Minutes of Proceedings

1 APOLOGIES

1.1 Apologies were received from Jim Wells MLA and Paula McClintock.

2 DECLARATION OF INTERESTS

2.1 There were no declarations of interests.

3 MINUTES OF THE PREVIOUS MEETINGS

3.1 The minutes of the SARC meetings held on 17 June and 21 June 2016 were approved without amendment.

4 MATTERS ARISING

4.1 SARC members noted the seven completed action points and were content with the actions and timeframes proposed for completing the remaining two actions.

5 INTERNAL AUDIT ACTIVITY / ASSURANCE

5.1 Brian Moreland reported that four Internal Audit reports have been issued in final form since the SARC meeting on 21 June 2016, bringing the total to six since 1 April 2016.

• Review of Corporate Governance – Satisfactory;
• Review of Business Office – Substantial;
• Review of Members' Expenses (2015/16) – Satisfactory;
• Review of Compliance with the Data Protection Act – Satisfactory;
• Review of SARC support – Substantial; and
• Review of Committee for Regional Development – Unacceptable.

5.2 In addition, a follow-up audit has been completed and a report was
issued on 3 October 2016 in respect of the Review of Post-Contract Benefits Realisation – the assurance remains Satisfactory. The report will be included in the pack for the next SARC meeting.

5.3 The final report on the Review of Members' Expenses was issued on 25 July
2016. Five recommendations were made, two at risk rating 2 and three at risk rating 3. Four of the 5 recommendations were accepted; the other recommendation is now not applicable. Recommendations have been made in respect of compliance with the Determinations by requiring Members to complete declarations of connected persons in respect of all Members' staff; retention of clear records of rental valuations on the rental files; retention of appropriate annotation to provide a management trail of decisions relating to the processing of queried or non-routine payments; delegation of responsibility for carrying out trend analysis to the operational level, with results being reported to the Deputy Head of Finance and escalated if necessary; and ensuring that payments are only made to suppliers for which the MLA has completed a declaration of associated persons. This was the last expenses review under the terms of the previous Determination and one of the risk rating 3 recommendations, concerning clear records of rental valuations, has been superseded by the terms of the new determination. The level of assurance for this assignment is Satisfactory.

5.4 The final report on the Review of Compliance with the Data Protection Act
was issued on 25 July 2016 with four recommendations, three at risk rating 2
and the remaining recommendation at risk rating 3. Recommendations were made in respect of the escalation of notifications in respect of staff who have not participated in mandatory data protection training; co-ordinating efforts between the Legal and Governance and Facilities Directorates to ensure that roles and responsibilities are clearly allocated prior to the 2017 retendering of the confidential disposal contract; development of appropriate contingency and continuity arrangements to ensure suitable resilience in information security and data protection management; and updating the directorate risk register to highlight the risk of reliance on one member of staff, and to consider suitable risk responses. All of the recommendations were accepted by management. The assurance rating for this audit is Satisfactory.

5.5 The final report on the Review of SARC Support was issued on 11 August
2016. The report contained no recommendations and Substantial assurance
was awarded. The report was fully accepted by management.

5.6 The final report on the Review of the Secretariat's support for the Committee
for Regional Development was issued on 18 August 2016 with 14 recommendations, 10 at risk rating 1 and four at risk rating 2. All of the recommendations were accepted by management.

5.7 During the course of the audit a number of significant issues came to light.
These involved several aspects of the review, including operational failure;
breakdown of monitoring and control; and lack of financial control.

5.8 Recommendations have been made in relation to a major delay in finalising a
Committee inquiry, which was carried out during the 2014-15 Parliamentary Session; the inappropriate use of a procurement card by a member of staff (the same issue had been raised on a previous report and involved the same individual) and the completeness and accuracy of financial records. Internal Audit has discussed with management the need for urgent action in respect of the matters identified and the steps necessary to prevent similar circumstances in the future. The assurance rating for this audit is Unacceptable.

5.9 SARC members noted that all of the recommendations will be implemented
by the end of October 2016; a review of Committee travel was undertaken during Summer recess; new guidance and pro-formas have been issued; action has been considered in respect of the individual identified, and staff training sessions are underway. A follow-up review will be completed in due course and SARC will be notified of the results of the follow-up.

