Decision details

The Head of Fund informed the Board that in view of the mitigating controls that were in place the risk ratings for O2 (Reliance on key persons and expertise) O3 (Risk Management) and T5 (External Drivers) had all been reduced. It was noted that I5 (Cash-Flow Management) continued to have a medium rating  though the Investment Panel, with the support of LPP, had reviewed the Investment Strategy with a view to recommending specific measures to mitigate this risk.

The Board also acknowledged that the risk rating for O7 (Data Protection and Cyber Security) had been increased on the basis that despite increased resources for Information Governance being made available at LPP it was considered that the transitional IT arrangements and the relatively short deadline for the implementation of the GDPR warranted the increase. It was suggested that consideration be given to purchasing specific insurance for cyber security or whether allocating those resources to additional internal controls would be more effective.

The significance of T3 (Investment Transition) was discussed and it was recognised that the situation would require careful monitoring to ensure that the expected reduction in fees/management costs were achieved and that this should be better articulated in the Risk Register narrative. It was noted that the transition was an ongoing process and during the last 18 months there had been an internal audit which identified some issues that had subsequently been addressed.

Resolved:

1.  That the report is noted.

2.  That in future the covering report regarding the Risk Register include an expanded narrative to explain key areas of progress.

3.  That an update report on the Risk Register is presented to the Board in April 2018 with particular emphasis on progress regarding those issues currently identified as being high risks.

4  That the report specified at 3 above also include an update on the risk assurance map developed by PWC to be reported to the Board in January 2018.