Access to Town Council computer

Question

Is it normal for only the Town Clerk to have access to the council's computer? Our clerk was recently off sick for quite some time and was very reluctant  to give the login details to the Chairman.

Answer 1

The information on the computer belongs to the Council, not the Clerk, so you should have arrangements in place to ensure that it can be made accessible without the involvement of the Clerk.  This would usually be a sealed envelope containing all the relevant access codes etc, held by the Chair or another designated councillor.

For a prolonged period of sickness, the Clerk should assist in providing access, if there is a valid reason for this.  For example, the council's email account(s) should be monitored at all times.

Did the Clerk offer an explanation for his or her reluctance to allow access?

Comments

Thank you for your reply. The Clerk said it was because of Data Protection. This made no sense to me as the it's the Council's data. The Clerk did eventually give me access as it was obvious she was going to be away for some time and I was able to deal with email and with the help of another councillor attend to minutes and agendas. But I realise that going forward we must have some system of access in place.

---

Some care needs to be taken with setting up a suitable solution.  Frequently used passwords should be changed on a regular basis and there should be checks that strong passwords are used.  There are online password managers that should allow regularly used passwords to be changed but still be controlled by a separate master password that can be shared with the Chairman of the Council (in a sealed envelope).

---

There have been cases where the Clerk has walked off with the computer or died and the Council lost access to everything
I’ve also been told of a case where the computer was wiped clean
So it’s not just the computer and access but also backing up the information just in case

---

Agreed.  Checks on computer backups should be part of the regular procedure checks carried out by councillors (as well as the internal auditor) alongside things like bank reconciliation.  Sadly many councils are still in amateur hour when it comes to most of this.

---

Thank you for your reply. We are only a small council so have only one password to login to the PC. I have heard about this putting the password in a sealed envelope but this could be mislaid, not updated etc, I have been considering a more up to date method - putting a second administrator account on the pc, password set by current chairman and vice chairman, password changed whenever there is a new chair or vice chair.

---

The theory behind the sealed envelope is that the Chair does not need to have access on a routine basis and should only be given access in an emergency. This protects the Chair against accusations of unauthorised access and modification of files.

---

The second admin access sounds like a reasonable solution given your size.

---

The "sealed envelope" solution is not good if there's only one key password.  Such passwords should be changed on a regular basis (e.g. at least every 30 days;  this should be forced on the user), so a physical solution such as a sealed envelope doesn't strike me as practical or very secure - especially for some larger town councils.  The organisations providing computer support should be able to come up with a better solution.

---

It is, however, as Helen has pointed out, a requirement of the Financial Regulations, so following any alternative path would require an amendment to the FR's.

---

Agreed.  But I'm not sure the NALC guidance is fit for purpose in this area - it's not kept pace with technology - or fraudulent methods.  The FR guidance also refers to BACS but ignores developments such as FasterPayments.  NALC don't seem to have put sufficient effort into the latest changes to the FR guidance.

I would hope that councils actually care what's in their FRs - instead I see Councillors who don't understand the significance of FRs and will pass anything that's put in front of them.  In these areas the FRs are merely providing an aide memoire rather than an effective policy;  Councillors should demand a policy that they understand and protects their council from financial abuse, internally and externally.

Answer 2

Check your Financial Regulations, It is 6.11 in the one I’ve just looked at.