Wrthi'n llwytho
Y penderfyniadau fel y mae cofnodion y cyngor yn eu cofnodi. Bydd crynodeb mewn iaith glir yn dilyn pan fydd wedi'i ysgrifennu.
AGREED to note the updated content of the Governance and Audit Committee Meeting Action Log as presented. It was reported that the appendices had been added to the log which was the report on the Aberaeron Coastal Defence presented to the Thriving Communities Overview and the feedback report to Cabinet. The Chair expressed concern that the Committee had only received its first report on the Aberaeron Coastal Defence Scheme at this meeting, following significant expenditure and overspend concerns had arisen and despite the project’s innovative governance arrangements. Officers were therefore requested to consider earlier engagement with the Committee on similarly unusual projects in the future.
AGREED to note the reports as presented.
AGREED to note the content.
AGREED to (i)note that the CIW Annual Return 2025/2026 for the Council's regulated services had been submitted to Care Inspectorate Wales by the required deadline and published on the Council's website in accordance with the new statutory requirements; and (ii) that the service would provide a table of ratings for each council run home in order to support comparison and learning.
AGREED that Committee had gained assurance that the recommendations are were completed and were being implemented.
AGREED to note the work undertaken and the current position of the Internal Audit Section and were satisfied that sufficient and appropriate audit work was being carried out to enable the provision of a realistic year-end assurance opinion whilst supporting the Council in achieving its objectives.
AGREED to note the findings of the Internal Quality Assessment and the associated improvement plan.
AGREED to note the contents of the Internal Audit Charter and approve the revised Charter.
AGREED to (i) note the contents of the Annual Report of Compliments, Complaints and Freedom of Information 2025-2026 and the supporting information; and (ii) that consideration be given as part of the forthcoming budget-setting process to options for retaining the temporary additional resources beyond the current fixed-term arrangement.
AGREED to note the current position.
AGREED to note the content of the report.
AGREED that the updated Risk Management Policy, Strategy and Framework be noted, and that members provide any comments or feedback on the documents by 17 October 2026 as part of the ongoing consultation process.
AGREED that the SIRO Annual Report be noted and that the Committee support the continued monitoring and oversight of cyber resilience, information management, supplier assurance and information rights pressures.
AGREED that the Cyber Resilience Strategy 2026 and associated Cyber Resilience Action Plan be noted, together with the governance arrangements for monitoring delivery and the arrangements for reporting progress through future SIRO and cyber resilience updates.
AGREED to note the Forward Work Plan as presented
Councillor Elizabeth Evans, Wyn Evans together with Mr Andrew Blackmore apologised for their inability to attend the meeting. Councillor Bryan Davies apologised for their inability to the meeting as he was on other Council duties.
The Chair thanked Mr Andrew Blackmore for his work and support during his time as a Committee Member and wished him well for the future.
None.
It was AGREED to confirm as a true record the Minutes of the Meeting of the Committee held on 04 June 2026 Matters arising Minute 1 – The appointments of the Chair and Vice-Chair had been confirmed at Council at its meeting held on the 19 June 2026. Minute 14- The Governance & Audit Chairs Annual Report had also been presented to the Council meeting held on the 19 June 2026 and had been approved. Minute 12 - HM Inspectorate of Probation – Update on Action Plan- Councillor Maldwyn Lewis reported that an update had been requested at a future meeting Minute 20- Recruitment of Governance and Audit lay members- It was reported the one Member had been appointed following an interview, and this appointment would be confirmed at the Council to be held on the 24 September. The second recruitment exercise had already started and the closing date for applications was the 21 October 2026
Y penderfyniad fel y'i cofnodwyd
AGREED to note the updated content of the Governance and Audit Committee Meeting Action Log as presented. It was reported that the appendices had been added to the log which was the report on the Aberaeron Coastal Defence presented to the Thriving Communities Overview and the feedback report to Cabinet. The Chair expressed concern that the Committee had only received its first report on the Aberaeron Coastal Defence Scheme at this meeting, following significant expenditure and overspend concerns had arisen and despite the project’s innovative governance arrangements. Officers were therefore requested to consider earlier engagement with the Committee on similarly unusual projects in the future.
