This meeting of the Audit and Risk Committee saw the consideration of a range of reports that covered topics including internal audit, financial management, the statement of accounts, value for money, and risk management.

The committee were also asked to note the minutes from the previous meeting of the committee on 24 September 2024 ¹.

Development of the 2025/26 Internal Audit Plan

The committee was asked to note and endorse the proposed approach to developing the 2025/26 Internal Audit Plan.

The committee was asked to highlight to Rachel Ashley-Caunt, Chief Internal Auditor, any risk areas it wanted to be considered for inclusion in the plan by 1 February 2025 ².

a) Reviewing the Council’s Risk Register and Corporate Plan;

b) Analysing coverage of Internal Audit reviews over the last four years and the assurance opinions provided following each review, to identify any assurance gaps or areas where follow up work would be of value;

c) Identifying any other sources of assurance for each of the Council’s key risks, which may reduce the added value of an Internal Audit review and where work could be aligned with other assurance providers;

d) Identifying any areas of the Audit Universe (a list of potential areas for audit review across the Council) which have not been subject to Internal Audit review during the last four years;

e) Consultation with the Audit and Risk Committee to discuss the planning process and areas where Members require assurances from Internal Audit during 2025/26, in the form of this report; and

f) Meetings with senior management to discuss key risks and emerging risk areas for the year ahead and any areas where Internal Audit support would be beneficial either in an assurance or consultancy role.

Internal Audit Update

The committee was asked to note the Internal Audit progress update report ³.

The committee was also asked to approve proposed amendments to the 2024/25 Internal Audit Plan. These included removing the audit of the Ofsted action plan, postponing the audit of the council's flood authority statutory duties to 2025/26 and replacing these with an audit of the council’s engagement with the Building Control Partnership, and an advisory review of Equalities, Diversity and Inclusion.

Annual Report of the Audit and Risk Committee

The committee was asked to recommend to full council that it note the Annual Report of the Audit and Risk Committee.

Financial Management

The committee was asked to note the findings and recommendations of a review of financial management commissioned by the council to support its wider transformation agenda ⁴.

Statement of Accounts 2023-24

The committee was asked to consider and approve the Statement of Accounts for 2023/24, taking into account the findings of the external audit as set out in the Audit Findings Report ⁵ provided by Grant Thornton.

“the Council should consider how to include an additional layer of control within the journal process to evidence that the relevant manager has appropriately reviewed the supporting documentation for the journal and has approved it accordingly.”

The report pack also asked the committee to consider and approve the Management Representation Letter.

Value for Money Report 2023-24

The committee was asked to consider the draft Auditor’s Annual Report for 2023/24 ⁶. The committee was also asked to consider the auditor's assessment against the Value for Money criteria, any recommendations the auditor had made, and the management response to these.

“Continue to review its current financial position, identify and implement actions that reduce its reliance on reserves to balance the budget in the medium term.”

Risk Management Policy - Proposed Revisions

The committee was asked to consider the updated Risk Management Policy, which is to be put to Cabinet for approval on the same day as the meeting ⁷.

• The Strategic Director for Law and Governance becomes the CLT member designated the guardian of the Policy and the champion of the risk management process, replacing the Strategic Director for Resources

• Terminology is updated to amend “Strategic Management Team” and “SMT” to “Corporate Leadership Team” and “CLT”

• A new term - “Corporate Risks”- is introduced to describe those risks which relate to the achievement of the long-term purpose, priorities and plans of the Council; impact more than one directorate or which require a response to be co-ordinate across multiple directorates; as well as Directorate risks which, if they materialised, would have the potential to impact significantly on service delivery and the reputation of the Council.

• The risk register has been redesigned to automate the links between directorate and project registers and the Corporate Risk Register

• The risk assessment criteria have been amended to replace a fixed timescale measure linked to a corresponding probability measure, with an urgency measure

Information Governance

The committee was asked to note the Information Governance Annual Report 2023/24, which provides a summary of information governance activity during the year. The report identifies a number of areas for improvement, including that the council should:

“Continue to work towards improving its response to Subject Access Requests (SARs). To continue to monitor the new approach to managing SAR’s and report back to committee on improvements made.”

The report notes that 17 data breaches were reported during the year, none of which were reported to the Information Commissioner’s Office (ICO).