# Health And Safety City Of York Council Internal Audit Report 2017/18

 Business Unit: Customer and Corporate Services Responsible Officers: Assistant Director, Customer Services and Digital, Assistant Director, Public Protection and Plannning Date Issued: 15/3/2018 Status: Final Reference: 19519/009 
 

## Summary And Overall Conclusions Introduction

The council has responsibilities for the health and safety of its employees, customers accessing services and people in the city. To meet these responsibilities, the council undertakes a broad and diverse range of activities. Previous audits have considered particular areas of health and safety management within the council. Following a request by the Audit & 
Governance Committee, it was agreed this audit would focus on the council's arrangements for ensuring safety at public events. Responsibility and liability for events differs depending upon who organises the event and who owns the land on which the event is held. Primary responsibility for health and safety lies with the event organiser. The vast majority of events held in York are organised by third parties, but the council and Make It York (MIY) both organise their own events. Make It York also acts on behalf of the council in respect of third party events held on council land. The council hosts and chairs the York Events Safety Advisory Group (SAG), which is made up of various bodies including the emergency services. The SAG provides advice and support to people organising events within the city; however, it has no statutory function and therefore cannot enforce compliance with its recommendations, nor require event organisers to submit their plans.1 Group members may independently exercise statutory powers afforded to them by their particular service area (e.g. Licensing may refuse to grant licences). By contrast, the council has a statutory duty to ensure safety at sports grounds as set out in the Safety of Sports Grounds Act 1975. The Sports Grounds SAG, which is also hosted and chaired by the council, carries out this function. 

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that: 

- 
the council has appropriate arrangements in place for ensuring health and safety of events it organises;  
- 
Make It York has appropriate arrangements in place for ensuring health and safety of events it organises; 
- 
suitable arrangements are in place for ensuring health and safety at events held on council land or public highways but not organised by the council or Make It York; 
- 
the council has suitable oversight of other private events organised within the city. 
 The audit included visits to Make It York and a review of arrangements at the SAG. 

## Key Findings

We found that, in general, arrangements for ensuring health and safety at events in the city are adequate. The audit primarily focused on the work of the Events SAG and MIY. A separate report is currently being drafted by North Yorkshire Police, with council involvement, regarding counter-terrorism measures at public events and in public spaces across York. An action plan was developed and training provided for the 2017 St Nicholas Fair and it is expected that other measures will be taken across the city as required. The council primarily gains assurance regarding health and safety at events through the work of the SAG and MIY. Although the SAG does not have a statutory function, ensuring that it is properly resourced and constituted is essential for it to provide effective oversight. Officers raised concerns about an impending lack of resources for the Events SAG due to staffing changes, which could impair its ability to provide timely advice and oversight of events. A similar issue was noted regarding the Sports Grounds SAG, although there is no suggestion that the council has been unable to carry out its regulatory duties. The Sports Grounds SAG was not the focus of this audit, but as the issue is similar to that of the Events SAG, it is raised here. These issues are discussed in Findings 1 and 2 below. Review of council-organised events found that health and safety responsibilities were specified and appropriate documentation completed. However, contracts with organisers did not include a requirement to submit event plans and other key documents to the SAG for scrutiny within a reasonable time frame. This is explained in Finding 3 below. The council's contract with MIY outlines health and safety responsibilities, but makes no requirement for them to refer events to the SAG, unlike in the separate service-level agreement for council land. This is further explained in Finding 4. Testing of third-party events found that key documentation had been completed and submitted to the SAG for scrutiny. However, it was noted that the contract for the event on council land did not include a clause requiring the organisers to submit plans to the SAG and comply with its advice. Discussions with the Assistant Director (Communities & Equalities) found that he currently has limited means of monitoring the servicelevel agreement with MIY. These issues are explained in Finding 5. Finally, the SAG's Terms of Reference (TOR) and meeting minutes were reviewed for adequacy. In general, the TOR was adequate, but some improvements could be made as outlined in Finding 6. The meeting minutes record events discussed and resulting actions, but do not always make clear if actions have been resolved. This is discussed further in Finding 7. 

## Overall Conclusions

The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 

 

## 1 Resourcing Of The Events Sag Issue/Control Weakness Risk

The Events SAG is facing resourcing pressures that may impact its ability to provide timely advice and oversight. 

If resources are not sufficient, this reduces the ability of the SAG to provide thorough and timely scrutiny of events. 

