| Askam and Ireleth Parish Council | |||||
| Risk Register 2026-2027 | |||||
| Risk ID | Topic | Risk Description | Risk Level | Mitigation | Action |
| 1 | Precept | Budget Not completed | L | Full Minute RFO to follow up | Diary review |
| 2 | Precept not Paid by Barrow BC | L | Monitor Receipt | Diary review | |
| 3 | Precept adequate | L | Review monthly | Diary review | |
| 4 | Other Income | Cash Receipts | L | Cash handling is avoided however necessary controls in place | Annual review of procedures |
| 5 | Banking | L | RFO check bank statements Monthly bank reconciliations. | Regular reviews with Chairman | |
| 6 | Grants | Claims Procedures | M | RFO as required | Diary review |
| 7 | Receipt of Grants when due | L | RFO as required | Diary review | |
| 8 | Direct Costs | Goods not supplied or of poor quality | M | Confirm orders delivery notes rejected | Diary review |
| 9 | Invoices not submitted or over stated | L | Check Invoices and perform bank reconciliations | RFO to review and action | |
| 10 | Grants & Support | Requests for payments without evidence of Council agreement | L | Submit to council, minute agreement, authorise payment | RFO to review and action |
| 11 | VAT | VAT analysis | L | All items in Cash Book | RFO to review and action |
| 12 | Charged on Sales | L | Annual review | RFO to review and action | |
| 13 | Charged on Purchases | L | All items in Cash Book | RFO to review and action | |
| 14 | Claimed within Time Limits | L | Submit return | RFO to review and action | |
| 15 | Reserves | General reserves Adequacy | L | Review at Budget meetings | RFO, 3 year plan |
| 16 | Earmarked reserves Adequacy | M | Review at Budget meetings | RFO, 3 year plan | |
| 17 | Earmarked reserves unidentified or contingency | M | Review minutes | RFO, Chairman view | |
| 18 | Assets | Loss or Damage | H | Regular Inspection, adequate Insurance and notify Asset register | Diary review |
| 19 | Risk or Damage to 3rd parties | M | Adequate Insurance | Diary review | |
| 20 | Staff | Loss of Key personnel | L | Review work load, adequate hours and have succession strategy | RFO, Chairman view |
| 21 | Maintenance | Reduced value of assets or degredation of amenities | M | Regular checks and inspections take appropriate action | Diary review |
| 22 | Legal Powers | Illegal activity or payments | H | Council to be aware of their legal powers and status | Diary review |
| 23 | Financial Records | Inadequate Records | L | RFO/Clerk to check regularly and internal audit | Diary review |
| 24 | Minutes | Accurate and legal | L | Review at following meeting | Diary review |
| 25 | Members Interests | Conflict of Interest | M | Declarations of interests to be documented minuted and any conflict addressed as appropriate within code of conduct | Diary review |
| reviewed and approved. 17th March 2026 |
This template guide covers only information we currently hold. If we do not hold some of the information listed below, we will mark it as 'not held' in the table.
