Minutes of Proceedings

VIA MICROSOFT TEAMS

Present:
Jim Brooks (Chair)
Derek Martin
Keith Buchanan MLA

In Attendance:
Lesley Hogg, NIA
Rodney Allen, NIAO
Tara Caul, NIA
Gareth McGrath, NIA
Richard Stewart, NIA
Paula McClintock, NIA
Eddie Kelly, NIA
Julie Devlin, NIA

Opening/Review 

The meeting commenced at 2.30 pm.

Jim Brooks opened the meeting by welcoming Keith Buchanan MLA to his first meeting as the Assembly Commission representative on SARC and explained that the main purpose of the meeting was to consider the draft Report and Accounts for the year ended 31 March 2020.

Lesley Hogg introduced everyone present to Keith.

1. Apologies

There were no apologies.

2. Declaration of Interests

No interests were declared.

3. Minutes of Previous Meeting

Minutes of the previous meeting, held on 5 February 2020, were approved without amendment.

4. Matters Arising

Lesley advised SARC that the Assembly had recently passed a motion confirming that an independent body would continue to determine the salaries of Members and pensions of former Members and which conferred a function on the Assembly Commission to determine the allowances for Members.  She said that the Assembly Commission would therefore bring forward a Bill to amend the scope of the current Independent Financial Review Panel and that the name of the Panel might also be amended.

Lesley stated the Assembly Commission intended to publish a new Determination in relation to Members’ allowances, but that there would be no change in the governance and oversight arrangements and no dilution of the scrutiny of Members’ expenses which would continue to be published on the website.

Keith said that he welcomed the change.

Jim advised that he was aware that there had been complaints about the way in which the existing Determination operated and that SARC would monitor the corporate governance issues arising from any new Determination.

Julie presented the action points from the previous meeting and advised SARC that two of the actions (relating to the review of SARC’s objectives and the revision of the Risk Management Strategy in line with the Orange Book) had been completed and the other action, in relation to a lessons learned review of the resumption of normal Assembly business, would be carried out over the summer

SARC noted the action points and agreed its objectives for 2020/21.

5. Internal Audit End of Year 2019/20 Report/Assurance

Eddie Kelly presented his Annual Report which summarised the year’s Internal Audit activity and provided an assurance level for the year. Eddie advised that 10 final reports had been issued, resulting in three substantial, six satisfactory and one limited level of assurance.  He said that of the seven follow-up reports issued, six provided a substantial level of assurance and one a satisfactory level of assurance.

Eddie presented an outturn against the 2019/20 Internal Audit Annual Plan and noted that three final reports remained outstanding, with two awaiting management responses and one undergoing quality assurance prior to issue.

Eddie stated that the limited assurance level was in respect of the Review of Broadcasting Infrastructure due to the risk associated with the resilience of the broadcasting infrastructure .  Eddie added that this was a legacy issue which management had been aware of for some time, as evidenced by its inclusion in the Corporate Risk Register and the mitigation measures planned.

Eddie said that the draft report of the External Quality Assurance Assessment, carried out by the Head of Risk and Assurance of the Welsh Parliament, was received on 3 July 2020 and that he anticipated the final report would be tabled at the next SARC meeting.

Eddie advised that the scope of the 2019/20 Internal Audit Plan was limited to those parts of the organisation that remained operational during period when there was no normal Assembly business and that normal Assembly business resumed on 11 January 2020.  He confirmed that he was satisfied that the scope of Internal Audit activity allowed the provision of a meaningful opinion on the overall framework of internal control, risk and governance for 2019/20.

Eddie said that for the majority of the reporting period, the Internal Audit Unit operated with an adequate level of staff resource to deliver an annual audit opinion, and that although staffing levels were adversely affected by unanticipated leave in the final quarter of the year, the fieldwork in the areas covered by the revised Internal Audit Plan was completed by the end of the reporting year.

Eddie advised that Internal Audit continued to operate independently and that there had been no impairments to its operational independence during the course of the year.

Eddie stated that, on the basis of the work carried out by Internal Audit during the course of 2019/20, and the high level of effective implementation of Internal Audit recommendations by management, it was his opinion that a satisfactory level of assurance could be provided on the framework of internal control, risk management and governance for 2019/20, and that this opinion could be used to inform the Governance Statement. He said that the limited assurance level of the Review of Broadcasting Infrastructure was not significant enough to affect this overall satisfactory assurance.

Lesley added that management had been aware of the Broadcasting Infrastructure issue for some time and that it had been anticipated that this  would have been replaced over the past few years. She explained that the political hiatus had delayed the project as it would have been imprudent to invest significant resources in a new broadcasting system when the Assembly was not carrying out normal business.

