Agenda and minutes

Audit and Governance Committee - Wednesday, 13 September 2023 10.00 am

Venue: Surrey County Council, Woodhatch Place, 11 Cockshot Hill, Reigate, Surrey, RH2 8EF

Contact: Amelia Christopher  Email: amelia.christopher@surreycc.gov.uk

Media

Items
No. Item

49/23

APOLOGIES FOR ABSENCE AND SUBSTITUTIONS

    • Share this item

    To receive any apologies for absence and substitutions.

    Additional documents:

    Minutes:

    Apologies were received from Ayesha Azad and Joanne Sexton. Steven McCormick acted as a substitute for Joanne Sexton.

     

     

50/23

MINUTES OF THE PREVIOUS MEETING - 12 JULY 2023 pdf icon PDF 184 KB

    • Share this item

    To agree the minutes as a true record of the meeting.

    Additional documents:

    Minutes:

    The Minutes were approved as an accurate record of the previous meeting.

     

51/23

DECLARATIONS OF INTEREST

    • Share this item

    All Members present are required to declare, at this point in the meeting or as soon as possible thereafter

    (i)            Any disclosable pecuniary interests and / or

    (ii)           Other interests arising under the Code of Conduct in respect of any item(s) of business being considered at this meeting

    NOTES:

    ·         Members are reminded that they must not participate in any item where they have a disclosable pecuniary interest

    ·         As well as an interest of the Member, this includes any interest, of which the Member is aware, that relates to the Member’s spouse or civil partner (or any person with whom the Member is living as a spouse or civil partner)

    ·         Members with a significant personal interest may participate in the discussion and vote on that matter unless that interest could be reasonably regarded as prejudicial.

    Additional documents:

    Minutes:

    There were none.

     

52/23

QUESTIONS AND PETITIONS

    • Share this item

    To receive any questions or petitions.

     

    Notes:

    1.  The deadline for Member’s questions is 12.00pm four working days before the meeting (7 September 2023).

    2.  The deadline for public questions is seven days before the meeting (6 September 2023).

    3.  The deadline for petitions was 14 days before the meeting, and no petitions have been received.

     

    Additional documents:

    Minutes:

    There were none.

     

53/23

RECOMMENDATIONS TRACKER AND WORK PLAN pdf icon PDF 121 KB

    • Share this item

    To review the Committee’s recommendations tracker and work plan.

    Additional documents:

    Minutes:

    Witnesses:

     

    Nikki O’Connor - Strategic Finance Business Partner

    Ciaran McLaughlin - Grant Thornton

     

    Key points raised in the discussion:

     

    1.    Regarding A4/23: The Strategic Finance Business Partner noted the agreed way forward with the Statement of Accounts 2021/22 sign off, because of the triennial revaluation of the pension fund liability the Council had restated its accounts and resubmitted those to Grant Thornton. Four issues had been identified from the latest technical review and had been responded to. The Grant Thornton representative noted that the audit was almost complete, the aim was to sign off the Statement of Accounts 2021/22 in September. He noted that Grant Thornton was working on the audit of the Statement of Accounts 2022/23 simultaneously, the aim was to get those signed off before 23 October - his last working day. The Strategic Finance Business Partner noted that the Statement of Accounts 2021/22 and 2022/23 were scheduled for November’s Committee.

    2.    A Committee member sought clarity on the Statement of Accounts 2022/23 sign off by 23 October as the Committee’s next meeting was in November. The Grant Thornton representative clarified that his aim was to get those accounts to a position where Grant Thornton could sign those by 23 October, formal sign off would happen in November following the Committee’s approval. Grant Thornton’s senior local government partner Paul Dossett would sign those off.

    3.    Responding to a Committee member’s query, the Grant Thornton representative confirmed that should there be any questions or clarifications requested on the accounts following 23 October, Paul Dossett would follow those up and he would be having a handover with him.

    4.    The Chairman requested that the Committee has a progress update on the finalisation of the Statement of Accounts 2022/23 and pension fund accounts in early October. The Strategic Finance Business Partner would provide a joint update with Grant Thornton.

    RESOLVED:

    1.    Monitored progress on the implementation of recommendations from previous meetings (Annex A).

    2.    Noted the work plan and any changes to it (Annex B).

     

    Actions/further information to be provided:

    1.    A19/23 - The Strategic Finance Business Partner will provide a joint update with Grant Thornton in early October on the progress of the finalisation of the Statement of Accounts 2022/23 and pension fund accounts.

     

54/23

INTERNAL AUDIT PROGRESS REPORT - QUARTER 1 pdf icon PDF 323 KB

    • Share this item

    The purpose of this progress report is to inform members of the work completed by Internal Audit between 1 April 2023 and 30 June 2023.

     

    Additional documents:

    Minutes:

    Item 8 was taken before item 6.

