Meeting:	Audit and Governance Committee
Meeting date:	28/01/2026
Report of:	Head of Internal Audit (Veritau)
Portfolio of:	Cllrs Lomas Executive Members for Finance, Performance, Major Projects, Human Rights, Equality and Inclusion

Audit and Governance Committee Report: Contract management: major project delivery

Subject of Report

1. This report has been prepared to allow the committee to consider the contract management: major project delivery final audit report alongside external audit’s 2024/25 audit completion report and the Key Corporate Risks Monitor 3.

Policy Basis

2. The work of internal audit is governed by the Accounts and Audit Regulations 2015, and the Global Internal Audit Standards in the UK Public Sector (GIAS UK Public Sector).

3. In accordance with these standards, outcomes from internal audit work are presented to the Audit and Governance Committee.

Recommendation and Reasons

4. The Audit & Governance Committee is asked to:

- note the content of the contract management: major project delivery final audit report.

Reason

To enable members to consider the implications of internal audit findings.

Background

5. During 2024/25, Veritau commenced work on an audit of the council’s contract management arrangements for its major capital projects. Work continued into 2025/26, following a request for additional work from the Director of Finance and to allow the council’s Director of City Development to contribute to the audit.

6. On 16 January 2026, following discussions with senior management about the content of the report and actions to address identified weaknesses, the final audit report was issued.

7. A Limited Assurance opinion was reached. This means that Veritau has assessed there to be significant gaps, weaknesses or non-compliance. It also means that improvement is required to governance, risk management and control arrangements to effectively manage risks to the achievement of objectives in the area audited.

8. The purpose of the audit was to provide assurance that:

a) there is a contract brief which clearly set out the work required

b) meetings are held with the contractor to manage delivery of the project

c) there is a verification process to confirm that work is completed to the required standard and within timescale

d) invoices received are accurate for the work that has been done.

9. In order to provide this assurance, Veritau reviewed the main construction contracts relating to three projects. These were York Station Gateway, Tadcaster Road, and the Housing Delivery Programme.

10. The focus of this audit was on how the main construction contracts for the three projects had been managed. However, in the case of York Station Gateway, we also evaluated officers’ own review into the circumstances relating to the significant overspend and delays with the project. This was the additional work requested by the Director of Finance, mentioned in paragraph 5.

11. A total of four findings were made in the report. The key finding, and the one the led to the Limited Assurance opinion being reached, relates to York Station Gateway. Veritau assessed this finding as ‘critical’, meaning that it represents a fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management.

12. The York Station Gateway finding is made up of separate but interrelated parts, as follows:

a) entering the construction contract ‘at risk’, before legal agreements with statutory undertakers had been sufficiently progressed

b) costs incurred as a result of changes during project delivery

c) accuracy of financial implications in decision reports

d) project governance, and delivery and support capacity.

13. Taken together, the four areas outlined in paragraph 12 contributed most to the overspends and delays experienced with the York Station Gateway project.

14. The remaining three findings (one of which was assessed as ‘significant’ and two as ‘moderate’) related to inaccuracies in how York Station Gateway costs were presented in monthly project highlight reports, a lack of rigour in reviewing and approving the Tadcaster Road project brief, and inconsistency / unavailability of compensation event documentation.

15. Ordinarily, the outcomes from internal audits are presented as part of regular progress reports. However, the content of this audit report is relevant to other items the committee will consider during the current meeting. The external audit completion report and key corporate risk monitor 3 both contain reference to the council’s management of major projects. Officers therefore requested that the outcomes of this audit be brought separately to this meeting, in advance of the next internal audit progress report in March.

16. The full internal audit report is contained in exempt annex 1 to this report.

Consultation Analysis

17. No consultation was required in the preparation of the report. Responsible officers named in the internal audit report, and others, were consulted during its preparation. This was done as part of Veritau’s usual practice for undertaking audit work.

Risks and Mitigations

18. The council will not comply with proper practice for internal audit if the results of internal audit work are not reported to senior management and the Audit and Governance Committee, particularly where arrangements require improvement. This could result in external scrutiny and challenge.  

Contact details

For further information please contact the authors of this report.

Author

Name:	Connor Munro
Job Title:	Head of Internal Audit
Service Area:	Veritau Public Sector Limited
Telephone:	01904 553512
Report approved:	Yes
Date:	20/01/2026

Background papers

· None

Annexes

Exempt Annex 1: Contract management (major project delivery) final audit report