Agenda and draft minutes

Apologies for absence were received from Councillor Coles, who was substituted by Councillor Taylor. Apologies for absence were also received from Independent Member Mr Binney.

At this point in the meeting, Members and co-opted members are asked to declare any disclosable pecuniary interest, or other registerable interest, they might have in respect of business on this agenda, if they have not already done so in advance on the Register of Interests. The disclosure must include the nature of the interest.

An interest must also be disclosed in the meeting when it becomes apparent to the member during the meeting.

[Please see attached sheet for further guidance for Members].

Members were asked to declare any personal interests not included on the Register of Interests, any prejudicial interests or any disclosable pecuniary interests which they may have in respect of business on the agenda. None were received.

To consider the exclusion of the press and public from the meeting during consideration of the following:

Annexes 2 to 4 to agenda item 16 on the grounds that it contains information relating to the financial or business affairs of any particular person (including the authority holding that information). This information is classed as exempt under paragraph 3 of Schedule 12A to Section 100A of the Local Government Act 1972 (as revised by The Local Government (Access to Information) (Variation) Order 2006).

Resolved: That the press and public be excluded from the meeting during consideration of Annexes 2-4 to Agenda Item 16, Internal Audit Progress Report 2026/27 on the grounds that it contained Information relating to the financial or business affairs of any particular person (including the authority holding that information). This information was classed as exempt under paragraph 3 of Schedule 12A to Section 100A of the Local Government Act 1972 (as revised by The Local Government (Access to Information) (Variation) Order 2006).

At this point in the meeting members of the public who have registered to speak can do so. Members of the public may speak on agenda items or on matters within the remit of the Committee.

Please note that our registration deadlines are set as 2 working days before the meeting, in order to facilitate the management of public participation at our meetings.  The deadline for registering at this meeting is 5:00pm on Monday 20 July 2026.

To register to speak please visit www.york.gov.uk/AttendCouncilMeetings to fill in an online registration form.  If you have any questions about the registration form or the meeting, please contact Democratic Services.  Contact details can be found at the foot of this agenda.

Webcasting of Public Meetings

Please note that, subject to available resources, this meeting will be webcast including any registered public speakers who have given their permission. The meeting can be viewed live and on demand at www.york.gov.uk/webcasts.

It was reported that there had been no registrations to speak at the meeting under the Council’s Public Participation Scheme.

To approve and sign the minutes of the meeting held on 6 May 2026.

The Committee highlighted that several items on the committee’s action plan didn’t have completion dates and asked that updates be sought on the actions.

Resolved:  That the minutes of the meeting held on 6 May 2026 be approved and then signed by the Chair as a correct record.

This report is to provide a briefing to the Committee covering performance for April 2025 to March 2026 for the different types of requests for information and data protection requests received. As well as, other relevant areas relating to information governance and data protection.

The DPO/Information governance manager introduced the report providing the Committee covering performance for April 2025 to March 2026 for the different types of requests for information and data protection requests received, as well as, other relevant areas relating to information governance and data protection. Members welcomed the performance improvements and asked whether the Council provided sufficient resources to improve further. It was confirmed that there was a small team in information governance but that the team worked across the Council which was driving improvements.

The Committee discussed a data breach relating to a failure to blind copy (BCC) email recipients for a newsletter. It was confirmed that the Council already had processes to avoid needing to send these kinds of emails via BCC and that officers would explore expanding these processes to reduce the likelihood of future breaches.

Members considered the Council’s response times to several different requests for information and asked about the Council’s 85% in time response for Subject Access Request’s (SAR). The Committee were informed that the Information Commissioner’s Office doesn’t have a specific target for SARs and that an 85% in time response rate was a strong performance. Members asked about the 15% that weren’t in time and were informed that the Council could in some cases apply a 2-month extension to these requests where applicable, but that many cases required the collating of significant amounts of information including reviewing paper records that meant responses could take significant amount of time to complete.

The Committee noted that there was an increase in various requests for information and enquired as to whether there were issues in accessing information. Officers noted that the Council published lots of information, including responses to previous requests on York Open data, however, requesters don’t always check or have specific ways they ask for the information meaning requests for information are received. Officers also noted that requests for information were across the Council which suggested that there wasn’t a specific area where issues could be identified. Instead, it was confirmed that the Council was getting more proactive in improving access.

