Audit and Risk Committee
Open Agenda
Meeting Date: |
Friday 14 June 2024 |
Time: |
9.30am |
Venue: |
Breakout Room 1 |
Committee Members |
Chair: Bruce Robertson Members: Mayor Kirsten Wise, David Pearson, Councillor Sally Crown (Deputy Chair), Councillor Greg Mawson and Councillor Hayley Browne Ngā Mānukanuka o te Iwi representative - Vacant |
Officer Responsible |
Deputy Chief Executive / Executive Director Corporate Services |
Administration |
Governance Team |
|
Next Audit and Risk Committee Meeting Thursday 5 September 2024 |
2022 TERMS OF REFERENCE - AUDIT AND RISK
Reports to: |
Council |
Chairperson |
Bruce Robertson (External Independent) |
Deputy Chairperson |
Councillor Crown |
Membership |
The Mayor Deputy Chair of Sustainable Napier Committee Chair of Prosperous Napier Committee External independent appointee Ngā Mānukanuka o te Iwi (Māori Committee) (1) Note: The Chief Executive and External Auditor are required to attend all meetings but are not members and have no voting rights. |
Quorum |
3 - One of which is an external appointee |
Meeting frequency |
At least quarterly and further as required |
Officer Responsible |
Deputy Chief Executive / Executive Director Corporate Services |
Role
The role and scope, as well as any delegations of the Audit and Risk Committee are defined in the Audit Charter (Doc Id 325090).
Delegations
The role and scope, as well as any delegations of the Audit and Risk Committee are defined in the Audit Charter.
The Committee can make recommendations to Council or the Chief Executive as appropriate.
Audit and Risk Committee - 14 June 2024 - Open Agenda
ORDER OF BUSINESS
Karakia
Apologies
Mayor Wise
Conflicts of interest
Public forum
Nil
Announcements by the Mayor
Announcements by the Chairperson including notification of minor matters not on the agenda
Note: re minor matters only - refer LGOIMA s46A(7A) and Standing Orders s9.13
A meeting may discuss an item that is not on the agenda only if it is a minor matter relating to the general business of the meeting and the Chairperson explains at the beginning of the public part of the meeting that the item will be discussed. However, the meeting may not make a resolution, decision or recommendation about the item, except to refer it to a subsequent meeting for further discussion.
Announcements by the management
Confirmation of minutes
That the Minutes of the Audit and Risk Committee meeting held on Thursday, 4 April 2024 be taken as a true and accurate record of the meeting............................................................................................. 75
Agenda items
1 Internal Audit Recommendations Progress Report.......................................................... 4
2 Sensitive Expenditure - Mayor and Chief Executive...................................................... 13
3 Internal Audit: Contract Management Report............................................................... 17
4 Policy review process update........................................................................................ 53
5 External Audit actions status update............................................................................. 55
6 Health and Safety Report.............................................................................................. 59
7 Risk Management Report............................................................................................. 66
Minor matters not on the agenda – discussion (if any)
Recommendation to Exclude the Public................................................................. 73
Agenda Items
1. Internal Audit Recommendations Progress Report
Type of Report: |
Information |
Legal Reference: |
N/A |
Document ID: |
1756765 |
Reporting Officer/s & Unit: |
Raewyn Fowler, Internal Audit Lead |
1.1 Purpose of Report
The purpose of this report is to provide the Committee with a summary of the internal audit recommendations progress to date.
|
Officer’s Recommendation The Audit and Risk Committee: a) Receive the Internal Audit Recommendations Progress Report.
|
Napier City Council contract to Crowe to provide internal audit services. The internal audits performed by Crowe include a written report on issues found with recommendations and agreed management actions to be taken by Council staff to address the issues raised. In addition, PWC provide Council regular taxation internal audits – these are also included in the progress report provided. The agreed management actions are now being followed up by the relevant Council management and progress on actions to date is being tracked and reported (refer attachment).
1.3 Issues
There are four internal audits that have outstanding actions (in progress) these being:
· Building and Resource Consents (Crowe)
· Sensitive Expenditure (Crowe)
· Records Management (Crowe
· PAYE & WHT (PWC)
Graph 1 below provides the status of recommendations (as at June 2024) – being Total Findings, Total Completed and Total Outstanding. Table 1 shows the progress of these recommendations being implemented since last report presented to the Committee (March 2024).
Graph 1: Recommendations Status
Percentage completed (Goal 100%) |
Jun-24 |
Mar-24 |
Building and Resource Consents (2022) |
71% |
57% |
Records Management (2021) |
41% |
35% |
Sensitive Expenditure (2022) |
88% |
75% |
PAYE/WHT (2023 PWC) |
59% |
12% |
Table 1: Percentage completed since last report
1.4 Significance and Engagement
N/A
1.5 Implications
Financial
N/A
Social & Policy
N/A
Risk
The internal audit programme monitors and significantly reduces risk across the organisation. By monitoring the recommendations to ensure they are implemented we are further reducing risk. Any outstanding actions do pose a risk to the organisation.
1.6 Development of Preferred Option
Recommend the committee receive the Internal Audit Recommendations Progress Report.
1 Internal Audit Recommendations Progress Report (Doc Id 1764969
2. Sensitive Expenditure - Mayor and Chief Executive
Type of Report: |
Procedural |
Legal Reference: |
N/A |
Document ID: |
1756766 |
Reporting Officer/s & Unit: |
Raewyn Fowler, Internal Audit Lead Talia Foster, Financial Controller |
2.1 Purpose of Report
To provide the information required for the Committee to review Sensitive Expenditure of the Mayor and Chief Executive for compliance with Council’s Sensitive Expenditure Policy.
