Agenda of Audit, Risk and Assurance Committee

Audit, Risk and Assurance Committee

30 June 2026

A black text on a white background

Description automatically generated

Audit, Risk and Assurance Committee

MINUTES

Minutes of an ordinary meeting of the Audit, Risk and Assurance Committee held in the Council Chamber, Dunedin Public Art Gallery, The Octagon, Dunedin on Friday 27 March 2026, commencing at 9:30 a.m.

PRESENT

Chairperson	Mr Bruce Robertson
Deputy Chairperson	Ms Rachael Dean
Members	Mayor Sophie Barker	Cr John Chambers
	Cr Cherry Lucas	Cr Andrew Simms
	Cr Lee Vandervis

IN ATTENDANCE	Sandy Graham (Chief Executive), Carolyn Allan (Chief Financial Officer), Hayley Knight (Assurance Manager), David Ward (General Manager 3 Waters, Property and Urban Development), Paul Henderson (General Manager Corporate and Regulatory Services), Mike Costelloe (General Manager, Arts, Culture and Economic Development), Richard Davey (Treasurer, Dunedin City Holdings Limited), Jane Pearce (Health and Safety Manager), Tania Cribb (Risk Manager), Tony Nelmes (Project Accountant), Councillor Doug Hall.

Governance Support Officer	Jean Cockram

1 Apologies

Mayor Sophie Barker gave apologies for absence to attend another appointment at 1pm.

Moved (Mr Bruce Robertson/Cr Cherry Lucas):

That the Committee:

Accepts the apology from Mayor Barker for absence.

Motion carried (ARAAC/2026/001)

2 Confirmation of agenda

Moved (Mr Bruce Robertson/Cr Cherry Lucas):

That the Committee:

Confirms the agenda with the following alterations: a) Item C2 be taken at 1pm after the lunch break to accommodate the availability of external representatives to speak to the report; and b) the addition of a new item (C16 – Finance Workshop) to be taken at the start of the confidential section of the agenda.

Motion carried (ARAAC/2026/002)

3 Declarations of interest

Members were reminded of the need to stand aside from decision-making when a conflict arose between their role as an elected representative and any private or other external interest they might have.

It was noted that the Interests Register would be updated with the interests of new independent members before the next meeting. In the interim, Bruce Robertson declared an interest in the Central Otago District Council Audit and Risk Committee and the MBIE Determinations section. Rachael Dean declared an interest in the Buller and South Waikato District Councils’ Risk Committees.

Moved (Cr Cherry Lucas/Mayor Sophie Barker):

That the Committee:

a) Amends the Elected or Independent Members' Interest Register; and

b) Confirms the proposed management plan for Elected or Independent Members' Interests.

Motion carried (ARAAC/2026/003)

4 Confirmation of Minutes

4.1 Audit, Risk and Assurance Committee meeting - 4 December 2025

Moved (Cr Cherry Lucas/Mayor Sophie Barker):

That the Committee:

Confirms the public part of the minutes of the Audit, Risk and Assurance Committee meeting held on 4 December 2025 as a correct record.

Motion carried (ARAAC/2026/004)

Part A Reports

5 ARAC Workplan Update 2026-27

A report from Civic provided an update on the Audit, Risk and Assurance Committee Work Plan 2026-27, which had been continued from the last Committee and would be further developed.

The Chief Financial Officer (Carolyn Allan) and the Assurance Manager (Hayley Knight) spoke to the report and responded to questions.

Moved (Cr Lee Vandervis/Cr Cherry Lucas):

That the Committee:

Notes the Audit, Risk and Assurance Committee Workplan for 2026-27.

Motion carried (ARAAC/2026/005)

6 General Matters Update Report - March 2026

A report from Finance provided updates on the progress of various matters that have been noted by the Committee.

The Chief Financial Officer (Carolyn Allan) and the Assurance Manager (Hayley Knight) spoke to the report and responded to questions.

Moved (Cr Cherry Lucas/Mr Bruce Robertson):

That the Committee:

Notes the Audit, Risk and Assurance Committee Updates Report – March 2026

Motion carried (ARAAC/2026/006)

7 Health, Safety and Wellbeing Monthly report for January 2026

A report from Health and Safety provided the monthly Health, Safety and Wellbeing update for January 2026 for the Committee’s information.

