Gosport Borough Council
Councillors:
27
Wards:
14
Committees:
10
Meetings (2026):
59
Meetings (2025):
50
Meeting
Standards & Audit Sub Board - Gosport
Meeting Times
Scheduled Time
Start:
Thursday, 26th March 2026
6:00 PM
Thursday, 26th March 2026
6:00 PM
End:
Thursday, 26th March 2026
10:00 PM
Thursday, 26th March 2026
10:00 PM
Meeting Status
Status:
Confirmed
Confirmed
Date:
26 Mar 2026
26 Mar 2026
Location:
Council Chamber
Council Chamber
Meeting Attendees
Committee Member
Councillor Kirsty Cox
Present, as expected
Committee Member
Deputy Chair
Councillor Jamie Hutchison
Present, as expected
Chairman
Councillor Robert Hylands
Present, as expected
Committee Member
Councillor Philip Raffaelli CB FRCP
Present, as substitute
Agenda
1
Apologies for Non Attendance
Minutes
Apologies for non-attendance were received from Councillor Philpott who was substituted by Councillor Raffaelli.
2
Declarations of Interest
Minutes
There were none
3
Minutes of the Meeting of the Sub Board held on 22 January 2026
Attachments:
- Document Minutes Public Pack, 22/01/2026 Standards & Audit Sub Board 18 Mar 2026
Minutes
RESOLVED: That the minutes of the meeting held on 22 January 2026 were signed as a true and correct record.
In answer to a Members question regarding the People’s Park officers advised that a report would be taken to P&O Board once updated costs from contractors had been received.
In answer to a Members question regarding the People’s Park officers advised that a report would be taken to P&O Board once updated costs from contractors had been received.
4
Deputations- Standing Order 3.4
(NOTE: The Board is required to receive a deputation(s) on a matter which is before the meeting of the Board provided that notice of the intended deputation and its object shall have been received by the Borough Solicitor by 12 noon on Tuesday 24 March. The total time for deputations in favour and against a proposal shall not exceed 10 minutes)
Minutes
There were none
5
Public Questions - Standing Order 3.5
(NOTE: The Board is required to allow a total of 15 minutes for questions from Members of the public on matters within the terms of reference of the Board provided that notice of such Question(s) shall have been submitted to the Borough Solicitor by 12 noon on Tuesday 24 March)
Minutes
There were none
6
Data Breach Report Jan 1-Dec 31 2025
The purpose of this report is to inform the Standards & Audit Sub-Board of data breaches that occurred at Gosport Borough Council between January 1st 2025 and December 31st 2025, and to provide an update on the remedial actions taken to prevent future incidents.
Attachments:
- Document SA sub board report V2 18 Mar 2026
Minutes
Consideration was given to a report by the Data Protection Officer (DPO) informing the Sub Board of data breaches that occurred between January 1st 2025 and December 31st 2025, and updating on the remedial actions taken to prevent future incidents.
The DPO introduced his report by advising that the results for GBC were consistent with authorities of similar size. The breaches that occurred were low impact, contained quickly with none needing to be reported to the ICO. In line with other authorities human error accounted for all of the breaches.
Members were advised that some of the breaches had led to improvements in policy and procedures and a new data protection Sharepoint site had resulted in better reporting of breaches.
In answer to a Member’s question, the DPO advised that he felt the increase in breaches against the same period in the previous year was mainly due to an improvement in recording. He explained that he had been holding in person training, which had received excellent feedback, and created posters explaining how to report breaches that had already had a positive impact with only 2 breaches reported so far in 2026.
Members were advised that housing run a number of systems, none of which can create email direct from the data held, so clients email addresses have to be entered manually. With many residents sharing surnames the system was open to mistakes. The DPO explained that over a test period of 180 days, housing had received on average 2,126 emails per day.
In answer to a Members question asking if it was possible to apply any extra labels or rules to emails that would reduce the risks associated with breaches due to incorrect information being sent by email, officers advised that there are tools in the new Microsoft licensing that could be investigated when this is implemented.
Members wished to thank the DPO for the training he has delivered and to recognize that it seems to have had an impact.
RESOLVED: That the Standards and Audit Sub Board:
1. Noted that there were twenty data breach incidents that occurred during the period January 1st 2025 and December 31st 2025, as referenced in appendix A. This is an increase in incidents from the previous year (14).
2. Noted that no incidents required notification to the Information Commissioners Office (ICO)
The DPO introduced his report by advising that the results for GBC were consistent with authorities of similar size. The breaches that occurred were low impact, contained quickly with none needing to be reported to the ICO. In line with other authorities human error accounted for all of the breaches.
Members were advised that some of the breaches had led to improvements in policy and procedures and a new data protection Sharepoint site had resulted in better reporting of breaches.