| Information to be published | How the information can be obtained | Cost |
|---|---|---|
| Class 1 - Who we are and what we do
(Organisational information, structures, locations and contacts) Current information only |
Website | Free |
| List of Council members and their responsibilities as well a list of Council Committees
Details of any representation on local public bodies |
Hard Copy | £5.00 |
| Postal and email address
Contact details for Parish Clerk and Council members |
Website | Free |
| Location of main Council office and accessibility details | Website | Free |
| Staffing structure | Website | Free |
| Class 2 – What we spend and how we spend it
(Financial information about projected and actual income and expenditure, procurement, contracts and financial audit) Current and previous financial year as a minimum |
Website | Free |
| Statement of accounts and internal audit report in the format included in the Annual Return form | Website | Free |
| Finalised budget | Hard Copy | £5 |
| Precept | Hard Copy | £5 |
| Borrowing Approval letter | n/a | n/a |
| All items of expenditure above £100 | Website | Free |
| Financial Standing Orders and Regulations | Website | Free |
| Grants given and received | Website | Free |
| List of current contracts awarded and value of contract | Website | Free |
| Members' allowances and expenses | Website | Free |
| Class 3 – What our priorities are and how we are doing
(Strategies and plans, performance indicators, audits, inspections and reviews) |
Website | Free |
| Annual governance statement in format included in the Annual Return form | Website | Free |
| Parish Plan | Website | Free |
| Annual Report to Parish or Community Meeting | Website | Free |
| Quality status
Local charters drawn up in accordance with DLUHC's guidelines |
N/A | |
| Data Protection impact assessments (in full or summary format) or any other impact assessment (eg Health & Safety Impact Assessment, Equality Impact Assessments etc), as appropriate and relevant | Website | Free |
| Class 4 – How we make decisions
(Decision making processes and records of decisions) Current and previous council year as a minimum |
Website | Free |
| Timetable of meetings (Council and any committee/sub-committee meetings and parish meetings) | Website | Free |
| Agendas of meetings (as above) | Website | Free |
| Minutes of meetings (as above) –exclude material that is properly considered to be exempt from disclosure | Website | Free |
| Reports presented to council meetings –exclude material that is properly considered to be exempt from disclosure | Website | Free |
| Responses to consultation papers | Hard | £5 |
| Responses to planning applications | Hard | £5 |
| Bye-laws | N/A | |
| Class 5 – Our policies and procedures
(Current written protocols, policies and procedures for delivering our services and responsibilities) Current information only |
Website | Free |
| Policies and procedures for the conduct of Council business:
• Procedural standing orders |
Website | Free |
| Policies and procedures for the provision of services and about the employment of staff:
• Internal instructions to staff and policies relating to the delivery of services |
Website | Free |
| Records management, personal data and access to information policies
Include information security policies, records retention, destruction and archive policies, and data protection (including data sharing and CCTV usage) policies |
Website | Free |
| Class 6 – Lists and Registers
Currently maintained lists and registers only. |
Website | Free |
| Information legally required to hold in publicly available registers (in most circumstances existing access provisions will suffice) | Website | Free |
| Assets register, including details of public land and building assets | Website | Free |
| Disclosure log indicating the information provided in response to FOIA and EIR requests. These are recommended as good practice | Hard | £5 |
| Register of members' interests | Website | Free |
| Register of gifts and hospitality | Website | Free |
| Class 7 – The services we offer
(Information about the services we offer, including leaflets, guidance and newsletters produced for the public and businesses) Current information only |
||
| Allotments | N/A | |
| Burial grounds and closed churchyards | N/A | |
| Community centres and village halls | N/A | |
| Parks, playing fields and recreational facilities | Hard | £5 |
| Seating, litter bins, clocks, memorials and lighting | Hard | £5 |
| Bus shelters | N/A | |
| Markets | N/A | |
| Public conveniences | N/A | |
| Agency agreements | N/A | |
| Services for which we are entitled to recover a fee and details of those fees (eg burial fees) | N/A |
Information not itemised in the lists above
This describes how the charges have been arrived at and should be published as part of the guide.
| TYPE OF CHARGE | DESCRIPTION | BASIS OF CHARGE |
|---|---|---|
| Disbursement cost | Photocopying @ ..p per sheet (black & white) | £5 |
| Photocopying @ ..p per sheet (colour) | £5 | |
| Postage | Actual cost of Royal Mail standard 2nd class | |
| Statutory Fee | In accordance with the relevant legislation (quote the actual statute) | |
| Other |
* the actual cost incurred
The parish council recognise that the efficient management of its records is necessary to comply with its legal and regulatory obligations and to contribute to the effective overall management of the parish council.
This document provides the policy framework through which this effective management can be achieved and audited. It covers:
Scope
Responsibilities
Retention Schedule
Disposal of Records
This policy applies to all records created, received or maintained by the parish council in the course of carrying out its functions.
Records are defined as all those documents which facilitate the business carried out by the parish council and which are thereafter retained (for a set period of time) to provide evidence of its transactions or activities. These records may be created, received or maintained in hard copy or electronically. A small percentage of the parish council's records will be selected for permanent preservation as part of the council's archives and for historical research.
