Audit and Risk Committee

Open Agenda

 

Meeting Date:

Friday 14 June 2024

Time:

9.30am

Venue:

Breakout Room 1
War Memorial Centre
Marine Parade
Napier

 

 

Committee Members

Chair:                   Bruce Robertson

Members:  Mayor Kirsten Wise, David Pearson, Councillor Sally Crown (Deputy Chair), Councillor Greg Mawson and Councillor Hayley Browne

Ngā Mānukanuka o te Iwi representative - Vacant

Officer Responsible

Deputy Chief Executive / Executive Director Corporate Services

Administration

Governance Team

 

Next Audit and Risk Committee Meeting

Thursday 5 September 2024

 

 


Audit and Risk Committee - 14 June 2024 - Open Agenda

2022 TERMS OF REFERENCE - AUDIT AND RISK

 

Reports to:

Council

Chairperson

Bruce Robertson (External Independent)

Deputy Chairperson

Councillor Crown

Membership

The Mayor

Deputy Chair of Sustainable Napier Committee

Chair of Prosperous Napier Committee

External independent appointee

Ngā Mānukanuka o te Iwi (Māori Committee) (1)

Note: The Chief Executive and External Auditor are required to attend all meetings but are not members and have no voting rights. 

Quorum

3 - One of which is an external appointee

Meeting frequency

At least quarterly and further as required

Officer Responsible

Deputy Chief Executive / Executive Director Corporate Services

 

Role

The role and scope, as well as any delegations of the Audit and Risk Committee are defined in the Audit Charter (Doc Id 325090).

 

Delegations

The role and scope, as well as any delegations of the Audit and Risk Committee are defined in the Audit Charter.

 

The Committee can make recommendations to Council or the Chief Executive as appropriate.

 


Audit and Risk Committee - 14 June 2024 - Open Agenda

ORDER OF BUSINESS

Karakia

Apologies

Mayor Wise

Conflicts of interest

Public forum

Nil

Announcements by the Mayor

Announcements by the Chairperson including notification of minor matters not on the agenda

Note: re minor matters only - refer LGOIMA s46A(7A) and Standing Orders s9.13

A meeting may discuss an item that is not on the agenda only if it is a minor matter relating to the general business of the meeting and the Chairperson explains at the beginning of the public part of the meeting that the item will be discussed. However, the meeting may not make a resolution, decision or recommendation about the item, except to refer it to a subsequent meeting for further discussion.

Announcements by the management

Confirmation of minutes

That the Minutes of the Audit and Risk Committee meeting held on Thursday, 4 April 2024 be taken as a true and accurate record of the meeting............................................................................................. 75

Agenda items

1      Internal Audit Recommendations Progress Report.......................................................... 4

2      Sensitive Expenditure - Mayor and Chief Executive...................................................... 13

3      Internal Audit:  Contract Management Report............................................................... 17

4      Policy review process update........................................................................................ 53

5      External Audit actions status update............................................................................. 55

6      Health and Safety Report.............................................................................................. 59

7      Risk Management Report............................................................................................. 66

Minor matters not on the agenda – discussion (if any)

Recommendation to Exclude the Public................................................................. 73

 


Audit and Risk Committee - 14 June 2024 - Open Agenda                                                                                                     Item 1

Agenda Items

 

1.    Internal Audit Recommendations Progress Report

Type of Report:

Information

Legal Reference:

N/A

Document ID:

1756765

Reporting Officer/s & Unit:

Raewyn Fowler, Internal Audit Lead

 

1.1   Purpose of Report

The purpose of this report is to provide the Committee with a summary of the internal audit recommendations progress to date.

 

 

Officer’s Recommendation

The Audit and Risk Committee:

a)   Receive the Internal Audit Recommendations Progress Report.

 

 

1.2   Background Summary

Napier City Council contract to Crowe to provide internal audit services.  The internal audits performed by Crowe include a written report on issues found with recommendations and agreed management actions to be taken by Council staff to address the issues raised. In addition, PWC provide Council regular taxation internal audits – these are also included in the progress report provided. The agreed management actions are now being followed up by the relevant Council management and progress on actions to date is being tracked and reported (refer attachment).

1.3   Issues

There are four internal audits that have outstanding actions (in progress) these being:

·     Building and Resource Consents (Crowe)

·     Sensitive Expenditure (Crowe)

·     Records Management (Crowe

·     PAYE & WHT (PWC)

 

Graph 1 below provides the status of recommendations (as at June 2024) – being Total Findings, Total Completed and Total Outstanding.  Table 1 shows the progress of these recommendations being implemented since last report presented to the Committee (March 2024).

 

 

 

Graph 1:  Recommendations Status

 

Percentage completed (Goal 100%)

Jun-24

Mar-24

Building and Resource Consents (2022)

71%

57%

Records Management (2021)

41%

35%

Sensitive Expenditure (2022)

88%

75%

PAYE/WHT (2023 PWC)

59%

12%

Table 1: Percentage completed since last report

 

1.4   Significance and Engagement

N/A

1.5   Implications

Financial

N/A

Social & Policy

N/A

Risk

The internal audit programme monitors and significantly reduces risk across the organisation. By monitoring the recommendations to ensure they are implemented we are further reducing risk. Any outstanding actions do pose a risk to the organisation.

1.6   Development of Preferred Option

Recommend the committee receive the Internal Audit Recommendations Progress Report.

 

1.6   Attachments

1      Internal Audit Recommendations Progress Report (Doc Id 1764969   

 


Internal Audit Recommendations Progress Report (Doc Id 1764969

Item 1 - Attachment 1

 





Audit and Risk Committee - 14 June 2024 - Open Agenda                                                                                                     Item 2

2.    Sensitive Expenditure - Mayor and Chief Executive

Type of Report:

Procedural

Legal Reference:

N/A

Document ID:

1756766

Reporting Officer/s & Unit:

Raewyn Fowler, Internal Audit Lead

Talia Foster, Financial Controller

 

2.1   Purpose of Report

To provide the information required for the Committee to review Sensitive Expenditure of the Mayor and Chief Executive for compliance with Council’s Sensitive Expenditure Policy.

