The Audit Committee of Middlesbrough Council met on Thursday 1 October 2026 to discuss strategic risks, information governance, health and safety, and external audit progress. Key outcomes included noting the latest position on children's social care, noting the information governance arrangements and being satisfied they were appropriate, and noting the health and safety arrangements and being satisfied that sufficient assurance was provided.

Management of Strategic Risk 02 - Volatility in the Demand, Complexity and Cost of Children's Social Care

The committee received an update on Strategic Risk SR-02, concerning the volatility in demand, complexity, and cost of children's social care. Annabel Bates, Corporate Director of Children's Services, explained that the service operates in a challenging environment with rising demand, increased case complexity, market instability, and significant financial pressures. These factors mean the risk level remains above the council's preferred appetite. The report highlighted that child poverty, parental mental health issues, exploitation, domestic abuse, and a growing number of children with complex needs are key drivers. Systemic pressures, such as reliance on high-cost external placements and regional workforce shortages, exacerbate these issues.

Members discussed the extent of child poverty in Middlesbrough, with the Corporate Director confirming that regional evidence suggests the situation is becoming increasingly challenging. The impact of the two-child benefit restriction was also queried, with the explanation that child poverty is influenced by multiple factors. The increasing complexity of cases was attributed to children presenting with multiple, overlapping needs that are difficult to address within existing service structures, leading to heightened safeguarding concerns. The committee was informed that early intervention and national reforms are crucial to prevent needs from escalating. The risk is subject to monthly review and enhanced management oversight, with various assurance arrangements in place. While existing controls provide reasonable assurance for statutory safeguarding responsibilities, many risk drivers are external to the council. Mitigation efforts include exploring in-house residential placements, strengthening regional collaboration, and reviewing governance processes. The committee noted the latest position on this strategic risk.

Senior Information Risk Owner (SIRO) Annual Report

The committee received the Annual Report of the Senior Information Risk Owner (SIRO), presented by Ann-Marie Johnstone, Head of the Chief Executive's Department. The report provided assurance on the council's information governance arrangements for 2025/26, covering the Information Governance Framework, the Information Strategy, data protection, information security, cyber resilience, records management, surveillance governance, statutory information requests, and physical access and building security.

Key policies, including the Surveillance Policy, Microsoft 365 Policy, Public Information and Information Requests Policy, and Records Management Policy, had been refreshed. An Artificial Intelligence Policy was also approved. The refreshed Information Strategy for 2025-2029 focuses on improving data management, ethical data use, and leveraging information for service transformation. Members discussed digital exclusion and how residents without digital access would be supported, with officers referring to work in Adult Social Care and the development of facilities like the Hemlington Hub. The availability of printed information through libraries was to be checked.

Concerns were raised about the increasing use of Artificial Intelligence in statutory information requests, leading to greater complexity and processing pressures. Officers explained that while AI-generated requests cannot be restricted, they can also improve accessibility. The council is strengthening cyber security through external reviews, data loss prevention measures, and specialist incident response. Internal Audit provided reasonable assurance on cyber security controls. Members sought assurance regarding Distributed Denial of Service (DDoS) attacks on the council's website, with officers explaining these attacks aim to disrupt access rather than steal data, and that protective measures have been implemented.

Pressures remain in managing statutory information requests, with increased complexity and a decline in compliance with response times for Subject Access Requests. Freedom of Information and Environmental Information Regulation requests have also risen. Work is ongoing to improve processes, monitor performance, and increase proactive publication of information. Progress has been made in records management, including the transition to SharePoint, although some migration activity has been temporarily paused for validation and assurance. Surveillance governance was inspected by the Investigatory Powers Commissioner's Office with no significant concerns identified. Physical security arrangements are being reviewed in light of the Terrorism (Protection of Premises) Act 2025. Future priorities include delivering the Information Strategy, completing the SharePoint transition, and strengthening information governance. The committee noted the position on information governance and was satisfied that the arrangements were appropriate.

Risk Annual Assurance Report

Erik Scollay, Chief Executive, presented the Risk and Opportunities Annual Assurance Report 2025. The report detailed significant progress in strengthening the council's risk management approach, including the development of a revised Risk and Opportunity Management Policy, an Enterprise Risk Management Framework, and a Corporate Risk Appetite Framework. Integration of risk, performance, and assurance activities has been enhanced, with improved governance and scrutiny.

The report highlighted the introduction of strategic risk deep-dive sessions at Audit Committee, better alignment between Internal Audit and risk management, and strengthened risk compliance monitoring. Internal Audit had previously provided Substantial Assurance on the council's risk management arrangements. The council manages risks through a hierarchy of registers, with regular review and escalation processes. Three new strategic risks were introduced during the reporting period, alongside new mitigation actions and risk assessments, while three risks were deactivated. Horizon scanning for emerging risks such as Artificial Intelligence and cyber security continues.

Priorities for the next 12 months include full implementation of the Enterprise Risk Management Framework and Policy, further integration of reporting, increased engagement between risk owners and the Audit Committee, and training to embed a positive risk culture. The committee noted the arrangements for managing risk and opportunity and was satisfied with the governance of these areas.

Health and Safety Annual Assurance Report

The Head of the Chief Executive's Department presented the Health and Safety Annual Assurance Report 2026. The report outlined the arrangements for managing health and safety across the council and progress made over the past year, demonstrating compliance with the Health and Safety at Work etc. Act 1974.

Health and safety management is a shared responsibility, supported by a governance framework including the Health and Safety Policy, a three-year strategic plan, procedures, and training. The digital health and safety management system, My Compliance, has been developed to include a legal register of statutory requirements. Data from this system has improved intelligence on incident reporting, audits, and action tracking. Several policies and procedures have been reviewed or implemented, including those for incident management, lone working, and food allergens.

Members discussed arrangements for managing hazardous substances and personal protective equipment, with officers confirming compliance with relevant regulations. Personal safety arrangements for elected Members were also discussed, with assurances that support and individual risk assessments are available. The report detailed 233 recorded accident and violence incidents, with six reportable to the Health and Safety Executive. Service area audits have been conducted across various operational services, and waste collection is included in the current year's audit programme. Training for officers includes face-to-face sessions on incident investigation, fire safety, manual handling, and personal safety, supplemented by e-learning. Future plans include implementing the new strategic Health and Safety Plan, further developing reporting capabilities, reviewing policies, conducting audits, and continuing training. The committee noted the health and safety arrangements and was satisfied with the provided assurance.

External Audit and Teesside Pension Fund Progress Report

The Senior Manager from Forvis Mazars presented the Audit Progress Report for Middlesbrough Council and the Teesside Pension Fund for the year ended 31 March 2026. Planning work for both audits is substantially complete, with liaison with the Pension Fund auditor underway. Materiality levels have been reviewed based on draft financial statements.

The council's Value for Money work has been completed, and the accounts audits are scheduled to commence in October and conclude in December 2026. The Senior Manager reported no immediate issues for either audit. Members sought clarification on completing audits ahead of backstop dates, with emphasis placed on the importance of close collaboration, early preparation, and a staged approach to building audit assurance for future years. The report also highlighted national publications and technical developments relevant to local government audit. The committee noted the Audit Progress Report.

Work Programme

The committee noted the update on the Audit Committee's work programme.

Any Other Urgent Items

There were no other urgent items.