Governance and Audit Committee

The Committee received a progress report providing an update on the work and performance of the Internal Audit and Investigation Teams from the Audit Manager, Chris Pyke. The progress report covered the period from 1 January to 28 February 2023. Annex 1 of the report highlighted the performance in relation to the Internal Audit Plan. A summary of the work performed, the priority recommendations raised, the critical findings, emerging trends, and relevant value for money findings across the Council for the assurance of the Governance and Audit Committee was provided. Annex 2 focused on proactive and reactive fraud awareness, detection and investigation activities, including participation in initiatives, such as National Fraud Initiative (NFI) data matching exercises The Audit Manager stated that the Team’s focus continues to be primarily to progress assurance audits from the Audit Plan but also to provide consultation and engagement in high-risk areas and provide assurance on the Council’s control environment. The Audit Manager provided the Committee with an update on the restructuring of the Audit Team and the further need to appoint to two vacant Senior Auditor Posts, following the internal promotion of two members of the Internal Audit team. Members were advised of the progress made against the internal audits that are currently underway and the emerging findings from audits that have concluded during the period. Members were asked to note that one ‘unsatisfactory’ audit opinion was received during the period (Central Transport Services), and another issued with an opinion of ‘insufficient with major improvement needed’ (Directorate Payment Card Industry Data Security Standard Compliance). The Governance and Audit Committee will receive an executive summary report of the findings and actions for improvement for the unsatisfactory audit its next meeting. A Member noted that at the previous meeting the Director of Education presented a report on the directorate control environment, which revealed that there were a total of 38 outstanding audit recommendations in 12 different schools. Some of those outstanding recommendations pre-dated the 2020/21 audit cycle. The Member asked that, given the large number or outstanding actions and the length of time that the actions have been outstanding, what progress has been made and what dialogue has been held with school governing bodies about the need to close off outstanding actions. The Audit Manager recognised the position in terms of the outstanding audit recommendations within the Education Directorate. However, there has been no focussed review of those outstanding recommendations since the last meeting. The Audit Manager has attended the Senior Management Team to report on the position against recommendations in all directorates, including Schools, as well as the status of draft reports requiring management response. SMT will receive further reports to provide an update on the position. The Director of Education has engaged with schools with a view to following up on the outstanding actions but it was accepted that there is more work to do in that regard. Members were also advised that consideration can be given to re-audit schools were longstanding recommendations are outstanding. It was noted that the Adults, Housing and Communities directorate provided valid reasons why there are outstanding actions, which provided a degree of assurance. . Members requested further assurance be provided by Schools and Lifelong Learning before the next meeting. The Chairperson noted the issues being raised and provided an undertaking to write to the Director of Education highlighting the concerns raised. Members noted that the Internal Audit Team still has 2 FTE post vacant. Members asked whether the Audit Manager was confident that those posts can be appointed to quickly in order to avoid any further delays to the Audit function. The Audit Manager highlighted the difficulties in appointing to Senior Auditor posts e.g. a tight market. However, other options were available to manage resources including bolstering the establishment with a CIPFA trainee and contracting out audits to an external organisation. In response to a question around timing of reports, the Audit Manager confirmed that the reports indicated for delivery are delivered to the draft report stage. Assurance opinions have an evidential basis and they are not expected to change between the draft and final stages. Reports issued at the end of a financial year are expected to be responded to in April and May. Members asked what proportion of the Council has been tested against the Directorate Payment Card Industry Data Security Standard Compliance (PCI-DSS) standard. The Audit Manager advised governance and systems were tested as a whole, and that five site visits were made to locations where card payments are made. The five site visits resulted in a single finding of non-compliance in one site and relating to one matter in respect of merchant receipts, that has now been addressed. The Committee was advised that the Authority has made significant improvement and has invested in appointing a dedicated officer for PCI-DSS compliance. Members noted the wide-ranging failures across a number of controls within Central Transport Services and considered that this might suggest a failure of wider management. The Audit Manager was asked to comment on whether an increased risk has been identified within the service in the 2023/24 Audit Plan. Members were advised that responsibility for the portfolio has moved to within the Resources Directorate. New operational management arrangements have been recently put in place and these have been highly effective in identifying and beginning to address control issues. Any ‘unsatisfactory’ audit will be revisited within 6 months and once the management response is received it is anticipated that the rating will be improved. It was confirmed that the follow-up audit will form part of the 2023/24 Audit Plan. RESOLVED – That the report be noted.

