audit and risk committee - city of perth 10 14... · audit and risk committee . 22 october 2014 ....

22
MINUTES AUDIT AND RISK COMMITTEE 22 OCTOBER 2014 APPROVED FOR RELEASE ------------------------------------ GARY STEVENSON PSM CHIEF EXECUTIVE OFFICER I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Upload: hoangkiet

Post on 19-Jul-2018

213 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

MINUTES

AUDIT AND RISK COMMITTEE

22 OCTOBER 2014

A P P R O V E D F O R R E L E A S E

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - G A R Y S T E V E N S O N P S M

C H I E F E X E C U T I V E O F F I C E R

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 2: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

FB CTE MINS 22 OCTOBER 2014

MINUTES

AUDIT AND RISK COMMITTEE

22 OCTOBER 2014

THESE MINUTES ARE HEREBY CERTIFIED AS CONFIRMED

PRESIDING MEMBER’S SIGNATURE

-----------------------------------

DATE:----------------------------

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 3: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

INDEX

Item Description Page AR36/14 DECLARATION OF OPENING 1

AR37/14 APOLOGIES AND MEMBERS ON LEAVE OF ABSENCE 1

AR38/14 QUESTION TIME FOR THE PUBLIC 1

AR39/14 CONFIRMATION OF MINUTES 2

AR40/14 CORRESPONDENCE 2

AR41/14 DISCLOSURE OF MEMBERS’ INTERESTS 2

AR42/14 MATTERS FOR WHICH THE MEETING MAY BE CLOSED 2

AR43/14 RISK MANAGEMENT – OCTOBER 2014 UPDATE 3

AR44/14 AMENDMENT TO ENTERPRISE RISK MANAGEMENT FRAMEWORK 8

AR45/14 CITY OF PERTH INTERNAL AUDIT PLAN 2014/15 11

AR46/14 CITY OF PERTH BIENNIAL REVIEW OF SYSTEMS AND PROCESSES 15

AR47/14 CONFIDENTIAL ITEM – UPDATE – CITY OF PERTH KEY PROCUREMENT ISSUES AND ACTIVITIES 17

AR48/14 CONFIDENTIAL ITEM – INTERNAL AUDIT 2013/14 – REVIEW OF CONTRACT MANAGEMENT 18

AR49/14 MOTIONS OF WHICH PREVIOUS NOTICE HAS BEEN GIVEN 18

AR50/14 GENERAL BUSINESS 19

AR51/14 ITEMS FOR CONSIDERATION AT A FUTURE MEETING 19

AR52/14 CLOSE OF MEETING 19

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 4: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 1 - 22 OCTOBER 2014

Minutes of the meeting of the City of Perth Audit And Risk Committee held in Committee Room 1, Ninth Floor, Council House, 27 St Georges Terrace, Perth on Wednesday, 22 October 2014.

MEMBERS IN ATTENDANCE

Cr Davidson - Presiding Member Cr Butler Cr Yong - Deputy Mr Linden - Independent Member

OFFICERS

Mr Stevenson - Chief Executive Officer Mr Mianich - Director Corporate Services Mr Dunne - Director City Services Mr Ridgwell - Manager Governance Mr Berry - Manager Finance Ms Thrush - Risk Management Coordinator Mr Cheldi - Internal Auditor Mr White - Chief Accountant Ms Fogg - Governance Coordinator

GUESTS

Nil member of the press. Nil members of the public.

AR36/14 DECLARATION OF OPENING The Presiding Member declared the meeting open at 4.00pm. The Presiding Member welcomed Mr Linden to his first meeting as the Independent member of the Audit and Risk Committee and Cr Yong, deputising for Cr Harley.

AR37/14 APOLOGIES AND MEMBERS ON LEAVE OF ABSENCE Cr Harley - Apology

AR38/14 QUESTION TIME FOR THE PUBLIC Nil

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 5: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 2 - 22 OCTOBER 2014

AR39/14 CONFIRMATION OF MINUTES Moved by Cr Butler, seconded by Cr Davidson, That the minutes of the meeting of the Audit And Risk Committee held on 27 May 2014 be confirmed as a true and correct record. The motion was put and carried The votes were recorded as follows: For: Crs Davidson, Butler, Yong and Mr Linden Against: Nil

AR40/14 CORRESPONDENCE Nil

AR41/14 DISCLOSURE OF MEMBERS’ INTERESTS Nil.