Members enquired as to whether it was a Councillor/Executive decision around the decision to install CCTV. It was confirmed that CCTV in public spaces followed national guidelines that the Council followed when considering the need for CCTV. Councillors and members of the public could submit a request for CCTV to be installed in a public space, and the Council would consider the request and follow the guidance when considering whether it was necessary and proportionate to install.

Resolved:

                         i.         Noted the details contained in this report and provide any comments or feedback.

Reason:     So that Members are provided with details about current performance and other areas of information governance and data protection from the IGT.

The purpose of this paper is to present Audit & Governance Committee with an update on the key corporate risks for City of York Council

The Head of Customer Finance Risk & Insurance introduced the report and was asked whether cyber security and Artificial Intelligence (AI) should be considered as requiring a Key Corporate Risk (KCR) assigned to them. Officers confirmed that these areas would make up part of departmental risk registers and would be managed as risks at that level. It was also noted that the Council was advised to maintain a manageable number of KCRs.

The Committee discussed KCR 5 – Safeguarding and raised a series of questions about the Care Quality Commission (CQC) assessment. Officers confirmed that the interventions put in place by the Council ensured that the CQC were assured that adults were kept safe in York. They also confirmed that the Council was improving partnership work and were seeking to improve its safeguarding systems but would not expect to remove all risk from peoples lives. Members were informed that the Council had a two-year period for the improvement programme which should move the Council above an inadequate assessment. Officers also noted that a National Safeguarding Board was being introduced, and this would likely see changes to national guidance the Council will need to follow.

Resolved:

                      i.         Noted the Council’s Key Corporate Risks and noted the in-depth review of KCR 5 Safeguarding at Annex C;

Reason:    To provide assurance that the authority is effectively understanding and managing its key risks.

The purpose of this report is to present for information the draft 2025/26 Annual Governance Statement. 

It was confirmed to the Committee that the Annual Governance Statement 2025/26 was currently a draft that would be regularly updated until the final accounts were submitted. The Committee welcomed the report but noted that they had not had training on the accounts which would assist the Committee in performing their duties as an audit and governance committee. Officers confirmed that they would usually provide additional training for members of the committee and that they would arrange training on the accounts as well as treasury management ahead of the final accounts being ready to be submitted.

Resolved:

                         i.         Noted the draft Annual Governance Statement for the financial year ended 31 March 2026.

                        ii.         That training be organised for the Committee on the Accounts and treasury Management.

Reason:     To ensure that Members have had the opportunity to review the draft Annual Governance Statement.

The purpose of this report is to present for information the draft 2025/26 Statement of Accounts before they are audited. 

Officers introduced the report of the draft 2025/26 Statement of Accounts before they are audited. The Committee asked about the 3-year funding settlement and enquired as to whether more recent quarters and a new prime minster might allow the for the funding assigned to York could be reviewed. Officers noted that they were working on the basis that the settlement wouldn’t be reopened. Members also raised changes to business rates and discounts which were affecting small businesses and non-profit organisations. Officers noted that they had no control over business rates the Council collected these on behalf of Government.

Members then considered whether the Council should seek encourage government to investigate the share of business rates the Council would receive if business rates revenue had increased but due to how it was distributed the Council was not receiving additional funding. The Committee also enquired about the evaluation of the value of the Council’s assets and whether it was correct that land had decreased in value with the committee expecting in York for this to have increased in value. Officers noted that the valuation is done by valuators and that the change in value of assets were marginal.

Resolved:

                         i.         Noted the draft pre-audit statement of accounts, for the financial year ended 31 March 2026.

Reason:     To ensure that, in line with best practice, Members have had the opportunity to review the draft pre-audit Statement of Accounts.

Attached at Annex 1 is the Treasury Management Outturn report and Review of Prudential Indicators 2025/26, which provides an update on treasury activity during the final quarter and will be considered by Executive on 7 July 2026.

Officers introduced the report noting that the Treasury Management Strategy 2025/26 was approved by Full Council on 27 February 2025 and provided an update on treasury activity during the final quarter, that was considered by Executive on 7 July 2026. Officers noted the Council’s current level of borrowing and confirmed that short term borrowing continued to provide better value than longer term borrowing. Members asked whether the change in Prime Minster could affect the Council’s treasury management and officers noted that they would await announcement from the Chancellor.

Resolved:

                         i.         Noted the Treasury Management Outturn Report and Review of Prudential Indicators 2025/26.

