Annual Implementation Report for the year ended 31 March 2025
Transport for Wales Audit and Assurance Policy
Annual Implementation Report for the year ended 31 March 2025
Introduction
Transport for Wales’s Audit and Risk Committee issued its Audit and Assurance Policy for the three years ending 31 March 2025 on 13 September 2022. It produced its first and second Annual Implementation Updates in July 2023 and 2024. This is the third and final Annual Implementation Update and completes the reporting on the Audit and Assurance Policy for the three years ended 31 March 2025.
Earlier in 2025 consultation took place on the Audit and Assurance Policy for the three years ending 31 March 2028 and this was published in March 2025 and is available here.
This third and final Annual Implementation Update sets out:
- the progress on implementing the actions set out in the Audit and Assurance Policy for the year ended 31 March 2025;
- the changes recommended by the Audit and Risk Committee to the approach set out in the Audit and Assurance Policy that have been implemented;
- a commentary on how the assurance activity set out in the Audit and Assurance Policy is working in practice.
The above is set out in relation to the major headings included in the Audit and Assurance Policy for the three years ending 31 March 2025.
TfW’s approach to risk | ||
| Implementation of actions | Changes | Commentary on assurance activity in practice |
TfW’s risk and internal control framework | ||
| The integration of TfW Fibre into the group risk and internal framework has now been completed. | A large amount of work has been carried out to ensure that the company is in a position to manage the risks it will be facing when the process for implementing bus franchising and Transport for Wales’s role within that, is realised. | The second line of defence has carried out work to and provided feedback to risk owners involved in the transition to bus franchising and their recommendations have been built into the way that the systems are being designed. |
| Fraud risk | ||
The Counter Fraud strategy and policy, and revised procedures for whistleblowing and conflicts of interest approved last year have been embedded. A revised counter-fraud strategy for 2025 to 2027 was approved by the Audit and Risk Committee at its June meeting and will be approved by the Board in July 2025. The counter fraud training programme, which was designed last year has been carried out with all relevant employees. Increased communication around counter fraud and to increase the effectiveness of investigations have resulted in a more effective approach. The Code of Ethics was issued in June 2025 and its communication is well under way. | There have been no changes to the proposed approach.
| Fraud risk is built into every assignment carried out by both the second line assurance team and internal audit. The process of alerting key members of management and the Chair of the Audit and Risk Committee appears to work well. This year no such incidents were raised.
|
| Financial and non-financial reporting risk | ||
Internal control documentation of financial and non-financial reporting. The recruitment of a resource with the right skills and approach has meant that significant progress has been made during 2024/25, although the work has not been completed in the timescale originally envisaged. Non-financial reporting | This year, for the first time, all members of the Executive Leadership Team were asked to complete a questionnaire on internal control, which provided useful feedback and was informative for members of the Executive Leadership Team on their responsibilities. This will become a regular exercise.
| The work on the enhanced internal control process is still work-in-progress, there has been little opportunity to see how the assurance activity is working in practice. However, the work done to date has given comfort to the Audit and Risk Committee that, as far as the financial controls is concerned, there appears to be no material control weaknesses. This is consistent with the findings of the internal audit function. The Audit and Risk Committee is satisfied that all material non-financial information has an appropriately documented system with appropriate internal controls to ensure that it is reported accurately. Again this view is supported by the work carried out by the internal audit function. |
TfW’s internal audit function | ||
The 2024/25 programme was satisfactorily completed and in addition certain ad hoc work was carried out at the request of management, which did not impede the completion of the programme. Also, it carried it some ad hoc for the Audit and Risk Committee on material non-financial information. The detailed programme for 2025/26 has been approved and is broadly in-line with the three-year plan. An independent External Quality Assessment was carried out by a member of The Chartered institute of Internal Auditors on the internal function in March 2024 and all recommendations have been implemented, which means that the internal audit function conforms with Global Internal Audit Standards. | None.
| The Audit and Risk Committee has received many excellent reports from internal audit during the year. No individual finding or collection of findings was considered material and those reports that had an adverse conclusion were generally known to management and action was well underway by the time the report was finalised.
|
The scope of the external auditor’s work | ||
| There were no significant changes in the scope of work carried out by the external auditors for the year ended 31 March 2025. The materiality for the TfW Group, agreed with the Audit and Risk Committee was £70 million and the reporting threshold for misstatements to be reported to the Audit and Risk Committee was £3.5 million. | None. | |
The principal sources of assurance received by TfW’s Board on information used to monitor business performance | ||
Considerable work has been carried out during the year on the KPIs that are used to monitor business performance, and some have been enhanced. The Board now has a set of KPIs that it believes enables it to oversee TfW’s businesses more effectively, although they will be continually evolved to ensure that they are effective in reflecting the outcomes expected from the company’s strategies and plans. | The company publishes on its website, with a commentary, the KPI’s that are considered most relevant to its customers and stakeholders on a quarterly basis.
| The internal audit function has carried out a review of the systems and processes that are used to prepare the detailed set of KPIs used by the Board and those KPIs that are published.
|
