Lancashire Combined Fire Authority

Audit Committee

Meeting to be held on 11 December 2025

Risk Management

(Appendix A refers)

Contact for further information – Esma Alicehajic, Senior Business Continuity and Emergency Planning Officer

Tel: 01772 866874

Executive Summary

Lancashire Fire and Rescue Service (LFRS) continues to strengthen its approach to organisational risk, aligning policy and practice with ISO 31000:2018 and National Fire Chief’s Council (NFCC) sector guidance. Risk management remains embedded within quarterly Executive Board and Corporate Performance Board discussions, enabling ongoing scrutiny, targeted mitigation, and informed decision-making. The updated Corporate Risk Matrix and summary register included at Appendix A reflects a stable overall risk position, with movements driven predominantly by organisational change, external environment, and developments in national fire sector context.

During this period, an internal audit of the Service’s risk management framework was completed, providing a reasonable level of assurance with no high-priority recommendations. Three recommendations were agreed, focusing on enhancing training, improving consistency in action setting and review, and standardising risk reporting. Work is now underway to address these areas, with implementation planned by April 2026 as part of the wider maturity trajectory.

Recommendation(s)

The Audit Committee is requested to endorse the Service’s current risk management arrangements, and note the latest position reflected in the Corporate Risk Matrix and Register.

Overview

The Audit Committee provides independent assurance on the adequacy of the Service’s risk management, internal control environment, and governance arrangements. Risk management remains a core component of organisational resilience, ensuring LFRS can anticipate, prevent, or respond effectively to events that may impact operational delivery, strategic objectives, financial sustainability, or reputation.

The Service continues to operate a tiered model for risk identification and escalation, with departmental risk registers informing discussion at Corporate Programme Board and Executive Board. Risks demonstrating wider organisational implications or thresholds beyond local tolerance are escalated to the Corporate Risk Register.

Current Risk Profile

The current corporate risk landscape remains largely stable, with no movement in the highest-scoring risks during this reporting period. Three risks continue to represent the most significant areas of exposure for the organisation: loss of funding, retention and recruitment of on-call staff, and the replacement of the existing mobilising system. These risks remain elevated due to the influence of long-term external factors and wider sector pressures, rather than deterioration in internal conditions.

The risk relating to loss of funding (2a) reflects continued uncertainty within the national public sector environment, including inflationary impacts and evolving government funding arrangements. While the Service continues to plan prudently, the external fiscal position remains fluid and is expected to shape this risk profile until national settlement trajectories stabilise.

The retention and recruitment of on-call staff (11f) remains a persistent sector-wide challenge. Labour market mobility, competing employment opportunities and changing workforce expectations continue to affect recruitment and availability. Local improvement activity continues, although the risk position remains unchanged until evidence of sustained improvement emerges.

The risk associated with mobilising system replacement (11g) reflects the reliance placed on mobilising systems to support operational response. The existing solution is approaching end of life and the transition to a replacement system introduces temporary vulnerability until full implementation, assurance and operational embedding are achieved.

Three new risks have been added since the previous reporting period. In addition to the mobilising system replacement risk referenced above, risks relating to unauthorised access, criminal damage or theft (11i) and failing pager messages (11j) have been introduced. Both relate to operational continuity and asset integrity and reflect emerging vulnerabilities identified during recent operational changes. Immediate mitigation measures have been implemented, and early indicators are positive; however, these risks will remain at the corporate level until stability is demonstrated and confidence in business-as-usual operation is established.

There has been one positive movement, with the lack of effective management of personal data in relation to pager messages risk (12b) being de-escalated to the Service Improvement departmental register following a period of increased stability and strengthened control. This represents effective mitigations, a maturing position and improved alignment with organisational tolerance.

More broadly, the risk landscape continues to be influenced by national themes including sector culture, professional standards, regulatory scrutiny, and public expectation. While these factors have not resulted in scoring changes this period, they remain relevant contextual considerations when interpreting overall exposure.

Overall, the risk landscape remains consistent and well-controlled, with targeted adjustments reflecting operational change, sector context and maturing mitigation rather than new or escalating threats.

Internal Audit Outcomes

The internal audit of Fire Risk Management (October 2025) concluded the Service has established strong foundations and is progressing positively. The report noted clear governance, a well-structured register, evidence of benchmarking, and increasing maturity of oversight and reporting mechanisms. The audit identified three areas for further development:

Theme	Agreed Forward Focus	Priority
Training	Embed risk management into induction and provide structured guidance for risk owners and Audit Committee members	Medium
Risk Register Consistency	Strengthen measurable mitigations, review cycles, and alignment across registers	Medium
Reporting	Introduce consistent reporting format showing trend, scoring, mitigations, and commentary	Low

Implementation activity has commenced, with early emphasis on aligning templates, increasing clarity on residual scoring, and preparing supporting materials for senior leaders and committee members.