The parish council has a corporate responsibility to maintain its records and record management systems in accordance with the regulatory environment. The person with overall responsibility for the implementing the policy is the Clerk to the parish council, and she/he is required to manage the Council's records in such a way as to promote compliance with this police so that information will be retrieved easily, appropriately and in a timely manner.
Under the Freedom of Information Act 2000, the parish council is required to maintain a retention schedule listing the records series which it creates in the course of its business. The retention schedule lays down the length of time which the record needs to be retained and the action which should be taken when it is of no further administrative use. The Clerk is expected to manage the current record keeping systems using the retention schedule and to account of the different retention periods when creating new record keeping systems.
All documents that are no longer required for administrative reasons should be shredded and disposed of.
This retention schedule refers to record series regardless of media in which they are stored.
| Document | Minimum Retention | Reason |
|---|---|---|
| Minute Book | Indefinite | Archive |
| Annual Accocunts | Indefinite | Archive |
| Annual Return | Indefinite | Archive |
| Bank Statements | 7 years | Audit/management |
| Cheque book stubs | Last completed | Audit/management |
| Paying in books | Last completed | Audit/management |
| Quotations | 7 years | Audit |
| Paid invoices | 7 years | Audit/VAT |
| VAT records | 7 years | Audit/VAT |
| Salary Records | 7 years | Audit |
| Tax & NI records | 7 years | Audit |
| Insurance Policies | Whilst Valid | Audit |
| Certificate of Employers Liability | 40 years | Audt/legal |
| Cert of public liability | 40 years | Audit/legal |
| Asset register | Indefinite | Audit |
| Deeds, leases | Indefinite | Audit |
| Declaration of acceptance | Term of Office + 1 year | Management |
| Members register of interest | Term of Office + 1 year | Management |
| Complaints | 1 year | Management |
| General information | 3 months | Management |
| Routine correspondence & emails | 6 months | Management |
All planning applications and relevant decision notices are available on the Westmorland and Furness Council Planning Portal website. There is no requirement to retain duplicates locally with exception of larger developments which will be retained for 12 months and kept in a safe location.
1.1 The Freedom of Information Act 2000 (FOIA) and Environmental Information Regulations 2004 (EIR) place legislative requirements on all public authorities, including local councils.
The laws established the legal Right to Know; a presumption in favour of public access to information held by public authorities, subject to certain exemptions; and other measures to improve public sector transparency.
1.2 The Council is obliged to provide information:
When responding to requests, there are set procedures that the Council needs to follow.
These include:
The Act also recognises that there are valid reasons for withholding information by setting out a number of exemptions from the right to know, some of which are subject to a public interest test.
As part of a society where information rights and responsibilities are respected by all, Askam and Ireleth Parish Council will aim to move away from the need for individual freedom of information requests and complaints towards a culture of routine, proactive and substantially increased transparency on the part of the Council, by:
3.1 Members of the public have a general right of access to information held by Askam and Ireleth Parish Council, specifically:
Note: There are certain exemptions and limitations to this general right, but just because a document is marked "Confidential" does not automatically mean that it is exempt information, although it may be covered by certain exemptions. Each case will be dealt with on its merits.
3.2 Requests for information must be in writing, must give the applicant's name and return address and must describe the information requested in such a way that we are able to locate it. A written request includes an e-mail. (For environmental information, the request does not have to be in writing.)
3.3 All requests for information will be logged on a record sheet.
3.4 Receipt will be acknowledged but if it is possible to respond with the information requested, this will be done instead. If further information is required in order to locate the information requested, this will be undertaken as quickly as possible.
3.5 All correspondence, phone calls, e-mails etc., that follow the original request will be recorded.
3.6 The Council has 20 working days in which to deal with a request for information. If it is not clear what information is required, the 20-day period does not begin until clarification is received from the applicant as to exactly what is required. (For environmental information, the response period is extended to 40 working days for information that is complex and bulky.)