The Audit and Risk Committee: a. Receive the 31 March 2024 quarterly report of Sensitive Expenditure for the Mayor and Chief Executive and review for compliance with the Sensitive Expenditure Policy. |
The Sensitive Expenditure Policy approved by the Chief Executive on 17 March 2023 and endorsed by Council requires a report of all sensitive expenditure by the Chief Executive and by the Mayor to Audit and Risk Committee meetings (clauses 6.3 and 6.4). The policy also states that the expenditure items will be reviewed by the Chairperson or the Deputy Chairperson of the Audit and Risk Committee for compliance with this policy.
2.3 Issues
No issues
2.4 Significance and Engagement
N/A
2.5 Implications
Financial
N/A
Social & Policy
All sensitive expenditure transactions for the quarter ended 31 March 2024 are compliant with Council’s Sensitive Expenditure Policy.
Risk
N/A
1 Sensitive Expenditure Q3 31 March 2024 Mayor (Doc Id 1762379)
2 Sensitive Expenditure Q3 31 March 2024 CE (Doc Id 1762380)
3. Internal Audit: Contract Management Report
Type of Report: |
Operational |
Legal Reference: |
Local Government Act 2002 |
Document ID: |
1760996 |
Reporting Officer/s & Unit: |
Raewyn Fowler, Internal Audit Lead Sharon O'Toole, Procurement Manager |
3.1 Purpose of Report
To table to the Committee the internal audit on Contract Management undertaken by Council’s internal auditors, Crowe.
|
Officer’s Recommendation The Audit and Risk Committee: a. Receive the report from Crowe titled ‘Internal Audit – Contract Management’.
|
As part of the internal audit programme (as approved by the Audit & Risk committee December 2022), an internal audit on Contract Management (Doc Id 1764970) was undertaken by our Internal Audit provider, Crowe. The fieldwork commenced September 2023 - completed by December 2023. A draft report of the findings was provided to management at the completion of the audit to review and provide feedback on the findings and recommendations.
The report was finalised on the 21 May 2024 (please refer Attachment 1). The report provides recommendations and management responses on how to deal with the identified performance gaps relating to Contract Management.
The audit involved four major contracts selected (in conjunction with management):
· Kerbside recycling
· Streetlight/traffic signal maintenance
· Supply and maintenance of parking machines
· Napier War Memorial Restoration project
The objectives of this audit were to review Council’s Contract Management processes on the following:
· Alignment of procurement and contract management policies and procedures.
· Qualitative and quantitative performance measures that are in place to enable the contract manager to monitor and measure service delivery.
· Performance review processes, including process for managing corrective measures and non-performance.
· Compliance with commercial contact conditions.
· Management of contract variations and extensions.
· Existing internal controls processes for the identification and requisition of works for completion, and confirmation of satisfactory completion of works.
3.3 Issues
The audit identified a total of 11 risks - three high, seven medium and one low. The three high risk issues are as follows:
5.1 Lack of Contract Management Planning Strategy
5.2 Incomplete Contract Management Framework documents
5.3 Financial delegations to be enforced
Management’s responses to these risks are included in the report and includes those staff members who are responsible for the implementation of the agreed recommendations.
Of note, and as part of these recommendations, a Procurement and Management Improvement Plan (the Plan) has been drafted to address the recommendations and to ensure the priorities, funding and resourcing are agreed upfront. At the time of writing this report, the Plan is scheduled for approval by ELT on 4 June 2024.
3.4 Significance and Engagement
N/A
3.5 Implications
Financial
N/A
Social & Policy
N/A
Risk
N/A
4. Policy review process update
Type of Report: |
Operational |
Legal Reference: |
N/A |
Document ID: |
1756764 |
Reporting Officer/s & Unit: |
Talia Foster, Financial Controller Caroline Thomson, Chief Financial Officer |
4.1 Purpose of Report
To update the committee on the progress made to date with the policy review project.
|
Officer’s Recommendation The Audit and Risk Committee: a. Receive the report titled “Policy Review Process Update” dated 14 June 2024.
|
At the meeting of the Audit and Risk Committee on 29 September 2023, the committee directed officers to provide an update of the policy review process which was undergoing changes.
It is important to Council to have up to date policies in place to reduce risk across many areas of Council. Regularly reviewing policies is good practice to ensure they are relevant and fit for purpose. Internal and External audits have highlighted issues with policies being past their review date and officers have been struggling to ensure their timely review due to issues with the internal policy review process and system.
In September 2023, the Executive Leadership Team (ELT) agreed to review policies outside of this system to enable the timely review and correct a backlog of policies where an initial review has been completed by officers, but not approved by the ELT.
4.3 Current Position
Since the last report to the committee, the following policies have been approved by ELT and are now awaiting minor edits and publishing:
· Gifts and Gratuities Policy
· Travel Policy
· Koha Policy
· 2024 Elected Members Expenses Policy (adopted by Council in April)
There are further policies going to ELT for approval between writing this report and the meeting on 14 June:
· Credit Card Policy
· Sensitive Expenditure Policy
· Payment Policy (renamed from Cheque Signing and Payment Policy)
· Complaints Policy
· Pressure Sewer Policy
In the 4 April report to committee we notified that nine policy reviews had been approved by ELT since 1 October. Four of these were already published. Of those that were not already published, four still require minor edits and publishing, and one is going to Council for adoption in June (CCTV Policy).
The Information Services team will be reviewing options for an IT solution to support automation as soon as practical. This will remove the manual process and speed up the process, enabling more policies to be pushed through review in a timely manner.
Currently we have approximately 110 policies, of which around 79 are due for review. It should be noted that these are estimates as we have had to work outside of the system, meaning the system may not provide an accurate picture.