AR42/14 MATTERS FOR WHICH THE MEETING MAY BE CLOSED

The Chief Executive Officer advised that in accordance with Section 5.23(2) of the Local Government Act 1995, the meeting will be required to be closed to the public prior to discussion of the following: Item No. Item Title Reason Confidential Item AR47/14

AR47/14 – UPDATE – CITY OF PERTH KEY PROCUREMENT ISSUES AND ACTIVITIES

s. 5.23(2)(f)(i)

Confidential Item AR48/14 and Confidential Schedule 7

AR48/14 – INTERNAL AUDIT 2013/14 – REVIEW OF CONTRACT MANAGEMENT

s. 5.23(2)(f)(i)

The Chief Executive Officer also advised that in accordance with Section 5.23(2) of the Local Government Act 1995, should a Member wish to discuss the content of the confidential schedules listed below, it is recommended that the Audit and Risk Committee resolve to close the meeting to the public prior to discussion of the following:

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 6: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 3 - 22 OCTOBER 2014

Item No. Item Title Reason Confidential Schedules 4, 5 and 6

AR46/14 – CITY OF PERTH BIENNIAL REVIEW OF SYSTEMS AND PROCESSES

s. 5.23(2)(f)(i)

Confidential reports and schedules are distributed to Members under separate cover. PRESENTATION The Manager Governance provided a presentation titled – Procurement Practices and Corruption and Fraud Risks refer Confidential Schedule 8. The presentation addressed issues dealt with in several of the reports considered at this meeting. Moved by Cr Butler, seconded by Cr Yong, That the Audit and Risk Committee receives the presentation titled “Procurement Practices and Corruption and Fraud Risks.” The motion was put and carried The votes were recorded as follows: For: Crs Davidson, Butler, Yong and Mr Linden Against: Nil

AR43/14 RISK MANAGEMENT – OCTOBER 2014 UPDATE

BACKGROUND:

FILE REFERENCE: P1029155 REPORTING OFFICER: Kirsten Thrush, Risk Management Coordinator RESPONSIBLE DIRECTOR: Robert Mianich, Director Corporate Services DATE: 9 October 2014 MAP / SCHEDULE: Schedule 1 – Strategic Risks (October 2014)

LEGISLATION / STRATEGIC PLAN / POLICY:

Legislation Local Government Act 1955 Regulation 17 of the Local Government (Audit) Regulations 1996

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 7: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 4 - 22 OCTOBER 2014

Integrated Planning and Reporting Framework Implications

Corporate Business Plan Council Four Year Priorities: Capable and responsive organisation S18 Strengthen the capacity of the organisation IP31 Implement Organisational Development Plan

Organisational Development Plan G4 Risk Management

Policy Policy No and Name: 19.1 – Enterprise Risk Management

DETAILS:

Policy and Framework The City’s Enterprise Risk Management Policy and Framework were adopted by Council at its meeting held on 4 June 2013. The Policy states that the purpose of risk management is to: “To protect the community, the City of Perth and its workers against foreseeable risks through developing a whole of enterprise culture of risk awareness, plans that reduce our risk exposure and systems that provide information to assist in informed decision making, maximising asset potential and enhancing community wellbeing.” Under the Framework, the Audit and Risk Committee has the responsibility for the systems and processes for risk management in line with the Local Government (Audit) Regulations 1996. The framework states that strategic and high level operational risks will be reported to the Audit and Risk Committee and Council on a six monthly basis. This report fulfils the reporting requirements of the framework. Implementation process The diagram below shows the path that is being followed to embed risk management within all functions of the organisation.

