Recommendation 29

Since November 2022, the Department’s programme risk register had included risks to quality, assessments and standards, yet the Department did not take sufficient action to check whether the risks were materialising, to prevent them from happening, or to escalate the risks appropriately. In November 2022, the Department recorded a risk that TrustMark might not carry out compliance checks on time or to the correct standard. It identified the risk as high impact but “very unlikely” to materialise and therefore judged it was a risk it could tolerate and not escalate to the portfolio level. In June 2023, it identified a risk that failures in the wider compliance and assurance processes could limit installation quality. It judged this risk was of medium impact and “possible” to materialise.64 The National Audit Office found that the Department did not have a dashboard reporting against key delivery risks, and that it only escalated these concerns to its Net Zero Buildings Portfolio Board in January 2025, once they had materialised as issues.65 Complicated and siloed quality assurance and consumer protection system