4.4 Significance and Engagement
N/A
4.5 Implications
Financial
N/A
Social & Policy
N/A
Risk
One key purpose of a policy is to mitigate risks. Having policies which are not regularly reviewed leaves us open to risks which are not effectively managed by policies. We are reducing this risk by prioritising the policies which are reviewed first.
4.6 Options
The options available to the Committee are as follows:
a. Receive this update on the policy review process
b. Provide further direction to officers
4.7 Development of Preferred Option
Receive the update on the policy review process.
Nil
5. External Audit actions status update
Type of Report: |
Information |
Legal Reference: |
N/A |
Document ID: |
1762046 |
Reporting Officer/s & Unit: |
Talia Foster, Financial Controller |
5.1 Purpose of Report
The purpose of this paper is to summarise the actions taken by management from recommendations made via our external audit process to provide assurance to the Audit and Risk Committee that these have been addressed.
|
Officer’s Recommendation The Audit and Risk Committee: a. Receive this report titled “External Audit Actions Status Update” dated 14 June 2024.
|
Napier City Council are audited by Audit New Zealand annually for our Annual Report process, as legislated by the Local Government Act 2002. For each audit, we receive a report detailing issues found and recommendations made.
The agreed management actions are now being followed up with the relevant Council staff management and progress on actions to date is being tracked and reported.
5.3 Issues
From the 2022/23 Annual Report audit, Audit NZ were able to close 13 action points. Only one new action point was added during that audit. We now have 12 action points remaining.
Any closed points have now been dropped from this report, and we are reporting on the actions which remained as outstanding in Audit NZ’s Management Report for 2022/23 which was presented to the Audit and Risk Committee meeting on 4 April 2024.
Although no additional items have been marked as completed in the past quarter, we are continuing to make progress and should have further points to be closed in the upcoming 2023/24 Annual Report Audit scheduled for October.
5.4 Significance and Engagement
N/A
5.5 Implications
Financial
N/A
Social & Policy
N/A
Risk
Along with the internal audit programme, our external audit monitors and significantly reduces risk across the organisation. By monitoring the recommendations to ensure they are implemented we are further reducing risk. Any outstanding actions do pose a risk to the organisation.
6. Health and Safety Report
Type of Report: |
Information |
Legal Reference: |
N/A |
Document ID: |
1762676 |
Reporting Officer/s & Unit: |
Adam McDonald, Health, Safety and Wellbeing Lead |
6.1 Purpose of Report To inform the Audit & Risk Committee (ARC) of Health Safety & Wellbeing (HSW) strategic progress, performance and activities covering the period March 2024 to May 2024. The report enables the ARC to provide assurance to Council for the capability and functioning of Council’s health, safety and wellbeing hazard and risk management system and associated programme. |
The Audit and Risk Committee:
a. Receive the Health and Safety Report for the period March 2024 to May 2024.
Napier City Council (NCC) has duties under the Health and Safety at Work Act 2015 and subsequent regulations to ensure the safety of employees, and all other persons, at, or impacted by the work of Council. Duties of Council are upheld through the implementation of NCC’s health and safety management system, that is guided by legislation, codes of practice, and is designed to address operational health and safety risks.
Executive summary
· Revised risk assessments for SR32 and OR183 remain high and out of appetite, with OR328 assessed as medium.
· Critical hazards have been identified across Council with many requiring a risk assessment. This would include the review of internal controls and determination of their effectiveness.
· Progress of key strategic activities aligned to Councils health and safety improvement plan are outlined in this report.
· Safety events during this reporting period include one lost time injury, two medically treated injuries and zero notifiable events to WorkSafe by Council.
· There were four serious contractor incidents that required an investigation, with one notifiable event from a Contractor to WorkSafe.
· The wellbeing working group was established over this reporting period and tasked with the development of a wellbeing strategic action plan. The review of literature has uncovered a range of evidence-based strategies, frameworks, and models that will help inform the development of wellbeing work programmes.
Discussion
Strategic and operational risks
Risk no |
Risk Issue |
Inherent RA |
Revised RA |
Target RA* |
Risk Movement |
SR14 |
Failure to maintain a safe and healthy workplace and safe systems of work (ie we do not proactively navigate H&S threats) |
Extreme |
High |
Medium |
Nil |
OR183 |
Failure to manage health, safety, and wellbeing in the workplace |
Extreme |
High |
Medium |
Nil |
OR328 |
Failure to comply with the Health and Safety at Work Act 2015 and subsequent regulations. |
Extreme |
Medium |
Low |
Nil |
Critical and emerging risks
While the table below is not an exhaustive list, it provides a starting point for the identification and assessment of critical risks. Further work is required for the identification and assessment of hazards, risks, and internal controls to determine effectiveness, with an update due to ARC in Q3.
Table 2. Hazards and critical health & safety risks
Hazard |
Description of hazard |
Risk in register (Sycle)
Yes/No |
Revised risk assessments |
Contractors
|
Napier City Council engage contractors to complete work on our behalf. The Council are required to work in partnership with contractors to ensure duties as PCBUs are met, including conformance with Councils safety management system. |
No |
N/A |
Wellbeing and psychosocial factors
|
Within workplace settings, there are environmental, relational, and operational hazards that may affect people’s psychological and physical health. |
No |
N/A |
Human behaviour
|
There is an increased presence of anti-social and intimidating behaviour from members of public towards Council staff.
|
No |
N/A |
Dangerous work activity
|
Workers, contractors, and volunteers often complete high-risk work activity including the handling of hazardous substances, confined spaces, excavations, lockout / tag out, working from heights, roof access, hazardous waste disposal, excavations, and operating heavy machinery.
|
No |
N/A |
Building materials
|
Assets may contain hazardous building material including asbestos and silica, |
Yes |
OR207 - High |
Pool facilities and water features.
|
Council own and/or operate a range of pool facilities including ocean Spa, Napier Aquatic Centre, Kennedy Park, and several water features. |
Yes |
OR49 – High
OR89 - Medium
OR316* – Medium
OR325 - Low
OR332* - Medium |
Strategic progress
The following workstreams will be presented to this Committee and are meant to outline progress in alignment with our Health & Safety improvement plan that represents significant programmes of work due for completion by June 2025. The work programmes are designed to improve our health and safety management system, the management of health and safety risks, an promote a positive health and safety culture.
