Minutes of Risk and Audit Committee - Wednesday, 1 May 2024

1. Welcome/Karakia /Apologies

The Chair welcomed everyone to the meeting and the group offered a karakia.

2. Conflict of interest declarations

There were no conflicts of interest declared.

3. Confirmation of Minutes of the Risk and Audit Committee held on 15 February 2024

Resolution

Minutes of the Risk and Audit Committee held on Thursday, 15 February 2024, a copy having been circulated prior to the meeting, were taken as read and confirmed as a true and correct record.

Harding/Mackintosh

CARRIED

Treasury Compliance Report for the period 1 January - 31 March 2024

Susie Young introduced the item, and Chris Comber and Tracey O highlighted:

· Finalising details of Council’s credit rating application with the HBRC-appointed credit rating agency Fitch and expect that the credit rating will be issued in the week of 6 May and will give Council a discount of up to 20 basis points.

· Short term (0-3 years) external debt is quite high and waiting to roll that over to longer term after the credit rating is issued to achieve up to $50k per year savings in interest.

· Insurance claims of ~$15M are expected to be paid in meantime so that will bring down the amount of short term debt as well.

· Silt and Debris funds from Central Government being held by Council have not been included in the compliance ratios and will be fully utilised by the end of June.

· Floating and fixed interest rate decisions are managed at an operational level with the assistance of PWC

Councillor Thompson Hokianga arrived at 9.19am

· The Capital Protected Amount (protecting 2% of capital) has been in place since the fund was created and it was queried whether the fund could be reinvigorated for greater returns. HBRIC is bound by the SIPO in relation to investment settings which reflect Council’s decisions. HBRIC is now mandated to deliver the returns set by Council in the letter of expectations.

· From a risk perspective, this may warrant further discussion by RAC at a future meeting.

RAC20/24

Resolution

That the Risk and Audit Committee receives and notes the Treasury Compliance Report for the period 1 January – 31 March 2024.

Maloy/Mackintosh

CARRIED

Health, Safety and Wellbeing update

Kirsty McInnes and Nancy Barlow spoke to the item, which was taken as read. Discussions covered:

· Thanks to staff for the comprehensive report.

· The one-page risk management plan for Health, safety, resilience and wellbeing of people included as an attachment to the paper, does not include the details of every single initiative, action or mitigation which are covered in the more detailed information underlying the one-pager, which is a live document.

· Staff mental wellbeing initiatives have been extended to a wholistic view that includes whanau and considers the whole person.

· The last staff survey responses reflected higher staff engagement ratings.

· Staff surveys, exit interview data and staff turnover data are useful for monitoring the effectiveness of health, safety and wellbeing initiatives.

· There’s been an increase in incident reporting, which is seen as a positive that reflects staff being actively involved in health and safety.

· Bullying, harassment and workload pressures are rated amber on the risk management plan and constantly being monitored. Because the risk is amber does not mean that there is an issue or an increase in incidents but rather that it’s an area of focussed monitoring and activity/mitigations.

· Questions were raised about how RAC can get assurance in terms of the monitoring data that’s reported to it, and it was suggested that the detail contained in the Organisational Performance dashboard should provide that.

· It was noted that reporting needs to state that HBRC is compliant with legislation – as the minimum standard.

· Regular updates on the transition to ISO45001 will be provided through the one-page risk management plan and the assurance dashboard updates. The timeframe for becoming ISO certified is over the next 1-2 years and is incorporated into the HSW team’s work plan.

· Although the ACC ‘product’ no longer exists, the WSMP standards are still relevant and meeting those meets the requirements of the Health & Safety at Work Act.

RAC21/24

Resolutions

That the Risk and Audit Committee:

1. Receives and considers the Health, Safety and Well-being update staff report.

2. Confirms that the actions taken to address the ECAAS Certification Gap Analysis findings are adequate in the circumstances explained.

Maloy/Harding

CARRIED

Enterprise Assurance update

Susie Young introduced Olivia Giraud-Burrell and the item, which was taken as read, covers the status of audit recommendations as well as the 2023-24 and proposed 2024-25 internal audit programme. Discussions covered.

· Section 17a reviews (2) and benchmarking revenue and staffing against other councils are currently being scoped by ELT

· There was a s17a review of the Works Group in 2019-20 and all corrective actions have been completed and closed. Works Group is now ‘part of’ the Asset Management Group, is ISO9001 certified and their financials included in the quarterly financial reports that go to Corporate and Strategic.

· In terms of RAC, the focus needs to be on corrective actions or reviews that are not on track to be efficient.

· The SEAM (asset module of TechOne) project is currently looking at solutions to integration issues between financial and day-to-day operational management within the system and has been extended to include Works Group.

· It was suggested that the assurance universe needs to include potential s17a reviews.

RAC22/24

Resolutions

That the Risk and Audit Committee

1. Receives and notes the Enterprise Assurance update staff report.

2. Confirms that the Internal Assurance Corrective actions update report has provided adequate information on the status of the Internal Assurance Corrective Actions.

Maloy/Harding

CARRIED

The meeting adjourned at 10.35am and reconvened at 10.50am

Risk Management update

Susie Young introduced the item and David Nalder, Acting Risk Manager. Discussions covered:

· A procurement probity check of the Silt and Debris taskforce contracting processes found no material issues.

· Background and context is provided that reflects the fundamental role of the RAC to ensure there’s an effective system of risk management in use within the Council and secondly, to define what the RAC’s stance is on what the critical risks are and ensuring the critical risks are effectively managed.

