Minutes of Proceedings

VIA MICROSOFT TEAMS

Present:

Jim Brooks (Chairperson)
Derek Martin
John O'Dowd MLA

In Attendance:

Lesley Hogg, NIA
Kathy Doey - NIAO
Tara Caul, NIA
Gareth McGrath, NIA
Richard Stewart, NIA
Billy Mahoney, NIA
Eddie Kelly, NIA
Julie Devlin, NIA

The meeting commenced at 2pm.

Opening remarks

Jim Brooks welcomed John O'Dowd MLA to his first meeting as the Assembly Commission representative and acknowledged the contribution that had been made by Keith Buchanan MLA over the course of his tenure on SARC.

1. Apologies

Apologies were received from Rodney Allen and Paula McClintock.

2. Declaration of Interests

No interests were declared.

3. Minutes of Previous Meeting

Minutes of the previous meeting, held on 18 February 2021, were approved without amendment.

4. Matters Arising

There were no matters arising.

5. Internal Audit End of Year 2020-21 Report /Assurance

Eddie Kelly provided an overview of the Internal Audit activity between 1 April 2020 and 31 March 2021 and advised that during that period twelve final reports had been issued of which six received a substantial assurance, five satisfactory assurances and one a limited level of assurance.

Eddie advised that the review of Broadcasting Infrastructure which had received limited assurance, had been included in Internal Audit's Annual Report for 2019-20. He said that good progress had been made since then, and as had been the case in 2019-20, it did not have a material impact on the overall level of assurance for 2020-21.

Eddie added that five follow-up reports had been issued during this period of which four received substantial assurance. He said that the remaining follow-up report was in respect of a Scoping Review of Cybersecurity and was not assurance-based, although he pointed out that the recommendations made had all been implemented.

Eddie advised that over the course of the year, Internal Audit was suitably resourced to deliver its planned workload and that there were no impairments to its independence or objectivity. He concluded that an overall Satisfactory Assurance level was provided for 2020-21, and that this could be used to inform the Governance Statement.

Jim thanked Eddie and commended the cyclical and strategic approach to Internal Audit's work over the course of the year, which resulted in a level of assurance that enabled SARC to provide the necessary assurance to the Assembly Commission.

SARC noted the Internal Audit Activity Report.

6. Internal Audit Strategy 2020/21 – 2022/23

Eddie advised SARC that he had carried out the first annual review of the Internal Audit Strategy 2020/21 – 2022/23. He said that this had resulted in revisions to the Strategic Plan and the development of the 2021-22 Internal Audit Plan and that SMG had approved the revised Strategy and the 2021-22 Internal Audit Plan at its meeting on 26 March 2021.

Jim thanked Eddie and commented on the breadth of planned audit coverage for 2021-22 which would allow the provision of assurance based on work across the Assembly Commission.

Jim asked for an update on the External Quality Assessment of Internal Audit. Eddie informed SARC that the production of the draft report had been delayed by a number of factors, but that he had recently met with the Clerk/Chief Executive and the Director of Legal Governance and Research Services to discuss management responses to the recently received draft. He said that he hoped that the final report would be available for the next SARC meeting in June 2021.

SARC noted the revised Internal Audit Strategy 2020/21 – 22/23.

7. Internal Audit Charter – 2021 review

Eddie advised SARC that he had reviewed the Internal Audit Charter, that no amendments were necessary at this time and that SMG had approved the Internal Audit Charter at its meeting in March 2021.

Jim commented that he would like to see an emphasis on Internal Audit providing good value for money to the organisation in future. Eddie responded that this would be considered as part of the 2022 Review of the Internal Audit Charter.

SARC noted the Internal Audit Charter.

8. Audit Recommendations Schedule

Julie Devlin summarised the status of the outstanding audit recommendations.

Jim commented that there were a relatively small number of outstanding audit recommendations and asked Eddie whether there were any particular areas of concern. Eddie stated that he did not have any concerns regarding the implementation of recommendations, and that any amendments to target implementation dates had been adequately justified by management. Jim commented that there was a good management culture in this regard

Derek Martin asked Lesley Hogg if she was confident that the revised dates for implementation of the overdue audit recommendations could be met.

Lesley advised that completion of some overdue recommendations were dependent upon external bodies and were not within the Assembly Commission's control, but that she was content with the completion dates for the recommendations within the Assembly Commission's control.

