Risk Management

How we see it

Risk management permeates everything we do and is intrinsic to the work of the Health Protection Agency . The Agency is committed to a strategy which minimises risks to its activities through a system of controls, whilst maximising the potential for innovation and best practice in the delivery of its objectives.

Within the Agency, risk is defined as anything which may have an impact on the achievement of its outputs. This can include opportunities as well as threats, related to both internal and external factors (partners, legislation) and includes tangible (staff, property) or intangible (reputation) elements of the organisation.

Risk management helps ensure the systematic, positive identification, evaluation and treatment of risks that pose a threat to the delivery of an organisation's outputs. It is an important component of our broader corporate governance arrangements and is reviewed annually as part of our assessment of compliance with the Department of Health Standards for Better Health (SfBH).

In essence, risk management is necessary to ensure that the effective management of opportunities enables the organisation to provide improved services, and that effective management of threats places the Agency in a stronger position to deliver its objectives.

Our Aim

Our desire is for the Agency to be an environment in which risk management is understood and where staff are both enabled and encouraged to assess and manage risks, report incidents, and to identify and pursue opportunities. Agency staff need to work collaboratively in the assessment and treatment of risks, both internally and with partners.

To achieve this, the benefits of risk management must be demonstrated through the production of information on risks and incidents, which meets governance requirements at Board level while providing appropriate feedback to users.

When Risks are realised

It is not possible to eliminate all risks to the Agency so the aim of risk management is to manage risk effectively. Despite effective management, risks can sometimes be realised. Business continuity plans set out the action to be taken if a key risk is realised, and we have a system for responding to adverse incidents or near misses. The latter ensures that we take every opportunity to learn and improve our risk management capabilities. Business Continuity Management (BCM) is an important part of how we fulfil our remit in responding to emergency situations that may arise. The HPA Centre for Emergency Preparedness and Response leads in this area.

Supporting our staff

The HPA Risk Management Function helps management by:

1. developing policy and strategy for risk management
2. building a '"risk management aware culture' within the HPA
3. facilitating staff training
4. designing and reviewing processes/procedures for risk management
5. co-ordinating and advising HPA staff on risk management issues
6. supporting management in the development of risk response processes
7. preparing reports and papers on risk for the Risk Management Group, the Integrated Governance Group, Audit Committee, and Board
8. maintaining a record of incidents, analysing them, and sharing lessons learned
9. maintaining the internal Risk Alert system

Providing Assurance

The Internal Audit Service provides a comprehensive, proactive and professional assurance and advisory service to the Agency. There are also a number of external assurance providers such as Clinical Pathology Accreditation, ISO9001 and UKAS which add to the assurance provided by management to the Board. Work carried out this year on SfBH has helped to develop an evidence based approach to assurance provision.

As a non-departmental public body, our chief executive is also required to sign off an annual statement on internal control. This covers how the HPA maintains a sound system of internal control that supports the achievement of the Board's policies, aims and objectives; whilst safeguarding the public funds and Agency's assets.

Risks to the Public

The HPA exists to protect the Public from many current and potential risks relating to health. Information on our activities can be found under the Key functions section.