The Chief Executive (Sandy Graham), General Manager 3 Waters, Property and Urban Design (David Ward), and the Health and Safety Manager (Jane Pearce) spoke to the report and responded to questions.

Moved (Cr Cherry Lucas/Mayor Sophie Barker):

That the Committee:

Notes the monthly Health, Safety and Wellbeing report for January 2026.

Motion carried (ARAAC/2026/007)

8 Financial Report - Period ended 31 January 2026

A report from Finance provided the financial results for the period ended 31 January 2026 and the financial position as at that date. It noted that the report was presented to the Finance and Performance Committee meeting held on Thursday 19 March 2026.

The Chief Financial Officer (Carolyn Allan) spoke to the report and responded to questions.

Moved (Mr Bruce Robertson/Cr Lee Vandervis):

That the Committee:

Notes the Financial Performance for the period ended 31 January 2026 and the Financial Position as at that date.

Motion carried (ARAAC/2026/008)

9 Waipori Fund - Quarter ending 31 December 2025

A report from Dunedin City Treasury provided information on the results of the Waipori Fund for the quarter ended 31 December 2025.

The Treasury Manager (Richard Davey) spoke to the report and responded to questions.

Moved (Cr Cherry Lucas/Cr Lee Vandervis):

That the Committee:

Notes the report from Dunedin City Treasury Limited on the Waipori Fund for the quarter ended 31 December 2025.

Motion carried (ARAAC/2026/009)

10 Financial Strategy Compliance

A report from Finance provided a summary of financial limits for rate increases and debt. It noted that the purpose of the report was to monitor current forecast measures against the limits.

The Chief Financial Officer (Carolyn Allan) spoke to the report and responded to questions.

Moved (Mr Bruce Robertson/Cr Lee Vandervis):

That the Committee:

Notes the Financial Strategy Compliance report.

Motion carried (ARAAC/2026/010)

Resolution to Exclude the Public

Moved (Mr Bruce Robertson/Cr Cherry Lucas):

That the Committee:

Pursuant to the provisions of the Local Government Official Information and Meetings Act 1987, exclude the public from the following part of the proceedings of this meeting namely:

General subject of the matter to be considered	Reasons for passing this resolution in relation to each matter	Ground(s) under section 48(1) for the passing of this resolution	Reason for Confidentiality
C1 Audit, Risk and Assurance Committee meeting – 4 December 2025 – Public Excluded	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities. S7(2)(b)(ii) The withholding of the information is necessary to protect information where the making available of the information would be likely unreasonably to prejudice the commercial position of the person who supplied or who is the subject of the information. S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied. S7(2)(b)(i) The withholding of the information is necessary to protect information where the making available of the information would disclose a trade secret. S7(2)(a) The withholding of the information is necessary to protect the privacy of natural persons, including that of a deceased person.	.
C2 Audit Arrangements for the year ending 30 June 2026	S7(2)(i) The withholding of the information is necessary to enable the local authority to carry on, without prejudice or disadvantage, negotiations (including commercial and industrial negotiations).	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C3 Treasury Risk Management Compliance Report	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C4 Dunedin City Holdings Ltd - Update on Audit and Risk Activity	S7(2)(b)(ii) The withholding of the information is necessary to protect information where the making available of the information would be likely unreasonably to prejudice the commercial position of the person who supplied or who is the subject of the information.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C5 Internal Audit: Workplan Update	S7(2)(b)(i) The withholding of the information is necessary to protect information where the making available of the information would disclose a trade secret. S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied. S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C6 Internal Audit Services Contract - Recommendation Report	S7(2)(b)(ii) The withholding of the information is necessary to protect information where the making available of the information would be likely unreasonably to prejudice the commercial position of the person who supplied or who is the subject of the information.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C7 Internal Audit: Recommendations and Actions Update	S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C8 Risk Assurance: Financial Management	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.	The information in this report is commercially sensitive..
C9 Risk Assurance: Integrity	S7(2)(a) The withholding of the information is necessary to protect the privacy of natural persons, including that of a deceased person.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.	The information in this report is commercially sensitive.
C10 Risk Assurance: Cybersecurity	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C11 Risk Management Update	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C12 Government Reforms Update - March 2026	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C13 Legal Compliance Survey 2024/25 - Corrective Actions Progress	S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C14 Legal Matters	S7(2)(g) The withholding of the information is necessary to maintain legal professional privilege.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C15 Investigation Register - March 2026	S7(2)(a) The withholding of the information is necessary to protect the privacy of natural persons, including that of a deceased person. S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.