Jim commented that SARC was aware of the broadcasting infrastructure situation and was satisfied that the work would be carried out in the future.  He thanked Eddie for the work of Internal Audit over the course of the year and the assurance provided.

SARC noted the Internal Audit End of Year Report 2019/2020.

6. Audit Strategy 2020-2023 and Internal Audit Plan 2020/2021

Eddie advised SARC that the new strategy covered the period 2020/21 – 22/23 and was agreed by SMG on 30 April 2020.  He said that the Strategy included a three-year Strategic Plan, a 2020/21 Internal Audit Plan, a table showing historic coverage, and the 2020/21 Resource Plan.

Eddie explained that the aim of the Strategy was to increase the strategic focus of Internal Audit while continuing to provide cyclical assurance in respect of routine business processed and that three themes had been introduced to categorise Internal Audit engagements in order to facilitate that approach.  He outlined them as Cyclical Assurance, Corporate Risk and Corporate Strategy and Plan and said that each audit in the Strategic and Annual Plans would be linked to one of these themes.

Eddie stated that the development of the Strategic Plan had involved an assessment of historical audit data which was then mapped to the current structure of the organisation and that the process also included an assessment of the main organisational risks as per the Corporate and Directorate Risk Registers; a review of the Northern Ireland Assembly Commission Corporate Strategy 2019-23 and Corporate Plan; and discussions with the Clerk/Chief Executive and Directors.  He said that the Audit Strategy and Strategic Plan would be reviewed at least annually, in line with the Internal Audit planning cycle.

Eddie advised SARC that an Internal Audit Plan would be prepared annually for delivery over the course of the Audit Strategy, presented to SMG for approval in April and then to SARC in May for its endorsement. 

Derek commented that the audit planning was logical and sound. He said that the three-year strategy was an excellent piece of work which would allow SARC to easily monitor the plan and resource.

Jim agreed and stated that one of the key objectives of SARC was to give assurance to the Clerk/|Chief Executive and the Assembly Commission.  He also noted the improvement in audit planning over the course of the last few years, which was now linked to the range of duties undertaken by the Assembly Commission and thanked Eddie.

SARC noted the Audit Strategy 2020-2023 and Internal Audit Plan 2020/2021.

7. Internal Audit Internal Quality Assessment Review (May 2020)

Eddie reminded SARC that he had carried out an Internal Quality Assessment and reported the findings in May 2019; that the review had concluded that the Unit was in “general conformance” with Public Sector Internal Audit Standards; and that he had recommended a number of actions to promote fuller conformance.

He said that these actions had been incorporated in to a Continuous Improvement Plan that was regularly reviewed and updated, and that he was presenting the latest update to SARC.

Eddie advised that one action remained “in progress” in relation to the development of an Internal Audit Manual which had been hampered by other priorities and resourcing issues, and that it would be progressed as and when permitted.  He added that any actions arising from the External Quality Assurance review would be added to the Continuous Improvement Plan, monitored and reported upon.

Rodney Allen commended the Continuous Improvement Plan as an important piece of work that reflected well on Internal Audit and suggested that it could be referred to in the Governance Statement.

SARC noted the status of the Internal Audit Internal Quality Assessment Review.

8. Outstanding Audit Recommendations Schedule

Julie advised SARC that since the last meeting five recommendations had been completed, five were in progress and one in relation to the development of a maintenance register was in progress, but had been delayed due to long term sickness absence.

Jim noted the approach of keeping the numbers of audit recommendations small and commented that the high proportion of audit recommendations being accepted was a positive sign.

SARC noted the status of the Outstanding Audit Recommendations Schedule.

9. NIAO Update on Audit of the Report and Accounts for the year ended 31 March 2020

Rodney Allen commented that the Audit Plan for Internal Audit was very good to see.

Rodney gave a brief update on the audit of 2019/20 Report and Accounts. He advised that samples had been selected for auditing and that it was likely that certification would take place in late September.

Rodney also advised that since the last SARC meeting the NIAO had received a whistleblower complaint in relation to Members' expenses, that it would be investigated during the audit and that he would report back before certification.

Lesley advised SARC that she was aware of the whistleblower complaint and that she did not envisage any difficulty responding to the allegations.

SARC noted the update from the NIAO on the audit of the Report and Accounts for the year ended 31 March 2020.

10. Draft Report and Accounts for the year ended 31 March 2020    

Paula McClintock presented the draft Report and Accounts to SARC. She apologised for the late issue which was due to staffing and operational difficulties arising from COVID-19 and acknowledged that SMG and SARC had not had sufficient time to review the accounts. Paula advised that there was a significant underspend as the Assembly had only returned to normal business in January and then business was adversely affected by the COVID-19 pandemic.