Officers have highlighted a lack of staff time as an issue. For example, the Licensing team is under particular pressure. The Senior Licensing Officer is the secretary to the Events SAG and the Licensing Manager is the secretary to the Sports Grounds SAG, which is a separate group with statutory powers. However, Licensing have lost two staff posts and are expecting a review of staffing requirements.  At the same time licensing duties have increased, meaning that the Senior Licensing Officer has less time to devote to SAG issues. The role of the secretary is included in the job description of the Senior Licensing Officer and the Health & Safety representative is required to sit on the SAG. However, other roles, including the role of the chair, are not included in the job descriptions of officers. The Events SAG has also recently lost its chair. The chair of the Sports Grounds SAG has taken over temporarily. Currently it is thought that the Emergency Planning Manager will take over the chair in the long-term, but this is dependent upon her workload and other responsibilities. The SAG is not included in the directorate service plans, nor does it have a dedicated budget. This lack of formal recognition increases the risk that the staffing issues outlined above will not be addressed. 

a) A review of SAG arrangements will be undertaken. This will include reviewing 
Priority 
2 
governance, roles and responsibilities, resourcing, an internal escalation process (see Finding 6), and job descriptions.  
Responsible Officer 

b) The findings of the review will determine what decisions and actions need to be taken. 

Assistant Director (Planning and Public Protection) 

Responsibilities and timescales for their implementation will then be assigned and further follow up work carried out for these actions. 

Timescale 
March 2018 
 

## 2 Resourcing Of The Sports Grounds Sag Issue/Control Weakness Risk

The Sports Grounds SAG is facing resourcing pressures that may impact its ability to carry out its statutory function. 

If resources are not sufficient, this reduces the ability of the SAG to provide thorough and timely scrutiny of events. 

The Head of Building Control currently acts as the chair, but this is not included in his job description and is done in addition to his day-to-day duties. He is planning on retiring in the next 18 months, but there is currently no plan of succession in place. The Licensing Manager is the secretary for the Sports Grounds SAG, while the Senior Licensing Officer acts as the secretary to the Events SAG. Licensing has lost two staff posts and a review of staffing requirements is expected. At the same time licensing duties have increased, putting increased pressure on the Licensing team. 

The SAG is not included in the directorate service plans, nor does it have a dedicated budget, despite having statutory obligations and powers. This lack of formal recognition increases the risk that the staffing issues noted above will not be addressed.  

A clear plan of succession for the Sports Grounds SAG chair will be developed. The review agreed as part of action 1.1 will include the Sports Grounds SAG to ensure the group is adequately resourced and recognised in service plans and job descriptions. 

## 3 Health & Safety Guidance For Council Events Issue/Control Weakness Risk

The council does not have sufficient oversight of health and safety at events it organises. 

There is no requirement for plans for council events to be submitted to the SAG. Relevant guidance on event planning and document retention is not available on the intranet. 

For two events tested, health and safety requirements were outlined in the brief or contract. However, neither included a requirement to submit event plans and other documentation to the SAG for scrutiny. The brief for the third event tested was no longer available, so it is not known if health and safety requirements were outlined, but risk assessments had been completed. Similar issues around submission of event plans to the SAG and document retention for the Grand Departy Concert were highlighted in the Tour de France Scrutiny Review Report that was presented to Executive Committee in September 2017. 

There is currently no information on event planning or the SAG on the council's intranet. The responsibility for health and safety at council-run events lies with the organising officer. Discussions with SAG officers identified that getting information in a timely fashion is problematic and hinders their work. Indeed, the SAG asked for information on one council event, but did not receive it. Further discussions identified that getting information in a timely manner is a broader issue (see Findings 4 & 5). Although there is information on the SAG available on the council's external website, officers said it does not clearly outline the application process for events, nor the SAG's expectations. It was agreed that links from the intranet and MIY's website to a single 'hub' of information on the council's website would be more useful than information replicated across three websites. 

a) Existing guidance on the council's website will be reviewed and guidance on the 
Priority 
2 
application process will be developed. This will include the SAG's expectations, timescales for the submission of documents, and a link to the Purple Guide. 
Responsible Officer 

b) The guidance will be published on the council's website and clearly signposted from the 

Assistant Director (Planning and Public Protection) 

council's intranet and Make It York's website. 

