Minutes of Proceedings

ROOM 106, PARLIAMENT BUILDINGS

APPROVED

Members:                

Jim Brooks, Chairperson
Derek Martin
Jim Wells MLA

Attendees:               

Lesley Hogg, NIA
Stephen Knox, NIAO
Richard Stewart, NIA
Tara Caul, NIA
Dr Gareth McGrath, NIA
Paula McClintock, NIA
Brian Moreland, NIA
Eddie Kelly, NIA
David Johnston, NIA, Secretary

1. APOLOGIES

1.1 Apologies were received from Louise Mason, NIAO, and Stephen Welch, Director of Facilities.

2. DECLARATION OF INTERESTS

2.1 Derek Martin advised that he had been appointed as Chairperson of the Health and Safety Executive for Northern Ireland.  Jim Brooks advised that he is no longer an Independent Board Member with DAERA but continues as Chairperson of the Audit Committee of the Northern Ireland Environment Agency.

3. MINUTES OF THE PREVIOUS MEETINGS

3.1 The minutes of the SARC meeting held on 25 January 2017 were approved without amendment.

4. MATTERS ARISING

4.1 SARC members noted the completed action point.

5. INTERNAL AUDIT ACTIVITY / ASSURANCE, INCLUDING DRAFT INTERNAL AUDIT PLAN

5.1 Brian Moreland, Head of Internal Audit, informed SARC of the audits completed since 1 April 2016:

• Review of Corporate Governance – Satisfactory;
• Review of Business Office – Substantial;
• Review of Members’ Expenses (2015/16) – Satisfactory;
• Review of Compliance with the Data Protection Act – Satisfactory;
• Review of SARC support – Substantial; and
• Review of Committee for Regional Development – Unacceptable.
• Review of Voluntary Exit Scheme – Satisfactory;
• Provision of Hardware and Software – Satisfactory;
• Bill Office – Satisfactory; and
• Review of Winding Up Expenditure – Satisfactory.

Follow-up activity:

• Review of Accounts Preparation – remains Substantial;
• Review of Accounts Payable – raised to Substantial;
• Review of Support Services – raised to Substantial;
• Review of Social Media – raised to Substantial;
• Review of Post Contract Benefit Realisation – remains Satisfactory;
• Review of Ethics – remains Satisfactory;
• NI Assembly and Business Trust – raised to Satisfactory;
• Compliance with the Data Protection Act – raised to Substantial; and
• Review of Committee for Infrastructure (formerly Committee for Regional Development) – raised to Satisfactory.

5.2 The final report on the provision of Hardware and Software was issued on 9 May 2017 with five recommendations; three at risk rating 2 and the remaining two recommendations at risk rating 3. Recommendations were made in respect of the development of the helpdesk and Inventory Management System; guidelines on the return of IT equipment; records of contract expenditure; a central record of software licences; and records on the disposal of hardware. The assurance rating for this audit is Satisfactory.

5.3 The final report on the review of the Bill Office was issued on 9 March 2017 with three recommendations, one at risk rating 2 and two at risk rating 3.
Recommendations were made in respect of the retention of bill checklists; the record of management QA checks; and the use of resources. The assurance rating for this audit is Satisfactory.

5.4 The review of Risk Management and the Cyber Security scoping review have both been issued in draft.   SARC members noted, however, that the audit of the Roof Project remains outstanding at the end of the year, as the necessary information is being collated by the business area.

5.5 In relation to cyber security, in the light of the major international attack at the weekend, SARC members were reassured that the IS Office has appropriate measures in place and had reviewed the situation since the weekend.  A recent penetration test, carried out by an external provider, had had generally very positive results.

5.6 The following additional work was completed in 2016/17:

• Review of Office Cost Expenditure Specified Payments – unplanned activity - report was issued on 27 May 2016;
• Review of Regional Development Committee – issues raised at end of 2015/16 necessitated deeper review – final report was issued on 18 August 2016;
• Special Investigation – Training/Travel and Subsistence;
• Northern Ireland Assembly and Business Trust accounts review – report to Trustees was issued in December 2016; and
• Broadcasting Contract – report was issued in December 2016.

