The Governance, Audit, Risk Management and Standards Committee (GARMS) met on Monday 16 February 2026 to review the Council's audited financial statements for 2024-25 and discuss the corporate and directorate risk registers. The committee received a disclaimed audit opinion on the Council's financial statements for 2024-25 due to national audit process constraints and insufficient time for auditors to complete necessary rebuilding assurance work.

The committee approved the audited Statement of Accounts for 2024-25, noting the disclaimed audit opinion was not attributable to the Council's actions. Significant risks discussed included a successful cyber or ransomware attack on the Council, failure to meet the demand for Adult Social Care within budget, significant overspends on Children's Services placements, and insufficient supply of affordable accommodation to meet homelessness demands. The committee also reviewed the Directorate Risk Register for Resources, noting a stable risk environment with the exception of an increased risk rating for cyber attacks. The Internal Audit and Corporate Anti-Fraud Team's progress report was noted, with a slight delay in recovering social housing units and disrupting fraudulent Right to Buy applications. Finally, the Treasury Management Strategy Statement, including Prudential Indicators, Minimum Revenue Provision Policy Statement, Annual Investment Strategy, and Annual Capital Strategy for 2026-27 were approved.

Statement of Accounts 2024-25 Audited

The committee reviewed the audited Statement of Accounts for 2024-25. Sharon Daniels, Strategic Director of Finance, presented the report, explaining that due to national audit process constraints and insufficient time for auditors to complete necessary rebuilding assurance work, a disclaimed opinion would be issued for the 2024-25 financial statements. This means the auditors, Forvis Mazars LLP, were unable to express an opinion on whether the financial statements give a true and fair view. Councillor Kanti Rabadia, Chair of the committee, noted that the disclaimed opinion was not attributable to the Council's accounts or actions, but rather to the auditors' processes and national guidance.

The committee approved the audited Statement of Accounts for 2024-25 and authorised the Chair to sign them. They also noted the Pension Fund Annual Report for 2024-25, which received an unqualified opinion. The Strategic Director of Finance was authorised to make any final minor amendments to the Statement of Accounts prior to the auditor's signature.

Corporate Risk Register 2025/26 Q3

The committee reviewed the Corporate Risk Register for Quarter 3 of the 2025/26 financial year. There were 17 open risks, with four rated as RED:

• Risk 1: Successful Cyber or Ransomware Attack: This risk's likelihood was re-evaluated and increased due to recent cyber incidents at neighbouring London councils. The risk has been reworded to include ransomware, and a contingency plan was updated in January 2026.
• Risk 2: Failure to meet demand for Adult Social Care (ASC) within budget: This risk remained stable, with work underway to ensure effective commissioning strategies and operational practices. Growth has been put into the draft budget for 2026/27 to make it more sustainable.
• Risk 3: Significant overspend on Children's Services Placements budget: A desk-top review of children's services placement activity has been commissioned to provide assurance on cost management systems and processes. Close oversight of placement costs through the High-Cost Panel continues.
• Risk 4: Insufficient supply of affordable accommodation to meet the demands of homelessness: This risk was reworded and re-articulated in Q3 from Increasing homelessness and demand for temporary accommodation (TA) cannot be met by the budget set out in the MTFS as this risk had been realised. The focus is now on the Council's mitigations of underlying demand pressures and supply factors.

Councillor Philip Benjamin raised concerns about the rewording of risks and whether it impacted the calculation of the risk register. Alex Dewsnapp, Managing Director, explained that rewording was done to focus on what the Council could mitigate and control. Councillor Kuha Kumaran requested monthly updates on cybersecurity threats and the latest technologies deployed. Ben, from the IT security team, confirmed that ransomware emails are regularly received, and staff are trained to identify them. He also detailed actions taken, including restricting external access to Teams and implementing a new AI-powered security monitoring system, which they believe will reduce the risk to AMBER.

Councillor Yogesh Teli inquired about fraud risks, and Alex Dewsnapp confirmed that while there are ongoing bits and bobs in this space, there are no significant losses. He highlighted mandatory fraud awareness training and investment in Justin's team for proactive resources.

Directorate Risk Register (Resources)

Jonathan presented the Resources Directorate Risk Register for Quarter 3. There were seven open risks: one RED, four AMBER, and two GREEN. The risk of a cyber attack or ransomware had increased in significance, aligning with the Corporate Risk Register. Six other risks remained stable. Councillor Rashmi Kalu questioned the data behind some risks, and Jonathan explained that risks have data and evidence behind them, with resident surveys indicating community cohesion is generally good. Councillor Kanti Rabadia, Chair, asked about business-critical contracts and backup plans, with Jonathan stating there were no immediate concerns regarding suppliers.

Internal Audit & CAFT Progress Report

Tracy and Justine presented the Internal Audit and Corporate Anti-Fraud Team (CAFT) progress report as at 31 December 2025. Internal Audit had met all its KPIs except for 5%, attributed to working on prior year audits. CAFT was meeting or exceeding all targets except for the recovery of social housing units and disruption of fraudulent Right to Buy applications. Justine detailed fraud referrals, outcomes, and financial savings, totalling over £1.1 million for the financial year. The National Fraud Initiative had resulted in over £400,000 in savings. Councillor Ghazanfar Ali questioned the IR35 review, and Tracy confirmed it was a surprise as it was thought to be dealt with years ago, but the review was to protect the Council. Justine confirmed that there were only 12 people outside IR35 within the Council, and a provision was made for potential fines.

Review of Treasury Management Strategy

Sharon Daniels presented the Treasury Management Strategy Statement, noting no changes compared to the previous year. The report detailed capital expenditure plans totalling £164 million for the General Fund and £256 million for the HRA over three years. The borrowing requirement was £99 million for the General Fund and £127 million for the HRA. The borrowing portfolio had increased from £413 million to £430 million, primarily due to repaying a higher-interest LOBO loan. The average borrowing rate had reduced from 3.45% to 3.23%. Investment portfolio average rates had also decreased, though UK government investment rates had increased. Councillor Philip Benjamin questioned the increase in borrowing and the drop in investment balances, and Sharon Daniels explained the borrowing was to repay a higher-interest loan and that the DSG deficit was being addressed by government grants. The committee recommended that the Council approve the Treasury Management Strategy Statement, Prudential Indicators, Minimum Revenue Provision Policy Statement, Annual Investment Strategy, and Annual Capital Strategy for 2026-27.

The meeting concluded with the approval of the recommendations for the Statement of Accounts, the Corporate Risk Register, the Directorate Risk Register, the Internal Audit & CAFT Progress Report, and the Treasury Management Strategy.