Agenda and minutes

None received.

None.

To receive public questions, if any.

None received.

To determine any items of business which the Chairman decides should be considered as a matter of urgency pursuant to section 100B(4)(b) of the Local Government Act 1972.

None.

Members are asked at this stage to declare any interests that they may have in any of the following items on the agenda. The code of conduct for Members requires that declarations include the nature of the interest and whether it is a disclosable pecuniary interest.

None.

To approve as a correct record, the minutes of the meeting of the Governance, Risk & Audit Committee held on 9^th September 2025.

The Chair asked for a title to be added to the item under Urgent Business to briefly explain its content.

Cllr Boyle proposed, and Cllr Fletcher seconded to approve the minutes which was ACCEPETED unanimously.

To monitor progress on items requiring action from the previous meeting, including progress on implementation of audit recommendations.

Chair asked if the action under Minute No.7, in respect of property assessments, be chased and allocated correctly to the appropriate Officer. The DRC said the Assistant Director for Finance and Assets (ADFA) would report back within a month.

The DRC asked the HIA to clarify if there was going to be an internal audit work plan for scheduled maintenance and whether that would have an impact on the date of that report. The HIA confirmed there was, so the DRC advised they would keep the Committee updated if that internal audit was going to mean a delay in providing a full written update, to Minute No.7, within the agreed time.

The IP believed it would be helpful to add a column onto the list highlighting when the action was initiated, to give some context on how urgent any update needed to be provided within, as well as a column noting when the action was completed.

The HIA suggested the Committee should consider training on the Global Internal Audit Standard in the UK Public Sector which would include the second part of the Chartered Institute of Public Finance and Accountancy (CIPFA) self-assessment.

The Committee unanimously agreed to an audit training day on March the 24^th 2026.

ACTION: The Committee agreed

• That the ADFA would provide a full answer to the outstanding action on property assessments within a month of the meeting.

• The DSGO to add columns to the list for date action opened and closed

• Training would be organised for March 24^th, 2026, to better understand the Global Internal Audit Standard in the UK Public Sector.

To receive a verbal update from the Council’s External Auditor

The EA gave a verbal update. He reminded the Committee that the report in June had raised 6 risks on the financial statements and one risk on the Value for Money conclusion (VFM). The EA explained that they had been working with the finance team to ensure they maximised the completion of planned procedures. The last time the Council received a full audit was for year 2021 due to delays in publishing accounts and new legislation that had been put in place. The final element of the audit for the 24/25 accounts had begun with a backstop date of the end of February 2026.

The Chair then invited questions from the Committee.

In response to a query from Cllr Penfold regarding what had happened to the Council’s accounts between 2021 and 2024, the EA explained there was a backlog across the whole sector, not just in North Norfolk. The 2021 accounts were signed off in 2023. Last year was the first year EA could fully update before the first backstop. Accounts between 2021 and 2024, hit the first backstop before they had time to complete an audit and went straight to disclaim as they could not form an opinion on them. The year 2024/25 was the first year they were trying to build assurance on. In 2025/26 they would carry out a risk assessment to see where the gaps were.  

The Chair was concerned how long disclaimed reports might go on before the Council could be in acceptable place for a full audit and asked for an assurance from the EA and the DRC that everything was being done to ensure the Council would be in that place as soon as possible. The DRC reiterated that the finance team and audit team were working closely to seek clarification as to when they needed to provide suitable evidence to be able to close an item off, they were doing so in sufficient time with all the correct information required. It that wasn’t provided then auditors would move on to another section due to the small window they had to complete the audit. The DRC said the finance team was quite new with many officers never having been audited before, but they were doing as much as they could to support those officers through that process.

The DRC explained that the opening balances from April 2024 were not certain as they had not done all the required tests to verify them due to not completing an audit for the previous three years.

The EA agreed and said the optimum time for returning to a clean opinion was three years but would depend on how successful they were in completing the planned procedures they were currently working through. The EA was comfortable that they had the capacity and resources to get through that work. It was in the EA’s opinion that a step forward would be to see a significant portion of the assurances, on the balance sheet significant accounts, turning green, as  ...  view the full minutes text for item 41.