5.7 The Internal Audit draft plan for 2017/18 was considered by SARC.

The plan is largely in line with that presented at the March 2016 SARC meeting, with a number of amendments resulting from work performed in the 2016/17 year and as a consequence of emerging issues.

5.8 The changes involve the inclusion of an audit of Secretariat travel that will examine the process from, for example, identification and approval for course / conference attendance, travel arrangements, etc. through to final coding of relevant payments. In addition, the other notable inclusions relate to the audit of Outreach (deferred from the 2016/17 year) and the General Data Protection Regulation (in particular the extent to which the Secretariat’s preparations provide adequate protection for the Accounting Officer).  As a consequence of the inclusion of these assignments, it is recommended that the audits scheduled for the Speaker’s Office and HR are deferred.

5.9 The audit of Members’ expenses will involve consideration of expenditure in respect of two determinations and will, as usual, involve visits to constituency offices. This will also be the first assignment performed entirely using the new audit software package.

5.10 Mr Moreland outlined work performed to date against that planned during 2016-17, along with an analysis of actual days v budget.

5.11 SARC members commented that the Internal Audit Plan 2016-17 had gone well, and SARC members were content with the Plan for 2017-18 as drafted.

5.12 As a result of recent changes to both the Assembly’s Risk Management Strategy and revisions to the HM Treasury Public Sector Internal Audit Standards (PSIAS), the HIA will review, and revise as necessary, the 2017-18 Internal Audit strategy.

5.13 The overall level of assurance for the period 1 April 2016 to 31 March 2017 is Satisfactory.  As for previous years, this assessment is based on the levels of assurance arising from the individual Internal Audit assignments - all of which were completed in accordance with PSIAS - the action taken by management to implement recommendations and the results of follow-up audits.

5.14 Internal Audit has recorded a high rate of implementation of recommendations which has been reflected in an increase in a number of the assurance ratings at follow-up stage. The most significant among these was the increase in the rating for the Infrastructure Committee (formerly Regional Development) which was revised upward from Unacceptable to Satisfactory.

5.15 No whistleblowing cases have been reported to Internal Audit to date this year, and no new cases of fraud have been identified by, or reported to, Internal Audit since the January SARC meeting.

5.16 In relation to an ongoing investigation, since the January SARC meeting, the PSNI met with Internal Audit and HR, and the Clerk / Chief Executive was briefed on the meeting.

5.17 Mr Moreland informed SARC that the next meeting of the Inter-Parliamentary Head of Internal Audit group is due to be held in Parliament Buildings on 16 June 2017. Items on the agenda so far include cyber security, the General Data Protection Regulation, external reviews and possible Brexit impacts.

5.18 In relation to the quality assurance and improvement programme, the Head of Internal Audit advised SARC members that one of the PSIAS revisions calls for a report on the current level of conformance. The Assembly’s Internal Audit function was rated as fully compliant in all aspects of the standards during its last review (follow-up report dated September 2014). These reviews are scheduled to be performed at least every five years and the intention is to continue to comply with this requirement. The Heads of Internal Audit of the Scottish and Welsh legislatures have suggested that the three bodies engage in a review arrangement that would facilitate the requirements of the standards in a cost-effective manner. Proposals are due to be discussed at the meeting in June, and SARC will be notified of any recommendations.

5.19 The Head of Internal Audit advised that all members of the Internal Audit unit have identified relevant generic and specialist training for the year ahead. Glenda Grant and Catherine Dornan-Weir attended the Irish District conference of the Chartered Institute of Internal Auditors this year, and the Head of Internal Audit and the Audit Manager attended a Leaders’ Conference, also hosted by the Institute.  Each member of the unit will be expected to monitor their compliance with the Continuing Professional Education requirements of the Institute in order to maintain their certified status. Progress will be discussed at team meetings throughout the year.