SARC noted the update on the Audit Recommendations Schedule.

9. Draft Assembly Annual Report and Accounts 2020-2021

Richard presented the draft Assembly Annual Report and Accounts 2020-21 and apologised for their late distribution. He reported that they were still in draft form as guidance on the Remuneration Report was still outstanding from the Department of Finance (DoF) and that some of the figures received from Civil Service Pensions were being queried and should therefore be treated as provisional.

Richard informed SARC that the Assembly had adopted the minimum reporting requirements and therefore, only an overview of the organisation's performance against targets was included in the Annual Report.

Kathy Doey advised that the NIAO was aware that guidance from DoF was pending and that the NIAO would review it once it was received. Kathy also advised that the draft Annual Report and Accounts should be submitted to the NIAO with a cover letter setting out those caveats.

Lesley stated that because of the tight timeline for preparation, the draft Annual Report and Accounts had not yet been reviewed by SMG.

Jim said that he had carried out an initial review of the draft Annual Report and Accounts and that he would direct any queries he may have to Richard.

SARC noted the Draft Annual Report and Accounts.

10. NIAO Update on Audit of 2020-21 Financial Statements

Kathy advised that interim work had been carried out by the NIAO on the Assembly's draft Annual Report and Accounts 2020-21 and there were no issues to bring to SARC's attention at this stage.

SARC noted the NIAO update on the Audit of 2020-21 Financial Statements.

11. Risk Management Strategy

Julie advised SARC that the Risk Management Strategy had been reviewed by SMG and formally approved at its meeting on 30 April 2021.

Julie outlined the key changes made and advised that SMG had considered a guidance note issued by HM Treasury on Risk Appetite and had agreed that the Assembly Commission's classifications and descriptions remained fit for purpose.

Julie also advised that SMG had considered the frequency of review of the Risk Management Strategy. She said that given that the Strategy was now embedded with only minor amendments required over the past two years, SMG was content to review the Strategy and risk appetite every two years, with any new or revised government guidance affecting the strategy being considered by exception.

SARC noted the revised Risk Management Strategy.

12. Self-Assessment Checklists - Action Plan Monitoring

Julie presented the Action Plans arising from the Cyber Security and Information Security and the Risk Management Self-Assessment Checklists to SARC. She advised that all actions arising from the Fraud and Bribery Self-Assessment Checklist had been reported as complete to SARC at its last meeting.

Jim said that he welcomed the additional resources being allocated to Cyber Security.

SARC noted the Self-Assessment Checklists – Action Plans.

13. Corporate Risk Register

Julie presented the CRR for March 2021 and advised SARC that a quarterly review of the CRR had been carried out by SMG. She advised that corporate risks in relation to the Assembly Commission's budget and the UK exiting the EU had been removed from the CRR as these risks had been mitigated.

Julie also advised that since SARC last reviewed the CRR in February 2021, risk scores had been reduced for the remaining three corporate risks and there were no risks with a red status.

Jim said that it was good to see that the CRR was being properly reviewed and risks that have been mitigated removed. He commented that the CRR should be a living document and it was a sign of growth in an organisation when risks that were mitigated were removed. He asked about the rationale for removal of the risk associated with the UK leaving the EU.

Lesley advised that the risk was in relation to how the Assembly Commission serviced the needs of the Assembly and that those needs had been addressed by the additional staff allocated to that area of work.

Tara also added that additional staff resources had been made available in the office of the ESR in relation to scrutiny of statutory rules and there had been an emphasis on learning and development and knowledge exchange in this area.

SARC noted the Corporate Risk Register.

14. Directorate Risk Registers

SARC noted the content of the Directorate Risk Registers.

15. Stewardship Statements

Jim invited Directors to give an overview of their Stewardship Statements.

Tara advised SARC that the key issue outlined in her Stewardship Statement was the protection of the health and wellbeing of staff during the COVID-19 Pandemic, alongside the continued effective delivery of services to the Assembly during this difficult time.

Tara advised that she was content that there were effective policies in place in relation to procurement and information management and that audit recommendations were being implemented throughout the Directorate.

Richard advised that during the COVID-19 Pandemic it was important that the level of controls, particularly in the Finance Office, were maintained whilst staff were working from home. He added that controls were reviewed throughout the year and he was content with the arrangements put in place.

