Agenda and minutes

Apologies were received from Cllr S Penfold.

None.

To receive public questions, if any.

None received.

Members are asked at this stage to declare any interests that they may have in any of the following items on the agenda. The code of conduct for Members requires that declarations include the nature of the interest and whether it is a disclosable pecuniary interest.

None

To determine any items of business which the Chairman decides should be considered as a matter of urgency pursuant to section 100B(4)(b) of the Local Government Act 1972.

One item of urgent business was raised by the Chair, but this was to be heard at the end of the meeting as item 14a.

To approve as a correct record, the minutes of the meeting of the Governance, Risk & Audit Committee held on 3^rd June 2025

The Chair asked for an update on the car park charges. The ADFA confirmed that the Council had received the draft copy of the Service Level Agreement (SLA) and this was currently being reviewed.

Cllr Boyle proposed, and Cllr Fletcher seconded the approval of the minutes of the meeting of 3^rd June 2025 which was RESOLVED unanimously.

To monitor progress on items requiring action from the previous meeting, including progress on implementation of audit recommendations.

The Chair asked for an update on the monthly progress reports. The HIA confirmed these were being sent so the Chair asked the DSGO to investigate.

Following a query by Cllr Holliday the CE confirmed the Council had been served notice for the formal transfer of Land Charges to the Land Registry, and the transfer would be completed in October 2025.

The DSD updated the Committee as to the Licensing income and reconciliation on the account. This was being done manually as the system was in development. It was being monitored and due to be signed off for internal audit.

The Chair proposed that the Internal Audit update was considered after agenda item 8 as this was otherwise not on the agenda

The HIA said there was nothing of any major concern to report. The Chair asked if the Committee could expect to receive an External Audit by later in the year. The ADFA confirmed the field work was expected beginning of November and everything on track to deliver on schedule. The HIA said they were happy that all Internal Audit information was also on track to be supplied to the External Auditor (EA) in good time

To receive an update on progress with reducing the number of outstanding audit recommendations

The Chair welcomed the reduction to 29 recommendations and thanked everyone for their efforts in reducing the number. The DSD added that one of the Corporate Executive Assistants had taken over responsibility for monitoring those recommendations and as new ones came in they would ensure they were completed as soon as possible. A number of those 29 were nearing completion.

The Independent Person (IP), Mr V Platten, made an observation on how these recommendations are prioritised. So, if the consequence of not taking various actions was to impact on risk mitigation action, he felt some dovetailing was required at this stage. The DSD confirmed that when an audit took place, the HIA would assess potential risks associated with the issue and this led to the recommendation which then informed the priority of that recommendation. Those with a greater risk were being assessed and moved forward as a priority. The Chair thanked the HIA.

The Committee noted the Report.

To consider the Council’s Annual Governance Statement for 2024/25 and Local Code of Corporate Governance

The CE responded to Cllr Fletcher’s concern that the Whistle-blowing Policy appeared not to have been updated for some time. The Authority did receive a report from the Ombudsman that we should have a dedicated complaints officer which represented a challenge for an organisation the size of NNDC. Customer Services had been restructured to look at how stage 1 and stage 2 complaints came into the Authority and with support from the Executive Assistants those complaints were managed and closed within the timeframes that were published.

The annual letter from the Local Government Ombudsman and Social Care Ombudsman confirmed that the number of complaints that progressed to their referral stage last year was 12 with just one finding against that resulted in the Authority in having to make a small compensatory payment.

Cllr Holliday asked whether the spread of Audit Opinions was better or worse than the previous year. The CE said the number of Limited Assurance Audits rose to 5 from 3 the previous year and demonstrated the importance of Audit. The CE was not unduly concerned that the number of limited assurances had increased as this reflected an organisation that wanted to improve. The CE did not want that position to deteriorate beyond the 5.

The Monitoring Officer (MO) responded to a query from Cllr Fletcher regarding the constitution review. The MO explained that initially significant changes had been planned but then Local Government Reorganisation (LGR) impacted this, and those changes had become less. That said, , changes were still needed, as the constitution had not been reviewed for approximately 10 years. The proposed changes were due to go to Full Council in September, following review by the Constitution Working Party.

The CE, in response to a question from the Chair, outlined the Terms of Project Management, monitoring performance and improving monitoring audit. Recommendations had been put in place which resulted in the establishment of  3 boards; a Performance and Productivity Board, a Major Projects Board and a Net Zero and Decarbonisation Board. A new Project Manager had been appointed who would support the roll out of the food waste programme. The three Officers who made up the Project Management Team had reviewed their systems and processes and were submitting a revised framework to Corporate Leadership Team (CLT) shortly, with the intention that this would be rolled out very soon across the Council He added that the Council had a dedicated project board for larger risk led by the DSD. The new DRC and Project Management Framework Provision would have oversight of smaller scale projects where there were less rigid project management in place. The CE concluded by saying that he would like to see improved reporting of these via the Project Management Framework. The Chair agreed that part of the challenge was to keep the public informed of the problems the Council faced so they fully understood the issue.