Workstream |
Status |
Milestones completed |
Next milestone |
Comment |
System improvement |
75% |
· Health and Policy · ELT Leadership charter · Centralisation of H&S data and documentation · Upgrade of incident reporting system (MySafety) |
Establish performance indicators and annual health and safety targets.
Review of H&S roles and responsibilities framework. |
Visit to Hamilton City Council planned for end May to discuss performance indicators and targets. |
|
||||
Health and safety risk management |
20% |
· Nil |
Identification and assessment of critical health and safety risks. |
Planned visit to Hamilton City Council who have implemented a critical risk framework, with the intention of implementing the framework (or something similar) at NCC. |
Leadership and commitment |
30% |
· Training and professional development opportunities delivered for directors and managers. |
Develop health and safety induction and training programme for managers and team leads to ensure they are equipped to manage health and safety risks. |
ELT and selection of tier three managers attended Institute of directors and IMPAC training/. |
Health and safety learning and development |
50% |
· Review of induction process, material, and scheduling. |
Complete training needs assessment for managers and team leaders |
Corporate inductions currently delivered face to face, with low attendance.
Risk based training is currently delivered using external training and education providers. |
Communication |
50% |
· Nil |
Health and safety communications plan and deliver communication on health and safety matters through existing channels and networks.
|
|
Engagement |
50% |
· Review and update health and safety committee terms of reference, and health and safety representative responsibilities, & accountabilities.
|
Establish communication channels for workers to remain engaged and informed for workplace health and safety.
|
|
Audit and assurance |
25% |
· Nil |
Develop and implement a schedule of health and safety reporting to enable effective monitoring and reviewing of health and safety performance based on strategic objectives and KPIs. |
Health and safety team continuing with audit activities focusing on critical risks. |
Health and safety reporting
Health and safety reporting profiled over this reporting period are summarised below (as of 20/05/2024).
Lag Reporting |
Q2 2023 |
Q2 2024 |
Incidents |
70 |
131 |
Pain + Discomfort |
33 |
26 |
Near Miss |
16 |
39 |
Lost time injuries |
2 |
1 |
Lead reporting |
Q2 2023 |
Q2 2024 |
Safety Observations |
56 |
121 |
Meetings |
25 |
53 |
Training delivered |
124 |
158 |
Investigations
· There were zero Council events that required an investigated during this reporting period.
· There were four contractor events that required an investigation during the reporting period.
WorkSafe notifiable events
· There was one contractor WorkSafe notifiable event during the reporting period.
· The incident involved a small hydrema dump truck at the Awatoto wastewater treatment plant on 06/05/2024. The worker involved in the incident was subcontracted to the principal contractor using a labour hire firm. The worker was found not to have received appropriate training and was not experienced or qualified to use the machinery. Furthermore, the person involved returned positive drug and alcohol post incident test.
· The investigation report identifies significant concerns for engaging sub-contractors, including the screening of workers. A contractor evaluation process is currently underway to determine the suitability of the contractor to complete any further work.
Workplace wellbeing
The wellbeing working group has been established to develop a wellbeing strategy for Council. Progress of key tasks for the development of the strategy are provided below.
Tasks |
Status |
Due date |
Milestones completed |
Next milestone |
Comment |
Literature review |
100% |
n/a |
Literature review |
Completed |
Strong evidence for addressing organisational factors with an emphasis on work design. |
Current state assessment |
100% |
n/a |
Current state assessment |
Completed |
NCC lacks a co-ordinated and structured approach to supporting workplace wellbeing. Initiatives and programmes are reactive and targeted to individuals. This approach is not well supported by the evidence. |
Data collection and analysis |
10% |
10 June, 2024 |
Nil |
Desktop analysis. Worker engagement |
Delays in initiating this work due to dependencies, competing demands and availability of resource. |
Future state recommendations including setting objectives, and outcome measures. |
0% |
30 June, 2024 |
Nil |
|
Delays in initiating this work due to dependencies and availability of resource. |
During the quarter we have continued to promote and support the wellbeing of our workers utilising our partnership with Mates4Life, access to EAP, and direction to community and public health resources.
6.3 Significance and Engagement
N/A
6.4 Implications
Financial
N/A
Social & Policy
N/A
Risk
N/A
Nil
7. Risk Management Report
Type of Report: |
Operational |
Legal Reference: |
N/A |
Document ID: |
1756767 |
Reporting Officer/s & Unit: |
Dave Jordison, Risk and Assurance Lead Alister Edie, Business Improvement Manager |
7.1 Purpose of Report
To update the Committee on risk management workstreams and inform on the status of Council’s strategic and operational risk profile and any emerging risks.
To align with our 3-year plan implementation, ELT met to workshop strategic risks and settled on an updated strategic risk profile in support of Councils strategic objectives. ELT was also supportive of a simplified framework for dashboarding and collectively reviewing strategic risks.
We have drafted an uplift plan to materially improve the management of our risk framework. This plan involves tailored education and improved processes to action risk reviews in a timely manner and enable escalations were required.
Our external partner has completed their review of our risk management framework and risk maturity status. We await this final report and will review recommendations and update our uplift plan as required.
We have implemented a rationalisation where new risks without a completed set up are de-activated. Without the assignment of adequate controls these risks report at their inherent/maximum risk level. We are working on a process to ensure these risks are set up in a timely manner.
