The Greater Manchester Combined Authority (GMCA) Audit Committee met on Monday 21 September 2026 to review its annual reports, discuss risk management and cyber security, and receive updates on internal and external audits. Key decisions included endorsing the Audit Committee's Annual Report for 2025/26 and recommending its approval by the Combined Authority, and noting the progress and challenges in the internal audit plan, particularly concerning overdue ICT actions.

Annual Report of the Audit Committee for 2025/26

The committee considered its Annual Report for 2025/26, which summarised the work undertaken during the year and the assurance provided to support the Combined Authority's governance arrangements. Members welcomed the report as an accurate reflection of the municipal year and endorsed its recommendations. The report was recommended to the Combined Authority for approval.

Annual Report of the Joint Audit Panel (Police and Crime)

Joanne Downs, Chair of the Joint Audit Panel, presented the Panel's Annual Report for 2025/26. The report outlined the Panel's work in strengthening oversight and assurance for Greater Manchester Police (GMP). Members noted the Panel's effective use of the risk register and welcomed the planned effectiveness review for January 2027. The committee resolved to note the update from the Joint Audit Panel and to update the work programme to align TfGM's annual update with that of GMP's.

Cyber Security Deep Dive

A presentation was given on cyber security, highlighting the evolving threat landscape and the increasing risks associated with ransomware, phishing, supply chain vulnerabilities, and the use of artificial intelligence by threat actors. Members were advised that significant progress had been made through the Cyber Security Programme, aligning with the National Cyber Security Centre Cyber Assessment Framework, and that a recent internal audit review had provided a Reasonable Assurance opinion. The committee resolved to note the update and to schedule a future Deep Dive focused on scrutiny of resilience outcomes for inclusion in the work programme for the 2027/28 municipal year.

Governance Review Update

An update was provided on the implementation of the Governance Review Programme, which aims to strengthen governance, performance oversight, and accountability arrangements for the Greater Manchester Strategy. Members welcomed the increased focus on assurance, accountability, and performance reporting. The committee resolved to note the update.

Risk Management Update

The committee received an update on risk management activities. Members queried the practical operation of the proposed corporate risk appetite framework and wider review of the Risk Management Framework. Officers advised that a corporate approach to risk appetite was being developed, which would define acceptable risk levels and support consistent decision-making. The committee resolved to note the update and that the development of the corporate risk appetite framework and the implementation of the revised risk register and dashboard would be included in future updates.

Internal Audit Progress Audit Action Tracking Report

Consideration was given to a report detailing progress in delivering the 2026/27 Internal Audit Plan and implementing agreed audit actions. Concerns were raised regarding the number of overdue GMFRS audit actions, which officers attributed to an increase in project scope. Measures to strengthen management oversight of audit recommendations, including dashboards and reporting tools, were noted. Members also requested further information on the ICT remediation programme. The committee resolved to request future updates on Internal Audit resourcing, the organisation's assurance framework, overdue GMFRS audit actions, and the Digital Remediation Programme.

Treasury Management Update

The committee received an update on treasury management activity during the first quarter of 2026/27. All treasury management activity had been undertaken in accordance with the approved Treasury Management Strategy and Prudential Indicators, and the Authority had operated within approved borrowing and investment limits. The committee resolved to note the report.

External Audit Progress Update

The committee received an update from the external auditors on progress in delivering the 2025/26 audit programme. Work was progressing across the Group, with differing stages of completion for GMP, TfGM, and the GMCA Group accounts. The committee resolved to note the update.

Audit Committee Work Programme

The committee noted the Audit Committee Work Programme for 2026-27 and resolved to add a future transport update to the programme.

Dates and Times of Future Meetings

The calendar of future committee meetings was noted.

The meeting also included a cyber security deep dive, which was discussed in detail, and a governance review update. Decisions were made to note updates and to request further information on specific areas, with a commitment to future reporting. No tax changes were discussed at this meeting.