Part 4: Audit and risk committees
4.1
In our May 2019 report Our 2018 work about local government, we reinforced the importance of effective audit and risk committees for councils. They can provide external and independent perspectives on the risks, issues, and challenges councils face.
4.2
In this Part, we discuss the importance of audit and risk committees to support the good governance of councils. We also look at the status of audit and risk committees after the 2019 local government elections, including their membership and terms of reference.
What are audit and risk committees and what is their value?
4.3
Audit and risk committees provide guidance and advice to councillors, typically on the council's financial reporting, risk management, system of internal controls, and external and internal audit matters.
4.4
Importantly, they can provide different and independent perspectives on the risks, issues, and challenges councils face. Although audit and risk committees should improve the governance of councils, they do not replace that governance.
4.5
In our view, effective audit and risk committees help provide assurance to councillors and management on councils' financial management and main systems and controls. They can also provide assurance that the council's strategies and plans are achieving their strategic objectives.
4.6
Audit and risk committees should focus on providing assurance to councillors that the council is managing risk well. An audit and risk committee that focuses only on compliance limits its value.
4.7
The Productivity Commission and the Institute of Directors expressed views on the use of audit and risk committees in local government. In its submission on the Commission's draft local government funding and financing report, the Institute said that it "strongly endorse[s] the Commission's recommendations to help build governance and financial capability."
4.8
The Commission's final report recommended that "[t]he Local Government Act 2002 should be amended to require all local authorities to have an audit and risk committee". This has also been our position for some time.
4.9
At the time of writing this report, the Government was considering the Commission's recommendations.
4.10
Most councils have an audit and risk committee. We looked at the number and make-up of audit and risk committees before the 2019 local government elections. We found that only five councils did not have an audit and risk committee or an equivalent.
4.11
At that time, 60 councils had an independent or external member(s), and 30 of these also had an independent chairperson. We looked at the status of audit and risk committees again after the 2019 local government elections and found that 76 councils had an audit and risk committee or an equivalent.
4.12
At the time of writing, the remaining two councils were still considering it. Of the 76 councils, 67 had or planned to appoint one or more independent members, and 42 had or planned to appoint an independent chairperson.
Figure 6
Numbers of council audit and risk committees before and after the 2019 local government elections
| Audit and risk committees | 2020 | 2019 |
|---|---|---|
| Standing committees (confirmed or proposed) | 76 (97%) | 73 (94%) |
| With independent members (including chairpersons) | 67 (86%) | 60 (77%) |
| With independent chairpersons | 42 (54%) | 30 (38%) |
| No standing committees | 2 (2%) | 5 (6%) |
Source: Office of the Auditor-General survey of councils.
4.13
We are pleased that almost every council now has an audit and risk committee, and that the number of councils with independent chairpersons has increased. The real value of these audit and risk committees, and their independent members and chairpersons, will be whether the councils they serve judge them to be effective.
How can audit and risk committees be effective?
4.14
In our view, there are four principles for an effective audit and risk committee. They are independence, clarity of purpose, competence, and open and effective relationships.
Independence
4.15
Independent and external perspectives, experience, and knowledge enable audit and risk committees to test and challenge councils. We consider that audit and risk committees need independent members – in particular, independent chairpersons – to be able to give truly independent advice.
Clarity of purpose
4.16
Councils need to be clear about what they want from audit and risk committees to get the most value from having one. Clarifying all parties' expectations keeps audit and risk committees focused on supporting governance. Strong terms of reference help enable clarity.
Competence
4.17
Audit and risk committees need a mix of skills and experience to provide the right level and type of oversight needed, particularly on risk. Having a diverse team brings a variety of perspectives and backgrounds and enables the audit and risk committee to scrutinise and debate issues.
Open and effective relationships
4.18
Effectiveness is achieved when audit and risk committees operate in an environment of openness and trust. Audit and risk committees more effectively support councils when chairpersons and councils promote open and proactive dialogue, including with management, staff, and councillors.
Mandate and relationships
4.19
A right mix of members and strong terms of reference are essential for audit and risk committees to succeed. To be effective, they need a wide mandate in their terms of reference.
4.20
We looked at terms of reference for some audit and risk committees. Most covered:
- risk management;
- internal controls;
- internal audit;
- external audit;
- external accountability; and
- compliance with legislation, policies, and procedures.
4.21
The terms of reference that councils set for audit and risk committees are important. A scope that is too narrow, meetings that are too few, or vague areas of focus could undermine the effectiveness of audit and risk committees in identifying and managing risks or scrutinising non-financial performance.
4.22
Several terms of reference that we looked at included requirements for independent member(s) and/or independent chairpersons. Matamata-Piako District Council's charter and terms of reference included a requirement that the chairperson be "an external appointment with skills and experience to provide value to the Council". Hutt City Council included a matrix table to record the "experience, skills and personal qualities" of each independent member.
4.23
Several terms of reference that we looked at explicitly included oversight of LTP development and/or progress, including financial and capital spending concerns.
4.24
Most terms of reference included references to risks and emerging risks that were focused mainly on systems and controls and financial implications. This might be too vague. Councils face many areas of challenge and risk. Audit and risk committees are a mechanism to help clarify and manage these risks.
The next steps
4.25
Councils have acted on our recommendation for them to have an audit and risk committee. They have voluntarily chosen to establish and develop an audit and risk committee or an equivalent.
4.26
We hope that this will continue to build council staff and the community's confidence in their councils and become embedded in councils' culture and governance.
4.27
We consider that, to be effective, audit and risk committees need to have independent members – in particular, an independent chairperson – and a strong mandate (terms of reference).
4.28
We encourage councils to continue to consider the membership and terms of reference for their audit and risk committees. We also encourage councils to clarify areas of ambiguity and complexity, such as the role audit and risk committees have in managing:
- transitioning to a disrupted climate and low-emissions future;
- funding and financing uncertainty;
- cyber security;
- regulatory and legislative compliance;
- significant project, operational, and development-related risks;
- infrastructure planning; and
- Covid-19 implications.
4.29
We will continue to support effective audit and risk committees in our capacity as auditors – in particular, audit and risk committees' contribution to managing risks. We and others have prepared material about audit and risk committees and guidance on enabling an effective committee.
4.30
We have met with several councils since the 2019 local government elections and will continue to work with our appointed auditors and audit and risk committees to support them in being effective.