The Corporate Governance, Audit and Standards Committee of Rushmoor Borough Council was scheduled to meet on 24 September 2025. According to the agenda, the meeting was to cover internal audit updates, surveillance policies, and the annual review letter from the Local Government and Social Care Ombudsman. The committee was also scheduled to receive an update on the appointment of an Interim Managing Director and Head of Paid Service.

Internal Audit

The committee was scheduled to receive three reports from the Southern Internal Audit Partnership (SIAP), the council's internal auditors. These reports were:

• The Internal Audit Progress Report August 2025, which provides an overview of internal audit activity and key updates.
• A report including the internal audit external quality assessment.
• A report detailing the Internal Audit Strategy 2025-28.

The [Internal Audit Progress Report August 2025][Item 2. Internal Audit] summarised the activities of internal audit for the period up to August 2025. According to the report, the Southern Internal Audit Partnership (SIAP) was experiencing a higher than average level of attrition, resulting in vacancies. The report stated that contingency arrangements were in place to mitigate such eventualities.

The report also included a rolling work programme, detailing progress on a number of audit reviews. These included:

• Disabled Facility Grants
• Capital Programme
• Effectiveness of Financial Rules
• NNDR
• FMS & Bank Reconciliations
• Sales Ledger
• Union Yard
• Pay360
• Risk Management
• Programme / Project Management
• Contract Management
• Procurement
• Cyber – Training & Awareness
• IT Contingency
• Treasury Management
• Financial Recovery Plan
• Recruitment & Retention
• LGA Peer Review – Action Plan
• Temporary Accommodation
• Asset Management & Disposal
• Agency Staff
• Budget Management
• Contingency – Devolution & LGR

The report also included an analysis of 'Live Audit Reviews'.

The [report on the internal audit external quality assessment][Item 2. Internal Audit] noted that the Global Internal Audit Standards (GIAS) require the Chief Internal Auditor to develop a plan for an external quality assessment, to be performed at least once every five years by a qualified, independent assessor or assessment team. The report stated that there are two approaches to meeting the requirement of an External Quality Assessment: A Full-scope External Quality Assessment (EQA) and a Self-assessment with Independent Validation (SAIV). It was proposed that the Southern Internal Audit Partnership conduct their external assessment as a Self-Assessment with Independent Validation (SAIV).

The [report detailing the Internal Audit Strategy 2025-28][Item 2. Internal Audit] stated that the Global Internal Audit Standards in the UK Public Sector requires the internal audit function to develop and maintain an internal audit strategy, defined as:

a plan of action designed to achieve a long-term or overall objective. The internal audit strategy must include a vision, strategic objectives, and supporting initiatives for the internal audit function. An internal audit strategy helps guide the internal audit function toward the fulfilment of the internal audit mandate.

The report stated that following a process of engagement with the Partnership's key stakeholders, three objectives have been prioritised to help attain their vision over the medium-term (2025 - 2028). These objectives are:

• Agile Auditing: Innovate to explore a more agile approach to the audit process, building efficiencies and producing more timely feedback to the organisation.
• Optimisation of Standards: Embrace and prioritise conformance and embedding of the Global Internal Audit Standards in the UK Public Sector and maximising their potential to benefit the organisation and the internal audit function.
• Data Analytics by Default: Further engage with the organisation to enhance and optimise the full potential of data analytics in the internal audit process.

Surveillance Policy

The committee was scheduled to consider a report updating them on the council's surveillance activities within and outside the scope of the [Regulation of Investigatory Powers Act 2000 (RIPA)]¹. The report noted that most of the surveillance carried out by the council is done overtly, and that the council's corporate policy on the use of covert techniques under RIPA should be reviewed regularly. It also noted that the Investigatory Powers Commissioner's Office (IPCO) reviews Rushmoor Borough Council's policies and procedures relating to RIPA on a regular basis.

The report stated that most of the surveillance undertaken by the council is outside of RIPA, for example, for planning enforcement purposes or under Licensing legislation, and that the IPCO have made clear that robust processes and procedures need to be in place for any surveillance carried, whether under the RIPA provisions or under separate legislation.

The report also noted that CCTV surveillance across the Borough is carried out by Runnymede Borough Council, on behalf of Rushmoor Borough Council, with the appropriate General Data Protection Regulation (GDPR) and contractual arrangements in place, and that this CCTV surveillance is outside of RIPA.

The report stated that there had been no requests for RIPA authorisation via Legal Services since the last report in September 2024, and that the IPCO confirmed in June 2023 that it was content with the council's RIPA policies and related governance in place. A further inspection by the IPCO was not expected until 2026.

Annual Ombudsman Complaint Review Letter

The committee was scheduled to receive the Monitoring Officer's Report summarising the outcome and findings of the Annual Review Letter 2024/25 from the Local Government & Social Care Ombudsman (LGSCO).

The report noted that the LGSCO had received two complaints in respect of Rushmoor Borough Council for the relevant period, but both complaints were closed on the Ombudsman's initial enquiry.

Update on Appointment of Interim Managing Director and Head of Paid Service

The committee was scheduled to consider a report from the Leader of the Council, setting out an update on the Interim Managing Director role.