This resolution is made in reliance on Section 48(1)(a) of the Local Government Official Information and Meetings Act 1987, and the particular interest or interests protected by Section 6 or Section 7 of that Act, or Section 6 or Section 7 or Section 9 of the Official Information Act 1982, as the case may require, which would be prejudiced by the holding of the whole or the relevant part of the proceedings of the meeting in public are as shown above after each item.

Motion carried (ARAAC/2026/011)

The meeting adjourned at 10.54 am and reconvened in non-public at 11.09 am.

The meeting concluded at 3.04 pm.

..............................................

CHAIRPERSON

Audit, Risk and Assurance Committee

30 June 2026

Part A Reports

Workplan and General Matters Update Report - June 2026

Department: Finance and Civic

EXECUTIVE SUMMARY

1 This report provides the workplan and updates on the progress of various matters for the Audit, Risk and Assurance Committee.

RECOMMENDATIONS

That the Committee:

a) Notes the Workplan and General Matters Update Report – June 2026

b) Notes the Audit, Risk and Assurance Committee Workplan (Attachment A)

DISCUSSION

Audit, Risk and Assurance Committee Workplan

2 This report provides a copy of the Audit, Risk and Assurance Committee (ARAC) Workplan June 2026 which has been aligned to work programme scheduling and decision making (Attachment A).

3 Please note that the items without ticks shown have not been scheduled for action.

2026/27 Annual Plan

4 Work on the development of the Annual Plan 2026/27 is coming to an end.

5 Community consultation ran from 30 March to 29 April 2026. Those who submitted as part of the consultation had an opportunity to speak directly to elected members at the Council meeting on 13 May 2026. Councillors heard directly from submitters on 30 submissions.

6 Council considered community feedback and deliberated on the draft Annual Plan at Council budget update meetings on 27 and 29 May, and 4 June 2026.

7 At the time of writing this report, staff are finalising the Annual Plan document, which is scheduled to be formally adopted by Council at its 25 June 2026 meeting. This is within the legislative deadline of 30 June 2026, as required by the Local Government Act 2002.

8 The Annual Plan 2026/27 will be made publicly available on the DCC website within one month of adoption.

30 June 2026 Annual Report

9 Planning and preparation is well-advanced for the year ending 30 June 2026 Annual Report. As previously noted, recommended improvements to the development of future Annual Reports are as follows:

a) 3 Waters valuations are completed as at 31 March. Over the past four years, there have been recurring issues with valuations, and completing them three months earlier than usual provides a buffer to address any potential challenges.

b) More detail is included on the performance of each Council-Controlled Organisation (CCO). While the primary focus of the Annual Report is the performance of the DCC, more supporting information on CCOs would provide helpful context to a reader.

c) The timeline for the development of the Annual Report is incrementally brought forward each year, in consultation with Dunedin City Holdings Limited and Audit NZ. This will ensure that the 2027/28 Annual Report can be adopted ahead of the next local government elections.

10 Council’s 3 Waters assets are in the process of being valued as at 31 March 2026. A competitive tender process for the valuation work was completed, and Pattle Delamore Partners (PDP) were appointed as the new valuers. Work commenced early April and has been progressing in line with staff expectations. The DCC waters valuation team is in the final stages of reviewing the final draft report and providing feedback to PDP before the final report is issued. Currently, the valuation is on track to be completed ahead of Audit NZ commencing their review on the 21 July 2026.

11 This year DCC has 3 valuations occurring which are 3 Waters, Roading and Investment Property. As commented on above, the 3 Water valuation has already commenced with a date of 31 March. The two other valuations will commence on 30 June 2026. It is also our understanding that Audit NZ plan to engage a peer reviewer for the Investment Property valuation this year.