Business risk

Failure to maintain an effective risk management system could result in significant operational, financial, legal, and reputational impacts, and undermine the Service’s ability to meet statutory duties and strategic objectives.

Sustainability or Environmental Impact

There are no identified impacts on sustainability or the environment.

Equality and Diversity Implications

There are no identified implications on equality and diversity.

Data Protection (GDPR)

Will the proposal(s) involve the processing of personal data?  N

HR implications

Improved consistency, governance, and reporting will support managers in managing risks proactively, reducing the likelihood of impact on personnel and improving decision-making confidence.

Financial implications

The risk management system supports financial planning, value-for-money assessments, and cost-benefit considerations linked to mitigation and acceptance of risk.

Legal implications

Well-governed risk management ensures compliance with the Civil Contingencies Act (2004) and strengthens organisational assurance in relation to scrutiny and accountability frameworks.

Local Government (Access to Information) Act 1985

List of background papers

Paper:

Date:

Contact:

Reason for inclusion in Part 2 if appropriate: Insert Exemption Clause

Appendix A: Corporate Risk Matrix and Summary Register

Appendix A

Corporate Risk Matrix and Summary Register

Risk ID	Sub Risk ID	Risk Cause	Triggers
1		Loss or lack of staff due to…	A widespread event or situation that leads to a significant loss of workforce ability to undertake normal business
	1a	Industrial Action	A local or national dispute with a major or multiple unions leading to staff undertaking partial performance or withdrawal of labour
	1b	Inability to recruit or retain key staff	Decline in available workforce due to a number of factors a. long term illnesses b. high level of retirement c. Service cannot offer competitive salary d. poor levels of recruitment  due to social, or financial pressures and capacity of current workforce to undertake promotion processes e. perception of service and culture discouraging applications  f. ineffective recruitment programme
	1c	Inability to provide sufficient staff in leadership roles	a. The ECR, delivered in 2024, resulted in an increase in the number of supervisory roles available.                                            b. The historical retirement profile has resulted in a large number of promotions over the years resulting in a reduced pool of staff available for promotion
	1d	Pandemic/ill-health epidemic	An ill-health epidemic or pandemic reducing ability of staff to attend or access to workplace, either due to their own illness, to prevent or reduce transmission and to care for dependants
2		Financial Pressures	Insufficient funding or unbudgeted cost pressures that financial sustainability and ability to maintain critical functions
	2a	Loss of funding	a. Government reduction of grant monies affecting income b. Change in Fair Funding Formula or Business Rates Retention impacting on LFRS share of funding c. Change in local or national economic circumstances resulting in reductions in Council Tax or Business Rates
	2b	Overspending and future financial pressures on MTFS due to increase in costs of goods and services and pay	a. Unexpected event that leads to rise in costs for goods and services and pay e.g. Fuel costs due to Ukraine war, Global recession b. higher than budgeted pay award
	2c	Future financial pressures on MTFS due to changes in legislation	a. Changes in building regulations resulting in higher costs than in our MTFS assumptions i.e. BREEM regulations b. New environmental targets resulting in increased costs in the future i.e. Net zero targets
	2d	Emerging risk associated with grey book pensions and overspending due to increase in costs and administrations associated with changes to pensions	a. Unexpected changes to the pension schemes due to court rulings.
3		Loss of Utilities	An event or situation, malicious or non-malicious, that causes a partial or total loss of a utility’s services
	3a	Telecommunications	Severe weather, Space weather, failure of equipment due to fault or malicious attack on national or local telecoms infrastructure at LFRS and/or North West Fire Control (NWFC). This could also be due to loss or withdrawal of contracts from suppliers.
	3b (i)	Power outage - Generally	Severe weather, space weather, failure of equipment due to fault or malicious attack on national or local power infrastructure or supply chains. Local or national demand is above capacity leading to Rota load disconnections etc.
	3b (ii)	Power outage - SHQ	Severe weather, space weather, failure of equipment due to fault or malicious attack on national or local power infrastructure or supply chains. Local or national demand is above capacity leading to Rota load disconnections etc.
	3b (iii)	Power outage - LDC	Severe weather, space weather, failure of equipment due to fault or malicious attack on national or local power infrastructure or supply chains. Local or national demand is above capacity leading to Rota load disconnections etc.
	3c	Water	Large scale failure of water company equipment due to fault or malicious attack on national or local processing and pumping infrastructure or supply chains, or failure of private company.
	3d	Fuel	Failure of equipment due to fault, incident, industrial action, or malicious attack on national or local infrastructure or supply chains. Geopolitical issues affecting access to fuel from international sources. Public behaviour (panic buying as a result of any of above scenarios)
4		Loss of ICT	Partial or total loss of physical or electronic/virtual ICT systems due to a fault, accidental damage, or malicious attack.
	4a	Cyber Security	Partial or total loss of electronic/virtual ICT systems due to a malicious attack.
