Managing risk

Our corporate risks are focused in four areas that are critical to our strategic intention as an independent regulator to best serve the public good:

• Our relevance
• Our voice
• Our independence
• Our capability

Our relevance

Risk: We do not have credibility as a regulator.

Status: Green. Robust mitigations in place. We have good evidence of how we have retained our relevance as a regulator, for example, the pre-emptive guidance we have issued around the design and use of algorithms. The pandemic has been a primary focus but we now see the spectrum of public interest broadening again and we are strengthening our mitigations to be able to anticipate and prioritise where we can have greatest impact. For example, we have a new horizon scanning approach, and we are going to be drawing more systematically on the intelligence and expertise offered by our non-executive directors and governance structure.

Maintaining our voice

Risk: We do not say the right thing at the right time.

Status: Green/Amber. Robust mitigations in place but as we move into 2022/23 and continue to use our voice around sensitive and important issues, there is an increased risk that there will be more mixed views on the reasonableness of our judgements. Proactive and transparent engagement in support of evidence-led decisions will be important.

Maintaining our independence

Risk: We are perceived by stakeholders not to be able to operate independently as a regulator.

Status: Green/Amber: Robust mitigations in place and we have good evidence of increasing visibility and public confidence in our role as the statistics ‘watchdog’. We will inevitably be making sensitive judgements that leave us vulnerable to our independence being questioned but we are confident in our evidence-led approach grounded in the Code.

Building our capability

Risk: We do not have the skills, tools and resources to regulate and uphold the Code.

Status: Green/Amber: Robust mitigations in place. We are increasingly optimistic around our capability having filled key strategic roles this year, and seeing our development functions – research, data and methods, and policy and standards – grow and add real value to our work. We need to be more active in our succession planning and continue to develop our people – strengthening individuals’ confidence and skills to drive improvement to meet future needs, and our built-in resilience.

There has been one main engagement with Internal Audit this year: an internal audit of the Office for Statistics Regulation (OSR) Maturity Model. – our performance assessment framework for our 5-year strategic plan and the development of our capability as a regulator. Internal Audit awarded a moderate opinion, finding that while the overarching aim of the maturity model is clearly understood, there were aspects of the maturity model process that were not operating effectively and efficiently, and required ownership and accountability to ensure that it brings the desired value for OSR. We very much appreciated the insights offered by this report and rather than offer quick solutions, we took a fundamental step back to reframe the maturity model which has given us an approach that supports ownership by our senior leadership team and has strengthened engagement within the team. We provided a detailed report to Internal Audit in January 2022 on the range of activity we have undertaken to date and the steps we are committed to over the coming six months – including finalising our organisational Theory of Change – to satisfy ourselves that our evaluation framework is fully embedded in our planning cycle and providing an objective narrative on our performance and impact.