5.10 Mr Moreland advised that fieldwork on the review of the NI Assembly's administration of the Voluntary Exit Scheme has been completed. The draft report will issue shortly. Terms of reference for the Review of the Bill Office have been agreed and fieldwork commenced in mid-September 2016. Terms of reference for the review of the provision of IT hardware and software have been drafted and work commenced on the review in late September 2016.

5.11 Mr Moreland informed SARC that the Internal Audit plan as agreed at the March meeting remains on target for completion, with some amendment. Following discussion with management, the timing of individual reviews has been reviewed but should still permit completion within the plan. The exception to this is the planned audit of Communications and Outreach. The Head of Internal Audit has suggested that this assignment be postponed until the 2017-18 year. This is to accommodate the additional resource allocated to the ongoing investigation and to facilitate any liaison with PSNI.

5.12 In addition, because of the nature of several issues raised in the Regional Development Committee audit and the recent investigation, the Head of Internal Audit recommends the inclusion of an additional audit in the 2017-18 plan. This would involve scrutiny of all Secretariat and Committee travel, from original business case, through to cost allocation. It may be necessary to omit one of the assignments already planned for that year, but SARC will be consulted accordingly.

5.13 Mr Moreland advised SARC that the overall level of assurance for the period 1 April 2016 to 5 October 2016 is Satisfactory. This assessment is based on the levels of assurance arising from the individual Internal Audit assignments, the action taken by management to implement recommendations and the results of follow-up audits. The overall rate of acceptance of Internal Audit recommendations for the year to date stands at 100% for each risk category.

5.14 No whistleblowing cases have been reported to Internal Audit to date this year.

5.15 No new cases of fraud have been identified by, or reported to, Internal Audit since the last SARC meeting.

5.16 As reported at the SARC meeting in March 2016, a file has been passed to the Public Prosecution Service in respect of a case of which SARC is aware. In relation to the ongoing case involving the Secretariat, PSNI have allocated the case and the investigation has commenced. HR are taking forward a disciplinary investigation, and Internal Audit will report following the conclusion of its internal investigation. It was noted that SARC would be informed of management responses in due course.

5.17 All members of the Internal Audit unit have identified relevant generic and
specialist training for 2016-17. Given the nature of recent Internal Audit activity, the Head of Internal Audit has been looking at options for the provision of in-house fraud investigation training, and Learning and Development staff have been assisting with this. It is understood that this training may also be of use to staff outside of the Internal Audit function. It was agreed that the Secretariat should again contact the NICS pool to ascertain investigative capacity when the existing call-off contract is up for renewal.
ACTION: BRIAN MORELAND

6 CLASSIFICATION OF INTERNAL AUDIT FINDINGS

6.1 SARC members considered DAO (DoF) 07/16 which introduced a revised system of Internal Audit opinions in NICS Departments and Arm's Length Bodies. SARC members were content for the Secretariat to retain the "Substantial" rating and drew attention to the helpful new definitions for Priority ratings. It was agreed that Mr Moreland would consider the revised priority definitions and decide whether the current definitions should be revised accordingly.
ACTION: BRIAN MORELAND

7 AUDIT RECOMMENDATIONS SCHEDULE

7.1 SARC members noted the continuing high level of implementation of accepted Internal Audit recommendations, with 18 recommendations currently "in progress". The Clerk/Chief Executive indicated that Directors would aim to complete the few remaining recommendations from 2014-15 in the next couple of months.

8 UPDATE ON IPSA PEER REVIEW RECOMMENDATIONS

8.1 Richard Stewart gave an overview of the implementation of the recommendations and observations contained in the IPSA Peer Review of 21 September 2015 and updated SARC members on the subsequent Members' Handbook review of 12 May 2016. SARC members were content but emphasised the importance of the Assembly Commission appointing a new Panel in the near future.

9 NIAO REPORT TO THOSE CHARGED WITH GOVERNANCE

9.1 Louise Mason gave an overview of the Report to those charged with Governance, which is not yet fully signed off. Following discussion, it was agreed that the NI Audit Office and Secretariat staff would liaise to discuss Recommendations 1, 3 and 4.

