The Audit and Governance Committee of the Liverpool City Region Combined Authority met on Thursday 23 July 2026. The committee reviewed the Head of Internal Audit's annual report, which concluded that the combined authority and Merseytravel have adequate governance, risk management, and internal control systems, with good capacity for improvement. The committee also received updates on risk management, information governance, and the external audit of the 2025/26 Statement of Accounts, noting the progress made and the planned audit approach.

Head of Internal Audit Annual Report and Conclusion 2025-26

Laura Williams, Head of Internal Audit and Risk, presented her annual report, concluding that both the Liverpool City Region Combined Authority and Merseytravel have an adequate system of governance, risk management, and internal control, with a good capacity for improvement. This assessment was based on the internal audit work undertaken during the 2025-26 financial year, alongside other sources of assurance, including unqualified external audit opinions on the 2024-25 Statements of Accounts and positive findings from the Integrated Financial Settlement Readiness Assessment.

Councillor Jane Corbett raised several points regarding the clarity and tracking of audit recommendations, particularly concerning the Littlewoods Refurbishment Enabling Works Project, where ten high-level recommendations were noted. Ms Williams explained that the update report provides a quarterly summary and that recommendations are tracked in specific tables within the pack. She assured members that progress is being made on outstanding recommendations, and that the comments box is used to highlight areas of concern.

Concerns were also raised about the reporting of suspicious activity to the Serious Crime Agency, specifically regarding potential money laundering related to the T-Flow system, which manages preferential pricing for tunnel access. Ms Williams confirmed that internal audit work was underway to examine fraud controls and awareness around money laundering in this area, with findings expected at the next meeting. Discussions also touched upon the potential for increased risks associated with future devolution and housing development pressures.

Councillor Chris Cook inquired about the specific sphere of activity related to the suspicious activity report and whether it represented a significant concern for public funds. Ms Williams clarified that the report related to the T-Flow system and its potential for manipulation for money laundering purposes, although she noted that client money was involved, separate from the public purse. She confirmed that fraud risk in this area was sufficient to warrant audit work.

The committee also discussed the Constitution, with Councillor Cook seeking clarity on councillor involvement in its review and consultation. Louise Outram, Monitoring Officer, explained that recommendations from officers are presented for committee consideration, offering opportunities for comment and potential amendments. She confirmed that the Combined Authority ultimately holds the decision-making power for the Constitution.

Regarding IT technical audits, Alex McKenna, Strategic Finance Manager, asked for more detail on high and medium recommendations related to end-user asset management and identity and access management. Ms Williams explained that these audits were part of a standard work schedule, not triggered by specific incidents, and related to the decommissioning of equipment and the security risks associated with hybrid working, respectively. Recommendations included strengthening monitoring processes, ensuring up-to-date third-party contracts, and improving password protocols.

A specific concern was raised by Councillor Simon Shaw, Chair, regarding overdue and deferred recommendations on the audit of the Mayor's Office expenses, declarations of interest, gifts, and hospitality. Ms Williams expressed confidence that this recommendation was close to being closed following recent positive conversations.

The committee noted the report.

Internal Audit Update

Laura Williams presented the internal audit update for the first quarter of the current year, highlighting that 18 pieces of internal audit work had been completed, with no reports of major organisational risk opinion. She noted four moderate opinion reports, two of which related to IT. Ms Williams also drew attention to the progress on implementing recommendations, with 32 implemented since the last meeting. She noted that there were still recommendations of concern, detailed in Table 6, and emphasised the importance of continued demonstrable progress.

Councillor Corbett asked for timescales for recommendations subject to internal audit action and for a comparison of the number of outstanding high and medium recommendations (41 and 101 respectively) against other combined authorities. Ms Williams stated that she could provide a fuller update on timescales at the next meeting and explained that comparing recommendation numbers could be misleading due to varying audit scopes. She advised focusing on the coverage of the internal audit plan and the comments box for areas of concern.