Focusing on extreme and high out-of-appetite risks, we are beginning to escalate operational risks where it is concluded that the risk analysis is correct and relevant controls have been identified and their true effectiveness determined. This process demonstrates the required due diligence is being carried out at ELT and Chief Executive levels.
7.3 Issues
N/A
7.4 Significance and Engagement
N/A
7.5 Implications
Financial
N/A
Social & Policy
N/A
Risk
Strategic Risks
ELT has updated Councils strategic risk profile – to align with our updated strategic priorities. ELT reviewed the relevance and ownership of current strategic risks and the inactive risks recommended from the previous PWC strategic risk workshop. Gaps to key risk areas and strategic objectives were also checked with the creation of two new risks, being 1. Security and privacy of data and Information and 2. Council reputation. Some strategic risks were generalised to better cover key uncertainties e.g. People and Capability and Funding and financial management.
Figure 1. Updated Strategic Risk Profile – see detail in attachment.
We plan to table the updated strategic risk review status at the audit and risk committee meeting. We are working through a simplified process where ELT is surveyed to form a group consensus of the risk status for each strategic risk. This process is still to be determined e.g. regarding links to the current review process in the system.
Operational Risks
Out of Appetite
There are currently 138 Operational risks showing as out of appetite, up from 50 in the previous period. This increase is due to the required risk reviews taking place with a more robust determination of the revised risk levels.
OR 334 serious harm or fatality of staff and/or public from trade waste non-compliance has a revised risk level of extreme so has been escalated through the Director of Infrastructure Services and on to the Chief Executive.
As part of the uplift program, we are determining processes for utilising ELT meetings to improve the regular review of out-of-appetite operational risks as well as strategic risks, where the risk owners sit below ELT level.
Escalations
- OR 334 serious harm or fatality of staff and/or public from trade waste non-compliance: has a revised risk level of extreme so has been escalated through the Director of Infrastructure Services and on to the Chief Executive.
- OR207 Failure to comply with Health and Safety at work (Asbestos) Regulations 2016: remains at a revised level of High and is in the process of being escalated through the director Infrastructure Services and on to the Chief Executive.
Improvements
Overdue Operational Risk Reviews have reduced 3% from the previous period. This is a result of risk review work undertaken by risk owners. This is supported by an 8% reduction in overdue control reviews and an 8% reduction in risks containing no controls. Overdue treatment actions have also reduced 3% and is evidence that target dates to address poor performing controls are being improved.
The 50% increase in the revised level of risk is as a result of increased review work resulting in a more accurate picture of the revised level of risk. Improving this measure is a focus of the next phase of the risk uplift programme, with the intention to ensure controls are in place and are as effective as possible, with escalation where required.
Risk Management Uplift Program
We have drafted an uplift plan to improve our risk management processes. The completed review of our risk management framework by our audit partner will further inform this plan. The completion dates of workstreams across the program are still to be determined but believe a 15month timeline could be suitable.
We have implemented some rationalisations now to improve the usability of our risk management framework e.g. de-activating new risks that have not been set up completely with controls - as they will automatically report at their inherent/maximum risk as out-of-appetite. We are also only focusing on extreme and high out-of-appetite risks for now.
We are seeking support from this committee of the following draft uplift programme.
Emerging Risks
Nil to Report
7.6 Preferred Option
Receive this risk management report and support the officers’ recommendations.
Recommendation to Exclude the public
That the public be excluded from the following parts of the proceedings of this meeting, namely:
AGENDA ITEMS
1. Verbal Update Chief Executive
2. Severence Pay Recommendations Update
The general subject of each matter to be considered while the public was excluded, the reasons for passing this resolution in relation to each matter, and the specific grounds under section 48(1) of the Local Government Official Information and Meetings Act 1987 for the passing of this resolution were as follows:
General subject of each matter to be considered.
|
Reason for passing this resolution in relation to each matter.
|
Ground(s) under section 48(1) to the passing of this resolution.
|
1. Verbal Update Chief Executive |
7(2)(h) Enable the local authority to carry out, without prejudice or disadvantage, commercial activities |
48(1)(a) That
the public conduct of the whole or the relevant part of the proceedings of
the meeting would be likely to result in the disclosure of information for
which good reason for withholding would exist: |
2. Severence Pay Recommendations Update |
7(2)(c)(i) Protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied |
48(1)(a) That
the public conduct of the whole or the relevant part of the proceedings of
the meeting would be likely to result in the disclosure of information for
which good reason for withholding would exist: |
Audit and Risk Committee
Open Minutes
Meeting Date: |
Thursday 4 April 2024 |
Time: |
9.30am – 12.05pm (Open) 12.07pm to 12.23pm (Public Excluded) |
Venue |
Breakout Room 2 |
|
Audio-visually recorded for Council website |
Present |
Chair: Bruce Robertson Members: Mayor Kirsten Wise, David Pearson, Councillor Sally Crown (Deputy Chair) Councillor Greg Mawson and Councillor Hayley Browne Ngā Mānukanuka o te Iwi representative - Joe Tareha |
In Attendance |
Chief Executive (Louise Miller) Deputy Chief Executive (Jessica Ellerm) Acting Executive Director Corporate Services (Caroline Thomson) Acting Chief Financial Officer (Talia Foster) Internal Audit Lead (Raewyn Fowler) Health, Safety and Wellbeing Lead (Adam McDonald) Team Leader Governance (Anna Eady) Audit New Zealand (Karen Young) |
Administration |
Governance Advisors (Carolyn Hunt and Jemma McDade) |
Audit and Risk Committee – Open Minutes
Table of Contents
Order of Business Page No.
