SECRETARIAT AUDIT AND RISK COMMITTEE (SARC)

WEDNESDAY, 5 FEBRUARY 2020 at 2.00PM ROOM 106, PARLIAMENT BUILDINGS

Present:
Jim Brooks (Chair)
Derek Martin

In Attendance:       
Lesley Hogg, NIA
Christine Burns, NIAO
Tara Caul, NIA
Gareth McGrath, NIA
Richard Stewart, NIA
Paula McClintock, NIA
Eddie Kelly, NIA
Cathy Dornan-Weir, NIA
Julie Devlin, NIA

Opening/Review

The meeting commenced at 2.00 pm.

1. Apologies

Apologies were received from Rodney Allen, NIAO.

Lesley Hogg, the Clerk/Chief Executive, advised that Jim Wells MLA was no longer a member of the Northern Ireland Assembly Commission (the Assembly Commission) and that the new Assembly Commission had not yet met and had therefore not nominated its SARC member.

SARC recorded its appreciation for the contribution made by Jim Wells MLA during his time as a member SARC.

SARC also expressed its appreciation to Ashleigh Mitford, the former Governance Officer, for carrying out the role of SARC Secretary, and wished her well in her future career.

Eddie Kelly, acting Head of Internal Audit, explained that since Cathy Dornan- Weir had only recently taken over the role of Governance Officer on a temporary basis he would take the lead on agenda items normally addressed by the Governance Officer.

2. Declaration of Interests

No interests were declared.

3. Minutes of Previous Meeting

Minutes of the previous meeting, held on 16th October 2019, were approved without amendment.

It was noted that the action point arising from the October 2019 SARC meeting, to submit the revised SARC Terms of Reference to the Assembly Commission for approval, had been carried out. The Assembly Commission considered and approved the SARC Terms of Reference at its meeting on 5th November 2019.

4. Matters Arising

Lesley Hogg advised that since the last SARC meeting, a meeting of the Assembly had taken place on 11 January 2020 and an Executive had been appointed. She explained that normal Assembly business resumed with immediate effect and that since then all scheduled Plenary and Committee meetings had been successfully supported with only a very small number of minor issues.

SARC commended the work of the Assembly Commission Secretariat in successfully facilitating the resumption of parliamentary activity in January 2020.

Lesley stated that Secretariat support for the resumption of Assembly business had gone extremely well, vastly exceeding our own expectations and that the Secretariat’s performance was particularly impressive given the short notice of resumption, and the large number of vacancies that had arisen over the period when there was no parliamentary activity.

Jim Brooks commented that this was an extreme form of Business Continuity performed very well indeed. In theoretical exercises it is always recommended to review lessons learned for the future and in that context he asked if a lessons learned exercise had been carried out following the resumption of normal Assembly business. Lesley advised that, as the resumption had occurred only 3 weeks previously and gone very well, our focus was continuing to support Assembly business at this time. She stated that lessons learned would however be considered later in the year and that the Summer Recess may provide an opportunity to do so.

Action: Clerk/Chief Executive to consider lessons learned. Further update to Whistleblowing Policy

Eddie advised SARC that HR had facilitated a workshop with a representative sample of Secretariat staff to discuss the updated Whistleblowing Policy. He explained that this had resulted in a minor amendment at paragraph 26 of the document, to include specific reference to case studies, and that the revised version of the policy was in the pack for the meeting.

Eddie said that this action was an outworking of the 2018 Fraud and Bribery Self-Assessment exercise and that all actions were complete, with the exception of one ongoing action. He stated that the final 2018 Fraud and Bribery Self-Assessment Checklists, Bribery Risk Assessment and Action Plan Monitor were also in the pack.

SARC members noted the updated Whistleblowing Policy, the final updated 2018 Action Plan Monitor and the updated SARC Terms of Reference.

5. Internal Audit Activity Update

Eddie Kelly presented an overview of Internal Audit activity since the October 2019 SARC meeting and then provided a summary of the final reports issued since October 2019.

Eddie advised SARC members that 2 final reports had been issued since October 2019. The final Review of Events report, issued on 17th December 2019, raised 5 issues and contained 6 recommendations, all of which were accepted by management. Eddie provided an overview of the risk ratings and recommendations and advised SARC that the assurance level was satisfactory.

Eddie stated that the final Review of Planned and Reactive Maintenance report was issued on 21st January 2020, and contained 3 recommendations which were all accepted by management. This report also provided a satisfactory level of assurance.

Derek Martin asked whether any action has been taken to date in relation to the recommendation made in this report to carry out an options appraisal. Richard Stewart, Director of Corporate Services, advised SARC that the options appraisal exercise had begun and that this would determine the future approach for the provision of maintenance services.

Richard explained that this would not be completed before the new Northern Ireland Civil Service (NICS) framework contract commenced in April 2020 but that the Assembly Commission, as a named party, would not be compelled to use the NICS contract for the duration of the new agreement and that it could opt out of the contract at any stage.