Councillor Cook enquired about a specific outstanding recommendation related to T-Flow and Fast-Tag account management, dating back to 2022-23. Ms Williams clarified that this related to the transition from Fast-Tag to T-Flow and that the audit was completed, but one high-priority recommendation remained outstanding.

Alex McKenna asked for more detail on seven high findings related to loan arrangements and Littlewoods refurbishment within the Strategic Investment Fund (SIF). Ms Williams explained that the SIF loan arrangements audit was recent and related to controls ensuring loan repayment. The Littlewoods audit focused on the recording of key decisions, where a lack of evidence trail was found. She noted that the assurance framework for SIF investments was under review, providing an opportunity to incorporate these considerations.

The committee noted the report and approved the updated Confidential Reporting (Whistleblowing ) Protocol and Guidance for the Public. This update includes the provision of sexual harassment as a qualifying disclosure, arising from changes to the Employment Rights Act.

Risk Management Update

Laura Williams presented the risk management update, outlining the six key corporate risks and the progress made in embedding risk management across the organisation. She noted that the corporate risk position remained stable, with positive progress in resilience, climate planning, transport reform, and economic development. However, continued attention is required for recruitment capacity within the transport programme. Bus franchising remains on track for September. The committee noted the report.

2025/26 Statement of Accounts - External Audit Update

Katie Kingston, Senior Manager from Forvis Mazars LLP, provided an update on the external audit of the 2025/26 Statement of Accounts. She outlined the audit strategy, timeline, and identified significant risks, including management override of controls, valuation of property, plant and equipment, valuation of the defined benefit pension scheme, and long-term debtors. Ms Kingston also detailed the basis for materiality and the expected audit fees.

Councillor Chris Cook questioned the £5,000 materiality threshold for senior officers' remuneration, which Ms Kingston clarified related to the banding of disclosed remuneration within the accounts, not the total salary. Councillor Jane Corbett inquired about the higher risk associated with the valuation of the local government pension scheme, particularly given the re-eligibility of councillors to join the scheme. Ms Kingston confirmed this was a complex area and a focus for the audit, noting a significant transfer of employees from Merseytravel to the combined authority's pension scheme. Louise Outram added that councillors' eligibility to join the pension fund would be reported in the following year due to a time lag. Alex McKenna asked for clarification on the lower coverage percentage for financing and investment income within the group audit scope, which Ms Kingston explained was due to the smaller value of that accounting area and the exclusion of certain small entities from comprehensive audit procedures. The committee noted the report.

Information Governance Update 2026

Andy Henderson, Senior Information Management Officer, presented the annual information governance update. He reported a 20% increase in Freedom of Information (FOI) and Environmental Information Regulation (EIR) requests in 2025/26, reaching 272 in total, all of which were responded to within the statutory deadline. He noted common request topics included bus franchising and Merseyrail. Two complaints were lodged with the Information Commissioner's Office, with case officers yet to be assigned.

Regarding GDPR and the Data Protection Act 2018, Mr Henderson stated that requests for personal data had remained steady, with 142 received in 2025/26. He highlighted that Subject Access Requests have a one-month response deadline, while other requests are handled as quickly as possible. A single data breach was reported to the Information Commissioner's Office concerning a concessionary travel pass application, which was deemed human error and satisfied the Commissioner.

The Audit and Accountability Act 2014 inspection window for the draft 2025/26 Statement of Accounts was open, with one enquiry received regarding Mersey Tunnels transactions. There were no complaints lodged regarding breaches of the Member Code of Conduct in 2025/26. Councillor Jane Corbett praised the team's performance in meeting deadlines, and Mr Henderson confirmed that capacity is being reviewed to manage anticipated increases in requests due to devolution. Councillor Chris Cook raised a linguistic point regarding the use of i.e. versus e.g. in relation to exemptions, which Mr Henderson agreed to correct in future reports. The committee noted the report.

Committee Work Programme 2026/27

The committee considered the draft work programme for the 2026-27 municipal year. The programme included regular updates on internal audit, risk management, finance, and governance matters, as well as specific reviews such as the constitution review and fraud update. The committee approved the work programme.