Agenda of Risk and Assurance Committee Meeting

1 Nau Mai | Welcome

2 Karakia a te Kaunihera | Council Blessing

I a mātou e whiriwhiri ana i ngā take kei mua i ō mātou aroaro

E pono ana mātou ka kaha tonu ki te whakapau mahara huapai mō ngā hapori e mahi nei mātou.

Me kaha hoki mātou katoa kia whaihua, kia tōtika tā mātou mahi,

Ā, mā te māia, te tiro whakamua me te hihiri

Ka taea te arahi i roto i te kotahitanga me te aroha.

As we deliberate on the issues before us,

We trust that we will reflect positively on the
communities we serve.

Let us all seek to be effective and just,

So that with courage, vision and energy,

We provide positive leadership in a spirit of harmony and compassion.

3 Whakapāha | Apologies

4 Te Tauākī o Te Whaitake ki ngā Mea o te Rārangi Take | Declarations of Interest Relating to Items on the Agenda

Notification from Elected Members of:

4.1 – any interests that may create a conflict with their role as an elected member relating to the items of business for this meeting, and

4.2 – any interests in items in which they have a direct or indirect pecuniary interest as provided for in the Local Authorities (Members’ Interests) Act 1968

5 He Wā Kōrero ki te Marea mō ngā Mea e Hāngai ana ki te Rārangi Take | Public Speaking Time for Items Relating to the Agenda

6 Ngā Teputeihana | Deputations

Nil

7 Ngā Take a ngā Mema | Members’ Business

(a) Updates from the Chair

(b) Leave of Absence

8 He Kōrero Hou | Updates

Nil

Risk and Assurance Committee Meeting Agenda

21 November 2024

9 Pūrongo | Reports

9.1 Quarterly Treasury Compliance

Kaituhi | Author: Ian Georgeson, Chief Financial Officer

Kaiwhakamana | Authoriser: Steffi Haefeli, Acting Group Manager Corporate Services

TE PŪTAKE | PURPOSE

1 This report provides confirmation to the Risk and Assurance Committee of the Council’s compliance with its Treasury Management Policy (Policy) for the quarter ended 30 September 2024.

HE WHAKARĀPOPOTO | EXECUTIVE SUMMARY

2 An executive summary is not required for this report.

TE TUKU HAEPAPA | DELEGATION

3 The Risk and Assurance Committee (Committee) has the delegation to consider this matter under the section of Part C.3 of the Governance Structure and Delegations 2022-2025 Triennium which states: “This committee is responsible for monitoring the Council’s financial management, financial reporting mechanisms and framework, and risk and assurance function, ensuring the existence of sound internal systems.”

TAUNAKITANGA | RECOMMENDATIONS

A. That the Risk and Assurance Committee:

A.1 Receives and notes the “Treasury Dashboard Report” for the September 2024 Quarter, attached as Appendix 1.

A.2 Notes the Council complied with all requirements of the Treasury Management Policy for the quarter ended 30 September 2024.

TŪĀPAPA | BACKGROUND

4 As part of the 2024/34 Long-term Plan process the Council adopted an updated Treasury Policy, to apply from July 2024. The objectives of the Policy are to control and manage borrowing costs, investment returns, liquidity requirements, and risks associated with treasury management activity.

5 The Council’s objectives in relation to borrowings are to:

5.1 minimise borrowing costs within approved risk parameters;

5.2 prudently manage the Council’s exposure to interest rate changes;

5.3 ensure sufficient levels of liquidity to meet planned and unforeseen cash requirements;

5.4 ensure that funding risks are managed by maintaining an appropriate spread of maturities;

5.5 prudently manage the Council’s credit exposures; and

5.6 monitor and report on the risk and the performance of debt portfolios against predetermined limits and benchmarks.

HE KŌRERORERO | DISCUSSION

6 The Treasury Dashboard Report for the September 2024 quarter, as at Appendix 1 to this report, provides an economic overview and reports against Policy requirements. The dashboard has been developed with Bancorp, our Treasury advisers, and is in a style consistent with reporting produced for many of their council clients. We are able to tailor the content to meet any specific requirements we may have.