	4b	Failure of key ICT systems	Partial or total loss of physical or electronic/virtual ICT systems due to a fault, accidental damage, or malicious attack.
5		Death or Serious injury of…	An incident that causes the death or serious injury of a person either in or interacting with the Service
	5a	A member of staff or contractor during work activities	An incident in the workplace related to general duties e.g. a member of staff involved in RTC whilst undertaking duties, slips trips and falls.
	5b	A member of staff during operational activities	An incident enroute to, on an incident ground or in operational training scenario e.g. falling debris.
	5c	A member of the public due to Service activities	An incident or situation that leads to the death or serious injury of a member of the public. During operational response, training activities or any other public interaction, or incident on Service premises.  OR Failure to appropriately assess, inform or safeguard the public from hazards and risks associated with fires
	5d	Death of member of staff, visitor, or contractor due to on service premises	An incident or situation on service premises or estate that leads to death or serious injury. Failure to provide appropriate risk assessment, first aid provision/ training, damaged or faulty equipment or buildings/structures.
	5e	Failure to identify and implement learning from past events.	Failure to properly investigate and implement actions following recommendations, from a near miss, death, or serious injury to mitigate risk for the future
6		Change in national legislation requiring additional workloads to assess implement and embed.	Change in national legislation requiring additional workloads, this might be due to a significant event requiring learning, new government initiatives or change in political landscape
	6a	Changes to Emergency Response Driver Training	Change in Fire Standard for Emergency Response Driver Training requiring additional workloads in training
8		Loss of Service Premises	An event or situation, malicious or non-malicious, that causes a partial or total loss of a fire service asset
	8b	Control room	Severe weather, physical or technical attack or failure, general damage to building, denial of access (e.g. Protests/ IA), failure of contracts with third party supplier (e.g. joint/co-located premises)
9		Failure to maximise opportunities	An event or situation that could provide an opportunity to improve the Service, which if not utilised could have a negative impact on the Service's progress
	9a	Technological advances	Failure to maximise the opportunities that technological advances present due to a lack of capacity within the ICT & DT department, and an inability of staff to keep pace with new developments that are implemented
10		Failure to manage incidents or staff conduct effectively, including inadequate handling of complaints or disciplinary processes, leading to loss of public confidence or reputational damage.	An incident or situation that results in loss of public or staff confidence due to employee conduct (in the workplace, personal life, or on social media), non-compliance with Service policies, the Core Code of Ethics, or EDI principles; compounded by negative media coverage or the Service's mismanagement of the response.
	10a	Failure to provide appropriate communications on events, situations or incidents that could lead to a loss of public confidence in LFRS	An event or situation relating to, loss of public or staff confidence due to Employee conduct at work, in personal life and on social media, failure to adhere to service policy/core code of ethics/ EDI and related negative press, or Sector events.
	10b	Failure to implement appropriate people processes in response to staff misconduct or complaints.	Allegations or evidence of staff misconduct (e.g., bullying, harassment, discrimination). Failure to act in line with Service Values, Core Code of Ethics, Staff Code of Conduct, or service policy. Delays or inconsistencies in investigations or decision making. Lack of transparency or perceived fairness in internal procedures
11		Operational	An event or situation that could impact on LFRS ability to respond effectively and efficiently.
	11a	Rapid external fire spread in high rise premises	An event or situation relating to lack of prevention, protection and operational response leading to a major incident.
	11b	Complete removal of DCP	A challenge from a Union to current local agreement.
	11c	Lack of required skills of operational staff	A situation where operational staff do not possess the required skill to operate safely at an incident
	11f	Retention, development, and recruitment of On Call staff	The failure to recruit and retain on-call staff caused by lack of on-call recruiting strategies, not being perceived as a desirable employer, not being competitive in pay rates, not providing enough flexibility to on-call staff with work arrangements.
	11g	Replacement of the existing mobilising system as current solution comes to end of life	The failure to recruit and retain on-call staff caused by lack of on-call recruiting strategies, not being perceived as a desirable employer, not being competitive in pay rates, not providing enough flexibility to on-call staff with work arrangements.
	11i	Unauthorised access, criminal damage or theft from stations, vehicles, or operational equipment, including during periods when staff may be present on site.	A spate of break‑ins nationally targeting fire stations or vehicles, including when crew are present or nearby.
	11j	Failing Pager messages	The failure of the Critico solution to notify on-call fire fighters of an incident.
12		General	An event or situation that could impact on LFRS
	12a	Major lack of effective Management of personal data	A situation or event caused by the lack of effective information management in LFRS