Review Of The Audit And Risk Committee Charter & Review Of The Internal Audit Policy · Attachment 1_Audit & Risk Committee Charter_Draft

Page 2

AUDIT & RISK COMMITTEE CHARTER


4       REVIEW

This Charter will be reviewed annually by the Committee or as required to ensure it remains
consistent with the Committee’s authority, objectives and responsibilities.
This review will include consultation with the Chairperson, Committee members and the Chief
Executive Officer. Any substantive changes to the Charter will be formally adopted by the Council
on the recommendation of the Committee.

5       LEGISLATIVE MANDATE

The Audit and Risk Committee is an advisory committee of Council established and governed in
accordance with Section 105 of Queensland’s Local Government Act 2009 and Sections 208-211 of
the Local Government Regulation 2012.

The Committee is an independent forum, with no delegation responsibility or management function
within Council, that acts as a source of advice to Council and the Chief Executive Officer (CEO) on
governance, risk management, accountability, financial reporting and management and audit related
matters.

6       ROLE AND RESPONSIBILITIES

The role of the Committee is to assist Council and the Chief Executive Officer to discharge their
responsibilities imposed under the Local Government Act and other relevant legislation, which
includes the requirement to monitor and review the following areas:

        Provide an independent review of Council’s financial statements to ensure the integrity and
         transparency of the financial reporting process.
        Engage with the external audit and assessing the adequacy of management response to
         issues identified by audit.
        Evaluate the quality of the Internal Audit function, particularly in the areas of planning,
         monitoring and reporting.
        Evaluate whether processes are in place to address key roles and responsibilities in relation
         to risk management.
        Evaluate the adequacy of the control environment to provide reasonable assurance that the
         systems of internal control are of high standard and functioning as intended.
        Monitor existing corporate policies and recommend new corporate policies that aim to
         prohibit unethical, questionable, or illegal activities.
        Monitor significant projects.
        Review the effectiveness of how council monitors compliance with relevant legislative and
         regulatory requirements and promotes a culture committed to lawful and ethical behaviour.
        Provide recommendations to Council and management about any matters that it considers
         needs action or improvement.

Furthermore, the Committee shall have a clear view of the maturity and performance of Council’s
core corporate governance systems including Council’s:
    Financial accounting processes, reporting and financial sustainability.
    Compliance frameworks.
    Governance structure, including financial delegations, adequate oversight, and reporting on
       significant projects or outsourced functions.
    Internal audit and other assurance providers, including external audit.
    Operational performance monitoring.

                                                                                              Page 2

Page 3

AUDIT & RISK COMMITTEE CHARTER


          Risk management, including fraud and corruption risk, business continuity.

The Committee’s responsibilities include:

6.1       Financial statements and reporting

      a) Review the appropriateness of accounting policies adopted by Council and ensure they are
         relevant to council and its specific circumstances.
      b) Review the appropriateness of significant assumptions and critical judgements made by
         management, particularly around estimations which impact on reported amounts of assets,
         liabilities, income, and expenses in the financial statements.
      c) Review the financial statements for compliance with prescribed accounting and other
         requirements.
      d) Review the results of the external audit and any significant financial issues identified.
      e) Analyse the financial performance and financial position and seek explanation for significant
         trends or variations from budget or forecasts.
      f) Monitor and assess progress against agreed financial statement preparation and auditing
         milestones.
      g) Review with management and the external auditors any significant adjustments or changes
         between draft and final financial statements.
      h) Review Council’s draft financial statements prior to submission to the Auditors and the final
         financial statements prior to adoption by Council.
      i) Review the draft annual report before release and consider the consistency of financial
         information being reported.


