FiMT Governance Committee 7 Aug 2018 – Risk Register Discussion – Item 6 START Assess potential risks and impact Make risk appetite decision Introduce controls to mitigate risks Identify and deal with risk events Report and learn from risk events Regular assessment of status of risks Enhance controls to address Risk Management Cycle

Inherent Risk Rating Assessment (C) Risk Register – proposed enhanced version Risk Impact Ratings: A – Likelihood (1-5) B – Impact (1-5) C – Score (AB+B) Changes since previous version shown highlighted   15 points or more – Board action required 8-14 points – Board monitoring of actions and/or Exec Team actions required 7 points or less – Routine Exec Team monitoring required ID # Identified Risk A B Inherent Risk Rating Assessment (C) Existing Controls Status (incl. Any risk events) Action / mitigating plan Resp. Current risk (CEO assessment) Governance (through GC) G1 Unexpected loss of key people such as Chairman or CE 2 3 9 Deputy Chairman role created Informal arrangement with Alium for Interim CE at 48 hours’ notice Succession planning Regular review at GC meetings and included in Board reports Chairman and CE in role. Further recruitment underway to enhance executive team including Dep CEO. Complete recruitment for key executive vacancies. CE G2 Insufficient Board capacity or skills Directors selected for experience and knowledge relevant to FIMT needs. Succession planning considered by Governance Committee Resignations of Andrew Barnett (Independent) and Melanie Waters (COBSEO director). Board remains effective but sub-optimal so replacement board directors being sought. COBSEO requested to nominate new director. GC considering independent director vacancy. CE & GC

Risk Assessment Scoring Methodology (Recommended by Charity Commission) Impact Descriptor Score Impact on service and reputation Insignificant 1 • no impact on service • no impact on reputation • complaint unlikely • litigation risk remote Minor 2 • slight impact on service • slight impact on reputation • complaint possible • litigation possible Moderate 3 • some service disruption • potential for adverse publicity - avoidable with careful handling • complaint probable • litigation probable Major 4 • service disrupted • adverse publicity not avoidable (local media) • complaint probable • litigation probable Extreme/ Catastrophic 5 • service interrupted for significant time • major adverse publicity not avoidable (national media) • major litigation expected • resignation of senior management and board • loss of beneficiary confidence Likelihood Example Remote may only occur in exceptional circumstances Unlikely expected to occur in a few circumstances Possible expected to occur in some circumstances Probable expected to occur in many circumstances Highly probable expected to occur frequently and in most circumstances