The Audit Committee met on Tuesday 23 April 2024 to discuss the local audit backlog, the internal audit plan, and risk management. Key decisions included noting proposals to address the local audit backlog, agreeing the internal audit plan for 2024-25, and noting updates to the corporate and directorate risk registers.

Addressing the Local Audit Backlog and Update on Outstanding Audit of Accounts

The committee received an update on the significant backlog of local authority audits across the country. Mr Ahsan Khan, Head of Strategic Finance and Chief Accountant, explained that proposals from the government and regulatory bodies aim to clear outstanding historical audit opinions by implementing a three-phase approach: Reset, Recovery, and Reform. A critical element of this plan is the introduction of statutory backstop dates, with a key deadline of 30 September 2024 for the publication of all outstanding financial statements.

Mr Jonathan Gooding, an external auditor from Deloitte, emphasised the importance of meeting these backstop dates. He confirmed that progress is being made, and Deloitte will report back to the committee on this matter. Concerns were raised by committee members regarding the tight timetable and the implications of not meeting the deadlines. Mr Gooding noted that sector-wide guidance is still evolving, but authorities failing to meet the deadlines would be expected to report and explain the reasons. Mr Khan assured the committee that the finance team was dedicating resources and prioritising efforts to meet these deadlines, with a focus on completing the value for money exercise thereafter. He also confirmed discussions with the new auditors, EY, to ensure they are fully briefed on any additional work required. Ms Julie Lorraine, Corporate Director for Resources and Section 151 Officer, highlighted that the government's proposals were a response to the recognised backlog in public sector audits and aimed to clear it in the most practical way.

The Audit Committee resolved to:

• Note the summary proposals for addressing the Local Audit Backlog in England.
• Note Deloitte's briefing paper to the Council on Plans for Addressing the Backlog in Local Audits Appendix A.
• Note the position on the outstanding external audits of the Council's Statement of Accounts for 2020/21, 2021/22 and 2022/23.
• Note the council's latest draft accounts for 2020/21 Appendix B, 2021/22 Appendix C and 2022/23 Appendix D.

Internal Audit Plan and Charter 2024-25

Mr David Dobbs, Head of Internal Audit, Anti-Fraud and Risk, presented the proposed Internal Audit Plan and Charter for the financial year 2024-25. He explained that the plan, detailed in Appendix A of the report Internal Audit Plan and Charter 2024-25, outlined the methodology and planned audits, including specific audits for schools. Mr Dobbs confirmed that he had incorporated feedback from the previous year's meeting and consulted with various stakeholders, including the Senior Leadership Team and the Institute of Internal Auditors.

Councillor Rachel Blake inquired about the inclusion of the 'Management of Lettings' and 'Management of Markets – Follow up' audits, which had been discussed at the January 2024 meeting. Mr Dobbs stated that these reports would be presented to the committee if they resulted in a 'limited assurance report'. He also offered to make full audit reports available to any committee members who wished to review them.

The Audit Committee resolved to agree the Internal Audit plan and Charter for 2024-25.

Internal Audit and Anti-Fraud - Progress Report

Mr David Dobbs presented the progress report on the 2023-24 Annual Internal Audit Plan, along with an update on fraud prevention and anti-fraud activities. He highlighted that 47% of audit opinions to date had resulted in 'Reasonable or Substantial assurance', an increase from the previous year's figure of 43%. Mr Dobbs noted that this was an interim figure and subject to change as the remaining work for the 2023-24 audit plan was completed. The report also detailed three 'limited assurance' audit reports concerning the Scheme of Publication, Attendance Management, and the RFQ (Request for Quotation) Process.

