Notice of Meeting
Audit, Risk and Improvement Committee Meeting
An Audit, Risk and Improvement Committee Meeting of Byron Shire Council will be held as follows:
Venue |
Conference Room, Station Street, Mullumbimby |
Date |
Thursday, 16 February 2023 |
Time |
11.30am |
Esmeralda Davis
Director Corporate and Community Services
I2023/135
Distributed
02/02/23
CONFLICT OF INTERESTS
What is a “Conflict of Interests” - A conflict of interests can be of two types:
Pecuniary - an interest that a person has in a matter because of a reasonable likelihood or expectation of appreciable financial gain or loss to the person or another person with whom the person is associated.
Non-pecuniary – a private or personal interest that a Council official has that does not amount to a pecuniary interest as defined in the Code of Conduct for Councillors (eg. A friendship, membership of an association, society or trade union or involvement or interest in an activity and may include an interest of a financial nature).
Remoteness – a person does not have a pecuniary interest in a matter if the interest is so remote or insignificant that it could not reasonably be regarded as likely to influence any decision the person might make in relation to a matter or if the interest is of a kind specified in the Code of Conduct for Councillors.
Who has a Pecuniary Interest? - a person has a pecuniary interest in a matter if the pecuniary interest is the interest of the person, or another person with whom the person is associated (see below).
Relatives, Partners - a person is taken to have a pecuniary interest in a matter if:
· The person’s spouse or de facto partner or a relative of the person has a pecuniary interest in the matter, or
· The person, or a nominee, partners or employer of the person, is a member of a company or other body that has a pecuniary interest in the matter.
N.B. “Relative”, in relation to a person means any of the following:
(a) the parent, grandparent, brother, sister, uncle, aunt, nephew, niece, lineal descends or adopted child of the person or of the person’s spouse;
(b) the spouse or de facto partners of the person or of a person referred to in paragraph (a)
No Interest in the Matter - however, a person is not taken to have a pecuniary interest in a matter:
· If the person is unaware of the relevant pecuniary interest of the spouse, de facto partner, relative or company or other body, or
· Just because the person is a member of, or is employed by, the Council.
· Just because the person is a member of, or a delegate of the Council to, a company or other body that has a pecuniary interest in the matter provided that the person has no beneficial interest in any shares of the company or body.
Disclosure and participation in meetings
· A Councillor or a member of a Council Committee who has a pecuniary interest in any matter with which the Council is concerned and who is present at a meeting of the Council or Committee at which the matter is being considered must disclose the nature of the interest to the meeting as soon as practicable.
· The Councillor or member must not be present at, or in sight of, the meeting of the Council or Committee:
(a) at any time during which the matter is being considered or discussed by the Council or Committee, or
(b) at any time during which the Council or Committee is voting on any question in relation to the matter.
No Knowledge - a person does not breach this Clause if the person did not know and could not reasonably be expected to have known that the matter under consideration at the meeting was a matter in which he or she had a pecuniary interest.
Non-pecuniary Interests - Must be disclosed in meetings.
There are a broad range of options available for managing conflicts & the option chosen will depend on an assessment of the circumstances of the matter, the nature of the interest and the significance of the issue being dealt with. Non-pecuniary conflicts of interests must be dealt with in at least one of the following ways:
· It may be appropriate that no action be taken where the potential for conflict is minimal. However, Councillors should consider providing an explanation of why they consider a conflict does not exist.
· Limit involvement if practical (eg. Participate in discussion but not in decision making or vice-versa). Care needs to be taken when exercising this option.
· Remove the source of the conflict (eg. Relinquishing or divesting the personal interest that creates the conflict)
· Have no involvement by absenting yourself from and not taking part in any debate or voting on the issue as of the provisions in the Code of Conduct (particularly if you have a significant non-pecuniary interest)
Committee members are reminded that they should declare and manage all conflicts of interest in respect of any matter on this Agenda, in accordance with the Code of Conduct.
RECORDING OF VOTING ON PLANNING MATTERS
Clause 375A of the Local Government Act 1993 – Recording of voting on planning matters
(1) In this section, planning decision means a decision made in the exercise of a function of a council under the Environmental Planning and Assessment Act 1979:
(a) including a decision relating to a development application, an environmental planning instrument, a development control plan or a development contribution plan under that Act, but
(b) not including the making of an order under that Act.
(2) The general manager is required to keep a register containing, for each planning decision made at a meeting of the council or a council committee, the names of the councillors who supported the decision and the names of any councillors who opposed (or are taken to have opposed) the decision.
(3) For the purpose of maintaining the register, a division is required to be called whenever a motion for a planning decision is put at a meeting of the council or a council committee.
(4) Each decision recorded in the register is to be described in the register or identified in a manner that enables the description to be obtained from another publicly available document and is to include the information required by the regulations.