The IP asked if it were possible to share that framework with the Committee given the links  ...  view the full minutes text for item 25.

To consider the draft Financial Statements for 2024/2025.

The ADFA explained these were the Draft Financial statements for year ending 31^st March 2025 so had not yet been audited. They had been shared with External Audit (EA) and one change to note for accounting policies which the Council was required to do, was the introduction of IFRS 16. Throughout the document there were comments that referred to re-statement of figures. This was not required by Audit but had been done to make the financial statements more accurate. As this would be the first set of accounts for a few years to be audited it was seen as a good time to go back and correct those. The Chair agreed that it was very prudent to make those minor changes and for the document to be as accurate as possible.

Cllr Cushing raised a concern about the large variance in the figures, particularly of employee costs, and asked what level of confidence the Committee could have when such a large variance, of 22%, on a relatively small budget was now presented compared to the Budget that was agreed at Full Council in Feb 2025. Cllr Cushing believed this should be monitored going forward. ADFA explained these were included in the financial statements as a statement of fact, reflecting the results of the year. Cllr Cushing wished to reiterate that the Councillors were required to make decisions based on the figures presented to them and if, in reality there was additional money available then, it was possible they may have taken a different decision The IP also agreed the high variance was a concern and felt the Council should be looking at its forecasting methods. The CE recognised that the 22% variance was something the Council needed to understand but he would have been more worried if it were a negative balance. As 40% of that variance related to income that was a positive position to be in but he accepted that there was a need to better understand the variance in staffing figures and that was an issue that he would ask the DRC and ADFA to investigate further.

The DRC said in relation to the variance of £1.6m in employee costs, that was made up of vacant posts and changing of funding in the Local Government Pension Scheme (LGPS), the latter being influenced by factors outside of the Council’s control. The DRC also confirmed he was looking, in fine detail, at the vacant posts and where those posts would no longer exist, and be deleted, how they could redirect those funds to other council activities. 

The CE answered a second query from the IP around temporary accommodation costs. The CE confirmed that over the last 3 years, the costs of TA was the largest cost pressure the Council faced after significant rises in Section 21 eviction notices. The costs of being a landlord had impacted the rental market so the stock of private rental units in the area had decreased. The Council had a statutory duty to  ...  view the full minutes text for item 26.

To review and note the Monitoring Officer’s Report.

Cllr Cushing thanked the Monitoring Officer (MO) for their report and had a query on Freedom of Information Requests (FOI). The MO explained that the Council did have a statutory duty to respond to FOI requests and they often fluctuated around the same subject matter depending on what was in the news. Very often persistent complainers would use the FOI act process as a way of asking further questions.

The IP wondered if it were possible to head off some of those FOI requests. The MO said the Council had a good record of responding to FOI requests within the timeframes the Information Commissioner required, and the number of appeals finding against the Council was very low.

In response to a question from Cllr Boyle on how those FOI requests compared year on year, the MO explained they could fluctuate but generally they did increase year on year. The Chair noted that there was also the Subject Access Requests which could also take considerable time. The Chair then asked how the 3 complaints upheld by the Ombudsman this year compared with previous years. The MO said they were roughly the same from previous year. The DSD believed it was 2 cases from the previous year and said the Council was a lot more robust with its complaint handling process and regularly monitored those. The Chair agreed that the way the Council dealt with complaints now was a huge improvement compared with previous years.

The Committee reviewed and noted the Report.

The Cyber Risk Management Policy was drafted following an audit recommendation.

The Committee is asked to review and approve the policy.

Cllr Holliday commented that the policy was quite slender. She also noted that there was no backfilling of the IT Infrastructure Manger role. The DSD said the policy was deliberately that way to protect the Authority against cyber-attacks as too much information on the Council’s defence protocols could give those cyber-attackers insight of getting around Council systems, so the policy was purely a statement of how those cyber risks were managed, adding that. there were other internal documents that set processes and policies. This approach had been tested by an independent Government tool to ensure the Council was dealing with cyber risk in an appropriate manner. The authority was compliant with the Public Services Network Code.

CE explained that a consultant from the East of England Local Government Association (EELGA) looked at IT staffing arrangements last year, which was reported to Full Council. It was noted that NNDC had a very strong ICT team in place but there was no single IT manager. The Council restructured the team with an internal appointment of a Strategic IT Manager being made. The Strategic IT Manager was asked to restructure the teams from 3 into 2 and that process was ongoing.

The IP asked if a cyber-attack was to occur, would the Council consider running scenarios and practical exercises to see how the Council would act in practice. The DSD confirmed that the Council carried out a lot of business continuity planning for all service areas, ICT was no exception, with system back-up, disaster recovery exercises etc, so regular testing already took place into the Council’s ability to respond to a disruptive event around ICT.

DSD responded to Cllr’s Cushing’s question on password security. Passwords only made up part of a number of authentication processes the Council enforced. The Council’s IT team checked if passwords were of suitable strength and systems regularly encouraged users to update passwords. There were also added layers of security for accessing the Council’s network beyond passwords when working offsite.

