Skip to main content
English Cymraeg

Strategic Risk Management

FSA 24-03-08 - Report by Ruth Nolan.

1.    Summary

 1.1. This paper reflects the FSA’s approach to risk management, including identifying which responsibilities lie at Board, Audit and Risk Assurance Committee (ARAC) or Executive level (see Annex B), and provides the Board with an overview of the strategic risks being managed.

1.2. The Board is asked to:

  • Note and agree the FSA principal risks and the mitigations being progressed, and steps being made to manage the risks (see paragraph 3.1 - 3.6 and Annex A).

2.1. The FSA’s primary purpose is rooted in the management of certain risks in the food system. The FSA was formed following several high-profile outbreaks and deaths from foodborne illness, and works to protect public health, and consumers’ wider interests in relation to food. This means that risk considerations are always front of mind across the whole department.

2.2. The food system is complex and constantly evolving with developments such as new technologies around food production, logistics, shifting consumer habits and trading influences including online sales.

2.3. Despite ongoing geopolitical and economic factors food supply has stabilised in 2023. However, tensions globally and high inflation to pose a risk to the food supply chain and cost of living. Disruptions to oil supply and potential rising oil prices may also impact food supply and a rise in food prices. There are also issues linked climate and environmental events that may increase the risk from food pests and microbiological prevalence or resistance. Growth in novel foods or novel processes, such as alternative proteins, may carry a lower risk of some hazards but it is not always clear what new or increased risk may be associated with them.

2.4. The FSA also faces uncertainty in the year ahead as 2024/25 represents the final year of our Spending Review 2021 settlement, which provided a broadly flat budget across the three-year period, against a backdrop of increasing costs and high inflation. We will not know our budgets beyond 2024/25 until later in the year, making medium term planning difficult, alongside the inherent uncertainty caused by the general election which is required by January 2025.

3.    FSA Principal Risks and Uncertainties

3.1. The Board and Executive hold an annual risk workshop to identify and consider the risks and opportunities we face in the future, agreeing which risks pose the greatest threat to us successfully achieving our objectives and corresponding strategic risk tolerance and thresholds for the levels of risk exposure.

3.2. The principal risks the FSA faces in delivering food you can trust are summarised as the inability to:

  1. Effectively identify, prioritise, assess and act to prevent avoidable food risks harming consumers.
  2. Effectively and cohesively work across multiple nations of the UK and administrations to ensure consumers are well-protected despite potential food / feed policy differences between systems.
  3. Provide an appropriate response to a major food / feed incident to protect consumers from potential harm.
  4. Deliver our Official Controls functions in England and Wales for Meat to protect consumer safety and confidence plus wider implications such as food supply interruption, trade and animal welfare.
  5. Support Local and Port Authorities in delivering Official Controls reducing potential food safety risk to consumers and maintaining confidence by trading partners and consumers.
  6. Successfully utilise our resources and support our people to deliver the FSA Strategy benefiting consumers.
  7. Maintain delivery of our required duties to sufficient standard with allocated resources
  8. Maintain informative and influential relationships across government and internationally to advance consumer protection, now and in the future.
  9. Maintain confidence and trust from consumers, business, government and / or other stakeholders sustaining our ability to deliver our strategic objectives to protect consumers.

3.3. Each of our principal risks are owned by the appropriate Director/s and Deputy Director/s, all mitigations are timebound and reviewed quarterly (or monthly by exception). The key mitigations we have in place to manage our principal risks are summarised in Annex A. We have also set out where we are prioritising further work to enhance our controls.

3.4. It is not possible to eliminate all risks completely and some may arise from unforeseen circumstances.

3.5. It is not always possible, or necessarily value for money, to try to fully eliminate certain risks and some risks are inherent in the environment or the nature of the food industry. Our aim is to strike the right balance between minimising and manage risks to an acceptable level and the resources required to do so.

3.6. In line with our risk policy, we will continue to actively monitor and manage our risks taking appropriate action and providing assurance to ARAC.

4.    Conclusion

4.1. The Board is asked to:

  • Note and agree the FSA principal risks and the mitigations being progressed, and steps being made to manage the risks.

Annex A

Table showing principal risks and uncertainties and our approach to managing our risks and uncertainties.