The Committee received a report providing Members with the Draft Internal Audit Charter for 2023/24 and appendices including draft Governance and Audit Committee Terms of Reference 2023/24. On 24 January 2023 the Committee received the Draft Internal Audit Charter and Summary Audit Plan 2023/24. Members were asked to consider and provide comments. The Audit Plan was further developed for approval and discussions were also held with senior management in directorates to shape the Plan. A Member noted that there were a number of audits were planned within the Education and Lifelong Learning Directorate including an audit of Governor Services. Members sought to clarify the objectives of that audit in particular. The Audit Manager stated that the objectives will be clarified following discussions between senior officers and considering any views of the Committee, with the scope of the audit being to establish the effectiveness of assurances provided by Governor Services for school governance matters. Detailed objectives will follow a preliminary assessment. Members asked whether Governor Services have a role in encouraging schools to close off audit actions and whether one of the objectives of the future audit should focus on that objective. The Audit Manager considered that the proposed Chairperson’s letter would seek to establish what the Director of Education sees as the mechanism for managing recommendations. The Committee’s earlier request for assurance around those arrangements was also noted. RESOLVED – That: (1) The Audit Strategy be noted; (2) the Internal Audit Charter 2023/24 (including the Governance and Audit Committee Terms of Reference 2023/24, ahead of a request for approval by Council; (3) the Internal Audit Plan be approved.

The Committee received a report providing Members with details of the PSIAS Peer Assessment and an opportunity to discuss the assessment with the assessor. The Chairperson welcomed Andrew Wathan, Chief Auditor of Newport Council and Monmouthshire Council and Dona Palmer, Audit Manager in Newport Council who had undertaken the assessment. Andrew Wathan was invited to present the report. Members were advised that the external peer assessment has been undertaken during the period November 2022 to February 2023. Both assessors are CIPFA qualified and have extensive internal audit management experience within local government. Andrew Wathan stated that Cardiff had provided comprehensive and thorough evidence pack and the conclusion was that the Cardiff Internal Audit Service is fully compliant with the standards. The assessment reported no partial or non-conformance with the requirements of the PSIAS. The Internal Audit Service of Cardiff Council was assessed as conforming to 304 of the requirements (includes those not applicable). The Internal Audit Service is assessed as generally conforming with the Standards in all significant areas and operating independently and objectively. One optional action was proposed and this has since been implemented, relating to the communication of the audit scope and objectives along with the risk within audit outputs. The full assessment was contained within Appendix A of the report. RESOLVED – That the report be noted.

