Agenda and minutes

To receive any apologies for absence.

An apology for absence was received from Councillor Jill Haynes.

To confirm the minutes of the meeting held on 23^rd February 2026.

The minutes of the meeting held on the 23^rd of February 2026 were confirmed and signed.

To consider the Audit & Governance Action Tracker.

Following a request from members the Deputy Section 151 Officer confirmed that process mapping would be brought to the next meeting.

The action tracker was noted.

To disclose any pecuniary, other registrable or non-registrable interest as set out in the adopted Code of Conduct.  In making their decision councillors are asked to state the agenda item, the nature of the interest and any action they propose to take as part of their declaration.

If required, further advice should be sought from the Monitoring Officer in advance of the meeting.

No declarations of disclosable pecuniary interests were made at the meeting.

Representatives of town or parish councils and members of the public who live, work, or represent an organisation within the Dorset Council area are welcome to submit either 1 question or 1 statement for each meeting.  You are welcome to attend the meeting in person or via MS Teams to read out your question and to receive the response. If you submit a statement for the committee this will be circulated to all members of the committee in advance of the meeting as a supplement to the agenda and appended to the minutes for the formal record but will not be read out at the meeting. The first 8 questions and the first 8 statements received from members of the public or organisations for each meeting will be accepted on a first come first served basis in accordance with the deadline set out below.

All submissions must be emailed in full to [email protected]

by 8.30 am on Wednesday 22 April 2025.

When submitting your question or statement please note that:

· You can submit 1 question or 1 statement.

· A question may include a short pre-amble to set the context.

· It must be a single question and any sub-divided questions will not be permitted.

· Each question will consist of no more than 450 words, and you will be given up to 3 minutes to present your question.

· When submitting a question please indicate who the question is for (e.g., the name of the committee or Portfolio Holder)

· Include your name, address, and contact details.  Only your name will be published but we may need your other details to contact you about your question or statement in advance of the meeting.

· Questions and statements received in line with the council’s rules for public participation will be published as a supplement to the agenda.

· All questions, statements and responses will be published in full within the minutes of the meeting. 

There were no questions from members of the public.

The following question was submitted by Councillor Andrew Parry: -

At Full Council on the 16th April 2026, Cllr Simon Clifford (Cabinet Member for Finance & Capital Strategy), clearly stated that he had experienced officers lying to him since his election and appointment to Cabinet.

Behaviours by officers towards elected members are an extremely serious matter.

In understanding which officers had said what and when to Cllr Clifford, if the officers remain in the organisation or under what terms they left, could the Audit & Governance Committee review the reporting chain of command Cllr Clifford should have followed in addressing his concerns, assessing if matters have indeed been satisfactorily brought to the right conclusion? 

Jonathan Mair, Director of Assurance & Governance gave the following response: -

Cllr Parry raises a serious point.

Elected members need to be able to feel confidence in their officers and that there is an appropriate route through which members are able to raise concern about the performance or conduct of an officer.

Officers also need to be able to feel confidence that the appropriate route will be followed so that their employment rights are observed.

If any member has concerns about the performance or the conduct of an officer then that must be raised in confidence with the Chief Executive as the Council's Head of Paid Service or with me as Monitoring Officer. The Chief Executive will ensure that any such concerns are addressed in accordance with the Council's procedures and legal requirements. Concerns about named or identifiable persons must not be raised and commented upon in public.  Having had further discussions with Cllr Clifford he is satisfied with the actions that were taken in the case that he mentioned.

As a supplementary question Cllr Parry asked if the officers of concern to Cllr Clifford remained employees of the Council.  In response the Monitoring Officer agreed to respond to Cllr Parry outside of the meeting.

To note the minutes of the Audit & Governance Hearing Sub-committee held on 25^th February 2026.

The minutes of the Audit & Governance Sub-Committee held on the 25^th of February 2026 were received.

To receive a report from Julie Masci, Head of Engagement Grant Thornton.

Julie Masci, Audit Director Grant Thornton, introduced the report. There were two separate audit plans, one in relation to the council and one in relation to the county pension fund. The overall delivery plans were highlighted in the report together with information on the backstop regulations and the bringing forward of the timescales set out by government, in terms of when local authorities had to have their accounts audited and published by. By March 2027 the 2026/2027 accounts would have to be audited and published by the end of November.

There was a risk assessment for the financial statements where significant risks are highlighted. Key significant risks were identified in relation to management override of controls, the valuation of land and building, and the pensions liability.

The initial risk assessment for value for money work was introduced which would be conducted alongside the accounts.