The Committee reviewed and noted the Report.

To receive and comment on the Corporate Risk Register. The registers for May and August 2025 are attached.

Cllr Fletcher queried the increase to cyber risk as the postholder who was overseeing cyber security has been promoted and the post not back-filled. The CE reiterated that the EELGA had suggested making a more senior position within the team and then look for restructuring and redeployment to strengthen the team’s performance moving forward. A high percentage of staff completed the existing courses around cyber awareness but if there was a perceived gap in terms of the Council’s capacity to have a dedicated post rather than specifying that responsibility within an existing post that was something the Council might need to consider further.

Cllr Holliday noted that one risk had gone up in May, not achieving the Net Zero target, and as the Committee did not have a chance to review the register in May could this have been a different outcome should Audit have been allowed the opportunity to comment at that time. CE said this was a good example of the issues with the Council’s Risk Register. The Council did ask the HIA to reflect on the score in terms of urgency as there were 2 urgent recommendations and CLT questioned what that urgency was, given it was involving a risk not involving life and limb, or of the Council entering into a major contract or involving the Council recovering monies that were owed to the authority. HIA said this was around a corporate policy of the Council that had not been updated for some time so Audit was right to highlight this as the Council had deviated from its position. The CE confirmed the Council had not abandoned its Net Zero objectives but as their asset base had increased their journey had somewhat stalled or been compromised. The CE believed the position in August better reflected where the Corporate Leadership Team felt the Council existed in context of what was a Corporate Risk but he appreciated that some of these things were subjective. CE accepted Cllr Holliday’s point that Members did not have a chance to debate the changes within the policy, but the team had re-drafted the Environmental Policy, and it was coming back to Members before Christmas.

The Chair asked that when something changed and went into a ‘red zone’ during the period between Committee meetings, if this could be highlighted within the report.

The Chair commented that it might be helpful if the IT team made it clear to staff and Members, that when cyber risk awareness courses were emailed that it was genuine and not a scam as this may increase compliance. The DSD was happy to take this point onboard and feed it through before future course roll out.

Chair agreed with Cllr Holliday, that there was currently no corporate risk listed for homelessness and it would be a good idea if the Council had one. DSD said they would give consideration as to how that would look, as some of those risks were identified and managed on a service level.  ...  view the full minutes text for item 29.

To receive the Procurement Exemptions Register for the period 21 May to 26 August 2025.

The Committee noted that there were no procurement exemptions to report.

Chair had added this item to the agenda. She explained that she had drafted for the attention of National Audit Office (NAO) as the body responsible for looking at best value and ensuring that the appropriate processes had been followed, in respect of costs and protecting the use of public money. The Chair did not believe this had been done when looking at LGR members to support the sending of a letter on behalf of the Committee or alternatively, the Chair could send it the Chair of the Audit Committee. The Chair read the out the draft letter asking the NAO to urgently assess and review the Governments decision.

The Chair did note that there was a debate on whether there was a motion going to Full Council to ask if other Norfolk Councils would follow suit and in response to Cllr Holliday’s query if this was a national push asking for the NAO to re-assess the Chair confirmed she believed it was.

IP agreed and said it was a well-worded letter, and he was very surprised no business case or impact assessment had been undertaken by Government. IP wondered if figures specific for Norfolk could be added, if available, to the letter, adding that if it could be sent jointly with other councils this would potentially strengthen the case. The Chair replied that they would write to leaders of those other Norfolk Council’s, if Committee in agreement, as a matter of urgency. Chair also attending East of England Audit Committee Chair meeting and would discuss if this could be taken forward.

Cllr Cushing said that he would support the letter as LGR was the most momentous point for Local Government. Cllr Cushing said that he believed LGR would not save money and that the councils affected would end up in a position which would cost the taxpayers far more and be far less democratic. Cllr Holiday wondered if there was a ‘no quality of delivery’ argument to be set out alongside the cost element. Chair felt at this stage it was about justifying the costs involved and that was the best way to fight against it at this point.

Cllr Butikofer agreed to circulate a copy of the letter electronically to Committee Members as soon as possible.

Cllr Butikofer proposed, and Cllr Holliday seconded as the Committee agreed to send the letter on behalf of the Governance, Risk & Audit Committee and to write to the Audit Committees and Leaders of the other Councils within Norfolk, asking if they would like to support NNDC in this. This was RESOLVED unanimously.

To review the Governance, Risk & Audit Committee Work Programme.

The Chair would meet the Committee’s new clerk to discuss any work items that needed to be brought before the Committee in the coming months and this would be shared with members at the next meeting

To pass the following resolution, if necessary:

“That under Section 100A(4) of the Local Government Act 1972 the press and public be excluded from the meeting for the following items of business on the grounds that they involve the likely disclosure of exempt information as defined in paragraph _ of Part I of Schedule 12A (as amended) to the Act.”