(5) This section extends to a meeting that is closed to the
public.
OATH AND AFFIRMATION FOR COUNCILLORS
Councillors are reminded of the oath of office or affirmation of office made at or before their first meeting of the council in accordance with Clause 233A of the Local Government Act 1993. This includes undertaking the duties of the office of councillor in the best interests of the people of Byron Shire and the Byron Shire Council and faithfully and impartially carrying out the functions, powers, authorities and discretions vested under the Act or any other Act to the best of one’s ability and judgment.
BYRON SHIRE COUNCIL
2. Declarations of Interest – Pecuniary and Non-Pecuniary
3. Adoption of Minutes from Previous Meetings
3.1 Minutes of the Audit, Risk and Improvement Committee Meeting held 17 November 2022.................................................................................................................................. 6
4. Staff Reports
Corporate and Community Services
4.1 ARIC Self Assessment 2022........................................................................................ 8
4.2 Internal Audit Charter.................................................................................................. 12
4.3 Policies for review: Risk Management Policy and Fraud and Corruption Control Policy........................................................................................................................................ 15
4.4 Internal Audit Plan 2023-2024 - Detailed version................................................... 18
5. Confidential Reports
Corporate and Community Services
5.1 Confidential - Internal Audit Report Quarter 2 2022-2023 including Plant and Fleet Review and Corporate Cards Review...................................................................... 21
5.2 Confidential - 2022 Year End Management Letter......................................... 23
5.3 Confidential - Cyber Security and IT System Outages Quarterly Update.. 25
6. Late Reports
7. For Information Only
7.1 Delivery Program 6-monthly Report and Operational Plan 2022/23 Quarter 2 Report - to 31 December 2022.................................................................................................. 27
7.2 External Audit of Development Applications: Assessment and Determination Stages........................................................................................................................................ 31
BYRON SHIRE COUNCIL
Adoption of Minutes from Previous Meetings 3.1
Adoption of Minutes from Previous Meetings
Report No. 3.1 Minutes of the Audit, Risk and Improvement Committee Meeting held 17 November 2022
Directorate: Corporate and Community Services
Report Author: Mila Jones, Governance and Internal Audit Coordinator
File No: I2022/1902
RECOMMENDATION:
That the minutes of the Audit, Risk and Improvement Committee Meeting held on 17 November 2022 be confirmed.
Report
The unconfirmed minutes of the Audit, Risk and Improvement Committee Meeting of 17 November 2022 are available on Council’s website and can be viewed at this link.
Report to Council
The minutes were reported to and adopted by Council on 15 December 2022. Council endorsed all the Committee’s recommendations at resolutions 22-712 to 22-717.
BYRON SHIRE COUNCIL
Staff Reports - Corporate and Community Services 4.1
Staff Reports - Corporate and Community Services
Report No. 4.1 ARIC Self Assessment 2022
Directorate: Corporate and Community Services
Report Author: Esmeralda Davis, Director Corporate and Community Services
File No: I2023/91
Summary:
This report presents the outcome of the self-assessment that was completed by Audit, Risk and Improvement Committee members on the performance of the Committee in 2022.
RECOMMENDATION:
That the Audit, Risk and Improvement Committee notes this report and that the Chair work with the General Manager to address any issues identified in the self-assessment questionnaire shown at Attachment 1 (E2023/8423).
Attachments:
1 Confidential - ARIC Self-Assessment Questionnaire Results - January to December 2022, E2023/8423
Report
In order to meet its obligation under clause 11 of the ARIC Constitution:
The Chair of the Committee shall initiate a review of the performance of the Committee annually. The review shall be conducted on a self-assessment basis (unless otherwise determined by the Chair), with appropriate input from management and any other relevant stakeholders, as determined by the Chair.
The Chair distributed a self-assessment questionnaire to all Audit, Risk and Improvement Committee members in December 2022. The completed questionnaires were provided to the Chair by the individual members, these were collated into one document by the Chair and the results provided for this report. Refer to Attachment 1.
This report recommends that the Chair work with the General Manager to address any issues identified in the attached Self-Assessment Questionnaire, as required.
Key issues
The self-assessment questionnaire covered the following areas of committee performance:
- Independent assurance
- Promotion of governance
- Communication
- Meetings
- Committee members’ contribution
- Overall contribution
The responses and feedback provided to the Chair identified both areas of strength and opportunities for continuous improvement. The response evaluation used a scale from 1 (strongly disagree) to 5 (strongly agree). The Chair has advised that individual scores were averaged, and therefore represent the majority view, rather than a unanimous position.
In general terms, areas highlighted by members as working well include:
- Committee Members collectively have the expertise and skill set required to fulfil the goals and purpose of the Committee
- Open discussion works well
However, overall the reported performance of the Committee generally scored low.
