The Audit, Standards and Statutory Accounts Committee convened to discuss the council's governance, risk management, and audit activities. The committee approved the minutes from the previous meeting, reviewed the annual governance statement, and discussed risk management and internal audit findings related to the change programme. The committee also agreed to move the date of the next meeting to November 24th.

Change Programme Audit

The committee discussed the findings of an internal audit review of the council's change programme. The audit gave 'limited assurance' on the programme, and made four priority one recommendations.

Councillor Caroline Wren addressed the committee with concerns about the change programme, saying:

...the reports that Council are receiving on performance of the programme are being drafted with flaws that should lead us to be concerned about how the programme is being managed and how the money is spent.

Councillor Wren said that reports were relentlessly positive and attributed successes solely to the change programme, when other factors were likely at play. She cited the example of faster telephone answering times, which officers had previously attributed to fixing staff shortages and operational changes unrelated to the change programme.

Sam Olson, Executive Director of Change and Innovation, responded that the report to the Finance, Policy and Resources Committee was specifically a 'benefits realisation paper', and was designed to focus on the benefits of the programme. She assured the committee that a rigorous process had been followed to determine what should be attributed to the change programme, and that everything in the benefits paper had been funded through the programme.

Councillor John Coombs raised concerns about the implementation dates in the audit report, noting that some priority one recommendations had implementation dates in the past, but the report did not state what had happened. Andrew Hamilton, Assistant Director of Audit Shared Service, clarified that the management response column was for managers to state what they had done and when they thought the implementation date should be. He said that the audit team had not verified these statements, and would do so as part of the follow-up process.

Councillor Coombs also asked about a key performance indicator (KPI) to reduce customer call handling times from 1,000 to under 400, and when progress on this would be visible. Sam Olson responded that she speaks to a Councillor Brown (now Councillor Millard) every month on customer services, digital matters and the change programme, and that telephony performance was on track. She added that the focus was now on improving email response times and enabling customers to find information themselves on the website.

Councillor Stephen O'Shea said that a 'limited assurance' audit was not good news, but he was reassured that the team recognised some of the problems and were trying to respond to them. He asked for reassurance that Andrew Travers, the Chief Executive, was across the programme and had a clear vision for it. Sam Olson responded that it was his number one priority, and that he had spoken to all staff about taking it to the next phase.

Councillor Nancy Baldwin asked when the council could expect the £4-6 million in savings that the programme was originally intended to deliver. Sam Olson said that she had seen the first six business cases last week, and that they were going through a process with the Executive Director for Finance. She added that there were 14 in flow, and that Andrew Travers wanted to ensure that they were all lined up so that they could be seen in this year's budget round.

Councillor Anton McNulty-Howard said that the average citizen would not understand the discussion, and that there was no real joined-up thinking or long-term view of how it would benefit residents. Sam Olson responded that the change programme had been about dealing with systemic issues and sorting out the foundations, but that the next phase of transformation would be more focused on what it means for the resident.

The committee noted the findings presented in the Change Management Internal Audit Review.

Annual Review of Risk Management

The committee then discussed the annual review of risk management. Kevin Holland, Assistant Director, Fraud, Risk and Insurance, introduced the report, explaining that it was both backward-looking and forward-looking. He said that the report provided assurance that the approach for 2024/5 met the necessary requirements for risk management, but that there was a wider review of risk management underway to see what needs to change.

Kevin Holland said that the report was a one-off snapshot of what happens in terms of risk management, whereas the approach that is endorsed is that risk management is owned by every service. He added that it was very hard to try and capture all of that, but that was something they were looking to see what they could do further.

Councillor John Coombs noted that the summary of department service head returns received showed that housing and regeneration had 18 high risks, much more than any other department. He asked how much of that was Richmond and how much was Wandsworth. Kevin Holland responded that the core of the high-risk areas in Wandsworth was in housing management, related to issues of managing the stock. He apologised that he should have done more work to exclude those out of the process, and offered to provide an updated table.