Eddie advised SARC that 2 Follow-Up Reports had issued since October 2019. He said that the Follow-Up Report of Research and Information Services had issued on 27th November 2019, that all of the recommendations had been fully implemented and that the assurance level had been raised to substantial.

Eddie advised SARC members that the Follow-Up Usher Services report had issued on 9th January 2020, which concluded that 6 of the original recommendations had been implemented with one recommendation not implemented. He explained this related to MLAs swiping in and out of Parliament Buildings and that the Assembly Commission had considered this matter at its meeting in December 2019 but decided not to progress the proposal at the present time. Eddie stated that the level of assurance remained as satisfactory and that Management would keep this matter under review.

Derek Martin enquired as to whether the view of the Assembly Commission was likely to change in relation to this recommendation. Lesley Hogg advised that the Assembly Commission wanted to ensure that Parliament Buildings remained accessible to the public but that it would be raised with the new Assembly Commission in due course.

Eddie updated SARC on work in progress. He said that reviews at draft report stage were the Equality and Good Relations Unit, Payroll and Broadcasting and that fieldwork had commenced on the reviews of Members Expenses (interim) 2019/20 and follow-up work on Secretariat travel. Eddie advised that draft Terms of Reference had been issued in respect of reviews of the Administration of Members’ Expenses and Mobile Phones.

Eddie presented progress against the 2019/20 Internal Audit Plan, showing actual days against budget. He advised SARC that several factors had had an adverse impact on Internal Audit activity, including unanticipated leave and increased indirect activity as a result of the procurement of replacement Internal Audit workflow software, and provision of cover for the vacant Governance Officer role.

Eddie added that the return of the Assembly and associated resource pressures had resulted in planned engagements in the Speaker’s Office, the HR Office, the Procurement Office and a review of business continuity planning being reviewed.

Eddie said that he had met with Lesley Hogg, the Accounting Officer, in January 2020 and reviewed the outstanding Internal Audit engagements for 2020 and that the Accounting Officer had approved the deferral of these reviews.

Eddie further advised SARC that Internal Audit resources would be focussed on completing the remaining areas of the plan and on developing the new Internal Audit Strategy and 3 year plan. He stated that the Internal Audit coverage over the course of 2019/20 would facilitate the provision of a meaningful level of assurance at year-end.

Jim Brooks commended the delivery and coverage of the audit plan to date, and the benefits of the clearer focus that had been brought to bear on audit planning and delivery. He noted the overrun in resource days in the majority of completed audits and concluded that these were meaningful targets and further effort was required to meet them. He further commended both Internal Audit and management on the high level of acceptance of recommendations.

Eddie updated SARC on the External Quality Assurance (EQA) Review of the Internal Audit Unit which was currently being carried out by the Head of Governance and Assurance of the National Assembly of Wales. He thanked all stakeholders for their input and assistance and advised SARC that he expected the EQA report would be available for its next meeting.

Eddie stated that there had been no cases of whistleblowing or fraud reported to the Internal Audit Unit this year.

In conclusion, Eddie briefed SARC that, following a tender exercise for the procurement of Internal Audit workflow software, necessitated by the expiry of the previous contract, a new contract had been agreed with the existing supplier. Eddie said that this provided for a seamless transition, without the need for additional training and resulted in no change to the format or presentation of Internal Audit reports.

SARC thanked Eddie for the update and noted its contents.

6. Audit Recommendations Schedule

Eddie Kelly asked SARC to note the change made to the descriptors used within the Audit Recommendations Schedule to reflect political developments, namely the change from “awaiting political developments” to “awaiting political decisions”.

SARC considered the updated Audit Recommendations Schedule and noted the implementation of 15 recommendations since the October 2019 meeting. Eddie advised SARC that implementation of 3 recommendations was in progress, 2 were awaiting political decisions and 1 recommendation in relation to the Assembly Members Pension Scheme (AMPS) was overdue. He explained that implementation of the recommendation was dependent on action by the AMPS Trustees, that the Trustees were due to meet in February 2020 and that management expected the recommendation to be implemented following that meeting.

Jim Brooks commended the ongoing high rate of implementation of recommendations, and emphasised its importance in demonstrating a strong governance culture in the organisation. He highlighted that this made an important contribution to the overall assurance provided to the Accounting Officer.

SARC noted the update.

7. SARC Objectives 20/21

Eddie Kelly advised SARC that the annual review of SARC objectives was now due, and asked members to consider the suggested amendments which reflected both political developments and potential reform of the system for financial support for Members. SARC indicated that it was content to formally adopt the draft changes.

Action: Governance Officer to update the agreed SARC objectives for 2020/21 and include in Matters Arising at the next SARC meeting.

8. NIAO Audit Strategy for 19/20

Christine Burns, Northern Ireland Audit Office (NIAO), provided an overview of the NIAO Letter of Understanding and the NIAO Audit Strategy for 2019/20.