Areas identified for continuous improvement include:
- Confidence that the Committee can provide independent assurance across the remit of responsibilities
- Communication
- Meetings
- Overall contribution
Management Comments
The function and role of the Audit Risk and Improvement Committee and the expertise of individual members is recognised and valued by management as an important line of defence in Council’s approach to risk management. Similarly, the role of the internal audit function delivered by Grant Thornton, is also recognised as a key mechanism to identify and mitigate priority risks and deliver on improvement opportunities.
We agree there are several areas of performance which could be improved to increase the effectiveness of the ARIC and have been actively working with the Committee to openly discuss the challenges and options for moving forward towards shared outcomes. As a result of these discussions, we have engaged two expert external facilitators to deliver a workshop to ARIC on 8 February, which we hope will address some of the concerns raised by members including:
- Improved understanding of audit, risk and improvement
- Clarity of roles, duties and relationship between “ARIC and Management”
- Improved understanding of relationship to internal audit
There will be an opportunity to workshop case studies/scenarios, clarify issues of concern and express a preferred way of working in the future, including the frequency and duration of meetings.
Furthermore, the release of the draft OLG Guidelines for Risk Management and Internal Audit, which are due to be fully implemented by Councils by 2024, will support the Committee as a robust governance mechanism for ensuring Council is doing things the best way it can for the community and is on track to delivering the community’s goals and objectives. Management is currently working to map out an implementation plan for elements of the guidelines which are not currently in place at Byron Shire Council, working to full compliance by June 2024.
Strategic Considerations
Community Strategic Plan and Operational Plan
CSP Objective |
CSP Strategy |
DP Action |
Code |
OP Activity |
1:
Effective Leadership |
1.2: Engage and involve community in decision making |
1.2.4: Advisory Committees - Coordinate advisory committees to inform decision making on their areas of expertise |
1.2.4.2 |
Coordinate the Audit Risk and Improvement Committee and internal audit program including reporting |
Recent Resolutions
Not applicable
Legal/Statutory/Policy Considerations
- Audit, Risk and Improvement Committee Constitution
- (draft) Office of Local Government have provided their Guidelines on Risk Management and Internal Audit for Local Government in NSW - although still in draft format (soon to be finalised), the Guidelines specify that an annual assessment by the ARIC forms part of the core requirement of the ARIC and the requirement will commence from 1 July 2024
Financial Considerations
No financial implications
Consultation and Engagement
The ARIC Chair distributed the self-assessment questionnaire to members in December 2022 and provided the results to staff on 24 January 2023 for reporting to the ARIC.
BYRON SHIRE COUNCIL
Staff Reports - Corporate and Community Services 4.2
Report No. 4.2 Internal Audit Charter
Directorate: Corporate and Community Services
Report Author: Mila Jones, Governance and Internal Audit Coordinator
File No: I2023/119
Summary:
This report presents a draft Internal Audit Charter for review and endorsement based on the Office of Local Government’s Model Internal Audit Charter which is included in their Guidelines for Risk Management and Internal Audit Framework for Local Council's in NSW.
RECOMMENDATION:
That the Audit, Risk and Improvement Committee endorses the draft Internal Audit Charter (Attachment 1 E2023/127884) for adoption by Council.
Attachments:
1 DRAFT
Internal Audit Charter - February 2023, E2022/127884
Report
The Office of Local Government (OLG) has approved their Guidelines for Risk Management and Internal Audit Framework for Local Council's in NSW (Guidelines) as advised in their Circular to Councils 22-41. The Guidelines have provided a model Internal Audit Charter for use by Councils. This report presents a draft Internal Audit Charter based on this model and Byron Shire Council’s operations.
The Guidelines state that it is important that a Council’s internal audit function has clear guidance on how it should support the Audit, Risk and Improvement Committee (ARIC) and that the ARIC has input into how the internal audit function will operate. This will ensure there is clarity in the relationships between the ARIC, the Council and the internal audit function.
The Guidelines also state that the Local Government (General) Regulation (once assented to) will require each Council to adopt an internal audit charter. This report recommends that the ARIC reviews and endorses the draft at Attachment 1.
Next Steps
At the May 2023 ARIC meeting, a report will be presented to provide an implementation plan for the Guidelines which will include any functions that are to commence from 1 July 2024 and have not yet been implemented by Council.
Strategic Considerations
Community Strategic Plan and Operational Plan
CSP Objective |
CSP Strategy |
DP Action |
Code |
OP Activity |
1: Effective Leadership |
1.2: Engage and involve community in decision making |
1.2.4: Advisory Committees - Coordinate advisory committees to inform decision making on their areas of expertise |
1.2.4.2 |
Coordinate the Audit Risk and Improvement Committee and internal audit program including reporting |
Recent Resolutions
Not applicable
Legal/Statutory/Policy Considerations
Guidelines for Risk Management and Internal Audit Framework for Local Council's in NSW (Guidelines) as advised in their Circular to Councils 22-41.