6.2       Internal audit

      a) Review and endorse the annual Internal Audit Plan to ensure it aligns with key risks of the
         council and provides adequate audit coverage.
      b) Monitor the extent of reliance on internal audit work by the external auditors to facilitate
         completeness of coverage and the effective use of audit resources.
      c) Review and monitor the quality, effectiveness, and objectivity of internal audit.
      d) Provide advice to the CEO and Council in relation to the appropriateness of Internal Audit
         resourcing and make recommendations if required.
      e) Review internal audit findings and assess the sufficiency of management responses to audit
         recommendations.
      f) Review management’s progress in implementing internal audit actions to address control
         weaknesses and manage risks within acceptable levels as reported in the Audit Actions
         Register.
      g) Periodically review the Internal Audit Policy to ensure appropriate authority, access and
         reporting arrangements are in place.


6.3       Risk management

      a) Review Council’s Enterprise Risk Management Framework for identifying, escalating,
         monitoring, and managing significant risks including fraud.
      b) Be informed about Council’s risk profile as well as the measures management is taking in
         relation to its high rated strategic and operational risks.
      c) Provide oversight of the embedding of a risk culture in policy setting, projects, programs and
         operating activities.
      d) The Committee may identify specific risks for more detailed review and discussion, and
         where appropriate, recommend additional controls
      e) Satisfy itself that insurance arrangements are appropriate and in alignment with Council’s
         Risk Management Framework, where appropriate. This includes the annual review Council’s
         insurance coverage.


                                                                                               Page 3

Page 4

AUDIT & RISK COMMITTEE CHARTER


      f) Determine whether an effective approach has been followed in establishing the Council’s
         business continuity planning arrangements and whether business continuity and disaster
         recovery plans have been periodically updated and tested.
      g) Monitor and receive reports for significant projects and outsourcing arrangements which
         include the identification of emerging risks and recommendations to overcome issues that
         impact on the success of the project or arrangement.
      h) Review Council’s processes for monitoring, identifying and responding to security threats
         including threats to council information, critical systems, cyber and ICT security.
      i) Receive reports regarding council’s safety performance and monitor Council’s workplace
         health and safety management system to ensure Council is meeting its obligations and
         effectively assessing and managing workplace health and safety risks.


6.4        Fraud and corruption controls

      a) Review the process of developing and implementing Council’s fraud control arrangements
         and satisfy itself that Council has appropriate processes and systems in place to identify
         fraud and corruption risks as well as to detect, capture and effectively respond to fraud-
         related information including public interest disclosures.
      b) Review reports on fraud that outline any identified allegations of fraud, the status of any
         ongoing investigations and any changes to identified fraud risk in Council.


6.5        Governance and internal control environment

      a) Review Council’s Governance Framework and monitor the standard of corporate
         governance.
      b) Monitor the organisations approach to managing internal controls and providing assurance
         regarding effective operation of controls.
      c) Recommend governance and internal control improvements for management consideration.
      d) Review and provide advice on key council policies particularly in relation to financial
         management, strengthening internal controls and risk management, and complying with
         legislative requirements.
      e) Consider whether management has in place an overall compliance and accountability
         framework together with relevant policies and procedures which reflect legislative, regulatory
         and policy requirements, and that these are periodically reviewed and updated.
      f) Review and monitor the effectiveness of the approach to ensuring legal and regulatory
         compliance including reports on emerging legal risks and obligations.
      g) Review the findings of any examinations by regulatory agencies including council’s
         responses and monitor management’s implementation of improvement recommendations.
      h) Review and provide advice on the appropriateness of Council’s performance management
         system for assessing, monitoring, and reporting on achievement of council’s performance
         and for alignment with corporate planning, budget and end of year reports.
      i) Monitor and evaluate council’s approach to ensuring a positive organisational culture
         (including the adoption of ethical principles) which is aligned to achieving council’s corporate
         objectives and core values.


6.6        Other Matters

      a) Identify opportunities to improve the efficiency and effectiveness of Council’s operations.
      b) Recommend special projects or investigations on any matter within its Charter.
      c) Communicate and bring awareness to the work that this Committee undertakes to Council
         and the community.