 
Timescale 
March 2018 
 

## 4 Contract Between The Council And Make It York

| Issue/Control Weakness                                                | Risk                                                        |
|-----------------------------------------------------------------------|-------------------------------------------------------------|
| The contract with MIY does not require it to refer events to the SAG. | MIY does not meet its responsibilities regarding health and |
| safety at public events held in York.                                 |                                                             |

The responsibilities of MIY are generally well defined in the contract and SLA with regard to third parties.  The SLA requires MIY to enter into an appropriate hire agreement with event organisers, binding them to carry out the event in line with the council's requirements and SAG's advice, but the same requirement is not included in the main contract in respect of events held in the city centre. Although in practice MIY does refer events to the SAG, the contract should be amended to ensure consistency between the two agreements. 

Priority 
2 

The contract between the council and MIY will be amended to include a requirement to refer events to the SAG and for event organisers to act upon its advice, bringing it in line with the SLA.  

Responsible Officer 
Assistant Director (Communities & Equalities) April 2018 

## 5 Sla Between The Council And Miy Issue/Control Weakness Risk

The contract with MIY does not require it to refer events to the SAG and monitoring of the SLA is limited. 

MIY does not meet its responsibilities regarding health and safety at public events held in York. 

The SLA between the council and MIY states that MIY will enter into an appropriate hire agreement with event organisers that binds the event organiser to carry out their event in line with the council's requirements and the advice of the SAG (section 4.e). However, testing of the hire agreement for the recent Balloon Fiesta found that there was no reference to the event organisers having to comply with the advice of the SAG. Although SAG meeting minutes and discussion with officers suggest that the event organisers were cooperative, the hire agreement should be amended to include this requirement in future. Furthermore, discussion with the Assistant Director (Communities & Equalities) found that monitoring of the SLA is limited to general discussion at client meetings due to resourcing pressures. It was agreed that seeking feedback from the SAG prior to client meetings would be an appropriate way of monitoring MIY's performance. 

a) MIYs hire agreement will be amended to include a requirement for event organisers to 
2 

submit their plans in a timely fashion to the SAG and act upon its advice. It will include conditions about when and how permission to run events will be withdrawn if requirements are not met. 

Assistant Director (Communities & Equalities) 

b) The Assistant Director (Communities & Equalities) will seek feedback from the SAG 

April 2018 

prior to routine client meetings. How this is done and what information is provided will be agreed with the SAG.  

## 6 Sag Terms Of Reference Issue/Control Weakness Risk

| The SAG's TOR has not been finalised.    |
|------------------------------------------|
| health and safety.                       |

The SAG has Terms of Reference (TOR), but these are in draft. Generally, the terms are adequate, but there are several improvements that could be made. The TOR states the SAG cannot stop an event going ahead, but discussion with officers found that the SAG will state whether or not it supports an event. This decision and how it is reached should be included in the TOR. The TOR also states that decision making will be delegated to the council via the Chair, but it is not clear what this means in practice. It also makes no provision for escalation of issues within the council should there be pressure on the SAG from within the council to support an event that in their opinion is not safe. Other issues identified include lack of version control, a process for amending the TOR, what constitutes quorum for meetings, who chairs meetings or how the chair is rotated. The TOR need revising to include the issues identified and a suitable escalation procedure should be developed to ensure that the SAG functions effectively and maintains its independence. 

The TOR will be reviewed and revised to reflect the outcome of the review of SAG arrangements (action 1.1). The points raised above will be considered, especially that of an internal escalation procedure to an appropriate officer (e.g. a Director).  

## 7 Sag Meeting Minutes Issue/Control Weakness Risk

Issues raised with event organisers are not resolved. 

It is not clear from SAG meeting minutes if issues raised with event organisers have been resolved or advice acted upon. 

SAG meeting minutes document which events have been discussed and any issues raised by group members. However, it is not always clear from the minutes whether issues raised have been resolved or event organisers have acted upon advice provided to them. When the SAG provides advice, the responsibility for ensuring adequate health and safety arrangements for events remain with the event organiser and not the SAG. However, it is suggested that a standing agenda item is included regarding updates on issues raised with, and advice provided to, event organisers. This will enable the SAG to keep a record of outcomes and gain insight into whether or not its advice is followed. 

A standing agenda item for issues raised with and advice provided to event organisers will be included in SAG meeting minutes and agendas. 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.