Councillor Stephen O'Shea said that he was interested in the high-risk ones, and asked whether the mitigations in place reduced the risk, or whether the council was still faced with a very significant risk even after all of the mitigations had been applied. Kevin Holland responded that the scores were the residual risk, after the services believed that these were the controls that they had, or the ones that they could apply.

Councillor O'Shea also asked about the cyber security risk, and whether the council was really saying that there was a 50 to 89% chance of millions of pounds worth of damage. Kevin Holland responded that the council and its IT services were at the forefront in terms of what they need to do to be protecting themselves, but that the biggest one in recent times was the attack that happened to Hackney, which cost tens of millions.

Councillor Anton McNulty-Howard asked how well the council tests and challenges these returns and the implications of them. Kevin Holland responded that that was currently outside the remit of what they do in risk management, and that he did not have the resource to challenge that. He added that the services are responsible for their own areas and their own review and contract management, supported by the procurement team.

Councillor McNulty-Howard asked if Kevin Holland was happy with the whole system at the moment. Kevin Holland responded yes sir.

The committee received as information the results of the annual review of the Risk Management Strategy carried out by Executive Directors, approved the Risk Management Strategy for 2024/25, and commented upon and noted the outline proposal for the review of risk management.

Annual Governance Statement

The committee reviewed the council's governance arrangements incorporating internal control, the proposed annual governance statement, and the Chief Audit Executive's opinion on risk management, control, and governance.

Andrew Hamilton introduced the report, noting that it was an annual report that comes to the committee in two parts: the annual governance statement itself, which they were being asked to approve for signing by the Chief Executive and the leader, and the annual audit report, which includes the Chief Audit Executive's opinion on risk management control and governance and a summary of the work completed during 2024-25.

Andrew Hamilton said that the majority of the pieces of work where they gave a specific opinion were positive, around 83%, and that there were a small number of limited or limited assurance reports and one no assurance report in the year's work that was completed. He said that Appendix A lists all of the pieces of work that they completed during the year along with their opinions where they gave one and the numbers of recommendations that they made each the priority for your information and that they completed seven key financial systems audits during the year which are some of the more important audits that they do and they were all given positive opinions which again is positive.

Andrew Hamilton also pointed out that the report makes reference to compliance with the public sector internal audit standards, and that he needed to confirm to the committee that he was satisfied that they did comply with the public sector internal audit standards in the work that they completed last year.

Councillor Nancy Baldwin asked what kind of pressure the lack of external audits was putting on the internal auditors, and how it was affecting their ability to do what they have to do. Andrew Hamilton responded that the council has caught up in terms of its external audits and the accounts, and that it doesn't really affect them in terms of what they do in internal audits.

Councillor Baldwin asked why everything that was substantial on finance was now reasonable. Andrew Hamilton responded that they changed their opinions a couple of years ago, and that full assurance was something that they shouldn't really be giving ever just because it suggests that every single process in place works as it should do and they can't possibly look at everything when they do an audit.

Councillor James Chard asked about the limited and no assurance audits, specifically the use of council vehicles and business continuity plans. Andrew Hamilton responded that business continuity plans need to be tested or potentially they're not worth the paper they're written on, and that in terms of the use of council vehicles, the key controls that you'd expect around monitoring, having good governance arrangements in place, those sorts of things just weren't there.

The committee noted the council's statutory annual review of its governance arrangements, noted the Assistant Director of Audit Shared Service's annual opinion on risk management, control and governance, and approved the proposed Annual Governance Statement for 2024/25 for signature and publication with the council's accounts.

Committee Work Programme

Finally, the committee discussed the committee work programme. Councillor Baldwin noted that there was one meeting with a lot of items on it, and then another with only two items. She asked if there was anything that could be moved into another meeting. The committee agreed that the meeting scheduled on Thursday, October the 23rd be moved to Monday, the 24th of November 2025.