Audit, Risk and Improvement Committee - 7 Sep 2026 6:00 PM

Topics

• Wanneroo committee pushes updated enterprise risk policy towards adoption
  The City is updating its organisation-wide risk policy to align with ISO 31000:2018 and its risk appetite framework.
  The policy could affect how the council manages risks across services, projects and decisions, but still requires further committee consideration.
• Wanneroo compliance return heads to Council after split committee vote
  The committee recommended adoption of the 2025 annual compliance return, with the second part passing only after the Presiding Member broke a 4–4 tie.
  The return covers statutory compliance and includes follow-up on procurement-contract reasoning and primary-return obligations.
• Audit committee retains oversight of Wanneroo’s higher-risk audit actions
  Wanneroo’s audit committee accepted closure of 19 action items and two sub-items while retaining oversight of extreme-, high- and moderate-risk matters.
  The decision sets the council’s ongoing public-governance structure for monitoring significant audit risks, although detailed findings remain confidential.

Decisions

• Updated Enterprise Risk Management Policy advanced
  The committee considered an extensively reviewed Enterprise Risk Management Policy aligned with AS ISO 31000:2018, the City’s risk appetite statements, risk assessment criteria and Enterprise Risk Management Framework. The policy is to be recommended to the Policy Review Committee for adoption.
  The policy will guide how the City identifies and manages risks across services, projects and decisions, but it was not adopted at this meeting.
• Risk appetite and assessment documents advanced to Council
  The committee considered updated Risk Appetite Statements, Risk Assessment Criteria and Matrix, and a Risk Roadmap, with the documents to be recommended to Council for endorsement.
  These documents set the level and type of risk the City is prepared to accept when pursuing its objectives and delivering services.
• 2025 Annual Compliance Audit Return recommended for adoption
  The committee recommended that Council adopt the Local Government Annual Compliance Audit Return for 1 January to 31 December 2025 and receive the recommendations from the related internal audit. The first recommendation passed 7–1. The second passed after a tied 4–4 vote was resolved by the Presiding Member’s casting vote in favour.
  The return records the City’s compliance with local-government obligations and identifies areas requiring correction or clarification.
• Internal audit oversight arrangements accepted
  In confidential session, the committee received and accepted the September 2026 Internal Audit Progress Report, updated audit log and Paxon review. It accepted validation of 19 action items and two sub-items for closure, supported six-monthly reporting in March and September, and retained committee oversight of extreme-, high- and moderate-risk audit items while the CEO oversees low-risk items.
  The arrangement is intended to ensure significant audit issues remain under committee scrutiny while lower-risk matters are managed administratively.
• Contract and lease status report brought forward
  The committee brought forward the Contract Status and Unexecuted Lease Report for consideration. The supplied extract describes red, amber and green contract-status categories and includes a list of approved leases not yet executed, but does not provide individual contract or lease outcomes.
  Contract performance and lease execution can affect the delivery of City services and use of public assets, although no specific affected contract or lease is identified in the extract.

Discussion

• Enterprise risk management
  Administration reviewed the City’s risk policy to align it with ISO 31000:2018, the City’s risk appetite statements, risk criteria and enterprise risk framework.
  The policy will influence risk controls and decision-making across City operations if adopted.
• Compliance audit follow-up
  Paxon assessed the 2025 compliance return against 98 questions. Two matters were highlighted: reviewing the response to question 2934 on entering multiple contracts rather than one contract, and reviewing question 2021 on primary returns lodged by relevant persons.
  The matters concern procurement decision-making and statutory declaration obligations within local government.
• Confidential internal-audit reporting
  The internal-audit report was considered confidentially because public release could endanger the security, including cyber-security, of City property or operations.
  The committee’s public resolution confirms ongoing oversight of significant audit risks, but the detailed audit findings were not released.

Impacts

• The updated risk policy and risk appetite documents may change how the City assesses and manages risks, subject to consideration by the relevant committee and Council.
• The City’s 2025 compliance return will proceed to Council for adoption, with two compliance responses identified for review.
• The committee will receive internal-audit progress reports every six months and continue oversight of extreme-, high- and moderate-risk audit items.
• No specific service closure, fee change, development approval, infrastructure project or new spending allocation was identified in the supplied extract.

Places

• Wanneroo (local government area)
  The City of Wanneroo is the council responsible for the policies, compliance return and audit matters discussed.
• Civic Centre, 23 Dundebar Road, Wanneroo (civic facility)
  Venue for the committee meeting and the next scheduled meeting.

Next

• Refer the updated Enterprise Risk Management Policy to the Policy Review Committee for consideration and adoption.
  After the 7 September 2026 meeting; exact date not stated.
• Recommend the updated Risk Appetite Statements, Risk Assessment Criteria and Matrix, and Risk Roadmap to Council for endorsement.
  Future Council consideration; exact date not stated.
• Review the City’s responses to compliance questions 2934 and 2021 in light of Paxon’s recommendations.
  Follow-up arising from the 2025 compliance audit; exact deadline not stated.
• Present the Internal Audit Progress Report and updated audit log to the committee twice yearly.
  March and September each year.
• Hold the next Audit, Risk and Improvement Committee meeting at the Civic Centre.
  6:00 PM, Monday 30 November 2026.

Extract

Unconfirmed Minutes Audit, Risk and Improvement Committee Meeting Minutes 6:00PM, Monday 07 September, 2026 Council Chamber (Level 1), Civic Centre, 23 Dundebar Road, Wanneroo wanneroo.wa.gov.au UNCONFIRMED MINUTES OF AUDIT, RISK AND IMPROVEMENT COMMITTEE MEETING HELD ON MONDAY 07 SEPTEMBER, 2026 CONTENTS ITEM 1 ATTENDANCES 1 ITEM 2 APOLOGIES AND LEAVE OF ABSENCE 1 ITEM 3 CONFIRMATION OF MINUTES 2 3.1 MINUTES OF AUDIT, RISK AND IMPROVEMENT COMMITTEE MEETING HELD ON 18 MAY 2026 2 ITEM 4 REPORTS 2 4.2 ENTERPRISE RISK MANAGEMENT POLICY 3 4.4 CONTRACT STATUS AND UNEXECUTED LEASE REPORT 39 5.1 INTERNAL AUDIT PROGRESS REPORT 44 4.1 RISK APPETITE STATEMENT, RISK ASSESSMENT CRITERIA AND MATRIX, AND...