It was AGREED to note the updated content of the Governance and Audit Committee Meeting Action Log as presented. It was reported that the appendices had been added to the log which was the report on the Aberaeron Coastal Defence presented to the Thriving Communities Overview and the feedback report to Cabinet. The Chair expressed concern that the Committee had only received its first report on the Aberaeron Coastal Defence Scheme at this meeting, following significant expenditure and overspend concerns had arisen and despite the project’s innovative governance arrangements. Officers were therefore requested to consider earlier engagement with the Committee on similarly unusual projects in the future.
Y penderfyniad fel y'i cofnodwyd
AGREED to note the reports as presented.
Consideration was given to the report setting out Regulator and Inspectorate reports and updates, along with Council responses regarding progress made against proposals and recommendations. Currently, the Committee noted that the following local risk work had been issued/published since the last Governance and Audit Committee held on the 03 June 2026. (i) Work Programme and Timetable Update to June 2026 o Ms Alison Lewis, Audit Wales, reported that the audit of the Council’s accounts was ongoing and would be presented to the Committee on 24 September. o It was noted that the final performance audit report for 2025/26, undertaken by Audit Wales, was included on the agenda for consideration. o Members were advised that the 2026/27 audit plan included reviews of highways and performance management arrangements. Following a request from the Council, and in light of the Council’s own review of performance management, it had been agreed that a review of housing adaptations, including Disabled Facilities Grants, would be undertaken as an alternative piece of audit work. o It was reported that the Children’s Services report was currently in the clearance process and was expected to be published in October rather than September. (ii) LG thematic – Recruitment and Retention Challenges - MRF Recruitment and Retention Challenges o It was reported that Audit Wales had undertaken a thematic review across all 22 Welsh local authorities and produced a Ceredigion-specific report. The review found that the Council had a good understanding of its recruitment and retention challenges and had implemented a range of actions which were being monitored. o Members noted that the review identified generally positive employee sentiment, with survey results indicating high levels of staff satisfaction. It was also reported that many workforce performance indicators were improving, although an area identified for further development was the consistent assessment of value for money in recruitment and retention activities. o Mr Geraint Edwards advised that the Council was developing a number of practical measures to support recruitment and retention, including the use of the Council website as the primary recruitment platform, bespoke digital campaigns for senior and critical vacancies, a framework to capture recruitment costs and outcomes, and an agency monitoring form to manage agency expenditure. o It was further reported that work was ongoing to finalise digital monitoring and costing frameworks to better align recruitment expenditure with workforce outcomes and to target bespoke recruitment activity where required. (iii) Review of decision-making arrangements MRF Review of decision-making arrangements o The Corporate Manager- Democratic Services reported that she had examined whether the Council had clear decision-making arrangements, whether those arrangements operated effectively, and whether regular reviews of effectiveness were undertaken. The review concluded that the Council’s arrangements were generally working well. o Members noted the positive findings of the review, which highlighted that the Constitution clearly set out governance arrangements and was regularly updated, meetings were generally well managed, councillors received appropriate training, and arrangements for accountability and transparency were largely in place. o It was reported that opportunities for improvement had been identified, including strengthening the publication and recording of delegated officer and Cabinet Member decisions, improving the accessibility of decision registers and associated information, clarifying the criteria for key and non-key decisions, and enhancing the impact of scrutiny. o The Monitoring Officer advised that Cabinet met regularly and published its notices of decisions on the Council’s website. Work was also underway to clarify the distinction between key and non-key decisions