The Guildford Council Audit and Risk Committee convened to discuss internal and external audit assessments, risk management, and covert surveillance policies, among other items. The committee approved the Internal Audit Charter 2025-26 and the Internal Audit Risk-Based Plan 2025-26, and noted the updated corporate risk registers. Members also reviewed and discussed the annual update on whistleblowing, requesting further information on outstanding cases.

Here's a more detailed breakdown of the key topics discussed:

Risk Management and Corporate Risk Registers

The committee reviewed the updated corporate risk registers for the first quarter of 2025/26, which included both strategic and operational risks. Luke Harvey, the Joint Assistant Director for Strategy and Corporate Services, presented the report.

Strategic risks are those that could impact the council's medium to long-term priorities, while operational risks are encountered in the delivery of services. Red-rated operational risks are reported to both the Audit and Risk Committee and the Executive.

Several substantive changes were made to the strategic risk register since the last update:

• Financial Sustainability (SR1): Mitigations were updated to include information on the level of reserves, final accounts, and the Independent Assurance Panel. The committee heard that the levels of reserves had been increased through a number of changes, including a reduction in the capital programme and a VAT claim during 2023/24.
• Local Government Reorganisation (SR2): The likelihood score was increased from Unlikely to Possible to reflect the implications of the Weyside Urban Village project and the financial uncertainties of local government reorganisation. Mitigations and actions were also updated.
• Scale and Pace of Change (SR3): Mitigations and actions were updated.
• Fraud (SR10): Mitigations and actions were updated and rescored.
• New Risks: Two new risks were added: Safeguarding (SR12) and Contract Management (SR13).

Internal Audit Strategy 2025-28

The committee reviewed the Internal Audit Strategy 2025-28, as presented by Neil Pitman, Head of Southern Internal Audit Partnership. The strategy includes a vision, strategic objectives, and supporting initiatives for the internal audit function. The top three objectives, based on feedback from a survey of audit committee members and senior officers, are:

1. Agile Auditing: Innovate to explore a more agile approach to the audit process, building efficiencies and producing more timely feedback to the organisation.
2. Optimisation of Standards: Embrace and prioritise conformance and embedding of the Global Internal Audit Standards in the UK Public Sector and maximising their potential to benefit the organisation and the internal audit function.
3. Data Analytics by Default: Further engage with the organisation to enhance and optimise the full potential of data analytics in the internal audit process.

Internal Audit Progress Report July 2025

The committee received the Internal Audit Progress Report July 2025, which provided an overview of internal audit activity and assurance work completed in accordance with the approved audit plan. The report highlighted resourcing issues within the Southern Internal Audit Partnership due to a higher than average level of attrition. Despite this, contingency arrangements are in place to mitigate the impact on service delivery.

Internal Audit External Quality Assessment

The committee discussed arrangements for the pending external assessment of the Southern Internal Audit Partnership against the Global Internal Audit Standards in the UK Public Sector. The assessment, which is required at least once every five years, will be conducted as a self-assessment with independent validation (SAIV). The key drivers for the SAIV approach include that it is a recognised approach within the standards, it requires external validation from an independent, qualified external assessor, it provides a more economical approach, and it minimises capacity implications for partners.

Regulation of Investigatory Powers: Update and Review of Covert Surveillance Policy

The committee received an annual report on the council's use of covert surveillance operations, as regulated by the Regulation of Investigatory Powers Act 2000 (RIPA)¹. Since the last report, there have been no new applications for covert surveillance activities. Training for Authorising Officers took place in September 2024, with further training planned for October 2025.

Update on Whistleblowing

The committee received an update on outstanding whistleblowing cases, as requested at its previous meeting. Further information was provided in an exempt appendix to the report. The committee noted the contents of the appendix and may suggest additional improvements to be made.