Issue - meetings

Alistair Wickens (Technical Specialist Pensions Fund Policy and Governance) introduced this report which provided updated governance information including details of the Pension Fund’s Forward Plan, risk monitoring, policies, and training. He highlighted the risk control actions which had been added to the Risk Register following its most recent review. These related to cyber security, the risk of governance failure, and data quality. Details were included within the report. He highlighted that the Training Policy had been updated following the recent Code of Practice Review by Aon. The revised Training Policy would be presented to the Sub-Committee at its meeting in March 2025.

Councillor Gifford stated that it was positive that the risk of climate change was acknowledged within the Risk Monitoring Chart. Cyber security was also a high priority area. He highlighted commentary in the report relating to staff training on phishing with additional cyber security training provided as required.

Alistair Wickens advised that the Cyber Security Policy had been reviewed in 2024. Data asset mapping work had been undertaken with all suppliers to ensure that each link in the chain was secure. Staff training had focused on phishing as part of wider cyber security training provided to staff.

In response to the Chair, Alistair Wickens advised that the Data Management Plan referred to within the report had not identified any essential data missing from the Fund’s pension records. The scores for the data management exercise had been good, and effective processes were in place to identify and put right any incorrect data.

Rob Powell (Executive Director for Resources) emphasised that the report outlined details of risk controls which supplemented existing cyber security arrangements. Risk monitoring work had not identified any concerns about the robustness of the cyber security systems in place.

Resolved:

That the Pension Fund Investment Sub-Committee notes the content of the report.