To review progress on internal audit recommendations

Recommendation: That the Committee is requested to:

• Receive and note progress with the 2025/26 Internal Audit Plan and outstanding recommendations.

• Approve the change to the Internal Audit Plan

The HOIA introduced the report and explained there were 11 audits to complete, 3 of which had been finalised. She highlighted that there were 34 outstanding recommendations with 1 limited report in reference to licensing that had an urgent recommendation.

Cllr Fletcher asked about the urgent recommendation that was highlighted by the HOIA in reference to renewal of premises licenses and the large amount of money that hadn’t been recouped. He was alarmed by the grace period allowed to businesses to settle the outstanding fees and the fact it appeared not to be tightly observed.

The DSD was aware that the Environmental Health (EH) team were working on those licenses and fees but did not have an up-to-date position at that time so offered to report back after the meeting. He explained EH now had a business manager in post looking at the processes to ensure not only the correct fees were charged for all licenses but that they were collected in a timely fashion.

It was felt by the Chair, that the guidance clearly stipulated that the Authority must suspend a license when it was not renewed on time and that the Council must enforce this on each occasion, when necessary, to be consistent. The MO clarified there was a system of debt recovery which would allow any outstanding fees to be chased that way. The MO also said that a period of grace to settle the outstanding fee, rather than immediately suspending the license was a pragmatic way of managing the situation but agreed that getting correspondence to those businesses impacted, outlining the consequences of non-payment of the fee, which could result in a potential suspension of the license, was important to do in good time.

The Chair said any grace period was open to misinterpretation and that the public may perceive that some businesses were given longer to renew before being suspended when others were suspended immediately. The Chair added it was important that businesses knew where they stood and that the Council did not leave itself open to criticism for being perceived to show any bias.

Cllr Cushing asked why a manual system had not been put in place to avoid the number of outstanding fees being owed when the Council knew the automated service was going to be switched off. The DSD said the old automated system closing was not the choice of NNDC and although it could make representations to the software companies that ran them to add certain features, unless EH were to pay, at significant cost, to include them they could not dictate to that company what functionalities their software would be able to provide. The DSD assured Cllr Penfold, who believed that the procedures needed to be tightened to reflect what EH expectations were, i.e. when the fee was due and the consequences of not paying, that those procedures were now being put in place as part of the new EH Business Manager’s focus before communicating that to businesses in good  ...  view the full minutes text for item 42.

To report to the Committee on the work that is being done to build project management knowledge and resilience within the council.

The Corporate Programme and Project Managers gave a short introduction to the Framework and said they believed that project governance was a key part to managing organisational risk. They explained that it was not a new framework but an existing one that had been refreshed and that their role was to ensure that projects across the organisation were delivered to the highest possible standard, consistently, with clear oversight and accountability. They still reported to CLT for final sign-off.

Cllr Cushing asked if the framework was based on Prince 2 principles. The CPPM said it was a hybrid as some service areas did things more agilely, but they did use some of those principles associated with Prince 2 without being too heavy handed as it was important they had consistency in governance. The CPPM said, in response to a query from Cllr Cushing, the number of projects they had in progress was around 14 with a further 81 that had been proposed but not started.

The DRC explained that the Major Project Oversight Board, was not a delivery board, their role was to ensure that the governance process was working and to highlight any significant risks that weren’t being mitigated or controlled and then escalated appropriately. They did not release finds of any kind that was the responsibility of Full Council.

The CPPM responded to a query from Cllr Penfold regarding how they evaluated a project, such as the North Walsham Heritage Action Zone, when working with partnering organisations who had different strategic objectives to the Council, saying they also had an external board where objectives would all be set out, and agreed, before the project was initiated.

In follow-up to observations made by the IP, the CPPM said they were already having regular meetings with those key departments that were likely to crossover into a project and as part of the proposal document they were pushing to have sign off from all the managers of the teams who would most likely be involved in an effort to raise awareness of the resource required and at what stage they were needed. They had implemented a log to capture what was done well and what they needed to improve upon throughout the course of a project that could then be fed into future ones. In light of LGR, they were developing an internal project management working group which they were looking to expand across other local authorities to discover any best working practices that could be shared.