and to improve access to relevant registers and supporting information. o The Group Manager, Democratic Services reported that a number of practical actions were being progressed, including Member and officer surveys to assess the timeliness and quality of reports and the effectiveness of committees, the introduction of clearer forward work programme items with concise descriptions of the reports, and the establishment of engagement panels during February and March to review governance and decision-making arrangements. (iv)National Reports Funding Council – how the Welsh Government funds Councils – It was reported :- o Ms Alison Lewis reported that Audit Wales had produced a national study covering all 22 principal Councils in relation to Welsh Government’s funding arrangements. The study five recommendations were directed at Welsh Government and not at individual Councils o It was reported that the Welsh Government would present a management response to the report to their Public Accounts/Public Administration Committee on 28 September; the Committee requested an update on this o The Executive Corporate Lead Officer – Finance & Procurement reported on practical consequences of late and earmarked grants such as the £887,000 capital maintenance grant notified in early September, limiting ability to schedule summer works in schools. o Regulatory impact assessments did not consistently provide clear cost estimates for councils to plan budgets and medium-term financial plans. o The Welsh Government does not consistently provide clear information on funding available to implement new responsibilities, nor routinely involve councils when estimating these costs. o Combined weaknesses make it harder for Councils to include new responsibilities in budgets and medium-term plans. o Councils emphasised the need for multi-year/settlement certainty and earlier notification of grant allocations to enable efficient planning and contractor procurement. o Councillors and officers strongly supported the report and saw it as giving leverage to press for change. o Members noted geographic/rural concerns: perception that funding was biased toward city/M4 corridor areas and that rural proofing / a rural premium should be considered to reflect topography, service costs and sparsity. o The new Welsh Government signalled early political support for some themes (formula review, rural considerations, funding floors) but members emphasised the need to see practical delivery o Timing pressure was also highlighted in relation to the provisional settlement that was due 1 December which created limited time to implement changes for the 2027/28 cycle. o Member agreed to use the Audit Wales report to lobby and to track whether political commitments converted into settlement changes. It was AGREED to note the reports as presented.
The report relating to item 7 on the agenda, Appendix 2, is not for publication as it contains exempt information as defined in paragraph 18 of Part 4 of Schedule 12A to the Local Government Act 1972 as amended by the Local Government (Access to information) (Variation) (Wales) Order 2007. If, following the application of the Public Interest Test, the Council resolves to consider this item in private, the public and press will be excluded from the meeting during such consideration, in accordance with Section 100B(2) of the Act. Members were requested, when dealing with the item, to consider whether to exclude the public and press from the Meeting. DECISION: That the public interest in maintaining the exemption outweighed the public interest in disclosing the information. To exclude the public and press from the meeting and to consider the report at the end of the meeting.
Y penderfyniad fel y'i cofnodwyd
AGREED to note the content.
The Committee received a report setting out Council responses and progress made against proposals and recommendations. It was reported that several actions were on track and the MRF actions were intended to be completed and reported by March 2027. Officers would feed the improvements from performance/risk reviews into broader risk and governance frameworks and report progress to the Committee. Review of Corporate Risk Management arrangements – Ceredigion County Council It was AGREED to note the content.
Y penderfyniad fel y'i cofnodwyd
AGREED to (i)note that the CIW Annual Return 2025/2026 for the Council's regulated services had been submitted to Care Inspectorate Wales by the required deadline and published on the Council's website in accordance with the new statutory requirements; and (ii) that the service would provide a table of ratings for each council run home in order to support comparison and learning.
