Date received: 18 December 2020
Date responded: 19 January 2021

You asked for:

1. Copies of the organisation’s most up-to-date Corporate Risk Register, including the date this was last updated.
2. Copies of any Brexit risk assessment or risk register carried out by the organisation.
3. Copies of the organisation’s most up-to-date corporate communications strategy.  Please include details of any planned announcements or releases of information, and anticipated dates of these.

SCoSS is able to provide some of the information you requested and where we could not we explain fully the reason for this.

1. Risk Register. I enclose a copy of all of the information you requested in the format you requested it in. SCoSS’s risk register is within the Annex.

The SCoSS Board agreed a risk register at its board meeting of 13 May 2020. A ‘risk register dashboard’, which contains any new, changing or high level risks, is presented to the Board on a quarterly basis along with the full risk register. A risk register status report paper, containing this information, was last agreed by the Board on 15 January 2021. The information provided in that paper is what is reproduced in the Annex below. (The paper was agreed by correspondence as there was insufficient time to consider the paper at the board meeting of 9 December 2020.)

The dashboard on the first page of the Annex summarises ‘red risks’ (risks with a risk score of 375 or above) and any risks where the risk score has changed since the risk register status report was last reviewed. The ‘impact’ and ‘likelihood’ risk ratings that produce the ‘risk score’ range from 5 (lowest) to 25 (highest) in increments of 5.

2. Brexit risk assessment. Section 17(1) of FOISA (information not held) requires SCoSS to notify you if it does not have the information you requested. SCoSS does not have the information you requested on any Brexit risk assessment or risk register carried out by the organisation. SCoSS’s risk register does not refer to Brexit as it is unlikely to significantly affect SCoSS’s ability to perform its statutory duties under the Social Security (Scotland) Act 2018. However, as noted, the Board keeps the risk register under regular review in order that it can respond to any significant developments. Further information on SCoSS and its statutory duties is available in its interim report.

3. Corporate Communications Strategy. As noted, Section 17(1) of FOISA (information not held) requires SCoSS to notify you if it does not have the information you requested. SCoSS does not have the information you requested on the organisation’s most up to date corporate communications strategy, details of any planned announcements or releases of information, and anticipated dates of these. SCoSS has not produced a corporate communications strategy detailing planned announcements and anticipated dates, however, the risk register notes the Board’s intention to develop a communications strategy. SCoSS publishes a limited number of reports each year (7 in 2020), primarily on draft regulations produced by the Scottish Government. It is for the Scottish Government to determine when it will submit draft regulations to SCoSS for scrutiny, and SCoSS cannot fully predict when this will happen. SCoSS also occasionally publishes corporate documents relating to its statutory functions when these are agreed by the Board.

I trust this information is helpful in satisfying your request under the Freedom of Information (Scotland) Act 2002 (FOISA), in particular where we have been able to fully provide the information requested.

Please do not hesitate to contact us if there is any further clarification required on the information we have provided.