Financial Considerations
Council has an annual budget for the internal audit function.
Consultation and Engagement
The draft Internal Audit Charter has been endorsed by the Executive Team for reporting to the ARIC.
BYRON SHIRE COUNCIL
Staff Reports - Corporate and Community Services 4.3
Report No. 4.3 Policies for review: Risk Management Policy and Fraud and Corruption Control Policy
Directorate: Corporate and Community Services
Report Author: Mila Jones, Governance and Internal Audit Coordinator
File No: I2022/1903
Summary:
This report presents the draft revised Risk Management Policy and draft revised Fraud and Corruption Control Policy (and associated strategy) to the Audit, Risk and Improvement Committee for review prior to reporting to Council for adoption.
RECOMMENDATION:
That the Audit, Risk and Improvement Committee endorses that the draft revised Risk Management Policy and draft revised Fraud and Corruption Control Policy and both be reported to Council for adoption.
1 DRAFT
Policy: Risk Management 2023, E2022/117777
2 DRAFT
Policy: Fraud and Corruption Control 2023, E2022/121613
3 DRAFT
Fraud and Corruption Control Strategy 2023, E2022/121935
Report
As part of Council’s compliance framework, an annual review of Council’s public policies is undertaken, and reports are regularly provided to the Audit, Risk and Improvement Committee (ARIC) and Council on the status of this review program.
This report presents two policies within the remit of the ARIC, following a review and amendments made by staff and endorsement by the Executive Team. The draft revised policies are the Risk Management Policy and the Fraud and Corruption Control Policy (and its associated Fraud and Corruption Control Strategy). The reason for the revisions to these policies are noted below.
Risk Management Policy
This Policy, shown at Attachment 1, has been reviewed by the Strategic Risk Coordinator and other Corporate Services staff and proposed significant changes as shown in track changes.
Fraud and Corruption Control Policy and Strategy
This Policy and Strategy, shown at Attachments 2 and 3 have been reviewed by Legal Counsel and the Strategic Contracts and Procurement Coordinator who proposed the following amendments (as track changed in the document):
· Updated definitions in accordance with the ICAC Act.
· Updated reference to the latest Community Strategic Plan
· Removal of Appendix 1 – Fraud Control Plan as it is no longer necessary to document in this format and not in line with current practice
· The Fraud and Corruption Control Strategy has also been updated to reflect Policy changes. Note, this strategy is not reported to Council. It is for endorsement by the Executive Team and ARIC only.
Strategic Considerations
Community Strategic Plan and Operational Plan
CSP Objective |
CSP Strategy |
DP Action |
Code |
OP Activity |
1: Effective Leadership |
1.1: Enhance trust and accountability through open and transparent leadership |
1.1.1: Leadership - Enhance leadership effectiveness, capacity, and ethical behaviour |
1.1.1.1 |
Coordinate Council's annual policy review program, update and publish adopted policies |
Legal/Statutory/Policy Considerations
When policies are reviewed, they are assessed as to whether the policy is current, redundant, requires updating, can be aggregated with another policy or may be converted to a Standard (internal staff policy), Procedure or Guideline.
When reviewing our policies, Council’s Corporate Documents Standard (internal policy) provides the following guidance to staff:
A Policy sets out Byron Shire Council’s position on a specific matter – a formal statement of intent and non-discretionary governing principles that apply to Byron Shire Council’s practice. The principles are derived from and shaped by the law and regulations that apply, community expectations, and the values and mission contained in the adopted Community Strategic Plan. A Policy is a concise document that may facilitate, enable or constrain practice, standard, guidelines or delegated functions but does not prescribe in detail how to perform certain functions - instead it provides a framework for action with its primary role being to guide the achievement of the adopted strategic goals and ensure legislative compliance.
The most recent developments in legislative requirements, and the community’s and Council’s position on certain matters, are checked for each policy to determine whether a policy requires updating, or whether a policy is still necessary. A policy may no longer be necessary, for instance, if legislation now wholly covers Council’s policy position, or if a Policy reflects legislation that no longer exists.
Financial Considerations
Nil
Consultation and Engagement
The Executive Team was consulted at meetings held on 7 and 21 December 2022. Consultation will occur with Council at their next available meeting should the staff recommendation to this report be endorsed.
BYRON SHIRE COUNCIL
Staff Reports - Corporate and Community Services 4.4
Report No. 4.4 Internal Audit Plan 2023-2024 - Detailed version
Directorate: Corporate and Community Services
Report Author: Mila Jones, Governance and Internal Audit Coordinator
File No: I2023/63
Summary:
At the Audit, Risk and Improvement Committee (ARIC) meeting held on 17 November 2022, the Committee requested that internal auditors provide a detailed version of the adopted internal audit plan 2023-2024 for the first ARIC meeting in 2023.