7 Policy compliance is reported as follows:

7.1 Liquidity and funding risk

7.1.1 Overall net debt / revenue within LGFA covenant 280% (page 9)

7.1.2 Spread of debt maturities (page 4)

7.1.3 Liquidity ratio (page 4)

7.2 Interest rate risk

7.2.1 Total fixed rate hedging and spread across maturity bands (page 5)

7.3 Credit risk

7.3.1 Counterparty exposure (page 9)

8 The Council complied with all policy requirements during the quarter.

He take | Issues

9 This report has a low level of significance under the Council’s Significance and Engagement Policy).

Ngā kōwhiringa | Options

10 There are no options to be considered.

Mana whenua

11 There are no mana whenua considerations arising directly from this report.

Panonitanga Āhuarangi me te Taiao | Climate change and Environment

12 There are no climate change considerations within this report.

Ahumoni me ngā rawa | Financial and resourcing

13 There are no financial and resourcing considerations in addition to those already noted in this report.

Tūraru ā-Ture me te Whakahaere | Legal and Organisational Risk

14 There are no legal and risk considerations arising from this report.

Ngā pānga ki ngā kaupapa here | Policy impact

15 There are no policy considerations in addition to those already noted in this report.

TE WHAKAWHITI KŌRERO ME TE TŪHONO | COMMUNICATIONS & ENGAGEMENT

Te mahere tūhono | Engagement planning

16 An engagement plan is not required for this report.

Whakatairanga | Publicity

17 There are no publicity considerations arising from this report.

NGĀ ĀPITIHANGA | ATTACHMENTS

1. Treasury Dashboard Report ⇩

Risk and Assurance Committee Meeting Agenda

21 November 2024

9.2 FY2024-25 Quarter 1 - Workplace Health, Safety and Wellbeing Report

Kaituhi | Author: Kelly Newbold, Manager Health Safety and Wellbeing

Kaiwhakamana | Authoriser: Rach Wells, Group Manager People and Capability

Te pūtake | Purpose

1 This report presents the Workplace Health, Safety and Wellbeing Report for the period 1 July 2024 to 30 September 2024.

He whakarāpopoto | EXecutive summary

2 Not required for this report.

Te tuku haepapa | Delegation

3 The Risk and Assurance Committee has delegated authority to consider this report under the following delegation in the Governance Structure, Section C 1.

· Ensuring that the Council has in place a current and comprehensive risk management framework and making recommendations to the Council on risk mitigations,

· Assisting Elected Members in the discharge of their responsibilities by ensuring compliance procedures are in place for all statutory requirements relating to their role,

· Governance role in regard to the Health, Safety and Wellbeing Policy and Plan.

Taunakitanga | RECOMMENDATIONS

A. That the Risk and Assurance Committee notes the Health and Safety Quarterly Insights Report for the period 1 July 2024 to 30 September 2024 attached as Appendix One to this Report.

Tūāpapa | Background

4 The quarterly Health, Safety and Wellbeing Report is intended to provide the Council with insights into initiatives and activities and their progress, as part of the Council’s commitment to providing a safe and healthy place to work. The contents and any subsequent discussions arising from this report can support Officers to meet their due diligence obligations under the Health and Safety at Work Act (HSWA) 2015.

5 The timing of the Health and Safety Quarterly Reports does not prevent an ‘as and when required’ verbal update from the Chief Executive to the Mayor and Council regarding serious or high-profile risk events. Such events would be recorded and retrospectively included in the next available Quarterly Report.

He kōrerorero | Discussion

6 This report provides a summary update on the Health, Safety and Wellbeing activities, and initiatives that are underway or planned to be undertaken during the 2024/2025 financial year, across policies, risk review, audits and assessments.

7 The insights report attached as Appendix One has changed from previous reporting formats to align with best practise reporting for Governance as set out in the updated “Health and Safety Governance: A Good Practice Guide” released by the Institute of Directors in July 2024.

He take | Issues

8 A recent people leader survey undertaken has shown that our Health and Safety Management System – Vault is not being optimised and in recent times there has been inconsistent training provided to staff and managers. A project is underway to determine if Vault is fit for purpose to meet our obligations under the Health and Safety at Work Act 2015.

