Insights on audit committees in local government

Queensland’s local governments are responsible for delivering essential community services, including water, waste, and roads. To ensure the continued provision of these services, councils must manage their financial resources well and adopt good governance practices. The community’s trust in local government increases when councils can demonstrate that they deliver the critical services their community needs in a transparent and financially responsible way.

Audit committees are fundamental to good governance and can assist councils in building and maintaining community trust through:

• accessing cost-effective expertise – by supplementing the skills and local knowledge of councillors with specific technical, governance, or industry expertise, at a relatively low cost. This allows informed, independent challenge of management’s strategies, processes, systems, and information
• improving accountability and transparency – by fostering a culture of questioning and challenge. Robust oversight of financial management, reporting, and internal controls enhances the integrity and effectiveness of operations
• increasing access to funding – by monitoring management’s actions to improve a council’s financial management (including project and asset management practices). Where funding bodies have confidence in the governance practices of councils, it may be easier for these councils to secure grants and other financial support
• managing risk better – by providing timely oversight of a council’s risks and risk mitigation strategies, thereby safeguarding the council's assets, information, and reputation. The earlier significant risks are identified and managed, the less they are likely to cost to rectify.

We have been recommending to councils and the Department of Local Government, Water and Volunteers (the department) since 2017 that all councils should have an audit committee. In 2023–24, there were still 12 councils in regional and remote areas of Queensland without audit committees.

In Local government 2023 (Report 8: 2023–24), we reported that councils without active audit committees or internal audit functions were more often late signing their financial statements and took longer to resolve significant deficiencies in their systems of internal control than those with one.

We also reported that more than 62 per cent of councils are at a moderate or high risk of not being financially sustainable. Of the 12 councils without audit committees, 9 councils were rated as high risk of not being financially sustainable. It is crucial that these councils maintain appropriate oversight of and accountability for their finances.

Stakeholders told us that maintaining an audit committee is too costly for smaller councils. These costs include council resources to prepare information, paying independent member fees, and reimbursing travel costs. Councils are entrusted with managing significant public funds, making robust financial oversight essential. While they do not receive dedicated funding for their audit committees, the 12 councils without committees collectively receive over $200 million each year to fund their operations.

Queensland is the only state that does not require all councils to have audit committees. It also does not require a majority of independent members on the committee, whereas most states do. To overcome the perceived cost burden of audit committees, New South Wales, Western Australia, and South Australia allow small neighbouring councils to use joint audit committees that share members and resources.

In this report, we draw on the audit committee practices of 10 councils across Queensland to provide actions that councils should consider and implement to improve how their audit committee functions. We make 3 recommendations to the department to improve its role in promoting and facilitating good governance for Queensland’s local governments.

We prepared this report using the information we gathered through our audits. Our report does not provide assurance on the effectiveness of audit committees in local governments.

We continue to recommend that all councils should have an audit committee. And we recognise that the size and composition of audit committees should be based on individual council needs.

We made 2 recommendations to councils based on our audit insights.

We made 3 recommendations to the Department of Local Government, Water and Volunteers as the regulator for councils in Queensland and the entity responsible for supporting and training councillors.

Reference to comments

In accordance with s. 64 of the Auditor-General Act 2009, we provided a copy of this report to relevant entities. In forming these insights, we considered their views and represented them to the extent we deemed relevant and warranted. Any formal responses from the entities are at Appendix A.

Local governments operate and deliver critical community services. These services are complex and require significant investment from council. To ensure that councils can continue to serve their communities they must effectively monitor and manage their financial sustainability, and adopt good governance practices. Audit committees are crucial in providing mayors and councillors with the confidence that their council can meet their community’s needs in a transparent and financially responsible way.

In this chapter, we report on the number of councils with audit committees in Queensland. We discuss the link between audit committees and better outcomes for councils. We also assess what the Department of Local Government, Water and Volunteers (the department) is doing to assist council audit committees.

Our focus

This report builds on our previous work in Effectiveness of audit committees in state government entities (Report 2: 2020–21). By examining the audit committee practices of 10 councils, we identify key actions that councils can take to improve their transparency and accountability.