RECOMMENDATION:
That the Audit, Risk and Improvement Committee endorses the scope of the audits to be undertaken in 2023-2024 as contained in the attached Internal Audit Plan (Attachment 1 E2023/8002).
Attachments:
1 Confidential - Internal Audit Plan 2023-2024 Detailed (v. January 2023), E2023/8002
Report
At the ARIC meeting held on 17 November 2022, the Internal Audit Plan for 2023-2024 was presented and endorsed. The version endorsed included scope summaries for the upcoming audits. The Committee requested at that meeting, that a detailed version of the scopes be presented to the first ARIC meeting in 2023, which this report now provides.
The internal audits scheduled for 2023-2024 are:
Quarter 1 – Disaster Recovery and Planning
Quarter 2 – Waste Management
Quarter 3 – Work Health and Safety
Quarter 4 – Development Contributions
Key issues
The timing of the proposed internal audits has been informed by operational and strategic priorities, as well as resourcing capacity, to ensure that internal audits optimise value for Council. This plan has previously been endorsed by ARIC and Council.
Strategic Considerations
Community Strategic Plan and Operational Plan
CSP Objective |
CSP Strategy |
DP Action |
Code |
OP Activity |
1: Effective Leadership |
1.2: Engage and involve community in decision making |
1.2.4: Advisory Committees - Coordinate advisory committees to inform decision making on their areas of expertise |
1.2.4.2 |
Coordinate the Audit Risk and Improvement Committee and internal audit program including reporting |
Recent Resolutions
· 22-713 Ordinary Meeting 17 November 2022
Legal/Statutory/Policy Considerations
The performance of the Internal Audit Services is required to be undertaken in accordance with the terms and conditions of Internal Audit Services Contract 2021-0001. These terms and conditions require consideration of the NSW Department of Premier and Cabinet, Office of Local Government, Internal Audit Guidelines and compliance with the associated professional accounting and audit standards.
Financial Considerations
There has been budget allocated to resource four internal audits per year in accordance with the tender criteria set by Council, and the contractual arrangements accepted by Grant Thornton. Grant Thornton are Council’s current contracted internal auditors until 30 June 2024.
Consultation and Engagement
In preparing the updated Plan, Grant Thornton consulted with:
· Internal Audit Committee Members
· Council’s Executive Team
· Director Corporate Services
· Governance and Internal Audit Coordinator
BYRON SHIRE COUNCIL
Confidential Reports - Corporate and Community Services 5.1
Confidential Reports - Corporate and Community Services
Report No. 5.1 Confidential - Internal Audit Report Quarter 2 2022-2023 including Plant and Fleet Review and Corporate Cards Review
Directorate: Corporate and Community Services
Report Author: Mila Jones, Governance and Internal Audit Coordinator
File No: I2022/1906
Summary:
This report presents the Internal Audit Recommendations Summary Report for Quarter 2 2022-2023 prepared by the Internal Auditor, Grant Thornton (GT). The report is at Confidential Attachment 1. It also presents the full internal audit status report for Quarter 2 which is at Attachment 2.
This report also presents the Internal Audit of Plant and Fleet and Internal Audit of Corporate Cards (undertaken in November 2022) completed by GT. These reports are at Confidential Attachments 3 and 4. The Plant and Fleet audit received a review rating of Needs Improvement and it identified three high, one moderate and two low rated issues. The Corporate Cards audit received a review rating of Acceptable and it identified three moderate and two low rated issues.
RECOMMENDATION:
1. That pursuant to Section 10A(2)(d)i of the Local Government Act, 1993, The Audit, Risk and Improvement Committee move into Confidential Session to discuss the report Internal Audit Report Quarter 2 2022-2023 including Plant and Fleet Review and Corporate Cards Review.
2. That the reasons for closing the meeting to consider this item is that the report contains:
a) commercial information of a confidential nature that would, if disclosed prejudice the commercial position of the person who supplied it
3. That on balance it is considered that receipt and discussion of the matter in open session would be contrary to the public interest, as the nature and content of internal audit reports is for operational purposes.
1 Confidential - Internal Auditor Summary of IA Recommendations Status for Quarter 2 2022-2023, E2023/7733
2 Confidential - Internal Audit Recommendations Status for Quarter 2 2022-2023, E2023/3535
3 Confidential - Internal Audit Report - Plant and Fleet - FINAL 2022, E2022/127137
4 Confidential - Internal Audit Report - Corporate Cards - FINAL 2022, E2022/126217
BYRON SHIRE COUNCIL
Confidential Reports - Corporate and Community Services 5.3
Report No. 5.2 Confidential - 2022 Year End Management Letter
Directorate: Corporate and Community Services
Report Author: James Brickley, Manager Finance
File No: I2023/123
Summary:
Council has received the 2022 Year End Audit Management Letter from the External Auditor, the Audit Office of NSW, relating to the 2021/2022 financial year audit. The Year End Audit Management Letter details three items for management to consider and provides recommendations to improve internal controls and financial reporting processes.
