Agenda item

The Internal Audit Progress Report was presented by the Head of Worcestershire Internal Audit Shared Service (WIASS). It was reported that the service was fully resourced and as of end of December 2025 186 productive days of internal audit work for the Council had been delivered against the full year plan of 308. It was anticipated that the objective of delivering 90 per cent of the full year plan would be achieved by year end (31 March 2026).

As of end of December 2025, four audit assignments had been fully completed, one assignment was at the draft report stage, seven assignments were in progress, two assignments were at the planning stage, and one assignment had been put on hold until February due to a request from management – this related to a data protection audit which was now due to be completed by mid-February.

Of the four fully completed audit assignments, three had been finalised since the last meeting of the Audit, Governance and Standards Committee. These were Payroll, General Ledger, and Corporate Health and Safety. Payroll had received ‘substantial assurance’ following audit with only minor issues identified.

The General Ledger was given ‘limited assurance’, although it was recognised that considerable progress had been achieved since the last internal audit review. However, at the time of the audit control suspense account reconciliations had not yet been completed 2024/25 and completion of bank reconciliations was behind schedule for both authorities. It was noted that this was mainly due to the legacy issues following implementation of the new finance system after February 2021 and focus on bringing statutory accounts up to date. Internal Audit was due to revisit this area in 2026/27.

The audit of Corporate Health and Safety resulted in ‘limited assurance’ being provided. This audit was requested by the Council’s senior management and resulted in a number of major issues being identified including 59 per cent of new starters since September 2023 not having received Health and Safety Induction training and no standardised means of ensuring role specific health and safety training was being provided. Furthermore, a significant number of service areas did not provide health and safety risk assessments when requested by the auditor.

There were 29 outstanding internal audit recommendations for the Council to action as of the time of report writing. 1 overdue medium priority action related to periodic entitlement review for households in receipt of Council Tax Single Person Discount as last such review took place eight years ago. There was 1 overdue high priority action in relation to assurance that cyber security awareness training had been completed by all elected Members. It was stated that five Members were yet to start this training, and one Member had an outstanding module to complete.

The Committee expressed concern that the cyber security training had not yet been completed by all Members. It was requested that the deadline be set for the remaining Members to complete this training and that political Group Leaders be notified of the Members of their Groups who had not completed the training. In addition, it was asked that the Internal Auditor contact these Members directly with a reminder to complete the training. It was further suggested that assistance could be provided before upcoming committee meetings for the outstanding Members to complete the training, if this could be facilitated. The Committee requested that an update on cyber security training completion be provided at the next meeting.

The Head of Worcestershire Internal Audit Shared Service highlighted that the preparation of the Internal Audit Plan for 2026/27 had begun. Members were encouraged to contact the Head of Internal Audit until the end of March to provide their feedback and input into the 2026/27 Internal Audit Plan.

RESOLVED that

the Internal Audit Progress Report be noted.