Ngā kōwhiringa | Options

9 There are no options arising from this report.

Mana whenua

10 There are no mana whenua considerations arising from this report.

Panonitanga Āhuarangi me te Taiao | Climate change and Environment

11 There are no climate change considerations arising from this report.

Ahumoni me ngā rawa | Financial and resourcing

12 There are no financial or resourcing considerations arising from this report.

Tūraru ā-Ture me te Whakahaere | Legal and Organisational Risk

13 There are no legal or organisational risks in addition to those noted in this report.

Ngā pānga ki ngā kaupapa here | Policy impact

14 There are 13 Health, Safety and Wellbeing related policies that are either under review or due to be reviewed in this financial year. These are detailed in the following table:

Table 1 – Health, Safety and Wellbeing Policies

Policy Name	Policy Description	Policy Review Due Date	Review Status
Corporate Policy Statement - Health and Safety	Statement from CEO to outlining Council's approach to H&S and expectations.	N/A	In progress
HR-21 Contractors Health and Safety Management	To set Council expectations of Contractors working on Council sites.	Jan 2025	In progress
HR-13-020 Health and Safety	Outlines Council's approach to managing H&S	Feb 2022	In progress
HR-13-018 Hazard Management	Aims to ensure the safety of Council employees, visitors and contractors required to work on or around its premises.		To be revoked when HR-13-020 H&S Policy Review Complete
HR-13-022 Working Alone or in Isolation	Outlines the H&S responsibilities of the Council, its managers and workers. It applies to those who may be required to work alone or in remote.	May 2020
HR-24 Personal Protective Equipment	To ensure the provision of PPE where required to minimise the risk of harm.	2 year review cycle
HR-030 Incident and Accident Management	To ensure all safety information about accidents, incidents, and near-misses are reported and investigated appropriately	Nov 2019
HR-13-024 Smoke Free Workplace	To provide a smokefree environment that will assist to improve the health status of all those who undertake work for or visit Council workplaces.	Dec 2021
HR-16-034 Care Register	Sets out the guidelines and parameters for the use, maintenance and review of the Care Register.	July 2020	Planned Q3
HR-16-035 Visitors	To ensure a safe environment for visitors at a Council workplace so they remain safe from harm or risk during that visit.	Dec 2021	Planned Q4
HR-16-044 Preventing and Responding to Workplace Bullying	To provide guidance for how to identify, report, address, and help prevent worplace bullying and other undesirable behaviour in our workplace.	Dec 2021	Planned Q3
HR-18 Return to Work	Aims to ensure good communication is established and maintained betrween the Council, employee, treatment provider, and ACC to faciliate a RTW programme	April 2011	Planned Q4
HR-13-015 Rehabilitation Management	Aims to ensure the early, safe and lasting return to work of Council employees following injury or illness.	May 2019	Planned Q4
HR-13-017 Staff Wellness	Provides information regarding the broad range of wellness initiatives offered to employees, encompassing both emotional and physical wellbeing.	Dec 2018	Planned Q3
HR-19 Vehicle User	To clarify the responsibilities of drivers when using Council vehaicles, ensourage and promote safe driving behaviours.	Feb 2023	Planned Q4
HR-19-041 Alcohol in the Workplace	Provides guidance for supplying and consuming alcohol at social events in Council workplaces or at Council-owned or controlled facilities.	May 2024	Planned Q4
HR-26 Drug and Alcohol	To ensure that all workers can work in an environment free of alcohol and drug use or abuse.	Mar 2021	Planned Q4
HR-13-016 Emergency Preparedness	To ensure Council has effective emergency plan to manage emergencies likely to occur across Council worksites.	Dec 2018
HR-16 - Flexible Working Arrangements (FWA)	Policy to provide the process for flexible working arrangements including change in hours and location.	April 2019	In progress

TE whakawhiti kōrero me te tūhono | Communications & engagement

15 Health, Safety and Wellbeing internal communication continues to increase through a range of internal channels.

Te mahere tūhono | Engagement planning

16 An engagement plan is not needed regarding this report.

Whakatairanga | Publicity

17 There are no publicity considerations regarding this report.

Ngā āpitihanga | Attachments

1. Q1 Health, Safety and Wellbeing Insights Report ⇩

Risk and Assurance Committee Meeting Agenda

21 November 2024

9.3 Top 10 Organisational Risk Report

Kaituhi | Author: Nienke Itjeshorst, Lead Risk and Assurance Advisor

Kaiwhakamana | Authoriser: Mark de Haast, Group Manager Corporate Services

Te pūtake | Purpose

1 This report provides an update on the Top 10 Organisational Risks currently facing the organisation.

He whakarāpopoto | Executive summary

2 Not required.

Te tuku haepapa | Delegation

3 The Risk and Assurance Committee has delegated authority to consider this matter in line with section C.3 of the Governance Structure and Delegations for the 2022-2025 triennium which state the committee has delegation to:

· Ensure that Council has in place a current and comprehensive risk management framework and making recommendations to the Council on risk mitigation.