12 Staff met with Audit New Zealand in mid-March to discuss an audit plan for the 2025/26 Annual Report. In line with recommended improvements above, the adoption of the Annual Report has been moved a week earlier than in 2025, and will be adopted at an additional Council meeting on 23 October 2026.

13 Staff will provide an update on valuations and key audit focus areas to the 10 September 2026 ARAC meeting. An ARAC meeting is scheduled on 21 October 2026 to review the Annual Report prior to adoption by Council on 23 October 2026.

10 Year Plan 2027-37

14 Work on the development of the 10 year plan 2027-37 (the 10 year plan) continues.

15 A Finance and Performance Committee workshop was held on 15 June 2026, and started a discussion with Councillors on the development of the Financial Strategy and Infrastructure Strategy for the 10 year plan. Some of the planned work that was discussed included:

a) A review of fees and charges alongside the review of the Revenue and Financial Policy.

b) Categorising operational expenditure as either controllable or uncontrollable, and then identifying ‘controllable’ operational savings, with a current aim of $10 million.

c) Assessing the impact on Levels of Service from potential operational savings.

d) Developing options on ways to reduce new and historical debt.

e) Categorising non 3 waters capital expenditure as either discretionary or non-discretionary, and then presenting all discretionary capital expenditure to Council in options reports, with only agreed projects being included in the draft budget.

f) Developing prioritisation criteria for ‘discretionary’ capital expenditure.

16 Another workshop with Councillors is being considered for July 2026, though is not confirmed, in order to get further direction and to discuss more specific Councillor suggestions relating to the draft 10 year plan budgets. Further workshops will be scheduled with Councillors to discuss a range of topics that pertain to the 10 year plan.

17 A project plan has been developed, with a high level summary expected to be presented to Council in July 2026.

18 Budget options reports will be incrementally presented to Councillors, with decisions built into the draft 10 year plan budgets, and then presented as a whole at the Council meeting on 7-10 December 2026.

19 Implementation of a budgeting system is underway, with implementation estimated within ten weeks. Having this system in place will improve the budgeting process for the upcoming 10 year plan as it will allow the finance team to move away from spreadsheet based budgeting.

Water Services Strategy

20 The Water Services Strategy is being developed in parallel with Council’s 10 Year Plan 2027-37. It is legislatively required to be adopted by Council by 30 June 2027.

21 Under the Local Government (Water Services) Act 2025 (LGWSA), the Council is required to adopt a water services strategy every three years.

22 Previously, water services information was included as part of a council’s Long Term Plan (i.e., a 10 year plan or 9 year plan), where relevant. However, from 1 July 2027, detailed water services information must not be included in the 10 year plan but must instead be covered in a Water Services Strategy document.

Waters Services Delivery Plan (Local Water Done Well)

23 The Water Services Delivery Plan - Implementation Plan has progressed with several tasks completed or underway.

24 The project control group is meeting monthly and includes two members from ELT (CFO, GM 3 Waters, Property and Urban Development), the PCG will be responsible for ensuring the programme of work is on track. The largest impacts from this work will be on the 3 Waters and Finance departments.

25 First reporting to DIA on implementation plan progress was sent at the end of April and covered the period from January to March 2025 (Attachment C). The next quarterly report is due at the end of July covering the period 1 April to 30 June.

26 Key dates: April 2026-June 2027 establishment phase; by 1 July 2027 in-house business unit to be fully operational; 30 June 2028 demonstrate long-term financial sustainability.

OPTIONS

27 This is a noting report so there are no options.

Signatories

Author:

Hayley Knight - Assurance Manager

Janet Fraser - Corporate Planner

Lauren Mead - Senior Financial Accountant

Authoriser:

Carolyn Allan - Chief Financial Officer

Attachments

	Title	Page
⇩a	ARAC Workplan - June 2026	29
⇩b	Water Services Delivery Plan Implementation - DIA Quarterly Monitoring Report 1 Jan - 31 March 2026	31

SUMMARY OF CONSIDERATIONS

Fit with purpose of Local Government

This report provides an update on various audit, risk and assurance related matters.