Stage 1 Implement

•Policy and Framework adopted •Risk registers

developed for all units •Information

download, large number of risks •Utilise excel

spreadsheets

Stage 2 Rationalise

•Rationalise and refine unit risk registers •Develop project risk

registers •Implement risk

management system •Develop

reporting/actions

Stage 3 Embed

•Embed into the business cycle •Concentrate on key

risks •Evolve

reporting/actions

Stage 4 Independence

•Staff independent/self reliant •Risk built into

everyone's business •Risk based planning

and decision making

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 8: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 5 - 22 OCTOBER 2014

The City has now completed Stage 1 above and has commenced Stage 2 which involves the process of rationalisation. Over the six months since the last report to the Audit and Risk Committee a number of actions have been occurring within the City: • Presentations have been given at unit meetings and staff inductions to raise

awareness of risk management. • Risk registers for business units have been updated by Managers. • A software system (RMSS – Risk Management Software System) has been

implemented to record and manage health and safety risks. It is also being used to record safety representative workplace safety inspections. In the future, RMSS will hold other risks as well as those related to health and safety.

• Strategic risks have been reviewed and updated. • The process of developing business continuity plans for the organisation has

commenced. An external consultant, Riskwest, has been appointed to assist with this process.

Strategic Risks Profile The following table demonstrates the risk profile for strategic risks within the organisation. The Enterprise Risk Management Framework states that all extreme and high risks are to be treated where possible, medium risks are to be treated if possible and cost effective to do so, and low level risks are to be monitored. There have been 22 strategic risks identified within the organisation, none of which are rated extreme and one of which is high. A full list of the risks, the controls, risk ratings and any further action required is provided in Schedule 1. Due to the strategic nature of these risks there has been no movement since the last report. Consequence

Likelihood 1

Insignificant

2

Minor

3

Moderate

4

Major

5

Catastrophic

A

Almost certain

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 9: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 6 - 22 OCTOBER 2014

Consequence

B

Likely

C

Moderate 7 1

D

Unlikely 1 1 2

E

Rare 4 5 1

TOTAL Low - 5 Medium -16 High - 1 Extreme - 0 Operational risks Profile The following table demonstrates the risk profile for operational risks within the organisation as at 16 September 2014. The number in each box corresponds to the number of risks with that rating. This includes risks from all unit risk registers as well as those from project risk registers, event risk registers and asset management risk registers. The number of risks have increased from the last report to the Audit and Risk Committee which did not include project risks or event risks. There are 692 risks identified within risk registers, 20 of which are rated extreme and 99 high. The extreme operational risks fit into broad themes of project management risks, transport / traffic management risks, breach of copyright and risks of suicides from buildings and car parks. The level of risk is being reviewed as part of the 2014 Risk Register update that is currently being undertaken as it is believed some of the risks may be over rated. Risks of a similar nature are also being rationalised. Treatment plans are in place to address all high and extreme risks. A full list of the extreme and high risks, the controls, risk ratings and any further action required is provided for in the individual risk registers held within the organisation.

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 10: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 7 - 22 OCTOBER 2014

Consequence

Likelihood 1

Insignificant

2

Minor

3

Moderate

4

Major

5

Catastrophic

A

Almost certain

10 21 24 5 0

B

Likely 11 34 28 8 2

C

Moderate 7 29 70 16 5

D

Unlikely 7 71 94 32 10

E

Rare 16 38 68 39 47

TOTAL Low - 207 Medium - 366 High - 99 Extreme - 20 Future direction The organisation has commenced stage two of the implementation process. The actions that are proposed for the coming twelve months include: • Review of all unit risk registers including reviewing consequence and likelihood

and rationalising risks. • Configuration of the RMSS system for risk and upload of the risks to the

database. • Using the RMSS system for future reporting to management and the Audit and

Risk Committee. • Developing a process for managing risk within projects • Finalisation of organisation wide business continuity plans for key services and

testing of the plans.

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 11: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 8 - 22 OCTOBER 2014

FINANCIAL IMPLICATIONS:

There are no financial implications related to this report. Each risk identified may have its own financial implications which will be the subject of normal budget consideration. Moved by Mr Linden, seconded by Cr Yong, That Council receives the report titled “Risk Management – October 2014 Update.” The motion was put and carried The votes were recorded as follows: For: Crs Davidson, Butler, Yong and Mr Linden Against: Nil Meeting Note: The Committee requested details of the 20 extreme operational risks

identified in this report. The Manager Governance advised that this information would be provided to Committee Members.

