Agenda and draft minutes

All members were present.

There were no declarations of interest stated.

To consider the minutes of the previous meeting(s).

The Chair recalled that members had requested that the Service Director for Information and Technology come to the Committee to provide clarification on the Cyber Incident Preparedness and Response Effectiveness report presented at the previous meeting.

The Service Director for Information and Technology advised that following the test exercise which would take place in a couple of weeks, the final response would be submitted back to the audit team with all recommendations completed. The matter had been handled as a priority with consideration to the importance of cyber incidents across councils.

Resolved:     That the minutes of the meeting held on 10^th November 2026 be agreed as a true and accurate record.

Watch the debate here

The Chief Internal Auditor (Staffordshire County Council) presented the Internal Audit Progress for 2025-26 for the period running from 1^st October 2025 to 31^st December 2025. Two audits had been completed since then and were currently with the Audit Manager. Two more were scheduled for the financial year.

Cllr Stubbs asked if the six medium recommendations and three lower recommendations had been fulfilled.

The Service Director for Information and Technology advised that these related to the Customer Relationship Management (CRM) project which was originally a proof of concept and had moved on into an actual project in terms of implementation. The project's governance, policies and procedures had now been put in place and all recommendations had been completed except for the bottom one which was due for the end of March.

Cllr Reece asked if the project in the initiation document had been approved.

The Service Director for Information and Technology confirmed that the project had now moved to the implementation stage with the issue of physical documents detailing the project aims and objectives. These would be fulfilled within the budgetary scope, time and resources.

Resolved:     1. That the progress against the 2025-26 Internal Audit Plan be noted.

2. That the progress on the implementation of audit recommendations be noted.

Watch the debate here

The Service Director for Legal and Governance (Monitoring Officer) presented the report on the Council’s current position in respect of risk management controls and identified corporate risks.

Cllr Holland enquired about the increase of the risk associated with the ministerial directive on air quality and whether this was due to the Council having failed to do something, or a lack of action from the government.

The Service Director for Legal and Governance (Monitoring Officer) said that there was nothing the Council had not done that they could have done at the current time. There had been an ongoing long-standing concern with air quality as faced by every local authority and one should remain cognizant of the risks.

Cllr Reece asked when that risk would escalate in terms of potential impact.

The Service Director for Legal and Governance (Monitoring Officer) responded that the risk increased by virtue of the fact of not having absolute clarity and guidance – whether that be statutory guidance or ministerial guidance. This did not necessarily mean that it increased in a real tangible sense.

Cllr Whieldon commented that when a project and a target are set out, things can change and if you don't go along with those changes and don't adapt to them, then the risk can escalate.

Cllr Holland wondered if one of the two new risks that had been added to the register, failure to adequately assess events, health and safety arrangements, was referring to a single event or to events generally.

The Service Director for Legal and Governance (Monitoring Officer) advised that this was for all events.

The Chair asked if members wished to scrutinise any individual risk profile at the next meeting. There were no requests to do so.

Resolved:     1. That there were currently NO risks that are more than 6 months overdue for a review up to end of Q3 2025/26, be noted.

2. That there had been 1 risk level increase, be noted.

3. That there had been 2 new risks added, be noted.

4. That the Corporate Risk Register profile be noted.

5. That officers be advised of any individual risk profiles that the Committee would like to scrutinise in more details at its next meeting.

6. That whilst the likelihood of a risk materialising may be mitigated, the likely impacts may not change, be noted.

Watch the debate here

Resolved:     That the work programme be noted.

Watch the debate here

There was no urgent business.