The Audit and Governance Committee of Tunbridge Wells Council met on Thursday 2 July 2026 to review the progress of external and internal audits, and to discuss the strategic risk register. The committee received positive assurances on the council's control environment and risk management processes, with all audits completed receiving a sound or strong rating. A key discussion point was the ongoing development of Royal Victoria Place, with an increased risk score attributed to the potential listing of a building within the development area.

External Audit Progress and Sector Update

Gufran Ahmed from Grant Thornton presented the external audit progress report, confirming that the audit plan for 2025/26 was on track. He acknowledged the council's effort in publishing draft accounts 20 days ahead of the statutory deadline. The audit work was expected to be completed by early September, with the audit report signed by the end of September. The committee noted the report and agreed to the recommendations.

Internal Audit Report and Annual Audit Opinion

Katherine Woodward, Head of Mid-Kent Audit Partnership, presented the internal audit report and annual audit opinion for 2025/26. She provided a positive opinion, stating that sound assurance can be placed upon the systems in place that ensure adequate and effective management, control and governance processes exist to manage the achievement the council's objectives. All audits completed during the year received either a sound or strong assurance rating.

During the discussion, Councillor Currie raised a concern about a recommendation concerning political independence between internal audit and risk management that remained unresolved. Ms. Woodward explained the measures in place to mitigate this risk, including a dedicated manager for risk management within her team. Councillor Knight inquired about the differentiator between strong and sound ratings, which Ms. Woodward clarified were defined in the agenda papers. Councillor Digby raised concerns about ICT controls, specifically the lack of routine multi-factor authentication (MFA) across all staff members and the governance of third-party systems. Ms. Woodward acknowledged these concerns and agreed to discuss the possibility of upgrading to Cyber Essentials Plus with the Head of IT. She also noted the concern regarding ICT disaster recovery. Councillor Digby also raised a point about deficiencies found in four out of ten inspected leases, and Ms. Woodward confirmed that a wider review of leases would be undertaken, though not immediately. The committee noted the report and the Head of Audit Partnership's opinion.

Strategic Risk Register Update

David Candlin, Head of Economic Development and Major Projects, presented an update on the Strategic Risk Register, focusing on risks related to the successful development of Royal Victoria Place (RVP). He explained that the risk score for RVP had increased due to uncertainty surrounding the potential listing of a building within the Ely Court development area. This could impact the development's timescale and lead to additional costs. To mitigate this, the council has submitted a Certificate of Immunity from Listing (COIL) to Historic England to establish a clear timetable for a decision.

Discussions also touched upon the potential impact of local government reorganisation on the RVP development and the council's assets. Mr. Candlin assured the committee that the council had worked to improve RVP's financial position and occupancy rates, aiming to leave it in a stronger state for any future unitary authority. The committee also discussed the risk of transferring assets to town or parish councils without achieving best value, with clarification that only allotments formally transfer under community governance legislation. The committee considered and noted the strategic risk register and the arrangements for managing strategic risk, and advised that any further information they would find beneficial in future reporting to strengthen their understanding of how the council manages its risks.

The meeting concluded with no urgent business and the date of the next meeting scheduled for Tuesday, 15 September 2026.