                                                                                                 Page 4

Page 5

AUDIT & RISK COMMITTEE CHARTER


7   AUTHORITY, INDEPENDENCE AND ACCESS

In discharging its responsibilities, the Committee has the authority to review and make
recommendations to Council on any matters within its scope of responsibility as outlined in this
Charter. This includes:
    Conduct or request investigations into matters within its scope of responsibility and in
       accordance with the Local Government Act.
    Access information, records, and personnel of the Council for such purpose.
    Request the attendance of any employee, including executive staff, at committee meetings.
    Conduct meetings with the Council’s internal and external auditors as necessary.
    Seek advice from external parties to meet its responsibilities, as necessary provided that
       Council approval will be required prior to committing to any expenditure required in seeking
       that advice.

8   CONFIDENTIALITY

In accordance with section 200(4) of the Local Government Act 2009 (Qld), confidentiality must be
preserved by Committee members and subsequently it is an offence to disclose confidential
information to unauthorised individuals.
The Committee members must not publicly comment on matters relative to activities of the
Committee other than as authorised by Council or the CEO.

9   ETHICAL PRACTICES

The Committee members will, always in the discharge of their duties and responsibilities, exercise
honesty, objectivity, probity and not engage knowingly in acts or activities that have the potential to
bring discredit to Council.

The Committee members must also refrain from entering any activity that may prejudice their ability
to carry out their duties and responsibilities objectively and must always act in a proper and prudent
manner in the use of information acquired in the course of their duties.

All committee members are expected to abide by Council’s Code of Conduct.

Members must not publicly comment on matters pertaining to activities of the ARCO other than as
authorised by Council.

Committee members are required to declare any interests that could constitute a real, potential or
perceived conflict of interest with respect to participation on the Committee. The declaration must
be made on appointment to the Committee and in relation to specific agenda items at the outset of
each committee meeting and be updated as necessary. Conflicts of interest will be a standing
agenda item and possible conflicts noted in the minutes of each meeting. The Committee will adopt
the council’s Register of Interests and associated processes adopted by council.



10 MEMBERSHIP

Committee members are independent of Council’s management and are objective with diverse
experience which creates a solid foundation for robust and insightful discussions and questions.

The membership of the Committee may be reviewed during the life of the Committee but will be
reviewed following the completion of each General Local Government Election.


                                                                                                Page 5

Page 6

AUDIT & RISK COMMITTEE CHARTER




The Committee will be composed of four members, including the Chairperson, as follows:
    Two Councillors appointed by Council on a rotational basis with a two-year term.
    Two independent external members (including the Chairperson) will be selected following an
      ITQ process and appointed by Council to ensure impartiality and an appropriate mix of skills.
      At least one member will have significant experience and skills in finance matters.1 When
      selecting an external independent member, Council must have regard to that person having
      a strong business, accounting, legal or similar background to provide additional expertise to
      Council.
    The term of an independent external member shall be a minimum of three years and a
      maximum of 6 years (in accordance with Queensland Treasury Guidelines).

A phased approach to the rotation of independent Committee members is preferred to preserve an
appropriate level of knowledge and expertise on the Committee and the Council may wish to have
new members join the Committee before existing members depart to lessen the loss of an
experienced member. External members including the Chairperson will be selected by inviting
expressions of interest.

The Chairperson will be appointed by Council for an initial period of no longer than three years, with
any extension of a further three-year term based on performance, giving a maximum of six years of
service (Noting the Audit Committee Guidelines issued by Queensland Treasury). The Chairperson
will possess sound communication and strong leadership skills. In addition to overseeing committee
meetings, the Chairperson will:
      Regularly consult with, and report to, the CEO to ensure the Committee’s agenda, style and
        discussion are providing the level of assurance Council needs and expects.
      Assist in developing new members as required.
      Review Committee agendas and minutes.
      Undertake an annual assessment of the Committee’s performance and deliver an annual
        presentation to council.