We prepared this report using the information we gathered through our audits. We drew on our firsthand experience from attending audit committees in local governments and more broadly across the Queensland public sector. Our report does not provide assurance on the effectiveness of audit committees in local governments. We provide more information on how we prepared it in Appendix B.

Local governments in Queensland

Queensland's 77 local governments, also known as councils, are responsible for delivering a wide range of community services, such as roads, water, and waste services. In some cases, councils provide housing, aged care, and childcare.

Managing services for the community involves managing risks, adhering to regulations, and meeting health and safety responsibilities. Councils must practice good governance and financial management to ensure their communities trust that they can deliver these services.

All councils, regardless of size, face similar risks and responsibilities. However, councils outside South East Queensland often have less access to the technical and specialist expertise needed to support their operations.

Councils in South East Queensland generally have larger populations and budgets. However, the relative importance of councils to their local economies, particularly in terms of land management and employment, usually increases further away from South East Queensland. This makes strong oversight and robust governance even more critical for regional and remote councils’ long-term sustainability.

Figure 2A below highlights the variance between the largest and smallest councils in Queensland and the services they deliver.

Audit committees: their purpose and what they do

Under the Local Government Act 2009 (the Act), audit committees monitor and review:

• the integrity of financial documents – for example reviewing and approving the annual financial report, considering external audit reports, and tracking recommendations
• the internal audit function – for example approving the internal audit plan, considering internal audit’s reports on the effectiveness of council operations, and tracking recommendations
• the effectiveness and objectivity of the local government’s internal auditors.

Audit committees also make recommendations to the local government about any matters that the committee considers need action or improvement. Some audit committees provide oversight on council’s risk management function, including monitoring risk levels and assessing the adequacy of risk mitigation. Councils cannot delegate responsibilities to an audit committee, so the committee does not replace management or internal controls.

The Local Government Regulation 2012 (the regulation) requires all large local governments to establish an audit committee. This applies to Brisbane City Council and the 28 large local governments specified in the regulation, schedule 3A. Councils that are not listed as large in the regulation are not required to have audit committees.

The link between audit committees and better outcomes

An effective audit committee can significantly improve governance in councils by:

• accessing cost-effective expertise that can provide independent challenge of management’s strategies, processes, systems, and information
• improving accountability and transparency through more robust oversight of financial management, reporting, and internal controls that protect council assets from fraud, waste, or misuse
• improving access to funding by monitoring management’s actions to improve financial management
• advising and informing chief executive officers (CEOs) and councillors of risks or threats to the council, such as cyber security and fraud risk.

In our report Local government 2023 (Report 8: 2023–24) and previous reports on local governments, we reported that more councils without active audit committees or internal audit functions were late signing their financial statements than those with one. We also reported that councils without committees or internal audit functions took longer to resolve significant deficiencies identified during our financial audits. In our report we explained the importance of audit committees and internal audit functions to improving the overall control environments of councils.

The Local Government Regulation 2012 requires councils to maintain a written record of their risks, along with the control measures adopted to manage those risks. An audit committee that understands its council's risks can provide better oversight of them. Figure 2B provides a case study of a council's audit committee identifying risks that lack control processes.

Audit committees that oversee financial management and internal audits can help councils improve financial performance. This oversight can facilitate better financial practices and risk mitigation. Figure 2C provides a case study of a council improving debt collection and cash flows.

Some councils do not have audit committees or internal audit functions

Our reports of local government financial audits have consistently recommended that all local governments establish audit committees. The timeline in Appendix C outlines our recommendations in relation to audit committees and key events since 2016.

In 2023–24 there were still 12 local governments in Queensland without an audit committee. A further 2 councils had audit committees, but the committee did not meet during the year. There were also 6 councils without an internal audit function and a further 5 councils’ internal audit function did not perform any audits. The regulation requires that all councils have an active internal audit function.

Without an audit committee or internal audit function, these councils are further exposed to risks and gaps in governance and oversight.

The 12 councils without audit committees collectively receive over $200 million in financial support each year in the form of grants, subsidies, contributions, and donations. Given the substantial public funding entrusted to councils, they must ensure robust financial oversight of those funds.