 

Officer’s Recommendation

The Audit and Risk Committee:

a.     Receive the 31 March 2024 quarterly report of Sensitive Expenditure for the Mayor and Chief Executive and review for compliance with the Sensitive Expenditure Policy.

2.2   Background Summary

The Sensitive Expenditure Policy approved by the Chief Executive on 17 March 2023 and endorsed by Council requires a report of all sensitive expenditure by the Chief Executive and by the Mayor to Audit and Risk Committee meetings (clauses 6.3 and 6.4). The policy also states that the expenditure items will be reviewed by the Chairperson or the Deputy Chairperson of the Audit and Risk Committee for compliance with this policy.

2.3   Issues

No issues

2.4   Significance and Engagement

N/A

2.5   Implications

Financial

N/A

Social & Policy

All sensitive expenditure transactions for the quarter ended 31 March 2024 are compliant with Council’s Sensitive Expenditure Policy.

Risk

N/A

 

2.6   Attachments

1      Sensitive Expenditure Q3 31 March 2024 Mayor (Doc Id 1762379)  

2      Sensitive Expenditure Q3 31 March 2024 CE (Doc Id 1762380)   

 


Sensitive Expenditure Q3 31 March 2024 Mayor (Doc Id 1762379)

Item 2 - Attachment 1

 


Sensitive Expenditure Q3 31 March 2024 CE (Doc Id 1762380)

Item 2 - Attachment 2

 


Audit and Risk Committee - 14 June 2024 - Open Agenda                                                                                                     Item 3

3.    Internal Audit:  Contract Management Report

Type of Report:

Operational

Legal Reference:

Local Government Act 2002

Document ID:

1760996

Reporting Officer/s & Unit:

Raewyn Fowler, Internal Audit Lead

Sharon O'Toole, Procurement Manager

 

3.1   Purpose of Report

To table to the Committee the internal audit on Contract Management undertaken by Council’s internal auditors, Crowe.

 

 

Officer’s Recommendation

The Audit and Risk Committee:

a.     Receive the report from Crowe titled ‘Internal Audit – Contract Management’.

 

 

3.2   Background Summary

As part of the internal audit programme (as approved by the Audit & Risk committee December 2022), an internal audit on Contract Management (Doc Id 1764970) was undertaken by our Internal Audit provider, Crowe.  The fieldwork commenced September 2023 - completed by December 2023.  A draft report of the findings was provided to management at the completion of the audit to review and provide feedback on the findings and recommendations. 

The report was finalised on the 21 May 2024 (please refer Attachment 1).  The report provides recommendations and management responses on how to deal with the identified performance gaps relating to Contract Management.

The audit involved four major contracts selected (in conjunction with management):

·     Kerbside recycling

·     Streetlight/traffic signal maintenance

·     Supply and maintenance of parking machines

·     Napier War Memorial Restoration project

 

The objectives of this audit were to review Council’s Contract Management processes on the following:

·     Alignment of procurement and contract management policies and procedures.

·     Qualitative and quantitative performance measures that are in place to enable the contract manager to monitor and measure service delivery.

·     Performance review processes, including process for managing corrective measures and non-performance.

·     Compliance with commercial contact conditions.

·     Management of contract variations and extensions.

·     Existing internal controls processes for the identification and requisition of works for completion, and confirmation of satisfactory completion of works.

 

3.3   Issues

The audit identified a total of 11 risks - three high, seven medium and one low.  The three high risk issues are as follows:

5.1 Lack of Contract Management Planning Strategy

5.2 Incomplete Contract Management Framework documents

5.3 Financial delegations to be enforced

 

Management’s responses to these risks are included in the report and includes those staff members who are responsible for the implementation of the agreed recommendations.

Of note, and as part of these recommendations, a Procurement and Management Improvement Plan (the Plan) has been drafted to address the recommendations and to ensure the priorities, funding and resourcing are agreed upfront.  At the time of writing this report, the Plan is scheduled for approval by ELT on 4 June 2024.

 

3.4   Significance and Engagement

N/A

3.5   Implications

Financial

N/A

Social & Policy

N/A

Risk

N/A

 

3.6   Attachments

1      Internal Audit - Contract Management (Doc Id 1764970)   

 


Internal Audit - Contract Management (Doc Id 1764970)

Item 3 - Attachment 1

 



































Audit and Risk Committee - 14 June 2024 - Open Agenda                                                                                                     Item 4

4.    Policy review process update

Type of Report:

Operational

Legal Reference:

N/A

Document ID:

1756764

Reporting Officer/s & Unit:

Talia Foster, Financial Controller

Caroline Thomson, Chief Financial Officer

 

4.1   Purpose of Report

To update the committee on the progress made to date with the policy review project.

 

 

Officer’s Recommendation

The Audit and Risk Committee:

a.     Receive the report titled “Policy Review Process Update” dated 14 June 2024.

 

 

4.2   Background Summary

At the meeting of the Audit and Risk Committee on 29 September 2023, the committee directed officers to provide an update of the policy review process which was undergoing changes.

It is important to Council to have up to date policies in place to reduce risk across many areas of Council. Regularly reviewing policies is good practice to ensure they are relevant and fit for purpose. Internal and External audits have highlighted issues with policies being past their review date and officers have been struggling to ensure their timely review due to issues with the internal policy review process and system.

In September 2023, the Executive Leadership Team (ELT) agreed to review policies outside of this system to enable the timely review and correct a backlog of policies where an initial review has been completed by officers, but not approved by the ELT.

4.3   Current Position

Since the last report to the committee, the following policies have been approved by ELT and are now awaiting minor edits and publishing:

·     Gifts and Gratuities Policy

·     Travel Policy

·     Koha Policy

·     2024 Elected Members Expenses Policy (adopted by Council in April)

There are further policies going to ELT for approval between writing this report and the meeting on 14 June:

·     Credit Card Policy

·     Sensitive Expenditure Policy

·     Payment Policy (renamed from Cheque Signing and Payment Policy)

·     Complaints Policy

·     Pressure Sewer Policy

In the 4 April report to committee we notified that nine policy reviews had been approved by ELT since 1 October. Four of these were already published. Of those that were not already published, four still require minor edits and publishing, and one is going to Council for adoption in June (CCTV Policy).

