Dear Dudley Council,

Further to https://www.expressandstar.com/news/loca... please supply a copy of the council's risk register (including risk levels) and a list of audits conducted over the last year with their outcomes.

Yours faithfully,

A Smith

Dudley Triggers, Dudley Council

Dear A Smith,

Information Access Request - Information Request DMBCIR:21266
Description : Risks and assurance work

I acknowledge your request for information received on 2019-08-19
08:37:00.

Your request is being considered and you will receive the information
requested within the statutory timescale of 20 working days (Freedom of
Information Act 2000/Environmental Information Regulations) or 1 month
from receipt (Data Protection access requests).

For your information, the Acts and Regulations define a number of
exemptions which may prevent release of the information you have
requested. There will be an assessment and if any of the exemption
categories apply then the information may not be released. In some
circumstances the decision to release information, or not, will be based
on a public interest test. You will be advised of any considerations,
subsequent decisions and your rights of appeal.

If the information you request contains reference to a third party then
they may be consulted prior to a decision being taken on whether or not to
release the information to you. You will be informed if this is the case,
including your rights of appeal.

Unless otherwise requested the information may be provided in electronic
format, paper copy, normal font size. If you require alternative formats,
e.g. language, audio, large print, etc. then please let me know.

There may be a fee payable for this information. This will be considered
and you will be informed if a fee is payable. In this event the fee must
be paid before the information is processed and released. The time limit
for responses is suspended until receipt of the payment.

If you have any queries or concerns then please contact the Information
Governance Officer at Dudley MBC, The Council House, Dudley, West
Midlands, DY1 1HF, telephone 0300 555 8283, e-mail
[Dudley Metropolitan Borough Council request email] .

Please remember to quote the reference number above in any future
communications.

Most of the information that we provide in response to Freedom of
Information/Environmental Information requests will be subject to
copyright protection. In most cases the copyright will be owned by Dudley
MBC. The copyright in other information may be owned by another person or
organisation, as indicated in the information itself. You are free to use
any information supplied for your own use, including for non-commercial
research purposes. The information may also be used for the purposes of
news reporting. However, any other type of re-use, for example, by
publishing the information or issuing copies to the public will require
the permission of the copyright owner.

For information where the copyright is owned by the Council details of the
conditions on re-use can be found on our website at www.dudley.gov.uk.

For information where the copyright is owned by another person or
organisation, you must apply to the copyright owner to obtain their
permission.

Yours sincerely,

The Information Governance Team
Council House
Priory Road
Dudley
West Midlands
DY1 1HF
[Dudley Metropolitan Borough Council request email]

Dear Dudley Triggers,

I would appreciate a response as this has now passed 20 working days and I would expect the information to be available.

Yours sincerely,

A Smith

Mail Delivery System,

2 Attachments

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email address]
host mailcluster.dudley.gov.uk [193.105.48.25]
SMTP error from remote mail server after RCPT TO:<[email address]>:
550 5.1.1 <[email address]>: Recipient address rejected:
User unknown in relay recipient table

Information Governance, Dudley Council

1 Attachment

  • Attachment

    Picture Device Independent Bitmap 1.jpg

    3K Download

 
Corporate Information Governance Team
3/5 St James’s Road, Dudley West Midlands. DY1 1HP
Tel: (01384) 815607  Fax: (01384) 815660
Email:[Dudley Metropolitan Borough Council request email]
[1]www.dudley.gov.uk
 

Our ref: 21266 Direct Line: 01384 816546 Date: 24/09/2019

 
 
Dear A Smith,
 
Freedom Of Information Act 2000 - Information Request 21266
 
I acknowledge your request for information received on 19/08/2019. Our
response is as follows.
 
Your Request
 
Further to
[2]https://www.expressandstar.com/news/loca...
please supply a copy of the council's risk register (including risk
levels) and a list of audits conducted over the last year with their
outcomes.
 
 
Our Response
 
A copy of the audit and standards committee meeting details and documents
can be found via our publication scheme, which can be found via this
link:-
 
[3]http://cmis.dudley.gov.uk/cmis5/Meetings...
 
Your request for a copy of the council’s risk register (including risk
levels) and a list of audits over the last year with their outcomes has
now been considered and it is not possible to meet your request.
 