 

 

Principal risks and uncertainties

Our approach to managing our risks and uncertainties

1. An inability to effectively identify, prioritise, assess and act to prevent avoidable food risks harming consumers.

Direction of risk change:

 

  increasing

Increasing

The FSA protects consumers by working closely with the lead Public Health Authorities (PHAs), Local Authorities (LA), and others to coordinate the response to foodborne disease incidents and outbreaks.

Surveillance in general across the FSA remains critical to our role and therefore we have established a flexible, responsive, data-enabled science, evidence and surveillance approach to harness the power of data science to identify emerging risks before they become risks to public health, using a variety of data sources.

The Incidents and Resilience Unit Prevention team, c.5 staff, monitors signals which are any possible risks to the UK food chain identified by using predictive surveillance systems such as the Signal Prioritisation Dashboard. This uses Artificial Intelligence technology to scan key international open data sources (including the EU’s Rapid Alert System for Food and Feed) to identify relevant information, download, interpret and configure the information into food safety risks to improve the situational awareness of risk within the food chain with an aim of incident detection and prevention. The team works closely with incidents teams and stakeholders to identify root causes of incidents, and to identify emerging and recurring risks where prevention strategies are required to mitigate the risks.

The FSA has recently seen improvements in how intel / information being handled by teams is shared across the FSA to make sure any risks identified are managed and co-ordinated action taken. Much of this work is being led by Regulatory Compliance Division (RCD) LA Intel Co-ordination Team, 6 staff, who chair an Intelligence Considerations Forum with broad FSA membership. The intel managed through this group helps the FSA have a consistent understanding of risks to the food/feed supply chain at any given time. Co-ordinated activities can include controls at ports, LA controls (as part of the standards delivery model), food/feed sampling activities, National Food Crime Unit (NFCU) actions, incidents response, incident prevention activities, as well as targeted action which focuses on consumer, industry and LA messaging, all of which is carried out to protect consumers.

Our Science Evidence and Research division (SERD) along with the RCD - Imports Delivery team, undertake surveillance sampling to identify emerging risks and monitor food safety and standards. The results of surveillance sampling inform the direction and funding of LA /PHA official control sampling funded by the FSA, such as RCD’s Directed Food Standards Sampling Programme. The purpose of which is to bring businesses into compliance, reducing the risk to consumers. Furthermore, risks identified through surveillance sampling are shared with LAs / PHAs and industry to inform their own sampling programmes. In total approximately £1.5m was spent in the 2023/24 Financial Year on targeted surveillance and directed food sampling.

We draw on intelligence and information from a number of sources, including through the use horizon scanning and strategic assessments to look ahead to see what is coming and our NFCU detects, investigates and disrupts serious fraud and criminality within food supply chains.

The FSA’s Risk Analysis Process captures the capabilities and processes in an end-to-end service by which a food risk is identified, assessed and mitigated (managed and communicated). This process also forms the basis for authorisation of Regulated Products. To ensure that the high standard of food safety and consumer protection is maintained, our risk analysis process is kept under review to ensure regulatory effectiveness. During 2024/25 we will be making improvements to our service including - increased use of other regulators’ opinions (subject to legal advice), improved process for routine and complex risk assessments and development of our case management system. In addition, we will act upon recommendations from the Board Subgroup to inform our future plans for regulated products.

2. An inability to work effectively and cohesively across multiple nations of the UK and administrations to ensure consumers are well protected despite potential food / feed policy differences between systems.

Direction of risk change:

 

  Stable

Stable

The FSA works with UK regulatory partners, Wales and Northern Ireland governments and with Food Standards Scotland (FSS) and the Scottish government to ensure that the UK food / feed regulatory regime continues to provide strong protection for consumers. Inevitably, there are areas where different political priorities and viewpoints among the four administrations will occur. These changes have the potential to negatively affect four-nation collaborative working relationships and can create difficulties for businesses trading across country borders, it is the FSA’s aim to manage differences in policy, where possible.

The FSA is party to three cross-government UK Frameworks. These put in place commitments to joint ways of working and seeking consensus on changes across the UK, while recognising that often businesses trading across the UK require consistency and that consumers require equal levels of protection. UK frameworks also recognise that UK Ministers can make different decisions from one another, where it is agreed on a four-nation basis that this is appropriate and supported by evidence.