The Committee received a report providing an update on the control environment within the Adults, Housing and Communities directorate. The report provided an overview of the services within the directorate’s remit and its governance arrangements. Members were advised that there are strong performance management arrangements in place including quarterly performance reporting covering key indicators performance(KPIs), corporate plan and directorate delivery plan objectives. Performance is reviewed regularly internally and performance is also monitored quarterly at various Scrutiny Committees. Further monitoring is provided by SMT and directorate assurance meetings. Individual performance is monitored through PPDRs and the directorate has a robust approach to ensuring that PPDRs are undertaken. The report also provided a summary of the directorate approach to risk management. A number of corporate and directorate risks were identified. Details of internal audit engagement and the directorate responses were also set out in the report, in addition to overviews of the directorate approach to major project and partnership governance, value for money, commissioned services and complaints handling. The Chairperson welcomed Jane Thomas, Director Adults, Housing and Communities to the meeting. The Director was invited to deliver a brief presentation on the control environment within the Directorate. The Chairperson then opened the debate on this item. The discussion is summarised as follows: • A Member asked for details of the systems that are in place to identify early indicators of safeguarding issues and how the authority responds once any early indicators are identified. The Director stated that the directorate was only responsible for statutory safeguarding in relation to adults, alongside general corporate safeguarding responsibilities . The directorate seeks to prevent safeguarding issues arising by identify risks at an early stage. Risks that are identified are flagged and are assessed by the Adult Safeguarding Team. The Team will seek to address individual cases and identify any themes arising. The number of referrals being identified is also monitored. The Director meets weekly with the Safeguarding Manager to discuss issues arising and how best to respond as multi-agency responses are often necessary. Members were also advised that Safeguarding training was built into the PDR process. • The Director was invited to comment further on the issues identified around Deprivation of Liberty Safeguards (DoLs), as detailed in the report. The Director stated that the issue identified in the report was a national issue. However, the Directorate has managed to reduce its backlog considerably. The Service is provided by the Vale of Glamorgan Council on behalf of Cardiff Council and Welsh Government has provided additional resource to ensure that backlogs are addressed. New legislation aimed at clarifying legislation and potentially reducing workloads has been delayed. • A Members asked whether any third parties were contracted to deliver Independent Living Services and, if so, what risk assessments have been made in relation to the management of any third parties. The Director advised that the Independent Living Service provides the first point of contact for Adult Services. Independent Living will visit and refer clients to third party organisations as appropriate. Those third parties are not directly commissioned. However, the Independent Living Service also includes Disabled Adaptations. Such works are contracted out and they would be managed under the same frameworks as other housing schemes. Comprehensive processes are in place to manage risk and quality assess those works. The authority does provide some other internally managed services to support Independent Living such as the Joint Equipment Service and day centres. • A Member commented on the risk register analysis. It was suggested that the directorate risk champion should support a review of the controls recorded in a number of risk areas. The Member also requested target dates and key actions be included within risk registers. • Members noted the number of outstanding audit recommendations. Members also suggested that a report be made back to the Committee providing a progress update on the implementation of audit recommendations. • Referring to an external audit recommendation in relation to the completion of violence against women training, Members noted that the percentage of staff completing the training was reducing. The Director was asked to comment. The Director stated that the risk was a corporate risk that sits within the directorate for monitoring purposes. However, individual directorates will be responsible for ensuring that their staff complete the training. Lots of work is being done within the directorate to ensure that their own staff complete training. Efforts are being made corporately to link the requirement to complete mandatory training modules to PPDRs. RESOLVED – That the report be noted.

The Chairperson welcomed Anil Hirani, Operational Manager, Capital, Corporate and Treasury, Sally Ormiston, Group Accountant, and Phil Pugh of Audit Wales to the meeting. The invitees were invited to present a report on the ISA 260, Annual Governance Statement and Audited Statement of Accounts 2021/22. Members were advised that since the last meeting of the Committee on 19 July 2022 a response to the questions received was circulated to Members in accordance with the actions for that meeting. Following the completion of the audit the revised draft Statement of Accounts and Annual Governance Statement now include any amendments arising from the feedback received from the Committee. Phil Pugh of Audit Wales provided a summary of the ISA 260 Audit Reports for Cardiff Council and Cardiff Harbour authority. Members were advised that an unqualified audit opinion would be provided for both sets of accounts. There were no uncorrected misstatements in the accounts and the corrections that have been made were set out in the report. Responding to a question from the Committee, Phil Pugh confirmed that there were no internal control arrangements risks revealed by the various adjustments made to the accounts. The adjustments were mainly of a technical accounting nature including updated valuations. RESOLVED – That the Committee recommends the 2021/22 Audited Statement of Accounts for Cardiff Council and Cardiff Harbour Authority; the 2021/22 Audit of Accounts Reports (ISA 260) for the Statement of Accounts for Cardiff Council and Cardiff Harbour Authority; and the 2021/22 Annual Governance Statement be considered for approval by Council on 30 March 2023.

The Corporate Director Resources and Section 151 Officer, Chris Lee, presented a financial update including resilience issues and the financial challenges facing the authority, including the Month 9 position and the budget strategy for 2023/24. RESOLVED – That the report be noted.

