The Audit and Transparency Committee of Kensington and Chelsea Council met on Monday 20 July 2026 to discuss the external audit plan for 2025/26, the strategic risk register, and the annual report on internal audit, internal control, and fraud investigations. Key decisions included noting the external audit plan, reviewing the strategic risk register, and receiving the annual report on internal audit and fraud investigations, which indicated reasonable assurance over the Council's control environment.

External Audit Plan 2025/26

The committee received the external audit plans for the 2025/26 financial year for both the Council and the Pension Fund, prepared by Grant Thornton. These plans outline the scope, significant risks, materiality levels, and proposed fees for the statutory audits.

Key risks identified for the Council's audit include management override of controls, the valuation of land and buildings, council dwellings, and investment properties, and the valuation of the pension fund net asset. The audit plan also highlights risks related to the Council's response to the November 2025 cyber-attack, the quality of social housing stock, and the significant budget gap projected due to the fair funding review.

For the Pension Fund, significant risks identified include management override of controls, and the valuation of private equity investments and directly held property, which are classified as Level 3 assets due to their reliance on unobservable inputs. The audit plan also addresses the actuarial present value of promised retirement benefits and the impact of the cyber-attack on the administering authority.

During the discussion, Councillor Sof McVeigh, Chair of the Committee, raised concerns about the reduction in the number of highlighted audit team members compared to the previous year and questioned the proposed fee increase, noting that the fee was subject to amendment from the Public Sector Audit Appointments (PSAA). Grant Thornton representatives explained that the team size remained consistent and that the fee variation was due to ongoing correspondence with the PSAA regarding the scale fee.

Informing Audit Risks 2025/26

The committee reviewed the auditor's assessment of key risk areas, including general enquiries of management, fraud, laws and regulations, related parties, going concern, and accounting estimates. Management provided responses to a questionnaire, which the committee was invited to consider for alignment with their own understanding.

A significant event impacting the Council's financial statements for 2025/26 was the cyber-attack in November 2025, which affected various operations and income collection. Management outlined the measures being taken to accrue income and estimate expected credit losses, acknowledging the potential for increased debt non-recovery. The report also detailed the Council's accounting policies, including the approach to valuing property, plant, and equipment, and the use of derivatives by the Pension Fund.

Regarding fraud, the Council has a robust anti-fraud framework and a fraud risk register. The Corporate Anti-Fraud Service processed 273 new referrals in 2025/26, with 232 resulting in positive outcomes. The Council also highlighted its participation in the London NFI FraudHub for data matching and its efforts to combat parking and housing fraud.

The committee heard that the Council is not aware of any factors that would lead to the discontinuation of statutory services or any significant litigation or claims that would affect the financial statements, beyond the ongoing Grenfell tragedy claims. Related party transactions are managed through annual declarations and established approval processes.

Strategic Risk Register

The committee received an update on the Council's Strategic Risk Register, highlighting changes since the January 2026 review. A new overarching Risk Management Policy has been introduced, alongside risk management training for employees. Two risks, non-compliance with statutory inspection obligations for buildings and ineffective partnership working for Notting Hill Carnival, have seen their likelihood scores reduced from four to two, reflecting progress in mitigation.

The register includes 22 strategic risks, with the highest impact and likelihood scores assigned to:

• A serious Information/Cyber Security incident.
• Failure to deliver necessary investment and improvements to the Council's social housing stock.
• Failure to meet landlord health and safety requirements for social housing.
• Failure to provide appropriate and safe temporary accommodation.
• Rising costs and challenges in providing care for children with complex needs.
• Not working effectively with partners to deliver a safe Notting Hill Carnival.

The committee discussed the downgrade of the risk score for non-compliance with statutory inspection obligations for buildings, with Councillor Claire Simmons expressing concern given the Housing Regulator's judgment on stock quality. Ray Chitty, Director for Audit, Fraud, Risk and Insurance, clarified that Risk 19 pertains to the corporate estate, while housing stock quality is covered under Risk 3 and 4, which have higher risk scores.

The committee also raised concerns about the lack of explicit mention of potential criminal charges related to the Grenfell Inquiry in the risk register. Officers confirmed that this is under consideration and will be updated in future reports.

