Agenda item

James Lake, Head of Pensions, Treasury & Statutory Accounts, introduced the item clarifying that the provision of administration services had moved from Surrey County Council to Hampshire County Council (HCC) in September 2021 following consistent underperformance and non-compliance with key performance indicators. It was highlighted that since joining HCC, performance had been consistent at 100% across all performance indicators. On the matter of the work being undertaken by HCC to clear the historic backlog of unprocessed case work from Surrey County Council, Members queried whether this could cause issues going forward. It was highlighted that HCC had set up a small dedicated team to process the backlog of case work, this work was expected to take up to two years to complete; however, the Committee were assured that it was unlikely that any issues regarding this work would come back to Hillingdon as the specific work being processed was of a low priority and not concerning those who were actively in receipt of their pensions.

The Committee were also notified of a separate exercise undertaken by HCC to test cyber security in the pensions administration system and along with Hampshire’s normal penetration testing, this found positive results in that there were no urgent, critical or high-level weaknesses identified for external, internal and application penetration testing. There were instances of low and medium level weaknesses which were being addressed by HCC and Civica; additionally, HCC’s internal vulnerability assessment scoring system showed none of the issues identified warranted adding to their vulnerability management register. The Committee asked whether HCC had considered the prospect of purchasing cyber insurance; it was confirmed that officers had asked HCC whether they had specific cyber insurance and it was noted that they had not taken up such a policy although as part of their annual general insurance assessment, they looked at the feasibility of acquiring cyber insurance. It was noted that, should HCC deem it necessary to acquire cyber insurance, they would need agreement from all of their pension administration partners. The Committee were also informed that independently of HCC, Hillingdon officers had looked at the cyber insurance market and noted the difficulties in obtaining cyber insurance as excesses were often close to or equivalent to the level of insurance cover. Members recognised that the current market for such insurance was not ideal and highlighted that there may be merit in contacting HCC and their other administration partners to establish whether there was an appetite for this type of insurance.

The Committee were also updated on two administration policies regarding nominated individuals: the Internal Disputes Resolution Policy (IDRP) and Death Grant Signatories. The stage 1 IDRP officer was currently James Lake, Head of Pensions, Treasury & Statutory Accounts, it was highlighted that the role required independence from the pension fund and it was therefore proposed that the role be attributed to the Head of Counter Fraud. With regard to the Death Grant Signatories, this had been updated to pertain to the four most senior officers in the Finance Directorate. It was also requested that a delegation be granted to allow for prospective post and job title changes although it was confirmed that the seniority level would be maintained.

RESOLVED: That the Pensions Committee:

1)    Noted the administration report;

2)    Agreed the updated Internal Disputes Resolution Policy and Death Grant signatories list;

3)    Delegated authority to officers to maintain and update the Internal Disputes Resolution Policy and Death Grant signatories; and

4)    Requested officers contact HCC and other administration partners regarding the prospect of exploring the merits of acquiring cyber insurance.