ACTION: LOUISE MASON / RICHARD STEWART

10 CORPORATE RISK REGISTER

10.1 SARC members noted the changes made to the contents of the Corporate Risk Register since the SARC meeting on 21 June 2016, including some reductions in Residual Risk scores. SARC members were content that the new format Risk Register be introduced for both Directorate and Corporate Risks. It was agreed that the new format Corporate Risk Register will be populated and presented at the next SARC meeting.
ACTION: DIRECTORS / DAVID JOHNSTON

11 SARC TERMS OF REFERENCE (ANNUAL REVIEW)

11.1 SARC members considered the draft revised Terms of Reference, noting that they are in line with the HM Treasury guidance of March 2016 but are enhanced with some additional provisions. Members agreed to adopt the revised SARC Terms of Reference.

12 HM TREASURY AUDIT AND RISK ASSURANCE COMMITTEE GUIDANCE 2016

12.1 SARC members were grateful for the Gap Analysis in relation to the NI
Assembly Secretariat's compliance with HM Treasury's Audit and Risk Assurance Committee guidance of March 2016 and were pleased to note the extremely high levels of compliance.

12.2 SARC members noted the Secretariat's full compliance with HM Treasury's
new section of Whistleblowing Guidance.

12.3 SARC members noted the Secretariat's high levels of compliance with HM
Treasury's new section of Cyber Security Guidance and expressed their thanks to Secretariat officials for their work in this regard.

13 KEY GUIDANCE FROM DEPARTMENT OF FINANCE

13.1 SARC members noted the DAO/FD of 12 August 2016 on Memoranda of Reply and the subsequent consideration by the Secretariat of general lessons and key issues arising from recent NI Public Accounts Committee Reports.

14 A.O.B.

14.1 Lesley Hogg paid tribute to the work of Colm McKenna, whose term as SARC Chair ends on 30 November 2016, for the past five years as Chair and the two years prior to that as Independent member. Lesley conveyed SARC's best wishes for the future and thanked Colm for his support and significant input to overseeing and improving the governance of the Secretariat. Bernard Mitchell also paid tribute to Colm's work as Chair.

15 DATE OF NEXT MEETING

15.1 The next meeting of SARC is due to be held in January 2017 following the appointment of a new Chairperson.

1             APOLOGIES

1.1         Apologies were received from Jim Wells MLA and Paula McClintock.

2       DECLARATION OF INTERESTS

2.1       There were no declarations of interests.

3              MINUTES OF THE PREVIOUS MEETINGS

3.1          The minutes of the SARC meetings held on 17 June and 21 June 2016 were approved without amendment.

4              MATTERS ARISING

4.1       SARC members noted the seven completed action points and were content with the actions and timeframes proposed for completing the remaining two actions.

5              INTERNAL AUDIT ACTIVITY / ASSURANCE

5.1       Brian Moreland reported that four Internal Audit reports have been issued in final form since the SARC meeting on 21 June 2016, bringing the total to six since 1 April 2016.

·         Review of Corporate Governance – Satisfactory;

·         Review of Business Office – Substantial;

·         Review of Members’ Expenses (2015/16) – Satisfactory;

·         Review of Compliance with the Data Protection Act – Satisfactory;

·         Review of SARC support – Substantial; and

·         Review of Committee for Regional Development – Unacceptable.

5.2     In addition, a follow-up audit has been completed and a report was    

issued on 3 October 2016 in respect of the Review of Post-Contract Benefits Realisation – the assurance remains Satisfactory. The report will be included in the pack for the next SARC meeting.

5.3     The final report onthe Review of Members’ Expenses was issued on 25 July    

2016.  Five recommendations were made, two at risk rating 2 and three at risk rating 3. Four of the 5 recommendations were accepted; the other recommendation is now not applicable.  Recommendations have been made in respect of compliance with the Determinations by requiring Members to complete declarations of connected persons in respect of all Members’ staff; retention of clear records of rental valuations on the rental files; retention of appropriate annotation to provide a management trail of decisions relating to the processing of queried or non-routine payments; delegation of responsibility for carrying out trend analysis to the operational level, with results being reported to the Deputy Head of Finance and escalated if necessary; and ensuring that payments are only made to suppliers for which the MLA has completed a declaration of associated persons.  This was the last expenses review under the terms of the previous Determination and one of the risk rating 3 recommendations, concerning clear records of rental valuations, has been superseded by the terms of the new determination. The level of assurance for this assignment is Satisfactory.