· Key findings of the OAG review of risk management in local government are provided to assist RAC to assess whether there’s an effective system of risk management in place.

· Slide 6 of the attachment outlines what good looks like, mapped to what HBRC is doing – current focus and next steps.

· A review to validate HBRC’s strategic risk profile found that common risk themes identified by other organisations were all reflected in our Enterprise Dashboard (strategic risk profile) or one-page management plans (risk assessments).

· The Enterprise Risk Dashboard has been updated to deliberately reflect the language used in the Long Term Plan and map to the Council’s 6 groups of activities.

· Effectiveness of Cyclone Gabrielle recovery (statement 5) has been removed from the risk profile as it was a ‘point in time’ and replaced with a re-worded statement 5 – effectiveness of (HBRC EOC) emergency management and a new risk statement 22 – effectiveness of North Island Weather event resilience programme.

· Divergent views amongst councillors is natural however it is important to understand if that is not driven by the diversity of the people themselves.

· The new risk framework is fairly well embedded across the business however the assurance landscape is still quite complicated and work will be undertaken by the CE, Risk Manager and GM Corporate Services to simplify the layers of assurance to enable the RAC to understand it to the extent they need to, to focus on the things that are critical.

· Deep dives on ‘understanding the expectations and needs of the communities we serve’ and ‘effectiveness of governance and partnerships’ will be scheduled – inadvertently left off the schedule in today’s agenda.

· Council’s risk appetite statement (in effect, an agreement between Council and ELT around the parameters within which ELT can operate and make risk-based decisions and the lines between which – inside or outside of agreed risk appetite position – it needs to be escalated to Council) needs to be updated, however it’s not straight forward and a process for how that is done needs to be determined first. The LTP effectively sets the bookends of the risk appetite.

· View expressed that there’s not enough of a focus on the risks associated with business decision-making at the operational level in terms of sustainability and the ability for customers to pay, e.g. rates rises. In response it was explained that those risks are contained within the risk statements and not all in one place.

· The HB CDEM Group Joint Committee is the body legislated to provide oversight of the actions/changes made in response to the recommendations of the Bush report on the HB CDEM Group response to Cyclone Gabrielle, and HBRC will receive updates on progress from the Joint Committee. The oversight provided by HBRC will be of the findings and recommendations that relate to HBRC’s functions only.

· For the recommendations that come out of the review of HBRC’s flood and drainage scheme performance, again as relate to HBRC’s functions and activities, RAC will provide oversight and receive updates through the Assurance programme.

RAC23/24

Resolution

That the Risk and Audit Committee receives and considers the Risk Management update staff report.

Harding/Mackintosh

CARRIED

Incident report - Payroll Holidays Act compliance

Resolution

That the Risk and Audit Committee excludes the public from this section of the meeting, being Agenda Item 8 Incident report - Payroll Holidays Act compliance with the general subject of the item to be considered while the public is excluded. The reasons for passing the resolution and the specific grounds under Section 48 (1) of the Local Government Official Information and Meetings Act 1987 for the passing of this resolution are:

RAC24/24

General subject of the item to be considered

Plain English reason for excluding the public

Rationale

Grounds under Section 48 (1) for the passing of the resolution

Incident report - Payroll Holidays Act compliance

s7(2)(g) Excluding the public is necessary to prevent disclosure of information that is legally privileged.

s7(2)(i) Excluding the public is necessary to enable the local authority holding the information to carry out, without prejudice or disadvantage, negotiations (including commercial and industrial negotiations).

The information contained in this paper may result in both industrial negotiations with affected staff members and commercial negotiations with the vendor of the TechOne product. The premature disclosure of information contained in the paper may prejudice the position of HBRC in such negotiations.

The paper also contains information derived from legal advice provided by in-house and external counsel. Inclusion of such material in public-facing papers is likely to prejudice the free-flow of information and advice in-confidence with HBRC’s legal advisors.

While there may be public interest in this matter, as it relates to the expenditure of public monies, such public interest is unlikely to outweigh the justifications for withholding the information. The public interest may be satisfied by the matter being reported on, with legally privileged material removed or redacted once the public disclosure of these matters would not affect these industrial and commercial positions. Moreover, relevant disclosures of these matters will be made to the appropriate unions, satisfying the need to ensure accountability in HBRC’s dealings with staff.

The Council is specified, in the First Schedule to this Act, as a body to which the Act applies.

Maloy/Harding

CARRIED

Strategic risk deep dives

Resolution

That the Risk and Audit Committee excludes the public from this section of the meeting, being Agenda Item 9 Strategic risk deep dives with the general subject of the item to be considered while the public is excluded. The reasons for passing the resolution and the specific grounds under Section 48 (1) of the Local Government Official Information and Meetings Act 1987 for the passing of this resolution are:

RAC25/24

General subject of the item to be considered

Plain English reason for excluding the public

Rationale

Grounds under section 48(1) for the passing of the resolution

Strategic risk deep dives

s7(2)(j) to prevent disclosing information that could be used for improper gain or improper advantage.

To prevent information about Council’s critical controls being accessed.

The public interest is protected by not allowing the information to be accessed by anyone outside the organisation.

The Council is specified, in the First Schedule to this Act, as a body to which the Act applies.

Maloy/Hokianga

CARRIED

The meeting went into public excluded session at 11.40am and out of public excluded session at 12.30pm

Closure:

There being no further business the Chair declared the meeting closed at 12.30pm on 1 May 2024.

Signed as a true and correct record.

Date: by Risk & Audit Committee resolution 31 July 2024 Chair: Stephanie Maloy