In response to questions, Mr Dobbs clarified that 'advisory' opinions would be reviewed and potentially changed if services improved their policies and procedures. Regarding the 'limited assurance' report for Malmesbury Primary School, he stated that the internal audit team would collaborate with the school's finance team to address the identified weaknesses. Ms Julie Lorraine, Corporate Director for Resources and Section 151 Officer, addressed the Attendance Management report, emphasising that accountability for attendance rests with managers and services, not HR. She mentioned plans to implement software to simplify absence reporting for staff and managers. Concerning the RFQ Process, Ms Lorraine explained that a review of procurement thresholds had been conducted, with an independent review commissioned to reduce the burden on budget holders for approvals under £100,000, taking CIPFA recommendations into account. Mr Dobbs confirmed that staff training for the RFQ process is provided but will be reviewed in light of the proposed changes. When asked about an action plan for the recommended changes, Mr Dobbs stated it would be circulated to the committee.

The Audit Committee resolved to note the contents of the report and the overall progress and assurance opinions for audits carried out as part of the 2023-24 Audit Plan.

Risk Management – Corporate and Directorate Risk Registers

Mr David Dobbs presented the report on Risk Management, which included the Corporate Risk Register Appendix 2 for Risk Management Corporate and Directorate Risk Registers and the Health and Social Care Directorate Risk Register Appendix 3 for Risk Management Corporate and Directorate Risk Registers. He highlighted three new risks identified for the Corporate Risk Register: emerging risks in rent collection and arrears, community cohesion, and the 'People First' council transformation programme. These risks are scheduled to be added to the register in the next cycle, with assigned owners and controls. The report also noted that a long-standing risk related to compliance with the Protection of Freedom Act 2012 would be de-escalated from the corporate register due to sufficient mitigation measures.

Councillor Kabir Ahmed requested an update to the risk register to reflect the interim Corporate Director for Health and Social Care, rather than the previous Corporate Director. Mr Dobbs confirmed this would be updated. He also detailed ongoing work to integrate risk registers from recently absorbed entities, such as Tower Hamlets Homes, and to incorporate the pensions risk register into the council's JCAD system. Mr Somen Banerjee, Interim Corporate Director of Health and Social Care, stated that their directorate's risk register was in good shape due to established processes and regular reviews. Mr Warwick Tomsett, Joint Director for Integrated Commissioning, added that repetition and routine in risk management were key to its effectiveness.

The committee discussed the challenges of ensuring all services populate the JCAD system, with Mr Dobbs explaining that this involved a mix of onboarding new services, addressing staff changes, and providing support to those struggling with the system. He assured the committee that his assessment indicated risks were generally being managed, even if not always formally captured. The committee also discussed the importance of clear risk ownership, with advice favouring ownership by Corporate Directors or Directors. Mr Dobbs committed to bringing a chart to the July meeting showing the trend of current and target risks over time, utilising the upgraded software's capabilities. The discussion also touched upon the risk of cyber attacks, with examples of other councils being targeted.

The Audit Committee resolved to:

• Note the updated Corporate Risk Register and request risk owners with risks requiring further scrutiny to provide a detailed update on the treatment and mitigation of those risks, including their impact on corporate objectives, at the next Audit Committee meeting.
• Note the proposed changes to the Council's risk registers, as set out in paragraphs 3.4 and 3.5 of the report.
• Note the updated Health and Social Care Directorate Risk Register and request risk owners with risks requiring further scrutiny to provide a detailed update on the treatment and mitigation of their risks, including their impact on the directorate's objectives, at the next Audit Committee meeting.

Annual Review of the Anti-Bribery Policy

Mr David Dobbs presented the annual review of the Anti-Bribery Policy, noting it was a cosmetic update to reflect current officer contact details and ensure its suitability for circulation. He stated that the Bribery Act 2010 is a strict liability offence, and maintaining adequate procedures is crucial. He mentioned that since the Act's introduction in 2010, only two potential offences had been examined by the council, neither of which met the criminal threshold.

In response to a question about training, Mr Dobbs confirmed that anti-bribery and fraud training is part of the mandatory corporate induction for all officers. He suggested that periodic updates and refreshed training with new scenarios could further enhance awareness.

The Audit Committee resolved to note and approve the Council's updated Anti-Bribery policy Appendix 1 for Annual Review of the Anti-Bribery Policy.

Audit Committee Work Plan

Members of the Audit Committee noted the current work plan. The Chair informed the committee that a new work plan for 2024-25 would be presented at the start of the new municipal year.