Minutes of Proceedings

1. APOLOGIES

1.1 Apologies were received from Pat Ramsey MLA, who is stepping down from the Assembly.  SARC members recorded their thanks to Pat for his two terms of service on SARC and extended best wishes for the future. 

2. DECLARATION OF INTERESTS

2.1 There were no declarations of interests.

3. MINUTES OF THE PREVIOUS MEETINGS

3.1 The minutes of the SARC meeting held on 8 October 2015 were approved without amendment.

4. MATTERS ARISING

4.1 SARC members noted that all the actions points arising from the 8 October meeting were now completed.  The Independent member expressed his thanks for being furnished with details of the Public Contract Regulations 2015.

5. INTERNAL AUDIT ACTIVITY / ASSURANCE

5.1 Brian Moreland reported that seven Internal Audit reports have been issued in final form since 1 April 2015: 

• Review of Accounts Preparation – Substantial
• Review of NIABT – Satisfactory
• Review of Support Services – Satisfactory
• Review of Members’ Expenses – Substantial
• Review of Social Media – Satisfactory
• Review of Post Contract Benefit Realisation – Satisfactory
• Review of Accounts Payable – Satisfactory

5.2      In addition, the follow-up audit in respect of Information Assurance has been completed and the report was issued on 4 December 2015. The assurance level remained satisfactory.

5.3 Fieldwork in respect of the HR (iTrent) audit is now complete, and a draft report has been issued to management. The assurance level for this assignment is satisfactory.

5.4 In relation to Payroll, a draft report has also been issued to management, and the assurance level is again satisfactory. Recommendations have been made on both reports to enhance control.

5.5 The Corporate Governance audit is nearing completion and a report will issue in the New Year

5.6 Brian Moreland reported that work remains on target for completion of the audit plan agreed by SARC in March 2015.  Since the October SARC   meeting, the Head of Internal Audit has had informal discussions with the Accounting Officer and the Chair of SARC to re-schedule several audits. In particular, as 2016 will see an Assembly election, it was agreed that the audit of Members’ expenses will be brought forward to February 2016. In order to accommodate this work, the audit of the roof project will be deferred   until the new financial year.

5.7 The Head of Internal Audit has started planning for the Internal Audit Strategy and programmes for 2016/17 and onwards. This has included meetings with all Directors to confirm structures and key risks, etc. Meetings have now been held with Heads of Business, and the process of allocating risk scores has been completed.

5.8 This planning exercise included a Secretariat-wide risk analysis using factors from the Corporate and Directorate risk registers, as well as results from previous Internal and External Audits. In addition to standard considerations such as finance, I.T. and vulnerability to fraud, etc., this exercise also included an assessment of the impact on control and risk management arising from SP15+ and the Voluntary Exit Scheme.

5.9 SARC members were presented with a first draft of the Internal Audit programme for 2016/17 for consideration.  SARC members were also provided with the outline programme for the following three years, the risk scores and audit days available for the period. The Audit Strategy, which is not expected to change significantly, will be available in advance of the March SARC meeting.

5.10 The SARC Chair sought clarification on the extent of the Voluntary Exit Scheme. The Clerk/Chief Executive provided the SARC Chair with details of the extent of the scheme to date (18 FTE staff) and advised that a provisional bid for 2016-17 has been submitted.

5.11 SARC members noted the level of non-audit days (including contingency, administration and consultancy etc.) that had been built into the draft audit programme, and the reasons given for this by the Head of Internal Audit. The SARC Independent member suggested that it would be useful if, down the line, estimated audit days could be compared with the actual number of days taken on assignments. The Head of Internal Audit advised SARC that an Internal Audit software package, currently at Business case stage and with an approximate budget of £20k, would facilitate such a comparison. SARC members noted this potential development. The Accounting Officer confirmed that he was content with the planned audit programme.

5.12 Brian Moreland reported that the overall level of assurance for the period 1 April to 16 December 2015 is satisfactory and that all audits have been completed in accordance with the Public Sector Internal Audit Standards (PSIAS). The satisfactory assessment is based on the levels of assurance arising from the individual Internal Audit assignments, the action taken by management to implement recommendations and the results of follow-up audits.

5.13 Each of the audits completed to date for the 2015/16 plan has resulted in either substantial (29%) or satisfactory (71%) assurance.

5.14 At the October meeting of SARC, the Head of Internal Audit was asked to explore the potential for collaboration with other legislatures in respect of cyber security. Mr Moreland advised that responses from Head of Internal Audit colleagues indicated a variety of approaches to this issue, and the only interest in a joint venture came from Wales. It will be discussed further at the meeting to be held in Edinburgh in the New Year.