The CPPM agreed with the Chair that it was important to review a project 12 months after completion to evaluate did it deliver and if not, why not, and this was already part of the existing framework but again they were working with teams to identify what benefits they were looking to see from that project down the line.

It was asked by the Chair at what point, if any, did the Project Management Team engage with Members. The CPPM felt that portfolio holders for  ...  view the full minutes text for item 43.

The DSD summarised what the PPOB did and explained that it focused on improving work around many areas to ensure the Council was moving in the right direction. A lot of recommendations did come in at the end of November so there had been a slight rise in the most recent report for that reason. The DSD highlighted the positive change around the complaint’s procedure, particularly from the local government ombudsman, as they had previously found against the Council on a couple of occasions. The Council had now made changes to the complaints process and policy which meant that stage 1 and stage 2 complaints were more in line with Local Government and Social Care Ombudsman guidance (LGSCO). In the previous year, November 2024 – November 2025 the Ombudsman had a similar number of complaints referred to them, but they had decided not to investigate any of them which he believed was a significant compliment for the Council complaints process.

It was noted by the Chair that the Council was part of a trial to which the DSD expanded on stating that the LGSCO do engage with several authorities to consider how they were going to update their code of practice on complaint handling. The Council had very positively engaged on the last couple of occasions that policy had been updated. As such, the timeline with which officers must respond to complaints had changed in line with the code which will be trialled up until April 1st, 2026, when the code would officially be adopted.

Cllr Holliday asked about the Corporate Plan and Action Plan and how the RAG (Red Amber Green) rating was determined as 80% were green. The DSD explained that it was not the job of the oversight board to grade but what they looked at was whether the report had been done and was the narrative relevant to the piece of work. The rating was for the responsible officers to establish.

It was pointed out by Cllr Boyle that in July 2024 there were 127 policies outstanding and now in November 2025 it had been reduced to 40 which was a massive amount of work to get through and should be applauded, to which the Chair agreed. The DSD said that figure would go up again as policies were constantly being reviewed but many were just in need of being refreshed, or updated, rather than completely rewritten to see if they were still relevant so did not take a lot of work.

The DSD paid special thanks to his Executive Assistant (EA), for the time and effort she put in to simplify a complicated system and did a lot of that work in chasing and updating and he was very grateful for her determination and commitment.

The Chair and Committee wished to pass on their thanks to the DSD’s EA.

The Committee noted the work that the PPOB has undertaken over the last 12 months and the progress that had been made on various issues.

To receive the Civil Contingencies Update

The RM introduced the update and reported it was a record year for number of events coming through Safety the Advisory Group and that caused some concern for the RM as they knew they were likely to see more coming in when the Terrorism Protection of Premises Act 2025, known as Martyn’s Law, came into effect against a backdrop of LGR and constrained budgets and there was no additional funding available from the regulator for safety advisory groups despite the associated additional administration costs.

Cllr Holliday had a concern about field fires and fire risk as she had spoken to the local fire prevention officer and discovered what they were doing in Dorset but there was not any support in Norfolk on fire prevention or readiness. The RM responded to a further query from Cllr Holliday on whether the communication breakdown risk should be raised as there had been a recent incident where an internet cable was cut by mistake cutting off commercial business for 3 weeks. The RM explained that the Norfolk Resilience Forum routinely went through all the risks that they separate from the Central Government ones but could not recall seeing one specifically around Communications but offered to report back on when that was due to be renewed and if it isn’t on the list, they could consider adding it. The RM said she would also go back to her contact with regards the field fire risk as, due to climate change, it was sadly more likely to happen again. Also, still classed by the Environment Agency as being in a dry spell, one down from drought, so another hot summer next year and that would increase the risk further still.

The DSD explained that he was the chair of the Norfolk Resilience Forum (NRF) and they did consider communication risks, and multiple others, such as widespread outages through the telephone system and the RM would be interested to hear of the businesses that were affected as part of Business Continuity. The DSD did also say that the NRF encouraged businesses to take that responsibility for themselves, as many didn’t use the normal wired IT systems and used satellite related internet so did have options open to them to protect from outages or have alternate provision.

