Agenda item

The Committee considered a report of the Chief Internal Auditor and Corporate Fraud Manager which informed Members of the work that had been carried out by Internal Audit during the period 1 April 2022 to 30 June 2023 as part of the 2022/2023 Internal Audit Plan (for copy see file of minutes).

In respect of a question from A Broadbent in terms of cybersecurity, the Audit Manager, Paul Monaghan noted the issue was one that was on the risk register and was linked in with other assurances that came from the County Council’s ICT arrangements.  He added that a separate ICT Auditor had a rolling programme of testing in this regard looking at issues such as malware, viruses and so on, again an element that was reported back upon at the Council’s Audit Committee.

The Head of Pensions (LGPS) noted there was assurance both for the Pension Fund Committee and Audit Committee and noted work with the Actuary in terms of assurance and they had been asked as regards any specific risks and prevention of fraud that could be undertaken including work on a cyber scorecard; as well as noting the assurance from the Council’s ICT and added that should any Fund specific issues arise, they would be reported back to Members.

Councillor J Atkinson asked regards likelihood of successful cyber-attacks.  The Head of Pensions (LGPS) noted that the issue would be incredibly serious and had moved up the risk register.  He noted that Russia’s invasion of Ukraine may exacerbate the risk.  He added that the plans in place were robust and ICT had backups in terms of data, so information could be replicated should the need arise.  He noted in terms of payroll, both the Council and BACS, who undertake external inspection of payroll arrangements, were satisfied in terms of the arrangements in place.

The Chair noted the levels of protections in place, adding Councillors were aware of the rigorous ICT processes that were in place.

Councillor M Porter asked about pensions payroll assurance.  The Head of Pensions (LGPS) noted that there were three degrees of assurance from Internal Audit: substantial; moderate; or limited.  He noted Internal Audit had noted substantial assurance, the highest assurance possible to give.

Resolved:

That the work undertaken by Internal Audit during the period ending 30 June 2023 be noted.