Collectively, the Committee shall possess:
     A thorough understanding of the core activities of Council and the environment in which it
        operates, including its strengths, weaknesses, opportunities and threats.
     A commitment to the continual improvement of the outputs that the organisation delivers and
        that contribute to the achievement of Council’s priorities.
     Strong business acumen and management skills.
     A high level of understanding of best practice internal control, risk management and
        corporate governance.
     A sound knowledge of information systems and emerging technology.
     A high level of competency in financial and operational reporting and the ability to analyse
        complex financial reports including Council’s Operating Statement, Statement of Financial
        Position, Cash Flow Statement and Notes to and forming part of those statements.
     An inquiring attitude, objectivity, and independence.
     A strong, demonstrated sense of probity and ethical conduct.

11 RELATIONSHIPS

11.1 Internal audit

The Committee will act as a forum for internal audit and oversight of its planning, monitoring, and
reporting processes. This process will form part of Council’s governance processes to ensure that
Council’s internal audit function operates effectively, efficiently, and economically. Within this


1
    Local Government Regulation 2012 (QLD) s 210(1)(b)(ii)

                                                                                              Page 6

Page 7

AUDIT & RISK COMMITTEE CHARTER


context, Council does not have a dedicated resource to perform the internal audit function. Its
practice is to engage external providers to undertake approved internal audits. The internal audit
function is governed by Council’s Internal Audit Policy. The Internal Auditor will be invited to present
on audit reports and recommendations. The Chairperson of the Committee may interact directly with
Council’s Internal Audit provider as required.

11.2 External audit

The Committee has no power of direction over external audit or the way the external audit is planned
or undertaken but will act as a forum for the consideration of external audit findings to ensure they
are balanced with the views of management. The Committee will consult with external audit on that
function’s proposed audit strategy and audit fees for each year and ensure that an integrated audit
process occurs, to the extent practicable. Furthermore, the Committee will report letters and reports
provided by an external auditor.

11.3 Executive and line management

The Committee will liaise closely with Council executive management and ensure, to the extent
practicable, that there is no material overlap between the internal and external audit functions. The
Committee will ensure that there is a frank and meaningful exchange of information between
executive management where this is necessary or desirable. In respect to Council’s line
management, the Committee will focus on assessing whether the actions proposed to address audit
concerns are reasonable, satisfactory, and cost-effective and will ultimately enhance the
effectiveness and efficiency of Council’s operations.

12 MEETINGS

12.1 Secretariat

      A secretariat function may be appointed by the Chief Executive Officer to facilitate
       Committee meetings and reporting duties. The Secretary in consultation with the
       Chairperson will be responsible for the preparation and circulation of the meeting agenda
       and accurately minuting the proceedings of the Committee.

12.2 Meeting agendas and minutes

      Meeting Agendas must be prepared and distributed to all members of the Committee at least
       seven (7) days prior to a meeting.
      In the setting of the Committee Agenda, there will be an emphasis on the most significant
       risks and threats to Council and the ongoing evaluation of what is being done to mitigate such
       risks.
      The Committee Agenda with Attachments are designed for internal reporting processes and
       shall not be released to the public. However, information may be made publicly available in
       a format suitable for external reporting at Council’s discretion.
      The Agenda for each meeting will include provision for a confidential session at the
       Chairperson’s discretion.
      The Committee must prepare prompt and timely meeting minutes and reports to Council as
       soon as practicable after each meeting outlining relevant matters that have been considered
       by it, as well as the Committee’s opinions and recommendations thereon.
      Meeting Minutes must be prepared and reviewed and by the Chairperson prior to being
       distributed to Committee members as soon as possible after the conclusion of the meeting.
      Meeting Minutes will then be confirmed as an accurate record of the meeting at the next
       Committee meeting.
      Recommendations to Council regarding matters considered by the Committee will be made
       to Council in the subsequent Council meeting.


                                                                                                Page 7

Page 8

AUDIT & RISK COMMITTEE CHARTER


      A summary of the role and achievements of the Committee shall be included in the Annual
       Report of Council together with a statement that the Committee has observed the terms of
       its Charter.