Taunakitanga | RECOMMENDATIONS

A. That the Risk and Assurance Committee receives and notes this report, including Appendix 1 to this report.

Tūāpapa | Background

4 The Top 10 Organisational Risks are aimed at setting a clear direction for staff as to what the Senior Leadership Team (SLT) have identified as the highest areas of potential risk for the organisation to being able to successfully achieve its objectives.

5 “Risk” for the management of the council organisation is defined as:

a. the impact of uncertain events that can happen in the future on the planned objectives that SLT wants the organisation to deliver and/or achieve (short, medium and long term), and

b. includes strategic, reputational, regulatory, legal, security, change and operational risks.

6 The current Top 10 Organisational Risks are managed in a risk register in our Enterprise Risk Management software: Camms Risk. It is important to note that these risk listings are:

a. not ranked in order of severity,

b. capped at 10, to provide a clear focus for SLT and this Committee, and

c. not ‘set in stone,” an emerging organisational risk can be brought forward to replace an existing risk when required and/or relevant.

7 Engagement on the organisational risk profile is through on-going conversations with SLT and activity managers about these risks, the controls to prevent or mitigate these risks and status of risk treatments that are underway to implement the controls to achieve the target risk level. These conversations ensure each risk is regularly reviewed providing assurance that the treatments are being conducted to further mitigate the risk.

8 The next table identifies the current Top 10 Organisational Risks.

Risk No.	Risk Title
ORG 1	Loss of life, serious injury or illness due to insufficient Health, Safety and Wellbeing management.
ORG 2	Failure to adequately maintain social licence.
ORG 3	Failure to give effect to Te Tiriti o Waitangi
ORG 4	Inadequate mitigation and adaptation responses to known and future climate change challenges.
ORG 5	Failure to achieve legislative obligations.
ORG 6	Inadequate management of the impacts of central government reform/change.
ORG 7	Inadequate safeguards against digital technology risks.
ORG 8	Failure to prudently manage Council’s financial stability including fraudulent activity.
ORG 9	Failure to maintain business continuity for essential services and inadequate planning and preparedness for emergencies.
ORG 10	Inability to attract and retain sufficient capacity to deliver Council’s objectives.

9 A list of AS/NZ/ISO 3100:2018 Standard: Risk Management – Guidelines definitions is included in the Heatmap Report on the last page.

He kōrerorero | Discussion

10 This report provides an update of the current Top 10 Organisational Risks. The associated Risk Heatmap Report (attached as Appendix 1 to this report), details how the organisation is treating and mitigating these risks, with progress updates against each of the individual risk treatments.

Changes to Top Organisational Risks

11 Two more risk workshops with the Senior Leadership Team were held in September and October 2024 with a focus on risk appetite and risk trend towards target risk. Risk consequence categories/ratings are currently being reviewed with SLT with a target completion date of February 2025.

12 All updates/changes to the Risk Heatmap Report (attached as Appendix 1 to this report), have been highlighted in blue font.

He take | Issues

13 There are no additional issues arising from this report.

Ngā kōwhiringa | Options

14 There are no options to be raised in this report.

Mana whenua

15 There are no mana whenua considerations in addition to those included in Appendix 1 to this report.

Panonitanga Āhuarangi me te Taiao | Climate change and Environment

16 There are no climate change considerations in addition to those included in Appendix 1 to this report.

Ahumoni me ngā rawa | Financial and resourcing

17 There are no financial and resourcing considerations in addition to those included in Appendix 1 to this report.

18 Tūraru ā-Ture me te Whakahaere | Legal and Organisational Risk

There are no further legal and risk considerations arising directly from this report.

Ngā pānga ki ngā kaupapa here | Policy impact

19 There are no further policy considerations arising from this report.

Te whakawhiti kōrero me te tūhono | Communications & engagement

Te mahere tūhono | Engagement planning

20 This matter has a low level of significance under the Council’s Significance and Engagement Policy and no engagement is triggered.

Whakatairanga | Publicity

21 This report and appendices will be publicly available through the agenda for the Risk and Assurance Committee meeting.

