Agenda and minutes

To receive any apologies or substitutions for the meeting.

Apologies were received from:

·       Cllr Gavin Grant

·       Cllr Ian Thorn and

·       Cllr Stuart Wheeler.

To confirm the minutes of the meeting held on 10 February 2021.

The minutes of the last meeting were presented for consideration. It was,

Resolved

To approve the minutes of the meeting on 10 February 2021 as a true and correct record.

To receive any declarations of disclosable interests or dispensations granted by the Standards Committee.

The Chairman declared a non-pecuniary interest, stating that he was a Director at SWAP.

To receive any announcements through the Chairman.

The Chairman announced that the agenda order was slightly different to usual as Deloitte were unable to join the meeting at the beginning.

The Council welcomes contributions from members of the public. During the ongoing Covid-19 situation the Council is operating revised procedures and the public are able participate in meetings online after registering with the officer named on this agenda, and in accordance with the deadlines below.

Guidance on how to participate in this meeting online.

Statements

Members of the public who wish to submit a statement in relation to an item on this agenda should submit this is electronically to the officer named on this agenda no later than 5pm on Monday 26 April 2021 (1 clear working day before the meeting).

State whom the statement is from (including if representing another person or organisation), state points clearly and be readable aloud in approximately 3 minutes. Up to three speakers are allowed for each item on the agenda.

Questions

Those wishing to ask questions are required to give notice of any such questions electronically to the officer named on the front of this agenda no later than 5pm on Wednesday 21 April 2021 (4 clear working days before the meeting) in order to be guaranteed of a written response. In order to receive a verbal response questions must be submitted no later than 5pm on Friday 23 April 2021 (2 clear working days before the meeting).

Please contact the officer named on the front of this agenda for further advice. Questions may be asked without notice if the Chairman decides that the matter is urgent. Details of any questions received will be circulated to members prior to the meeting and made available at the meeting and on the Council’s website; they will be taken as read at the meeting.

No public questions or statements were received.

To receive an update on the Internal Audit Plan 2021/22.

Report to follow.

The Chairman invited Charlotte Wilson, SWAP to present the item. The report for this item was published at page 4 of agenda supplement 1.

Ms Wilson explained that SWAP was building on the approach to the Internal Audit (IA) taken for 2020/21, whereby the plan would be an agile rolling plan, allowing for adaptability and flexibility. The programme of IA work would be built from the Wiltshire Council strategic and service level risk registers, by liaising with CLT and directors and looking at live corporate performance information. SWAP was looking to bring in some sector wide risk themes and highlight potential areas to focus on. SWAP would report quarterly to CLT and to the Audit and Governance Committee. Ms Wilson also highlighted the IA Charter attached at appendix 1 of the report.  The purpose of the Charter was to set out the nature, role, responsibility, status and authority of internal auditing within Wiltshire Council, and to outline the scope of internal audit work.

In response to questions regarding the Healthy Organisation framework and where this fit into the IA plan it was explained that the Healthy Organisation review usually took place every three years, the review was a high level information gathering review into the Governance of the Council and the last review was in the process of being finalised and would be brought to the next committee meeting.

In response to points raised regarding the content of the report, it was confirmed that a reference to annual IA planning would be removed and that the responsibility of the Audit and Governance Committee to monitor implementation of IA recommendations would be added to a revised report. It was,

Resolved:

To note the Internal Audit Plan 2021/22 and the Internal Audit Charter.

To consider the Q4 Internal Audit Report 2020/21.

Report to follow.

Charlotte Wilson of SWAP presented the Q4 IA report which was published in agenda supplement 1. Ms Wilson stated that there had been challenges on delivery due to lock down and the redeployment of audit staff to Wiltshire Council in order to help administer busines grants. It was stated that challenges were slowly reducing with the majority of audit staff now back in their roles.