The pension fund audit plan had a couple of risks to bring attention of the committee. The management override of controls and the valuation of level 3 investments were highlighted as significant risks.

Pension fund investments were to be transferred to a new pooling partner, LPPI (Local Pensions Partnership Investments).

A discussion was had regarding the internal deadline of the 30^th of November and whether enough resources were being allocated to make this deadline an achievable test and Julie Masci was confident that it could be delivered.

The report was noted.

To receive a report from Chris Swain, Risk Management and Reporting Officer.

Liz Crocker, Head of Service - Strategy, gave a brief introduction to agenda items 8 and 9.  Both the risk management report and the audit actions update report reflected a deliberate step forward in maturing the approach and improving the committee’s ability to identify areas for improvement.

Chris Swain, Risk Management and Reporting Officer discussed the key headlines of his report. The report had been designed to set the risk-based context for other papers on the agenda and to support members while reflecting on risk as per the committee’s request.

The report highlighted cyber security and data migration strategic risks which were selected by committee members and were drawn from a wider pool of risks set out in Appendix A.  These selected risks were considered through the lens of two principal risks, data and information management and security, which acted as the council’s overarching classification of risks.

A formal update regarding the continual development of the risk management framework would be brought to the committee on the 29^th of June.  It was highlighted by Cllr Holloway that the risk regarding limited higher education opportunities and a declining youth population in Dorset should be classed as a high risk rather than a medium due to the consequences to the economy.

There was a discussion regarding transformation and the risk that the transformation work may not achieve its objectives due to inadequate levels of resources. Lisa Cotton, Interim Executive Director for Modernisation & Customer commented that the risk relating to investment and requirement for resources would be reviewed through regular scrutiny and assurance reports.

A question was asked by Cllr A Parry regarding what was being done to mitigate the risk of Dorset Council being unable to secure reliable disposal routes resulting in less favourable options and increased costs for waste disposal.  Cllr S Clifford agreed to provide a report on this to a future meeting along with a specific response to the issue raised by Cllr Parry..

Decision

-       That the selected Strategic Risks and their associated risk appetites, as context for the committee’s consideration of the “Annual Information Governance Report” and “Protecting our council - cyber security risk management and future improvement plans” papers presented to this meeting of the committee be noted.

-       That the adequacy of current risk controls and the appropriateness of the stated risk appetite for each principal risk was considered.

-       To receive an update on the progress of the review of Dorset Council’s risk scoring matrix at the next risk management update on 29 June 2026 be agreed.

-       That the Quarter 3 risk data (Appendix A) be noted.

To receive a report from Chris Heighway, Strategic Performance & Risk Lead.

Chris Heighway, Strategic Performance & Risk Lead introduced the report which provided an overview of performance in relation to audit actions and set out how the council was managing audit assurance through a risk led approach aligned to the risk management framework.

A short overview of the new risk led assurance approach was given, followed by a focus on the thematic audit area on information governance, and the table which summarised overall audit progress was highlighted to members.

James Ailward, Head of IT Operations confirmed that the actions in the report had been completed and cyber security risk and wider IT audit actions were being integrated into the corporate audit and risk log which provided clearer visibility to any actions in the future.

There was discussion on the risk relating to temporary accommodation and the 8 outstanding actions that had not been completed as a result of a change in personnel. Iain Sim, Interim Corporate Director of Housing reported that 7 of the outstanding actions had been closed off and that there was only one remaining action relating to the suite of policies for temporary accommodation that required approval by Cabinet.

Decision

-       That the SWAP audit update provided in the report, including the detailed progress report at Appendix 1 be noted.

-       That the new risk-based governance approach to managing and reporting on SWAP audits and actions be endorsed.

-       That thematic areas for focus be bought to the next committee meeting on 29 June 2026.

To receive a report from Marc Eyre, Service Manager for Assurance.

Marc Eyre, Service Manager for Assurance introduced the report which covered an analysis of the information governance risks, actions that had been taken over the last twelve months, and further mitigation for the next year.  The report was split between five strategic risks and a range of operational risks to be clear on what actions were being taken moving forward.  Focus was given to the data maturity audit as there had been several overdue actions which were waiting for ratification by the Strategic and Information Governance Board but had since been signed off.

There was a discussion regarding who determined what information should be retained from predecessor councils in the archives. Sam Johnston, Service Manager for Archives & Records, commented that services would take ownership of the predecessor records for which they were now responsible, including the analysis of their value and determining which should be retained, although it was anticipated that a great deal would be deleted in accordance with the retention policy.