Ngā āpitihanga | Attachments

1. Top 10 Organisational Risk Heatmap Report 21 November 2024 ⇩

Risk and Assurance Committee Meeting Agenda

21 November 2024

9.4 Legislative Compliance 1 July to 30 September 2024

Kaituhi | Author: Sarah Wattie, General Counsel

Kaiwhakamana | Authoriser: Steffi Haefeli, Acting Group Manager Corporate Services

Te pūtake | Purpose

1 The purpose of this report is to notify the committee of legislative non-compliance in the first quarter of the financial year, 1 July 2024 to 30 September 2024.

He whakarāpopoto | EXecutive summary

2 An executive summary is not required.

Te tuku haepapa | Delegation

3 The Risk and Assurance Committee has delegated authority to consider this report under section C3 of the Governance Structure and Delegations document for the 2022-2025 triennium. These delegations include:

· ensuring that the Council has in place a current and comprehensive risk management framework and making recommendations to the Council on risk mitigation.

· assisting elected members in the discharge of their responsibilities by ensuring compliance procedures are in place for all statutory requirements relating to their role.

Taunakitanga | RECOMMENDATIONS

A. That the Risk and Assurance Committee notes legislative non-compliance for the first quarter of the financial year from 1 July 2024 to 30 September 2024 as outlined in Attachment 1 to this report.

Tūāpapa | Background

4 Local government is governed by a complex statutory framework with the Council responsible for a range of legislative requirements. Legislative compliance is important to the Council carrying out its functions under the Local Government Act 2002 in a fair and effective manner that is accountable to the local community. Failure to achieve Council’s legislative obligations has also been identified as one of the Council’s top 10 risks.

5 Each quarter key Council staff responsible for the Council’s compliance with legal obligations under different Acts are asked to complete a quarterly declaration of known non-compliance with legislative requirements and key assurance areas being privacy, procurement, authorised expenditure, cyber security and Local Government Official Information and Meetings Act 1987 (LGOIMA) requirements.

6 Council staff are asked to report against all applicable legislation. A legislative compliance schedule exists to assist staff in completing this declaration, set out in Attachment 2 to this report. The Council’s external auditors have identified the following legislation and regulations where non-compliance could have a fundamental effect on operations:

· Local Government Act 2002

· Local Authorities (Members’ Interests) Act 1968

· Local Government (Rating) Act 2002

· Local Government (Financial Reporting and Prudence) Regulations 2014

· Building Act 2004

· Resource Management Act 1991.

He kōrerorero | Discussion

7 This section sets out legislative compliance breaches for the first quarter of the financial year, 1 July 2024 to 30 September 2024, against all applicable legislation with risk ratings, corrective actions and status assigned for each breach. It also provides an assurance against key assurance areas outlined above being privacy, procurement, authorised expenditure, cyber security and LGOIMA.

Organisational Risk Levels

8 Organisational risks levels have been assigned to legislative compliance breaches reported to this Committee based on the Council’s organisational risk framework. The risk levels are set out below, noting that the assigned Risk Levels in Attachment 1 account for an assessment of the risk and corrective actions taken together:

Organisational Risk Levels
High	· Matters and/or issues considered to be fundamental to the mitigation of material risk, maintenance of internal control or good corporate governance.
Moderate	· Matters and/or issues considered to be of major importance to maintenance of internal control, good corporate governance, or best practice for processes.
Low	· A weakness which does not seriously detract from the internal control framework.

Key Assurance Areas

9 The Risk and Assurance Committee has requested the following key assurance areas be reported on in additional to legislative compliance:

· Privacy breach: A privacy breach is not meeting the requirements of the Privacy Act 2020 which may include releasing personal information to someone not authorised to receive it or using personal information in an unauthorised way.

· Procurement breach: A procurement or probity breach is a failure to follow the requirements of Council’s procurement policy, which sets out the requirements for our staff to ensure they carry out procurement in a way that is transparent, accountable, impartial and equitable.

· Unauthorised expenditure: Unauthorised expenditure is expenditure that breaches Council’s finance and purchasing policies, such as a staff member spending money without the appropriate financial delegation.

· Cyber security breach: A cyber security breach is a breach of Council’s information security systems which may result in the disclosure of sensitive, personal or commercial information to persons who are not authorised to receive the information, including members of the public.

· Local Government Official Information and Meetings Act 1987 (LGOIMA): A breach of this act relates to failure to meet deadlines or requirements for official information requests, land information memorandum (LIM) requests, and transparency and notification requirements relating to Council, committee and community board meetings.

