Recommendation 2

The pandemic has demonstrated variability in departments’ risk management. A recent cross-government review of risk management by the Government Internal Audit Agency highlighted significant variability across departments, including the 6 Government preparedness for the COVID-19 pandemic: lessons for government on risk extent to which senior leaders promote and support risk management, departments’ capabilities, and their degree of alignment to the Orange Book, the government’s guidance on risk management. We are surprised that there are no uniformity in government’s high-level alignment with the Orange Book and a seeming lack of appreciation for the principles of the three lines of defence model. Before the pandemic, departments lacked an agreed understanding of risk tolerance, such as which consequences of a pandemic they deemed acceptable and which consequences they needed to mitigate. It is only after departments started responding to the crisis that they reached a shared understanding of the objectives and priorities they should focus on. Recommendation: The Cabinet Office and HM Treasury should set out what they intend to do to ensure that there is sufficient uniformity in department’s high-level interpretation of and alignment to the principles of the Orange Book. As part of this, the Cabinet Office should set out how it will ensure that departments have a shared understanding of the government’s tolerance for the impacts of major risks, including what levels of impact are acceptable and what levels of impact require mitigation.