Internally, our commitment to a ‘one FSA’ approach ensures that collaboration across the FSA offices in England, Wales and Northern Ireland is embedded in our ways of working. Recognising that the outworking of the EU through subsequent legislative changes such as the Windsor Framework, UK Internal Market Act etc, has presented more challenging circumstances for the FSA, we build on a strong history of close working relationships between teams in the three countries and with FSS. Examples of this include our dedicated incidents teams in the three nations, who work closely together as well as with FSS and, where necessary, with the Food Safety Authority of Ireland, to ensure consumers across these islands are protected. Our communications teams ensure that messaging and campaigns are consistently delivered across the three nations, tailoring to the unique requirements and considerations of their respective landscapes, ensuring a local voice at all times and that Wales and Northern Ireland are adequately represented by our operations. We engage closely with the Northern Ireland Assembly and Welsh Government and ensure that we meet our commitments and ensure that developments and decisions are appropriately agreed and communicated, including to our Board. We also deliver some additional responsibilities, such as Food Compositional Standards and Labelling in Wales and Northern Ireland, and Nutrition-related Labelling, Composition and Standards in Northern Ireland. In Wales we are also committed to the Welsh Language Act, and to providing a meaningful bilingual service to consumers in Wales.

3. An inability to provide an appropriate response to a major food / feed incident to protect consumers from potential harm.

Direction of risk change:

Stable

Stable

The FSA has well-established contingency and resilience arrangements to respond to a major food or feed safety incident. Lessons learned reviews from real incidents as well as Winter Planning activity, provide us with valuable learning to strengthen our resilience and improve our response standard operating procedures and is used to inform our annual exercise and training programme that supports the continual improvement of our organisational resilience. We have a team of c.50 staff working to support food incidents and have robust contingency plans in place, we have a flexible workforce to draw on when required, through a number of trained volunteers outside of the incidents team.

During the year we deliver emergency preparedness exercises and training activities of varying complexity and scope. These included cross-departmental and statutory exercises, providing the FSA with an opportunity to walk through, validate and further improve our procedures at a tactical level.

This approach enables us to invoke our incident response and emergency protocols efficiently; deliver an appropriate response to a food incident; and enable the organisation to return to our normal operations as quickly as possible. However, a response to a large-scale food-borne incident (on a scale similar to the pandemic) the FSA would face significant challenges to respond in such a comprehensive way. We also hold concerns regarding official laboratory capacity and capability to cope if sampling activity required in respond to the incident.

There is a risk that during the Borders Target Operating Model (BTOM) implementation period there will be an increase in detection of non-compliance with the new BTOM requirements and that this might also result in an increase in food safety incidents. We are taking this into account as the new requirements roll out and anticipate that the number of technical non-compliances may rise due to a lack of familiarity with new forms and procedures. In addition, as checks will begin to be carried out on commodities that have previously entered unchecked that we may also identify an increased number of food safety incidents as we increase the volume of checks. This means that there is a potential risk that the FSA, PHAs or LAs could be unable to respond to all incidents in an effective and proportionate way. These risks will be mitigated by using learning from the 31 January implementation of the use of Import of Products, Animals, Food and Feed System for EU notifications and the requirement for Export Health Certificates for Medium Risk Products of Animal Origin and using an education and of a graduated approach to implementation and engagement with Competent Authorities in the EU. This work is led by Defra and working closely with the PHAs by both Defra and the FSA to ensure that staffing will be at the appropriate level.

To continue to build on our preparedness and resilience the FSA commissioned a Risk and Crisis management review, to better understand its capability and maturity in strategic risk and crisis management. Recommendations from this review have been used to establish an action plan with remedial work now underway to further enhance our approach to emergency management.

4. An inability to deliver our Official Controls functions in England and Wales for Meat to protect consumer safety and confidence plus wider implications such as food supply interruption, trade and animal welfare.

Direction of risk change:

Increasing

Increasing

In England and Wales, FSA deliver Official Controls in FSA approved meat establishments (c.915) full and partial audits, wine producers (c.2200) and on-farm dairy establishments (c.7800).

The FSA’s approach to direct delivery of regulatory controls involves a split between (c.330) FSA-employed people and (c.600) contractors via a Service Delivery Partner (SDP). The SDP is currently the only employer of our Official Veterinarian (OV) cohort and more than 50% of our Meat Hygiene Inspectors (MHIs). The FSA, via its contract management arrangements, continually monitors the capacity and capability of the supplier to undertake their contractual obligations and uses Key Performance Indicators to identify non-compliances and service failures (for which there are financial penalties).