6. AUDIT RECOMMENDATIONS SCHEDULE

6.1 SARC members discussed the contents of the schedule and noted the continuing high level of implementation of accepted Audit recommendations, with 9 recommendations currently “in progress”.

7. NIAO UPDATE ON AUDIT OF 2016-17 FINANCIAL STATEMENTS

7.1 Stephen Knox updated SARC members on the NI Audit Office’s audit of the 2016-17 Financial Statements.  No major issues had emerged at Interim Audit.  The key risks highlighted in the Audit Strategy are Pension Provision and Regularity of Payments to Members.  In relation to pensions, a debit pension reserve has now been put in place in line with similar reserves in place in the Scottish Parliament and the National Assembly for Wales, although a presentational issue needs to be resolved.  On payments to Members, the findings of Internal Audit’s work in this area are awaited. There remains an accounting issue in relation to a chandelier in Parliament Buildings to be addressed.

8. DRAFT ASSEMBLY RESOURCE ACCOUNTS 2016-17

8.1 Richard Stewart gave SARC members an overview of the Annual Report and Accounts 2016-17, including the Notes to the Statement of Assembly Supply, the Notes to the Assembly’s Resource Accounts, the Statement of Cash Flows and the Governance Statement.  SARC members reviewed the contents and were content for the draft Report and Accounts to be submitted to the NI Audit Office on 22 May 2017.

ACTION: PAULA McCLINTOCK

8.2 Paula McClintock advised SARC that PwC had recently completed the audit of Financial Assistance for Political Parties Scheme and that no major issues had been raised.

8.3 SARC members sought and received clarification, in the light of the current political situation, that the Assembly Secretariat had sufficient funds available and that the Assembly Commission remained in place.

9. RISK MANAGEMENT STRATEGY

9.1 Lesley Hogg informed SARC that the Risk Management Strategy and Risk Management Process Guidance had been updated into a merged Risk Management Strategy document.   Key changes include a revised approach to Risk Appetite and guidance on setting and achieving target risk scores.

9.2 SARC members found the Risk Management Strategy to be an impressive document and found the categories of risk appetite particularly helpful.  They were happy to commend the Risk Management Strategy to the Assembly Commission.

ACTION: LESLEY HOGG

10. DIRECTORATE RISK REGISTERS

10.1 SARC members sought clarification on certain aspects of the Directorate Risk Registers. The contents were discussed and SARC members were content. 

11. CORPORATE RISK REGISTER

11.1 SARC members noted the changes made to the contents of the Corporate Risk Register since the January SARC meeting. The contents were discussed and SARC members were content. 

12. STEWARDSHIP STATEMENTS (at 31 March 2017)

12.1 SARC members discussed and noted the contents of the Stewardship Statements as at 31 March 2017. It was noted that it has not been possible for the Stewardship Statement for the Facilities Directorate to be completed due to a long term absence.  In the absence of this Statement, the Clerk / Chief Executive has sought assurance from the individual Heads of Business that they are content that the controls in place are appropriate to manage the risks.

ACTION: DIRECTOR OF FACILITIES TO COMPLETE ON RETURN TO WORK

13. SARC ANNUAL REPORT AND SELF ASSESSMENT

13.1 SARC members were content with the contents of the SARC Annual Report and the self-assessment.  Some additional wording will be inserted in the Chairperson’s Foreword to reflect the current political situation and the implications of Brexit.

ACTION: DAVID JOHNSTON / JIM BROOKS

14. KEY GUIDANCE FROM DEPARTMENT OF FINANCE

14.1 SARC members noted the contents of the two DAO letters, three DAO/FD letters and one FD letter that had been issued by the Department of Finance since the January SARC meeting and, where appropriate, their application to the Assembly Secretariat.

15. A.O.B.

15.1 There was no other business.

16. DATE OF NEXT MEETING

16.1 As previously agreed, the next meeting of SARC will be held on Tuesday 20 June 2017 at 10.30 am in Room 106, Parliament Buildings.