AR44/14 AMENDMENT TO ENTERPRISE RISK MANAGEMENT FRAMEWORK

BACKGROUND:

FILE REFERENCE: P1013822 REPORTING OFFICER: Kirsten Thrush, Risk Management Coordinator RESPONSIBLE DIRECTOR: Robert Mianich, Director Corporate Services DATE: 9 October 2014 MAP / SCHEDULE: Schedule 2 – Risk Management Framework (TRIM

reference 231152/14)

LEGISLATION / STRATEGIC PLAN / POLICY:

Legislation Local Government Act 1995 Regulation 17 of the Local Government (Audit) Regulations 1996

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 12: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 9 - 22 OCTOBER 2014

Integrated Planning and Reporting Framework Implications

Corporate Business Plan Council Four Year Priorities: Capable and responsive organisation S18 Strengthen the capacity of the organisation IP31 Implement Organisational Development Plan

Organisational Development Plan: G4 Risk Management Policy Policy No and Name: 19.1 – Enterprise Risk Management

DETAILS:

The Enterprise Risk Management Policy and Framework were adopted by Council at its meeting held on 4 June 2013. The Policy states that the purpose of risk management is to: “To protect the community, the City of Perth and its workers against foreseeable risks through developing a whole of enterprise culture of risk awareness, plans that reduce our risk exposure and systems that provide information to assist in informed decision making, maximising asset potential and enhancing community wellbeing.” Under the framework the Audit and Risk Committee has the responsibility for the systems and processes for risk management in line with the Local Government (Audit) Regulations 1996. It is proposed to make four changes to the document. Framework Diagram The framework diagram within the introduction has been replaced with a new diagram that better reflects the linkages between the risk management system of documents, the risk registers and the plans that they inform. Inherent Risk The Enterprise Risk Management Framework (6.2.3.3) states that inherent risk should be analysed. Inherent risk assumes that there are no controls in place. This is purely theoretical as there are always some forms of controls in place and it is not well understood by staff. It is not required under AS/NZS ISO 31000:2009 Risk Management – Principle and Guidelines, and there is not a field to record it in our risk management software (RMSS). It is therefore proposed that inherent risk be removed from the framework requirements and that the necessary changes from this be made to the operational document (handbook and template).

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 13: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 10 - 22 OCTOBER 2014

Monitoring and Reporting Risk The Enterprise Risk Management Framework (refer to section 6.2.7) includes a diagram outlining the reporting at each level. When the diagram was developed an error was made on it reporting operational risks to the Community and Council. This does not happen as these risks are managed within the organisation with strategic risks reported to Council and the Community. It is therefore proposed to amend this diagram to remove the requirement. Timeframes The Enterprise Risk Management Framework (refer to section 7.3) includes a table with timeframes. As risk management within the organisation is now achieving a level of system maturity, it is proposed that the reporting to the Risk Management Task Force (RMTF) be changed from monthly to ‘no less than four times per annum’.

FINANCIAL IMPLICATIONS:

There are no financial implications related to this report.

COMMENTS:

The proposed changes will not affect the management of risk within the organisation and it is recommended that Council agree to proceed with the changes and subsequent changes to the operational document (handbook and template). Moved by Cr Butler, seconded by Cr Yong, That Council amends the Enterprise Risk Management Framework, as detailed in Schedule 2. The motion was put and carried The votes were recorded as follows: For: Crs Davidson, Butler, Yong and Mr Linden Against: Nil

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 14: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 11 - 22 OCTOBER 2014

AR45/14 CITY OF PERTH INTERNAL AUDIT PLAN 2014/15

BACKGROUND:

FILE REFERENCE: P102969-8 REPORTING OFFICER: Mario Cheldi, Internal Auditor RESPONSIBLE DIRECTOR: Robert Mianich, Director Corporate Services DATE: 29 August 2014 MAP / SCHEDULE: Schedule 3 – City of Perth Internal Audit Plan 2014/15 An Internal Audit Plan for the 2014/15 financial year has been prepared by the Internal Auditor. This plan is submitted for Council approval.

LEGISLATION / STRATEGIC PLAN / POLICY:

Legislation Local Government (Audit) Amendment Regulations 2013

Integrated Planning and Reporting Framework Implications

Corporate Business Plan Capable and responsive organisation. A capable, flexible and sustainable organisation with a strong and effective governance system to provide leadership as a capital city and deliver efficient and effective community centred services.

