Risk Management
Councils are currently assessing the effectiveness of their risk management arrangements, addressing specific threats like cyber security, and refining governance structures.
Hackney Council's Scrutiny Panel is scrutinising its performance monitoring framework, raising concerns about target setting and data quality, and the integration of risk management (October 2026). Kingston Council's Chief Audit Executive described its risk management arrangements as "reasonable" in June 2026, prompting councillors to question the distinction from "substantial assurance." Wandsworth Council's Audit Committee reviewed its risk management and risk appetite in March 2026, with a follow-up review scheduled for summer 2026.
Cyber security remains a key concern, with Hammersmith and Fulham Council identifying a high risk of attacks in March 2026 following a November 2025 incident, and Sutton Council addressing cyber-attack risks to pension fund data in December 2025. Tower Hamlets Council's Audit Committee flagged 'red' assurance levels in financial areas in March 2026, leading to a disclaimed audit opinion for 2024/25 due to significant weaknesses in financial reporting and internal control.
Lewisham Council is reviewing and updating its Corporate Risk Register, including cyber security and IT asset management (November 2025). Enfield Council is considering renaming its General Purposes Committee to the Audit Committee to sharpen its focus on finance and risk management (October 2025). Looking ahead, the City of London's Finance and Risk Committee is scheduled to review internal audit updates and risk reports in September 2026, and Sutton Council's North East Surrey Crematorium Board will conduct its annual review of risks in September 2026.
Key facts
- Hackney Council's Scrutiny Panel raised concerns about target setting, data quality, and the integration of risk management into performance tracking in October 2026. Source
- Kingston Council's Chief Audit Executive described its risk management arrangements as "reasonable" in June 2026. Source
- Hammersmith and Fulham Council identified a high risk of cyber attacks in March 2026, following a November 2025 incident. Source
- Tower Hamlets Council's Audit Committee flagged 'red' assurance levels in financial areas in March 2026, leading to a disclaimed audit opinion for 2024/25. Source
- Wandsworth Council's Audit Committee reviewed its risk management and risk appetite in March 2026, with a follow-up review scheduled for summer 2026. Source
About this summary
This summary was written automatically from our published stories and the council meeting records they draw on. It describes what councils have discussed and decided; it does not take a view on any decision. Each key fact links to the story it comes from. Updated 23 October 2026. Spotted a mistake? Email community@opencouncil.network.