Karakia
Apologies
Conflicts of interest
Public forum
Announcements by the Mayor
Announcements by the Chairperson
Announcements by the management
Confirmation of minutes
Agenda Items
1. Ombudsman Report - Council Meeting and Workshop setting amendments. 4
2. Health and Safety Report
3. Risk Management Report
4. Sensitive Expenditure - Mayor and Chief Executive
5. Internal Audit Recommendations Progress Report
6. Policy review process update
7. External Audit actions status update
8. Audit Plan for 2023/24 Annual Report
9. Audit New Zealand Management Report
Minor matters
Resolution to Exclude the Public
Order of Business
The meeting opened with the Council karakia.
Nil
Nil
Nil
Announcements by the Chairperson
The Chair advised that today’s Audit and Risk Committee meeting, and future meetings, would be audio-visually recorded and at the conclusion of the meeting uploaded to Council’s website meetings page for the public to view.
Announcements by the management
Nil
Bruce Robertson / Councillor Crown That the Minutes of the Audit and Risk Committee meeting held on 13 December 2023 were taken as a true and accurate record of the meeting. Carried |
· Progress of the Asset Management Roadmap and implementation to be reported back at the 14 June 2024 Audit and Risk Committee meeting.
Agenda Items
1. Ombudsman Report - Council Meeting and Workshop setting amendments
Type of Report: |
Operational |
Legal Reference: |
Local Government Official Information and Meetings Act 1987 |
Document ID: |
1745863 |
Reporting Officer/s & Unit: |
Anna Eady, Team Leader Governance |
1.1 Purpose of Report
In October 2023 the Ombudsman released a report “Open for Business”, which followed an investigation into local council meetings and workshops. This report will set out our proposed improvement programme and the Council direction to meet the Ombudsman’s key recommendations.
At the meeting The Team Leader Governance, Ms Eady spoke to the report and highlighted to the Committee whether it considered that Napier City Council (NCC) should have an indemnity and liability Policy in regard to making public recordings of workshops on the NCC website. In response to questions the following was clarified: · The Ombudsman’s request that a plain English explanation in reasonable detail to exclude the public will require some adjustment to Council’s agenda creation system (Infocouncil). Currently officers can select an Act and reason for exclusion and it is intended that plain English reasons also be included. · Officers will need to provide Governance good reason to withhold information and weigh it against public interest. · Ombudsman virtual training for staff and elected members will be held on 9 April 2024 which will assist officers and elected members in the understanding of valid reasons for withholding information. · A dedicated page on the Council website is to be created that will list the workshops, whether they are public excluded and the reason, or if they are open to the public. · Workshop guidelines are currently being drafted to assist Chairs on how to manage workshops and it is anticipated they will be available as soon as possible, with the Ombudsman training supporting this work. Minutes of workshops would be a summary of key points and actions rather than detailed meeting minutes. · Audio-visual recordings of workshops would be uploaded to a YouTube channel. · Full costs of the activity are hard to predict. John Norris, Engage Video, who livestreams Council/Committee meetings advised that running workshops following meetings did not increase the cost. · The cost for his services would be the same for transcripts as the cost relates to licenses for Teams or Zoom links and microphone set up required to capture conversation. · Ideally workshops would be scheduled after Council/Committee meetings to keep costs down. However, on the days that were not meeting days officers would record through a zoom link, and upload the recording to the workshop page on Council’s website. · There are tools already in use to provide a solution around the release of public excluded information, for example through the Action Register reported to Council · It was noted that the timetable for implementation had been adopted by Council at its meeting on 14 March 2024.
|
|
Committee resolution
|
David Pearson / Councillor Browne The Audit and Risk Committee: a) Receive the report titled Ombudsman Report – Council Meeting and Workshop setting amendments.
b) Note officers have undertaken an assessment of Napier City Council’s current practices in relation to the Ombudsman’s Open for Business report and will make improvements to these practices.
c) Note open Audit and Risk Committee meetings will be recorded and published on the Napier City Council website. Carried |
Type of Report: |
Information |
Legal Reference: |
N/A |
Document ID: |
1722342 |
Reporting Officer/s & Unit: |
Adam McDonald, Health, Safety and Wellbeing Lead |
2.1 Purpose of Report
The purpose of this report is to provide the Audit & Risk Committee (ARC) an overview of Health Safety & Wellbeing (HSW) activity, inform on the progress of initiatives underway to improve health, safety, and wellbeing, as well as key performance indicators covering the period December 2023 through to February 2024. The report enables the ARC to provide assurance to Council for the capability and functioning of Council’s health, safety and wellbeing hazard and risk management system and associated programmes.
At the meeting The Health, Safety and Wellbeing Lead, Mr McDonald spoke to the report, providing a brief summary and overview of Health and Safety activity risks, progress of initiatives underway to improve health, safety, and wellbeing, as well as current key performance indicators covering the period December 2023 to February 2024. In response to questions the following was clarified: · The Employee Assistance Programme (EAP) reports seeing pressures, outside of work impacting on the workplace. Work specific issues were not identified as a reason for staff engaging with the EAP. · Well-being programme developed going forward as the organisation supports staff, no matter the origin of the stress or anxiety, so they can be the best version of themselves at work. · Future reporting on EAP will not be through numbers it will be how to effect organisational change and focus more on wellbeing. Work is being undertaken on what challenges people are facing so programmes can target what is needed to improve their well-being.. · A Health and Safety Improvement Plan had now been developed and approved by the Executive Leadership Team (ELT). The Health and Safety Team, together with the People and Capability Team, are working on culture change management and promoting the changes. · The actions integrated into the Implementation Plan will require a programme to monitor the results. |
|
Committee resolution
|
Mayor Wise / Councillor Crown The Audit and Risk Committee: a) Receive the Health and Safety Report for the period December 2023 to February 2024. Carried |
The meeting adjourned for morning tea at 10.33am
and reconvened at 10.50am
Type of Report: |
Operational |
Legal Reference: |
N/A |
Document ID: |
1744348 |
Reporting Officer/s & Unit: |
Dave Jordison, Risk and Assurance Lead Alister Edie, Business Improvement Manager |
3.1 Purpose of Report
To update the Committee on current developments and workstreams within the risk management framework and inform on the status of Council’s strategic and operational risk profile and any emerging risks.