     

    Witnesses:

     

    David John - Audit Manager

    Paul Fielding - IT Audit Manager

    Russell Banks - Orbis Chief Internal Auditor

    David Mody - Head of Strategic Risk

    Anna D’Alessandro - Director of Corporate Finance and Commercial

     

    Key points raised in the discussion:

     

    1.    The Audit Manager highlighted that twenty-four audits had been completed, including three Partial Assurance opinions (two were schools) and no Minimal Assurance opinions. He noted the breadth of the assurance work which demonstrated that the Annual Audit Plan 2023/24 was responsive to the Council’s strategic priorities, additional unplanned audits had also been undertaken. No audits had been removed from the audit plan and the contingency budget enabled new audits to be added so that emerging risks could be addressed. There was a healthy relationship between the Council’s management team and Internal Audit.

    2.    A Committee member noted that Cyber Security had a Reasonable Assurance opinion and asked whether there was any risk of a cyber security failure in the future. The Audit Manager noted that it was a massive risk and was escalating given international tensions. The IT Audit Manager added that the Cyber Security audit looked at the Council’s response and resilience, looking at access control, information governance and data storage. Cyber was a fast moving, evolving threat and the teams were constantly working towards increasing the Council’s resilience.

    3.    As a supplementary question the Committee member noted that there was little information about what might occur in local government in terms of a cyber-attack. She asked how the Council’s staff were made aware of the problems that might arise and what type of cyber-attack would be likely. The Orbis Chief Internal Auditor noted that Internal Audit carried out specific pieces of work in relation to cyber, as well as other IT related audits that had a cyber security element to those. Individual services managed the awareness to the relevant risks internally. He noted that it would be difficult for the Council to prevent against a cyber-attack from a foreign power given the technology and expertise, therefore the focus was on the Council’s response via its business continuity arrangements; the Head of Strategic Risk noted that was why cyber-attacks were a top corporate risk. The Audit Manager highlighted an online article about the effects of a recent cyber-attack by a private hacking group on Hackney Council which cost them £12 million.

    4.    A Committee member referred to section 3: Action Tracking whereby the Committee received updates on high priority actions, he asked whether medium and low priority actions were tracked and how it was known that they were being completed. He asked whether follow-up audits on high priority actions were guaranteed. The Orbis Chief Internal Auditor noted that Internal Audit balanced its resources by tracking high priority actions only, it reported its findings and agreed a responsible owner and timescale; management had the responsibility for maintaining the control environment. The expectation was that services and teams had their own arrangements  ...  view the full minutes text for item 54/23

55/23

RISK MANAGEMENT pdf icon PDF 306 KB

    • Share this item

    To provide an update on risk management. 

    Additional documents:

    Minutes:

    Witnesses:

     

    David Mody - Head of Strategic Risk

    Anna D’Alessandro - Director of Corporate Finance and Commercial

     

    Key points raised in the discussion:

     

    1.    The Head of Strategic Risk noted that since March’s Committee update, many of the external risks predicted had materialised. Inflation was in the high single digits, interest rates had increased and there had been national industrial action; residents were impacted by the cost of living and the conflict in Ukraine showed no signs of abating. Internally, there had been ballots with the Trade Unions and the demand for Council services was not abating. Good progress had been made concerning the internal risks, one risk had improved and a new risk was added.

    2.    The Head of Strategic Risk explained that risks were reported to the Corporate Leadership Team (CLT) monthly, informal Cabinet (iCab) received risk updates quarterly and there were deep dives on specific risks, and the Committee reviewed the overall processes. He did some deep dives in the summer on the directorates’ risk registers, ensuring they were up to date, risks reviewed regularly and actions were being followed up. Internal Audit uprated the assessment on risk management to Substantial Assurance, and the actions had been completed. He noted the minor changes to the Risk Management Strategy in relation to the three lines of defence approach and risk leads; and the delegation to the Committee of its approval.

    3.    A Committee member referred to paragraph 8 on the cover report, a) Risk Registers - ‘risk owners and target dates had not been recorded for all risks included on registers’. He was surprised that the Risk Management Strategy was not updated to include dates as the length of items on the registers could not be ascertained. The Head of Strategic Risk explained that risk registers were live documents, a work in progress where he was happy with those including missing information so that there could be conversations around the risks, any missing actions or risk owners. He had informed the directorates to include that information where possible, it was not mandated because he did not want the situation where risks were potentially not being included in risk registers because some bits of information were missing.

    4.    As a supplementary question the Committee member queried whether the Head of Strategic Risk knew how long risks had been on the risk registers for. The Head of Strategic Risk noted that there was a control version where he could go back through previous iterations to track risks over time. He noted that he tried to keep the risk registers down to core information so that people continued to engage.

    5.    As a supplementary question the Committee member queried the absence of a risk and issue management framework in the Risk Management Strategy around the mitigations that might be in place in case of risks materialising. The Head of Strategic Risk noted that anything rated a 5 on the risk register was a triggered risk which then became an issue, the  ...  view the full minutes text for item 55/23

56/23

HOME TO SCHOOL TRANSPORT - PROGRESS UPDATE pdf icon PDF 517 KB

    • Share this item

    The purpose of this report is to provide the Committee with an update on the Home to School Travel Assistance (H2STA) Improvement Programme and the current performance of the service provided to children, young people, and families of Surrey.