This is because the Council is relying on an exemption – Section 36 (2)
(c) of the Freedom of Information Act, 2000.
 
Information to which this section applies is exempt information if, in the
reasonable opinion of a qualified person, disclosure of the information
under this Act would otherwise prejudice, or would be likely otherwise to
prejudice, the effective conduct of public affairs.
 
In accordance with the Freedom of Information Act 2000 this letter acts as
a Refusal Notice.
 
If this does not answer your question, then you may submit a further
request; it would be helpful if you could refine your request so that we
can advise what may be provided under the Freedom of Information Act and
any cost implications.
 
If you do have difficulty in accessing the information please contact
Dudley Council Plus on 0300 555 2345 who will be able to assist you.
 
If you are unhappy with the service you have received in relation to your
request and wish to make a comment or complaint, or request a review of
the decision, you should write to the Freedom of Information Officer at
Dudley MBC, The Council House, Dudley, West Midlands, DY1 1HF, telephone
0300 555 2345, e-mail [4][Dudley Metropolitan Borough Council request email]. 
 
Please remember to quote the reference number above in any future
communications.
 
If you are not content with the outcome of your complaint, you may apply
directly to the Information Commissioner for a decision.  Generally, the
ICO cannot make a decision unless you have exhausted the complaints
procedure provided by Dudley MBC.
 
The Information Commissioner may be contacted at:
 
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow 
Cheshire 
SK9 5AF
Telephone:   01625 545 700
[5]www.ico.org.uk
 
Most of the information that we provide in response to Freedom of
Information Act 2000 requests will be subject to copyright protection.  In
most cases the copyright will be owned by Dudley MBC.  The copyright in
other information may be owned by another person or organisation, as
indicated in the information itself.  You are free to use any information
supplied for your own use, including for non-commercial research
purposes.  The information may also be used for the purposes of news
reporting.  However, any other type of re-use, for example, by publishing
the information or issuing copies to the public will require the
permission of the copyright owner.
 
For information where the copyright is owned by the Council details of
the conditions on re-use can be found on our website at
[6]www.dudley.gov.uk.
 
For information where the copyright is owned by another person or
organisation, you must apply to the copyright owner to obtain their
permission.
 
 
Yours sincerely,
 
Steven Attwood
Information Governance Officer
Digital and ICT Services
Corporate Information Governance Team
Chief Executive’s Directorate
Tel: 01384 816546
Email: [7][email address]
 
 
This Email and any attachments contains confidential information and is
intended solely for the individual to whom it is addressed. If this Email
has been misdirected, please notify the author as soon as possible. If
this email has a protective marking of OFFICIAL – SENSITIVE, PROTECT or
RESTRICTED in its title or contents, the information within must be
subject to appropriate safeguards to protect against unauthorised or
unlawful processing and against accidental loss or destruction or damage.
OFFICIAL – SENSITIVE, PROTECT and RESTRICTED information should only be
further shared where there is a legitimate need. If you are not the
intended recipient you must not disclose, distribute, copy, print or rely
on any of the information contained, and all copies must be deleted
immediately. Whilst we take reasonable steps to try to identify any
software viruses, any attachments to this e-mail may nevertheless contain
viruses which our anti- virus software has failed to identify. You should
therefore carry out your own anti-virus checks before opening any
documents. Dudley Metropolitan Borough Council will not accept any
liability for damage caused by computer viruses emanating from any
attachment or other document supplied with this e-mail.

Please consider the environment - do you need to print this e-mail?

References

Visible links
1. http://www.dudley.gov.uk/
2. https://www.expressandstar.com/news/loca...
3. http://cmis.dudley.gov.uk/cmis5/Meetings...
4. mailto:[Dudley Metropolitan Borough Council request email]
5. http://www.ico.org.uk/
6. http://www.dudley.gov.uk/
7. mailto:[email address]

Dear Dudley Council,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Dudley Council's handling of my FOI request 'Risks and assurance work'.

======================================

Thank you for the committee documents link containing some of the information requested.

"Your request for a copy of the council’s risk register (including risk levels) and a list of audits over the last year with their outcomes has now been considered and it is not possible to meet your request."

