The Audit and Performance Committee of Westminster Council met on Tuesday 30 June 2026 to review the council's financial performance and position for the 2025/26 year. The committee was scheduled to discuss year-end financial reports, including revenue and capital outturns, treasury management, and workforce updates. A significant item on the agenda was the investigation and impact of the November 2025 cyber incident, alongside the committee's own annual report.

Year-End Performance Report 2025/26

The committee was scheduled to receive a comprehensive overview of the council's performance at the end of the 2025/26 financial year. This report presented Key Performance Indicator (KPI) results across all directorates, highlighting achievements and challenges. Of the KPIs monitored, 69% met their target, 16% narrowly missed, and 15% did not meet their target. The report also included an overview of the 2025 City (Residents') Survey results, which indicated overall satisfaction with the council remained strong, though it had decreased for the third consecutive year. Satisfaction with core services remained high and consistent. The report noted that all council systems had been restored following the cyber incident, though some KPIs had not yet returned to pre-incident levels due to the reversion to manual business continuity arrangements.

Year-End Finance Monitor 2025/26

This report detailed the city council's financial position for the 2025/26 year. The General Fund revenue outturn was an overspend of £8.2 million (3.9%) against an approved budget of £213.4 million. This was primarily driven by pressures in temporary accommodation and children's social care, partly offset by increased parking income. The Housing Revenue Account (HRA) outturn showed an overspend of £2.1 million, attributed to new legislative and regulatory requirements. The General Fund capital outturn was an underspend of £92.9 million against a revised budget of £374.2 million, with the HRA capital outturn also showing an underspend of £39.6 million against a budget of £216.3 million. The report noted that inflationary pressures, including a 3.2% pay award compared to a budgeted 2.8%, had contributed to increased costs.

Treasury Management Strategy Outturn 2025/26

The committee was scheduled to review the annual treasury management final outturn for 2025/26. This report covered the council's investment portfolio, borrowing strategy, compliance with treasury and prudential limits, and an economic update. The council's net cash invested decreased from £109.3 million at 31 March 2025 to £262.6 million at 31 March 2026, reflecting the use of internal borrowing to fund the capital programme. Investment returns remained robust despite Bank Rate reductions. The council's borrowing at 31 March 2026 was £569 million, within the Prudential Indicator for external borrowing. The report noted that the council had exceeded its Operational Boundary for debt but remained within the Authorised Limit.

Workforce Update 2025/26

This report provided a strategic overview of Westminster's workforce as of the end of the 2025/26 financial year. It covered workforce demographics, pay gaps, staff engagement, and key workforce indicators. The council reported continued progress in building a more representative workforce, with an increase in staff from global majority backgrounds and female representation at senior levels. The gender median pay gap was 6% and the ethnicity median pay gap was 10% as of March 2025, with provisional data for March 2026 indicating further reductions. The Our Voice staff survey 2025 showed an engagement index of 80%, an increase from previous years and above local government benchmarks.

Cyber Incident - Investigation and Impact

The committee was scheduled to assess the council's response to the major cyber incident first reported on 24 November 2025, which impacted Westminster City Council, the Royal Borough of Kensington and Chelsea, and the London Borough of Hammersmith & Fulham. The report detailed the immediate response, including system isolation and the engagement of external cyber incident experts. It noted that while a limited amount of data was exfiltrated, none had been published or misused to date. The report highlighted that 95% of systems were restored within 12 weeks, with all systems back online by April 2026, comparing favourably to other local authority incidents. The report also outlined lessons learned and planned security improvements, including enhanced staff training and the exploration of a Zero-Trust architecture.

Annual Report of the Audit and Performance Committee 2025/26

This report summarised the work of the Audit and Performance Committee throughout the 2025/26 municipal year. It detailed the committee's activity, including reviews of audit, risk management, financial reporting, and performance monitoring. The report noted the committee's consistent delivery of robust scrutiny and its commitment to upholding strong internal controls. It also highlighted the role of the Independent Committee Member, Mark Maidment, and the effectiveness of the council's internal audit and fraud service delivery models. The committee reviewed the 2026/27 Internal Audit Plan and received assurance on the council's governance, risk management, and control arrangements. The report concluded that the committee had consistently delivered robust scrutiny and would continue to evaluate risk management and promote best practices.