At the meeting The Business Improvement Manager, Mr Edie spoke to the revised report that was circulated, which included minor updates in the summary section and the inclusion of a table of revised operational risks. Mr Edie provided a brief summary of the current risk management framework, some developments and workstreams underway. In response to questions the following was clarified: · A review of the strategic risks is to be undertaken and will align to the Long Term Plan (LTP). Council’s strategic priorities have been reset by elected members and consultation on the 3 year LTP is underway and to be reported back at the next meeting. · Asbestos risk is extreme and does not comply with the Act. An urgent project is underway to address this, and will be completed within two weeks. The programme needs to be in place to reduce the risk rating. · Introduction of a housekeeping programme to regularise and formalise how the organisation is addressing risks and to understand the systems that management are using to monitor risks. · A review of the system is currently underway through an internal audit. It was noted at the meeting that it would be beneficial for the Committee to meet with internal auditors Crowe.
|
|
Committee resolution
|
David Pearson / Councillor Browne The Audit and Risk Committee: a) Receive the report titled “Risk Management Report” dated 4 April 2024. Carried |
4. Sensitive Expenditure - Mayor and Chief Executive
Type of Report: |
Procedural |
Legal Reference: |
N/A |
Document ID: |
1742723 |
Reporting Officer/s & Unit: |
Raewyn Fowler, Internal Audit Lead Talia Foster, Financial Controller |
4.1 Purpose of Report
To provide the information required for the Committee to review Sensitive Expenditure of the Mayor and Chief Executive for compliance with Council’s Sensitive Expenditure Policy.
At the meeting The Internal Audit Lead, Ms Fowler took the report as read and confirmed that items identified in the report for this quarter complied with Council’s Sensitive Expenditure Policy. |
|
Committee resolution
|
Councillor Mawson / Joe Tareha The Audit and Risk Committee: a) Receive the 31 December 2023 quarterly report of Sensitive Expenditure for the Mayor and Chief Executive and review for compliance with the Sensitive Expenditure Policy. Carried |
5. Internal Audit Recommendations Progress Report
Type of Report: |
Information |
Legal Reference: |
N/A |
Document ID: |
1742724 |
Reporting Officer/s & Unit: |
Raewyn Fowler, Internal Audit Lead |
5.1 Purpose of Report
The purpose of this report is to provide the Committee with a summary of the internal audit recommendations progress to date.
At the meeting The Internal Audit Lead, Mrs Fowler spoke to the report which was an update on internal progress, and noted that another internal audit had been undertaken during that period for PAYE and withholding tax which was also included in the report. The Financial Controller, Ms Foster spoke to the PWC report advising there were issues identified in actioning some items due to lack of resource in payroll, People and Capability and Procurement teams. In response to questions the following was clarified: · In regards to the records management that dates back to 2021, with 13 outstanding recommendations it is understood that once the SharePoint system and learning management system are up and running well these may be ticked off. · A conscious pause has been implemented in the transition to new technology planned for in Council’s digital transformation Strategy. The Digital Strategy priorities have been reviewed and over the next 3-5 years a learning management tool will be implemented first, followed by a Human Resources tool. · The outstanding recommendations have been reviewed and slowing implementing the recommendations has a low risk level. · When considering the recommendations officers can explore whether they can be addressed through other strategies or if they can be achieved through other control mechanisms. Recommendations made by the Auditor can be challenged and if agreed with, ranked in order of priority . · The risk that Council are not complying with PAYE is considered low, however withholding tax is more problematic. There is not considered to be a financial liability but processes do need to be reviewed.
|
|
Committee resolution
|
Bruce Robertson / Councillor Crown The Audit and Risk Committee: a) Receive the Internal Audit Recommendations Progress Report dated 4 April 2024.
Carried |
6. Policy review process update
Type of Report: |
Operational |
Legal Reference: |
N/A |
Document ID: |
1701124 |
Reporting Officer/s & Unit: |
Talia Foster, Financial Controller Caroline Thomson, Chief Financial Officer |
6.1 Purpose of Report
To update the committee on the progress made to date with the policy review project.
At the meeting The Financial Controller, Ms Foster spoke to the report which was a result of some recommendations from internal and external auditors and there was some concern from the Committee that some policies were not up-to-date. In response to questions the following was clarified: · Although the majority of policies were out of date, even though recently, the fact that they had not been reviewed did not mean they were no longer relevant. The process in place currently is that policies are going to the ELT monthly, with 3-5 being addressed at each meeting. · It was noted that other policies (Code of Conduct for Employees Policy, Confidentiality Policy, Drug and Alcohol Policy and Workplace Bullying Policy) which were considered high importance or high risk were not included in the upcoming quarter. The important thing to note is whether they were still adequate even if they were out-of-date.
· The Workplace Bullying Policy was currently under development by the People and Capabilities Team. · The policies that are crucial for audit are in People and Capability and Finance. This puts a lot of work on those two teams to get the policies reviewed and completed, which is why they cannot all be finalised within the timeframe. · An Acting Chief People Officer has been appointed and Ms Ellerm will work with her to try and progress these policies. · For future reporting the policy review dates are to be included for reference.
|
|
Committee resolution
|
Councillor Mawson / Mayor Wise The Audit and Risk Committee: a) Receive the report titled “Policy Review Process Update” dated 4 April 2024. Carried |
Councillor Browne withdrew from the meeting at 11.40am
7. External Audit actions status update
Type of Report: |
Information |
Legal Reference: |
N/A |
Document ID: |
1742734 |
Reporting Officer/s & Unit: |
Talia Foster, Financial Controller |
7.1 Purpose of Report
The purpose of this paper is to summarise the actions taken by management from recommendations made via our external audit process to provide assurance to the Audit and Risk Committee that these have been addressed.