Each of the audit matters raised in the 2022 Year End Audit Management Letter has been identified in this report for consideration by Council and the Audit, Risk and Improvement Committee.
RECOMMENDATION:
1. That pursuant to Section 10A(2)(f) of the Local Government Act, 1993, Council resolves to move into Confidential Session to discuss the report 2022 Year End Management Letter.
2. That the reasons for closing the meeting to the public to consider this item be that the report contains:
a) details of systems and/or arrangements that have been implemented to protect council, councillors, staff and council property
3. That on balance it is considered that receipt and discussion of the matter in open Council would be contrary to the public interest, as:
Nature and content of audit reports is for operational purposes and report details information about Council systems, controls and processes.
1 Confidential - 2022 Year End Management Letter from Audit Office of NSW, E2023/10387
Report No. 5.3 Confidential - Cyber Security and IT System Outages Quarterly Update
Directorate: Corporate and Community Services
Report Author: Colin Baker, Manager Business Systems and Technology
File No: I2023/4
Summary:
This report provides a summary of cyber security activities and IT service outages during the reporting period from 1 October 2022 to 31 December 2022.
Cyber security improvement work is ongoing. Council is now utilising security testing services available through the NSW Government agency, Cyber NSW. The most recent check from Cyber NSW was made on Council’s public websites. This identified several cyber vulnerabilities across multiple websites.
There were several cyber events & one significant cyber incident during the reporting period. The cyber incident occurred with a cloud-based password management tool used by the IT team; LastPass. This application is used to store all sensitive IT account information. LastPass reported a major cyber breach, impacted all customers.
There were no significant IT system outages during the reporting period.
RECOMMENDATION:
1. That pursuant to Section 10A(2)(f) of the Local Government Act, 1993, Council resolves to move into Confidential Session to discuss the report Cyber Security and IT System Outages Quarterly Update.
2. That the reasons for closing the meeting to the public to consider this item be that the report contains:
a) details of systems and/or arrangements that have been implemented to protect council, councillors, staff and Council property
3. That on balance it is considered that receipt and discussion of the matter in open Council would be contrary to the public interest, as:
Exposes information security risks and vulnerabilities that could assist unauthorised threats to Council's information and systems.
1 Cyber NSW Internet Facing Vulnerability Assessment Report - Key Recommendations, E2023/918
2 Summary extract of Cyber NSW penetration test 2022, E2023/1147
BYRON SHIRE COUNCIL
For Information Only 7.1
Report No. 7.1 Delivery Program 6-monthly Report and Operational Plan 2022/23 Quarter 2 Report - to 31 December 2022
Directorate: Corporate and Community Services
Report Author: Heather Sills, Manager Corporate Services
File No: I2023/134
Summary:
Council’s Operational Plan outlines its projects and activities to achieve the commitments in its four-year Delivery Program. In accordance with the Local Government Act 1993 progress reports must be provided at least every six months.
This report represents the progress toward the activities in the 2022/23 Operational Plan at the end of the first quarter, being 31 December 2022. A summary of the status is provided in the graph below:
This report also represents the ‘6-monthly edition’ of the Quarterly Report, providing an additional reporting layer regarding the Council’s progress toward the higher-level actions of the Delivery Program.
1 Delivery
Program and Operational Plan - Quarterly Report - December 2022, E2023/11308
Report
The Delivery Program and Operational Plan are two key corporate documents that establish Council’s goals and priorities for the term and the current financial year.
The Delivery Program (4-year) outlines the principal activities to be undertaken to implement the strategies established by the Community Strategic Plan (10-year), within the resources available under the Resourcing Strategy. All plans, projects, activities, and funding allocations must be directly linked to this program.
The Delivery Program is supported by the annual Operational Plan, which identifies the individual projects and activities that will be undertaken for the year to achieve the commitments made in the Delivery Program.
The General Manager is required to provide six monthly progress reports to the Council on the progress toward the delivery program, in accordance with the Local Government Act 1993 s404 which states:
“The general manager must ensure that regular progress reports are provided to the council reporting as to its progress with respect to the principal activities detailed in its delivery program. Progress reports must be provided at least every 6 months”
While the requirement is six monthly reporting, the Council is provided with a Quarterly Report on the activities in the Operational Plan, to promote effective and efficient reporting and decision making.