Fit with strategic framework

	Contributes	Detracts	Not applicable
Social Wellbeing Strategy	✔	☐	☐
Economic Development Strategy	✔	☐	☐
Environment Strategy	✔	☐	☐
Arts and Culture Strategy	✔	☐	☐
3 Waters Strategy	✔	☐	☐
Future Development Strategy	✔	☐	☐
Integrated Transport Strategy	✔	☐	☐
Parks and Recreation Strategy	✔	☐	☐
Other strategic projects/policies/plans	☐	☐	✔

This report provides an update on the progress made by Council to deliver upon the activities identified by the Audit, Risk and Assurance Committee, which is a regulatory function and considered good quality and cost effective.

Māori Impact Statement

There are no known impacts for mana whenua.

Sustainability

There are no implications for sustainability.

Zero carbon

There are no implications for zero carbon.

LTP/Annual Plan / Financial Strategy /Infrastructure Strategy

There are no implications.

Financial considerations

No financial implications have been identified.

Significance

This report is rated low under the Council’s Significance and Engagement Policy.

Engagement – external

No external engagement has been undertaken.

Engagement - internal

Activities noted herein include cross Council engagement and collaboration.

Risks: Legal / Health and Safety etc.

No risks have been identified.

Conflict of Interest

There are no conflicts of interest identified.

Community Boards

There have been no implications for Community Boards identified.

Audit, Risk and Assurance Committee

30 June 2026

Waipori Fund - Quarter Ending 31 March 2026

Department: Finance

EXECUTIVE SUMMARY

1 The attached report from Dunedin City Treasury Limited provides information on the results of the Waipori Fund for the quarter ended 31 March 2026.

RECOMMENDATIONS

That the Committee:

a) Notes the report from Dunedin City Treasury Limited on the Waipori Fund for the quarter ended 31 March 2026.

DISCUSSION

2 The Waipori Fund Statement of Investment Policy and Objectives (SIPO) requires quarterly reporting on the performance and financial position of the fund.

3 Dunedin City Treasury Limited has provided the Waipori Fund report for the March 2026 quarter. The report is provided as Attachment A.

OPTIONS

4 As this is a noting report, no options are provided.

NEXT STEPS

5 Quarterly reporting on the performance and financial position of the fund will be provided to future meetings of either the Finance and Performance Committee or Council. In addition, they are provided to the Audit, Risk and Assurance Committee.

Signatories

Authoriser:

Carolyn Allan - Chief Financial Officer

Attachments

	Title	Page
⇩a	Waipori Fund March 2026 Quarter	90

SUMMARY OF CONSIDERATIONS

Fit with purpose of Local Government

This decision enables democratic local decision making and action by, and on behalf of, communities.

Fit with strategic framework

	Contributes	Detracts	Not applicable
Social Wellbeing Strategy	☐	☐	✔
Economic Development Strategy	☐	☐	✔
Environment Strategy	☐	☐	✔
Arts and Culture Strategy	☐	☐	✔
3 Waters Strategy	☐	☐	✔
Future Development Strategy	☐	☐	✔
Integrated Transport Strategy	☐	☐	✔
Parks and Recreation Strategy	☐	☐	✔
Other strategic projects/policies/plans	☐	☐	✔

Reporting on the performance of the Waipori Fund does not contribute directly to the Strategic Framework.

Māori Impact Statement

Investment returns from the Waipori Fund impact on the level of rates payable and therefore impact across all Dunedin communities including Māori.

Sustainability

There are no impacts for sustainability.

Zero carbon

There are no impacts for zero carbon.

LTP/Annual Plan / Financial Strategy /Infrastructure Strategy

There are no implications for LTP / Annual Plan / Financial Strategy / Infrastructure Strategy.

Financial considerations

Financial considerations are presented in the Waipori Fund report for the March 2026 quarter.

Significance

This report is considered to be of low significance in terms of the Council’s Significance and Engagement Policy.

Engagement – external

There has been no external engagement.

Engagement - internal

There has been no internal engagement.

Risks: Legal / Health and Safety etc.