Chair was very grateful for the updates provided by the Civil Contingencies team keeping Members well informed when incidents did occur. The Chair was also very sad to hear that the flood wardens in Wells-Next-The-Sea were stepping down and paid tribute to all their hard work over many years.

The Committee noted the report and the council’s contributions to the Norfolk Resilience Forum and the response to incidents.

Cllr Penfold left the meeting.

To review and note the corporate risk register and consider any necessary recommendations.

The IP offered to write in with suggestions that he had observed if that was helpful to the Committee. The Chair agreed and the DSD was grateful for any assistance in improving what they were doing.

Cllr Holliday asked about capacity around the IT Manager and if the Council was paying sufficient attention to that. The DRC agreed that it was a valid concern as IT systems integration would be one of the biggest challenges of LGR putting even more pressure on the IT team. As officers were nominated to liaise with partners on the LGR processes, CLT was liaising with those teams in offering assistance to backfill those posts of those nominated as they were very concerned about officer resilience and were supporting them due to fear of burnout in the lead up to vesting day and that was something worth considering as part of the risk register.

The DSD said he would be happy to ask the lead officer to revisit the risk of housing delivery targets after a concern was raised by Cllr Cushing in relation to the sign off of the local plan with the risk of the government imposing their target of 932 new homes a year but the DSD did explain that the risk was not a subjective assessment but based on a calculation within the system and that risk may change over time but would not want to change the rating based on something that might happen.

The Committee discussed the risks that were being proposed to be removed from the register. The DSD agreed with Cllr Holliday that, in reference to risk CR029, it should reflect the corporate risk associated with specific activity and should be identified where appropriate. The DSD also reassured Cllr Cushing on risk CR038 stating that there was a separate risk register for that project and that remains in place.

It was felt by the IP that a solution could be to provide a clearer explanation as to the reasons why the risks were being requested to be removed as part of the report. The DSD was happy to take this point onboard.

The Committee Agreed for the IP to write in with suggestions. This will be shared with the Committee and the CLT upon receipt by the DSGO.

The Committee noted the report and agreed to remove specific risks from the register:

•           CR 009 – Poor Procurement

•           CR 029 – Poor Reputation of the Council in the Community

•           CR 038 - Fakenham Leisure and Sports Hub (FLASH) – threat to building within funding window

•           CR 040 - Management Information System – failure to complete development and maintain when in use

The HOIA left the meeting.

To review the Risk Management Policy and Framework.

The DRC explained that this item was on the agenda for reference as it was the Policy that was adopted 12 months ago and there were no proposed changes.

Action: It was suggested by Cllr Holliday that the Risk Register is placed earlier on the agenda to allow for sufficient time and questions to be made. The Committee agreed and the Chair felt after the External and Internal audits would be more appropriate. The DSGO will action this suggestion beginning at the next meeting.

The Committee reviewed and noted the Risk Management Policy and Framework.

To consider the Procurement Exemptions register.

The Committee noted that there were two procurement exemptions to report but there were no questions.

To review the Governance, Risk & Audit Committee Work Programme.

The Committee agreed that there were sufficient items on the work programme going forward and that would be added to in time.

The Chair to update the Committee on the NAO reply to the Audit Committee’s letter and discuss any potential response.

The Chair introduced this item regarding the cost of delivering LGR and if that was a good use of public money. The Chair felt that perhaps the NAO should be pro-actively seeking to investigate rather than be reactively looking back after the process had been completed. The Chair proposed drafting a new letter that would be sent to the Committee before being sent to the NAO.

It was suggested by the IP that any final letter the Committee agreed upon may also have some other target audiences, with which the Chair was open to should the IP feed those suggestions back.

The Committee agreed for the Chair to write a response to the NAO letter, from the Committee, and this would be shared, and agreed upon, accordingly before being sent.

To pass the following resolution, if necessary:

“That under Section 100A(4) of the Local Government Act 1972 the press and public be excluded from the meeting for the following items of business on the grounds that they involve the likely disclosure of exempt information as defined in paragraph _ of Part I of Schedule 12A (as amended) to the Act.”