The Royal Borough of Greenwich Audit and Risk Management Panel met to discuss the council's cyber risk position, the implementation of the Procurement Act 2023¹, the strategic risk register, the annual governance statement, internal audit performance, and the draft statement of accounts. The panel agreed to consider the report on cyber risk in a closed session and reviewed the draft Annual Governance Statement 2024/25, providing comments prior to approval of the 2024-25 Statement of Accounts. The panel also noted the Internal Audit and Anti-Fraud performance report for the period 1 April to 30 June 2025.

Cyber Risk Position

The panel requested to go into closed session to discuss the cyber risk position, citing the increased risk trend noted on the strategic risk register and the severe impact of cyber attacks on various organisations, including public sector entities such as Transport for London (TFL) and other local authorities.

Update on the Implementation of the Procurement Act 2023

The panel considered actions taken by officers to implement the Procurement Act 2023, which came into force on 24 February 2025, bringing significant changes to public sector procurement. The act has a strong focus on transparency, managing conflicts of interest, supporting small and medium-sized enterprises (SMEs), and social value. Actions taken by the Procurement Team include:

• Revised Contract Standing Orders: Approved on 24 June 2024, including process and terminology revisions and a focus on contract management.
• New Procurement System: Implementation of a new eProcurement System aligned to the act.
• Procurement Strategy and Contract Management Support: Establishment of a Strategy and Contract Management Team and roll out of a new Contract Management Framework and Training.
• Social Value: Implementation of a social value system called Match My Project (MMP) to allow suppliers to offer social value services to local community organisations.

The report noted that the emphasis on transparency in the Procurement Act 2023 could lead to additional risks in procurement, as suppliers who do not deliver contracts satisfactorily could be debarred from public contracts.

Strategic Risk Register

The panel reviewed the updated Strategic Risk Register, which identifies key risks to the council's plans and strategies, along with mitigating actions. The register is owned by the Greenwich Management Team (GMT), with each risk assigned to a designated director. The panel considered the Risk Dashboard and Risk Profile, which summarise risk assessments, control effectiveness, and action status.

One of the risks highlighted was CORPGMT 07 - Cyber Security & Data Breaches, with the report noting that the borough must ensure that its systems, services, staff and data are protected from cyber attacks and data breaches to maintain confidentiality, integrity and accessibility.

Another key risk was CORPGMT 13 – Achieving Carbon Neutral by 2030, with the report noting that RBG aims to be carbon neutral by 2030 to mitigate the impact of the climate emergency on the borough and prepare to respond to extreme weather events.

Annual Governance Statement 2024/25

The panel received the draft Annual Governance Statement (AGS) for review and comment prior to approval of the 2024-25 Statement of Accounts. The AGS explains the council's governance arrangements and how controls manage risks. It aligns with the principles of good governance set out in the CIPFA/SOLACE Framework. The report also included the RBG Governance Framework, detailing governance arrangements and their alignment to good governance principles.

The AGS identified areas for improvement, including:

• No Recourse to Public Funds (NRPF): Continued monitoring of NRPF work through the Borough of Sanctuary Council Officers Group.
• Medium Term Financial Strategy (MTFS): Addressing significant budget gaps in the MTFS and replenishing risk reserves.
• Compliance with Health and Safety standards in relation to Social Housing: Continuing to work with the Regulator of Social Housing to address issues raised in a regulatory notice.

Internal Audit and Anti-Fraud Performance 2024/25 (Q1-Q3)

The panel noted the Internal Audit and Anti-Fraud performance report for the period 1 April 2025 to 30 June 2025. During this period, work commenced on 19 audits, with 4 completed. The report included a summary of completed audits, the status of the 2025/26 internal audit plan, and performance against key performance indicators (KPIs).

The report also detailed anti-fraud referrals and investigations, including housing benefit fraud, tenancy fraud, and corporate-related fraud. Between 1 April 2025 and 30 June 2025, Anti-Fraud received 25 referrals relating to allegations of Housing Benefit / Council Tax Support Fraud.

Draft Statement of Accounts 2024/25

The panel considered the draft Statement of Accounts for the year ended 31 March 2025, which had been submitted to Forvis Mazars for audit on 15 July 2025. The statement includes a narrative statement, core financial statements, and notes to the accounts.

The narrative report included an introduction from Councillor Denise Hyland, Cabinet Member for Finance, Resources and Social Value, and highlighted key achievements and future challenges for the council. The report noted that the council continues to face increases in demand for services, inflationary cost increases, and demographic cost pressures, particularly in Childrens' Social Care, Special Educational Needs and Disabilities (SEND), Adult Social Care and temporary accommodation.