With regards to agreed actions, there were 18 priority 2 actions outstanding, which was a decrease from the last update and a significant number of priority 3 actions outstanding. However, SWAP were awaiting an update on these outstanding actions in the next agenda item (item 8) and it was anticipated that the number would reduce significantly.

Details of changes to the IA plan due to the pandemic were also covered in the report. There had been some changes to Appendix B, the standard progress table, since the report was published, the Housing Benefit and Council Tax Support Audit and the ICT Governance review had now been issued as draft reports. There had been one limited assurance opinion issued since the last update, related to Children’s brokerage and management actions, as a result roles, responsibilities, expectations and reporting requirements had been agreed upon.

The Chairman was concerned with the number of outstanding IA recommendations (page 23) which had been outstanding for over 4 months. In response Ms Wilson stated that with permission she would move into the next agenda item covering the Consolidated IA Outstanding Management Actions Report, which was agreed by the Chairman. It was anticipated that the figures would be reduced by the next meeting when an updated report would be provided. It was confirmed that no outstanding actions had been removed, only implemented actions had been removed from the list. For priority 1 and 2 items these were reviewed by IA. There was a follow up protocol in place and Ms Wilson was working closely with the Deputy s151 Officer to make sure actions were monitored and implemented. The Chairman welcomed the new follow up protocol.

The Chairman raised concerns regarding the fact that 100% of IA recommendations for schools had been outstanding for over 4 months, and further concerns regarding whose responsibility this was and what actions could be taken. In response Lizzie Watkin (Deputy s151 officer) stated that an update was required from the Director for Education on whose responsibility these issues were and how they could be addressed. It was hoped that the committee may be able to receive a short update on this at the next meeting and it was on the Forward Work Programme.

There was further discussion surrounding these issues from Members and in response Andy Brown (s151 Officer) stated that Wiltshire Council did have a level of responsibility with maintained schools, the last line of defence as it were, he stated that it would be useful to have a discussion around this at the next meeting to determine the level of oversight.

In response to a  ...  view the full minutes text for item 88.

To consider the consolidated IA outstanding management actions report.

Report to follow.

This item was taken under agenda item 7, the Q4 Internal Audit Report 2020/21.

Quarterly update, to include:

·       Corporate Governance update

·       Outstanding AGS improvement actions

·       Update on review of governance reporting arrangements in the constitution

Ian Gibbons, Director Legal and Governance, gave an update on Corporate Governance to the meeting.

The officer stated that there was an update report in the pack, the first part of which related to the Annual Governance Statement (AGS) and improvement actions as a result of the AGS, which were detailed in appendix 1. There were no changes to highlight.

The second part of the report was in response to a request from the Committee on governance reporting arrangements. As a result suggested amendments to the constitution (seen at appendix 2) had been made which gave clarity on the responsibilities of the Audit and Governance Committee and the Scrutiny Committees, there was some fine tuning summarised in the report, such as updating the name of the committee to the Audit and Governance Committee; confirmation of the Committee’s responsibility to approve the Annual Statement of Accounts and the AGS; clarification of the Committee’s role in relation to Swindon and Wiltshire Local Enterprise Partnership (SWLEP) and the Committee’s role in relation to the Council’s Stone Circle companies, which would be considered as part of a review of the governance arrangements for these companies as requested by Cabinet at its meeting in February. An update on the review would be provided to Cabinet in July 2021. The role of the Audit and Governance Committee would need to be considered as part of that.

The Chairman stated he was happy with the report but highlighted one error on page 37 where the adjustment of Audit, to Audit and Governance was missed. Mr Gibbons confirmed that this would be rectified. The officer also clarified that the proposed changes would go to the Constitution Focus Group and then to Full Council for approval.

It was;

Resolved:

·       To note the current status of improvement actions identified in Annual Governance Statement, as set out at Appendix 1 (page 31), and

·       To approve the proposed changes to Protocol 10 – Governance Reporting Arrangements, as set out at Appendix 2 (page 35).

To receive an update from SWAP on cyber security.