12.3 Conduct of meetings

      The Committee shall meet at least four times per year and the schedule of meetings
       including the Annual Rolling Work Plan and Standing Agenda items will be agreed in
       advance. In addition, the Chairperson may call such additional meetings as may be necessary
       to address any matters referred to the Committee or in respect of matters that the
       Committee wishes to pursue.
      The Chief Executive Officer will convene these meetings when requested by the Committee
       Chair and at such other times which are deemed to be appropriate to the conduct of
       Committee business and convenient to the members of the Committee.
      A quorum shall consist of at least two (2) members. As far as practicable, decisions of the
       Committee shall be regarded as its collective decision or advice. However, where there is
       material dissension to a decision, a minority view may be placed before the Council.
      A Committee meeting may be held utilising video conferencing technology.
      Due to the confidential nature of information considered, and to support the high level of
       independence of Internal and External Audit, Committee meetings will be closed to the
       public.
      All information supplied by Council and its officers for consideration at Committee meetings
       Audit and Risk Committee must be treated as being confidential to the local government.


12.4 Other attendees at Committee meetings

      The Committee or individual members may request and obtain information from
       management and consult directly with the auditors. However, the Committee has no power
       to direct Council staff in the performance of their duties.
      The Chief Executive Officer, the Director Corporate Services, the coordinating officer and
       the Governance Manager should attend all meetings as Ex Officio observers but have no
       voting rights. Other Council officers may attend meetings as required at the discretion of the
       Committee.
      Representatives of External and Internal Audit shall be invited to attend Committee
       meetings at the discretion of the Committee.
      The Chairperson may determine that any or all observers, including the CEO, be excluded
       from a particular meeting or part of a meeting during consideration of a particular agenda
       item or as other business, in particular if there is any known or perceived conflict of interest.
       The minutes will record that this closed session occurred, and the participants, but not the
       subject matter discussed.
      The Committee has the right to request that the CEO arrange independent professional
       advice when considered necessary.

13 ADMINISTRATIVE ARRANGEMENTS

13.1 Committee member sitting fees

A sitting fee will be paid to external members for attendance at Committee Meetings. The amount of
sitting fees will be reviewed and determined by Council in the Annual Budget deliberations.




                                                                                                 Page 8

Page 9

AUDIT & RISK COMMITTEE CHARTER


13.2 Schedule of meetings

The Committee will maintain and update an Audit and Risk Committee forward meeting schedule
and forward Work Plan that includes proposed Agenda items for each meeting for the forthcoming
year to demonstrate how it intends to discharge its responsibilities under this Charter.

13.3 Induction of new members

New members of the Committee will be provided with induction material on their appointment to
assist them to meet their committee responsibilities and to familiarise themselves with Council’s
operations, corporate governance arrangements, corporate practices, and culture. Further training
may be made available if required.


13.4 Committee performance review

The Committee Chairperson will initiate an annual review of the Committee’s performance in fulfilling
its responsibilities under the Charter and workplan to identify and action improvement opportunities
to increase the effectiveness of the Committee.

The Chairperson will also deliver an annual presentation on the Committee’s performance to the
Council and provide each individual member of the Committee with feedback on their work
performance and professional contributions to the Committee’s activities.



14 DEFINITIONS

Accountability The obligation of an individual or organization to account for its activities, accept
responsibility for them, and to disclose the results in a transparent manner.

Annual work plan Sets out the activities to be covered by the audit and risk committee and allocated
key tasks to be covered at each meeting to ensure all activities associated with key risks and issues
are addressed at the appropriate time during the year and that all key responsibilities are covered.