Derek asked Richard if all documents were in place in relation to the Roof Project and Richard confirmed that they were.

Derek said it was essential that processes were being followed and accurate records kept.

Lesley confirmed that specialist advice was also being sought.

Gareth gave an overview of his Stewardship Statement highlighting that although there was an extensive recruitment programme in progress, there were still a number of vacancies in his Directorate. He stated that significant additional resources had been allocated to deal with the work arising from the UK's departure from the EU and that some vacancies in the IS Office had been filled with work ongoing to mitigate any risk in that area. Gareth added that the acquisition of a router matrix had significantly improved the resilience of the broadcasting infrastructure, and that a life cycle maintenance and replacement plan was in place.

Jim thanked the Directors.

SARC noted the Stewardship Statements.

16. Draft SARC Annual Report and Self-Assessment

Jim thanked Derek and the Assembly Commission member for their work during the year and gave an overview of the content of the draft SARC Annual Report. He reported that the implementation of audit recommendations was good and that the Internal Audit Planning process had continued to improve and noted the development of the Internal Audit Strategy. He said he was content that a fundamental review of Risk Management had been carried out and that as this was the last SARC Annual Report he would be delivering as his term of appointment was coming to an end, he was content that he and Derek were leaving the organisation in good order.

Jim added that he would be presenting the SARC Annual Report to the Assembly Commission.

16. Key Guidance from Department of Finance

Julie advised SARC that since the last meeting two Dear Accounting Officer (DAO) letters had been received from the DoF. She said that one letter provided direction on the format and content of the Annual Report and Accounts and the deadline for submitting them to the Comptroller and Auditor General, and that the other was in relation to Ministerial Directions which was not applicable to the Assembly Commission.

SARC noted the key guidance that had been issued by the Department of Finance since the February 2021 SARC meeting.

17. AOB

There were no additional items of business.

18. Date of Next Meetings

It was agreed that the next meeting would be held in June 2021, date to be confirmed.

The meeting ended at 2.50 pm

VIA MICROSOFT TEAMS

DRAFT

Present:                    Jim Brooks (Chairperson)

Derek Martin

John O’Dowd MLA

            In Attendance:        Lesley Hogg, NIA

Kathy Doey - NIAO

                                                Tara Caul, NIA

                                                Gareth McGrath, NIA

Richard Stewart, NIA

Billy Mahoney, NIA

Eddie Kelly, NIA

Julie Devlin, NIA

The meeting commenced at 2pm.

Opening remarks

Jim Brooks welcomed John O’Dowd MLA to his first meeting as the Assembly Commission representative and acknowledged the contribution that had been made by Keith Buchanan MLA over the course of his tenure on SARC.

1.         Apologies

Apologies were received from Rodney Allen and Paula McClintock.

2.            Declaration of Interests

No interests were declared.

3.         Minutes of Previous Meeting

Minutes of the previous meeting, held on 18 February 2021, were approved without amendment.

4.         Matters Arising

            There were no matters arising.

5.         Internal Audit End of Year 2020-21 Report /Assurance

Eddie Kelly provided an overview of the Internal Audit activity between 1 April 2020 and 31 March 2021 and advised that during that period twelve final reports had been issued of which six received a substantial assurance, five satisfactory assurances and one a limited level of assurance.

Eddie advised that the review of Broadcasting Infrastructure which had received limited assurance, had been included in Internal Audit’s Annual Report for 2019-20.   He said that good progress had been made since then, and as had been the case in 2019-20, it did not have a material impact on the overall level of assurance for 2020-21.

Eddie added that five follow-up reports had been issued during this period of which four received substantial assurance.  He said that the remaining follow-up report was in respect of a Scoping Review of Cybersecurity and was not assurance-based, although he pointed out that the recommendations made had all been implemented.

Eddie advised that over the course of the year, Internal Audit was suitably resourced to deliver its planned workload and that there were no impairments to its independence or objectivity. He concluded that an overall Satisfactory Assurance level was provided for 2020-21, and that this could be used to inform the Governance Statement.

Jim thanked Eddie and commended the cyclical and strategic approach to Internal Audit’s work over the course of the year, which resulted in a level of assurance that enabled SARC to provide the necessary assurance to the Assembly Commission.