Darren Roberts (SWAPs Assistant Director ICT, Digital and Cyber), gave a presentation on cyber security. The presentation slides are appended to these minutes. The essence of the presentation highlighted that cyber security was incredibly important, there would always be risk and it was highly likely that there would be a breach at some point, usually as a result of the human factor, therefore it was everyone’s responsibility to take action to prevent breaches. The Chairman thanked Mr Roberts for his presentation.

The Chairman invited Ian Robinson (Director of Digital, Data and Technology) to give a presentation and asked for assurance for the Committee in regards to Cyber Security at Wiltshire Council and to what extent the concerns highlighted by Mr Roberts could be addressed.

The Officer stated that he wanted to give a sense of progression being made. He started in 2019 and started in depth reviews due to some concerns. Shortly after there was a data centre power failure which caused issues, turning some of the concerns to reality.

The review became a formal programme and a lot of the work undertaken was fed from the audit where 2 critical items were highlighted and a further 12 recommendations were made. As a result, Wiltshire Council back up facilities were completely refreshed. The primary data centre was now wholly reflected in a secondary data centre. There was also an “air gapped” back-up solution. So, if data was compromised and destroyed it could be replaced by the “air gapped” back up which was held completely separately. Some further trialling and real world testing of disaster recovery was required but had been delayed due to the pandemic.

A redesign of the boundary defences, such as firewalls had been implemented. Many apps and data were also now held in the cloud. The ICT structure would be reorganised and bolstered with training, this process had been prioritised. In summary good progress was being made.

Cllr Holder commented that he was gratified by the presentations and the comments made and was satisfied that progress was being made. Cllr Holder stated he had a specific question regarding Cyber Essentials Plus accreditation, however he was happy to raise this with the officer outside the meeting. Copeland Council’s cyber security issues were raised an example that all Councils wanted to avoid. He encouraged all to allow the live tests to occur.

At the conclusion of the debate it was proposed that the Audit and Governance Committee:

·       Note the presentations.

·       Note the need for further work on red risk items.

·       Recommend that Wiltshire Council work towards Cyber Essentials Plus accreditation as a minimum standard.

The officer confirmed that action was being taken on all these items.

Cllr Philip Whitehead, Leader of Wiltshire Council also stated that this was a priority and he had previously had conversations with the officer regarding this, and work was progressing. The importance of our data was highlighted and the support of the Audit and Governance Committee was welcomed and work would be  ...  view the full minutes text for item 91.

To receive a presentation on accounting policies 2020/21.

Lizzie Watkin (Assistant Director Finance and Deputy s151) gave a presentation on accounting policies for 2020/21.

Ms Watkin stated that this was an annual paper regarding accounting policies for the financial year for which they were currently producing the statement of accounts, so 2020/21. There had been no significant changes since the previous year. However, there had been a significant amount of grant funding from central government due to the pandemic. Therefore, there was additional disclosure on the Council approach to agency / principal relationships. In addition, the creation of the Stone Circle subsidiary companies meant the Council would now be producing full group rather than single entity accounts in 2020/21. This required a change in format rather than policy, but due to political aspects and public interest this was also included.

In response to a question as to whether parish councils were creditors in regard to CIL it was clarified that this was not technically the case. Amounts due to parish councils were covered in the general recognition of balances. It was,

Resolved:

·       To approve the council’s accounting policies for the financial year 2020/21.

To consider the statement of accounts 2019/20, letter of representation and review of AGS.

Andy Brown (Corporate Director Resources & Deputy Chief Executive (s151 Officer)) gave an update to the meeting. The statement of accounts 2019/20 were attached in draft format. Unfortunately, it had not been possible to finalise these accounts due to resource constraints however there was an improved direction of travel. In November 2020 the Statement of Accounts 2018/19 were approved which there had been some qualification issues with, which had caused delays and were having a knock-on effect on the 2019/20 Statement of Accounts. Some external technical support from David Bolden was being provided and a new Chief Accountant employed. The focus was on the 2020/21 accounts which it was hoped would be delivered on time.