There are no identified risks.

Conflict of Interest

There are no known conflicts of interest.

Community Boards

There are no implications for Community Boards.

Audit, Risk and Assurance Committee

30 June 2026

DCC Policy Update Report

Department: Finance and Business Information Services

EXECUTIVE SUMMARY

1 This report provides an update on DCC policies identified in the Audit, Risk and Assurance Committee (ARAC) Workplan.

RECOMMENDATIONS

That the Committee:

a) Notes the Policy Update Report – June 2026.

b) Notes the Information Management Policy (Attachment A)

c) Approves the updated Purchase Card Policy (Attachment B).

DISCUSSION

2 The following policies are undergoing review:

a) Asset Management Policy: A working group has been set-up to review and update the Asset Management Policy including the recommendations from the Asset Management Policy Audit. This policy will be a high-level principles-based policy that will support consistency of asset management practices across the DCC. This policy is expected to be presented to ARAC at the December meeting.

b) Asset Disposal and Write-Off Policy: This policy is now in the final stages of review; the proposed policy and guidance are being tested against similar policies developed by other local government entities/CCO’s. This policy and the guidelines are expected to be presented to ARAC at the December meeting.

c) ICT Acceptable Use Policy: A draft “Digital Acceptable Use Policy” is under development to replace the current ICT Acceptable Use Policy. Further review is underway with Business Information Services, People and Capability, Legal, and the Privacy Officer before going through the formal approval process. A timeframe for this work has not been developed.

d) Leave Management Policy: As the government has signalled there will be updates to the legislation (Holidays Act reform) the review of this policy is on-hold until those changes have occurred. The expected review and delivery date for this policy has not been set.

e) Staff Code of Conduct: Following the organisational values refresh there has been review and development of a number of policies managed by the People and Capability team. This document is expected to be presented to ARAC at the September meeting. The Staff Code of Conduct is being updated to provide:

· A principles-based document that sets clear expectations for behaviour and decision-making.

· A shift away from a primary focus on unacceptable behaviour to a strengths-based approach grounded in the values of commitment, accountability, wellbeing, and collaboration.

· Greater emphasis on the positive behaviours that support a respectful, inclusive, and high-performing workplace.

f) Protected Disclosures (Whistleblower) Policy: This policy has had some minor edits to provide contact details for those who can receive protected disclosures, that version is live on the DCC website. Further review is on-going including development of a fraud response plan for employees involved in investigations. Investigation is underway for implementing a protected disclosures hotline which will allow for anonymous reporting. This policy and the procedures are expected to be presented to ARAC at the September meeting.

g) Risk Management Policy: As recruitment is underway for a new Risk Lead, the expected review and delivery date for this policy has not been set.

h) Health, Safety and Wellbeing Policy: This policy has undergone a high-level review and the review date has been pushed back 12 months to November 2026. The current review of the policy will look at aligning to the new organisational values. The charter is also under review by the CEO and Mayor. This policy and the charter are expected to be presented to ARAC at the December meeting.

i) Treasury Risk Management Policy: This policy is reviewed every three years as a part of the 10-year plan process. Forex Limited are currently providing an external review of the policy. This policy will be brought to ARAC at the September meeting to allow for feedback before it goes to Council for approval.

3 After the review process, updated copies of DCC policies will be provided to ARAC for feedback or approval.

Information Management Policy

4 Attachment A provides a copy of the Information Management Policy to ARAC for noting. The policy was approved by the Executive Leadership Team in December 2025.

5 An internal audit on Records Management recommended that the DCC develop a new policy for information management that covered the requirements of the Information and Records Management Standard 2016.

6 The attached Information Management Policy has been developed by Business Information Services and reviewed by the Assurance Manager and Legal Services.

7 The Information Management Policy has been developed to align with:

a) Public Records Act 2005

b) Privacy Act 2020

c) Local Government Official Information and Meetings Act 1987

d) Information and Records Management Standard (Archives New Zealand 2016)

8 Information management policies from other councils were examined to support consistency in the wording and approach for information management practices.

9 This policy has been written at a high level, with the Information Management Operational Standards, Guidelines and Resources undergoing development.