The current sector wide difficulties in recruiting and retaining veterinarians adds challenges to the delivery of Official Controls for which we are directly responsible. Recent changes to increase the earning thresholds for immigrant workers, could increase this risk particularly with our use of OVs and MHIs recruited overseas by our SDP. Approximately 98% of OVs and 48% of MHIs are recruited from overseas for both FSA and the SDP.

The FSA has established the Veterinary Resourcing Programme following an update to the FSA Board in June 2023 on the current risks to veterinary supply and the work we have been doing with the Royal College of Veterinary Surgeons (RCVS), our current SDP and across government to mitigate these. The programme aims to maintain and secure OV resources to deliver Official Controls in abattoirs in England and Wales from 2025, whilst creating greater political visibility and public awareness of the systemic shortage of veterinarians in the UK and globally. We are making good progress in reducing our reliance on the RCVS’s Temporary Registration scheme, which allows qualified veterinarians to practice under supervision in meat plants whilst they undertake technical and English language training. This scheme is available to the FSA until December 2024 and the percentage of Temporary Registered Novice OVs continues to reduce, down from 33% in June 2023 to 21% in October 2023. However, the mitigations we are progressing does not guarantee we can fully mitigate the risk due to external factors that could impact the delivery of Official Controls.

The FSAs current SDP contract is entering the final extension period and during 2024/25 we will run a fair and open contract retender process. However, the increased difficulties in securing resources from overseas and the expected changes to minimum migrant salaries may significantly increase the cost of the next contract and impact bids from suppliers. The situation could risk our ability to deliver official controls for the meat sector and negatively impact FSA industrial relations as well as reduce our resources currently allocated to other priorities.

5. An inability to effectively support Local and Port Authorities in delivering Official Controls reducing potential food safety risk to consumers and maintaining confidence by trading partners and consumers.

Direction of risk change:

increasing

Increasing

The food system is complex, and its regulation involves multiple bodies. The FSA operates in England, Wales and Northern Ireland and has different responsibilities within these countries. Food and feed law places reliance on others to deliver many regulatory functions and we need to work closely to ensure service / consumer protection are not compromised.

-    LAs specifically cover food producers, food processors, catering establishments, takeaway and food delivery, retailers and approved dairy, and meat and fish establishments.

-    FSA and LAs together deliver shellfish official controls.

-    LAs and PHAs in England, LAs and the Animal and Plant Health Agency in Wales, and LAs and Department of Agriculture, Environment and Rural Affairs (DAERA) in Northern Ireland are responsible for imported food controls.

-    Feed controls are the responsibility of LAs in England and Wales, and DAERA in Northern Ireland.

We continue to monitor the performance of LA’s regarding their delivery of official food controls through analysing data from their returns, LAs are facing increased pressures and financial challenges, and some are struggling to deliver official controls. The December 2023 FSA Board Paper outlined some of the challenges LAs are currently experiencing exacerbated by the lack of officers in LAs to undertake official controls. The Board agreed that we will continue to support food teams in addressing problems and be assertive in ensuring LA leaders are aware of their statutory duties, including through escalation where needed. As part of this approach, we wrote to all LA Chief Executives and c.150 Finance Officers to set out our concerns about resourcing and delivery, and to remind them of the statutory nature of official food controls when considering and setting budget allocation for the next financial year.

We will be rolling out a new food standards delivery model that will take an intelligence led approach allowing LAs to focus their resource on the greatest areas of risk. This will be on an incremental approach for LA in England and Northern Ireland to implement the model over 12 months from April 2024. A pilot of the model in Wales concludes at the end of February 2024 and will be then subject to a period of evaluation and consideration before any next steps re any wider implementation across Wales.

We are also preparing to consult on amendments to the Food Law Code of Practice relating to food hygiene delivery model in Autumn 2024 that extend the use of Regulatory Support Officers, allow the use of remote assessment and other flexibilities in specific circumstances and to implement triaging of businesses due official controls.