SARC noted the Internal Audit Activity Report.

6.            Internal Audit Strategy 2020/21 – 2022/23

Eddie advised SARC that he had carried out the first annual review of the Internal Audit Strategy 2020/21 – 2022/23. He said that this had resulted in revisions to the Strategic Plan and the development of the 2021-22 Internal Audit Plan and that SMG had approved the revised Strategy and the 2021-22 Internal Audit Plan at its meeting on 26 March 2021.

Jim thanked Eddie and commented on the breadth of planned audit coverage for 2021-22 which would allow the provision of assurance based on work across the Assembly Commission.

Jim asked for an update on the External Quality Assessment of Internal Audit. Eddie informed SARC that the production of the draft report had been delayed by a number of factors, but that he had recently met with the Clerk/Chief Executive and the Director of Legal Governance and Research Services to discuss management responses to the recently received draft. He said that he hoped that the final report would be available for the next SARC meeting in June 2021.

SARC noted the revised Internal Audit Strategy 2020/21 – 22/23.

7.            Internal Audit Charter – 2021 review

Eddie advised SARC that he had reviewed the Internal Audit Charter, that no amendments were necessary at this time and that SMG had approved the Internal Audit Charter at its meeting in March 2021.

Jim commented that he would like to see an emphasis on Internal Audit providing good value for money to the organisation in future. Eddie responded that this would be considered as part of the 2022 Review of the Internal Audit Charter.

            SARC noted the Internal Audit Charter.

8.            Audit Recommendations Schedule

Julie Devlin summarised the status of the outstanding audit recommendations.

Jim commented that there were a relatively small number of outstanding audit recommendations and asked Eddie whether there were any particular areas of concern. Eddie stated that he did not have any concerns regarding the implementation of recommendations, and that any amendments to target implementation dates had been adequately justified by management. Jim commented that there was a good management culture in this regard

Derek Martin asked Lesley Hogg if she was confident that the revised dates for implementation of the overdue audit recommendations could be met.

Lesley advised that completion of some overdue recommendations were dependent upon external bodies and were not within the Assembly Commission’s control, but that she was content with the completion dates for the recommendations within the Assembly Commission’s control.

SARC noted the update on the Audit Recommendations Schedule.

9.            Draft Assembly Annual Report and Accounts 2020-2021

Richard presented the draft Assembly Annual Report and Accounts 2020-21 and apologised for their late distribution.  He reported that they were still in draft form as guidance on the Remuneration Report was still outstanding from the Department of Finance (DoF) and that some of the figures received from Civil Service Pensions were being queried and should therefore be treated as provisional.

Richard informed SARC that the Assembly had adopted the minimum reporting requirements and therefore, only an overview of the organisation’s performance against targets was included in the Annual Report.

Kathy Doey advised that the NIAO was aware that guidance from DoF was pending and that the NIAO would review it once it was received. Kathy also advised that the draft Annual Report and Accounts should be submitted to the NIAO with a cover letter setting out those caveats.

Lesley stated that because of the tight timeline for preparation, the draft Annual Report and Accounts had not yet been reviewed by SMG.

Jim said that he had carried out an initial review of the draft Annual Report and Accounts and that he would direct any queries he may have to Richard.

SARC noted the Draft Annual Report and Accounts.

10.         NIAO Update on Audit of 2020-21 Financial Statements

Kathy advised that interim work had been carried out by the NIAO on the Assembly’s draft Annual Report and Accounts 2020-21 and there were no issues to bring to SARC’s attention at this stage.

SARC noted the NIAO update on the Audit of 2020-21 Financial Statements.

11.         Risk Management Strategy

Julie advised SARC that the Risk Management Strategy had been reviewed by SMG and formally approved at its meeting on 30 April 2021.

Julie outlined the key changes made and advised that SMG had considered a guidance note issued by HM Treasury on Risk Appetite and had agreed that the Assembly Commission’s classifications and descriptions remained fit for purpose.

Julie also advised that SMG had considered the frequency of review of the Risk Management Strategy.  She said that given that the Strategy was now embedded with only minor amendments required over the past two years, SMG was content to review the Strategy and risk appetite every two years, with any new or revised government guidance affecting the strategy being considered by exception.

