Audit, Risk and Improvement Committee - 13 May 2025 9:30 AM

Key decisions

• Confidential session held for audit and internal risk matters
  The committee moved into confidential session to consider the external audit engagement plan, the Q3 internal audit status and draft Section 10.7 certificate report, and revised internal audit plans because they involved internal audit program details, information security risks, and internal risk management matters.
  Most detailed discussion was withheld from the public because of security and risk-management concerns, limiting immediate public visibility of the underlying reports.
• External audit engagement plan noted
  Council noted the 2024-2025 External Audit Engagement Plan prepared by the Audit Office of New South Wales for the year ended 30 June 2025.
  This supports oversight of council finances and governance for the current financial year.
• Internal audit recommendations reviewed and some closed
  The committee noted the Internal Audit Status Report and Q3 2024-2025 recommendations report, endorsed closing 8 internal audit recommendations, and endorsed modified recommendations and management actions in the draft Section 10.7 Certificates internal audit report, including acceptance of one low-risk finding.
  This affects how council tracks and resolves governance, compliance, and internal control issues.
• Future internal audit reporting format changed
  The committee requested that management comments and risk evaluation be included in draft internal audit reports and that future reporting be split into a quarterly status report and a separate internal audit report.
  This may make future audit reporting clearer and improve accountability.
• Revised internal audit plans endorsed
  The committee endorsed revised internal audit plans for 2024/25 and 2025/26, and the revised four-year internal audit plan for 2024-2028.
  This sets the program for future internal reviews of council systems, risks, and controls.
• Additional quarterly risk reporting requested
  The committee requested investigation of a system to show progress on mitigating actions in quarterly risk updates and requested a summary of key high risks in quarterly reports to track progress.
  Residents may see clearer reporting on major council risks and how they are being managed.

Important topics

• Information security and internal risk management
  Confidential treatment was justified partly because the reports contained information about internal audit programs, information security risks and vulnerabilities, and internal risk management matters.
  These issues relate to protection of council systems and continuity of public services.
• Draft Delivery Program and Operational Plan listed later in agenda
  The meeting changed the order of business to deal with Report 7.3 next, and the extracted minutes also list the Draft Delivery Program 2025-2029 and 2025/26 Operational Plan, Budget, and Revenue Policy plus the 2024/25 Quarter 3 Operational Plan report, but no decision text for those items is provided in the extract.
  These are major planning and budget documents, but the provided extract does not show any confirmed resolution on them.

Resident impacts

• Council's external and internal audit oversight for 2024-25 progressed.
• Eight internal audit recommendations were approved to be closed.
• Future quarterly risk updates are expected to include clearer tracking of mitigation actions and key high risks.
• Some audit and risk matters remained confidential due to security and internal risk concerns.

Places affected

• Mullumbimby (town)
  Meeting held in the Conference Room, Station Street, Mullumbimby.
• Station Street, Mullumbimby (road/facility location)
  Meeting venue location named in the minutes.

Next steps

• Implement the noted external audit engagement plan for the year ending 30 June 2025
  2024-2025 financial year
• Close the 8 endorsed internal audit recommendations from Q3
  Following the meeting
• Revise future internal audit reports to include management comments and risk evaluation, and split status and audit reports
  For future reporting cycles
• Apply the revised internal audit plans for 2024/25, 2025/26, and the 2024-2028 four-year period
  Ongoing
• Investigate a system to show progress of mitigating actions and include summaries of key high risks in quarterly risk updates
  Before future quarterly risk reports

Extracted minutes text

Minutes of Meeting Audit, Risk and Improvement Committee Meeting Venue Conference Room, Station Street, Mullumbimby Date Tuesday, 13 May 2025 Time 9:30 AM BYRON SHIRE COUNCIL AUDIT, RISK AND IMPROVEMENT COMMITTEE MEETING MINUTES 13 MAY 2025 A R I C A u d i t , R i s k a n d I m p r o v e m e n t C o m m i t t e e M e e t i n g p a g e 3 Minutes of the Audit, Risk and Improvement Committee Meeting held on Tuesday, 13 May 2025 File No: I2025/700 PRESENT: Councillors: Cr E Hauge Present Independent Members: Peter Sheville (Chairperson) Present Melissa Jacobs Present Alan Pigott Present Staff: Mark Arnold (General Manager) Esmeralda Davis (Director Corporate and Community Services) Present Phil...