Agenda item

Prior to the committee receiving the report, the Head of Audit & Information Governance confirmed to the committee that the monetary value for gifts and hospitality as a declaration of interest was £50.  This would be updated and noted in future agendas of the committee. 

The committee considered a report from the Head of Audit & Information Governance to present an update on the work completed by the Internal Audit team since the previous update in November 2024 and progress made against delivery of the 2024/25 Internal Audit Plan.

In regard to the Annual Audit Plan, which was approved by the committee in July 2024, the Head of Audit & Information Governance noted that the plan continued to be reviewed to ensure that the areas included remained relevant and reflected the risks of the organisation. The first two quarters of the audit year had largely focused on grant verifications required within individual grants funding and the deferred 2023-2024 internal audits.  Key corporate projects had also been maintained, providing project support and consultancy roles, particularly in procurement, contract management, and the Integrated Settlement working group. 

In regard to the completed audits and findings, the Head of Audit & Information Governance noted that several audits had been completed between November 2024 and the present, including three audits that had been completed to final report stage that were the Transport for West Midlands (TfWM) External Assurance Follow-up Governance and Capital Projects, Integrated Settlement Readiness Check and Independent Training Providers (ITPs), which all received reasonable assurance. Significant progress was noted in relation to the TfWM External Assurance audit, with 55% of actions fully implemented and 45% partially implemented, showing substantial improvement from the previous year.

In regard to deferred and cancelled audits, the Head of Audit & Information Governance noted that due to resource pressures and additional workloads at certain periods, a few audits had been cancelled from this year's plan, and two audits had been deferred to 2025-2026.  He reassured the committee that these changes would not impair the ability to provide an annual audit opinion for 2024-2025, that was required to be included in the annual governance statement.

In regard to ongoing work and changes to the audit plan, the Head of Audit and Information Governance noted that currently 13 audits were underway and in various stages of progress.  The internal audit plan was subject to changes due to evolving risks and resource pressures. Two corporate projects had been requested for completion, including an independent review of WMCA Board papers and additional work related to external practical projects. There had also been an increase in investigation work requirements during this period.

The report included a progress summary table highlighting completed audits and ongoing work.  The Head of Audit & Information Governance noted regular recommendation tracking was conducted, and significant improvements had been made in implementing actions from previous audits.  He further noted that although there were concerns about the number of audit recommendations not being completed within the set timelines by Responsible Officer’s (ROs), reassured the committee that efforts were being made to work closely with action owners to ensure achievable and realistic timelines and to escalate actions to the WMCA’s internal Business Management Panel and Executive Board as necessary.

The Business Continuity Resilience, Response and Recovery Manager provided a verbal update on the 15 recommendations from the internal audit undertaken on business continuity.  She emphasised the ongoing review and update of the business continuity plan, the completion of missing business impact assessments, and the importance of aligning IT systems with disaster recovery plans.  She further noted that a crisis communications plan was in progress, and efforts were being made to standardise on-call structures and update the strategic risk register. The Chair asked that a written report be provided at a subsequent meeting to facilitate an understanding of the progress being made.

Councillor Martin raised a concern regarding the high-risk recommendation for the Long Bridge Park and Ride project that was initially scheduled for completion by September 2024 and sought assurance that there would be no further slippage and that the project would be completed within the newly agreed timeframes. 

In response, the Head of Audit & Information Governance   acknowledged the concern and confirmed that the audit recommendation had been outstanding since the initial audit in 2022. 

He further explained that there had been significant pushbacks and that his team was continuously seeking assurance over the matter. The most recent update indicated that the project would be completed within the next couple of months.  He emphasised that the major stumbling block was related to contract approval and evidencing the approval of the initial contract.  He assured that that the RO was working on resolving this issue and promised to provide an update as soon as the contract was signed. 

The Chair suggested that if the project was not completed by the newly agreed timeframe, the RO should be asked to attend the committee meeting to provide an explanation.

Councillor Martin further raised a concern about the high-risk recommendation related to ITPs as the issue at hand was the evidence of compliance in procuring training, which posed a significant risk and required immediate mitigation that she sought assurance that this risk would be addressed promptly. 

In response, the Head of Audit & Information Governance acknowledged the seriousness of the risk and noted that it be partially discussed in the private session.  He explained that the recommendation was linked to another recommendation within a previous audit report concerning adult education procurement. 

This recommendation highlighted the need for due diligence and financial checks for ITPs and he assured that a new dynamic purchasing system was being developed, which would include enhanced financial due diligence processes.  He confirmed that the team was actively working on this issue and that further details would be discussed in the private session.

The Chair specifically raised a concern about the inconsistency in the wording between the Treasury report and the Internal Audit Plan to highlight that the Treasury report mentioned an internal review of treasury activities, however this review was not included in the current year's plan.  In response the Head of Audit & Information Governance acknowledged the concern from the Chair and noted while the internal review of treasury activities was planned for next year, agreed, along with the Executive Director of Finance & Business Hub that the wording should be aligned to avoid any confusion.

Councillor Lakha noted that the wording of the voting requirements in the report could possibly be misconstrued and wondered if it should be revised. The Chair suggested that the Executive Director of Finance & Business Hub discuss this with the Director of Law, Governance & Audit to ensure the wording was clear as to the requirements for any resolution to be passed. 

Recommended to the WMCA Board: 

(1)  The contents of the latest Internal Audit Update Report and the
        amendments to the original plan, including those audits which had been
        added, deferred or cancelled since its approval on 15 July 2024 be noted.

(2)  Progress on the implementation of recommendations be noted.