Agenda and draft minutes

The Committee stood in silence as a mark of respect following the recent sad passing of Councillor John Blackham.

The Chair wished to place on record the Committee’s condolences to his family and friends and how his contribution and engagement in the activities of the Audit Committee would be sorely missed.

To receive declarations of interest from Members in respect of items listed on the agenda.

There were no declarations of interest made at the meeting.

To receive questions relating to items of business on the agenda from members of the public or press who are present at the meeting.

There were no members of the public or press present at the meeting and no questions had been received in advance.

To determine whether the following items should be considered under the categories suggested in accordance with Part 1 of Schedule 12A (as amended 2006) of the Local Government Act 1972.

Under Section 100A(4) of the Local Government Act 1972, the press and public be excluded from the meeting for:-

Agenda Item 12 (Internal Audit Progress Report) (Appendix G) on the grounds that it involves the likely disclosure of exempt information as defined in Paragraph 7 of Part I of Schedule 12A to the Local Government Act 1972 (information relating to any action taken or to be taken in connection with the prevention, investigation or prosecution of crime)

Agenda Item 13 (Policy, Strategy and Engagement Risk Register) on the grounds that it involves the likely disclosure of exempt information as defined in Paragraph 3 of Part I of Schedule 12A to the Local Government Act 1972 (information relating to the financial or business affairs of any particular person (including the authority holding that information)).

Resolved:-  That, under Section 100A(4) of the Local Government Act 1972, the press and public be excluded from the meeting for Minute Nos. 44 (Internal Audit Progress Report – Appendix G) and 45 (Policy, Strategy and Engagement Risk Register) as defined in the paragraphs indicated below of Part 1 of Schedule 12A to the Local Government Act 1972.

To consider and approve the minutes of the previous meeting held on 28^th July, 2026, as a true and correct record of the proceedings and to be signed by the Chair.

Consideration was given to the minutes of the previous meeting of the Audit Committee held on 28^th July, 2026.

Resolved:-  That the minutes of the previous meeting of the Audit Committee be approved as a correct record of proceedings.

Representations of Grant Thornton (External Auditor) to present

Liz Luddington and Greg Charnley, Grant Thornton (External Auditor) presented a progress report as at 15^th September, 2026, highlighting:-

-        Audit fieldwork had commenced in early July and remained on track to issue audit opinion by the end of November

-        Intention for work to be well progressed with all significant risk areas of the audit by the end of September

-        Assessment underway of the Council’s adoption of the new indexation requirement applicable to land and buildings for the first time in 2025/26.  This was the sole change in accounting standard applicable to this year’s accounts audit

-        The Council’s draft financial statements were subject to a technical review this year termed as a ‘hot review’.  This was a biennial review and the process had already started

-        Detailed Value for Money work had begun in August with meetings held to obtain further understanding of the progress the Council had made in responding to the significant weakness identified in previous years

The report also provided information on external audit sector updates highlighting:-

-        Adult Social Care

-        Children’s Social Care

-        Annual Government Statement

-        Best Value

It was clarified that the progress position had improved since production of the papers with Grant Thornton confident that all audit areas would be “green” by November.

Resolved:-  That the progress and sector updates be noted.

Karen Middlebrook, Head of Procurement, to present

Karen Middlebrook, Head of Procurement, presented a report providing an update on procurement activity since March, 2025.

In February 2025 the new legislation (Procurement Act 2023 (“PA23”)) governing public sector procurement activity was implemented for all new procurement activity commencing from the date of implementation.  Whilst the new legislation was in force, the old legislation (Public Contracts Regulations 2015 (“PCR15”)) had not ceased to exist and would remain in force for as long as the last contract procured under the old regime was in existence.  For health related contracts linked to Public Health activity, the provisions of The Health Care Services (Provider Selection Regime Regulations 2023 (“PSR”) were applicable.

The uptake of activity under PA23 and PSR had been slow as the Council had commenced a significant volume of large scale procurements before the changes came in to allow the legislation sufficient time to settle in.  However, since the last update to the Audit Committee (Minute No. 84 11^th March, 2025), the Council had now undertaken a range of procurement exercises under all the different applicable legislation.  It remained challenging due to the multiple pieces of legislation to ensure the correct processes were undertaken, notices published and terminology/language used but would become easier the more exposure the Council had in undertaking this activity.

The PA23 had also brought a duty to report twice yearly on the Council’s performance of paying its suppliers within 30 calendar days through the publication of a Payments Compliance Notice.  The first notice required publication before the 29^th April 2026 deadline covering the period 1^st October 2025 to 31^st March 2026.  This reported that the Council took an average of 12.30 days to pay with 94.08% of invoices paid within 30 calendar days during that period.