Annual Report on Internal Audit, Internal Control and Fraud Investigations 2025/26

The committee received the annual report summarising the work of the Internal Audit Service and Corporate Anti-Fraud Service for 2025/26. The Head of Internal Audit provided an opinion of reasonable assurance on the Council's governance, risk management, and control environment, noting that 90% of audits received a positive assurance opinion. Two audits received a limited assurance rating: Corporate Strategy (Equalities Impact Assessments & Equalities) and IT Governance Framework.

The report detailed that 169 recommendations were followed up, with 86% fully implemented and 8% partially implemented. The committee noted the increase in the volume of recommendations followed up compared to the previous year.

The Corporate Anti-Fraud Service achieved 156 successful outcomes in fraud prevention, detection, or recovery, with an estimated loss prevented of £366,583. The London NFI FraudHub contributed significantly to these outcomes. The Kensington Housing Investigation Team achieved 20 successful outcomes, including property recoveries for abandonment, subletting, and failed succession.

The committee discussed the dual assurance model for internal audit, with resources drawn from an in-house team and external providers. Concerns were raised about the potential conflict of interest when internal audit undertakes advisory reviews, and the need for clear policies on this. The committee also discussed the presentation of audit outcomes, particularly for limited assurance reviews, and requested more explicit tracking of follow-up actions.

Local Code of Corporate Governance 2026/27 and Draft Annual Governance Statement 2025/26

The committee reviewed the draft Local Code of Corporate Governance for 2026/27 and the draft Annual Governance Statement (AGS) for 2025/26. The updated Local Code incorporates changes reflecting the CIPFA Addendum to the Good Governance Framework and the Council's commitments following the Grenfell Inquiry.

The AGS reports on the Council's compliance with its Local Code and draws on various sources of assurance, including internal and external audits, regulatory bodies, and the LGA Corporate Peer Challenge. The report highlighted that the Council's governance framework operated effectively throughout 2025/26.

Significant governance issues discussed included the November 2025 cyber-attack, detailing the response, recovery, and ongoing improvements to security. The report also addressed the Council's ongoing work related to the Grenfell tragedy, including the Restorative Justice programme and cooperation with the criminal investigation.

The committee noted that the Council's external auditors, Grant Thornton, found the Council's accounts to be of excellent quality and that the Council had strong value for money arrangements. The committee also discussed the Councillor Code of Conduct, noting that two complaints against Councillor Jedut were upheld, resulting in censure and a recommendation for mentoring.

Draft Committee Annual Report

The committee reviewed the draft Annual Report for 2025/26, which summarises the committee's activities and achievements. The report highlighted the committee's work in scrutinising external audit plans, risk management, internal audit, fraud investigations, and the Council's corporate governance arrangements.

The committee discussed the effectiveness of its own operations, noting areas of strength and identifying actions for further improvement, such as enhancing communication of the committee's role and inviting senior officers and lead members to meetings for deeper dives into specific risks. The report also acknowledged the valuable contributions of the independent committee members.

The committee agreed that the draft report was a good summary of their work and would be presented to full Council.

Committee's Action Tracker & Forward Programme

The committee received an update on the Action Tracker, noting that 11 outstanding actions were in progress. The Forward Programme for the remainder of the municipal year 2026/27 was also presented, outlining planned topics such as the external audit plan, strategic risk register, and focused risk items. Members were invited to suggest additional topics for consideration.

Key actions noted as in progress include:

• Grant Thornton LLP following up on the process for transferring assets from 'assets under construction' to 'council dwellings'.
• The provision of an updated Asset Strategy for Pembroke Road.
• The outcome of the Housing Allocations Audit.
• A breakdown of VIAH incidents and clarification on the risk scoring for safeguarding.
• Development of a more effective Strategic Risks Heatmap.
• A report on the Fairer Action Plan to the Overview and Scrutiny Committee.
• A future meeting with the cyber-recovery team to discuss Artificial Intelligence.
• The provision of audit work on housing allocations.
• Consideration of a meeting between the Chairs of the Audit and Transparency Committee and Overview and Scrutiny Committee regarding resilience functions.

Completed actions included the commencement of combined assurance reporting and the recirculation of a briefing note. The committee also noted that the Strategic Risk Register and Heatmap would be updated based on committee feedback.