Minutes of Proceedings

SARC Minutes of Proceedings 13 October 2021.pdf (153.85 kb)

SECRETARIAT AUDIT AND RISK COMMITTEE (SARC)

Wednesday 13 October 2021 at 2 pm

VIA MICROSOFT TEAMS

Present:

Jim Brooks, Chairperson

Derek Martin, Independent Member

John O’Dowd MLA

In Attendance:

Lesley Hogg, Clerk/Chief Executive,

Kathy Doey - NIAO

Tara Caul, Director of Legal, Governance and Research Services

Gareth McGrath, Director of Parliamentary Services

Richard Stewart, Director of Corporate Services

Billy Mahoney, Acting Deputy Head of Finance

Eddie Kelly, Acting Head of Internal Audit

Julie Devlin, Governance Officer

Karl Hedley, Clerical Supervisor

The meeting commenced at 2pm.

1. Apologies

No apologies were received.

2. Declaration of Interests

No interests were declared.

3. Minutes of Previous Meeting

Minutes of the previous meeting, held on 24 June 2021, were approved without amendment.

4. Matters Arising

There were no matters arising.

John O’Dowd joined the meeting at 2.05pm.

5. Internal Audit Activity Report /Assurance

Eddie Kelly provided a summary of the reports that had issued since the June 2021 meeting of SARC as follows:

• The Review of the Office of the Examiner of Statutory Rules Report issued in July provided substantial assurance and no recommendations were made;

• The Review of Risk Management Report issued in August covered the design and operation of the risk management framework. Substantial assurance was provided and no recommendations were made;

• The Follow-up Review of Hansard concluded that both of the recommendations made in the previous report had been implemented and a substantial level of assurance was retained; and

• The Follow-up Review of Corporate Procurement Cards found that of the three recommendations made in the previous report, one had been implemented, one was in progress but had subsequently been implemented and one had not been implemented but this recommendation was outside managements’ control. The level of assurance remained satisfactory.

Eddie provided an overview of the Internal Audit reviews in progress and advised that no cases of whistleblowing or fraud had been reported to Internal Audit since the last meeting.

Overall, Eddie reported that the level of assurance for the year was satisfactory.

Jim Brooks sought confirmation that the audit programme for the year was on track and would be completed. Eddie confirmed that this was the case. Jim noted that although only a small number of reports had issued since the last meeting, a number of reviews had been completed and the reports were pending. He thanked Eddie for the assurance provided.

SARC noted the Internal Audit Activity Report.

6. Audit Recommendations Schedule

Julie Devlin summarised the status of the outstanding audit recommendations.

Jim stated that it was clear that management was keeping on top of audit recommendations and that detailed explanations had been provided for those that were outstanding. Derek Martin and John concurred.

SARC noted the update on the Audit Recommendations Schedule.

7. Final Report to Those Charged with Governance (RTTCWG)

Kathy Doey stated that the final RTTCWG recommendations had not changed since those presented at the last meeting and that management comments had now been included. She reported that one recommendation had been implemented and that the other would be implemented in the 2021/22 accounts.

Jim stated that the RTTCWG was the most important document SARC received; that the tone and quality of it was good; and that it affirmed SARC’s view that internal control and the way in which business was conducted in the Assembly Commission was sound. He thanked Kathy for the report.

SARC noted the Report to Those Charged with Governance.

8. Corporate Risk Register (CRR)

Julie presented CRR for September 2021 and highlighted the changes from the June 2021 version.

Derek commended management for updating the CRR regularly in line with current developments. Jim added that the CRR provided a strategic overview of the risks and opportunities in the organisation.

SARC noted the Corporate Risk Register.

9. Stewardship Statements

Jim invited directors to provide an overview of their Stewardship Statements.

Gareth McGrath highlighted the recruitment and retention issues in the IS Office and advised that recruitment had been paused pending the outcome of the Grading and Pay Benchmarking Review. He also highlighted the projects to upgrade broadcasting equipment.

Derek queried whether services to the Assembly could be fulfilled in light of the staffing issues within the IS Office. Gareth confirmed that they could but that other projects had to be paused.

Derek asked if other mitigations such as consultancy support had been considered. Gareth confirmed that it had, but would only be used as a last resort as it was very expensive.

Jim thanked Gareth for his overview

Tara Caul reported that the main issue of concern in her Directorate was in relation to Records Management and staff resources in that area. She advised that a comprehensive review of the Assembly Commission’s Retention and Disposal Schedule was in progress and that the Records Management Policy required significant revision. Tara also advised that a new Data Protection and Governance Officer was joining the organisation and that resourcing would be kept under review.

Jim thanked Tara for her overview.

Richard Stewart advised that the main issues in his Directorate were workforce planning for retirements across the organisation and planning for the return of staff to the office who were staff currently working from home. Richard confirmed that a Homeworking Policy was being developed.

Jim raised employer responsibilities in relation to home working and Richard confirmed that there were a number of issues being considered.

Jim asked about the Systems Review Project and Richard advised that responses to the tender were currently undergoing evaluation.

Jim thanked Richard for his overview.

SARC noted the Stewardship Statements.

10. National Audit Office (NAO) Cyber Security and Information Risk Self-Assessment Checklist and Action Plan

Julie advised that the NAO Cyber Security and Information Risk Self-Assessment Checklist and Action Plan had been reviewed and updated in conjunction with the Head of IS Office and Data Protection and Information Security Officer and approved by SMG.

Julie highlighted that one area in the Self-Assessment had an amber status in relation to staffing in the IS Office and that it was anticipated that the posts would be filled by the end of November 2021.

Jimstated that the Self-Assessment was very comprehensive and confirmed that because of near complete compliance, he was content for it to continue to be carried out every two years.

SARC noted the NAO Cyber Security and Information Risk Self-Assessment Checklist and Action Plan.

11. Risk Management Self-Assessment Checklist - Action Plan monitoring

Julie advised that only one action remained outstanding in relation to risk management training, and that this should be available from January 2022.

SARC noted the update provided on the Risk Management Self-Assessment Checklist - Action Plan.

12. Key Guidance from the Department of Finance

Jim advised that he had reviewed the key guidance from the Department of Finance and that he was content that there was nothing critical for the attention of SARC or the organisation.

SARC noted the key guidance that had been issued by the Department of Finance.

17. AOB

Lesley advised SARC that this was Julie’s last meeting as SARC Secretary and thanked Julie for her work and the support provided to SARC over the past year and a half.

Lesley noted that it was also Jim and Derek’s last meeting and thanked them for the very valuable contribution that they had made to SARC during their five-year term. She also thanked them for their commitment and the professional support and advice they had provided.

Jim said that it had been a pleasure and a privilege to work with a very stable, thoughtful management team who had its eyes fixed firmly on the future. Jim expressed his gratitude to Julie for the professional service she had provided as SARC Secretary.  Derek and John also thanked Julie for her work as SARC Secretary.

John thanked Jim and Derek for their work over the past five years on behalf of the Speaker and the Assembly Commission, and said that the Assembly Commission had found them very helpful and professional.

Derek thanked Lesley and the Secretariat Management team and said that he had enjoyed his time on SARC. He also thanked Eddie for the Internal Audit work carried out and the reports issued.

18. Date of Next Meetings

The date of next meeting was deferred pending appointment of a new SARC Chairperson and Independent Member.

The meeting ended at 2.50 pm