Councillor Alun Williams ( Deputy Leader and Cabinet Member for Through Age and Wellbeing) presented the report upon the Care Inspectorate Wales (CIW) Annual Return 2025/2026 for Ceredigion County Council's regulated services. Members were advised that CIW was the independent regulator of social care and childcare services in Wales and that the Council was required to complete and submit an Annual Return for its regulated services following the end of each financial year. The Annual Return covered the period from 1 April 2025 to 31 March 2026 and had been submitted by the required deadline of 26 May 2026. It was noted that the Responsible Individual had a key role in ensuring the completion of the Annual Return and overseeing quality assurance arrangements. Members were informed that regular monitoring visits were undertaken for each regulated service, with the findings reviewed with the Director of Social Services. The Committee noted that the Annual Return included information relating to provider and service details, workforce data, service provision, complaints, consultation arrangements with service users, and compliance statements. The Return covered the Council's regulated residential care homes and care services, including Bryntirion, Min y Môr, Hafan Deg, Hafan y Waun, Sycharth, Tŷ Ni, Yr Hafod and the Targeted Care and Enablement Service. Members were informed that the provider information held by CIW had been reviewed and confirmed as accurate and that all required workforce templates had been completed and submitted. The report also outlined arrangements for workforce development, including training needs analysis, supervision, appraisals, induction programmes and professional qualifications. The Committee noted the key changes introduced for the 2025/2026 Annual Return, including the new statutory requirement for providers to publish the Annual Return on their own website by 30 June 2026 and the inclusion of additional workforce questions as part of a combined data collection process between CIW and Social Care Wales. It was confirmed that the Annual Return had been published on the Council's website within the required timeframe. It was AGREED to (i)note that the CIW Annual Return 2025/2026 for the Council's regulated services had been submitted to Care Inspectorate Wales by the required deadline and published on the Council's website in accordance with the new statutory requirements; and (ii) that the service would provide a table of ratings for each council run home in order to support comparison and learning.
Y penderfyniad fel y'i cofnodwyd
AGREED that Committee had gained assurance that the recommendations are were completed and were being implemented.
Consideration was given to the report upon progress made in implementing the recommendations arising from the Public Services Ombudsman for Wales Own Initiative Investigation into the administration of carers’ needs assessments under Part 3 of the Social Services and Well-being (Wales) Act 2014. Members were advised that, on 6 April 2023, the Ombudsman had informed the Council that it had been selected as one of four Welsh local authorities to participate in the investigation. The purpose of the review had been to examine how councils undertook carers’ needs assessments and whether statutory requirements were being met. It was reported that the Council had provided the Ombudsman’s Office with an update on progress against the recommendations in August 2025, followed by a meeting to clarify a number of matters. Subsequently, the Council had been notified that a follow-up report was being prepared. Whilst the Ombudsman had acknowledged progress made, it was indicated that two recommendations had not yet been fully achieved. In response, the Council had provided assurances in December 2025 that work remained ongoing to address the outstanding matters, whilst noting that implementation of the new social care data management system, Eclipse, had impacted timescales for completion. Members noted that a further request for an update had been received from the Ombudsman’s Office on 5 August 2026 in relation to the recommendations contained within the report “Are We Caring for Our Carers? Revisited”. The Committee was informed that the recommendations for Ceredigion included amendments to carers’ needs assessment documentation to ensure that assessments recorded whether the cared-for person had been consulted, whether carers were willing and able to continue caring, and whether employment, education, training and leisure opportunities had been considered. The recommendations also required recording whether carers had been offered a copy of their assessment, whether they were satisfied with the assessment process and outcomes, and whether any unmet needs or disagreements had been identified. Members were further advised that the Ombudsman had recommended the introduction of a standard template letter to accompany completed assessments. The letter was required to provide an outline of the assessment, information regarding review arrangements, and details of how carers could request a review or reassessment. In addition, the Ombudsman had recommended that progress and compliance with the recommendations be monitored through the Council’s Audit and Risk Committee. Officers reported that, following the implementation of the Eclipse social care system in July 2026 , the revised carers’ assessment documentation was now fully available within the system and incorporated the required fields identified by the Ombudsman. It was further confirmed that all relevant template letters had been reviewed, updated and made available for use by Care and Support staff. Officers stated that these recommendations had been fully completed and implemented. Committee noted that the Ombudsman' office: • had confirmed its satisfaction with the template letters • had requested that a remote meeting be arranged to assess the carers assessment form • been invited to attend the Committee meeting During discussion, Members welcomed the progress that had been made and acknowledged the challenges associated with introducing a new social care information system whilst simultaneously implementing service improvements. Officers emphasised that the required changes had now been embedded within operational processes and that the information had been submitted to the Ombudsman’s Office for consideration. Having reviewed the evidence presented, the Committee: 1) noted: i) that appropriate measures had been implemented to address the recommendations and provide greater assurance regarding the quality and consistency of carers’ needs assessments ii) the progress to date on implementing the Recommendations, as outlined in the report and having heard from the Corporate Lead officer- Porth Cymorth Cynnar 2) AGREED that Committee had gained assurance that the recommendations are were completed and were being implemented.
