Enhancing Risk Management and Internal Audit Framework for Local Councils in NSW

New risk management and New risk management and internal audit framework internal audit framework for local councils in NSW for local councils in NSW Note: ARIC ARIC = audit, risk and improvement committee = audit, risk and improvement committee IA IA = internal audit = internal audit RM = risk management = risk management Local Government Act 1993 RM LG Act LG Act = = Local Government Act 1993

Statutory framework Statutory framework Legislation Legislation LG Act s 8 LG guiding principles - sound financial management and RM s 428A s 428A - each council must have an ARIC s 428B s 428B - councils can share ARICs LG Act Layer Layer 1 1 s 8 LG guiding principles New Regulations New Regulations Layer Layer 2 2 Minimum regulatory requirements for ARICs, IA function and RM framework New Mandatory Guidelines New Mandatory Guidelines Replace the 2008 Internal Audit Guidelines by OLG Provide comprehensive guidance Layer Layer 3 3

Layer 1 Layer 1 - - LG Act LG Act Legislative compliance Risk management Performance measurement ARIC to review Service delivery Internal & external audit Fraud & corruption controls (s 428A LG Act) Financial management & performance

Layer 1 Layer 1 LG Act LG Act Shared arrangements s 248B LG Act Propose two options in new regulations: independent shared arrangements shared arrangement through JO or ROC Councils can share all or part of their ARIC, Chief Audit Executive, IA function, secretariat etc Proviso: no council can be disadvantaged from being in a shared arrangement

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines New New mandatory tiered approach with different prequalification requirements 3 tiers based on population, risk profile, revenue, proximity to urban centre: 1. Rural councils, JOs, county councils 2. Regional councils 3. Metro councils + N/castle, W/gong, C/Coast, Lake Macq ARICs: All tiers must have a prequalified chair Other ARIC members: 1. Rurals/JOs/county councils chair + 2 independent/un- prequalified members, can seek exemption from prequalified chair 2. Regionals: chair + 1 prequalified member and 1 independent/un-prequalified member 3. Metros: chair + 2 prequalified members

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines New New eligibility criteria for independent/un-prequalified members to ensure minimum skills and knowledge includes ability for councils to allow local community knowledge as criteria for appointment to tier 2 or 3 ARICs New New independence requirements that allow for members with LG knowledge whilst still maintaining ARIC independence ARICs: New New ARIC fees set by councils to help minimise costs New New term limits to make it easier to appoint ARIC members longer maximum terms coincide with council terms exemptions from term limits where tier 1 councils can t find new members

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines New New flexibility in ARIC s role: reviews all matters in s428A over the council term more flexibility to shape ARIC s role to council s needs New New stronger links between ARIC and governing body annual and four-yearly meetings between ARIC and governing body to discuss key risks, trends, concerns optional councillor non-voting ARIC member quarterly reports to councillors to summarise ARIC findings and recommendations ARIC Chair/Mayor can meet anytime ARICs: New New enhanced leadership role for ARIC chairs

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines New New flexibility for councils regarding confidentiality of ARIC agendas and minutes governing body decides each council term New New unrestricted access by ARIC to GM and senior staff only access to other staff requires GM approval ARICs: New New stronger appointment and induction processes for ARIC members New New implementation timeline: all councils have an ARIC by June 2022 compliance with membership requirements by 2027

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines New New flexibility in implementation and workforce resourcing RM Coordinator is now a function not a position that needs to be recruited to GM can delegate RM to any staff member removed need for RM responsibilities to be included in senior staff contracts Risk management: New New ability for county councils and JOs to share RM New New accountability to the ARIC and governing body ARIC reviews RM framework each council term RM framework discussed with ARIC and governing body annually and each council term New New implementation timeline compliance by 2024

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines New New optional tiered approach for IA function to reduce costs and provide greater flexibility Large councils (recommended): in-house IA function overseen by Head of IA (council employee) who supports ARIC and leads audits Head of IA meets requirements of professional internal auditor (if necessary) optional IA in-house staff or external providers undertake audits Internal Audit Small-medium councils (recommended): external provider/auditor undertakes audits new IA coordinator function performs administrative functions (e.g. mailbox between provider and ARIC, secretariat)

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines Rural/remote councils: encouraged to enter shared arrangement with other councils or their JO JOs: encouraged to establish shared arrangement for member councils and JO to use, or utilise a member council s ARIC and IA function Internal Audit County councils: encouraged to utilise a member council s ARIC and IA function New New simplified shared arrangements oversight by councillor and administrative committee removed

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines New New flexibility in implementation and workforce resourcing: specific title and eligibility criteria for Head of IA function removed IA function can report to senior staff member other than GM can combine Head of IA function with another role provided safeguards are met Internal Audit New New implementation timeline compliance by 2024

Layers 2 & 3 Layers 2 & 3 new regulations and guidelines new regulations and guidelines New New: Signed by GM only GM to consult ARIC before publication New: New: Attestation does not commence until 2027 to coincide with new implementation timeframes Accountability New: New: Attestation template developed by OLG clarifies what councils are attesting to New: New: DPIE response to exemption requests to be published in council s annual report

Next steps Next steps Act amendments commenced - 18 August August 2021 3 month consultation on new guidelines and model documents 24 August 26 November Aug-Nov 2021 Framework commences 4 June all councils must have an ARIC New regulations and guidelines prescribed before June June 2022 Full compliance: Full compliance: 2024 RM and IA function 2027 ARIC composition 2024- 27