The meeting received the Head of Assurance's Annual Report and Opinion on the Council's governance, risk management and control, approved the 2024/25 Internal Audit Plan, received an update on the progress of the external audit, noted the management responses to the recommendations made in the 2022/23 Auditor's Annual Report and received the Corporate Risk Register Update. The meeting confirmed the minutes of the previous meeting.

Annual Internal Audit Opinion 2023/24

The Head of Assurance reported that Lewisham Council had adequate and effective arrangements for governance, risk management and internal control. However, he recommended that the Council include two recurring findings as areas for improvement in its Annual Governance Statement. These are the quality and consistency of the Council's record keeping, and the level of compliance across the Council with returns its Executive Management Team have sanctioned as a required part of maintaining effective governance. The Head of Assurance also reported that he had brought the audit of Lewisham Homes in-house.

Internal Audit Plan 2024/25

The Committee approved the Internal Audit Plan for 2024/25 (8. Internal Audit Plan 2024-25 for Audit Risk Committee 202409). The plan contains 37 proposed engagements and will consume an estimated 830 days of audit resource. The Head of Assurance reported that he would be moving from a cyclical, three-yearly, audit of schools to a risk-based approach. The Head of Assurance said that he believed that Lewisham had adequate resources to deliver robust internal audit assurance in 2024/25.

External Audit Update 2023/24

The Committee received an update from KPMG on the progress of the audit of the Council's 2023/24 accounts (5. External Audit Update 2023-24). The Committee was informed that KPMG had identified a specific risk of management override of controls in relation to the Housing Revenue Account (HRA). The risk arose because the usable reserves in the HRA had fallen consistently over recent years and were under pressure. To mitigate against the risk of the Council inappropriately understating HRA expenditure in order to improve the reported position of the HRA, KPMG proposed to review journal entries with unexpected account code combinations which reduce HRA expenditure and increase general fund expenditure.

Value for Money 2022/23

The Committee noted the management responses to the recommendations made in the 2022/23 Auditor's Annual Report (6. Value for Money 2022-23 Audit Annual Report VFM and Management Responses). The management responses included the details of the Council's approach to reviewing the Council's high-spending services, the method of setting future budgets and savings targets, the process for managing risks and the process for reviewing the performance of the Council's services.

Corporate Risk Register Update September 2024

The Committee received the Corporate Risk Register Update (9. Corporate Risk Register Update September 2024). The Committee discussed the changes to the risk register since the last update in December 2023. These changes included:

• The risk of the Council failing to achieve full regulatory compliance for Council Housing Stock (LBL001) being raised from 20 to 25. The risk score was increased because of the intervention of the Regulator of Social Housing.
• The risk of the Council losing overall financial control (LBL011) being changed to reflect that the Council is currently experiencing significant persistent overspends. The risk now focuses on mitigating the negative impacts of overspending.
• A new very high risk being added to the register, relating to the Housing Management System Software Implementation Failure (LBL021).
• The risk of the Building for Lewisham Programme failing (LBL020) being divided into seven sub-risks.
• The risk of the presence of Reinforced Autoclaved Aerated Concrete (RAAC) in the Council's school and corporate buildings (LBL016) being removed from the Corporate Risk register and added to directorate level risk registers.
• Two new risks being added to the register, the risk of loss of power in corporate buildings (LBL022), and the risk of significant underperformance or disruption in partner IT services delivered through the Shared Technology Service (LBL023).

The Committee also discussed the development of a new Emergency Planning Risk Register.