Minutes
|
|
|
|||
|
|
OF A MEETING OF THE
|
|
|||
|
|
Joint Audit and Governance Committee
HELD on Tuesday 3 October 2023 at 7.00 pm Meeting Room 1, Abbey House, Abbey Close, Abingdon, OX14 3JE |
|
|||
Present in the meeting room
Members:
South Oxfordshire District Councillors: Mocky Khan (Co-Chair), Peter Dragonetti, Leigh Rawlins, and Tony Worgan
Vale of White Horse District Councillors: Emily Smith (Co-Chair in the chair), Oliver Forder, Judy Roberts, and Andrew Skinner
Officers: Darius Zarazel (Democratic Services Officer), Simon Hewings (Head of Finance), Victoria Dorman-Smith (Internal Audit and Risk Manager), Yvonne Cutler Greaves (Risk and Insurance Team Leader), and Abigail Witting (People and Culture Manager)
Remote attendance:
Officers: Bertie Smith (Broadcasting Officer), Patrick Arran (Head of Legal and Democratic), Simon Turner (IT Programmes Manager), John Tredrea (Auditor), and Mark Minion (Head of Corporate Services)
Guests: Councillor David Rouane (Leader of South Oxfordshire District Council), Councillor Bethia Thomas (Leader of Vale of White Horse District Council and Cabinet Member for Climate Action and the Environment, Strategic Partnerships and Place), Councillor Andrea Powell (South Oxfordshire District Council Cabinet member for Corporate Services, Policy and Programmes), Councillor Andy Foulsham (Vale of White Horse District Council Cabinet member for Corporate Services, Policy and Programmes), and Richard Tebbs (EY)
10 Apologies for absence
Apologies for absence was received from the independent member, Mike Boon.
11 Minutes
RESOLVED: to approve the minutes of the meeting held on 4 July 2023 as a correct record and agree that the chair sign these as such.
12 Declarations of interest
There were no declarations of interest.
13 Urgent business and chair's announcements
The chair welcomed everyone to the meeting, outlined the procedure to be followed, and advised on emergency evacuation arrangements. She also noted that there was no urgent business.
14 Public participation
There was no public participation.
15 Local audit update
The committee received the local audit updated, presented by the head of finance. He emphasised to the committee that the delay in the local audit signoff was a long-term issue for many local authorities and that the under-secretary of state for local government and building safety had put out a statement with the goal of starting the process of clearing the backlog.
The under-secretary of state proposed two methods of doing so. The first was through a number of statutory deadlines, although it was acknowledged that the auditors may only be able to give a certain level of assurance to all councils if issued with certain deadlines. The second was through longer-term changes to the auditing process. The head of finance noted that district councils were required to produce significantly more in their statement of accounts than other body of the same size. He also clarified the timescales for these changes and noted that the government had planned to implement them by December 2023, but the council had not received any update since their last report in July. The council was therefore waiting for more information before any concrete steps could be taken to plan for the proposed changes.
On the council’s statement of accounts, the head of finance confirmed that they had been audited up to and including the 2020/21 and would look to sign the 2021/22 accounts at the extra Joint Audit and Governance Committee meeting on the 30 October 2023.
Members asked about the new external auditor, Bishop Fleming, which would be auditing the council’s 2023/24 accounts and the head of finance informed members that they were procured on the council’s behalf as they signed up to the national purchasing agreement for external auditors. Although they were new to the market, the head of finance informed the committee that he was confident in the appointment system and that the firm had worked elsewhere in the public sector, but that there was recourse if the councils were unsatisfied with their performance.
In addition, when asked about if the change may result in the current auditor, EY, taking longer to audit their accounts, the head of finance assured members that he had worked with EY for a number of years and was confident they would continue to work to the required standard on the audit.
On questions about why the accounts were so large and taking so long to be audited, the head of finance clarified to the committee that local authority requirements on the accounts were very large and growing each year as the standards were becoming more rigorous given the number of local authority failures. He also provided the example that South Oxfordshire and Vale of White Horse District Councils were required to submit the same detail in their accounts as Birmingham City Council, the largest local authority in Europe and that some reasons for the delay were also noted as being the pension deficit valuation. In addition, when asked about what the council could do to accelerate the signoff for the accounts, the head of finance believed that the councils should wait for the next stage of the central government’s proposals as this could potentially have a significant impact on the auditing timescales and requirements.
Members agreed that they would like to see a smaller, less detailed, statement of accounts for smaller local authorities as they believed this would still be effective for auditing purposes whilst best using public money and time and that this would also make the accounts more accessible and understandable. Although the head of finance agreed with the committee’s suggestion, he noted that the accounts were continuing to get larger each year and if that was not solved there would still be delays.
The committee thanked the head of finance for the update, and he confirmed that he would report back to the committee when more information about the suggested audit changes was made available by central government.