Community Objectives
The report (#E2023/11308) is structured by the five Community Objectives in the Byron Shire Community Strategic Plan:
· Effective Leadership: We have effective decision making and community leadership that is open and informed
· Inclusive Community: We have an inclusive and active community where diversity is embraced and everyone is valued
· Nurtured Environment: We nurture and enhance the natural environment
· Ethical Growth: We manage growth and change responsibly
· Connected Infrastructure: We have connected infrastructure, transport, and facilities that are safe, accessible, and reliable
Q2 Status by Community Objective:
The report details Council’s progress toward the activities in the 2022/23 Operational Plan. It includes a status update on progress and commentary on the activities undertaken during the reporting period.
Each section notes the progress against the activities including:
· Activity
· Measure
· Timeframe
· Comments
· Status
aCompleted: the activity has been completed in accordance with the prescribed measures
4On Track: progressing and on track, in accordance with the timeframe, measures, and budget
x Needs Attention: indicates that the scope of the activity may need to be reviewed in line with constraints such as timeframe/budget
; Delayed - progressing but not currently on track with the timeframe, measures, or budget
0 Not Commenced – not yet commenced or due to commence
Strategic Considerations
Community Strategic Plan and Operational Plan
CSP Objective |
CSP Strategy |
DP Action |
1:
Effective Leadership |
1.1: Enhance trust and accountability through open and transparent leadership |
1.1.4: Performance Measurement and Reporting - Embed a robust performance management system through the development of an outcomes measurement framework |
Legal/Statutory/Policy Considerations
The General Manager is required under Section 404 (5) of the Local Government Act 1993 to provide regular progress reports as to the Council’s progress with respect to the principal activities detailed in the Delivery Program/Operational Plan.
Financial Considerations
Council’s financial performance for the reporting period is addressed in the Quarterly Budget Review.
Consultation and Engagement
The progress reports on the Operational Plan and Delivery Program are published on Council’s website as a way of ensuring transparency around how Council is progressing activities and actions.
BYRON SHIRE COUNCIL
For Information Only 7.2
Report No. 7.2 External Audit of Development Applications: Assessment and Determination Stages
Directorate: Sustainable Environment and Economy
Report Author: Kylie Grainey, Business Improvement Officer
File No: I2022/1909
Summary:
This report is provided to the Audit, Risk and Improvement Committee (ARIC) for information about the outcome and recommendations of the Audit Office of NSW external performance audit of development applications – the assessment and determination stages (the Audit).
1 FINAL
REPORT - Development applications assessment and determination stages, E2023/1244
2 Formal
Response - NSW Auditor-General Report Performance Audit - Development
Applications: assessment and determination stages, E2022/121251
Report
This audit continues a series of audits by the NSW Audit Office examining the development assessment process in NSW Councils.
The Audit Office of New South Wales previously considered local government development assessments in a 2019 performance audit: 'Development assessment: pre-lodgement and lodgement in Camden Council and Randwick City Council'.
This audit focussed on local and regional development that requires assessment and determination by a local Council and/or an independent local planning panel or Sydney or regional planning panel in three Local Government Areas (LGAs).
Byron Shire Council was selected for the Audit, along with Northern Beaches Council and The Hills Shire Council. Audited Councils were selected from a range of criteria, including:
• the number, value and types of development applications determined in 2018–19
• average determination timeframes
• appeals against determinations and Land and Environment Court outcomes
• LGA demographics.
The objective of this audit was to assess whether:
• selected Councils have effectively assessed and determined development applications in compliance with relevant legislation, regulations and government guidance
• selected Councils and DPE effectively support independent planning panels to determine development applications in compliance with relevant legislation, regulations and government guidance.
The Auditor General of NSW formally advised the General Manager, Mayor and the then Chair of the ARIC on 1 November 2021 of the intention to undertake an external performance audit into Council’s assessment and determination of development applications.
The Audit Office of NSW presented its findings to Parliament on 12 December 2022. The full Auditor-General’s report is available on their website.
Council’s response to the findings and recommendations was also presented to Parliament. This is included as attachment 2.
The audit reporting period was for applications determined between 1 July 2019 and 30 June 2021. During this period there were many changes and pressures placed on staff, including:
· Transitioning from receiving hardcopy development applications to electronic lodgement as an early adopter of the NSW Planning Portal. This allowed for an easy transition to mandatory lodgement when Covid Public Health Orders resulted in closure of the Administration building.
· Introduction of the NSW Planning Portal and legislation changes resulting in subsequent mandating of development and associated certificates and approvals for all NSW Councils.
· Addressing Covid-19 impacts, including lockdowns, working from home, legislation changes, border closures.
· Transition to a fully electronic assessment process.
· Dramatic increase in development due to Government building stimulus, regional migration, low interest rates, lack of international travel.
The audit outcomes are an indication of the significant changes and challenges experienced over the two-year period.
The recommendations and comments will be used to improve our systems and processes.
Audit Recommendations
Council considered and accepted each of the recommendations. Some of which were implemented during the Audit process. The rest will be implemented by June 2023.
