Ms Geraldine Larkin:

No, it is not a case of changing them if we see fit. We obviously have to evaluate the Indecon recommendations and put an implementation plan in place. Our executive has been recognised by Indecon as being under-resourced, due to the numbers that were removed from the organisation in recent years because of cost-cutting measures. Consequently, we do not have the facility to appoint a single individual with responsibility for risk and nor do we currently have the capacity to incur that additional resource. Therefore, the risk officer role is deployed through a risk management committee. That committee comprises the entire executive. The risk management committee has completed a risk register with three different gradings of risk. That risk register is then considered by the audit committee of the board and all high risks are considered at every single board meeting until they come down to an acceptable level.

The solution we have proposed is robust. It recognises the limitations of the resources we have available to us, but at the same time delivers a strong risk management policy. From the recommendations in the Indecon report, the key was that we manage the risk and ensure that key personnel have responsibility for addressing the risk as it arises under those areas. Ultimately, it is governed and controlled both by the audit committee in the first instance and by the board in total which has responsibility for it. There are layers of risk governance within that.