At the meeting The Financial Controller, Ms Foster spoke to the report on what progress had been made on actions. In response to questions the following was clarified: · Ms Foster confirmed that the $1m figure referred to in the actions to approve operating expenditure in excess of $1m was now out-of-date. While a process is in place to ensure Council have approved spend over the CE delegation before payments are made, this needs to be put in writing. It was noted that there were some high leave balances and staff would be encouraged to take leave as a preference or cash it up.
|
|
Councillor Browne rejoined the meeting at 11.45am
|
|
Committee resolution
|
Councillor Crown / David Pearson The Audit and Risk Committee: a) Receive the report titled “External Audit Status Update” dated 4 October 2024. Carried |
8. Audit Plan for 2023/24 Annual Report
Type of Report: |
Enter Significance of Report |
Legal Reference: |
Enter Legal Reference |
Document ID: |
1742735 |
Reporting Officer/s & Unit: |
Talia Foster, Financial Controller |
8.1 Purpose of Report
To provide delegation to the Chair to approve the Audit Plan for the 2023/24 Annual Report in consultation with the Chief Executive.
At the meeting The Financial Controller, Ms Foster spoke to the Audit Plan for the upcoming Annual Report for the year end 30 June 2024. There are auditors on site currently for an interim audit with nothing unusual or unexpected in the Audit Plan. The Chair invited auditor Karen Young’s comments. Ms Young confirmed that everyone worked well together last year with really good co-operation and assistance with good headway made in the revaluations. In response to questions the following was clarified: · In regard to the attendance and resolution times, the qualification will remain due to the comparatives, officers are confident that a lot of work has been done in this area but it is still to be verified. · Ms Young confirmed that if systems and processes were only put in place midway through the year they would not be cleared. Processes implemented from 1 July would be clear going forward. Updates undertaken for the IT system were done by 1 July so the system has been in place for a year. Training took place throughout the year and QA processes have gone back to the beginning of the year. · Council’s materiality worked to before draft accounts are provided to audit typically for year end is $5,000-$10,000 for accruals on a transaction level while exercising professional judgement. Where aware of any errors or adjustments required at that level they will be corrected or advise audit of the issue. The workload required versus the value add needs to be balanced. · Ms Foster confirmed that she was very comfortable that 30 October 2024 was achievable for the Annual Report and did not anticipate any issues. · Ms Young advised the reason the audit letter was in draft was in regard to performance measures. Audit have received some guidance around the Drinking Water Performance Measures from the Auditor General’s Office which the Department of Internal Affairs have communicated to them and the letter will be able to finalised in the very near future. |
|
Committee resolution
|
Bruce Robertson / David Pearson The Audit and Risk Committee: a) Receive the report titled “Audit Plan for 2023/24 Annual Report” dated 4 April 2024. b) Delegate authority to the Chair and the Chief Executive to approve the Audit Plan for the 2023/24 Annual Report on behalf of the Audit and Risk Committee (Doc Id 1746445). Carried |
9. Audit New Zealand Management Report
Type of Report: |
Information |
Legal Reference: |
Local Government Act 2002 |
Document ID: |
1742736 |
Reporting Officer/s & Unit: |
Talia Foster, Financial Controller |
9.1 Purpose of Report
To consider the Audit NZ management report to the Council on the audit of Napier City Council for the year ended 30 June 2023.
At the meeting The Financial Controller, Ms Foster spoke to the Audit New Zealand Management report for the year ended 30 June 2023 that was adopted at the end of last year. Council received a Qualified Opinion and the report provides some further recommendations and actions that will be reported back to the Committee in the future. Ms Young commented that it was a very busy and challenging year for the Council and there was only one new recommendation to ensure the good condition of above ground water assets , and that the register is complete and has integrity. Otherwise it was a very good result and Council management and staff should be very proud of what they achieved last year. The Committee confirmed that they were comfortable with the recommendations, management responses and timelines for completion. |
|
Committee resolution
|
Bruce Robertson / Councillor Crown The Audit and Risk Committee: a) Receive the Audit NZ management report to the Council on the audit of Napier City Council for the year ended 30 June 2023 (Doc Id 1745793). Carried |
There were no minor matters to discuss.
Resolution to EXCLUDE the Public
Councillors Mawson / Crown That the public be excluded from the following parts of the proceedings of this meeting, namely: 1. Verbal Update Chief Executive Carried |
The general subject of each matter to be considered while the public was excluded, the reasons for passing this resolution in relation to each matter, and the specific grounds under section 48(1) of the Local Government Official Information and Meetings Act 1987 for the passing of this resolution were as follows:
General subject of each matter to be considered. |
Reason for passing this resolution in relation to each matter. |
Ground(s) under section 48(1) to the passing of this resolution. |
1. Verbal Update Chief Executive |
7(2)(h) Enable the local authority to carry out, without prejudice or disadvantage, commercial activities |
48(1)(a) That the public
conduct of the whole or the relevant part of the proceedings of the meeting
would be likely to result in the disclosure of information for which good
reason for withholding would exist: |
The meeting adjourned at 12.05pm and reconvened
in Public Excluded at 12.07pm
The meeting closed with a karakia at 12.23pm
Approved and adopted as a true and accurate record of the meeting.
Chairperson .............................................................................................................................
Date of approval ...................................................................................................................... |