As a matter of priority, Byron Shire Council should:
Recommendation |
Response |
1. ensure all delegations for determination of development applications are followed. |
Assessment report templates have been amended to provide a means for delegations to be identified. |
By June 2023, Byron Shire Council should:
Recommendation |
Response |
2. finalise and implement a consolidated policies and procedures manual for development assessment |
Consolidation of processes and procedures has commenced. |
3. strengthen transparency over conflicts of interest within development applications assessment by: a. requiring a declaration of any interests to be made within assessment reports b. aligning or consolidating its policies that govern conflicts of interest management c. ensuring Councillors’ conflicts of interest declarations are retained in all meetings discussing or considering development applications
|
Transparency over conflicts of interest have/will be resolved as follows:
a. Development assessment reports now include a declaration that the assessing and delegated officer does not have a conflict of interest. b. The Management of Conflicts of Interest in Development Applications Procedure will be reviewed when the Code of Conduct is reviewed to ensure consistency. c. The Planning Review Committee are now required to declare any conflicts of interest in development applications discussed at meetings. |
4. strengthen its peer review process to ensure development application assessment reports meet quality and consistency requirements. |
The development assessment report template has been updated to minimise future errors.
|
Audit Conclusions
Council provided a response to each of the conclusions. Additionally, background information and a response to the Audit commentary was also provided. This can be viewed in Attachment 2.
Byron Shire Council has established clear roles, responsibilities and delegations for assessment and determination of development applications. However, the effectiveness of the Council’s approach is limited by gaps in governance, risk management and internal controls.
Byron Shire Council has established clear roles, responsibilities and delegations for assessment and determination of development applications. However, Council does not have a consolidated policy and procedure for development assessment; has not adequately followed up on the outcomes of internal reviews that identified opportunities to strengthen its assessment and determination procedures and approach; and has not demonstrated that it has managed relevant risks effectively.
The Council has not ensured that delegations have been consistently followed in the assessment of development applications.
Response:
Council has developed procedures for the lodgement, assessment, and determination of development applications. While these procedures are not within a consolidated form, staff are aware of the processes and senior staff provide guidance where necessary.
These procedures have been developed over a period of increased workload and significant change. They will be consolidated into a standard operating procedure as recommended.
Byron Shire Council’s approach to managing conflicts of interest in development assessments does not provide transparency over potential conflicts of interest.
Byron Shire Council manages the risk of conflicts of interest for development assessment under its Code of Conduct. The Council has also implemented a separate policy that details additional requirements for managing conflicts of interest relevant to the development assessment process but has not regularly updated this policy and requirements between it and the Code of Conduct have not been aligned. This creates a risk that planning staff may be following inconsistent or outdated advice in managing conflicts of interest.
Across the period of review, the Council did not require staff to provide a disclosure of interest for individual development applications to be contained within assessment reports. Including these disclosures would increase transparency and ensure that staff are sufficiently considering any conflicts of interest relevant to each separate assessment process.
Response:
Council has a Code of Conduct that applies to all members of staff. It is based on the Model Code of Conduct for Local Councils in NSW which has been prescribed under the Local Government (General) Regulation 2021. It is the principal document used by staff to manage conflicts of interest. Separate to this, and to minimise the potential for conflicts of interest arising from assessment of development applications, the Management of Conflicts of Interest in Development Matters Procedure was developed to support the Code of Conduct.
Staff are aware of both the policy and procedure, and act accordingly. As a result of the Audit, a declaration has been included in the assessment template of each development application (including modifications and reviews) to endorse this.
Byron Shire Council has processes that promote compliance with legislation, regulation and Government policy, but can improve how it undertakes some aspects of these that would ensure transparency, quality and consistency.
Our review of a sample of completed development applications from the Council indicated that most assessments were completed in compliance with relevant legislation, regulations, and Government guidance, but that there were some opportunities to improve elements of the assessment process including: transparency of any conflicts of interest involved in the assessment process; ensuring compliance with delegated authority limits; and consideration of modification application provisions.
The Council has established templates to guide planners through relevant assessment considerations required by legislation, regulations, and other guidance. However, it could do more to strengthen its approach to peer or manager review; monitoring legislative changes; and how it monitors the completion of relevant training by planning staff.
Response:
As a result of recommendations from this Audit, Council has made some minor changes to improve transparency, quality, and consistency. These are outlined below in the relevant commentary.
It is however noted the issues raised were of a minor nature and may have been a result of the excessive workloads over the reporting period as outlined in the background information above.
Council will now work towards implementing the remaining recommendations by 30 June 2023. This will include other improvements and process changes identified during the audit process.
Strategic Considerations
Community Strategic Plan and Operational Plan
N/A
Legal/Statutory/Policy Considerations
N/A
Financial Considerations
There are no financial considerations.
Consultation and Engagement