Reason:     That those responsible for scrutiny and governance arrangements are updated on a regular basis to ensure that those implementing policies and executing transactions have properly fulfilled their responsibilities with regard to delegation and reporting.

The purpose of this report is to present the 2025/26 Draft Audit Strategy Memorandum from Forvis Mazars, the Council’s external auditors.

Mark Outterside from Forvis Mazars introduced the report on the Draft Audit Strategy Memorandum for the Council’s external auditors. Members enquired whether the cost of the external audit work would be similar to last years. It was noted that the new indexation approach meant that the cost of external audit work would become clearer over time, but that the Council was expecting and had budgeted for a similar amount with a small, budgeted uplift. It was also noted that cost could be hard to determine in the case of additional work such as letters from the public. The Committee discussed the program of work for external audit and asked about the Station Gateway project and exit packages in both cases it was confirmed that the external auditors would provide an opinion on these areas once review work was completed.

Resolved:

                      i.         Noted the matters set out in the Audit Strategy Memorandum presented by the external auditor.

Reason:   To ensure the proper consideration of the progress of the external auditor in respect of the annual audit of accounts and review of the council’s arrangements for ensuring value for money

To provide a draft version of the Chair’s annual report, for members’ consideration prior to its reporting to Council in September 2026.

The Committee noted the Annual Report of the Chair of Audit and Governance Committee.

Resolved:

                         i.         To delegated authority to the Chair and Vice-Chair of the Committee to finalise the report for submission to the meeting of full Council on 17 September 2026.

Reason:     To finalise the annual report for Council.

This report provides an update on counter fraud work undertaken so far in 2026/27.

Jonathan Dodsworth of Veritau introduced the report on Counter Fraud work undertaken by the Council’s internal auditors. Members welcomed the work on counter fraud that was being carried out and enquired as to whether more work could be done to publicise the outcomes of the work. Officers noted that they could only name individuals if they were prosecuted and a lot of action is used to tackle fraud prior to legal action, in part due to the cost of legal action, compared to the potential return from any action taken.

The Committee were informed of the work undertaken on blue badge fraud and the day of action that was undertaken with parking. Members also enquired as to whether action could be taken on HMO’s that were registered as domestic dwellings and not businesses around things such as waste collections. Officers noted that they had not been presented with fraud in of this kind but that members or the public can raise possible cases of fraud with Veritau.

Members also enquired about the new whistleblower policy and whether the recommendation being to report to a line manager was the best course of action for staff which to raise concerns. Officers confirmed that line managers were identified as a first port of call, however, should any officer believe it was not appropriate to report it to their line manger the policy supports an issue being raised with officers of a higher level or with Veritau directly.

Resolved:

                         i.         Noted counter fraud activity and the updated whistleblowing policy.

Reason:     To enable members to consider the progress of counter fraud work in the current financial year.

To consider the committee’s work plan.

The Committee considered its work plan. It was noted that an item on Yorhomes was being worked on to potentially be scheduled for the Committee’s September meeting and the one year review of planning committee changes would come to the Committee’s November meeting. The Committee also discussed the review of the Council’s Constitution and noted that there were challenges with officer resources to be able to review the Constitution on a more regular basis.

Resolved:

                         i.         That the work plan be updated with outstanding items identified for the Committee.

Reason:     To ensure that the Committee maintains a programme of work.

This report provides an update on the delivery of the internal audit work programme for 2026/27, and plans for delivery over the remainder of the year.

Connor Munro from Veritau introduced the report and noted that four more audits had been completed since the report was finalised, including an audit of Payroll which received reasonable assurance. The Committee enquired as to whether it was best practice for Veritau to undertake a self-assessment of its own internal governance, and it was confirmed that this was a appropriate approach with improvements from any assessment being to Veritau’s benefit. Members enquired about the Flexi-time audit, and it was confirmed that have received reasonable assurance.

The remainder of this item was considered under the exclusion of press and public as agreed at minute 3.

Resolved:

                      i.         Noted the progress made in delivering the 2026/27 internal audit work programme, and plans for delivery over the remainder of the year

Reason:    To enable members to consider the implications of internal audit findings, and to review planned activity for the remainder of 2026/27.

                    ii.         Noted the final outcome from Veritau’s self-assessment of conformance to the GIAS UK Public Sector for 2026.

Reason:    To acknowledge the reassurance members can have in the continued professional conformance of the council’s internal audit service.