5.4    The final report onthe Review of Compliance with the Data Protection Act
    was issued on 25 July 2016 with four recommendations, three at risk rating 2     

and the remaining recommendation at risk rating 3.  Recommendations were made in respect of the escalation of notifications in respect of staff who have not participated in mandatory data protection training; co-ordinating efforts between the Legal and Governance and Facilities Directorates to ensure that roles and responsibilities are clearly allocated prior to the 2017 retendering of the confidential disposal contract; development of appropriate contingency and continuity arrangements to ensure suitable resilience in information security and data protection management; and updating the directorate risk register to highlight the risk of reliance on one member of staff, and to consider suitable risk responses.  All of the recommendations were accepted by management.  The assurance rating for this audit is Satisfactory.

5.5      The final report on the Review of SARC Support was issued on 11 August   

      2016.  The report contained no recommendations and Substantial assurance  

       was awarded. The report was fully accepted by management.

5.6     The final report on the Review of the Secretariat’s support for the Committee    

for Regional Developmentwas issued on 18 August 2016 with 14 recommendations, 10 at risk rating 1 and four at risk rating 2. All of the recommendations were accepted by management.

5.7      During the course of the audit a number of significant issues came to light.  

      These involved several aspects of the review, including operational failure;   

      breakdown of monitoring and control; and lack of financial control.

5.8      Recommendations have been made in relation to a major delay in finalising a   

Committee inquiry, which was carried out during the 2014-15 Parliamentary Session; the inappropriate use of a procurement card by a member of staff (the same issue had been raised on a previous report and involved the same individual) and the completeness and accuracy of financial records.  Internal Audit has discussed with management the need for urgent action in respect of the matters identified and the steps necessary to prevent similar circumstances in the future. The assurance rating for this audit is Unacceptable.

5.9      SARC members noted that all of the recommendations will be implemented   

by the end of October 2016; a review of Committee travel was undertaken during Summer recess; new guidance and pro-formas have been issued; action has been considered in respect of the individual identified, and staff training sessions are underway.  A follow-up review will be completed in due course and SARC will be notified of the results of the follow-up.

5.10    Mr Moreland advised that fieldwork on the review of the NI Assembly’s administration of the Voluntary Exit Scheme has been completed. The draft report will issue shortly. Terms of reference for the Review of the Bill Office have been agreed and fieldwork commenced in mid-September 2016.  Terms of reference for the review of the provision of IT hardware and software have been drafted and work commenced on the review in late September 2016.

5.11    Mr Moreland informed SARC that the Internal Audit plan as agreed at the March meeting remains on target for completion, with some amendment. Following discussion with management, the timing of individual reviews has been reviewed but should still permit completion within the plan. The exception to this is the planned audit of Communications and Outreach. The Head of Internal Audit has suggested that this assignment be postponed until the 2017-18 year. This is to accommodate the additional resource allocated to the ongoing investigation and to facilitate any liaison with PSNI.

5.12    In addition, because of the nature of several issues raised in the Regional Development Committee audit and the recent investigation, the Head of Internal Audit recommends the inclusion of an additional audit in the 2017-18 plan. This would involve scrutiny of all Secretariat and Committee travel, from original business case, through to cost allocation. It may be necessary to omit one of the assignments already planned for that year, but SARC will be consulted accordingly.

5.13    Mr Moreland advised SARC that the overall level of assurance for the period 1 April 2016 to 5 October 2016 is Satisfactory. This assessment is based on the levels of assurance arising from the individual Internal Audit assignments, the action taken by management to implement recommendations and the results of follow-up audits. The overall rate of acceptance of Internal Audit recommendationsfor the year to date stands at 100% for each risk category.

5.14    No whistleblowing cases have been reported to Internal Audit to date this year.

5.15    No new cases of fraud have been identified by, or reported to, Internal Audit since the last SARC meeting. 

5.16    As reported at the SARC meeting in March 2016, a file has been passed to the Public Prosecution Service in respect of a case of which SARC is aware.  In relation to the ongoing case involving the Secretariat, PSNI have allocated the case and the investigation has commenced.  HR are taking forward a disciplinary investigation, and Internal Audit will report following the conclusion of its internal investigation.  It was noted that SARC would be informed of management responses in due course.