An analysis against the Yorkshire and Humber region local authorities had been undertaken where information was published which revealed that Rotherham was ranked 6^th.  Work was underway with Finance with regard to wider support to services to improve this position.

Procurement training continued to be delivered to officers across the Council with approximately 180 trained and a dedicated session to the Regeneration and Environment Directorate of over 60.

In recognition of the work referred to above and in response to a recommendation from the External Auditor’s Value for Money report, a Procurement Strategy had been developed for the period 2026-2031.  It set out 6 key themes:-

-        Delivering Social Value

-        Upholding Ethnical Procurement Principles

-        Ensuring Compliance and Good Governance

-        Strengthening Contract and Supplier Management

-        Supporting Financial Sustainability

-        Building a Strong and Diverse Supply Base

The Strategy needed to be considered as part of the wider commissioning lifecycle and all Services would have a role in delivering the activity.  It helped to frame the key priorities for the Service to better enable it to be understood by Services and the external supply market.

Discussion ensued with the following issues raised/clarified:-

·        There was no breakdown by organisation of payment performance; the  ...  view the full minutes text for item 39.

Luke Sayers, Service Director, Customer, Information and Digital Services, to report

Consideration was given to the annual report presented by Sam Ulyatt, Service Manager Information Management, which set out the detail of Council’s compliance with Data Protection and Freedom of Information Act 2000 legislation (for the purpose of the report included the Environmental Information Regulations 2004).

The report, therefore, set out in detail performance for Freedom of Information, Right of Access Requests and any Data Incidents/Breaches.

In terms of responses to Freedom of Information (FOI) Requests (within the statutory time limits) overall performance was at 97% with the number of requests received during Year 2025/26 up to 1,423 compared to 1,347 in 2024/2025.  Overall 97% of FOI requests were responded to within the statutory time limits (1,380 of the 1,423).

This was a slight decrease in performance compared to the previous year but a further numerical increase in the number of requests received.  Whilst performance for 2025/26 was 1% lower than in the previous year (98%), analysis of the data did not raise any concerns on the year’s performance.  In 2025/26 there were no requests formally refused as invalid.

With regards to Right of Access Requests (RoARS) during 2025/26 there was a substantial step-change increase to the numerical volume received in 2024/25 (235). This continued the trend of the volume of RoARS increasing year-on-year.

However, despite the volume increase, performance had improved by 4% compared with the previous year with 264 (67%) requests processed within the statutory timeframe for 2025/26 compared to 149 (63%) in 2024/25.

Performance would continue to be closely monitored with regard to FOI and RoAR with the focus on improving time to completion and keeping customers informed.

In terms of Data Incidents and Breaches, the Council actively encouraged Services to report any suspected data incidents and all reported cases were investigated. Attached to the report was an Appendix which provided a breakdown of the number and classification of incidents.

In 2025/26 the Council had logged and investigated 223 reports of incidents of which 167 (75%) were recorded as breaches.  Disclosed in error breaches accounted for 134 of the 167 (80%).  In the previous year the equivalent figures were 129 out of 142 breaches (91%).

All the breaches investigated were non-reportable to the regulatory body (ICO).

Discussion ensued with the following issues raised/clarified:-

·        The information provided by Directorates with regard to information data incidents was accurate but reliant upon the reporting thereof

·        If a FOI request was refused, the customer would receive a formal response to that effect and also include some advice/guidance on narrowing the parameters of their question so they could, if they wanted to, refine their request and resubmit

·        There had been continued growth in the number of RoARs being received a large number of which were within Social Care and, by nature, frequently quite complicated.  On average it would take an officer a day to review 250 pages with a Social Care file being anything from 5,000-10,000 pages.  There was potential for a piece of redaction software which would assist the process  ...  view the full minutes text for item 40.

Katie Stead, Policy, Improvement and Risk Manager, to report

Consideration was given to the report presented by Katie Stead, Policy, Improvement and Risk Manager, which detailed how in April 2016 the Chartered Institute of Public Finance and Accountancy and the Society of Local Authority Chief Executives published revised guidance on delivering good governance in Local Government. In May 2025 CIPFA issued an addendum to the guidance covering the annual review of governance and the annual governance statement.

The guidance set out the 7 key principles which underpinned the governance of each local government organisation.  The Council’s local Code followed these principles and demonstrated how they were applied and evidenced in practice.

The Council’s Code of Corporate Governance was refreshed last year to comply with the addendum. It was good practice to review and revise the Council’s Code on an annual basis and the review of the Code had been completed focussing on updating evidence in line with internal improvements.  Attached to the report submitted was the tracked change appendix.