In Local government 2023 (Report 8: 2023–24), we reported that more than 62 per cent of councils are at a moderate or high risk of not being financially sustainable under the department’s new financial sustainability framework. Of the 12 councils without audit committees, 9 councils were rated as high risk of not being financially sustainable. It is crucial that these councils maintain appropriate oversight of and accountability for their finances.

Queensland is the only state that does not require all local governments to have an audit committee. New South Wales, Western Australia, and South Australia allow councils to form joint or regional audit committees where councils can share resources and independent members. Appendix E lists the legislated audit committee requirements in other jurisdictions.

The department can play a greater role in supporting councils to improve their oversight and governance

It is not mandatory for all councils in Queensland to have audit committees. Council audit committee chairs, CEOs, and other stakeholders told us there are several barriers that can hinder a council from establishing and maintaining an audit committee:

• Resource constraints – can make it challenging to establish and support an audit committee. This includes resources within council to prepare for meetings and pay independent member fees and travel costs for members.
• Lack of available expertise – with the necessary skills and experience to serve on the audit committee.
• Resistance to change – from management or staff can impede the formation and effective functioning of an audit committee.
• Insufficient support – from senior management or governing bodies can undermine the establishment and maintenance of an audit committee.

For councils to address these challenges they require a commitment to good governance, adequate resource allocation, and strong leadership support.

Since we commenced this report, the department has issued audit committee guidelines and a suite of templates to assist councils in setting up and maintaining an audit committee. However, some councils may need additional support to establish and maintain their committees. This support is crucial in ensuring that councils can challenge and effectively oversee their financial performance and position, internal control environment, risk management practices, and other committee responsibilities.

Actions to improve council audit committees

For councils that do have audit committees, there are opportunities for them to improve the functioning of their committees. Throughout this report, we list actions to help councils evaluate and enhance the effectiveness of their audit committees. These actions are also summarised in Appendix D.

In this chapter, we discuss how audit committees need the support of the mayor, CEO, and management. Without their support, an audit committee will be less effective. We also report on how a council can best support its audit committee by giving it access to people and information within council.

Successful meetings need senior people from across the council

The best way for CEOs to support effective audit committees is to attend meetings and provide regular business updates to the committee. CEO attendance at meetings can drive discussion and focus the committee on council risks, community issues, and major projects. A supportive CEO can empower management and staff to understand the audit committee's purpose and engage effectively with it.

Formalising CEO attendance and reporting in the audit committee charter provides greater transparency to the committee. It also supports accountability.

We reviewed the minutes of 10 council audit committees and found that CEOs consistently attended most, if not all, meetings.

Audit committee chairs told us that regular one-on-one meetings with CEOs and mayors assist them in keeping these key stakeholders informed. In separate meetings, the chair can provide feedback on the agenda, work plans, and quality of papers, and pass on feedback from audit committee meetings.

Effective audit committees need access to council resources, including staff, and information

Audit committees must have access to staff and information about the council to ensure they can perform their duties effectively. Access to staff and information is usually granted within the audit committee charter.

Of the 10 audit committees we reviewed, 9 had audit committee charters and 3 of these charters did not provide the audit committee with unrestricted access to staff and information.

The best way for councils to ensure that audit committees have the resources they need is for management to be responsible for items on the committees’ work plans and know when information is needed.

Action for council Council CEO engages with the audit committee, which is demonstrated by: the CEO and audit committee chair meeting regularly throughout the year and outside of audit committee meetings ensuring, where practicable, the CEO attends all meetings agreed with the audit committee chair and provides an update on emerging issues and risks (better practice is a written report).

In this chapter, we present the current makeup of the audit committee membership in councils across the state and discuss the need for committees to be led by a strong independent chair. Independent chairs and members can provide insights into best practice and advice to the CEO and council, and question existing norms.

Councillor members also play a crucial role in audit committees through their insights into the local context and strategic priorities of the council.

Councils should use a skills matrix to assist in recruiting members who fulfil the committee’s and council's requirements. Councils should also plan for the succession of members, especially around council elections, to ensure the committee retains its knowledge.