The Committee received an update on Estyn inspection activity during the 2025-2026 academic year. It was reported that 11 core inspections had been undertaken, comprising five schools, the Pupil Referral Unit and five non-maintained settings, together with five interim visits to schools. Members noted that of the six school core inspections, four schools had received Estyn spotlights for good practice. It was further noted that all five non-maintained settings inspected had received judgements of good or better. The Committee was informed that the Service maintained a central spreadsheet containing inspection outcomes and associated information from all inspections. In addition, a number of schools had participated in thematic visits and recorded podcasts for the Estyn website to share examples of good practice. The Committee noted the positive inspection outcomes and the arrangements in place for monitoring inspection findings across the county
Y penderfyniad fel y'i cofnodwyd
AGREED to note the work undertaken and the current position of the Internal Audit Section and were satisfied that sufficient and appropriate audit work was being carried out to enable the provision of a realistic year-end assurance opinion whilst supporting the Council in achieving its objectives.
Consideration was given to the Internal Audit progress report, which provided an update on progress against the 2025/26 Internal Audit Plan. Members noted that the Plan, approved in March 2026, included audits carried forward from the previous year, routine audit work, grant certifications, and reviews prioritised on the basis of risk. It was noted that ongoing risk assessments were being undertaken alongside consideration of the Council’s Corporate Risk Register to ensure that emerging and changing risks were reflected in the audit programme. Members also noted that any reactive work added to the Plan would continue to be reported through regular progress updates. The Committee received an update on the work completed to date, the current resource position within the Internal Audit Section, and progress against the Section’s improvement plan. It was AGREED to note the work undertaken and the current position of the Internal Audit Section and were satisfied that sufficient and appropriate audit work was being carried out to enable the provision of a realistic year-end assurance opinion whilst supporting the Council in achieving its objectives.
Y penderfyniad fel y'i cofnodwyd
AGREED to note the findings of the Internal Quality Assessment and the associated improvement plan.
Consideration was given to the report upon the Internal Audit Internal Quality Assessment of the Internal Audit Service against the Global Internal Audit Standards (GIAS) in the UK Public Sector, which came into force in April 2025. It was reported that the assessment, undertaken using CIPFA's quality assessment checklist, concluded that the Internal Audit Service Generally Conforms with the GIAS. Three areas of Partial Conformance were identified and an improvement plan had been developed to address these areas. It was AGREED to note the findings of the Internal Quality Assessment and the associated improvement plan.
Y penderfyniad fel y'i cofnodwyd
AGREED to note the contents of the Internal Audit Charter and approve the revised Charter.
The Committee considered the report on the revised Internal Audit Charter, noting that the Charter had originally been approved in March 2013 and had been reviewed to ensure compliance with Standard 6.2 of the Global Internal Audit Standards. Members noted the proposed amendments relating to: • Governance and Audit Committee oversight to align with the Committee's Terms of Reference. • Internal Audit resourcing, including the Internal Audit structure. • Counter Fraud arrangements following the approval of a Counter Fraud Officer post. It was AGREED to note the contents of the Internal Audit Charter and approve the revised Charter.
Y penderfyniad fel y'i cofnodwyd
AGREED to (i) note the contents of the Annual Report of Compliments, Complaints and Freedom of Information 2025-2026 and the supporting information; and (ii) that consideration be given as part of the forthcoming budget-setting process to options for retaining the temporary additional resources beyond the current fixed-term arrangement.