5.17    All members of the Internal Audit unit have identified relevant generic and

specialist training for 2016-17. Given the nature of recent Internal Audit activity, the Head of Internal Audit has been looking at options for the provision of in-house fraud investigation training, and Learning and Development staff have been assisting with this. It is understood that this training may also be of use to staff outside of the Internal Audit function.  It was agreed that the Secretariat should again contact the NICS pool to ascertain investigative capacity when the existing call-off contract is up for renewal.

ACTION: BRIAN MORELAND

6          CLASSIFICATION OF INTERNAL AUDIT FINDINGS

6.1       SARC members considered DAO (DoF) 07/16 which introduced a revised system of Internal Audit opinions in NICS Departments and Arm’s Length Bodies.  SARC members were content for the Secretariat to retain the “Substantial” rating and drew attention to the helpful new definitions for Priority ratings.  It was agreed that Mr Moreland would consider the revised priority definitions and decide whether the current definitions should be revised accordingly.
ACTION: BRIAN MORELAND

7           AUDIT RECOMMENDATIONS SCHEDULE

7.1       SARC members noted the continuing high level of implementation of accepted Internal Audit recommendations, with 18 recommendations currently “in progress”.  The Clerk/Chief Executive indicated that Directors would aim to complete the few remaining recommendations from 2014-15 in the next couple of months.

8          UPDATE ON IPSA PEER REVIEW RECOMMENDATIONS

8.1       Richard Stewart gave an overview of the implementation of the recommendations and observations contained in the IPSA Peer Review of 21 September 2015 and updated SARC members on the subsequent Members’ Handbook review of 12 May 2016.  SARC members were content but emphasised the importance of the Assembly Commission appointing a new Panel in the near future.

9       NIAO REPORT TO THOSE CHARGED WITH 

     GOVERNANCE

9.1       Louise Mason gave an overview of theReport to those charged with Governance, which is not yet fully signed off.  Following discussion, it was agreed that the NI Audit Office and Secretariat staff would liaise to discuss Recommendations 1, 3 and 4.

ACTION: LOUISE MASON / RICHARD STEWART

10       CORPORATE RISK REGISTER 

10.1    SARC members noted the changes made to the contents of the Corporate Risk Register since the SARC meeting on 21 June 2016, including some reductions in Residual Risk scores.  SARC members were content that the new format Risk Register be introduced for both Directorate and Corporate Risks.  It was agreed that the new format Corporate Risk Register will be populated and presented at the next SARC meeting.

ACTION: DIRECTORS / DAVID JOHNSTON

11     SARC TERMS OF REFERENCE (ANNUAL REVIEW)

11.1    SARC members considered the draft revised Terms of Reference, noting that they are in line with the HM Treasury guidance of March 2016 but are enhanced with some additional provisions.  Members agreed to adopt the revised SARC Terms of Reference.

12     HM TREASURY AUDIT AND RISK ASSURANCE

         COMMITTEE GUIDANCE 2016

12.1      SARC members were grateful for the Gap Analysis in relation to the NI

Assembly Secretariat’s compliance with HM Treasury’s Audit and Risk Assurance Committee guidance of March 2016 and were pleased to note the extremely high levels of compliance.

12.2      SARC members noted the Secretariat’s full compliance with HM Treasury’s

new section of Whistleblowing Guidance.

12.3      SARC members noted the Secretariat’s high levels of compliance with HM

Treasury’s new section of Cyber Security Guidance and expressed their thanks to Secretariat officials for their work in this regard.

13     KEY GUIDANCE FROM DEPARTMENT OF FINANCE

13.1    SARC members noted the DAO/FD of 12 August 2016 on Memoranda of Reply and the subsequent consideration by the Secretariat of general lessons and key issues arising from recent NI Public Accounts Committee Reports.

14     A.O.B.

14.1    Lesley Hogg paid tribute to the work of Colm McKenna, whose term as SARC Chair ends on 30 November 2016, for the past five years as Chair and the two years prior to that as Independent member.  Lesley conveyed SARC’s best wishes for the future and thanked Colm for his support and significant input to overseeing and improving the governance of the Secretariat.  Bernard Mitchell also paid tribute to Colm’s work as Chair.

15     DATE OF NEXT MEETING

15.1    The next meeting of SARC is due to be held in January 2017 following the appointment of a new Chairperson.