10 Confidential investigations are not included in this legislative compliance report and will be reported in public excluded where required.

11 Table 1: Assurance against key risk areas

Risk area	Description
Privacy	There were five privacy breaches reported in the period.
Procurement	There were no reported procurement breaches in the period.
Unauthorised expenditure	There was no reported unauthorised expenditure in the period.
Cyber security	There were no reported cyber security breaches in the period.
LGOIMA	There were no reported LGOIMA breaches in the period.

12 While there has been an increase in the number of privacy breaches reported (six in the last quarter and five this quarter), reporting of privacy breaches is encouraged by increased focus on legislative non-compliance. Privacy awareness continues to be a priority for Council. The Legal Services team arrange compliance training on key risk areas for the organisation. In relation to privacy this includes online privacy modules for all staff, Privacy Week activities and communication, and team-specific training.

13 Legislative compliance breaches for the first quarter of the financial year are set out in Attachment 1 to this report. These include ongoing breaches previously reported to this Committee, where staff are still working on mitigations.

He take | Issues

14 There are no issues for this report.

Ngā kōwhiringa | Options

15 There are no options required for this report.

Mana whenua

16 The Council has a partnership with local iwi and hapū on the Kāpiti Coast District represented by Te Rūnanga O Toa Rangātira, Ngā Hapū o Ōtaki and Āti Awa ki Whakarongotai Charitable Trust.

17 The Council’s accountability to the community on legislative compliance extends to its partnership with iwi and commitments made to reflect the obligations under Te Tiriti o Waitangi, as well as other obligations to Māori, mana whenua and tangata whenua under the Local Government Act 2002, Resource Management Act 1987 and other legislation.

Panonitanga āhuarangi | Climate change

18 There are no climate change implications arising directly from this report.

Ahumoni me ngā rawa | Financial and resourcing

19 There are no financial implications arising directly from this report.

Tūraru ā-Ture me te Whakahaere | Legal and Organisational Risk

20 Except for the issues noted in this report, there are no other legal or risk implications.

Ngā pānga ki ngā kaupapa here | Policy impact

21 There are no policy implications arising directly from this report.

TE whakawhiti kōrero me te tūhono | Communications & engagement

22 This report is for the purpose of providing information only and does not trigger the Council’s Significance and Engagement policy.

Te mahere tūhono | Engagement planning

23 There is no requirement for engagement planning.

Whakatairanga | Publicity

24 There are no additional publicity considerations arising directly from this report.

Ngā āpitihanga | Attachments

1. Legislative Compliance Breaches and Updates 1 July 2024 to 30 September 2024 ⇩

2. Legislative Compliance Schedule ⇩

Risk and Assurance Committee Meeting Agenda

21 November 2024

9.5 Forward Work Programme to September 2025

Kaituhi | Author: Mark de Haast, Group Manager Corporate Services

Kaiwhakamana | Authoriser: Steffi Haefeli, Acting Group Manager Corporate Services

Te pūtake | Purpose

1 This report seeks agreement to the forward work programme for the Risk and Assurance Committee to September 2025.

He whakarāpopoto | EXecutive summary

2 An executive summary is not required for this report.

Te tuku haepapa | Delegation

3 The Risk and Assurance Committee (Committee) has the delegation to consider this matter under the section of Part C.3 of the Governance Structure and Delegations 2022-2025 and set its annual work programme which contains matters relating to the committee’s purpose:

“This committee is responsible for monitoring the Council’s financial management, financial reporting mechanisms and framework, and risk and assurance function, ensuring the existence of sound internal systems.”

Taunakitanga | RECOMMENDATIONS

A. That the Risk and Assurance Committee approves its Forward Work Programme to September 2025 as set out in Appendix 1 to this report.

Tūāpapa | Background

4 Under Council’s Standing Orders, the Chief Executive has the responsibility for approving the Committee agenda items, this report provides an opportunity for the Committee to discuss and endorse its work programme going forward which will shape the items to be discussed at future meetings.

He kōrerorero | Discussion

5 The forward work programme for the Risk and Assurance Committee, as developed by the Group Manager Corporate Services, is attached in Appendix 1 to this report.

He take | Issues

6 The establishment and presentation of the forward work programme is in accordance with the Office of the Auditor General’s best practice guidance. This approach is used by other councils throughout New Zealand.

7 That same best practice also provides for the Committee to review its forward work programme at each subsequent meeting to ensure it remains relevant and can be adapted as necessary.