In November, we published research that we commissioned into LA Capacity and Capability across feed, food hygiene and food standards. It outlines multiple and complex contributing factors to a shortage of qualified and competent officers to deliver official food and feed controls and broader regulatory services. The research also helped us to identify that as well as the shortage of existing officers to deliver official controls, there is also a shortage in people training to work in environmental health, trading standards and broader regulatory services.

We have set up a project to address the findings of the research. We acknowledge that the FSA cannot fix the problem of LA resourcing, particularly as some of the issues relating to funding of LA and terms and conditions of service. However, the project will directly address findings from the research that are within our control. We will review our approach to suitable qualifications, including more flexible and modular routes to qualification. We will also review our competency framework for officers so that Lead Officers can spend less but better quality time on assessing officer competence and we will review our learning and development offer for LAs and explore if there are options for us to encourage more people into a career in food regulation. We will also be working across government, with professional bodies and with industry to voice our concerns to governments, parliamentarians, and elected council members and to consider solutions to shared problems, pooling resources where possible to take affirmative action.

Through the Achieving Business Compliance Programme, we are also testing out new models for future regulation, including the trial of enterprise level regulation, on which the Board will discuss next steps in June 2024. We are also working on other mechanisms to improve business compliance, such as our Food Safety Charter with online aggregators.

However, while our efforts to mitigate this risk are substantial, it is important to acknowledge that complete mitigation is not achievable due to our reliance on others to deliver regulation.

6. An inability to successfully utilise our resources and support our people to deliver the FSA Strategy benefiting consumers.

Direction of risk change:

 

Decreasing

Decreasing

There are ever-increasing constraints on resource that all parts of government face. The FSA will continue to focus on improving its effectiveness and efficiency, ‘leveraging great impact from small resources’. This includes ongoing development of our planning, performance, financial, risk, and prioritisation capability.

We continue to create an environment in which our people are highly capable, effectively supported, and choose to make outstanding contributions to protecting, informing and empowering consumers and to successfully deliver the FSA’s strategic objectives. Our People Plan sets out how we will improve as an employer and the benefits this will bring us, the businesses we regulate and the public whose health we protect. It is our map for attracting the best people to our teams, helping colleagues grow and develop in their work, and for ensuring we become known for our great culture. In year one we have:

-    reviewed our pay and benefits offer leading to more positive perception in the 2023 Civil Service People Survey.

-    refreshed and promoted our ASPIRE values ahead of our next culture enquiry.

-    developed our FSA management charter, to be rolled out and embedded from April 2024.

-    made progress in integrating wellbeing into our working environments, both in front-line and non-frontline environments.

-    completed our strategic capability skills forecast to inform Strategic workforce planning and corporate development plans.

-    developed our leadership and management development framework for launch in early 2024/25.

-    rolled our Phase 1 of the Connect programme by introducing Workday.

-    improved our approach to corporate planning and prioritisation.

We will continue to build on these throughout year two and three by enhancing people management capacity, introducing corporate development planning, evolving our approach to succession planning and talent management, and supporting development of Government Veterinary Profession Graduate Programme.

7. An inability to maintain delivery of our required duties to sufficient standard with allocated resources.

Direction of risk change:

Stable

New risk

 

The uncertainty of current and future economic conditions could have a significant impact on our ability to deliver and maintain standards in delivering our statutory duties. This could be driven by upward cost pressures (increased pay for civil servants, contractor costs and other non-staff costs), uncertainty with the upcoming general election and the next Spending Review, or possible impact of headcount limits which are being introduced to all government departments.

Preparations for the next Spending Review are underway with planning sessions held across the FSA to understand the scope and develop clear proposals. The Spending Review play a crucial role in ensuring that we use our resources efficiently, prioritise key areas of work and align our monies with our strategy. It will be vital for the FSA to continue cross-departmental collaboration to demonstrate the value of our work to protect consumers. We will continue to maintain positive relationships across HM Treasury and Cabinet Office, enabling the FSA to be best placed to influence plans and thinking in the early stages.

We constantly review delivery of our priorities as a collective and remain agile to ensure our resources are in the right place. The main forum for this is the quarterly review process where the Chief Executive and Director of People and Resource hold individual session with each director to understand progress of delivery of against the annual plan, financial forecasts and risks and uncertainties being managed. This then allows collective consideration of our delivery and rebalancing of resources if required.