The committee documents include a list of 2018/19 audits and a list of audits rated by the internal audit services function as minimal or requires improvement:

* Property Income
* Information@Work Systems Review
* Public Sector Partners Dudley LLP
* HR and Payroll Systems Review
* M3 Public Protection Systems Review
* Redhall Primary School
* Alder Coppice Primary School
* Bromley Hills Primary School
* HR Transactions
* New Heritage Regeneration
* Special Educational Needs

I note for my own and the public interest that two of these audits, HR and Payroll Systems and HR Transactions, were of an area of the council overseen by Mr Adrian McCormick in the role of Chief Officer, who was also responsible for overseeing the project to install the new HR and Payroll system, and comment that the ratings do not much surprise me.

Since the performance report highlights areas of the council with these low assurance ratings, it is very difficult to credit that indicating the assurance rating outcomes of the other audits would "prejudice the effective conduct of public affairs". I fail to see why this information is being withheld unless to spare blushes for specific senior employees, and urge the council to reconsider.

Moving on to the risk register. To the best of my knowledge and having seen a copy some years ago, the council's risk register is available to its employees through an internal web page.

It is strange that the council trusts members of staff at all levels with this information but states that disclosure would prejudice the effective conduct of public affairs, and I cannot imagine what could have been added to it to justify this response. Apart from the risk register in the context of the newspaper article, it is unconscionable at a time of considerable national uncertainty that the council should seek to hide its risk management practices.

I note that is normal for councils to publish their risk registers in the interests of transparency:-

https://www.gravesham.gov.uk/__data/asse...
https://www.north-norfolk.gov.uk/media/2...
https://www.orkney.gov.uk/Files/Committe...
https://democracy.bristol.gov.uk/documen...
https://www.valeofglamorgan.gov.uk/Docum...
https://www.charnwood.gov.uk/files/paper...
https://www.fenland.gov.uk/media/5917/Co...
http://www.newport.gov.uk/documents/Coun...
http://democracy.rochdale.gov.uk/documen...
https://www.eastlothian.gov.uk/download/...
https://www.lambeth.gov.uk/elections-and...
https://www.wychavon.gov.uk/documents/10...
https://www.hertfordshire.gov.uk/media-l...
https://democracy.wirral.gov.uk/document...
http://democracy.brent.gov.uk/documents/...
https://committee.nottinghamcity.gov.uk/...
http://www.democracy.caerphilly.gov.uk/d...
https://www.bromley.gov.uk/downloads/fil...
https://www.southdowns.gov.uk/wp-content...
https://www.hart.gov.uk/sites/default/fi...
https://edemocracy.coventry.gov.uk/docum...
https://rds.eppingforestdc.gov.uk/docume...
http://mycouncil.oxford.gov.uk/documents...
https://www.stroud.gov.uk/media/208663/i...
http://politics.leics.gov.uk/documents/s...
http://committeepapers.barnet.gov.uk/doc...
https://democracy.croydon.gov.uk/documen...
https://governance.enfield.gov.uk/docume...
http://www.moray.gov.uk/minutes/data/PR2...
http://democracy.stockport.gov.uk/mgConv...
https://democracy.spelthorne.gov.uk/docu...

I would therefore suggest it may be preferable for the council to provide its risk register, perhaps even to publish it openly as do so many other councils, rather than this being escalated to a complaint with the Information Commissioner.

=================================

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/r...

Yours faithfully,

A Smith

Information Governance, Dudley Council

2 Attachments

Dear Mr Smith,

 

Re:  Freedom of Information Request – 21266 – Request for a Review

 

Thank you for your email dated 28^th September requesting a review of how
the above request (submitted on 19^th August 2019) for information was
handled.  I have now re-considered your request and my response is
detailed below.

 

For the avoidance of doubt you requested:

 

Further to
[1]https://www.expressandstar.com/news/loca...
please supply a copy of the council's risk register (including risk
levels) and a list of audits conducted over the last year with their
outcomes.

 

To address your comments regarding the provision of assurance ratings
relating to Audits undertaken,  I have reconsidered what has been provided
to you in terms of what is available in committee reports.  To supplement
this, I believe that the attached additional material may be of assistance
to you.