The Chairperson invited Anil Hirani, Operational Manager, Capital, Corporate and Treasury to introduce a report on the Statement of Accounts 2022/23 Accounting Policies and Timescales. Members were advised that the timetable in the report aims to present a set of accounts to the November 2023 meeting of Council. Members were asked to note that there are no changes made to the draft policies or assumptions that would significantly impact on the reporting of financial performance historically or in the future. However, there were some changes to accounting policies anticipated from CIPFA around valuation of fixed assets. There would also be increased focus around the pension fund in terms of understanding what ‘income’ is and what is change in valuation of assets. The report indicated that a number of reviews and changes are being proposed for future years which are likely to impact on the CIPFA Code of Practice and, therefore, to the Council’s approach. These include changes in relation to leasing; valuation of property assets; and infrastructure assets. A summary of each of these changes was provided. Members requested a progress update on the service area response to the administrative implications of the changes to IRFS16 – leasing. The Operational Manager advised that the service have access to a leasing management system. Testing has been undertaken and major leases in terms of property, vehicles and plant equipment have been identified. A view has been taken on assets such as printers and watercoolers and whether their inclusion added value. The next steps will be to discuss the approach with colleagues in Internal Audit and ensure that the resources are in place. CIPFA require that the changes are implemented in 2-years but the Operational Manager was hopeful that Cardiff could introduce the changes a year earlier than planned. RESOLVED – That the report be noted.

The Corporate Director Resources presented a report on the corporate risk position as at Quarter 3, 2022/23. Members were asked to note the revised residual risk ratings (both reduced) for financial resilience and the risk for ineffectively managing demand in Childrens Services. Members suggested that the Performance Management risk mitigation should include some narrative around the performance management framework in place. The Corporate Director Resources accepted the point made. RESOLVED – That the report be noted.

The Chairperson welcomed Gareth Newell, Head of Performance, to the meeting and invited him to deliver a report providing an overview of progress made in delivering the recommendations made by external regulators. The Head of Performance considered that introduction of the report had provided additional assurance and ensures that the Council is responding to recommendations received. Members were advised that the report provides the mid-year position and a number of recommendations, therefore, have no RAG rating. However, those ratings and the management responses will be included at year-end. Officers are working on drafting guidance to be provided to officers setting out agreed standards for responding to any recommendations received. It was anticipated that the guidance will further provide additional assurance. Members asked whether the requirement that Governance and Audit Committees are expected to consider relevant reports and recommendations from external review bodies was a mandatory requirement. The Head of Performance agreed to clarify the position and provide a response following the Committee. Responding to a point from the Committee, the Head of Performance also agreed to discuss strengthening a response to a 2018/19 recommendation in relation to Corporate Safeguarding at the next Corporate Safeguarding meeting. RESOLVED – That the report be noted.

The Committee received a report providing Members with the proposed Treasury Management Practices (TMP’s) to be applied from April 2023. Officers confirmed that there were significant controls in place to ensure that appropriate segregation controls are in place to ensure financial transactions can be undertaken safely and securely by members of staff who are working from home. The Council’s bank will also have their own controls in place to safeguard against fraud, for example. The Corporate Director Resources stated that as the officer responsible for the cyber security corporate risk there are external assurance requirements that ensure Council networks are secure, including financial transactions. RESOLVED – That the report be noted.

RESOLVED – That the report be noted.

RESOLVED – That report be noted.

RESOLVED – That the report be noted.

No urgent items.

The next meeting is scheduled for 11 July (subject to Full Council in May 2023).

To mark the occasion of his retirement and the end of 62 years public service the Chairperson made some closing remarks. The Chairperson expressed his thanks for the courtesy and support extended to him during his period in the Chair from elected member and officers. The Chief Executive attended to provide words of praise and thanks to the Chair, as did the Corporate Director Resources and the Deputy Chairperson. The Chairperson thanked and gave recognition to the senior officers and members he had worked with, to the Committee and the Chairperson wished to record his particular gratitude for the support he received from Chris Pyke, Audit Manager.

The next meeting is scheduled for 11 July (subject to Full Council in May 2023).