16 Information security audit
The committee received an update on the information security audit, presented by the internal audit and risk manager, the IT programmes manager, the head of corporate services, and the people and culture manager. The update was requested at the last committee meeting, on the 4 July 2023, in responses to several items on the information security audit being overdue and high risk.
The internal audit and risk manager informed members that there were 12 actions open in July but since then, 10 had been actioned and there were only two still open. The two open actions were on the cyber security response strategy and the business continuity disaster recovery testing scenarios.
Members enquired into a recent data breach at Capita around March 2023 and the IT programmes manager clarified that none of the councils’ infrastructure or data was affected.
On information security training, the people and culture manager confirmed that they had worked with IT and a revised IT policy and training were available for members and officers. She also confirmed that officers monitored cyber training statistics, which could also be provided to the committee, through the councils LEAH platform (an online training portal). The people and culture manager highlighted that they had provided a deadline to staff, asking them to read and understand the IT policies by the end of quarter three, and that new staff would be provided with a list of compulsory training alongside their contract of employment.
When asked if the councils ran tests to check officer and member compliance and understanding of IT policies, the IT programmes manager confirmed that a question-and-answer section was included in the training and the head of corporate services added that once the councils were outside of the Capita contract, they were more able to run compliance tests. However, the committee noted that since the training was issued, members and officers were more aware of potential IT breaches and were taking more precautions.
Members then asked if there was a review of the times insecure or unsafe sites were attempted to be accessed. The IT programmes manager clarified that all devices on the councils’ network were managed through a proxy service which, if identifying a threat or risk, would prevent access and the councils received a monthly report from Capita about those numbers. However, the numbers provided would be for all the five councils in the Capita contact rather than just the South Oxfordshire and Vale of White Horse District Council numbers. Finally, he also noted that once the councils moved out of the Capita contract, similar cyber defences would be needed to be provided by the councils themselves and at that stage he would know the exact figures.
Finally, the committee inquired into the take-up and completion rate of the IT training and if there was a difference in requirements between full and part-time members of staff. The head of corporate services confirmed that they did run reports on this and that the take up could be better for both staff and members. He also said he was speaking to the heads of service to encourage their teams to complete the training or to do refresher courses, due to the changing nature of cybersecurity. On full time and agency staff, the people and culture manager added that they had made a matrix for agency and contracted employees to identify what training was needed at what stages of employment. Members asked if a matrix could be provided for members and the people and culture manager said that training guides already existed but that more assistance, or training days, could be provided should a knowledge gap about accessing or completing the training be identified.
The committee thanked all the officers for their answers to their questions and the work they had done to close the open actions from the internal audit.
17 Internal audit update report - Q2 2023/24
The committee received the internal audit update report for quarter two 2023/24, presented by the internal audit and risk manager. The report summarised the outcome of the work done in quarter two, and the progress made against the 2022/23 and current year internal audit plans.
The internal audit and risk manager noted that she had received a 100 per cent response rate from action owners, an improvement on previous quarters. In addition, 40 actions had been completed in the quarter and 161 were open. She confirmed to members that progress on last year’s audit plan was good with only one more audit to finalise, which was about to be issued in final. In addition, she noted that there was also good progress being made on the current year’s audit plan, but that staff sickness had put some audits on hold. The internal audit and risk manager then informed members that the committee had been presented with the two limited assurance reports: the first on health and safety 2022/23 and the second on the report lifecycle process 2023/24.
On the health and safety report, the auditor informed the committee that a number of staff changes in the service required a revised report and that progress had been made on some of the recommendations but that some of the actions were overdue. The head of corporate services also noted the staffing issues in the health and safety team had caused delays in progressing the audit actions but that they now had a full-time interim officer in place for the remainder of the calendar year who put out reminders to all teams to review their risk assessments and to ensure they were fit for purpose. He also highlighted to members that a recruitment exercise was ongoing for full-time senior officer and adviser positions.
Members of the committee asked the officers about some of the public liability insurance for contractors being not found or below the normal level of insurance. In response, the councils’ auditor confirmed that he could go back to the audits to check for the reason but assured members that they would need the review and approval of the relevant head of service before being signed off.
The committee also discussed the due dates displayed on the internal audit plan and requested that the original due dates for actions be kept in the plan as well as the revised dates in order to help better track the actions.
The committee inquired into homeworking and the head of corporate services clarified that officers of the councils were employed on hybrid contracts, not homeworkers, which would be a different contract and the people and culture manager added that all hybrid staff were responsible for completing a Display Screen Equipment assessment and that the councils had a comprehensive homeworking policy.
The second limited assurance report brought to the committee was on the report lifecycle process. Members noted that it was one of the first to use a new layout, something they greatly appreciated as they commended the new style’s clarity. The internal audit and risk manager welcomed the members comments on the new style and was open to sending the cover pages of all reports to members in the new style, not just the limited assurance reports, and this was an approach the committee welcomed.