3.7 A charge will be made for the photocopying of information requested as follows:
3.8 Any requests for information that is not contained in the Publication Scheme will be passed to the council Clerk to deal with under the FOI Act. A certain amount of guidance on dealing with requests is held by the Clerk, but it may be necessary that further specific guidance will be required from the Information Commissioner's Office. Certain personal information is covered by the Data Protection Act.
3.9 The applicant will be kept informed at all stages of the process of supplying the information requested, particularly if it is a complex request, when guidance may have to be sought from other agencies.
3.10 If a request is refused, the refusal notice will give the reasons for refusing the request and advise the applicant as to their rights of appeal – both internally by way of a complaint and, following that, by way of an appeal to the Information Commissioner.
4.1 If the information requested cannot be supplied, the reasons for this will be communicated to the applicant immediately. The applicant has the right of appeal against the refusal, initially to the Council, but ultimately to the Information Commissioner.
4.2 Any initial appeal will be made to the Council, it will be dealt with by elected members, in accordance with the Council's Complaints Procedure. If the original decision not to supply the information is upheld by the Council, but is still not accepted by the applicant, then the applicant is able to appeal to the Information Commissioner.
4.3 Reasons for refusing information must be in accordance with the respective provisions of the legislation, including consideration of the public interest test where this applies.
This policy will be reviewed every year (or earlier if required by changes to legislation or additional documentation) and amended as necessary based on good practice or evidence taken forward.
Policy first adopted by Askam and Ireleth Parish Council
Agreed Minute reference.
Reviewed March
Next Review 17th February 2026
Clerk – Janice Cumming
Some of the indicators to be used by the Council to identify whether a request for information is vexatious (ICO Guidance – 'Dealing with Vexatious Requests').
The tone or language of the requester's correspondence goes beyond the level of criticism that a public authority or its employees should reasonably expect to receive.
The effort required to meet the request will be so grossly oppressive in terms of the strain on time and resources, that the authority cannot reasonably be expected to comply, no matter how legitimate the subject matter or valid the intentions of the requester.
For whatever reason, the requester is targeting their correspondence towards a particular employee or office holder against whom they have some personal enmity.
The requester is attempting to reopen an issue which has already been comprehensively addressed by the public authority, or otherwise subjected to some form of independent scrutiny.
The request makes completely unsubstantiated accusations against the public authority or specific employees. Intransigence
The requester takes an unreasonably entrenched position, rejecting attempts to assist and advise out of hand and shows no willingness to engage with the authority.
The requester submits frequent correspondence about the same issue or sends in new requests before the public authority has had an opportunity to address their earlier enquiries.
The requester has explicitly stated that it is their intention to cause disruption to the public authority or is a member of a campaign group whose stated aim is to disrupt the authority.
The request appears to be part of a completely random approach, lacks any clear focus, or seems to have been solely designed for the purpose of 'fishing' for information without any idea of what might be revealed. Disproportionate effort
The matter being pursued by the requester is relatively trivial and the authority would have to expend a disproportionate amount of resources in order to meet their request.
The requester is abusing their rights of access to information by using the legislation as a means to vent their anger at a particular decision, or to harass and annoy the authority, for example, by requesting information which the authority knows them to possess already.
The issue at hand individually affects the requester and has already been conclusively resolved by the authority or subjected to some form of independent investigation. Frivolous requests
The subject matter is inane or extremely trivial and the request appears to lack any serious purpose. The request is made for the sole purpose of amusement.
The council is committed to being transparent about how it collects and uses the personal data of staff, and to meeting our data protection obligations. This policy sets out the council's commitment to data protection, and your rights and obligations in relation to personal data in line with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).
This policy applies to the personal data of current and former job applicants, employees, workers, contractors, and former employees, referred to as HR-related personal data. This policy does not apply to the personal data relating to members of the public or other personal data processed for council business.
The council has appointed Michael Cumming as the person with responsibility for data protection compliance within the council. Questions about this policy, or requests for further information, should be directed to them.
"Personal data" is any information that relates to a living person who can be identified from that data (a 'data subject') on its own, or when taken together with other information. It includes both automated personal data and manual filing systems where personal data are accessible according to specific criteria. It does not include anonymised data.