The Information Services team will be reviewing options for an IT solution to support automation as soon as practical. This will remove the manual process and speed up the process, enabling more policies to be pushed through review in a timely manner.

Currently we have approximately 110 policies, of which around 79 are due for review. It should be noted that these are estimates as we have had to work outside of the system, meaning the system may not provide an accurate picture.

4.4   Significance and Engagement

N/A

4.5   Implications

Financial

N/A

Social & Policy

N/A

Risk

One key purpose of a policy is to mitigate risks. Having policies which are not regularly reviewed leaves us open to risks which are not effectively managed by policies. We are reducing this risk by prioritising the policies which are reviewed first.

4.6   Options

The options available to the Committee are as follows:

a.     Receive this update on the policy review process

b.     Provide further direction to officers

4.7   Development of Preferred Option

Receive the update on the policy review process.

 

4.8   Attachments

Nil

 


Audit and Risk Committee - 14 June 2024 - Open Agenda                                                                                                     Item 5

5.    External Audit actions status update

Type of Report:

Information

Legal Reference:

N/A

Document ID:

1762046

Reporting Officer/s & Unit:

Talia Foster, Financial Controller

 

5.1   Purpose of Report

The purpose of this paper is to summarise the actions taken by management from recommendations made via our external audit process to provide assurance to the Audit and Risk Committee that these have been addressed.

 

 

Officer’s Recommendation

The Audit and Risk Committee:

a.     Receive this report titled “External Audit Actions Status Update” dated 14 June 2024.

 

 

5.2   Background Summary

Napier City Council are audited by Audit New Zealand annually for our Annual Report process, as legislated by the Local Government Act 2002. For each audit, we receive a report detailing issues found and recommendations made. 

        The agreed management actions are now being followed up with the relevant Council staff management and progress on actions to date is being tracked and reported.

5.3   Issues

From the 2022/23 Annual Report audit, Audit NZ were able to close 13 action points. Only one new action point was added during that audit. We now have 12 action points remaining.

Any closed points have now been dropped from this report, and we are reporting on the actions which remained as outstanding in Audit NZ’s Management Report for 2022/23 which was presented to the Audit and Risk Committee meeting on 4 April 2024.

Although no additional items have been marked as completed in the past quarter, we are continuing to make progress and should have further points to be closed in the upcoming 2023/24 Annual Report Audit scheduled for October.

5.4   Significance and Engagement

N/A

5.5   Implications

Financial

N/A

Social & Policy

N/A

Risk

Along with the internal audit programme, our external audit monitors and significantly reduces risk across the organisation. By monitoring the recommendations to ensure they are implemented we are further reducing risk. Any outstanding actions do pose a risk to the organisation.

 

5.6   Attachments

1      External Audit Actions Status Update (Doc Id 1762377)   

 


External Audit Actions Status Update (Doc Id 1762377)

Item 5 - Attachment 1

 



Audit and Risk Committee - 14 June 2024 - Open Agenda                                                                                                     Item 6

6.    Health and Safety Report

Type of Report:

Information

Legal Reference:

N/A

Document ID:

1762676

Reporting Officer/s & Unit:

Adam McDonald, Health, Safety and Wellbeing Lead

 

6.1   Purpose of Report

To inform the Audit & Risk Committee (ARC) of Health Safety & Wellbeing (HSW) strategic progress, performance and activities covering the period March 2024 to May 2024. The report enables the ARC to provide assurance to Council for the capability and functioning of Council’s health, safety and wellbeing hazard and risk management system and associated programme.

 

Officer’s Recommendation

The Audit and Risk Committee:

a.     Receive the Health and Safety Report for the period March 2024 to May 2024.

 

6.2   Background Summary

Napier City Council (NCC) has duties under the Health and Safety at Work Act 2015 and subsequent regulations to ensure the safety of employees, and all other persons, at, or impacted by the work of Council. Duties of Council are upheld through the implementation of NCC’s health and safety management system, that is guided by legislation, codes of practice, and is designed to address operational health and safety risks.

Executive summary

·     Revised risk assessments for SR32 and OR183 remain high and out of appetite, with OR328 assessed as medium.

·     Critical hazards have been identified across Council with many requiring a risk assessment. This would include the review of internal controls and determination of their effectiveness.

·     Progress of key strategic activities aligned to Councils health and safety improvement plan are outlined in this report.

·     Safety events during this reporting period include one lost time injury, two medically treated injuries and zero notifiable events to WorkSafe by Council.

·     There were four serious contractor incidents that required an investigation, with one notifiable event from a Contractor to WorkSafe.

·     The wellbeing working group was established over this reporting period and tasked with the development of a wellbeing strategic action plan. The review of literature has uncovered a range of evidence-based strategies, frameworks, and models that will help inform the development of wellbeing work programmes.

Discussion

Strategic and operational risks

 

Risk no

Risk Issue

Inherent

RA

Revised

RA

Target

RA*

Risk Movement

SR14

Failure to maintain a safe and healthy workplace and safe systems of work (ie we do not proactively navigate H&S threats)

Extreme

High

Medium

Nil

OR183

Failure to manage health, safety, and wellbeing in the workplace

Extreme

High

Medium

Nil

OR328

Failure to comply with the Health and Safety at Work Act 2015 and subsequent regulations.

Extreme

Medium

Low

Nil

 

Critical and emerging risks

While the table below is not an exhaustive list, it provides a starting point for the identification and assessment of critical risks. Further work is required for the identification and assessment of hazards, risks, and internal controls to determine effectiveness, with an update due to ARC in Q3.

 

Table 2. Hazards and critical health & safety risks 

Hazard

Description of hazard

Risk in register (Sycle)

 

Yes/No

Revised risk assessments

Contractors

 

 

 

Napier City Council engage contractors to complete work on our behalf. The Council are required to work in partnership with contractors to ensure duties as PCBUs are met, including conformance with Councils safety management system.

No

N/A

Wellbeing and psychosocial factors

 

 

 

Within workplace settings, there are environmental, relational, and operational hazards that may affect people’s psychological and physical health.

No

N/A

Human behaviour

 

 

There is an increased presence of anti-social and intimidating behaviour from members of public towards Council staff.