Members inquired into point 6 in the report, ‘consultation with experts’, and asked for assurance that the reports were being signed off appropriately. In response, the head of legal and democratic said that the audit highlighted ways the report signoff process could improve and that the existing template did not detail which officer was the one to sign off the report. The democratic team accepted the actions from the audit and would ensure there was appropriate clearance shown in the checklist of all reports. The head of legal and democratic also confirmed that all reports going to cabinet were going through the appropriate processes but that consultees would be more involved in reports at an earlier stage in order to provide more time for them to be appropriately reviewed before publication.
Some members asked about the management actions not detailing that officers’ names would need to be on report checklists, but the committee was satisfied with the clarification from the head of legal and democratic that this would be included and that the democratic department had been made aware of this requirement. He also confirmed that more education to officers about the report lifecycle process could be provided to help all officers understand the requirements and timescales.
Overall, the committee thanked the internal audit and risk manager for her report and were satisfied with the actions outlined in the limited assurance reports and that their questions to the action owners were appropriately answered.
18 Annual complaints report
The committee received the annual complaints report for 2022/23 presented by the head of corporate services. The report was a review of formal complaints received during 2022/23 and highlighted that the number of complaints received by both South Oxfordshire and Vale of White Horse District Councils had gone down in comparison to the previous year, as well as the number of complaints that had gone to the Local Government and Social Care Ombudsman (the Ombudsman). The committee was encouraged to see the total number of complaints had reduced.
The head of corporate services informed the committee that the councils had 15 working days to respond to complaints at stage one, and also 15 working days if elevated to a stage two complaint. He confirmed that the councils met the deadline in the majority of cases and if not, they agreed an extension with the complainant and that these extended deadlines had been consistently met.
As South and Vale District Councils were now social landlords, the head of corporate services informed members that they had updated their policy and websites to reflect that new area and the potential for receiving housing complaints.
On the outcome of complaints to the Ombudsman being upheld, members asked if the council had a formal policy in place to assess the complaints and ensure that lessons were being learnt from. The head of corporate services responded that there was no formal procedure in place, but he would talk to his team to see if this would be valuable and how it could be best implemented. However, he assured members that the relevant service areas did learn from Ombudsman upheld complaints. Also, when asked about the Ombudsman requiring the council to pay financial compensation to complainants, he confirmed that these payments were usually small based on Ombudsman guidance and would come from the relevant service area’s budget.
Finally, the head of corporate services also agreed with a members’ suggestion that more detail should be provided as to which services areas were affected by the complaints going to the Ombudsman in future annual complaints reports to the committee.
RESOLVED: that the committee notes:
1) the formal complaints received in 2022/23 and the councils’ performance in responding against timescales set out in our Corporate Complaints Policy and Procedure.
2) the complaints received by the Local Government & Social Care Ombudsman relating to the councils, and
3) the revised Corporate Complaints Policy and Procedure following the councils’ registration as a social landlord.
19 Review of terms of reference for appointment of independent person
The committee received the report on the review to their terms of reference for the appointment of the independent member by the head of legal and democratic. The report was requested at a previous committee meeting, on the 15 November 2022, as part of the resolution to recommended that an independent person be appointed to the committee.
The head of legal and democratic informed members that the council looked to appoint an independent person to the committee before it became a legal requirement and that the report set out the basis for that appointment. Since the last meeting in July, Mr Mike Boon had been appointed to the role.
As part of the committee’s recommendation for the independent person, they also suggested that a mechanism be provided in the terms of reference to remove them if they did not perform to the expected standard, and the report provided some suggested wording to allow for that. Overall, the committee was satisfied with the suggested wording but also that the independent person could have the appropriate time to respond before being removed.
The chair then informed the committee that members had been involved in the recruitment of the independent member and that she was looking forward to their contribution to the committee moving forward.
RESOLVED: that the committee:
1) Agrees to a proposed change to the committee’s terms of reference as set out below:
“The committee may consider the removal of the independent person from the committee if it is agreed that they are not making a meaningful contribution to the work of the committee. Any request for their removal must be made to the co-chairs of the committee who will consult with the monitoring officer and section 151 officer. The committee will make a final decision on the matter. The independent person will have the opportunity to respond to the proposal at the committee if there is cause to consider such a proposal.”
2) Recommend that council approve the additional wording and authorise the head of legal and democratic to make the changes to the council’s constitution.
20 Corporate risk review
The committee received the corporate risk review, presented by the risk and insurance team leader. The report was brought to the committee as it was a regular half yearly item.