Ngā kōwhiringa | Options

8 The Committee can consider and, if necessary, make amendments to the forward work programme attached as Appendix 1 to this report.

Mana whenua

9 Whilst this report does not directly affect mana whenua, any such considerations will be included where appropriate in other reports presented to the Committee as part of the approved work programme.

Panonitanga Āhuarangi me te Taiao | Climate change and Environment

10 There are no climate change considerations for this report.

Ahumoni me ngā rawa | Financial and resourcing

11 There are no additional financial considerations for this report.

Tūraru ā-Ture me te Whakahaere | Legal and Organisational Risk

12 There are no legal considerations or risks for this report.

Ngā pānga ki ngā kaupapa here | Policy impact

13 There is no impact on existing Council policies.

TE whakawhiti kōrero me te tūhono | Communications & engagement

Te mahere tūhono | Engagement planning

14 No engagement planning is required for this report.

Whakatairanga | Publicity

15 The approved forward work programme will be publicised through the publication of the agenda and minutes of this Risk and Assurance meeting.

Ngā āpitihanga | Attachments

1. Forward Work Programme to September 2025 ⇩

Risk and Assurance Committee Meeting Agenda

21 November 2024

9.6 EY Control Findings 2024-34 Long-term Plan Process

Kaituhi | Author: Sharon Foss, Manager Risk and Assurance

Kaiwhakamana | Authoriser: Steffi Haefeli, Acting Group Manager Corporate Services

Te pūtake | Purpose

1 This report summarises the matters identified by Council’s Auditors, Ernst and Young (EY) during their audit of the Long-Term Plan 2024-34 and outlines how the matters raised will be addressed.

He whakarāpopoto | EXecutive summary

2 Not required.

Te tuku haepapa | Delegation

3 The Risk and Assurance Committee has the delegated authority to consider this matter in line with section C.3 of the Governance Structure and Delegations for the 2022-2025 triennium which state the committee has the delegation to:

· Review and maintain the internal control framework

· Obtain from external auditors any information relevant to Council’s financial statements and assess whether appropriate action has been taken by management in response to the above.

Taunakitanga | RECOMMENDATIONS

A. That the Risk and Assurance Committee receives this report and notes that management accepts the Ernst & Young Long-term Plan 2024-34 Report on Control Findings.

Tūāpapa | Background

4 EY, in their role as Council’s external auditors, reviewed the process used to develop the Long-Term Plan for 2024-34 and associated Consultation Document. Their input acts as Council’s ‘fourth line of defence’ and is valuable feedback for the development of Council’s processes when preparing the next Long-Term Plan. EY have shared their observations, attached as Appendix 1 to this report, directly with management, which was a useful opportunity to hear directly from the auditors on areas for improvement when developing the next Long-Term Plan. They also acknowledged the hard work and dedication of the Council team involved in the process.

5 Each observation made by EY is attributed a risk ranking. The ranking system for the Long-Term Plan audit uses an amended risk descriptor and definition to that previously used by Council’s auditors in order to reflect the three-year cycle. The rankings are noted below:

Ernst & Young – Risk Ranking System for Long-Term Plan Audit
High: needs significant improvement	These recommendations relate to a serious weakness which exposes the Council to a material extent in terms of achievement of Council’s objectives, key performance measures or may otherwise impair the Council’s reputation.
Moderate: needs substantial improvement	A control weakness, which can undermine the system of internal control and/or operational efficiency and should therefore be addressed.
Low: needs some improvement	A weakness which does not seriously detract from the system of internal control and/or operational effectiveness/efficiency, but which should nevertheless be addressed by management.

He kōrerorero | Discussion

6 The management letter presents six findings that highlight weaknesses in Council’s first line of defence (controls). The findings highlighted key areas for improvement, such as the forecasting model, processes and procedures used for the development of the consultation document, the content of the Long-Term Plan document and other significant matters that will be helpful for future Long-Term Plan processes.

