The Audit, Risk and Governance Committee of Lancashire County Council met on Monday 13 October 2025 to review external and internal audit progress, discuss the council's risk management strategy, and examine the corporate risk and opportunity register. Key decisions included the approval of the new Risk Management Strategy and the updated Corporate Risk and Opportunity Register.

External Audit Progress Report and Sector Update

Ian from Grant Thornton provided an update on the external audit progress for both the council's financial statements and the Lancashire County Pension Fund. The audit of the financial statements was on track, with detailed testing expected to conclude by late October or early November. The value for money work was also nearing completion. The report highlighted the upcoming establishment of a new Local Audit Office from April 2026, intended to reform the local audit system. Members discussed audit fees, the complexity of public sector reporting, and the new IFRS 16 accounting standard for leases, which requires most leases to be brought onto the balance sheet. The council's finance team confirmed that while there wasn't a problem with the lease register, information was being collated differently for IFRS 16 compliance. The value of leases identified was generally considered not material to the accounts, though adjustments were being made for PFI-related leases. Discussions also touched upon land leases and the process for reviewing them.

Internal Audit Progress Report

Andrew Dalecki, Head of Internal Audit, presented the quarterly progress report. As of 23 September 2025, 26% of the planned audit assignments for the year had been completed and reported. Of the 13 audits finalised since the last meeting, two received a limited assurance rating: payroll and St. Bede's Catholic High School.

The limited assurance for payroll was primarily due to a significant weakness in overtime payment controls, which allowed individuals to change their pay rates for overtime claims without sufficient justification. While core payroll processing was functioning well, an issue was identified where individuals made changes when not needed, and recovery of overpayments was ongoing. Investigations were underway to determine if this constituted fraud or required disciplinary action. Another ongoing issue highlighted was overpayments due to late notifications of employee leavers, which had impacted the assurance rating.

St. Bede's Catholic High School received limited assurance due to weaknesses in procurement, budget monitoring, clerking arrangements, and purchase controls. Other audits generally provided positive or substantial assurance. The report also detailed progress against the audit plan, including completed and outstanding assignments.

Risk Management Strategy

Hannah Race, Head of Governance, presented a proposed new Risk Management Strategy for approval. The strategy aimed to provide clearer, more accessible guidance for officers, aligning with best practice and internal audit recommendations. Key changes included a clearer definition of principles, objectives, approach, and control framework, a more defined approach to risk appetite, and a step-by-step risk management process. The strategy also enhanced the requirement for officers to identify and report fraud risks and improved integration with other corporate governance processes, with a stronger emphasis on horizon scanning. The development of a formal risk appetite statement was ongoing, with a target completion date of March 2026. The committee approved the new strategy.

Corporate Risk and Opportunity Register – Quarterly Update

Hannah Race also presented the updated Corporate Risk and Opportunity Register. The risk score for recruitment and retention had decreased to 8, reflecting improved vacancy rates and a reduction in agency spend. Despite this improvement, the risk would continue to be monitored due to its critical impact on service delivery. A new risk, Council Improvement Plan, was identified and added to the register, reflecting significant organisational challenges in service improvement, financial sustainability, and organisational effectiveness. The register indicated that the risk score for Adult Social Care Demand remained at 16, with a target score of 9 by March 2026, and the direction of travel was static. The risk associated with SEND Demand also remained at 16, with a target score of 16, indicating no expected improvement in the short term. The committee requested a deep dive into the School Places risk for a future meeting. The committee approved the updated Corporate Risk and Opportunity Register.

The meeting also included discussions on the external audit progress report, internal audit findings, and the council's risk management framework. The committee approved the minutes of the previous meeting and noted the progress reports from both external and internal auditors. The date of the next meeting was set for Monday, 26 January 2026.