Resolved:- That the refreshed version of the Code of Corporate Governance be received and noted.

Louise Ivens, Head of Internal Audit, to present

Consideration was given to a report presented by Louise Ivens, Head of Internal Audit, proposing an update to the Council’s Anti-Money Laundering Policy to ensure that it was in line with current best practice and took into account any changes to the Council’s organisational structure.  It was last updated in 2024 (Minute No. 55 refers).

Public authorities (not being regulated businesses as defined within the Legislation) were not legally obliged to apply the provisions of all the Money Laundering Regulations unless they were undertaking a service ‘by way of business’.  The Chartered Institute of Public Finance and Accountancy (CIPFA) had produced guidance which suggested that as responsible bodies, public authorities should put in place appropriate and proportionate anti-money laundering safeguards and reporting arrangements designed to enable them to detect and avoid involvement in the crimes described in the Legislation and Regulations.

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI2026/621) had come into force on 30^th June, 2026, and amended The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.  The key changes focused on refining due diligence requirements and high risk country lists; converting EU monetary thresholds into pound sterling equivalents; refining and tightening the Enhanced Due Diligence test (EDD) and new Customer Due Diligence (CDD) obligations for pooled client accounts.  There were expanded and clarified information sharing duties between Anti-Money Laundering supervisors, Companies House and other public regulatory bodies to target economic crime intelligence.

The Council’s updated Anti-Money Laundering Policy was attached at Appendix A and the tracked changes version included at Appendix B.  It had been reviewed with only minor amendments made and in accordance with the updated legislation.  The amendments did not change any of the underlying responsibilities or requirements of staff.

Alongside the Policy review, Internal Audit were examining controls within higher risk areas within the Council and would assess whether there were appropriate and proportionate anti-money laundering arrangements in place.  The scope included staff awareness of the risks, customer due diligence, record keeping, monitoring, reporting lines and general awareness and training.  The outcome of the review would be included in the Internal Audit progress report once the final report was issued.

Resolved:-  (1)  That the revised Anti-Money Laundering Policy be received and noted.

(2)  That the actions being undertaken to review the Council’s anti-money laundering arrangements be noted.

Louise Ivens, Head of Internal Audit, to present

Consideration was given to the report presented by Louise Ivens, Head of Internal Audit, which detailed the proposed update to the Council’s Anti-Fraud and Corruption Policy and Strategy.

The update followed an annual review process which was designed to ensure that the Policy and Strategy were up-to-date with current best practice and to take into account any changes to the Council’s organisational structure.

The Committee was advised that there had been only minor updates to the Policy and Strategy since the last review. The Fighting Fraud and Corruption Locally checklist had been used to review the Council’s arrangements against current best practice. The self-assessment against the checklist and resulting actions were included as part of the report.

For the first time, the report also included additional information on the Council’s Counter Fraud Framework including fraud risks and mitigations in place.  Appendix E of the report submitted was a self-assessment against the Fighting Fraud and Corruption Locally checklist.  This was a review against best practice which demonstrated Rotherham’s robust compliance with the arrangements. 

The Global Internal Audit Standards (GIAS UK Public Sector) set out the requirement for the consideration of fraud risks within the Internal Audit Plan.  When scoping audits, auditors should consider specific risks related to fraud.  Auditors therefore needed to have sufficient knowledge to recognise the probability of fraud.  This was addressed by a prompt around considering fraud risk in the audit scoping process by having 4 experienced auditors with a variety of fraud qualifications and investigatory experience which was shared with other auditors and the completion of fraud awareness training by all staff in the Internal Audit Service.  In addition a Housing Tenancy Fraud Officer (within Housing Services) undertook investigations into possible housing and Right to Buy frauds.

The Council’s system of internal control to prevent and detect fraud was considered to be robust and operating effectively.  There had been no proven fraud cases during 2025/26.

Discussion ensued on what checks the Council carried out when renting out properties to companies to ensure they were legitimate and not being used as false sites for illegal purposes.

The Executive Director of Corporate Services now had responsibility for the majority of lettings within the Council other than Council housing.  She would ascertain what checks were undertaken around legitimacy of a company of a company/individual tenant.

It was noted that it was the first time that all the information had been pulled together into one document for Audit Committee Members.  Any potential fraud should be reported to the Head of Internal Audit or Executive Director of Corporate Services so they were aware of any potential issues that may arise during Council business. 

Resolved:-  (1)  That the revised Anti-Fraud and Corruption Strategy be approved.

(2)  That the revised Anti-Fraud and Corruption Policy be received and noted.