    Additional documents:

    Minutes:

    Witnesses:

     

    Gerry Hughes - Assistant Director – Support Services (CFLL)

    David Mody - Head of Strategic Risk

    Nikki O’Connor - Strategic Finance Business Partner

     

    Key points raised in the discussion:

     

    1.    The Assistant Director – Support Services (CFLL) noted that at the end of the last academic year over 10,000 children were supported on their journeys to and from school - half were mainstream and half had Special Educational Needs (SEN) or Additional Needs and Disabilities (AND). The team had reached its peak in workflow over the summer months and the routes had been optimised. She highlighted the significant national challenges around driver and disability vehicle shortages. The Home to School Travel Assistance (H2STA) service had been working in collaboration with operational colleagues, with the Freedom to Travel and Single View of a Child (SVoaC) programmes, and Internal Audit.

    2.    The Assistant Director – Support Services (CFLL) noted that significant transformational improvements had been undertaken over the last eighteen months, categorised into six key workstreams. She noted that 99% of pupils - significant improvement from last year - had transport in place ahead of the start of term, it took thirty days on receipt for transport to be in place. Interim allowances were being put in place for applications received during August. She noted the further challenges from the SEN Recovery Plan around waiting times for transport.

    3.    The Assistant Director – Support Services (CFLL) thanked Internal Audit for its support as a critical friend and noted that with the completion of the fourteen recommendations, the Partial Assurance opinion from May 2022’s audit had been uprated to Reasonable Assurance in the follow-up audit in July 2023; with the caveat that the service could not be fully tested as it had not gone through the peak workflow. Three of the six recommendations had been completed and the other three were being worked through. She noted the ongoing scrutiny through the new Children, Families, Lifelong Learning (CFLL) governance boards, the select committee and upcoming deep dive by iCab.

    4.    A Committee member asked how many children and young people who applied for transport by 31 July did not have transport confirmed by two weeks before the start of term. The Assistant Director – Support Services (CFLL) explained that 95% - she would provide the exact number - of the cohort was given that information within the timescale, those without that information had significant medical needs and the team was struggling to find medical personal assistants to provide support.

    5.    As a supplementary question the Committee member referred to the Data risk whereby data from EYES could not be used, he also noted that the IT & Digital Development original timeline would be on hold for a year; he asked why that was and what the impact would be. The Assistant Director – Support Services (CFLL) explained that Liquidlogic had stalled its development, the Council therefore had to use legacy systems; due diligence was being done on market alternatives. She noted that the team  ...  view the full minutes text for item 56/23

57/23

SURREY PENSION FUND EXTERNAL AUDIT PLAN 2022/23 pdf icon PDF 150 KB

    • Share this item

    To provide the Audit & Governance Committee with an update on the process for undertaking the external audit of the 2022/23 Surrey Pension Fund.

    Additional documents:

    Minutes:

    Witnesses:

     

    Ciaran McLaughlin - Grant Thornton

    Key points raised in the discussion:

     

    1.    The Grant Thornton representative noted that it was titled indicative because it was produced in June and should have gone to July’s Committee, it was now final. Work was underway regarding the two big significant risks: management over-ride of controls and the valuation of Level 3 investments; as well as other risks such as: Level 2 investments. Additional work was undertaken as it was the first year the Surrey Pension Fund 2022 triennial valuation applied. Materiality was £73 million for the Pension Fund and £21 million for non-investment related elements.

    2.    A Committee member asked whether the £20,000 fee for ‘IAS19 Assurance letters to scheduled and admitted bodies’ was a new requirement. The Grant Thornton representative noted that fee was required annually in undertaking the pension fund audit. The Committee member noted surprise that it was not part of the scale fee. The Grant Thornton representative explained that some pension funds did not have to issue letters to admitted bodies, IAS19 assurance letters fell outside the core audit requirement. Grant Thornton provided that work on behalf of the other auditors, the cost of that work was recharged to the Council and then the Council could recharge that cost back to the employing organisations.

    3.    Referring to the IT audit strategy, a Committee member asked whether the audit took into account the Council’s transition from SAP to Unit 4. The Grant Thornton representative clarified that the audit looked at 2022/23 when SAP was in place.

    4.    The Chairman asked how confident the Grant Thornton representative was that the audited pension fund accounts, Statement of Accounts and audit findings report would be ready for November’s Committee. The Grant Thornton representative was confident that timeline would be met as discussed in item 5.


    RESOLVED:

    Approved the 2022/23 Surrey Pension Fund Audit Plan.

    Actions/further information to be provided:

    None.

     

58/23

DATE OF NEXT MEETING

    • Share this item

    The next meeting of the Audit & Governance Committee will be on 22 November 2023.

    Additional documents:

    Minutes:

    The date of the next meeting of the Committee was noted as 22 November 2023.