Audit committee membership in Queensland councils

Council audit committees typically consist of 2 types of members: external independents and councillors. Throughout this report we refer to external independent members as ‘independent members’.

In Queensland, smaller councils typically have fewer independent audit committee members than larger councils. The average number of each type of member is summarised by tier in Figure 4A.

Independent chairs and members add value

Experienced independent chairs and members can help to identify gaps and weaknesses in audit committee processes.

Since 2019, we have recommended that audit committees in local governments should have an independent chair. All other states and territories, except South Australia, require independent chairs and 3 states require majority independent members on the committee.

In 2023–24, of the 65 councils with audit committees, 5 did not have an independent chair and 37 did not have a majority of independent members.

Appointing the right chair

The chair serves as the link between the audit committee and the council and is responsible for leading and guiding meetings. The chair must be independent of the council and possess appropriate qualities for the role, including:

• strong leadership qualities to raise and deal with tough issues
• relationship and stakeholder management skills for maintaining effective working relationships between committee members and with the council
• interpersonal skills to facilitate discussions and encourage participation by other members.

Audit committee chairs have many responsibilities, including:

• keeping the council and CEO informed about the strategic and technical aspects of audits, risks, and control issues
• preparing for meetings by providing feedback to the council on agendas, meeting packs, and work plans
• ensuring meetings are conducted effectively and efficiently and that the views of members are heard
• focusing the committee on important issues
• summarising the discussions and deliberations of the committee and reporting this to council
• challenging management information to demonstrate unbiased oversight, and by doing this ensuring objectivity, mitigating risks, protecting stakeholder interests, and improving decision-making
• identifying key actions for management and/or the audit committee for reporting.

Having a chair with the right skills can help the council improve its governance. Successful chairs ask questions, raise challenges, and direct councils’ attention to risks or activities that require attention. Independent chairs and members can also provide committees with valuable skills and experiences from working with other councils, government entities, the private sector, or boards.

Some councils appoint finance professionals working for neighbouring councils onto their audit committees. While this might provide some insight into other, and potentially better, practices, councils may forgo the opportunity to recruit members with skills that are most needed by individual councils, such as risk management or cyber security for example.

Councils must seek opportunities to recruit the right members with the right skills, taking into account the existing skillsets of members already on the committee and the council risks.

Attracting members with the right skills

It is the council's responsibility to assess the suitability of proposed audit committee members. Councils should use a skills matrix to better understand and align members with their council needs. For example, a council without a sound risk management culture and practices should consider appointing a member with this background.

The Local Government Regulation 2012 requires audit committees to have at least one member with significant skills and experience in financial matters.

In our review of 10 audit committee charters, we found that only one defined the required skills of members, other than significant financial skills. The skills identified in this charter included internal controls, risk management, corporate governance, and information systems. Only 2 other charters referred to an assessment of the committee’s existing skills prior to appointing new members.

To ensure effective oversight in high-risk or developing areas, councils should select members with a diverse range of relevant skills. Some councils perform a skills matrix as a part of their annual self-assessment to identify the skills gap that exists in their audit committees. They can then use the results of the matrix to assist them in identifying new members. We have included an example in Figure 4B.

Action for council Council engages independent members that align with the needs of its business. A skills matrix should be used to identify suitable candidates for membership.

There is an increasing need for cyber security skills in councils

Cyber risks continue to evolve, particularly for entities undergoing information technology (IT) or digital transformation projects and using new technologies, such as artificial intelligence. Councils are especially vulnerable due to operating many information systems to support the delivery of critical public services, including water and sewerage services.

In our report Responding to and recovering from cyber attacks (Report 12: 2023–24), we reported that government entities, including local governments, are not as prepared as they should be to respond to attacks. In the report, we included 3 examples of cyber attacks that impacted Queensland councils since 2020.

Selecting independent committee members with a background in cyber security or information technology can provide a council with further oversight over its IT systems and controls.

