The Committee approved the Internal Audit Strategy and Annual Plan 2024/25, the Treasury Management Strategy and noted the Ethical Standards Annual Review 2023-24 and the latest update on risk management. It also noted the process for appointing a new Independent Member.

Internal Audit Progress Report

The Committee considered a report on Internal Audit's progress in the third quarter of 2023-24. This included a summary of completed audits and an update on counter fraud and investigation activities.

The Audit Manager, David John, reported that most of the audits that quarter had given a ‘reasonable assurance’ opinion, which means that most of the controls were in place and were operating as expected to manage key risks.

There were three audits which had resulted in a ‘partial assurance’ opinion:

• The Schools Alliance for Excellence (SAfE) Contract - The main concerns were around the internal contract management processes. This included the lack of a system for recording variations to the contract, the lack of a risk register and a failure to break the contract down into more manageable sections. There were also concerns about the way the Council was transferring data to the supplier, using email and Excel spreadsheets. In response to this, Mr John explained that “all sensitive data is uploaded to Nexus, which is a data sharing platform which holds data from the DFE” [^2]. [^2]: The DfE is the Department for Education. Nexus is a web portal where the DfE shares education data with Local Authorities.
• Unofficial School Funds (USFs) - The main concern here was the lack of oversight by the Council. These accounts are funded by donations from parents, fundraising etc and are held by schools independently of the Council. The Council was found to have limited assurance that schools are managing them correctly. As part of the audit, Internal Audit suggested a number of improvements to the process and will follow this up with another audit to assess whether those have been implemented.
• Times Ditton Infant School - There were some concerns about the general control environment at the school but no fundamental weaknesses.

Councillor Terry Price welcomed the USF audit and said that, based on his experience as an independent examiner of school accounts, he was not surprised by the findings. He also expressed concern that some school staff were only ‘encouraged’, rather than ‘required’ to declare any conflicts of interest, suggesting that this should be changed to ‘required’ in future reports.

Internal Audit Strategy and Annual Audit Plan 2024/25

The Committee considered a report on the Internal Audit Strategy and Annual Audit Plan 2024/25. The Audit Manager, David John, explained that the plan is based on a risk assessment which takes into account the views of senior officers and Members, the Council's risk registers, discussions with Orbis partners and other local authorities. This was presented to the Corporate Leadership Team (CLT) on 27 February 2024 and was agreed by the Section 151 Officer ¹ at the Resources Directorate Leadership Team on 1 March 2024. The main points highlighted were that:

• Some key financial systems audits will be undertaken as a matter of priority after delays to the implementation of the new Unit4 ERP solution (MySurrey).
• Systems which received a ‘minimal’ or ‘partial’ assurance opinion will be subject to follow-up reviews.
• Audits which were not delivered during the previous financial year will be re-prioritised.

Councillor Steven McCormick asked for an update on the difficulties in recruiting qualified auditors that had been discussed in last year’s meeting. Russell Banks, Orbis Chief Internal Auditor, explained that the service was still experiencing recruitment challenges and was currently using external contractors to fill gaps at the senior level, but that the hope was that all of the posts within the structure could be filled in due course.

Ethical Standards Annual Review 2023-24

The Committee considered a report on ethical standards. Paul Evans, Director of Law and Governance, and Monitoring Officer, explained that this year's report had been expanded to include declarations of interest and gifts and hospitality. He confirmed that all Members have received induction training on the Code of Conduct, and that additional training had been provided on data protection and the use of social media.

Key points from the report included:

• Ten complaints were made against Councillors in the year to 31 January 2024. None of the complaints were investigated formally and no breaches of the Code of Conduct were found.
• Nine declarations of interest were made at meetings held in public between 1 February 2023 and 31 January 2024. No complaints were received suggesting that any Councillors had failed to declare an interest when required to do so.
• Eighteen declarations of gifts and hospitality were made. Seventeen of these related to dinners and networking opportunities, mainly attended by the Leader of the Council, Councillor Tim Oliver.

Councillor Price suggested that a similar annual report should be prepared covering senior officers, and Mr Evans confirmed that this would be done in future.

Appointment of Independent Member to the Audit and Governance Committee

The Committee noted that a recruitment process was underway to appoint a new Independent Member ² to the Committee, to replace Councillor Price, who was retiring. A recruitment panel, consisting of the Chairman, Councillor Victor Lewanski, the Vice-Chairman, Councillor Richard Tear, and Councillors Stephen McCormick and Stephen Cooksey, would be interviewing the shortlisted candidates in the next few weeks, and a recommendation would then be made to the full Council.

Risk Management

David Mody, Head of Strategic Risk, presented a report on risk management. He explained that, after a focus on internal improvements in 2023, including the approval of the Risk Management Strategy at this Committee, the development of the Risk ‘Intranet’ and the creation of local working instructions, the focus in 2024 would be outwards, with a review of how other similar organisations were undertaking risk management.

Councillor Cooksey asked why a risk regarding Home to School Travel Assistance had been removed from the Corporate Risk Register ³, and Mr Mody explained that this was because improvements had been made, and that it was now being monitored at directorate level.