Audit Committee means a committee that is established in accordance with section 105(2) of the
Queensland Local Government Act 2009 and that:
   (a) Monitors and reviews –
          i.    the integrity of financial documents, and
          ii.   the internal audit function; and
         iii.   the effectiveness and objectivity of the local government’s internal auditors; and
   (b) makes recommendations to the local government about any matters that the audit committee
       considers need action or improvement.
Business Continuity Plan A business continuity plan is a document that explains the actions that
should be taken before, during and after unexpected events and situations. It is designed to assist
in: identifying, preventing or reducing risks where possible; preparing for risks that are out of your
control; responding and recovering if an incident or crisis occurs.

Charter means a formal document which outlines the scope of activities of the Audit and Risk
Committee including responsibilities, operational requirements and reporting obligations.

Conflict of Interest Any relationship that is, or appears to be, not in the best interest of the
organization. A conflict of interest would prejudice an individual’s ability to perform his or her duties
and responsibilities objectively.

                                                                                                 Page 9

Page 10

AUDIT & RISK COMMITTEE CHARTER



Corporate Governance Framework The system of rules, practices, and processes by which
Council is directed and controlled.

External Audit The independent examination and opinion of council’s financial statements, and
whether the council is complying with accounting standards, laws and regulations.

Fraud Any illegal act characterized by deceit, concealment, or violation of trust. These acts are not
dependent upon the threat of violence or physical force. Frauds are perpetrated by parties and
organizations to obtain money, property, or services; to avoid payment or loss of services; or to
secure personal or business advantage.

Fraud and corruption control framework A tailored program to manage their organisation’s risks
of fraud and corruption effectively.

Governance The combination of processes and structures implemented by the board to inform,
direct, manage, and monitor the activities of the organization toward the achievement of its
objectives.

Independent external member means a professional, experienced individual appointed to the Audit
and Risk Committee by Council, who is independent of Council and councillors.

Internal Audit A department, division, team of consultants, or other practitioner(s) that provides
independent, objective assurance and consulting services designed to add value and improve an
organization’s operations. The internal audit activity helps an organization accomplish its objectives
by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of
governance, risk management and control processes.

Risk Management Framework Set of components that set out the organisational arrangements for
designing, implementing, monitoring, reviewing and continually improving risk management
throughout an entity.



15 HUMAN RIGHTS

In developing this Policy, the subject matter has been considered in accordance with the
requirements of the Queensland Human Rights Act 2019. It is considered that the subject matter
does not conflict with any human rights and supports a human rights approach to decision making
by Council. Council representatives will endeavour to act and make decisions under this Policy in a
manner that is compatible with human rights. In particular, representatives will endeavour to:
 identify relevant human rights which may be affected by the action or decision;
 give proper consideration to the impact of its actions and decisions on human rights; and
 ensure that any conduct or decision by Council which limits an individual’s human rights is
reasonable and justifiable. This Policy should be read in conjunction with Council’s Human Rights
Policy.


16 RELATED DOCUMENTS

This Policy complements and is to be implemented in conjunction with other council policies,
directives and relevant documents including:
      Audit and Risk Committee Charter
      Internal Audit Policy and Terms of Reference


                                                                                             Page 10

Page 11

AUDIT & RISK COMMITTEE CHARTER


        Enterprise Risk and Opportunity Management Policy
        Governance Framework



   Version     Reason/ Trigger             Change (Y/N)   Endorsed/ Reviewed by   Date
   1.0         New Policy                                 Council                 28/08/14
   1.1         Updated Policy              Y              Council                 27/08/15
   1.2         Updated Policy              Y              Council                 17/11/16
   1.3         Updated Policy              Y              Council                 19/10/2017
   1.4         Updated Policy              Y              Council                 20/12/2018
   1.5         Updated Policy              Y              Committee               21/02/2020
   1.5         Updated Policy              Y              Council                 19/03/2020
   1.6         Updated Policy              Y              Council                 21/05/2020
   1.7         Updated Charter             Y              Council                 18/03/2021
   1.8         Updated Charter             Y              Council / ARCo          17/03/2022
   1.9         Updated Charter             Y              Council




                                                                                         Page 11