The FSA Board and Business Committee play a critical role in setting our priorities and are regularly engaged to consider how changes in the external environment and uncertainty are impacting on our priority activity and resource allocations. The three-year corporate plan, alongside the annual business planning for 2024/25, have been designed to aid prioritisation and provide a ‘medium term’ forward look of the main activities we aim to deliver over the next few years.

8. An inability to maintain informative and influential relationships across government and internationally to advance consumer protection, now and in the future.

Direction of risk change:

 

Stable

Stable

It is vital that we are able to influence Governments effectively in Westminster, Wales and Northern Ireland, as well as internationally, to ensure that our work is understood, supported and that we are able to achieve change that benefit consumers.

During 2024 we will keep alive to proposals across government and other announcements related to FSA policy and the wider food system, planning for what impact this would have on the FSA. We are engaging with government and Parliamentary stakeholders across all three nations, including in the reformed NI Assembly, on a range of issues relating to food standards, hygiene and controls, as well as on wider consumer protection matters. We have a programme of engagement to drive awareness, understanding and support for both our existing work and our planned reforms, for example, in Regulated Products.

The FSA Board set out a clear set of principles to guide FSA officials’ input to trade policy and trade negotiations and we provide respected expertise into lead departments to inform negotiations of Free Trade Agreements. Monitoring international developments aids early intelligence and analysis on issues which could have an impact on food safety risks for consumers.

9. An inability to maintain confidence and trust from consumers, business, government and/or other stakeholders sustaining our ability to deliver our strategic objectives to protect consumers.

Direction of risk change:

 

Stable

Stable

 

Failing to influence and engage effectively with a wide range of stakeholders would risk our pledge to put consumers first in everything we do. Trust and confidence (of consumers, media, government, industry, partners) are central to us achieving our outcomes for consumers.

One of the foundations of trust in the FSA is our use of evidence, openly published and well communicated. We use science and evidence to come to our decisions, and are seen to be open, honest, independent and inclusive. A single incident or a major campaign where we are seen to not be playing the required role or do not provide proportionate advice and information that is not science based or impartial, could jeopardise the trust in FSA and adversely affect our reputation. Our public communications and stakeholder engagement work is designed and targeted in order to build and maintain trust amongst our different audiences. This includes providing accurate, evidence-led information for consumers about food safety and hygiene, driving awareness and understanding of our policy making amongst business and government.

An example of how we build trust with consumers if through maintaining the integrity of the Food Hygiene Rating Scheme (FHRS) in partnership with LAs across England, Wales and Northern Ireland. The scheme provides information to the public on the hygiene standards in food premises. Businesses in Wales and Northern Ireland are required by law to display their rating stickers at their premises, and in England, display is currently voluntary.

Annex B

Risk Management Policy and Framework

2.    The Board is responsible for setting the FSA’s strategic risk tolerance / appetite, agreeing the thresholds for the levels of risk exposure, and ensuring that an appropriate risk management strategy is in place. The Board also provides a strategic view on the FSA’s principal risks and reviews the risks annually.

3.    ARAC has oversight of the FSA’s approach to, and assurance over, the risk management delegated from the Board and, in its non-executive capacity, advises the Board and CEO on the strategic processes for risk management, including reviewing the strategic risks and ratings, considering the risk appetite, and providing oversight of the effective application of appropriate controls and processes.

4.    The Executive formally oversees operational risk management as part of our risk management cycle and considering risk in all strategic and Executive decisions.

5.    Our strategic risks are reviewed by relevant senior leaders quarterly (or sooner by exception), ensuring that the level of risk exposure is monitored closely in the changing environment we operate in, updating the Executive to provide strategic oversight.

6.    ARAC are presented quarterly with a summary of the latest risk review alongside the strategic risk dashboard, and as appropriate, are consulted regarding process changes / improvements. To supplement this process our principal risks are also subject to periodic in-depth reviews, presented to ARAC to evaluate and challenge.

7.    Adding to the Board’s strategic and corporate risk roles, the Board’s Business Committee has a key role in high-level oversight of operational matters which includes identifying and monitoring operational and delivery issues, ensuring that ARAC is informed if these risks could become a strategic concern.

8.    The latest Orange Book guidance published in 2023 included a new Risk Control Framework section providing further granularity in relation to the control of risk. We have reflected this in our own risk management processes to enhance our risk and assurance controls.

 

UK Government - Orange Book ‘three lines of defence model’