Working arrangements and relationships with the external auditors had been worked upon and improved, so there as now a position of greater understanding and this was an improvement. Whilst there were issues with the 2019/20 accounts resources were in place to deal with these and the Cabinet Member for Finance was keeping a careful watch and holding the s151 Officer to account.

Lizzie Watkin (Assistant Director Finance and Deputy s151) stated that she recognised that there had been gaps in knowledge and expertise within the team. David Bolden had been instrumental in progressing the accounts to draft state, a review had been undertaken and several errors and misstatements were identified. Appendix A detailed all the changes that had been made and all errors and misstatements had been corrected apart from those noted in Deloitte’s update.

The team was responding more quickly with robust data and an improvement plan in terms of technical financial accounting was being implemented which focused on development and learning, sharing audits findings, expectations of standards, recruiting senior technical accounting resource and recruiting apprentices. Processes had been reset for the 2020/21 accounts which was helping with learning and development. It was explained that the statement of accounts and appendices were huge documents and the auditors were undertaking final reviews and checks on this and any changes which had occurred were clearly set out. In response to questions it was confirmed that the appendix contained all the changes which had been made.

Ian Howse of Deloitte then presented his report (page 173) on the Statement of Accounts 2019/20. The 2019/20 accounts had been very challenging and a lot of improvements made to the initial draft set of accounts. It was not easy to extract information from the current finance system, so he felt the fact that SAP was being replaced was good as were the improvements in staffing and expertise. A number of control recommendations and disclosure defficiencies had been raised in his report. A very positive workshop had been held with Deloitte and the finance team, helping to increase knowledge.

Mr Howse echoed the comments that the 2020/21 accounts were progressing very well so things would get back on track. They were outside the normal audit cycle on the 2019/20 accounts which impacted how long it took to complete the work. The report  ...  view the full minutes text for item 93.

To receive an update from Deloitte on external audit plans for 2020/21.

Ian Howse, Deloitte, presented the External Audit Plan 2020/21. The report identified key risks, which were materially broadly in line with previous years and involved property valuation; having the right amounts in the right year; valuation of the pension fund which included a lot of assumptions; management override of controls; changes to the value for money work and the ISA 540 update to how they audit. There was also detail on the impact of the pandemic. There was uncertainty around the period at year end in 2019/20, which was consistent across all Councils due to the pandemic, but which should hopefully not feature in the 2020/21 accounts. Control deficiencies were also included for completeness.

It was stated that the right conditions had been created for 2020/21 and the work that had been undertaken by the new resources to close down plan was very encouraging.

Cllr Dobson queried out of interest what was determined material and how fraud might of smaller amounts might be reported. It was clarified that smaller amounts were reported when it was a qualitative issue. Any fraud should be picked up by Internal Audit.

Andy Brown (s151 Officer) stated that there were 3 lines of defence to fraud, management controls, policies and procedures such as IA to ensure controls were to standard, and the external aspect.

Resolved:

·       To note the External Audit Plan 2020/21.

The Chairman highlighted the Forward Work Programme contained within the agenda (page 239) and requested that the following items be added to the FWP:

·       Healthy Organisation Review

·       The SWLEP (responsibilities towards that and what we do)

·       Governance of the Stone Circle Company

·       Cyber Security and how to take forward these issues

Resolved:

·       To note the FWP and add the above items.

To note that the next regular meeting of the Committee will be held on  21 July 2021.

The date of the next meeting would be held on 21 July 2021.

There were no urgent items, however as this was the last meeting of the Committee in this Council term, the Chairman expressed thanks to all Members, in particular the Vice-Chairman who was retiring.

Cllr Dobson thanked all officers for their hard work and thanked the Chairman for his excellent stewardship of the Committee.

The Chairman also thanked Ian Gibbons (Director Legal and Governance) who was retiring, for all his help and advice.