The risk and insurance team leader informed members that there were 25 risks identified in March 2023, but that had now increased to 31 – identified in part by the council’s new risk forum and risk champions. This was noted as being due to the changing local government landscape, new councils’ priorities, and over Housing Infrastructure Fund (HIF1). The top ten risks identified included a failure to provide suitable temporary housing for asylum seekers, failure to secure a waste depot, and increased homelessness. However, two regular risks involving IT cyber security had been moved to business as usual as effective mitigation measures had been put in place, reducing exposure to cyber incidents.
Members asked the risk and insurance team leader about broad risks that could affect the organisation itself. Some of the risks suggested in that category were about the risk of losing leadership through staff turnover, causing a loss of corporate memory of best practice, or about culture failures, both of which could potentially cause very serious issues. In response, the risk and insurance team leader confirmed that a point about effective recruitment and retention was on the risk register and that the council officers did engage in collaborative working, even when hybrid working. However, she acknowledged that these macro-organisational risks were interesting points to examine moving forward.
The people and culture manager also informed the committee that they produced quarterly reports on staff turnover which helped to identify areas where a loss of staff could potentially result in a loss of key practical knowledge. She also added that a workforce strategy was going to be put to the senior management team to assist with strategic workforce planning and that leadership and management training was provided for any managers or project leads to help educate and train the staff. The risk and insurance team leader stated that the development of a workforce strategy was a further mitigation action on the risk register against risks 84 South and 86 Vale – with regards to effective recruitment and retention strategy.
Some members of the committee inquired into the hybrid working arrangement of the officers and if the council was looking at other organisations and authorities to look for best practice. The people and culture manager confirmed that studies from outside the council were being brought to the senior management team but emphasised that the council’s hybrid working arrangements was a large positive in the recruiting and retaining of staff compared to other organisations.
The committee asked for an update on point 78/80 in the risk register, and the risk and insurance team leader confirmed that the council’s property team working were currently on this, and the head of finance added that this risk was currently on many local authority’s risk registers. Also, members enquired into point 77/79, and the risk and insurance team leader clarified that this was about the loss of the current waste depot due to the housing development in Culham and needing to secure a new one, and not about the waste contract itself on which work was progressing towards an extension and so was mitigated. Finally, on point 76/78 members asked why this was a new risk when it had been expected, but the head of finance responded that the exit for the Five Councils Partnership was still a few years away but that it was now the appropriate time to start taking mitigating actions, which was why it was a new action on the register.
Overall, members thanked the risk and insurance team leader for the report and emphasised that broader, organisational risks, such as over corporate culture, could be future points to be brought into the risk register.
21 Treasury management outturn report - 2022/23
The committee received the treasury management outturn report for 2022/23, presented by the head of finance. The report outlined that both councils earned more than they budgeted for in the year, which the head of finance confirmed was to be expected due to increased interest rates. However, he also noted that the councils did not outperform the benchmarks for internally managed funds due to the money that was out on fixed term deposits, but he added that he would expect the reverse to happen when the interest rates fall.
In terms of security, the councils saw no breaches of prudential indicators or counterparty limits through the year.
On a question about who the council lent funds to and if that was still going to a number of comparatively small building societies, the head of finance clarified that the strategy allowed them to lend to building societies but that they had reduced the amount lent to them in the recent years, and instead lent more to local authorities. He also confirmed that Thurrock Council had replayed all the money due to the councils on time, and that funds leant to other councils was secure as councils were backed by the United Kingdom government and were considered safe places for the councils lending.
Members then made a point about the economic conditions and factors effecting investment returns during 2022/23, and about if inflation rates should be included. They thought this could be helpful as the council should be conscious about the returns of their longer-term investments against the rate of inflation and to ensure the purchasing power of the invested funds was not eroded.
South Oxfordshire District Council RESOLVED: to
(a) note the treasury management outturn report 2022/23,
(b) confirm they were satisfied that the treasury activities are carried out in accordance with the treasury management strategy and policy, and
(c) confirm they had no recommendations to pass to cabinet
Vale of White Horse District Council RESOLVED: to
(a) note the treasury management outturn report 2022/23,
(b) confirm they were satisfied that the treasury activities are carried out in accordance with the treasury management strategy and policy, and
(c) confirm they had no recommendations to pass to cabinet
22 Work programme
The committee received the Joint Audit and Governance work programme and the democratic services officer informed members about the items that were scheduled to come to the next committee meeting, on 30 October 2023, and for the other meetings in the remainder of the municipal year 2023/24.
The head of finance highlighted that the meeting on the 30 October would be to cover the statement of accounts and would involve four separate items: the external auditors report, statement of accounts, annual governance statement, and the letters of representation to the external auditor.
The chair then confirmed that, if any member of the committee had an item they thought should be on the work programme that they bring it to the attention of the co-chairs for consideration.
The meeting closed at 9.01 pm
Chair Date
|
|
|
|
|
|