The West of England Combined Authority Audit Committee met on Monday 6 July 2026 to review the Authority's financial performance, risk management, and internal controls. Key discussions included the Treasury Management Outturn Report, the Internal Audit Annual Report, and the proposed expansion of the Combined Authority to include North Somerset Council. The Committee also received updates on cyber resilience, health and safety, and information governance.

Treasury Management Outturn Report 2025/26

The Audit Committee reviewed the Treasury Management Outturn Report for the financial year ending 31 March 2026. The report indicated that total investment income for the year was approximately £22.9 million, exceeding the budgeted figure by £7.2 million. The average rate of investment return was 4.6%, which was above the benchmark SONIA rate. However, the capital value of pooled funds had reduced, resulting in an unrealised capital loss of approximately £4 million. A £5 million earmarked reserve remains in place to mitigate potential future losses. Members expressed concern about the reduction in pooled fund values and sought clarification on the Authority's significant cash balances, which officers explained were largely due to pre-agreed Central Government grant payment schedules for major infrastructure projects. The Committee noted a typographical error in the report regarding the investment income budget, which officers confirmed should have read £15 million.

Internal Audit Annual Report 2025/26

The Committee received the Internal Audit Annual Report for 2025/26, which provided an opinion on the effectiveness of the Authority's internal control environment. The Head of Internal Audit reported that no audits had resulted in a No Assurance or Limited Assurance opinion, with all completed audits receiving either Reasonable Assurance or Substantial Assurance. This indicated a satisfactory internal control framework. The report also detailed the certification of approximately £31.8 million in grant expenditure, all of which complied with terms and conditions. Members were informed that 65 out of 68 audit recommendations had been implemented, with the remaining three related to the Mobility as a Service project management audit being partially implemented and scheduled for completion by August 2026. The Committee also noted the Authority's counter-fraud activities and was informed that a counter-fraud briefing session for members was planned for the coming months.

Expansion of the Combined Authority

An update was provided on the proposed expansion of the West of England Combined Authority to include North Somerset Council. Officers confirmed that the expansion proposal had been submitted to the Government following approval from both the Combined Authority Committee and North Somerset Council. The process was now Government-led, with completion anticipated within the current financial year. Changes to legislation meant the final consent stage had been brought forward. Members discussed potential legal challenges to the expansion, but officers stated that the process was legally robust and no successful challenge was anticipated. The implications of expansion on governance and capacity were also discussed, with officers clarifying that the current proposal focused solely on the inclusion of North Somerset.

Project Management Plan for Delivery of the 2025-26 Audit

The Committee received the Project Management Plan for the 2025/26 External Audit. The External Auditors, Grant Thornton, presented the plan, highlighting its aim to support the timely completion of audits and clarify responsibilities. The Authority was categorised as a Phase One audit due to its strong track record. Audit work had commenced, with an aspiration for substantial completion by the end of August 2026 and a formal opinion by September 2026. Members noted the ambitious timetable and welcomed the increased transparency provided by the plan's milestones and performance indicators.

The Audit Plan for West of England Combined Authority - Year Ending 31 March 2026

Grant Thornton presented their Audit Plan for the year ending 31 March 2026. The audit would focus on the Statement of Accounts opinion and a Value for Money (VFM) assessment. Key risks identified included management override of controls, valuation of the pension fund net liability, and the financial system upgrade of Unit4 to the cloud. The VFM assessment would cover financial sustainability, governance, and economy, efficiency, and effectiveness. Members discussed the audit materiality threshold, which had been revised upwards due to increased gross expenditure, and raised questions regarding the audit of pension liabilities and governance risks. The proposed audit fee was also discussed.

West of England Combined Authority - Auditor's Annual Report - Year Ending 31 March 2025

The Committee received the final Auditor's Annual Report for the year ending 31 March 2025. The report detailed the external auditor's assessment of value for money arrangements, noting significant progress in governance and partner relationships, but highlighting residual weaknesses in embedding new arrangements and programme governance, particularly concerning the CRSTS programme. The report also confirmed an unqualified opinion on the financial statements. The Auditor addressed public objections received, stating that no revisions to the report's narrative or further recommendations were required. The report concluded that the Authority's arrangements for securing value for money in 2024/25 were inadequate, with key recommendations made regarding governance culture and CRSTS programme delivery.

Quarterly Corporate Risk Register Update

The Committee reviewed the updated Corporate Risk Register, noting that all corporate risks were assessed as manageable following mitigation. Key changes included the removal of the Poor quality performance and project management risk (CRR17) due to strengthened controls, and a reduction in the CRSTS Delivery Risk (CRR14) reflecting improved delivery confidence. However, the significance of the Global Instability Risk (CRR6) had increased due to ongoing economic and geopolitical pressures. Risks related to funding constraints (CRR5) and workforce capacity (CRR10) had been reframed for clearer articulation of strategic challenges. Members discussed the difference between risks on the corporate register and those managed at directorate level, and requested further information on workforce retention and recruitment data. The potential risks associated with Artificial Intelligence were noted as being managed at a directorate level.

Health and Safety Update

The Head of Health and Safety presented an update on performance during 2025/26, highlighting a strong safety record with zero RIDDOR-reportable incidents and zero lost-time injuries. Hazard reporting had doubled the annual target, indicating a positive safety culture. Key achievements included the signing of a new Health and Safety Policy Statement, delivery of member training, improvements to Davis House, and a substantial fire safety programme. Plans for 2026/27 include rolling out new mandatory training, strengthening business continuity plans, and focusing on psychosocial risks. Members discussed the Authority's role as a funder in relation to health and safety on construction projects, with officers clarifying that statutory responsibility lay with the delivering organisations.

Information Governance Update

The Committee received an update on the implementation of the Combined Authority's Information Governance Framework. Officers presented the new statutory Data Protection Complaints Policy for endorsement and reported on the Authority's performance in handling Freedom of Information and Environmental Information Regulation requests. The Authority had responded to 90% of requests within the statutory 20-working-day timeframe. Members discussed the importance of accessible complaints procedures and the potential for future benchmarking of FOI performance.

Local Government & Social Care Ombudsman Annual Review Letter

The Committee noted the Local Government and Social Care Ombudsman's Annual Review Letter for 2025/26. The report indicated that during the period, the Ombudsman had considered two complaints relating to the Authority. One was referred back for local resolution, and the other was closed as premature. No investigations were undertaken, no complaints were upheld, and no recommendations were made.

Forward Work Plan

The Committee's discussion of the proposed Forward Work Plan for 2026/27 was deferred to a later meeting.

Annual Cyber Resilience Update

The Committee received an update on cyber resilience improvements, ongoing management, and future plans. Significant progress had been made over the past two years, including the transition to new ICT service arrangements with Delt, enhancing cyber security capabilities. The Authority was now focused on embedding these improvements and maturing its cyber resilience. Members questioned how effectiveness was measured and discussed third-party risks and investment in cyber security. Officers confirmed that AI risks were managed at a directorate level and that an AI policy had been adopted. The Committee requested a future report on the Authority's use of AI.

The meeting adjourned following Item 17 due to time constraints and the need for some members to leave. The meeting reconvened on 14 September 2026 to consider the remaining items on the agenda.