7 The process of EY issuing a report on control findings is an opportunity for Council’s external assurance provider to assist Council to improve preparation for the next Long-Term Plan. The six control findings and recommendations from EY have been accepted in full and are noted below:

Risk Ranking	EY No.	Long Term Plan 2024-34 Control Findings	Status as at 7 November 2024
Risk Ranking	EY No.	Long Term Plan 2024-34 Control Findings	EY finding	Council response
Moderate	2.1.1	Overall project management and timetabling	New	Accepted
Moderate	2.1.2	Consultation issues, providing the right debate and the readability of the consultation document	New	Accepted
Moderate	2.1.3	Infrastructure Strategy and Finance Strategy	New	Accepted
Low	2.2.1	Approach to finance modelling	New	Accepted
Low	2.2.2	Regular maintenance of asset management plans and linkage to forecasting documents	New	Accepted
Low	2.2.3	Key project costing	New	Accepted

8 The Group Manager Corporate Services will maintain corporate oversight of how the control findings provided by EY are considered and resolved in preparation for the next Long-Term Plan.

9 These actions will be incorporated into the 2027-37 Long-Term Plan scope and will be reported on alongside other EY control findings to this Committee. EY have commented that they will consider progress as part of the audit for the 2027-37 Long-Term Plan.

He take | Issues

10 There are no additional issues arising from this report.

Ngā kōwhiringa | Options

11 There are no options arising from this report.

Mana whenua

12 There are no tangata whenua considerations arising from this report and mana whenua have not been consulted in relation to this report – as it is procedural.

Panonitanga Āhuarangi me te Taiao | Climate change and Environment

13 There are no climate change issues arising from this report.

Ahumoni me ngā rawa | Financial and resourcing

14 There are no financial considerations in addition to those already discussed in this report.

Tūraru ā-Ture me te Whakahaere | Legal and Organisational Risk

15 There are no legal and risk issues arising directly from this report. The control findings reflect corrective measures recommended to strengthen Council’s first line of defence in relation to its Long-Term Plan processes. None of the findings have been considered as high risk.

Ngā pānga ki ngā kaupapa here | Policy impact

16 There are no policy considerations in relation to this report.

TE whakawhiti kōrero me te tūhono | Communications & engagement

Te mahere tūhono | Engagement planning

17 The report has a low level of significance under the Council’s Significance and Engagement Policy and no engagement is triggered.

Whakatairanga | Publicity

18 This report and appendices will be publicly available through the agenda for the Risk and Assurance Committee meeting.

Ngā āpitihanga | Attachments

1. EY Report to Management for the LTP 2024-34 ⇩

Risk and Assurance Committee Meeting Agenda

21 November 2024

11 Te Whakaūnga o Ngā Āmiki Kāore e Wātea ki te Marea | Confirmation of Public Excluded Minutes

Nil

12 Purongo Kāore e Wātea ki te Marea | Public Excluded Reports

Resolution to Exclude the Public

PUBLIC EXCLUDED ReSOLUtion

That, pursuant to Section 48 of the Local Government Official Information and Meetings Act 1987, the public now be excluded from the meeting for the reasons given below, while the following matters are considered.

The general subject matter of each matter to be considered while the public is excluded, the reason for passing this resolution in relation to each matter, and the specific grounds under section 48(1) of the Local Government Official Information and Meetings Act 1987 for the passing of this resolution are as follows:

General subject of each matter to be considered

Reason for passing this resolution in relation to each matter

Ground(s) under section 48 for the passing of this resolution

12.1 - Litigation and External Investigations Report

Section 7(2)(a) - the withholding of the information is necessary to protect the privacy of natural persons, including that of deceased natural persons

Section 7(2)(c)(i) - the withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information, or information from the same source, and it is in the public interest that such information should continue to be supplied

Section 7(2)(g) - the withholding of the information is necessary to maintain legal professional privilege

Section 48(1)(a)(i) - the public conduct of the relevant part of the proceedings of the meeting would be likely to result in the disclosure of information for which good reason for withholding would exist under section 6 or section 7


RĀRANGI TAKE AGENDA Te Komiti Whakamauru Tūraru \| Risk and Assurance Committee Meeting
I hereby give notice that a Meeting of the Te Komiti Whakamauru Tūraru \| Risk and Assurance Committee will be held on:
Te Rā \| Date:	Thursday, 21 November 2024
Te Wā \| Time:	9.30am
Te Wāhi \| Location:	Council Chamber Ground Floor, 175 Rimu Road Paraparaumu
Mark de Haast Group Manager Corporate Services

Mr David Shand	Chair
Mayor Janet Holborow	Member
Deputy Mayor Lawrence Kirby	Member
Cr Liz Koh	Member
Cr Jocelyn Prvanov	Member
Cr Glen Cooper	Member
Mr David Cochrane	Member