The Governance and Audit Committee of West Yorkshire Combined Authority met on Thursday 08 October 2026 to review and endorse several key governance and assurance frameworks. The committee approved the Integrated Assurance Framework, reviewed and recommended amendments to the West Yorkshire Local Assurance Framework, and noted updates on risk management, treasury management, and internal and external audit progress.

Integrated Assurance Framework

The committee reviewed and commented on the proposed Integrated Assurance Framework (IAF), which aims to establish a coordinated and systematic approach to assurance across governance, risk management, internal control, and organisational performance. The IAF aligns assurance activities across a three lines of defence model, providing a consolidated view of assurance, improving visibility of gaps and overlaps, and enabling earlier identification of control weaknesses and emerging risks. The committee supported the continued development of an Integrated Assurance Dashboard and an organisational Assurance Map, noting that the Framework will mature during 2026/27. The principles and direction of travel set out within the IAF were endorsed as a key component of the Combined Authority's governance and assurance arrangements. Observations and recommendations were provided to inform the further refinement and implementation of the Framework.

West Yorkshire Local Assurance Framework (LAF), Annual Review 2026

The committee noted the review and refresh of the West Yorkshire Local Assurance Framework (LAF) undertaken in consultation with the government. The LAF, originally developed as part of the Growth Deal in 2015, is a key document required by the government to assure them that appropriate processes are in place for the Combined Authority to fulfil its role as the accountable body for funding. The annual review for 2026 incorporated feedback from the Ministry of Housing, Communities and Local Government (MHCLG) and other government departments, focusing on alignment with the Integrated Settlement policy document. Key revisions included simplifying the document, updating it to reflect the powers and functions of an Established Mayoral Strategic Authority, adding the Combined Authority's Three Lines of Defence model, and clarifying investment decision-making processes. The committee reviewed the draft LAF and recommended amendments relating to governance, risk, or audit. The Combined Authority Board had previously approved the revised draft LAF on 24 September 2026.

Risk Management

The committee noted the contents of the report on Risk Management, which provided an overview of the Combined Authority's Risk Management Strategy (RMS) Development Plan and progress made in strengthening organisational risk management. The organisation has progressed to Level 3 (Defined) of risk maturity, with improvements in governance, standardisation of risk registers, and clearer roles and responsibilities. However, challenges remain, including the absence of an integrated digital risk management solution and current resource capacity within the Risk and Compliance Team. The report outlined current limitations and challenges affecting the pace of improvement, with a phased approach to delivery and a planned recruitment of a Senior Risk & Compliance Officer in 2027/28. Key priorities for the Embedding Phase include improving the quality and consistency of risk information, strengthening ownership and accountability, and developing future options for a digital risk management solution.

Data Protection Officer Report

The committee noted the report on the Combined Authority's data protection and information governance performance. Compliance with statutory timescales for Freedom of Information (FOI) and Environmental Information Regulations (EIR) requests was at an average of 95% in Quarter 1 of 2026/27, with improvements noted following targeted training. Subject Access Requests (SARs) were responded to on time in 100% of cases. Transparency obligations were measured at 63% compliance, with ongoing work to review and update policies. The ICO Accountability Framework audit cycle was refreshed, with a high level of compliance expected upon completion. Mandatory UK GDPR training compliance stood at 87.9%, and 21 data security incidents were reported in Q1 2026/27, none of which involved high-risk or special category data.

Q1 Treasury Management Update

The committee noted the Quarter 1 Treasury Management Update, which reported on the Combined Authority's borrowing and investment position as of 30 June 2026. Net investments increased significantly due to the implementation of Integrated Settlement funding arrangements. The overall borrowing position reduced, and both the Combined Authority and West Yorkshire Police (WYP) maintained an under-borrowed position. All treasury management activities complied with the approved Treasury Management Strategy. The Authority's investment portfolio achieved a weighted average rate of return of 4.16%, outperforming benchmarking groups without increasing overall portfolio risk. The outlook for the remainder of 2026/27 focuses on maintaining security and liquidity, managing significant cash balances, and monitoring market conditions for borrowing opportunities.

Quarterly Internal Audit Progress Update

The committee noted the Quarterly Internal Audit Progress Update. Progress against the audit plan was at 20% based on finalised and draft reports, with a risk to achieving the 50% target by January due to staffing absences and recruitment delays. Efforts are underway to digitise resource recording and automate the action follow-up process. Key themes from audit work included improvements in reporting information by the second line of defence and strengthening controls in areas such as time recording and purchase card policies. Counter fraud investigations have closed four cases, with recommendations for policy and process improvements.

Quarterly Audit Recommendation Follow Up Report

The committee noted the updates on outstanding audit actions. While the overall number of recommendations has decreased, there has been an increase in older recommendations and those not to be implemented, partly due to the consolidation of directorate-wide recommendations under single owners. Several recommendations related to AccessBus, BSIP Mayors Fares, and Bus Station Security remain overdue, with ongoing monitoring and requests for further evidence. Recommendations concerning contract management training and the PIMS system are progressing. The Mass Transit programme is addressing governance framework reviews and training, while Transport Capital and Services are working on project documentation and KPI frameworks. Risk management recommendations are being addressed through template revisions and a planned digital solution.

External Audit Update

The committee noted the Audit Strategy Memorandum 2025/26 from the external auditors, Forvis Mazars. The memorandum outlines the planned scope and timing of the audit for the year ended 31 March 2026, including the approach to rebuilding assurance following disclaimed audit opinions in previous years. The auditors anticipate a disclaimer of opinion for 2025/26, with a qualified opinion potentially achievable by 2027/28. Materiality levels have been set, and the auditors confirmed their independence. The report also detailed the framework for Value for Money work, focusing on financial sustainability, governance, and economy, efficiency, and effectiveness. The auditors identified no new risks of significant weaknesses in arrangements for 2025/26 but will follow up on previously identified weaknesses related to key financial controls and financial reporting arrangements.

The minutes of the meeting held on 2 July 2026 were approved as a correct record.

The committee also noted the Data Officer Protection Report, which detailed information governance performance, including compliance with FOI/EIR requests and transparency obligations.

The committee noted the Q1 Treasury Management Update, confirming compliance with treasury management strategies and prudential indicators.

The committee noted the Quarterly Internal Audit Progress Update, highlighting progress against the audit plan and themes from recent audits.

The committee noted the Quarterly Audit Recommendation Follow Up Report, providing updates on outstanding audit actions.

The committee noted the External Audit Update, specifically the Audit Strategy Memorandum 2025/26 from Forvis Mazars.