 

 

No

N/A

Dangerous work activity

 

Workers, contractors, and volunteers often complete high-risk work activity including the handling of hazardous substances, confined spaces, excavations, lockout / tag out, working from heights, roof access, hazardous waste disposal, excavations, and operating heavy machinery. 

 

No

N/A

Building materials

 

 

Assets may contain hazardous building material including asbestos and silica,

Yes

OR207 - High

Pool facilities and water features.

 

 

Council own and/or operate a range of pool facilities including ocean Spa, Napier Aquatic Centre, Kennedy Park, and several water features.

Yes

OR49 – High

 

OR89 - Medium

 

OR316* – Medium

 

OR325 - Low

 

OR332* - Medium

 

 

 

Strategic progress

The following workstreams will be presented to this Committee and are meant to outline progress in alignment with our Health & Safety improvement plan that represents significant programmes of work due for completion by June 2025. The work programmes are designed to improve our health and safety management system, the management of health and safety risks, an promote a positive health and safety culture.

 

 

 

 

 

1.   1.  

Workstream

Status

Milestones completed

Next milestone

Comment

System improvement

75%

·      Health and Policy

·      ELT Leadership charter

·      Centralisation of H&S data and documentation

·      Upgrade of incident reporting system (MySafety)

Establish performance indicators and annual health and safety targets.

 

Review of H&S roles and responsibilities framework.

Visit to Hamilton City Council planned for end May to discuss performance indicators and targets.

 

Health and safety risk management

20%

·      Nil

Identification and assessment of critical health and safety risks.

Planned visit to Hamilton City Council who have implemented a critical risk framework, with the intention of implementing the framework (or something similar) at NCC.

Leadership and commitment

30%

·      Training and professional development opportunities delivered for directors and managers.

Develop health and safety induction and training programme for managers and team leads to ensure they are equipped to manage health and safety risks.

ELT and selection of tier three managers attended Institute of directors and IMPAC training/.

Health and safety learning and development

50%

·      Review of induction process, material, and scheduling.

Complete training needs assessment for managers and team leaders

Corporate inductions currently delivered face to face, with low attendance.

 

Risk based training is currently delivered using external training and education providers.

Communication

50%

·      Nil

Health and safety communications plan and deliver communication on health and safety matters through existing channels and networks.

 

 

Engagement

50%

·      Review and update health and safety committee terms of reference, and health and safety representative responsibilities, & accountabilities.

 

Establish communication channels for workers to remain engaged and informed for workplace health and safety.

       

 

Audit and assurance

25%

·      Nil

Develop and implement a schedule of health and safety reporting to enable effective monitoring and reviewing of health and safety performance based on strategic objectives and KPIs.

Health and safety team continuing with audit activities focusing on critical risks.

 

Health and safety reporting

Health and safety reporting profiled over this reporting period are summarised below (as of 20/05/2024).

Lag Reporting

Q2 2023

Q2 2024

Incidents 

70

131

Pain + Discomfort 

33

26

Near Miss 

16

39

Lost time injuries

2

1

Lead reporting

Q2 2023

Q2 2024

Safety Observations 

56

121

Meetings 

25

53

Training delivered

124

158

 

 

 

 

Investigations

·   There were zero Council events that required an investigated during this reporting period.

·   There were four contractor events that required an investigation during the reporting period.

 

WorkSafe notifiable events

·   There was one contractor WorkSafe notifiable event during the reporting period.

·   The incident involved a small hydrema dump truck at the Awatoto wastewater treatment plant on 06/05/2024. The worker involved in the incident was subcontracted to the principal contractor using a labour hire firm. The worker was found not to have received appropriate training and was not experienced or qualified to use the machinery. Furthermore, the person involved returned positive drug and alcohol post incident test.

·   The investigation report identifies significant concerns for engaging sub-contractors, including the screening of workers. A contractor evaluation process is currently underway to determine the suitability of the contractor to complete any further work.

 

Workplace wellbeing

The wellbeing working group has been established to develop a wellbeing strategy for Council. Progress of key tasks for the development of the strategy are provided below.

Tasks

Status

Due date

Milestones completed

Next milestone

Comment

Literature review

100%

n/a

Literature review

Completed

Strong evidence for addressing organisational factors with an emphasis on work design.

Current state assessment

100%

n/a

Current state assessment

Completed

NCC lacks a co-ordinated and structured approach to supporting workplace wellbeing.

Initiatives and programmes are reactive and targeted to individuals. This approach is not well supported by the evidence.

Data collection and analysis

10%

10 June, 2024

Nil

Desktop analysis.

Worker engagement

Delays in initiating this work due to dependencies, competing demands and availability of resource.

Future state recommendations including setting objectives, and outcome measures.  

0%

30 June, 2024

Nil

 

Delays in initiating this work due to dependencies and availability of resource.

 

During the quarter we have continued to promote and support the wellbeing of our workers utilising our partnership with Mates4Life, access to EAP, and direction to community and public health resources.

6.3   Significance and Engagement

N/A

6.4   Implications

Financial

N/A

Social & Policy

N/A

Risk

N/A

 

6.5   Attachments

Nil

 


Audit and Risk Committee - 14 June 2024 - Open Agenda                                                                                                     Item 7

7.    Risk Management Report

Type of Report:

Operational

Legal Reference:

N/A

Document ID:

1756767

Reporting Officer/s & Unit:

Dave Jordison, Risk and Assurance Lead

Alister Edie, Business Improvement Manager

 

7.1   Purpose of Report

To update the Committee on risk management workstreams and inform on the status of Council’s strategic and operational risk profile and any emerging risks.

 

 

Officer’s Recommendation

The Audit and Risk Committee:

a.     Receive the report titled “Risk Management Report” dated 16 June 2024.

b.     Approve Councils updated list of strategic risks

c.     Support the draft risk management uplift program

 

 

7.2   Background Summary

        To align with our 3-year plan implementation, ELT met to workshop strategic risks and settled on an updated strategic risk profile in support of Councils strategic objectives. ELT was also supportive of a simplified framework for dashboarding and collectively reviewing strategic risks.

We have drafted an uplift plan to materially improve the management of our risk framework. This plan involves tailored education and improved processes to action risk reviews in a timely manner and enable escalations were required.

Our external partner has completed their review of our risk management framework and risk maturity status. We await this final report and will review recommendations and update our uplift plan as required.