Consideration was given to the Report upon the Annual Report of Compliments, Complaints and Freedom of Information 2025-2026. Members noted that complaint-handling performance had improved during 2025-2026, with 187 complaints received, representing a 32% reduction compared with the previous year. It was noted that 81% of Stage 2 corporate complaints were completed within the target timescale and that Ombudsman intervention had reduced significantly, with only three cases requiring Early Resolution or Voluntary Settlement. The Committee further noted that 231 compliments had been received during the year and that 1,205 FOI and EIR requests had been processed. Members acknowledged that compliance with statutory FOI and EIR response times remained an area requiring improvement, with 70% of requests responded to within the required timescale. It was noted that the Complaints and FOI Team had increased from four to six officers, two of whom were in temporary fixed-term positions, strengthening oversight, quality assurance and engagement with services. The Committee noted the key priorities for 2026-2027, including improving compliance with complaints and FOI/EIR timescales, reviewing relevant policies, delivering targeted training, reinforcing corporate ownership, and improving the recording of compliments and lessons learned. It was AGREED to (i) note the contents of the Annual Report of Compliments, Complaints and Freedom of Information 2025-2026 and the supporting information; and (ii) that consideration be given as part of the forthcoming budget-setting process to options for retaining the temporary additional resources beyond the current fixed-term arrangement.
Y penderfyniad fel y'i cofnodwyd
AGREED to note the current position.
Consideration was given to the report providing an update on the Council’s Corporate Risk Register, which was presented regularly to ensure ongoing oversight and assurance that risks identified by senior managers were being appropriately managed and monitored. This reinforces the Governance and Audit Committee role of providing independent assurance to the Council of the appropriate management of the CRR. The latest review of the CRR had been undertaken by the Leadership Group, including consideration of whether any risks should be promoted to or removed from the register. Following this review, no corporate risks were identified for removal from the CRR, and no service-level risks were considered to warrant escalation to corporate risk status. All existing corporate risks had been reviewed and updated, with revised commentary provided and the status of mitigating actions reassessed using the RAG rating methodology. No changes had been made to the overall corporate risk scores during this reporting period, and no additional mitigating actions have been identified or added to the register. Members raised concerns regarding the heading Review date:2024 within the Risk Register as this could give the impression that the risks had not been reviewed or updated since that date. The Corporate Lead Officer explained that this date related to the latest review at Overview and Scrutiny Committee, and that risks were reviewed quarterly by lead officers with further weekly consideration by the Leadership Group. Some of the risks were static in nature due to factors outside of the Council’s control, but that they continue to be monitored and amended where appropriate, with risk scores having changed during some quarters. It was agreed that the wording on the Welsh translation of the Review date heading would be reviewed to ensure that its meaning was clear and did not cause confusion when reports were considered by Scrutiny Committees or as part of the Council’s corporate governance arrangements. It was AGREED to note the current position.
Y penderfyniad fel y'i cofnodwyd
AGREED to note the content of the report.
The Committee considered the Draft Self-Assessment Report and noted that the report represented the Council’s fifth self-assessment undertaken under the requirements of the Local Government and Elections (Wales) Act 2021. Members noted that the self-assessment process formed part of the Council’s ongoing approach to continuous improvement and was intended to support the review of performance, outcomes and opportunities for improvement across all service areas. It was reported that the assessment had been informed by a range of evidence, including internal reviews, external inspection and regulatory reports, engagement activities and workshops held with Members and officers. The Committee noted that the report fulfilled the Council’s obligations under the Local Government and Elections (Wales) Act 2021, the Well-being of Future Generations (Wales) Act 2015 and the Social Partnerships and Public Procurement (Wales) Act 2023. Members further noted that the findings and actions identified within the report would continue to be monitored throughout the year and that the draft report would be updated to reflect any recommendations made by the Committee prior to the submission of the final report in December 2026. It was AGREED to note the content of the report.
