Agenda and minutes

To receive any apologies for absence.

Apologies for absence were received from Cllrs Suttle and Kippax.

To confirm the minutes of the meeting held on 24^th November 2025.

The minutes of the meeting held on 24^th November 2025 were confirmed and signed.

Audit and Governance Action Tracker to follow.

The Corporate Director Finance and Commercial, Sean Cremer highlighted his actions on the Action Tracker. The first action was around updating systems, in response to the SWAP paper in identifying weaknesses and controls. There had been a range of activity including updating SAP which was the main financial ledger system for the approval route which took effect just before Christmas. Orders had been rerouted according to a different scheme of delegation and additional spend controls had been introduced around in year approvals. Some of the approval ratings had been lowered to require director sign off. Which was due to the SWAP process and managing the financial position. More would be discussed when the Q3 report was brought forward. 

In response, it was requested for the written response sent by Sean Cremer for action 6 in the Action tracker to be circulated to the rest of the Members of the Audit and Governance Committee. Along with the additional answer given during the Committee regarding the £28 million social care debt but only £17 million collectable, and if this would be collectable eventually and what percentage of the debt would never be collected and written off?

Co-opted Member, Mr Roach asked for an action to be added to the list from the October 13th meeting regarding children in care with reference to the competition of markets authority report in 2022. In that report there was a series of suggestions on what local authorities could do to increase their purchasing power for example, collaborating across authorities. He asked what conclusion was drawn from that and for it to be added as an action that could be completed as a written response.

To disclose any pecuniary, other registrable or non-registrable interest as set out in the adopted Code of Conduct.  In making their decision councillors are asked to state the agenda item, the nature of the interest and any action they propose to take as part of their declaration.

If required, further advice should be sought from the Monitoring Officer in advance of the meeting.

No declarations of disclosable pecuniary interests were made at the meeting.

Representatives of town or parish councils and members of the public who live, work, or represent an organisation within the Dorset Council area are welcome to submit either 1 question or 1 statement for each meeting.  You are welcome to attend the meeting in person or via MS Teams to read out your question and to receive the response. If you submit a statement for the committee this will be circulated to all members of the committee in advance of the meeting as a supplement to the agenda and appended to the minutes for the formal record but will not be read out at the meeting. The first 8 questions and the first 8 statements received from members of the public or organisations for each meeting will be accepted on a first come first served basis in accordance with the deadline set out below.

All submissions must be emailed in full to [email protected] by 8.30 am on 7^th January 2025.

When submitting your question or statement please note that:

· You can submit 1 question or 1 statement.

· A question may include a short pre-amble to set the context.

· It must be a single question and any sub-divided questions will not be permitted.

· Each question will consist of no more than 450 words, and you will be given up to 3 minutes to present your question.

· When submitting a question please indicate who the question is for (e.g., the name of the committee or Portfolio Holder)

· Include your name, address, and contact details.  Only your name will be published but we may need your other details to contact you about your question or statement in advance of the meeting.

· Questions and statements received in line with the council’s rules for public participation will be published as a supplement to the agenda.

· All questions, statements and responses will be published in full within the minutes of the meeting. 

There was no public participation.

To note the minutes of the Audit & Governance Hearing Sub-committee (if any meetings have been held).

No meetings held.

To receive a report by Sally White, SWAP.

Sophie Blackburn, Principal Auditor SWAP introduced the report. Due to on-going concerns SWAP continued to offer a limited assurance opinion which was made up of outstanding actions still in progress and two significant corporate risks. Since the last report in October 2025, two limited assurance opinions had been issued. The first was the family hubs program phase one and the second from data maturity. She referenced pg 21 of the report, which highlighted two significant corporate risks. The first was contract and expenditure compliance audit of which could be confirmed that the significant process progress had been made through the second follow-up and had resulted in only one action that remained outstanding. For the outstanding action, a paper was expected to go to SLT and Cabinet this month outlining actions for the ongoing arrangement from April 2026. The second significant corporate risk was from the investigation work, and an action plan was confirmed in December with 35 actions agreed with the latest remediation date being the 31^st May 2026. 

Cllr Todd asked given that the Council does not currently maintain a complete record of all systems holding personal data, has identified inconsistencies between Information Asset Owners and service teams, and has approximately 36,000 paper records awaiting retention decisions, can officers explain how the Council is currently assuring itself that it is meeting its data governance and data protection obligations?

In doing so, can officers set out the risks arising from the current position, including regulatory and financial exposure, and confirm whether officers recognise that non-compliance could, in principle, expose the Council to enforcement action and fines of up to 4% of annual turnover, however unlikely that outcome may be?

Finally, can officers outline the concrete actions, leadership arrangements, and timescales in place to address these issues, including system oversight, resourcing, and training?

