The Audit, Standards and Statutory Accounts Committee met on Thursday 02 July 2026 to review the external audit of the 2025-26 accounts, discuss the council's governance arrangements, and receive an update on the strategic review of risk management. Key decisions included noting the completion of the 2024-25 accounts, approving the proposed Annual Governance Statement for 2025-26, and noting progress on the updated risk management approach.

Update on Accounts and External Audit of 2025/26

The committee received an update on the external audit of the 2025-26 accounts. Alicia Attoe, Chief Accountant, confirmed that the draft accounts for 2025-26 had been published in line with the statutory deadline. Adrian Barmer from Ernst & Young (EY), the external auditor, was present to answer questions.

A key discussion point was the impact of changes in central government funding on the council's finances, as detailed on page 74 of the reports pack¹. EY confirmed that their advice was based on their independent assessment of the evidence available. Councillor Anton McNulty-Howard raised concerns about the council entering into contracts without a clear understanding of the costs involved, referencing the arrangement with PSAA² for audit services. EY explained that PSAA acts as a central contracting body, and fees are subject to arbitration and benchmarking.

The committee also discussed the overall financial statement risks for the council, which EY noted had not changed significantly year-on-year. These risks include material judgments and valuations, pensions, inappropriate capitalisation of revenue expenditure, and management overrides. EY expressed confidence that the council was in a strong position to achieve an unqualified audit opinion for the 2025-26 accounts, a testament to the work done by both EY and council officers.

The committee noted the completion and publication of the 2024-25 accounts, EY's 2025-26 audit planning report³, and the fees update.

Review of the Council's Governance Arrangements

Andrew Hamilton, Chief Audit Executive, presented the annual internal audit report and the proposed Annual Governance Statement (AGS) for 2025-26. He stated that the council's governance, risk management, and internal control arrangements provide reasonable assurance. The majority of assurance reports received a reasonable opinion, with two receiving substantial assurance. There were no limited or no assurance reports issued.

Hamilton highlighted that many audit findings related to the implementation of existing controls rather than the absence of controls, often due to human error. Five priority one recommendations were made, primarily concerning billing and debt monitoring, service monitoring, regulatory compliance, and cost recovery. Management accepted all these recommendations.

Recurring themes in the audit work included issues with the implementation of controls, governance and oversight, monitoring and performance reporting, contract management, policy and procedure maintenance, and key financial controls.

Councillor Carey Bishop inquired about the reasons for inconsistent control implementation, to which Hamilton attributed it to human error. Councillor John Coombs noted the number of reasonable rather than substantial assurance opinions and questioned if this should guide future audit work, particularly concerning income generation within the transformation programme. Tanya Kalisha, Audit Manager, confirmed that debt collection is a focus for the current year's audit work.

Concerns were raised about the deferral of audits due to the implementation of new IT systems and their impact on service capacity. Hamilton assured the committee that audit teams are involved in project boards for new IT systems to help shape controls.

The AGS, which is a formal statement on the effectiveness of the council's governance arrangements, identifies several significant governance issues requiring ongoing management and attention. These include information and cyber security, organisational capacity and workforce sustainability, contract management and third-party assurance, major projects and project management, financial sustainability and transformation, and the ongoing implementation of the risk management framework. Hamilton clarified that these issues are included because they are areas of strategic importance requiring continued oversight, not because governance has failed.

The committee was asked to note the council's statutory annual review of its governance arrangements, note the annual internal report, and approve the proposed Annual Governance Statement for 2025-26 for signature and publication with the council's accounts.

Update Report on Strategic Review of Risk Management

Paul Guilliotti, Director of Financial Services, introduced the report on the strategic review of risk management. He explained that the council has evolved its risk management approach from a list of specialists to a more integrated process, supported by a digital platform. The report outlines 13 corporate risks identified through this process, which are considered to have fundamental challenges and difficulties if things went wrong across the whole borough.

Guilliotti highlighted that some risks, such as geopolitical risks, are outside the council's control. The new approach incorporates inherent risk, controls, residual risk, and risk appetite. The council is now monitoring risk appetite to understand the level of risk it is willing to accept.

Councillor Carey Bishop asked about making workshops compulsory for embedding the new process. Guilliotti stated that while workshops are offered, the focus is on the digital platform's usage and evidence of change, rather than workshop attendance. He noted that Executive Directors are required to sign off departmental registers, providing greater oversight.

Councillor Anton McNulty-Howard questioned the process for embedding risk management with councillors and lead members. Guilliotti stated that this should be part of existing project risk registers and project boards, where councillors can ask questions about governance and milestone achievement.

Councillor Andrew Duncan raised concerns about the high-level nature of the corporate risk register, suggesting that sub-categories might have different scores and that averaging them could hide specific risks. Kevin Holland, Assistant Director of Fraud, Risk & Insurance, explained that the digital platform is still in its infancy and will provide more granular detail as it develops. He also addressed concerns about risks being exaggerated for funding, explaining the three-tier review process (service, departmental, corporate) and peer challenge mechanisms.

Councillor James Chard commented on the transformation programme's risk scores, suggesting they appeared low given the programme's potential impact on financial stability and service delivery. Guilliotti responded that the scores reflect the current status and that they should be challenged if things begin to go awry. Chard also raised the risk of political decisions being delayed or fudged due to political interest in the transformation programme. Guilliotti acknowledged this as a valid point, noting it is recognised as a governance issue.

The committee was asked to note and comment on the corporate risk register and note progress with updating the council's risk management approach and digital platform.

Committee Work Programme

Andrew Hamilton, Assistant Director of Audit Shared Service, discussed the committee's work programme. He noted that the transformation programme is a significant risk and that an audit is ongoing into its governance arrangements. He suggested that findings would be reported in an update report unless there were significant issues or priority one findings, in which case a full report would be presented. A similar approach was suggested for the Twickenham Riverside audit. The committee agreed to this approach.

The committee noted the work programme.