10 The Information Standards are under development to work alongside the policy, and cover five core standards of:

a) Information Management Lifecycle: A high-level end-to-end model for how information is created, stored, used, maintained, and eventually disposed of in a compliance with legal and business requirements.

b) Information Access, Privacy and Security: Ensures information is accessible while protecting sensitive information, meeting privacy obligations, and enabling open-by-default transparency while adopting a digital-first approach.

c) Information Storage and Approved Repositories: Specifies approved locations for storing information. Ensures reliability, accessibility, and legal compliance while prevention use of non-compliant locations.

d) Information Asset Register: Documents the organisation’s information assets, ownership, sensitivity, risks, and dependencies – reducing duplication, improving accountability, and supporting risk and retention decisions.

e) Metadata and Classification Standard: Ensures consistent metadata and classification so information is searchable, trustworthy, retainable, migratable, and secure.

11 These standards will provide a framework for departments on how to view and manage information. The standards will provide a maturity assessment for different types of information and where improvements should be made. Work is underway to have the standards used early in project work to ensure new information management processes are compliant by design.

Purchase Card Policy

12 The Purchase Card Policy is not due for review until August 2028, however, a few areas have been identified for change.

13 This report is seeking approval for the following edits to be made to the Purchase Card Policy, as outlined in Attachment B:

a) Update section 4.6 to include two identified Civil Defence roles (employed by the Otago Regional Council) as an exception role, to be authorised to hold a DCC purchase card. The purpose of this is for DCC business during a civil defence activation, and to keep the facility operational (for example, diesel for the boilers). The cards will hold a $500 value and will be increased to a $10,000 limit upon a civil defence activation involving DCC activities. This is to provide emergency funding resiliency as cards can only be issued to a specific holder, and it can be difficult to guarantee which DCC staff will be involved in an activation. This approach has been considered as being the most pragmatic.

b) Update section 4.6 to refer to the “Chair of the Audit, Risk and Assurance Committee”.

c) Update section 4.7 to have the standard limit for purchase cards of $2,000, to reduce exposure risk.

NEXT STEPS

14 Any policies that are approved will be presented to employees alongside supporting materials e.g., guidance, procedures, and FAQs.

Signatories

Author:

Hayley Knight - Assurance Manager

Graeme Riley - Chief Information Officer

Authoriser:

Carolyn Allan - Chief Financial Officer

Paul Henderson - General Manager Corporate and Regulatory Services

Attachments

	Title	Page
⇩a	Information Management Policy	101
⇩b	Purchase Card Policy - June 2026 draft track changes	105

SUMMARY OF CONSIDERATIONS

Fit with purpose of Local Government

This report provides an update on Council Policy documents as identified by the Audit Risk and Assurance Committee Workplan, which is a regulatory function considered good quality and cost effective.

Fit with strategic framework

	Contributes	Detracts	Not applicable
Social Wellbeing Strategy	✔	☐	☐
Economic Development Strategy	✔	☐	☐
Environment Strategy	✔	☐	☐
Arts and Culture Strategy	✔	☐	☐
3 Waters Strategy	✔	☐	☐
Spatial Plan	✔	☐	☐
Integrated Transport Strategy	✔	☐	☐
Parks and Recreation Strategy	✔	☐	☐
Other strategic projects/policies/plans	✔	☐	☐

The Audit Risk and Assurance Committee monitors and provides assurance for the effective review and management of core Council Policies – thereby supporting business controls and delivery, governance and the realisation of strategic objectives.

Māori Impact Statement

There are no know impacts for mana whenua.

Sustainability

There are no implications for sustainability.

LTP/Annual Plan / Financial Strategy /Infrastructure Strategy

There are no known implications.

Financial considerations

No financial implications have been identified.

Significance

This report is considered low in terms of the Council’s Significance and Engagement Policy.

Engagement – external

No external engagement required for the Information Management Policy as it is an internal operating policy.

Civil Defence staff were engaged to understand the needs for activations involving DCC activities.

Engagement - internal

For the development of the Information Management Policy, Business Information Services, in house Legal, Assurance Manager have been engaged.

