The Governance & Audit Committee of Carmarthenshire Council met on Friday, 6 March 2026, to review the Council's financial and risk management arrangements. Key discussions included the Audit Wales Annual Audit Summary 2025, the Council's Corporate Risk Register, and updates on internal audit plans and recommendations. The Committee also received reports on the National Fraud Initiative and minutes from various supporting groups.

Audit Wales Annual Audit Summary 2025

The Committee received the 2025 Audit Wales Annual Audit Summary, which outlined completed audit work for Carmarthenshire County Council. The summary indicated that the Council's accounts were properly prepared and materially accurate, with an unqualified audit opinion issued. However, performance audit work highlighted that there remained scope to strengthen how the Council identifies the most significant risks to achieving its strategic objectives. Recommendations were made to improve risk identification, management, monitoring, and reporting. The outstanding work from the Audit Plan was expected to be completed by June 2026. Members thanked officers for their work in preparing the annual accounts.

Audit Wales Work Programme Update

The Committee reviewed the Audit Wales Work Programme and Timetable quarterly report as at 31 December 2025. This report provided an overview of ongoing audit work relevant to Carmarthenshire County Council, including financial and performance audits. The Committee noted the update.

Audit Wales Report: Review of Corporate Risk Management Arrangements

Audit Wales presented its review of Carmarthenshire County Council's corporate risk management arrangements, conducted between March and May 2025. The report identified areas for improvement in risk identification, management, monitoring, and reporting, and in the Council's evaluation of its arrangements. Four recommendations were made, superseding previous ones. The Council's management response outlined planned actions, including strengthening risk descriptions, enhancing horizon scanning, improving the use of data for risk assessment, clarifying risk appetite and escalation processes, and demonstrating understanding of partner risks. The Head of Revenue and Financial Compliance agreed to provide a progress update in March 2027. The Committee approved the Council's response to the recommendations.

Internal Audit Plan Update 2025/26

An update on the implementation of the Internal Audit Plan for 2025/26 was presented, showing a completion rate of 74% against a target of 80%. Due to a vacancy within the team, the Committee approved the deferral of the Cyber Security and Risk Management reviews to the 2026-27/2027-28 audit plan. The VAT Internal Audit report was also noted, indicating no recommendations for action.

Internal Audit Recommendations

The Committee received an update on the progress of Internal Audit recommendations from the 2024/25 financial year. The report detailed the status of outstanding and off-target actions, including issues related to creditor payments, staffing matters, Net Zero Carbon training, foster care payments, light plant and handheld equipment asset management, property concessions, and the management of school balances.

Internal Audit Strategy and Audit Plan 2026/27

The Committee considered the proposed Internal Audit Strategy and Audit Plan for 2026/27, along with the planned coverage for 2026-2029. The plan was compiled considering the Council's Corporate Risk Register and Service Risk Registers to ensure appropriate coverage of high-priority risks. The strategy was amended to include an action on value-for-money under enhance efficiency and to note the inclusion of informal meetings between members and auditors for transparency. The Committee supported recruitment for the department, acknowledging it was currently under-resourced. The Internal Audit Strategy and Plan for 2026/27 were approved, and the planned coverage for 2026-29 was confirmed.

Carmarthenshire County Council's Corporate Risk Register 2025/26

The Committee reviewed the Corporate Risk Register, which identifies strategic risks facing the Council. No risks were removed from the register, but the risk score for CRR190084 – Demographic and demand risk – decreased. The Committee requested clarification on the risk score reduction and amendments to the wording of the Education risk to better reflect its seriousness. The Corporate Risk Register was received.

National Fraud Initiative (NFI) 2024-25

The Committee received a report on Carmarthenshire County Council's participation in the National Fraud Initiative (NFI) 2024-25. The report detailed data matching activities, investigations, and outcomes, including financial savings and process improvements. No confirmed fraud cases were identified, and only minimal error/overpayment cases were found, which were resolved through standard procedures. The outcomes provided positive assurance regarding the effectiveness of internal controls. The report also highlighted areas for improvement, such as strengthening data mapping and quality checks. The Council's participation and approach were commended.

Governance & Audit Committee Action Log

The Committee reviewed the Action Log, which details actions to be monitored from previous meetings. A verbal update was provided on budget challenges facing schools, the establishment of an Intervention Board, and the progress of the Risk Register In-Depth Review. The Committee noted the progress and concerns regarding some schools' non-participation in deficit reduction efforts.

Governance & Audit Committee Forward Work Programme

The Committee considered its Forward Work Programme for the upcoming year, outlining expected agenda items. A member training session on managing risk was agreed to be scheduled for the Autumn. The Forward Work Programme was received, subject to the inclusion of this training.

Minutes of Relevant Groups

The Committee received minutes from the Grants Panel (5 September 2025 and 18 December 2025) and the Risk Management Steering Group (18 December 2025).

Minutes of Previous Meetings

The minutes of the Governance and Audit Committee meetings held on 12 December 2025 and 19 December 2025 were signed as a correct record.

Exclusion of Public

The Committee resolved to exclude the public from the meeting for specific agenda items due to the presence of exempt information, as defined by the Local Government Act 1972.

Audit Wales Report: Cyber Security Arrangements

The Committee received the Audit Wales report on Cyber Security Arrangements (September 2025). The review assessed the Council's cyber resilience against the National Cyber Security Centre's (NCSC) 10 Steps to Cyber Security. The Committee noted the findings and recommendations, along with the Council's planned actions. An update report on cyber security measures and investments was requested for July 2026.

Internal Audit Report - Safeguarding

The Committee received an Internal Audit report on Safeguarding, which assessed procedures for new staff to ensure the protection of vulnerable individuals and progress on addressing issues identified in a previous Audit Wales review of Corporate Safeguarding. The Committee considered the findings and recommendations, noting that subsequent considerations would be overseen by the Corporate Safeguarding Board.

Risk Register In-Depth Review: School Balances

The Committee received a report on the in-depth review of Corporate Risk CRR190019 concerning School Balances. Members expressed dissatisfaction with the limited information provided and the absence of representation from the Education & Leisure management team. They requested a further report and an extraordinary meeting with the Director of Education & Leisure to address the significant school budget deficits.

Progress Update on Light Plant and Handheld Equipment Asset Management

A progress update on the Light Plant and Handheld Equipment Asset Management Internal Audit Report was presented. The Committee acknowledged the considerable work completed despite delivery taking longer than initially anticipated due to the scale and complexity of operational services. The progress update was received.