Y penderfyniad fel y'i cofnodwyd
AGREED that the updated Risk Management Policy, Strategy and Framework be noted, and that members provide any comments or feedback on the documents by 17 October 2026 as part of the ongoing consultation process.
Consideration was given to the updated Risk Management Policy, Strategy and Framework following the Council’s three-yearly review of risk management arrangements undertaken in July 2026. Members were advised that the review had been informed by the findings of the Council’s internal review process, the Audit Wales review of Corporate Risk Management published in November 2025, ongoing work through the WLGA Risk Management Network, consultation with Internal Audit and Zurich Insurance, and work currently being undertaken with Zurich to develop risk appetite statements and tolerance levels. The Committee noted that several amendments had been made to strengthen the Council’s risk management arrangements. These included enhanced guidance on horizon scanning, providing greater clarity on how emerging risks are identified and monitored; the introduction of a distinction between risks and issues within the Corporate Risk Register; and the implementation of an annual review of partnership risks to improve understanding of the interrelationship between the Council’s risks and those of partner organisations. Members further noted that the Corporate Risk Register had been updated to adopt a cause-event-consequence format for risk descriptions, identify both risks and issues, and demonstrate how individual risks may impact upon the Council’s Corporate Well-being Objectives. The report also clarified the Council’s approach to mitigating actions, recognising that while most actions would be SMART, some strategic actions would intentionally remain aspirational in nature. Clarification had also been provided regarding the costing of major mitigation actions and projects to support proportionate and effective governance arrangements. In addition, the role of the Council’s Self-Assessment Report in presenting an overall picture of risk, performance, budgets and value for money had been further defined. The Committee noted that work to develop and agree updated risk appetite statements and tolerance levels remained ongoing, with completion anticipated in October 2026. These statements would be incorporated into the final version of the Risk Management Framework due to be presented to the Committee in December 2026. Members also noted that opportunities registers were not yet widely established within local government and that officers were working with the WLGA Risk Management Network to develop a sector-led approach in this area. It was reported that consultation on the updated documents had already taken place with Internal Audit and Zurich Insurance, and that the Governance and Audit Committee was now being invited to review the documents and provide feedback as part of the consultation process. Following completion of the consultation, the final documents would be presented to the Committee in December 2026 before submission to Cabinet for approval in February 2027. It was AGREED that the updated Risk Management Policy, Strategy and Framework be noted, and that members provide any comments or feedback on the documents by 17 October 2026 as part of the ongoing consultation process.
Y penderfyniad fel y'i cofnodwyd
AGREED that the SIRO Annual Report be noted and that the Committee support the continued monitoring and oversight of cyber resilience, information management, supplier assurance and information rights pressures.
The Committee considered the SIRO (Senior Information Risk Owner) Annual Report, which provided an annual assurance assessment of the Council’s information risk position, including cyber resilience, information governance, technology lifecycle risk, supplier dependency and statutory information rights pressures. Members noted that the overall position remained positive, with significant progress having been made in strengthening governance arrangements, reducing technology lifecycle risks, progressing delivery of the Cyber Resilience Strategy, and improving the identification, ownership and management of information assets and systems across the Council. The Committee was advised that three corporate risks remained particularly significant. Risk R023 (Systems End of Life) had improved considerably as a result of ongoing investment and mitigation activity and may be suitable for removal from the Corporate Risk Register during the next reporting period. Risk R009 (Information Management) had also shown improvement but continued to warrant inclusion on the Corporate Risk Register. Risk R024 (Cyber Resilience) remained appropriately scored at 20 due to the increasing cyber threat landscape and ongoing external risks facing public sector organisations. Members noted that, while improvements had been made across a number of areas, continued oversight was required in relation to cyber security threats, reliance on third-party suppliers, strengthening information asset ownership arrangements, and managing increasing demand associated with Subject Access Requests and wider Information Governance responsibilities. It was AGREED that the SIRO Annual Report be noted and that the Committee support the continued monitoring and oversight of cyber resilience, information management, supplier assurance and information rights pressures.