"Processing" is any use that is made of data, including collecting, recording, organising, consulting, storing, amending, disclosing or destroying it.
"Special categories of personal data" means information about an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation and genetic or biometric data as well as criminal convictions and offences.
"Criminal records data" means information about an individual's criminal convictions and offences, and information relating to criminal allegations and proceedings.
The council processes HR-related personal data in accordance with the following data protection principles the council:
The council will tell you of the personal data it processes, the reasons for processing your personal data, how we use such data, how long we retain the data, and the legal basis for processing in our privacy notices.
The council will not use your personal data for an unrelated purpose without telling you about it and the legal basis that we intend to rely on for processing it. The council will not process your personal data if it does not have a legal basis for processing.
The council keeps a record of our processing activities in respect of HR-related personal data in accordance with the requirements of the General Data Protection Regulation (GDPR).
The council will process your personal data (that is not classed as special categories of personal data) for one or more of the following reasons:
If the council processes your personal data (excluding special categories of personal data) in line with one of the above bases, it does not require your consent. Otherwise, the council is required to gain your consent to process your personal data. If the council asks for your consent to process personal data, then we will explain the reason for the request. You do not need to consent or can withdraw consent later.
The council will not use your personal data for an unrelated purpose without telling you about it and the legal basis that we intend to rely on for processing it.
Personal data gathered during the employment is held in your personnel file in hard copy and electronic format on HR and IT systems and servers. The periods for which the council holds your HR-related personal data are contained in our privacy notices to individuals.
Sometimes the council will share your personal data with contractors and agents to carry out our obligations under a contract with the individual or for our legitimate interests. We require those individuals or companies to keep your personal data confidential and secure and to protect it in accordance with Data Protection law and our policies. They are only permitted to process that data for the lawful purpose for which it has been shared and in accordance with our instructions.
The council will update HR-related personal data promptly if you advise that your information has changed or is inaccurate. You may be required to provide documentary evidence in some circumstances.
The council keeps a record of our processing activities in respect of HR-related personal data in accordance with the requirements of the General Data Protection Regulation (GDPR).
The council will only process special categories of your personal data (see above) on the following basis in accordance with legislation:
If the council processes special categories of your personal data in line with one of the above bases, it does not require your consent. In other cases, the council is required to gain your consent to process your special categories of personal data. If the council asks for your consent to process a special category of personal data, then we will explain the reason for the request. You do not have to consent or can withdraw consent later.
As a data subject, you have a number of rights in relation to your personal data.
You have the right to make a subject access request. If you make a subject access request, the council will tell you:
The council will also provide you with a copy of your personal data undergoing processing. This will normally be in electronic form if you have made a request electronically, unless you agree otherwise.
If you want additional copies, the council may charge a fee, which will be based on the administrative cost to the council of providing the additional copies.
To make a subject access request, you should send the request to the Clerk or Chair of the Council. In some cases, the council may need to ask for proof of identification before the request can be processed. The council will inform you if we need to verify your identity and the documents we require.
The council will normally respond to a request within a period of one month from the date it is received. Where the council processes large amounts of your data, this may not be possible within one month. The council will write to you within one month of receiving the original request to tell you if this is the case.
If a subject access request is manifestly unfounded or excessive, the council is not obliged to comply with it. Alternatively, the council can agree to respond but will charge a fee, which will be based on the administrative cost of responding to the request. A subject access request is likely to be manifestly unfounded or excessive where it repeats a request to which the council has already responded. If you submit a request that is unfounded or excessive, the council will notify you that this is the case and whether or not we will respond to it.
You have a number of other rights in relation to your personal data. You can require the council to:
To ask the council to take any of these steps, you should send the request to the Clerk or Chair of the Council.
The council takes the security of HR-related personal data seriously. The council has internal policies and controls in place to protect personal data against loss, accidental destruction, misuse or disclosure, and to ensure that data is not accessed, except by employees in the proper performance of their duties.
Where the council engages third parties to process personal data on our behalf, such parties do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
The council have robust measures in place to minimise and prevent data breaches from taking place. Should a breach of personal data occur the council must take notes and keep evidence of that breach.