We have implemented a rationalisation where new risks without a completed set up are de-activated. Without the assignment of adequate controls these risks report at their inherent/maximum risk level. We are working on a process to ensure these risks are set up in a timely manner.

Focusing on extreme and high out-of-appetite risks, we are beginning to escalate operational risks where it is concluded that the risk analysis is correct and relevant controls have been identified and their true effectiveness determined. This process demonstrates the required due diligence is being carried out at ELT and Chief Executive levels.

7.3   Issues

N/A

7.4   Significance and Engagement

N/A

7.5   Implications

Financial

N/A

Social & Policy

N/A

Risk

Strategic Risks

ELT has updated Councils strategic risk profile – to align with our updated strategic priorities. ELT reviewed the relevance and ownership of current strategic risks and the inactive risks recommended from the previous PWC strategic risk workshop. Gaps to key risk areas and strategic objectives were also checked with the creation of two new risks, being 1. Security and privacy of data and Information and 2. Council reputation. Some strategic risks were generalised to better cover key uncertainties e.g. People and Capability and Funding and financial management.

Figure 1. Updated Strategic Risk Profile – see detail in attachment.

 

 

We plan to table the updated strategic risk review status at the audit and risk committee meeting. We are working through a simplified process where ELT is surveyed to form a group consensus of the risk status for each strategic risk. This process is still to be determined e.g. regarding links to the current review process in the system.

Operational Risks

Out of Appetite

There are currently 138 Operational risks showing as out of appetite, up from 50 in the previous period. This increase is due to the required risk reviews taking place with a more robust determination of the revised risk levels.

OR 334 serious harm or fatality of staff and/or public from trade waste non-compliance has a revised risk level of extreme so has been escalated through the Director of Infrastructure Services and on to the Chief Executive.

As part of the uplift program, we are determining processes for utilising ELT meetings to improve the regular review of out-of-appetite operational risks as well as strategic risks, where the risk owners sit below ELT level.

Escalations

-     OR 334 serious harm or fatality of staff and/or public from trade waste non-compliance: has a revised risk level of extreme so has been escalated through the Director of Infrastructure Services and on to the Chief Executive.

-     OR207 Failure to comply with Health and Safety at work (Asbestos) Regulations 2016: remains at a revised level of High and is in the process of being escalated through the director Infrastructure Services and on to the Chief Executive.

Improvements

Overdue Operational Risk Reviews have reduced 3% from the previous period. This is a result of risk review work undertaken by risk owners. This is supported by an 8% reduction in overdue control reviews and an 8% reduction in risks containing no controls. Overdue treatment actions have also reduced 3% and is evidence that target dates to address poor performing controls are being improved.

The 50% increase in the revised level of risk is as a result of increased review work resulting in a more accurate picture of the revised level of risk. Improving this measure is a focus of the next phase of the risk uplift programme, with the intention to ensure controls are in place and are as effective as possible, with escalation where required.

 

 

 

 

Risk Management Uplift Program

We have drafted an uplift plan to improve our risk management processes. The completed review of our risk management framework by our audit partner will further inform this plan. The completion dates of workstreams across the program are still to be determined but believe a 15month timeline could be suitable.

We have implemented some rationalisations now to improve the usability of our risk management framework e.g. de-activating new risks that have not been set up completely with controls - as they will automatically report at their inherent/maximum risk as out-of-appetite. We are also only focusing on extreme and high out-of-appetite risks for now.

We are seeking support from this committee of the following draft uplift programme.

Emerging Risks

Nil to Report

7.6   Preferred Option

Receive this risk management report and support the officers’ recommendations.

 

7.7   Attachments

1      NCC Strategic Risk Update June 2024 (Doc Id 1767086)   

 


NCC Strategic Risk Update June 2024 (Doc Id 1767086)

Item 7 - Attachment 1

 

 


Audit and Risk Committee - 14 June 2024 - Open Agenda

Recommendation to Exclude the public

 

That the public be excluded from the following parts of the proceedings of this meeting, namely:

AGENDA ITEMS

1.         Verbal Update Chief Executive

2.         Severence Pay Recommendations Update

 

The general subject of each matter to be considered while the public was excluded, the reasons for passing this resolution in relation to each matter, and the specific grounds under section 48(1) of the Local Government Official Information and Meetings Act 1987 for the passing of this resolution were as follows:

General subject of each matter to be considered.

 

Reason for passing this resolution in relation to each matter.

 

Ground(s) under section 48(1) to the passing of this resolution.

 

1.  Verbal Update Chief Executive

7(2)(h) Enable the local authority to carry out, without prejudice or disadvantage, commercial activities

48(1)(a) That the public conduct of the whole or the relevant part of the proceedings of the meeting would be likely to result in the disclosure of information for which good reason for withholding would exist:
(i) Where the local authority is named or specified in Schedule 1 of this Act, under section 6 or 7  (except 7(2)(f)(i)) of the Local Government Official Information and Meetings Act 1987.

2.  Severence Pay Recommendations Update

7(2)(c)(i) Protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied

48(1)(a) That the public conduct of the whole or the relevant part of the proceedings of the meeting would be likely to result in the disclosure of information for which good reason for withholding would exist:
(i) Where the local authority is named or specified in Schedule 1 of this Act, under section 6 or 7  (except 7(2)(f)(i)) of the Local Government Official Information and Meetings Act 1987.

 

 


Audit and Risk Committee - 14 June 2024 - Open Agenda

 

 

Audit and Risk Committee

Open Minutes

 

Meeting Date:

Thursday 4 April 2024

Time:

9.30am – 12.05pm (Open)

12.07pm to 12.23pm (Public Excluded)

Venue

Breakout Room 2
War Memorial Centre
Marine Parade
Napier

 

Audio-visually recorded for Council website

 

 

Present

Chair:          Bruce Robertson

Members:    Mayor Kirsten Wise, David Pearson, Councillor Sally Crown (Deputy Chair) Councillor Greg Mawson and Councillor Hayley Browne

Ngā Mānukanuka o te Iwi representative - Joe Tareha

In Attendance

Chief Executive (Louise Miller)

Deputy Chief Executive (Jessica Ellerm)

Acting Executive Director Corporate Services (Caroline Thomson)

Acting Chief Financial Officer (Talia Foster)

Internal Audit Lead (Raewyn Fowler)

Health, Safety and Wellbeing Lead (Adam McDonald)

Team Leader Governance (Anna Eady)

Audit New Zealand (Karen Young)

Administration

Governance Advisors (Carolyn Hunt and Jemma McDade)

 

 

 

 

Audit and Risk Committee – Open Minutes

 

 

Table of Contents

Order of Business                                                                                                     Page No.