Policy Policy No and Name: 19.1 – Enterprise Risk Management

DETAILS:

The City has expanded the terms of reference for its Audit and Risk Committee to include oversight in the areas of risk management, internal control and legislative compliance. This expansion of terms of reference has been in response to the Local Government (Audit) Amendment Regulations 2013 published in the Government Gazette on 8 February 2013 requiring the Audit and Risk Committee of a local government to have oversight of the local government’s systems and procedures in relation to the above mentioned areas. An Internal Audit Plan has been developed by the City’s Internal Auditor for the 2014/15 financial year which seeks to evaluate the adequacy of internal controls in a number of higher risk areas. In line with the oversight responsibilities mentioned above the Internal Audit Plan for the 2014/15 financial year is presented (refer to Schedule 3) to Council for its review and approval.

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 15: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 12 - 22 OCTOBER 2014

Audit areas An explanation for selection of the audit areas in the Internal Audit Plan for the 2014/15 financial year is provided below. Determination of audit areas involved analysis of organisational risks per documentation provided by the Risk Management Coordinator as well as discussions with senior management to determine potential higher risk auditable areas. The 2014/15 Internal Audit Plan includes two audits which are required to be completed under Local Government Act Regulations. Biennial review of systems and procedures As required by regulation 17 of the Local Government (Audit) Regulations 1996, a review of the appropriateness and effectiveness of systems and procedures in relation to risk management, internal control, and legislative compliance is to be undertaken. Regulation 17 was amended to incorporate this new requirement on 8 February 2013. The amended regulation requires a local government’s Chief Executive Officer to review, at least once every two calendar years, systems and procedures in each of the above mentioned areas. The Department of Local Government and Communities requires the first review of each of the three areas to be completed by the Chief Executive Officer, reviewed by the Audit and Risk Committee and reported to Council by 31 December 2014. This review has now been completed and the results of this review presented in a separate report to the October 2014 Audit and Risk Committee meeting. Purchasing Purchasing continues to be a high risk area for the City and warrants inclusion in the Internal Audit Plan for 2014/15. A number of shortfalls were identified in the RSM Bird Cameron Procurement Audit carried out in January 2013 on behalf of the Corruption and Crime Commission. There have also been two investigations carried out since the audit in relation to staff purchasing activities. This audit will examine whether certain controls introduced or reinforced following the above mentioned audit are operating adequately. An investigation into potential anomalies in the purchasing process is also planned for review. Local Government Compliance Audit The City is required to complete an annual Compliance Audit Return to the Department of Local Government and Communities in accordance with the requirements of the Local Government (Audit) Regulations 1996. The period of

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 16: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 13 - 22 OCTOBER 2014

compliance is 1 January to 31 December 2014 and compliance activities examined as per the 2013 return are as follows: • Commercial Enterprises by Local Government; • Delegation of Power / Duty; • Disclosure of Interest; • Disposal of Property; • Elections; • Finance; • Local Government Employees; • Official Conduct; and • Tenders for Providing Goods and Services. This return has to date been completed by the Governance Unit, however, it has been noted that at least 50% of the scope of the return falls within the field of Governance. Following discussions with this Unit it is agreed that completion of this task is better suited to Internal Audit. Completion of the 2014 Compliance Audit Return has therefore been included in the Internal Audit Plan for 2014/15 and it is envisaged will also be included in future plans. Cash Handling A review of cash handling procedures at various City of Perth sites, e.g. Customer Service Centre, Citiplace Rest Centre, Community Centres, Childcare Centre and manned car parks is planned to determine the adequacy of current controls in place to minimise risks of theft and fraud. Except for an investigation carried out in 2012 involving a staff member at the Citiplace Rest Centre, cash handling procedures have not been subject to review in recent years. Human Resources Review This review will examine whether the treatment of workplace grievance and discipline issues is in accordance with established procedures and relevant legislation. Particular risks to the City from mistreatment of these issues include litigation, allegations harmful to the City’s image as well as health, safety or security risks. Lease Payments Concerns have been raised by senior management in regards to lease payments from tenants of City properties not being received in a timely manner. This review will comprise an analysis of timeliness of lease payments as well as the carrying out of rental reviews in accordance with lease agreements.

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 17: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 14 - 22 OCTOBER 2014

FINANCIAL IMPLICATIONS:

There are no financial implications related to this report.