Christine advised SARC that the Letter of Understanding was a standard document issued by the NIAO. She said that the Audit Strategy was more specific and tailored to the Assembly Commission, for example by defining roles and responsibilities, and the key risks in the context of the annual audit of accounts. Christine drew attention of the reference to the Review of Financial Process included this year and explained that this was previously known as the Clear Line of Sight Process and would have minimal impact on Northern Ireland.

Christine highlighted various administrative arrangements in place to meet the plan and associated deadlines. She stated that the NIAO had held planning meetings with Paula McClintock, Head of Finance and Eddie Kelly as part of their risk based audit approach. Christine advised SARC on the work underway to provide the interim accounts within the agreed deadline, and that fieldwork had not revealed any issues of substance to date.

Jim Brooks noted that payments to MLAs remained a risk factor in the Audit Strategy.

SARC noted the receipt of the Audit Strategy for 19/20 and the Chairman expressed his gratitude to Christine and NIAO for their work, on behalf of SARC.

9. Updated Orange Book – July 2019

Tara Caul, Director of Legal, Governance and Research Services, presented an overview of the main developments contained in the updated 2019 version of HM Treasury’s “The Orange Book, Management of Risk – Principles and Concepts” (the Orange Book).

Tara advised SARC that an initial review of the Orange Book had been carried out and this concluded that the updates were not so substantive as to necessitate an early review of the Assembly Commission’s Risk Management Strategy.

Tara asked SARC to note the discussion points raised in the SARC paper and that these would be considered further when the Risk Management Strategy was reviewed in April 2020.

SARC thanked Tara for the helpful analysis of the updates contained in the revised Orange Book, and noted the Assembly Commission’s planned action to consider the implications of the revised Orange Book along with the scheduled review of the Risk Management Strategy in April 2020.

Action: Tara Caul and Governance Officer to consider the Orange Book and discussion points noted in the SARC paper as part of annual review of the Risk Management Strategy in April 2020.

10. Corporate Risk Register

Eddie Kelly provided an overview of key changes since the Corporate Risk Register was considered by SARC in October 2019. Eddie asked SARC members to note the contents of the revised Corporate Risk Register which was agreed by SMG on 17 December 2019.

SARC expressed its satisfaction with the comprehensive nature of the Corporate Risk Register.

SARC noted the updated Corporate Risk Register.

11 Risk Management Self-Assessment 2019

Eddie Kelly explained that SARC had last considered the Assembly Commission’s Risk Management Strategy at its meeting in June 2019. He highlighted that part of the review process contained within the Strategy was an annual Risk Management Self-Assessment exercise.

Eddie advised SARC that the self-assessment was carried out in October 2019, and that SMG considered and approved its contents in November 2019. Eddie said that due to the high level of compliance demonstrated, SMG agreed to complete the exercise every 2 years, rather than annually, as was originally intended. Eddie provided an overview of the 2 outstanding issues, namely Business Continuity Planning and contingency arrangements, and wider risk management training. He then outlined the proposed Action Plan.

Jim Brooks complimented Officials on the quality of the review carried out and stated that it was extremely reassuring to see such a high level of compliance.

SARC noted the contents of the November 2019 Risk Management Self- Assessment and the proposed Action Plan.

12. Fraud and Bribery Self-Assessment Checklists, Bribery Risk Assessment and Action Plan 2019

Eddie Kelly presented the latest position in relation to the 2018 Fraud and Bribery Self-Assessment Checklists, Bribery Risk Assessment and Action Plan.

Eddie advised SARC that all outstanding actions had been completed since the October 2019 meeting and that any ongoing/annual actions have been carried forward.

Eddie stated that the self-assessment exercise was repeated in November 2019, and the contents of the revised Fraud and Bribery self-Assessment checklists, Bribery Risk Assessment and Action Plan were agreed by SMG in December 2019. Eddie advised SARC that SMG had agreed, given that near full compliance had been demonstrated, to change the frequency of this self- assessment exercise to every 2 years.

Eddie summarised the changes made to Fraud and Anti-Bribery Self- Assessment Checklists and advised that all applicable ratings were green. He then provided an overview of the changes made to the Bribery Risk Assessment and the Action Plan.

SARC expressed the view that the review exercise was very helpful and that this further enhanced the assurance provision within the organisation.

SARC noted the contents of the revised Fraud and Bribery Self-Assessment Checklists, Bribery Risk Assessment and Action Plan, and the amended plan to conduct the reviews bi-annually.

13. NAO Cyber Security & Information Risk Checklist – Action Plan Monitoring

Eddie Kelly provided an update on the one outstanding action shown in the table provided to SARC.

SARC noted the update provided.

14. Key Guidance from Department of Finance

SARC noted the key guidance that had been issued by the Department of Finance since the October 2019 SARC meeting.

Paula McClintock advised SARC that the revised Government Financial Reporting Manual (FReM) 2019-20 had not resulted in any significant changes in accounting practices.