For the update of the Purchase Card Policy the Finance team and Civil Defence team have been engaged.

Risks: Legal / Health and Safety etc.

A failure to maintain effective and appropriate Policy framework across core Council functions exposes the DCC to a range of operational and strategic risks, including financial, business and service performance, community, business and sector confidence, as well as potential fraud and litigation.

Conflict of Interest

No conflicts of interest have been identified.

Community Boards

There are no known implications for the Community Boards.

Audit, Risk and Assurance Committee

30 June 2026

Resolution to Exclude the Public

That the Audit, Risk and Assurance Committee:

Pursuant to the provisions of the Local Government Official Information and Meetings Act 1987, exclude the public from the following part of the proceedings of this meeting namely:

General subject of the matter to be considered	Reasons for passing this resolution in relation to each matter	Ground(s) under section 48(1) for the passing of this resolution	Reason for Confidentiality
C1 Confirmation of the Confidential Minutes of Audit, Risk and Assurance Committee meeting - 27 March 2026 - Public Excluded	S7(2)(i) The withholding of the information is necessary to enable the local authority to carry on, without prejudice or disadvantage, negotiations (including commercial and industrial negotiations). S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities. S7(2)(b)(ii) The withholding of the information is necessary to protect information where the making available of the information would be likely unreasonably to prejudice the commercial position of the person who supplied or who is the subject of the information. S7(2)(b)(i) The withholding of the information is necessary to protect information where the making available of the information would disclose a trade secret. S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied. S7(2)(a) The withholding of the information is necessary to protect the privacy of natural persons, including that of a deceased person. S7(2)(g) The withholding of the information is necessary to maintain legal professional privilege.	.
C2 Treasury Risk Management Compliance Report	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C3 Dunedin City Holdings Ltd - Update on Audit and Risk Activity	S7(2)(b)(ii) The withholding of the information is necessary to protect information where the making available of the information would be likely unreasonably to prejudice the commercial position of the person who supplied or who is the subject of the information.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C4 Risk Management Update and Deep Dive	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C5 Risk Assurance: Cybersecurity Update	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C6 Underwriting Policy	S7(2)(g) The withholding of the information is necessary to maintain legal professional privilege.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C7 Assurance Dashboard	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.	The information in this report is commercially sensitive..
C8 Insurance Update Report - June 2026	S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C9 Internal Audit: Workplan Update	S7(2)(b)(i) The withholding of the information is necessary to protect information where the making available of the information would disclose a trade secret. S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied. S7(2)(h) The withholding of the information is necessary to enable the local authority to carry out, without prejudice or disadvantage, commercial activities.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C10 Audit New Zealand Update	S7(2)(i) The withholding of the information is necessary to enable the local authority to carry on, without prejudice or disadvantage, negotiations (including commercial and industrial negotiations).	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C11 External Audit: Recommendations and Actions Update	S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C12 Legal Matters	S7(2)(g) The withholding of the information is necessary to maintain legal professional privilege.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.
C13 Protected Disclosure and Investigation Register - June 2026	S7(2)(a) The withholding of the information is necessary to protect the privacy of natural persons, including that of a deceased person. S7(2)(c)(i) The withholding of the information is necessary to protect information which is subject to an obligation of confidence or which any person has been or could be compelled to provide under the authority of any enactment, where the making available of the information would be likely to prejudice the supply of similar information or information from the same source and it is in the public interest that such information should continue to be supplied.	S48(1)(a) The public conduct of the part of the meeting would be likely to result in the disclosure of information for which good reason for withholding exists under section 7.

	Title	Page
⇩a	Financial Update	59
⇩b	Statement of Financial Performance	74
⇩c	Statement of Financial Position	75
⇩d	Statement of Cashflows	76
⇩e	Capital Expenditure Summary	77
⇩f	Capital Expenditure Detailed	79
⇩g	Statement of Operating Variances	85
⇩h	Debt Graph	86

	Title	Page
A ⇩	Minutes of Audit, Risk and Assurance Committee meeting held on 27 March 2026	12

Author:	Jane Pearce - Health and Safety Manager
Authoriser:	David Ward - General Manager, 3 Waters, Property and Urban Development