(3)  That the current fraud risks and the ongoing actions taken to strengthen the Council’s fraud and corruption arrangements be noted.

Louise Ivens, Head of Internal Audit to report

Consideration was given to a report presented by Louise Ivens, Head of Internal Audit, which provided a summary of Internal Audit work completed during 1^st May to 31st July, 2026, and the key issues that had arisen.

The plan attached as part of the report showed the position up to the end of July 2026, the progress of the 2026/27 audit plan, the reports finalised between May and July 2026 and Performance Indicators for the Team. 

Internal Audit provided an opinion on the control environment for all systems or services which were subject to audit review. The report detailed the audit opinions and a summary of all audit work concluded in the last quarter. 14 audits had been finalised since the last Audit Committee. 

A review of the current performance indicators was detailed in Appendix D, post-audit questionnaires and results included at Appendix E and the Quality Assurance and Improvement Plan at Appendix F.  Appendix G set out details of the Internal Audit investigative work completed.

It was noted that CIPFA’s external review had advised Internal Audit to work with senior managers and the Audit Committee to update the performance measures.  The audit standards stated that there should be a comprehensive set of targets which encompassed all significant Internal Audit activities including obtaining stakeholder feedback.

Balanced scorecards were becoming an increasingly well established means for reporting quantitative and qualitative Key Performance Indicators (KPIs) to audit committees.  A review of the current KPIs had been undertaken, together with a review of guidance issued by the Institute of Internal Auditors, on performance measurement and those being reported in other local authorities.  The proposed approach moving forward was documented in the report for discussion.

Discussion ensued on Appendix G and the investigations that had taken place by Internal Audit with further work still to be undertaken.

It was also noted that moving forward consideration was to be given as to the logging of audits that were delayed due to untimely management responses.

Resolved:-  (1)  That the Internal Audit work undertaken since the last Audit Committee, 1^st May to 31st July, 2026, and the key issues arising therefrom be noted.

(2)  That the performance objectives of Internal Audit and the actions being taken by audit management in respect of meeting the performance objectives be noted.

(Appendix G was considered in the absence of the press and public in accordance with Paragraph 7 of the Act (information relating to any action taken or to be taken in connection with the prevention, investigation or prosecution of crime).

Katie Stead, Policy, Improvement and Risk Manager, to present

Consideration was given to the report presented by Fiona Boden, Head of Policy, Performance and Intelligence, which provided details of the current position of the Policy, Strategy and Engagement (PSE) Risk Register and risk management activity following the change to the arrangements and functions of the Directorate.

The PSE Directorate was established in January 2026 to play a central role in how the Council shaped its strategic direction by driving insight-led improvement and communication with residents, partners and Elected Members.  In the formation, Human Resources and Organisational Development and Change was transferred to Corporate Services leaving 4 Services areas i.e. Policy, Performance and Intelligence, Democratic Services, Communications and Marketing and Neighbourhoods.  The Complaints Team had also transferred from PSE to Corporate Services in June.

Following the appointment of a permanent Director and changes to the Directorate’s structure and responsibilities, a full review and refresh of the PSE Directorate Risk Register had been undertaken with the revised register to be reported to the March 2027 meeting of the Audit Committee.

As part of its annual cycle, the Corporate Services Directorate Risk Register was due to be considered by the Committee in January 2027.

There were 11 risks on the PSE Directorate Risk Register, 4 of which were reflected in the Corporate Strategic Risk Register.

Resolved:- (1) That the progress and current position in relation to risk management activity in the Policy, Strategy and Engagement Directorate, as detailed in the report submitted, be noted.

(2)  That, following the appointment of a permanent Director and changes to the Directorate’s structure and responsibilities, a full review and refresh of the Policy, Strategy and Engagement Directorate Risk Register be undertaken with the revised register submitted to the March 2027 meeting of the Audit Committee.

(Exempt under Paragraph 3 (information relating to the financial or business affairs of any particular person (including the Council) of Part 1 of Schedule 12A))

Louise Ivens, Head of Internal Audit, to present

Consideration was given to the proposed forward work plan for the Audit Committee for November 2026 to September 2027.  The plan showed how the agenda items related to the objectives of the Committee.  It was presented for review and amendment as necessary.

Resolved:-  That the Audit Committee forward work plan, with the inclusion of the Policy, Scrutiny and Engagement Risk Register in March, 2027, be approved.

To consider the referral of matters for consideration by the Overview and Scrutiny Management Board.

There were no items for referral.

To consider any item which the Chair is of the opinion should be considered as a matter of urgency.

There was no urgent business to be considered.