Councillor members understand the community and the council’s needs

Councillors are important members of the audit committee. They can provide insights that independent external members cannot, including an understanding of:

• local context, challenges, and opportunities
• council’s strategic priorities
• how to engage with the CEO, management, other councillors, and the mayor.

Councillor members can also act as a link with the council, increasing the committee’s understanding of council risks and audit issues.

Audit committee chairs told us that councillor members can provide a helpful balance between elected/community matters and operational matters. They can provide context to risk discussions and assist the audit committee in focusing on the business of council, including service delivery, road and infrastructure development and maintenance, safe drinking water supply, and waste collection.

However, if councillors are not equipped with the right knowledge and understanding of their responsibilities on an audit committee, they may have difficulties contributing effectively. Stakeholders told us that councillor members can sometimes cause delays in decision-making due to not understanding their responsibilities on the committee.

An independent chair with the right skills and qualities can engage councillor members in discussions. One chair told us they encourage discussions and engagement in meetings by telling members and attendees that there are no stupid questions.

Councillor members often join audit committees with no prior knowledge of how audit committees function or their role. Without appropriate training and induction materials, councillor members may not be adequately equipped to support audit committees and provide valuable local context.

Councillors absorb a significant amount of information when they are newly elected, and they are ultimately responsible for ensuring councils meet their legislated responsibilities. They are likely to need additional training to understand their role and responsibilities as an audit committee member.

Action for council New audit committee chairs and members have access to appropriate induction, training, and other resources to ensure adequate knowledge of the role and other subject matter areas relevant to committee discussions. Council should provide induction training on: the committee’s roles and responsibilities topics included in the committee’s annual work plan council’s key strategic and operational risks and financial reporting risks.

The department designs and publishes online training for councillors (compulsory and non-compulsory modules). The non-compulsory training provided to councillors includes an overview of audit committees, however it does not provide any information on the responsibilities of audit committee members. The department could provide guidance or training to councillors to better understand what an audit committee is and how they can perform their duties if they are a member on the committee.

Audit committee succession planning is critical in local governments

Councillor members often change every 4 years, following council elections. In the March 2024 election, 53 per cent of councillors changed. These changes affect the continuity of knowledge within audit committees and increase the need for independent members. Smaller councils often have more councillor members than external independent members, which increases the impact of turnover.

In this chapter, we report on how audit committees can define their responsibilities, plan their work, and assess their performance.

Figure 5A describes the key documents that audit committees need to operate effectively.

Effective charters clearly define roles and responsibilities

An audit committee charter or terms of reference sets the tone and content of audit committee meetings by defining the committee’s roles and responsibilities. A charter approved by the council ensures the committee has the authority to access information, people, and resources.

Councils can seek support from experienced audit committee members by asking them to review the charter before it is approved by council.

We found that 9 of the 10 councils we assessed had audit committee charters, however, 2 councils did not require the audit committee to review the charter and 2 were approved by the CEO rather than the council.

Charters should be fit for purpose and tailored to council needs

The audit committee charter should be adapted to meet the needs of council. For instance, some councils may have separate risk management or workplace health and safety committees, while others may include these responsibilities in the audit committee charter.

Not all of the committees performed the work specified in their charter. For example, 4 of the 9 councils had risk management as a responsibility in their charters, however, there was no evidence of these committees reviewing risk assessments throughout the year.

The Local Government Act 2009 requires audit committees to:

• monitor and review the integrity of the financial documents
• monitor and review the effectiveness and objectivity of the internal auditors
• make recommendations to the council about any matters the audit committee considers relevant.

Other corporate governance processes and systems that can be included in audit committee responsibilities include:

• monitoring and reviewing risk management processes, including cyber security
• regulatory compliance
• governance structure, including financial delegations, and reporting on significant projects and outsourced activities
• workplace health and safety
• fraud prevention and identification
• complaints processes.

The extent of an audit committee’s responsibilities depends on the council’s needs and risks. A council should have a clear view of the maturity of its corporate governance processes and systems so that the audit committee can focus its efforts on the areas that need attention.

Action for council Council regularly reviews the roles and responsibilities in the audit committee charter to clearly define the objectives of the committee and ensure the committee has the authority to perform its role.