5.15 Several legislatures have used external consultants for the technical aspects of the work and followed this up with in-house compliance audits, primarily against the requirements of ISO 27001. Others have simply performed self-assessments against the ISO with no penetration testing performed to date. The Head of Internal Audit reported that he has also held initial discussions with the Head of the IS Office, who has penetration testing carried out every other year. A cost effective option may be for Internal Audit and the IS Office to approach this area in a co-ordinated fashion to achieve best value and use of resources.  SARC members thanked the Head of Internal Audit for the update on this interesting area of work.

5.16 No whistleblowing cases have been reported to Internal Audit to date this year.

5.17 Brian Moreland informed SARC that updates had been sought in advance of the meeting from each of the PSNI teams with which work has been undertaken. The case from 2014 is still under consideration by the Public Prosecution Service. SARC will be notified as soon as the outcome is known. The PSNI team involved in the most recent case have been in contact with the Head of Finance to obtain additional material in connection with their investigation. The Head of Internal Audit has been informed that a file has been passed to the Public Prosecution Service. However, to date, only minimal information has been made available. The Head of Internal Audit has suggested a meeting with PSNI officers to obtain further clarification regarding this case.

5.18 In relation to these cases, the Accounting Officer informed SARC that he had taken appropriate internal actions but was not proposing to take any other action pending PSNI and Prosecution Service decisions. SARC members were content that this was the appropriate position.

5.19 Brian Moreland advised that all members of the Internal Audit unit have identified relevant generic and specialist training for the year ahead.

6. “IN PROGRESS” AUDIT RECOMMENDATIONS SCHEDULE

6.1 SARC members noted the continuing high level, and pace, of the implementation of accepted Internal Audit recommendations, with only four recommendations currently “in progress”. 

7. RTTCWG 2015 AUDIT RECOMMENDATIONS SCHEDULE

7.1 SARC members noted progress in relation to the three recommendations in the Report to those charged with Governance 2015.  Members were content that no further action could be taken in relation to recommendation 1, and it will be removed from future monitoring schedules.

8. OUTSTANDING AUDIT RECOMMENDATIONS SCHEDULE

8.1 SARC members noted the nil return.

9. SARC 2016/17 OBJECTIVES

9.1 SARC members agreed that no changes were necessary to the current SARC objectives.

10. CORPORATE RISK REGISTER

10.1 SARC members again welcomed the clear style of the Corporate Risk Register showing tracked changes, and they noted the changes made to the contents of the register since the October 2015 SARC meeting.

11. STEWARDSHIP STATEMENTS (at 30 September 2015)

11.1 SARC members discussed and noted the contents of the Stewardship Statements as at 30 September 2015. It was noted that the Director of Facilities had stated that controls were not appropriate but that he had listed the reasons for this and had included an appropriate entry in the Corporate Risk Register. It was noted that the outcome of the PSNI security review   should be known in January 2016.

11.2 SARC members noted that three Directors had made reference to the savings programme and that this could signify an area of increased risk. The Clerk/Chief Executive advised that it also involved better ways of doing business, and he highlighted greatly reduced print costs in recent years. SARC will keep potential risk arising from the savings programme under review.

12. MANAGEMENT ACCOUNTS

12.1 SARC members noted expenditure to end-November 2015, including the current underspends in Secretariat General Admin Expenditure and Members’ expenses. The Director of Corporate Services confirmed that he expected the levels of underspend to reduce significantly by the end of the financial year.

13. A.O.B.

13.1 Louise Mason advised SARC of recent NIAO staffing changes necessitated by the Voluntary Exit Scheme. Louise then gave SARC members an overview of the NI Audit Office’s Audit Strategy for the audit of the NI Assembly’s Resource Accounts 2015-16.  The two significant risks listed in the strategy are Members’ Pension provision/Excess Vote and Payments to Members. Procurement remains as a risk factor. The audit timetable was noted by SARC.

13.2 SARC members sought an update on the work of the Independent Financial Review Panel following SARC’s recent engagement with the Panel. Members were reassured that officials are having sight of the Panel’s draft proposals and noted that the administrative arrangements flowing from the 2016 Determination will be contained in a revised Financial Support for Members Handbook. The Determination is awaited in early 2016, and SARC members will be briefed on the resulting changes in due course.

ACTION: RICHARD STEWART

14. DATE OF NEXT MEETING

14.1 It was agreed that the next meeting of SARC would take place at 11.30 am on Tuesday 22 March 2016.

14.2 It was further agreed that SARC would meet on Thursday 19 May 2016 at 2.00 pm to consider the draft Resource Accounts and that a full SARC meeting, including consideration of the final Resource Accounts, would take place on Friday 17 June 2016 at 2.00 pm.