SARC noted the revised Risk Management Strategy.

12.         Self-Assessment Checklists - Action Plan Monitoring

Julie presented the Action Plans arising from the Cyber Security and Information Security and the Risk Management Self-Assessment Checklists to SARC. She advised that all actions arising from the Fraud and Bribery Self-Assessment Checklist had been reported as complete to SARC at its last meeting.

Jim said that he welcomed the additional resources being allocated to Cyber Security.

SARC noted the Self-Assessment Checklists – Action Plans.

13.         Corporate Risk Register

Julie presented the CRR for March 2021 and advised SARC that a quarterly review of the CRR had been carried out by SMG. She advised that corporate risks in relation to the Assembly Commission’s budget and the UK exiting the EU had been removed from the CRR as these risks had been mitigated.

Julie also advised that since SARC last reviewed the CRR in February 2021, risk scores had been reduced for the remaining three corporate risks and there were no risks with a red status.

Jim said that it was good to see that the CRR was being properly reviewed and risks that have been mitigated removed. He commented that the CRR should be a living document and it was a sign of growth in an organisation when risks that were mitigated were removed. He asked about the rationale for removal of the risk associated with the UK leaving the EU.

Lesley advised that the risk was in relation to how the Assembly Commission serviced the needs of the Assembly and that those needs had been addressed by the additional staff allocated to that area of work.

Tara also added that additional staff resources had been made available in the office of the ESR in relation to scrutiny of statutory rules and there had been an emphasis on learning and development and knowledge exchange in this area.

SARC noted the Corporate Risk Register.

14.         Directorate Risk Registers

SARC noted the content of the Directorate Risk Registers.

15.         Stewardship Statements

Jim invited Directors to give an overview of their Stewardship Statements.

Tara advised SARC that the key issue outlined in her Stewardship Statement was the protection of the health and wellbeing of staff during the COVID-19 Pandemic, alongside the continued effective delivery of services to the Assembly during this difficult time.

Tara advised that she was content that there were effective policies in place in relation to procurement and information management and that audit recommendations were being implemented throughout the Directorate.

Richard advised that during the COVID-19 Pandemic it was important that the level of controls, particularly in the Finance Office, were maintained whilst staff were working from home. He added that controls were reviewed throughout the year and he was content with the arrangements put in place.

Derek asked Richard if all documents were in place in relation to the Roof Project and Richard confirmed that they were.

Derek said it was essential that processes were being followed and accurate records kept.

Lesley confirmed that specialist advice was also being sought.

Gareth gave an overview of his Stewardship Statement highlighting that although there was an extensive recruitment programme in progress, there were still a number of vacancies in his Directorate. He stated that significant additional resources had been allocated to deal with the work arising from the UK’s departure from the EU and that some vacancies in the IS Office had been filled with work ongoing to mitigate any risk in that area. Gareth added that the acquisition of a router matrix had significantly improved the resilience of the broadcasting infrastructure, and that a life cycle maintenance and replacement plan was in place.

Jim thanked the Directors.

SARC noted the Stewardship Statements.

16.         Draft SARC Annual Report and Self-Assessment

Jim thanked Derek and the Assembly Commission member for their work during the year and gave an overview of the content of the draft SARC Annual Report. He reported that the implementation of audit recommendations was good and that the Internal Audit Planning process had continued to improve and noted the development of the Internal Audit Strategy. He said he was content that a fundamental review of Risk Management had been carried out and that as this was the last SARC Annual Report he would be delivering as his term of appointment was coming to an end, he was content that he and Derek were leaving the organisation in good order.

Jim added that he would be presenting the SARC Annual Report to the Assembly Commission.

16.       Key Guidance from Department of Finance

Julie advised SARC that since the last meeting two Dear Accounting Officer (DAO) letters had been received from the DoF. She said that one letter provided direction on the format and content of the Annual Report and Accounts and the deadline for submitting them to the Comptroller and Auditor General, and that the other was in relation to Ministerial Directions which was not applicable to the Assembly Commission.

            SARC noted the key guidance that had been issued by the Department of Finance since the February 2021 SARC meeting.

17.       AOB

            There were no additional items of business.

.

18.       Date of Next Meetings

            It was agreed that the next meeting would be held in June 2021, date to be confirmed.

          The meeting ended at 2.50 pm