Karakia. 3

Apologies. 3

Conflicts of interest 3

Public forum.. 3

Announcements by the Mayor 3

Announcements by the Chairperson. 3

Announcements by the management 3

Confirmation of minutes. 3

Agenda Items

1.       Ombudsman Report - Council Meeting and Workshop setting amendments. 4

2.       Health and Safety Report 4

3.       Risk Management Report 5

4.       Sensitive Expenditure - Mayor and Chief Executive. 5

5.       Internal Audit Recommendations Progress Report 6

6.       Policy review process update. 7

7.       External Audit actions status update. 7

8.       Audit Plan for 2023/24 Annual Report 8

9.       Audit New Zealand Management Report 8

Minor matters. 9

Resolution to Exclude the Public. 10

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Order of Business

Karakia

The meeting opened with the Council karakia.

Apologies

Nil

Conflicts of interest

Nil

Public forum

Nil

Announcements by the Chairperson

The Chair advised that today’s Audit and Risk Committee meeting, and future meetings, would be audio-visually recorded and at the conclusion of the meeting uploaded to Council’s website meetings page for the public to view.

Announcements by the management

Nil

Confirmation of minutes

Bruce Robertson / Councillor Crown

That the Minutes of the Audit and Risk Committee meeting held on 13 December 2023 were taken as a true and accurate record of the meeting.

Carried

 

·         Progress of the Asset Management Roadmap and implementation to be reported back at the 14 June 2024 Audit and Risk Committee meeting.

 

 

 

 

 

 

 

Agenda Items

 

1.    Ombudsman Report - Council Meeting and Workshop setting amendments

Type of Report:

Operational

Legal Reference:

Local Government Official Information and Meetings Act 1987

Document ID:

1745863

Reporting Officer/s & Unit:

Anna Eady, Team Leader Governance

 

1.1   Purpose of Report

In October 2023 the Ombudsman released a report “Open for Business”, which followed an investigation into local council meetings and workshops. This report will set out our proposed improvement programme and the Council direction to meet the Ombudsman’s key recommendations.

 

At the meeting

The Team Leader Governance, Ms Eady spoke to the report and highlighted to the Committee whether it considered that Napier City Council (NCC) should have an indemnity and liability Policy in regard to making public recordings of workshops on the NCC website.

In response to questions the following was clarified:

·     The Ombudsman’s request that a plain English explanation in reasonable detail to exclude the public will require some adjustment to Council’s agenda creation system (Infocouncil).  Currently officers can select an Act and reason for exclusion and it is intended that plain English reasons also be included.

·     Officers will need to provide Governance good reason to withhold information and weigh it against public interest.

·     Ombudsman virtual training for staff and elected members will be held on 9 April 2024 which will assist officers and elected members in the understanding of valid reasons for withholding information.

·     A dedicated page on the Council website is to be created that will list the workshops, whether they are public excluded and the reason, or if they are open to the public.

·     Workshop guidelines are currently being drafted to assist Chairs on how to manage workshops and it is anticipated they will be available as soon as possible, with the Ombudsman training supporting this work. Minutes of workshops would be a summary of key points and actions rather than detailed meeting minutes.

·     Audio-visual recordings of workshops would be uploaded to a YouTube channel.

·     Full costs of the activity are hard to predict. John Norris, Engage Video, who livestreams Council/Committee meetings advised that running workshops following meetings did not increase the cost. 

·         The cost for his services would be the same for transcripts as the cost relates to licenses for Teams or Zoom links and microphone set up required to capture conversation.

·         Ideally workshops would be scheduled after Council/Committee meetings to keep costs down.  However, on the days that were not meeting days officers would record through a zoom link, and upload the recording to the workshop page on Council’s website.

·         There are tools already in use to provide a solution around the release of public excluded information, for example through the Action Register reported to Council

·         It was noted that the timetable for implementation had been adopted by Council at its meeting on 14 March 2024.

 

Committee resolution

 

David Pearson / Councillor Browne

The Audit and Risk Committee:

a)    Receive the report titled Ombudsman Report – Council Meeting and Workshop setting amendments.

 

b)    Note officers have undertaken an assessment of Napier City Council’s current practices in relation to the Ombudsman’s Open for Business report and will make improvements to these practices.

 

c)    Note open Audit and Risk Committee meetings will be recorded and published on the Napier City Council website.

Carried

 

 

2.    Health and Safety Report

Type of Report:

Information

Legal Reference:

N/A

Document ID:

1722342

Reporting Officer/s & Unit:

Adam McDonald, Health, Safety and Wellbeing Lead

 

2.1   Purpose of Report

The purpose of this report is to provide the Audit & Risk Committee (ARC) an overview of Health Safety & Wellbeing (HSW) activity, inform on the progress of initiatives underway to improve health, safety, and wellbeing, as well as key performance indicators covering the period December 2023 through to February 2024. The report enables the ARC to provide assurance to Council for the capability and functioning of Council’s health, safety and wellbeing hazard and risk management system and associated programmes.

 

At the meeting

The Health, Safety and Wellbeing Lead, Mr McDonald spoke to the report, providing a brief summary and overview of Health and Safety activity risks, progress of initiatives underway to improve health, safety, and wellbeing, as well as current key performance indicators covering the period December 2023 to February 2024.

In response to questions the following was clarified:

·     The Employee Assistance Programme (EAP)  reports seeing pressures, outside of work impacting on the workplace. Work specific issues were not identified as a reason for staff engaging with the EAP. 

·     Well-being programme developed going forward as the organisation supports staff, no matter the origin of the stress or anxiety, so they can be the best version of themselves at work.

·     Future reporting on EAP will not be through numbers it will be how to effect organisational change and focus more on wellbeing.  Work is being undertaken on what challenges people are facing so programmes can target what is needed to improve their well-being..