 He noted that the Green RAG rating on management attitude towards data, but this problem has not been updated since the introduction of GDPR

Marc Eyre, Service Manager for Assurance responded that there would be an updated Information Governance Report coming to Audit and Governance Committee at the earliest opportunity.

Noted.

To receive a report by Sally White, SWAP and Liz Crocker, Head of Service -Strategy.

Sally White, Assistant Director for SWAP introduced the report. 4 Audits had been identified, and 3 officers were in attendance, to provide members with an update on each of the 4 audits.

Steven Ford, Corporate Director for Strategy, Performance and Sustainability added that work had been done to re-calibrate the way that they were monitoring compliance in a general sense and how outstanding external audits were monitored and strengthening the relationship between risk management and outstanding audits.

James Ailward, Head of ICT Operations addressed the Application Portfolio Management Issue and the specific action that was outstanding was communicating the general ledger codes to commissioning managers such that they were coding software purchases accurately within our SAP system such that we have an understanding of the spend that we have across the Council on application software and an outstanding action that could be addressed immediately and completed by the end of the month. It was a part of a bigger piece of work and had been lost in that bigger piece of work. Looking at the broader application portfolio and understanding more strategically how the software portfolio that we use supports the objectives of the organisation.  The risk of the action remaining open was that there would not be a proper understanding of costs and they aimed to mitigate the risk through the new design authority approach to governing change by doing just in time analysis of the portfolio in a broader sense to allow change decisions around commissioning of new software to be completed in a way that understands the costs as well as some of the other aspects like alignment and technology health and capability. Such that the organisation was making considered decisions around the software and its commissioning. The just in time approach had already been started and introduced to the design authority. He covered the two actions that were outstanding on IT management, one of the actions was complete and the other was near completion. The first action which was near completion and related to ensuring that the risk and impact assessment were completed for all proposed changes. To develop robust testing and validation protocols prior to deployment and to provide targeted training relevant to teams and then to do an audit to ensure compliance with that process. So, the element of that which was not complete was the audit which would be done by the end of March 2026. The other action related to updating the policy to account for shifts in recent years around IT best practice for change management. At this point the residual risk was significantly reduced.

Marc Eyre, Service Manager for Assurance, went through two actions that had been identified as part of an internal audit on the Council’s whistleblowing arrangements. The Audit provided a reasonable assurance level but identified a couple of priority three recommendations around training. As part of the audit, five managers, one from each directorate area were approach by SWAP to ask to what extent were they aware  ...  view the full minutes text for item 181.

To receive a report by Chris Swain, Risk Reporting Officer and Liz Crocker, Head of Service - Strategy.

The Risk Management & Reporting Officer, Chris Swain, introduced the report. There was 100% compliance in risk register updates for quarter 2. The new risk dashboard was fully operational, providing a central and accessible location for entering, updating and consuming risk information. The Committee had received a briefing and demonstration of the dashboard’s functionality. In 2026 there would be three key initiatives, first delivering a learning module to support the embedding of the RM framework across the organisation. Second to review Dorset Council’s risk scoring matrix with improvements in automation and greater granularity around the impact and likelihood of components, providing enhanced insight to support more informed decision making. Lastly, strengthening alignment between the ERM framework and SWAP processes, to ensure a consistent risk-based approach to audit actions.

The Chair noted Co‑optee Simon Roach’s request for increased visibility of risks 22, 91 and 200. The Chair highlighted the scale and complexity of each of these risks and asked officers to determine the most appropriate approach for undertaking a deep dive into them. Cllr Steve Robinson – Cabinet Member for Adult Social Care – advised that a deep dive into risk 200 would be premature, as the Council is still awaiting Government confirmation on the final system processes. The Chair acknowledged this point but emphasised that where a deep dive cannot yet be undertaken, this should be noted and added to a forward plan for when it would be feasible.

Item 194 on the report was referenced and refers to the instability in the high needs bloc budget may create increased deficit in the dedicated school grant resulting in deficit in Dorset Council’s financial position. It was identified as a significant issue for the Council and there was a request for reassurance from the Cabinet Member for Education and finance to reassure the Committee to mitigate significant financial risk to the organisation.

Noted.

To consider the work programme for the Committee.

No Comments.

To consider any items of business which the Chairman has had prior notification and considers to be urgent pursuant to section 100B (4) b) of the Local Government Act 1972. The reason for the urgency shall be recorded in the minutes.

There were no urgent items.

To move the exclusion of the press and the public for the following item in view of the likely disclosure of exempt information within the meaning of paragraph 3 of schedule 12 A to the Local Government Act 1972 (as amended).

The public and the press will be asked to leave the meeting whilst the item of business is considered.

There was no exempt business.