The Greater Manchester Combined Authority Audit Committee is scheduled to meet on Monday 16 November 2026. The meeting's agenda includes discussions on the role of the Audit Committee within the GMCA group, updates from various audit panels, and oversight of the use of consultants and contractors. A significant portion of the meeting will also focus on risk management, including a deep dive into Artificial Intelligence (AI) and cyber security.

Role of the GMCA Audit Committee within the GMCA group

A report from Sarah Horseman, Director of Governance, Risk and Assurance, is scheduled to be discussed, outlining the respective roles of the GMCA Audit Committee, the Joint Audit Panel (Police and Crime), and the TfGM Audit, Risk and Assurance Committee (ARAC). The report aims to clarify how these bodies can collaborate effectively while respecting their individual responsibilities and avoiding duplication. The committee is expected to note the distinct legal and governance arrangements for Greater Manchester Police, the Mayor's police and crime functions, and TfGM, and endorse the principle of reporting assurance by exception.

Oversight and Monitoring Updates

The committee's agenda includes an update on the Use of Consultants and Contractors within GMCA, including GMFRS from Steve Wilson, Group Chief Finance Officer, and Mallicka Mandal, Director of People Services. This report will provide an overview of how consultants and contractors are utilised, the associated risks, and the controls and assurance mechanisms in place. It will also consider whether the current reliance on external expertise is appropriate and time-limited.

Additionally, a report on Procurement Exemptions by Steve Wilson will be presented, detailing statistical data on the use of procurement exemptions at GMCA and considering the procedures that govern them.

Risk Deep Dive: AI and Cyber Security

A significant item on the agenda is a Risk Deep Dive: AI and Cyber Security related risks. Reports from Kieran Smith, Deputy Director Digital & Transformation, and John Laurence Curtis, Deputy Director Information & Data Governance & Data Protection Officer (DPO) Group, are scheduled. This discussion will likely cover the evolving cyber threat landscape, the increasing use of AI by threat actors, and the potential impact of cyber incidents on essential services and organisational resilience. A separate report, considered exempt from publication, will provide further detail on this topic.

Internal Audit Progress and Treasury Management

Damian Jarvis, Assistant Director Internal Audit (Group), will present the Internal Audit Progress Audit Action Tracking Report, updating the committee on the delivery of the 2026/27 Internal Audit Plan and the implementation of agreed audit actions.

Steve Wilson, Group Chief Finance Officer, will also present the Treasury Management and Annual Investment Strategy Mid-Year Review Report. This report will cover the Authority's treasury management activity for the first half of the 2026/27 financial year, including borrowing and investment performance, and compliance with treasury and prudential indicators. A key recommendation is expected regarding an amendment to the Annual Investment Strategy to permit lending to Greater Manchester local authorities for periods exceeding 365 days.

External Audit and Work Programme

The committee is scheduled to receive the Draft Auditor's Annual Report from Forvis Mazars, the external auditors. This report will summarise the work undertaken for the year ended 31 March 2026. Updates on the Audit Committee Work Programme and Dates and Times of Future Meetings are also on the agenda.

The meeting will also receive updates from the Joint Audit Panel and the Audit, Risk and Assurance Committee (ARAC).