COMMENTS:

The recruitment timeframe for the Assistant Internal Auditor position (successful applicant expected to commence duties in early December 2014) and the audits to be undertaken by this new officer was a factor for consideration in the development of the Internal Audit Plan for 2014/15. Planned leave absence of the Internal Auditor was also factored into the development of the plan. As per past financial years the achievement of the plan may well be affected by the need to deal with a number of unsolicited requests for assistance being received from staff members. These requests relate to a variety of business related matters. During the 2014/15 financial year time has already been spent on two investigations into staff activity and the possibility of work on new investigations is ever present. The Internal Auditor is a member of the Procurement Working Group as part of the Local Government Reform Process. It is not clear at this stage whether continued involvement with this group or other aspects of the reform process may be required. Finally, during this financial year work is planned to be undertaken to address the remaining audit action within the Organisational Development Plan: “Establish new Internal Audit Policy and Programs”. Moved by Mr Linden, seconded by Cr Butler, The Council approves the City of Perth Internal Audit Plan 2014/15 attached as Schedule 3. The motion was put and carried. The votes were recorded as follows: For: Crs Davidson, Butler, Yong and Mr Linden Against: Nil

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 18: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 15 - 22 OCTOBER 2014

AR46/14 CITY OF PERTH BIENNIAL REVIEW OF SYSTEMS AND PROCESSES

BACKGROUND:

FILE REFERENCE: P1029155, P1029779 REPORTING OFFICERS: Mark Ridgwell, Manager Governance

Kirsten Thrush, Risk Management Coordinator Mario Cheldi, Internal Auditor

RESPONSIBLE DIRECTOR: Robert Mianich, Director Corporate Services DATE: 26 August 2014 MAP / SCHEDULE: Confidential Schedule 4 – Review of systems and

procedures – Risk Management Confidential Schedule 5 – Review of systems and procedures – Internal Control Confidential Schedule 6 – Review of systems and procedures – Legislative Compliance

LEGISLATION / STRATEGIC PLAN / POLICY:

Legislation Local Government (Audit) Amendment Regulations 2013

Integrated Planning and Reporting Framework Implications

Corporate Business Plan Capable and responsive organisation. A capable, flexible and sustainable organisation with a strong and effective governance system to provide leadership as a capital city and deliver efficient and effective community centred services.

Policy Policy No and Name: 19.1 – Enterprise Risk Management

DETAILS:

As required by regulation 17 of the Local Government (Audit) Regulations 1996, a review of the appropriateness and effectiveness of systems and procedures in relation to risk management, internal control, and legislative compliance is to be undertaken. Regulation 17 was amended to incorporate this new requirement on 8 February 2013. The amended regulation requires a local government’s Chief Executive Officer to review, at least once every two calendar years, systems and procedures in each of the above mentioned areas. Department of Local Government and Communities requires a report on the review to be presented to the Audit Committee and Council by December 2014.

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 19: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 16 - 22 OCTOBER 2014

It was determined that the review would be carried out by relevant staff as follows: • Risk Management component – Risk Management Coordinator. • Legislative Compliance component – Manager Governance. • Internal Control component – Internal Auditor. The Department of Local Government and Communities Circular No 39-2013, dated 17 December 2013, includes information regarding amendments to regulation 17. Reference is made on this circular to appendix 3 of the new operational guideline 9 (Audit in Local Government) for issues that should be considered for inclusion in the Chief Executive Officer’s review of risk management, internal control and legislative compliance. Items contained within appendix 3 of the guideline 9 were used as a guide for carrying out this review. The overall conclusion from this review is that the City has established systems and procedures in regards to risk management, internal control and legislative compliance. These systems and procedures are continually being improved.

FINANCIAL IMPLICATIONS:

There are no financial implications related to this report.

COMMENTS:

This is the first instance whereby a biennial review of systems and procedures in relation to risk management, internal control and legislative compliance was required to be undertaken. Advice from the Department of Local Government and Communities suggests that the biennial review is more aimed at assisting smaller local governments who may not have established systems and procedures in the above mentioned areas. Nevertheless, the review undertaken by the City presented an opportunity to document its relevant systems and procedures as well as improvement initiatives and plans. It is considered that undertaking the review by officers with expertise in areas mentioned above is appropriate and a more efficient process especially given the number of items for consideration in each area as outlined in appendix 3 of guideline 9. Completion of the review and presentation of results at the October 2014 Audit and Risk Committee (and Council following the Committee Meeting) enables the City to meet the deadline of 31 December 2014.