In answer to a Member’s question, the DPO advised that he felt the increase in breaches against the same period in the previous year was mainly due to an improvement in recording. He explained that he had been holding in person training, which had received excellent feedback, and created posters explaining how to report breaches that had already had a positive impact with only 2 breaches reported so far in 2026.
Members were advised that housing run a number of systems, none of which can create email direct from the data held, so clients email addresses have to be entered manually. With many residents sharing surnames the system was open to mistakes. The DPO explained that over a test period of 180 days, housing had received on average 2,126 emails per day.
In answer to a Members question asking if it was possible to apply any extra labels or rules to emails that would reduce the risks associated with breaches due to incorrect information being sent by email, officers advised that there are tools in the new Microsoft licensing that could be investigated when this is implemented.
Members wished to thank the DPO for the training he has delivered and to recognize that it seems to have had an impact.
RESOLVED: That the Standards and Audit Sub Board:
1. Noted that there were twenty data breach incidents that occurred during the period January 1st 2025 and December 31st 2025, as referenced in appendix A. This is an increase in incidents from the previous year (14).
2. Noted that no incidents required notification to the Information Commissioners Office (ICO)
7
Internal Audit Progress Report 1 April 2025 to 19 February 2026
To update the sub board on the progress of the Audit Plan 2025/26, agreed (March 2025), to the Members with responsibility for governance.
Attachments:
- Document Audit Progress Covering Report March 2026 18 Mar 2026
- Document Appendix A Internal Audit Progress Report GBC March 2026 18 Mar 2026
Minutes
Consideration was given to a report by the Chief Internal Auditor (CIA) updating the Sub Board on the progress of the Audit Plan 2025/26 agreed March 2025 to the Members with responsibility for governance.
The CIA introduced his report by updating the figures to show that 25 audits have been issued and I is in draft. The Waste Contract audit has been moved to the 2026-2027 plan to reflect the new requirements.
It was agreed to invite the Head of Housing to address the next meeting and advise on progress of audit actions.
Members were advised that the team was on course to complete the plan by the end of the period 2025/26.
RESOLVED: That the Standards and Audit Sub Board noted the progress of the Audit Plan 2025/26 from 1st April 2025 to 19th February 2026 as set out in Appendix A.
The CIA introduced his report by updating the figures to show that 25 audits have been issued and I is in draft. The Waste Contract audit has been moved to the 2026-2027 plan to reflect the new requirements.
It was agreed to invite the Head of Housing to address the next meeting and advise on progress of audit actions.
Members were advised that the team was on course to complete the plan by the end of the period 2025/26.
RESOLVED: That the Standards and Audit Sub Board noted the progress of the Audit Plan 2025/26 from 1st April 2025 to 19th February 2026 as set out in Appendix A.
8
IT Update Report
This report provides an update of work within the IT service following the retirement of the previous Head of IT and responding to the request for an update following the Internal audit opinion at the last Standards and Audit Sub-Board.
This updated report reflects progress made since the September 2025 update and is informed by the Internal Audit follow-up position update reports completed in February 2026, covering IT Helpdesk, Disaster Recovery, Hardware and Asset Management, Licence Management and Microsoft Teams governance.
This updated report reflects progress made since the September 2025 update and is informed by the Internal Audit follow-up position update reports completed in February 2026, covering IT Helpdesk, Disaster Recovery, Hardware and Asset Management, Licence Management and Microsoft Teams governance.
Attachments:
- Document Standards and Audit Committee - March 2026 - IT Update 18 Mar 2026
Minutes
Consideration was given to a report by the Head of IT providing an update of work within the IT service following the retirement of the previous Head of It and responding to the request for an update following the Internal Audit opinion at the last Standards and Audit Sub Board.
The Head of IT (HOI) introduced his report by explaining that due to the length of time since the original audits some actions have been superseded by advances in technology and some were no longer possible. The audits in the 2026-27 plan would be segmented, for which there is resource in place.
In answer to a Member’s question the HOI advisee that a bid in the budget focused on critical requirements such as desk top and laptops still on now unsupported Windows 10 creating a cyber risk. The replacement of monitors had been taken out of the plan as it was felt they were not critical. Decisions on telephony would be put on hold until discussions with other authorities had taken place.
The plan and strategy would focus on supported and secure systems and equipment, with a detailed action plan prioritizing which team/department should be actioned first. This information would be brought to the sub board once there was a clear road map of actions. The HOI would also be reporting back to CMT providing a project plan with timelines for all to have oversight.
The HOI advised that progress had been made against all audits and essential works such as a list of all assets had been created and the VPM which enabled home connection replaced.
In answer to a Member’s question, the HOI advised that although sufficient manpower was not currently in place it was built into the business case and some specialist requirement had been identified. Increasing the licenses from Microsoft would provide input from them.