Y penderfyniad fel y'i cofnodwyd
AGREED that the Cyber Resilience Strategy 2026 and associated Cyber Resilience Action Plan be noted, together with the governance arrangements for monitoring delivery and the arrangements for reporting progress through future SIRO and cyber resilience updates.
The Committee considered the Cyber Resilience Strategy 2026 and the associated Cyber Resilience Action Plan. Members were advised that the Council’s reliance on digital technology to deliver services and protect sensitive information meant that cyber resilience remained a significant corporate risk. It was noted that the cyber threat landscape continued to evolve, with increasingly sophisticated attacks and emerging threats, including the use of artificial intelligence by malicious actors, increasing the likelihood and potential impact of a serious cyber incident. The Committee noted that the Cyber Resilience Strategy 2026 established the Council’s strategic approach to reducing cyber risk, maintaining service continuity and protecting information. The strategy was structured around six key areas: adoption of the National Cyber Security Centre Cyber Assessment Framework; prevention and patching; detection and response; resilience and recovery; collaboration and intelligence; and people and culture. Members noted that the Cyber Assessment Framework would provide the foundation for assessing the Council’s cyber security maturity, identifying areas for improvement, prioritising actions and monitoring progress through governance arrangements. It was reported that delivery of the Strategy would be overseen by the Senior Information Risk Owner (SIRO), supported by ICT services and the Council’s cyber resilience governance framework. Progress would be monitored through the Cyber Resilience Group, reported to the Leadership Group and, where appropriate, through democratic reporting arrangements, including future SIRO updates and reports to the Committee. The Committee further noted that the Cyber Resilience Action Plan had been developed as a live programme of work to support delivery of the Strategy. The Action Plan incorporated a range of improvement activities, including strengthening asset and supplier management, enhancing identity and access controls, improving patching and system configuration, strengthening backup and recovery arrangements, enhancing incident response processes, increasing staff awareness and improving performance monitoring and reporting. Members recognised that the Strategy and Action Plan provided a structured and risk-based approach to managing cyber resilience and supporting the ongoing protection of Council services, systems and information. It was AGREED that the Cyber Resilience Strategy 2026 and associated Cyber Resilience Action Plan be noted, together with the governance arrangements for monitoring delivery and the arrangements for reporting progress through future SIRO and cyber resilience updates.
Y penderfyniad fel y'i cofnodwyd
AGREED to note the Forward Work Plan as presented
It was AGREED to note the Forward Work Plan as presented
None.
The report relating to item 7 on the agenda, Appendix 2, is not for publication as it contains exempt information as defined in paragraph 18 of Part 4 of Schedule 12A to the Local Government Act 1972 as amended by the Local Government (Access to information) (Variation) (Wales) Order 2007. If, following the application of the Public Interest Test, the Council resolves to consider this item in private, the public and press will be excluded from the meeting during such consideration, in accordance with Section 100B(2) of the Act. Members were requested, when dealing with the item, to consider whether to exclude the public and press from the Meeting. DECISION: To exclude the public and press from the meeting. 7 The Committee agreed to note the report as presented
Rhaid i gynghorwyr ddweud pan fydd ganddyn nhw gysylltiad personol â rhywbeth sy'n cael ei drafod, fel swydd, eiddo neu aelod o'r teulu. Mae buddiant sy'n rhagfarnu yn ddigon cryf i'r cynghorydd adael yr ystafell fel arfer a pheidio â chymryd rhan.
Caiff datganiadau eu darllen o'r cofnodion unwaith y byddan nhw wedi'u cyhoeddi.
Yn rhestru cynghorwyr presennol y cyngor yn unig. Nid yw aelodau cyfetholedig, swyddogion a chyn-gynghorwyr yn cael eu dangos.