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 20: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 17 - 22 OCTOBER 2014

Moved by Cr Butler, seconded by Cr Yong, The Council approves the review of systems and procedures in regards to risk management, internal control and legislative compliance, as detailed in Confidential Schedules 4, 5 and 6. The motion was put and carried The votes were recorded as follows: For: Crs Davidson, Butler, Yong and Mr Linden Against: Nil

AR47/14 CONFIDENTIAL ITEM – UPDATE – CITY OF PERTH KEY PROCUREMENT ISSUES AND ACTIVITIES

BACKGROUND:

FILE REFERENCE: P1029779 REPORTING OFFICER: Mario Cheldi, Internal Auditor RESPONSIBLE DIRECTOR: Robert Mianich, Director Corporate Services DATE: 16 September 2014 MAP / SCHEDULE: N/A In accordance with Section 5.23(2)(f)(i) of the Local Government Act 1995, this item is confidential and was been distributed to the Members under separate cover. Confidential Item AR47/14 is bound in Confidential Minute Book Volume 1 2014. Moved by Cr Butler, seconded by Mr Linden, That Council receives the report titled “Update – City of Perth Key Procurement Issues and Activities”. The motion was put and carried The votes were recorded as follows: For: Crs Davidson, Butler, Yong and Mr Linden Against: Nil

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 21: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 18 - 22 OCTOBER 2014

AR48/14 CONFIDENTIAL ITEM – INTERNAL AUDIT 2013/14 – REVIEW OF CONTRACT MANAGEMENT

BACKGROUND:

FILE REFERENCE: P102969-8 REPORTING OFFICER: Mario Cheldi, Internal Auditor RESPONSIBLE DIRECTOR: Robert Mianich, Director Corporate Services DATE: 13 October 2014 MAP / SCHEDULE: Confidential Schedule 7 – City of Perth Contract

Management Review In accordance with Section 5.23 (2)(a) of the Local Government Act 1995, this item is confidential and was been distributed to the Members under separate cover. Confidential Item AR48/14 is bound in Confidential Minute Book Volume 1 2014. Moved by Mr Linden, seconded by Cr Yong, That Council approves the review of existing controls and practices over the management of contracts as part of the Internal Audit Plan 2013/14 as detailed in Confidential Schedule 7. The motion was put and carried The votes were recorded as follows: For: Crs Davidson, Butler, Yong and Mr Linden Against: Nil

AR49/14 MOTIONS OF WHICH PREVIOUS NOTICE HAS BEEN GIVEN

Nil

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX

Page 22: AUDIT AND RISK COMMITTEE - City of Perth 10 14... · AUDIT AND RISK COMMITTEE . 22 OCTOBER 2014 . ... AUDIT\AR141022 - MINUTES.DOCX . FB CTE MINS 22 OCTOBER 2014 : ... Corporate Business

AUDIT AND RISK COMMITTEE

- 19 - 22 OCTOBER 2014

AR50/14 GENERAL BUSINESS Responses to General Business from a Previous Meeting Nil New General Business 1. Scheduling Audit and Risk Committee to Consider Audited Annual Financial

Statement The Director Corporate Services tabled the signed Audited Annual Financial Statements for the information of members and advised that an Audit and Risk Committee meeting will be scheduled in consultation with the Presiding Member to enable the Annual Financial Statements to be considered.

2. Scheduling Audit and Risk Committee in 2015

The Director Corporate Services advised the proposed meeting dates previously circulated and proposed for 2015, being 23 February, 25 May and 2 November and noted that these will be formally confirmed by advice from the Presiding Member.

AR51/14 ITEMS FOR CONSIDERATION AT A FUTURE MEETING Outstanding Items: Nil

AR52/14 CLOSE OF MEETING There being no further business the Presiding Member declared the meeting closed at 4.50pm.

I:\CPS\ADMIN SERVICES\COMMITTEES\7. AUDIT\AR141022 - MINUTES.DOCX