Members were keen to ensure that as well as providing physical equipment, staff and members ‘expertise was increased through training and support. This may require a cultural shift to introduce tools such as co-pilot, and to consider encouraging more departments to go paperless. IT needs to be part of transformation programme leading through improved services not by cuts.
Members and officers agreed that the priority would be to ensure readiness for LGR and to keep up the dialogue with other authorities. The issues raised by the LGR environment remain a standing item on the CMT agenda.
RESOLVED: That the Sub Board:
Noted the update from the HOI including progress on specific projects, updates on staffing and skills whilst highlighting on-going challenges.
Noted the continued progress made through the IT Improvement Programme and the positive direction of travel reflected in the February 2026 Internal Audit follow-up reports.
The Head of IT (HOI) introduced his report by explaining that due to the length of time since the original audits some actions have been superseded by advances in technology and some were no longer possible. The audits in the 2026-27 plan would be segmented, for which there is resource in place.
In answer to a Member’s question the HOI advisee that a bid in the budget focused on critical requirements such as desk top and laptops still on now unsupported Windows 10 creating a cyber risk. The replacement of monitors had been taken out of the plan as it was felt they were not critical. Decisions on telephony would be put on hold until discussions with other authorities had taken place.
The plan and strategy would focus on supported and secure systems and equipment, with a detailed action plan prioritizing which team/department should be actioned first. This information would be brought to the sub board once there was a clear road map of actions. The HOI would also be reporting back to CMT providing a project plan with timelines for all to have oversight.
The HOI advised that progress had been made against all audits and essential works such as a list of all assets had been created and the VPM which enabled home connection replaced.
In answer to a Member’s question, the HOI advised that although sufficient manpower was not currently in place it was built into the business case and some specialist requirement had been identified. Increasing the licenses from Microsoft would provide input from them.
Members were keen to ensure that as well as providing physical equipment, staff and members ‘expertise was increased through training and support. This may require a cultural shift to introduce tools such as co-pilot, and to consider encouraging more departments to go paperless. IT needs to be part of transformation programme leading through improved services not by cuts.
Members and officers agreed that the priority would be to ensure readiness for LGR and to keep up the dialogue with other authorities. The issues raised by the LGR environment remain a standing item on the CMT agenda.
RESOLVED: That the Sub Board:
Noted the update from the HOI including progress on specific projects, updates on staffing and skills whilst highlighting on-going challenges.
Noted the continued progress made through the IT Improvement Programme and the positive direction of travel reflected in the February 2026 Internal Audit follow-up reports.
9
Internal Audit Plan 2026/27
This report is to present the proposed Internal Audit Plan 2026/27 to the board for approval, as set out in Appendix A
Attachments:
- Document Audit Plan 2627 Covering Report March 2026 18 Mar 2026
- Document Appendix A GBC 2026-27 Audit Plan 18 Mar 2026
Minutes
Consideration was given to a report by the Chief Internal Auditor (CIA) presenting the proposed Internal Audit Plan 2026/27 to the Sub Board for approval as set out in Appendix A
The CIA advised that the plan is drawn up following discussions with senior officers and remains flexible to reflect emerging risks.
In answer to a Member’s questions, the CIA advised that updates on budget monitoring would be brought to the next meeting, with anything identified appearing as a follow up audit. The external auditors would also be bringing work on that topic. All recognized that shared service staffing has vulnerabilities and there are sometimes issues with attendance which creates a risk covered by the Loss of Key Staff Strategic Risk.
RESOLVED: That Members approved the proposed Internal Audit Plan 2026/27
The CIA advised that the plan is drawn up following discussions with senior officers and remains flexible to reflect emerging risks.
In answer to a Member’s questions, the CIA advised that updates on budget monitoring would be brought to the next meeting, with anything identified appearing as a follow up audit. The external auditors would also be bringing work on that topic. All recognized that shared service staffing has vulnerabilities and there are sometimes issues with attendance which creates a risk covered by the Loss of Key Staff Strategic Risk.
RESOLVED: That Members approved the proposed Internal Audit Plan 2026/27
10
Whistleblowing Policy & Statistics
To present an updated Whistleblowing Policy for approval following the annual review (March 2026).
To present members with the statistics regarding the Whistleblowing Policy and any referrals and outcomes made from 3rd March 2025 to the 19th February 2026.
To present members with the statistics regarding the Whistleblowing Policy and any referrals and outcomes made from 3rd March 2025 to the 19th February 2026.
Attachments:
- Document CtteereportSAMarch26V2 Whistleblowing (002) ps1 18 Mar 2026
- Document AppendixAGosportWhistle blowing policyreviewMarch26 18 Mar 2026
Minutes
Consideration was given to a report by the Chief Internal Auditor (CIA)
presenting an updated Whistleblowing Policy for approval following the annual review (March 2026), and to present Members with the statistics regarding the Whistleblowing Policy and any referrals and outcomes made from 3rd March 2025 to February 2026.