If you are aware of a data breach you must contact the Clerk or Chair of the Council immediately and keep any evidence, you have in relation to the breach.
If the council discovers that there has been a breach of HR-related personal data that poses a risk to the rights and freedoms of yourself, we will report it to the Information Commissioner within 72 hours of discovery. The council will record all data breaches regardless of their effect.
If the breach is likely to result in a high risk to the rights and freedoms of individuals, we will tell you that there has been a breach and provide you with information about its likely consequences and the mitigation measures we have taken.
The council will not transfer HR-related personal data to countries outside the EEA.
You are responsible for helping the council keep your personal data up to date. You should let the council know if data provided to the council changes, for example if you move to a new house or change your bank details.
Everyone who works for, or on behalf of, the council has some responsibility for ensuring data is collected, stored and handled appropriately, in line with the council's policies.
You may have access to the personal data of other individuals and of members of the public in the course of your work with the council. Where this is the case, the council relies on you to help meet our data protection obligations to staff and members of the public. Individuals who have access to personal data are required:
Failing to observe these requirements may amount to a disciplinary offence, which will be dealt with under the council's disciplinary procedure. Significant or deliberate breaches of this policy, such as accessing personal data without authorisation or a legitimate reason to do so or concealing or destroying personal data as part of a subject access request, may constitute gross misconduct and could lead to dismissal without notice.
The council provides training to all individuals about their data protection responsibilities.
If your roles require you to have regular access to personal data, or you are responsible for implementing this policy or responding to subject access requests under this policy, you will receive additional training to help you understand your duties and how to comply with them.]
This is a non-contractual policy and procedure which will be reviewed from time to time.
Date of policy: September 2024
Approving committee: Full Council
Policy version reference: 2024/01
Supersedes: Data Protection Policy 2019/01
Policy effective from: 17th February 2026
Date for next review: 1st March 2027
This is an example policy that should be adjusted to reflect the procedures and policy of the council.
1. Data audit
It is important that the council's policy reflects current practice. Any policy must be based on a data audit to ensure that the council understands what data is collected, where it is stored, who has access to the data and the measures taken to ensure it is secure. For more information on implementing a Data Protection Policy, please refer to the Information Commissioner website.
2. Relevance
The council must ensure that any commitment made in their policy is relevant and up-to-date.
3. Data Protection Officer
The policy assumes that the council has a Data Protection lead rather than appointed a Data Protection Officer (DPO). The role of DPO is set out in legislation and infers specific obligations. Parish councils in England and community councils in Wales and Scotland are exempt from having to appoint a DPO (https://ico.org.uk/for-organisations/in-your-sector/local-government/local-gov-gdpr-faqs/) but are still subject to data protection legislation and must ensure sufficient resources to meet the obligations under the GDPR.
4. Data storage within the EU
You need to take account of where your data is stored including servers, on the cloud, and where your suppliers might hold their data including on their server.
Where there is text in [square brackets] this part may be updated or be deleted if not relevant. An alternative option may have been provided.
This is an example of an employment policy designed for a small council adhering to statutory minimum requirements and does not constitute legal advice. As with all policies it should be consistent with your terms and conditions of employment.
This document was commissioned by the National Association of Local Councils (NALC) in 2019 for the purpose of its member councils and county associations. Every effort has been made to ensure that the contents of this document are correct at time of publication. NALC cannot accept responsibility for errors, omissions and changes to information subsequent to publication.
This document has been written by the HR Services Partnership – a company that provides HR advice and guidance to town and parish councils. Please contact them on 01403 240 205 for information about their services.
Individuals have the right to know what data is held on them, why the data is being processed and whether it will be given to any third party. They have the right to be given this information in a hard copy. This is known as a 'subject access request or 'SAR'.
(*These documents must be dated in the past 12 months; +These documents must be dated in the past 3 months)
The following procedure shall apply when efforts to deal with a complaint informally by either the Clerk or Chair have been unsuccessful.
Website Designed by Whamos Ltd