 

In terms of the Risk Register information, you were responded to on the
24^th September with the provision of information that is already in the
public domain and contained within Audit and Standard Committee meeting
public papers.  This material includes the Council’s Corporate Risk
Register that is published 3 times a year.  For example, I specifically
refer you to Appendix One (page 62 of 150) that provides a table entitled
“[2]Risk Register:  Corporate Risks”. (click on this link to view
content).  It was the publication of this material that was the source of
the press article to which you refer.

 

As a consequence the conclusion is that you have been provided with this
information and the council does publish the information routinely.

 

In terms of the previous response to you exempting disclosure of
information under Section 36 (2)(c) of the Freedom of Information Act 2000
on the grounds that disclosure would otherwise prejudice, or would be
likely to prejudice, the effective conduct of public affairs.  This was
based on the initial interpretation of your request, which assumed you
were requiring disclosure of the council’s operational risk register
contained in our risk management system and not the Corporate Risk
Register, your further clarification and signposting of what other public
authorities publish has clarified that this was not the case and I
apologise for this misinterpretation.

 

I trust that the link to information provided above and the additional
material attached is satisfactory resolution to this matter.

 

If you are not content with the outcome of your complaint, you may apply
directly to the Information Commissioner for a decision.  Generally, the
ICO cannot make a decision unless you have exhausted the complaints
procedure provided by Dudley MBC.

 

The Information Commissioner may be contacted at:

 

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow 

Cheshire 

SK9 5AF

Telephone:   01625 545 700

[3]www.ico.org.uk

 

Most of the information that we provide in response to Freedom of
Information Act 2000 requests will be subject to copyright protection.  In
most cases the copyright will be owned by Dudley MBC.  The copyright in
other information may be owned by another person or organisation, as
indicated in the information itself.  You are free to use any information
supplied for your own use, including for non-commercial research
purposes.  The information may also be used for the purposes of news
reporting.  However, any other type of re-use, for example, by publishing
the information or issuing copies to the public will require the
permission of the copyright owner.

 

For information where the copyright is owned by the Council details of
the conditions on re-use can be found on our website at
[4]www.dudley.gov.uk.

 

For information where the copyright is owned by another person or
organisation, you must apply to the copyright owner to obtain their
permission.

 

Yours sincerely,

 

Lewis Bourne

Data Protection & Information Governance Manager

Corporate Information Governance

Finance & Legal

Tel: 01384 81 5608

 

[5]cid:image001.png@01D57CFB.C1856CC0

 

This Email and any attachments contains confidential information and is
intended solely for the individual to whom it is addressed. If this Email
has been misdirected, please notify the author as soon as possible. If
this email has a protective marking of OFFICIAL – SENSITIVE, PROTECT or
RESTRICTED in its title or contents, the information within must be
subject to appropriate safeguards to protect against unauthorised or
unlawful processing and against accidental loss or destruction or damage.
OFFICIAL – SENSITIVE, PROTECT and RESTRICTED information should only be
further shared where there is a legitimate need. If you are not the
intended recipient you must not disclose, distribute, copy, print or rely
on any of the information contained, and all copies must be deleted
immediately. Whilst we take reasonable steps to try to identify any
software viruses, any attachments to this e-mail may nevertheless contain
viruses which our anti- virus software has failed to identify. You should
therefore carry out your own anti-virus checks before opening any
documents. Dudley Metropolitan Borough Council will not accept any
liability for damage caused by computer viruses emanating from any
attachment or other document supplied with this e-mail.

Please consider the environment - do you need to print this e-mail?

References

Visible links
1. https://www.expressandstar.com/news/loca...
2. http://cmis.dudley.gov.uk/CMIS5/Document...
3. http://www.ico.org.uk/
4. http://www.dudley.gov.uk/

Dear Information Governance,

Thank you for your constructive response, providing both audit outcome ratings and highlighting the risk register in

http://cmis.dudley.gov.uk/CMIS5/Document...

It is positive to see that most other parts of the council managed by other senior officers over this period do not appear to raise internal audit concerns in the way those overseen by Mr A M have.

Yours sincerely,

A Smith