Audit committee charters should inform annual work plans

Audit committees should align their annual work plan with the responsibilities in their charter.

Only 3 of the 10 councils we assessed included a work plan in their audit committee packs and not all audit committee charters required annual work plans.

Stakeholders have informed us that audit committees led by experienced independent chairs are briefed on the council's main functions, systems, and risks. They use this information and the responsibilities listed in the audit committee charter to develop work plans and set agendas. These chairs also make sure the work plan is included as a regular agenda item so the committee is aware of upcoming matters and can adjust the work plan if urgent issues arise.

Audit committees need to have the capacity to discuss agenda items in depth and add other matters not on the formal agenda. To provide advice to council, they need this flexibility. One chair told us about how they manage the annual work plan when agenda items are delayed and further meetings are added to the plan, as described in Figure 5B.

Meetings need sufficient time

Audit committees should plan the length of audit committee meetings and dedicate sufficient time to discuss council’s major issues that are within the committee’s scope.

The 10 councils we assessed had audit committee meetings that ranged from 25 minutes to 4 hours.

Planning out the time for each agenda item can assist the committee in ensuring it is spending enough time on those issues that impact council most. It can highlight where committees are not spending enough time, which could indicate that they are not getting quality information, or the committee is not engaging in robust discussions.

Action for council Council and the audit committee prepare an annual work plan that is informed by the key risks and challenges facing council. The number, length, and focus of meetings are planned to ensure the committee delivers on all responsibilities in its charter.

Meetings need quality information and sufficient preparation time

For audit committees to have robust and respectful discussions, councils must provide them with sufficient time and access to quality information.

Councils typically prepare audit committee packs, with papers for each item on the agenda. Papers can include financial reports, internal and external audit reports, risk management reports, and project plans. Audit committee chairs told us that they often receive an overwhelming volume of information in audit committee packs.

We found that 6 of the 10 councils we assessed had audit committee packs that averaged over 200 pages. One pack had more than 850 pages.

Some audit committee chairs have implemented rules to reduce the volume and help the committee focus on relevant issues. One chair told us that they meet with the CEO and the audit committee secretariat to discuss each item on the work plan and the information the audit committee needs.

Councils should include a cover page for each paper to assist the audit committee in directing its attention to critical aspects of the report. This should be supported by the relevant representative from the council area attending and presenting their papers. This allows the audit committee to ask questions and develop a deeper understanding of council business.

Audit committees need sufficient time to review meeting packs prior to the meeting. Some audit committee members told us they were given as little as 2 days to review papers before the meeting.

Striking the right balance of information provided to audit committees relies on councils planning effectively for these meetings and providing information that is tailored to the needs of the audit committee. Overwhelming audit committees with information is not likely to result in effective outcomes from meetings.

Action for council Council supports the audit committee by providing it with timely agendas and meeting packs that consist of clear and concise management reports that provide needed information and address council’s key risks.

Reporting to council can be improved

Following an audit committee meeting, the committee is required under the regulation to present a written report to council. The report must include any recommendations the committee has made about matters discussed in the meeting.

For 8 of the 10 audit committees we examined, we found the chair provided minutes to the council, not a report on its activities.

Reporting to council is an important step in the audit committee process given that the purpose of the audit committee is to provide advice to council. While minutes provide an account of what is discussed, chairs can use the report to direct the council’s attention to matters of importance.

Action for council Audit committee chair provides a summary written report to council as soon as practical after a meeting of the audit committee so that all elected members of council are informed of the committee’s discussions and recommendations.

Audit committees should regularly assess their performance

Self-assessments help audit committees confirm they have met their responsibilities. The assessments should be customised, based on the audit committee's charter responsibilities and the council’s core activities and risks.

A well-executed self-assessment can help the council to effectively measure and report on its audit committee's performance. Additionally, the council can use the self-assessment to identify any skill gaps on the committee.

Action for council Council reviews the audit committee’s performance annually to ensure that: members possessed the right skills to deliver on the work plan members contributed to committee discussions the committee met its responsibilities within the charter the committee provided sufficient reporting to council.