Attention was brought to the risk around failure to detect, investigate, risk assess, record, and respond to data breaches, and the increase in these data breaches. There was a process in place to investigate the breaches, the level of which would depend on the type of breach.  It was suggested that attention should be paid to the background of the data breaches to find any cultural issues that needed to be addressed in respect of the non-serious but persistent data breaches.  It was commented that the increase in data breaches may have been due to an increase in organisational awareness of the data breaches via new technology.

Concern was raised regarding the lack of a time frame regarding the transfer of physical records from the former Purbeck district council building. Sam Johnston, Service Manager Archives and Records, commented that there was a holdup due to a mould outbreak but reassured members that the records would be recovered alongside other legacy records that needed to be brought into the archives.

A question was raised regarding the number of Freedom of Information Requests (FOI) and the risk of them increasing further.  In some areas of the council a set of Frequently Asked Questions had been created online to answer repetitive questions on a common theme.

The report was noted by the committee.

To receive a report from Marc Eyre, Service Manager for Assurance.

Marc Eyre, Service Manager for Assurance introduced the report which looked at how the service received and handled complaints. Figures showed that there had been a significant increase in complaints each year since 2019 which was a trend seen by local authorities across the country.  The increased use of Artificial Intelligence resulted in complaints bypassing the online forms and sending lengthy complaints directly to the complaints email address.

There was some concern regarding the move to a e-form only policy as there could be an increase in digital exclusion.  Reassurance was given that those residents who struggled with the e-form would be able to phone the council to receive support. It was also noted that prior to an increase in use of AI the majority of complaints had been submitted via the e-form.

Concern was also raised regarding the rising trend in number of complaints. It was commented that the size and number of complaints being received prevented the complaints team from learning and creating policy to prevent the complaints in the future. Restricting submissions to the e-form would help direct complainants to a clear and concise form to support the complaints team.

It was agreed that a report would be brought back in six months to review the revised policy.

Decision

That the Audit and Governance Committee approve the proposed changes to the complaints policy frameworks:

-       Restricting submission of complaints to e-form only (other than for social care complaints);

-       Removing reference to the complaints email address from policy documents;

-       Reserving the right to summarise and only respond to key points of long AI generated correspondence;

-       Adding a target review timescale to the Managing Customers Behaviour protocol;

-       Reserving the right of the Unreasonable Behaviours Panel to make decisions from virtual circulation of evidence.

There were ten in favour and one abstention.

To receive a report from Sally White, Assistant Director SWAP.

Sally White, Assistant Director SWAP, introduced the report which provided updates on the current significant organisational risks, including the contract expenditure and compliance with council constitution which had been adequately mitigated. The first follow-up of the building compliance investigation action plan had been undertaken which covered actions due up until the end of March and a second follow-up would be taken at the end of June. The final significant organisational risk brought to the committee’s attention was the ICT assurance mapping work and all 3 of the actions had been completed.

The report was noted.

To receive a report from Sally White, Assistant Director SWAP.

Sally White, Assistant Director SWAP, introduced the report which outlined how SWAP had planned internal audit work for 2026/27. The aim was to continue with a dynamic and flexible approach to accommodate for planned changes within the council. There was a clear process described in the paper to create the audit plan of work. It was explained that planned audit work could be tracked at any time through the live audit dashboard.

The annual programme of work would be delivered within a budget of £470,000 which reflected a 3% increase with no cuts to the budget proposed this year.

Richard Clark, Chief Executive SWAP, introduced the charter which was an obligation placed by the global internal audit standards to set out the powers of internal audit, what the powers were intended to do and how those powers were overseen.

The report was noted.

To consider the work programme for the Committee.

The work programme was noted.

To consider any items of business which the Chairman has had prior notification and considers to be urgent pursuant to section 100B (4) b) of the Local Government Act 1972. The reason for the urgency shall be recorded in the minutes.

There were not urgent items.

To move the exclusion of the press and the public for the following item in view of the likely disclosure of exempt information within the meaning of paragraph 7 of schedule 12 A to the Local Government Act 1972 (as amended).

The public and the press will be asked to leave the meeting whilst the item of business is considered.

Proposed by Councillor Ryan Holloway, seconded by Councillor Spencer Flower.

Decision:

That the press and the public be excluded for the following item(s) in view of the likely disclosure of exempt information within the meaning of paragraph 7 of schedule 12 A to the Local Government Act 1972 (as amended).

To consider a report from James Ailward, Head of ICT Operations.

The recommendations were noted by the committee.