·     A Health and Safety Improvement Plan had now been developed and approved by the Executive Leadership Team (ELT). The Health and Safety Team, together with the People and Capability Team, are working on culture change management and promoting the changes.

·         The actions integrated into the Implementation Plan will require a programme to monitor the results.

Committee resolution

 

Mayor Wise / Councillor Crown

The Audit and Risk Committee:

a)   Receive the Health and Safety Report for the period December 2023 to February 2024.

Carried

 

The meeting adjourned for morning tea at 10.33am

and reconvened at 10.50am

 

3.    Risk Management Report

Type of Report:

Operational

Legal Reference:

N/A

Document ID:

1744348

Reporting Officer/s & Unit:

Dave Jordison, Risk and Assurance Lead

Alister Edie, Business Improvement Manager

3.1   Purpose of Report

To update the Committee on current developments and workstreams within the risk management framework and inform on the status of Council’s strategic and operational risk profile and any emerging risks.

 

 

At the meeting

The Business Improvement Manager, Mr Edie spoke to the revised report that was circulated, which included minor updates in the summary section and the inclusion of a table of revised operational risks. Mr Edie provided a brief summary of the current risk management framework, some developments and workstreams underway.

In response to questions the following was clarified:

·     A review of the strategic risks is to be undertaken and will align to the Long Term Plan (LTP). Council’s strategic priorities have been reset by elected members and consultation on the 3 year LTP is underway and to be reported back at the next meeting.

·     Asbestos risk is extreme and does not comply with the Act. An urgent project is underway to address this, and will be completed within two weeks.  The programme needs to be in place to reduce the risk rating.

·     Introduction of a housekeeping programme to regularise and formalise how the organisation is addressing risks and to understand the systems that management are using to monitor risks.

·         A review of the system is currently underway through an internal audit.  It was noted at the meeting that it would be beneficial for the Committee to meet with internal auditors Crowe.

 

Committee resolution

 

David Pearson / Councillor Browne

The Audit and Risk Committee:

a)    Receive the report titled “Risk Management Report” dated 4 April 2024.

Carried

 

 

 

4.    Sensitive Expenditure - Mayor and Chief Executive

Type of Report:

Procedural

Legal Reference:

N/A

Document ID:

1742723

Reporting Officer/s & Unit:

Raewyn Fowler, Internal Audit Lead

Talia Foster, Financial Controller

 

4.1   Purpose of Report

To provide the information required for the Committee to review Sensitive Expenditure of the Mayor and Chief Executive for compliance with Council’s Sensitive Expenditure Policy.

 

 

 

 

At the meeting

The Internal Audit Lead, Ms Fowler took the report as read and confirmed that items identified in the report for this quarter complied with Council’s Sensitive Expenditure Policy.

Committee resolution

 

Councillor Mawson / Joe Tareha

The Audit and Risk Committee:

a)      Receive the 31 December 2023 quarterly report of Sensitive Expenditure for the Mayor and Chief Executive and review for compliance with the Sensitive Expenditure Policy.

Carried

 

 

5.    Internal Audit Recommendations Progress Report

Type of Report:

Information

Legal Reference:

N/A

Document ID:

1742724

Reporting Officer/s & Unit:

Raewyn Fowler, Internal Audit Lead

 

5.1   Purpose of Report

The purpose of this report is to provide the Committee with a summary of the internal audit recommendations progress to date.

 

At the meeting

The Internal Audit Lead, Mrs Fowler spoke to the report which was an update on internal progress, and noted that another internal audit had been undertaken during that period for PAYE and withholding tax which was also included in the report.

The Financial Controller, Ms Foster spoke to the PWC report advising there were issues identified in actioning some items due to lack of resource in payroll, People and Capability and Procurement teams.

In response to questions the following was clarified:

·     In regards to the records management that dates back to 2021, with 13 outstanding recommendations it is understood that once the SharePoint system and learning management system are up and running well these may be ticked off.

·     A conscious pause has been implemented in  the transition to new technology planned for in Council’s digital transformation Strategy. The Digital Strategy priorities have been reviewed and over the next 3-5 years a learning management tool will be implemented first, followed by a Human Resources tool.

·     The outstanding recommendations have been reviewed and slowing implementing the recommendations has a low risk level.

·         When considering the recommendations officers can explore whether they can be addressed through other strategies or if they can be achieved through other control mechanisms. Recommendations made by the Auditor can be challenged and if agreed with, ranked in order of priority .

·         The risk that Council are not complying with PAYE is considered low, however withholding tax is more problematic.  There is not considered to be a financial liability but processes do need to be reviewed.

 

Committee resolution

 

Bruce Robertson / Councillor Crown

The Audit and Risk Committee:

a)   Receive the Internal Audit Recommendations Progress Report dated 4 April 2024.

 

Carried

 

 

6.    Policy review process update

Type of Report:

Operational

Legal Reference:

N/A

Document ID:

1701124

Reporting Officer/s & Unit:

Talia Foster, Financial Controller

Caroline Thomson, Chief Financial Officer

 

6.1   Purpose of Report

To update the committee on the progress made to date with the policy review project.

 

At the meeting

The Financial Controller, Ms Foster spoke to the report which was a result of some recommendations from internal and external auditors and there was some concern from the Committee that some policies were not up-to-date.

In response to questions the following was clarified:

·         Although the majority of policies were out of date, even though recently, the fact that they had not been reviewed did not mean they were no longer relevant.  The process in place currently is that policies are going to the ELT monthly, with 3-5 being addressed at each meeting.

·         It was noted that other policies (Code of Conduct for Employees Policy, Confidentiality Policy, Drug and Alcohol Policy and Workplace Bullying Policy) which were considered high importance or high risk were not included in the upcoming quarter.  The important thing to note is whether they were still adequate even if they were out-of-date.

 

·         The Workplace Bullying Policy was currently under development by the People and Capabilities Team.

·           The policies that are crucial for audit are in People and Capability and Finance. This puts a lot of work on those two teams to get the policies reviewed and completed, which is why they cannot all be finalised within the timeframe.

·           An Acting Chief People Officer has been appointed and Ms Ellerm will work with her to try and progress these policies.

·           For future reporting the policy review dates are to be included for reference.

