Assertion 10 (SAPPP 2025) – What it Really Means for Your Council

When the new Assertion 10 was added to the AGAR in 2024/25, many councils initially saw it as just another checkbox. But in practice, it marks one of the most significant changes in local governance for years — a formal recognition that digital systems and data are now central to how councils operate.

Why the change?

Every council, no matter how small, now handles sensitive information — personal details of staff, residents, and suppliers, as well as confidential correspondence and financial records. Much of this information sits on computers, cloud accounts, or websites, and is communicated by email.

Assertion 10 acknowledges that digital risks are real risks — and that clerks must manage them just as carefully as financial or physical ones.

“The authority has carried out an assessment of the risks in relation to the use of information technology and has put in place adequate arrangements to manage those risks.”

This means councils need to understand where their digital risks are, document the steps they’re taking to reduce them, and review those arrangements regularly.

What auditors may expect to see

During your internal or external audit, you might be asked to evidence:

  • Where your website is hosted and how updates are managed

  • Whether Councillors use secure, official email addresses

  • How your council’s data is backed up and stored

  • What happens if a system fails or information is lost

  • Whether you have a simple digital risk register or policy

A small, proactive investment in secure hosting, proper backups, and official email can save hours of explaining later — and demonstrate to your auditor that the council takes its responsibilities seriously.

How to show you’re compliant

  • Create an IT Policy (listing systems, risks, and mitigations)

  • Use professional council emails rather than personal accounts

  • Keep your website maintained with SSL, accessibility, and updates

  • Centralise your website and emails on a secure UK-hosted platform

Assertion 10 isn’t about complex IT audits — it’s about good governance and control. If your systems are tidy, secure, and documented, compliance follows naturally.

Tip: If your website or emails are hosted abroad, consider migrating to a UK provider. This strengthens your GDPR compliance and makes Assertion 10 reporting straightforward.

How can Town and Parish Council Websites help?

  • We provide a complete service, website design and set-up and hosting.
  • We can register .gov.uk domain names for your and set up emails that use the same domain.
  • We are local Council specialists and produce websites that are fully compliant with all relevant legislation.
  • Our websites are compliant with WCAG 2.2 AA accessibility standards, meet GDPR requirements and have all the pages necessary for your to publish the information required by the Transparency Code.
  • We offer stability and security for your crucial information. We are well established and have over 120 local Councils who use our services.

Want to know what it will cost?

REQUEST A QUOTATION