The CIA introduced his report by advising that there were a fair few changes to the policy to be considered. A change in the Employment Rights Act 2025 regarding sexual harassment had prompted a more thorough review of the policy.
In answer to Member’s questions the CIA advised that there was no time limit on former employees submitting a report, and this would be explained during an exit interview. The changes, once agreed would be rolled out to staff through internal communications and the online mandatory training updated to reflect changes.
Members were advised that since the last review a piece of work around raising staff awareness had taken place, and managers were being supported by HR to encourage a speak up culture. Training and comms to support managers was in place and HR hold an important role in building relationships with staff. HR are frequently made aware of concerns on an informal basis, and use the opportunity to advise of the formal process. Managers and HR keep notes and records of issues brought to their attention and can pick up patterns of behaviour.
The CIA explained that receiving an anonymous report provides protection for the reporter, but makes it hard to follow up the issue. Staff are assured that information will be kept anonymous once an investigation is started.
Members discussed whether changing the name of the policy and process to include the phrase “Raising Concerns” would make it more user friendly, and it was agreed to discuss the issue with comms to find out, through a survey, if a name change would be beneficial. The CIA felt that it was important to maintain the link to Government Guidance and as specific categories are covered by the policy he wouldn’t want to lose the legal link.
The CIA advised that the one referral mentioned in the report had been investigated and was currently being progressed by the Borough Solicitor and Monitoring Officer (BSMO). Details were kept brief to protect the whistleblower.
Members noticed that Councillors were not mentioned in the policy and the CIA agreed to discuss with the BSMO.
Members were advised that the CIA tracks reviews of policies in line with his annual reporting to Sub Board, and there was currently work being done to draw all policies into one place in the IT system, which hopefully could provide prompts to the appropriate officers.
RESOLVED: That the members of the Standards and Audit Sub Board:
i) Approved the proposed changes to the Whistleblowing Policy
ii) Authorised the Chief Internal Auditor and officers nominated by him to make future minor changes to the Policy in consultation with the Borough Treasurer and the Borough Solicitor and Monitoring Officer.
iii) Noted the Whistleblowing statistics regarding referrals and outcomes made from 3rd March 2025 to the 19th February 2026
presenting an updated Whistleblowing Policy for approval following the annual review (March 2026), and to present Members with the statistics regarding the Whistleblowing Policy and any referrals and outcomes made from 3rd March 2025 to February 2026.
The CIA introduced his report by advising that there were a fair few changes to the policy to be considered. A change in the Employment Rights Act 2025 regarding sexual harassment had prompted a more thorough review of the policy.
In answer to Member’s questions the CIA advised that there was no time limit on former employees submitting a report, and this would be explained during an exit interview. The changes, once agreed would be rolled out to staff through internal communications and the online mandatory training updated to reflect changes.
Members were advised that since the last review a piece of work around raising staff awareness had taken place, and managers were being supported by HR to encourage a speak up culture. Training and comms to support managers was in place and HR hold an important role in building relationships with staff. HR are frequently made aware of concerns on an informal basis, and use the opportunity to advise of the formal process. Managers and HR keep notes and records of issues brought to their attention and can pick up patterns of behaviour.
The CIA explained that receiving an anonymous report provides protection for the reporter, but makes it hard to follow up the issue. Staff are assured that information will be kept anonymous once an investigation is started.
Members discussed whether changing the name of the policy and process to include the phrase “Raising Concerns” would make it more user friendly, and it was agreed to discuss the issue with comms to find out, through a survey, if a name change would be beneficial. The CIA felt that it was important to maintain the link to Government Guidance and as specific categories are covered by the policy he wouldn’t want to lose the legal link.
The CIA advised that the one referral mentioned in the report had been investigated and was currently being progressed by the Borough Solicitor and Monitoring Officer (BSMO). Details were kept brief to protect the whistleblower.
Members noticed that Councillors were not mentioned in the policy and the CIA agreed to discuss with the BSMO.
Members were advised that the CIA tracks reviews of policies in line with his annual reporting to Sub Board, and there was currently work being done to draw all policies into one place in the IT system, which hopefully could provide prompts to the appropriate officers.
RESOLVED: That the members of the Standards and Audit Sub Board:
i) Approved the proposed changes to the Whistleblowing Policy
ii) Authorised the Chief Internal Auditor and officers nominated by him to make future minor changes to the Policy in consultation with the Borough Treasurer and the Borough Solicitor and Monitoring Officer.
iii) Noted the Whistleblowing statistics regarding referrals and outcomes made from 3rd March 2025 to the 19th February 2026
11
Any Other Items
Minutes
The Chairman read a prepared statement regarding the Whistleblowing Policy and Statistics item
Previous Meetings
Join the Discussion
You need to be signed in to comment.
Sign in