 

Committee resolution

 

Councillor Mawson / Mayor Wise

The Audit and Risk Committee:

a)    Receive the report titled “Policy Review Process Update” dated 4 April 2024.

Carried

 

Councillor Browne withdrew from the meeting at 11.40am

 

 

7.    External Audit actions status update

Type of Report:

Information

Legal Reference:

N/A

Document ID:

1742734

Reporting Officer/s & Unit:

Talia Foster, Financial Controller

 

7.1   Purpose of Report

The purpose of this paper is to summarise the actions taken by management from recommendations made via our external audit process to provide assurance to the Audit and Risk Committee that these have been addressed.

 

At the meeting

The Financial Controller, Ms Foster spoke to the report on what progress had been made on actions.

In response to questions the following was clarified:

·         Ms Foster confirmed that the $1m figure referred to in the actions to approve operating expenditure in excess of $1m was now out-of-date.  While a process is in place to ensure Council have approved spend over the CE delegation before payments are made, this needs to be put in writing.

It was noted that there were some high leave balances and staff would be encouraged to take leave as a preference or cash it up.

 

Councillor Browne rejoined the meeting at 11.45am

 

 

 

Committee resolution

 

Councillor Crown / David Pearson

The Audit and Risk Committee:

a)      Receive the report titled “External Audit Status Update” dated 4 October 2024.

Carried

 

8.    Audit Plan for 2023/24 Annual Report

Type of Report:

Enter Significance of Report

Legal Reference:

Enter Legal Reference

Document ID:

1742735

Reporting Officer/s & Unit:

Talia Foster, Financial Controller

 

8.1   Purpose of Report

To provide delegation to the Chair to approve the Audit Plan for the 2023/24 Annual Report in consultation with the Chief Executive.

 

At the meeting

The Financial Controller, Ms Foster spoke to the Audit Plan for the upcoming Annual Report for the year end 30 June 2024.  There are auditors on site currently  for an interim audit with nothing unusual or unexpected in the Audit Plan.

The Chair invited auditor Karen Young’s comments. Ms Young confirmed that everyone worked well together last year with really good co-operation and assistance with good headway made in the revaluations.

In response to questions the following was clarified:

·         In regard to the attendance and resolution times, the qualification will remain due to the comparatives, officers are confident that a lot of work has been done in this area but it is still to be verified.

·         Ms Young confirmed that if systems and processes were only put in place midway through the year they would not be cleared.  Processes implemented from 1 July would be clear going forward. Updates undertaken for the IT system were done by 1 July so the system has been in place for a year.  Training took place throughout the year and QA processes have gone back to the beginning of the year.

·         Council’s materiality worked to before draft accounts are provided to audit typically for year end is $5,000-$10,000 for accruals on a transaction level while exercising professional judgement.  Where aware of any errors or adjustments required at that level they will be corrected or advise audit of the issue.  The workload required versus the value add needs to be balanced.

·         Ms Foster confirmed that she was very comfortable that 30 October 2024 was achievable for the Annual Report and did not anticipate any issues.

·         Ms Young advised the reason the audit letter was in draft was in regard to performance measures. Audit have received some guidance around the Drinking Water Performance Measures from the Auditor General’s Office which the Department of Internal Affairs have communicated to them and the letter will be able to finalised in the very near future.

Committee resolution

 

Bruce Robertson / David Pearson

The Audit and Risk Committee:

a)    Receive the report titled “Audit Plan for 2023/24 Annual Report” dated 4 April 2024.

b)    Delegate authority to the Chair and the Chief Executive to approve the Audit Plan for the 2023/24 Annual Report on behalf of the Audit and Risk Committee (Doc Id 1746445).

Carried

 

9.    Audit New Zealand Management Report

Type of Report:

Information

Legal Reference:

Local Government Act 2002

Document ID:

1742736

Reporting Officer/s & Unit:

Talia Foster, Financial Controller

9.1   Purpose of Report

To consider the Audit NZ management report to the Council on the audit of Napier City Council for the year ended 30 June 2023.

 

At the meeting

The Financial Controller, Ms Foster spoke to the Audit New Zealand Management report for the year ended 30 June 2023 that was adopted at the end of last year.  Council received a Qualified Opinion and the report provides some further recommendations and actions that will be reported back to the Committee in the future.

Ms Young commented that it was a very busy and challenging year for the Council and there was only one new recommendation to ensure the good condition of above ground water assets , and that the register is complete and has integrity.  Otherwise it was a very good result and Council management and staff should be very proud of what they achieved last year.

The Committee confirmed that they were comfortable with the recommendations, management responses and timelines for completion.

Committee resolution

 

Bruce Robertson / Councillor Crown

The Audit and Risk Committee:

a)    Receive the Audit NZ management report to the Council on the audit of Napier City Council for the year ended 30 June 2023 (Doc Id 1745793).

Carried

Minor matters

There were no minor matters to discuss.

 

Resolution to EXCLUDE the Public

Councillors Mawson / Crown

That the public be excluded from the following parts of the proceedings of this meeting, namely:

1.       Verbal Update Chief Executive

Carried

The general subject of each matter to be considered while the public was excluded, the reasons for passing this resolution in relation to each matter, and the specific grounds under section 48(1) of the Local Government Official Information and Meetings Act 1987 for the passing of this resolution were as follows:

General subject of each matter to be considered.

Reason for passing this resolution in relation to each matter.

Ground(s) under section 48(1) to the passing of this resolution.

1.  Verbal Update Chief Executive

7(2)(h) Enable the local authority to carry out, without prejudice or disadvantage, commercial activities

48(1)(a) That the public conduct of the whole or the relevant part of the proceedings of the meeting would be likely to result in the disclosure of information for which good reason for withholding would exist:
(i) Where the local authority is named or specified in Schedule 1 of this Act, under section 6 or 7  (except 7(2)(f)(i)) of the Local Government Official Information and Meetings Act 1987.

 

The meeting adjourned at 12.05pm and reconvened

in Public Excluded at 12.07pm

 

 The meeting closed with a karakia at 12.23pm

 

Approved and adopted as a true and accurate record of the meeting.

 

 

Chairperson .............................................................................................................................

 

 

Date of approval ......................................................................................................................