A detailed discussion on the draft Report and Accounts took place covering issues such as underspends, provisions and reserves.  

Jim acknowledged the fact that SMG had not had time to review the Report and Accounts due to their late receipt and advised that he would send queries to the Head of Finance for clarification.  He thanked Paula and her team for preparing the Report and Accounts, especially given the additional pressures resulting from the impact of the COVID-19 pandemic.

Lesley advised that SMG had not had an opportunity to review the accounts at all, that the Report and Accounts would be submitted to SARC in September and that SMG would have considered them fully before that.

SARC received the draft Report and Accounts for the year ended 31 March 2020.

Action: Any comments on the draft Report and Accounts should be directed to Paula.

11. Risk Management Strategy – Revised May 2020

Julie advised that the annual review of the Risk Management Strategy had been carried out by SMG in May 2020 and that it had been revised in line with the HM Government Orange Book updates of July 2019 and February 2020.

Julie advised SARC that the annual review of the risk appetite had been completed during the review and that SMG had agreed that it was satisfied with the risk appetite and that no amendment was necessary. She advised SARC that all the amendments made to the strategy were detailed in the cover memo and invited comments.

SARC noted the revised Risk Management Strategy.

12. Action Plan Monitoring

Julie advised SARC that the Fraud and Bribery Self-Assessment Checklist Action Plan showed that two actions had been completed and that two were due to be completed by October 2020. She also advised that the Cyber-Security and Information Risk Self-Assessment Action Plan had one action which was in progress, and that the Risk Management Self-Assessment Action Plan showed that one action had been completed and that one in relation to risk management training was in progress.

SARC noted the status of the Action Plans

13. Corporate Risk Register

Julie advised SARC that, the Corporate Risk Register had been updated in March 2020 and that an additional review of risks associated with COVID-19 had been carried out in May 2020. Julie advised that SARC had been provided with the June Risk Register but that the cover memo detailed the changes made to the Corporate Risk Registers in March, May and June and asked if there were any questions.

Tara advised SARC that in order to ensure that all risk responses in the context of the COVID-19 emergency were recorded on an ongoing basis, SMG  felt that the additional review of the risk register in May 2020 was necessary.

SARC commended this approach and commented on the positive way the organisation had responded to the COVID 19 crisis and the way in which staff had been protected throughout a very difficult period.

SARC noted the Corporate Risk Register.

14. Directorate Risk Registers

Jim advised that SARC had reviewed the Directorate Risk Registers contained in the pack and asked Directors if they had anything further to add.

Jim stated that the organisation responded very well to risk generally and that there were procedures in place to deal with risks which could knock the organisation’s corporate objectives off course (positive as well as negative risks).  Derek congratulated everyone for continuing to carry out their work during this difficult time.

Jim added that it was good to see that all the COVID-19 guidance had been followed and the fact that the Assembly Commission had no reported cases of COVID-19 was testament to the good work.

As Directors were content that the Directorate Risk Registers contained all relevant information, Jim advised that SARC was content to note their contents.

SARC noted the Directorate Risk Registers.

15. Stewardship Statements

Jim invited Directors to highlight any issues from their governance statements.

Gareth McGrath advised SARC that there was a high level of staff vacancies in the Parliamentary Services Directorate. A general discussion around vacancies took place and Gareth stated that the process to fill those vacancies had started.

Lesley added that when normal business had resumed in January there had been 50 vacancies, but with the additional work coming from the New Deal New Approach that figure had risen to approximately 80. There was a general discussion about the wider labour market and the Assembly Commission’s efforts in attracting suitable candidates.

Richard Stewart provided SARC with an overview of his Stewardship Statement.  He highlighted additional cyber-security risks associated with cyber crime during the COVID-19 pandemic, such as bogus invoicing, and advised SARC that staff were provided with regular reminders to ensure that they remained aware of the risks and remained vigilant in validating the source of invoices received.

Tara advised that the main issue in the Legal, Governance and Research Directorate was that all staff had been working from home for the majority of the time since 24 March 2020 because of the COVID-19 pandemic and she commended staff for the professional way in which those working from home arrangements had been expedited and put in place. She also advised that the staffing issue highlighted in the Stewardship Statement in relation to Internal Audit staffing had now been resolved.

16. Draft SARC Annual Report and Self-Assessment

Jim presented SARC’s Annual Report and Self-Assessment and invited comments. Everyone agreed that they were content with the contents of the report.

Action: Report to be presented to the Assembly Commission and then published on the website.

17. Key Guidance from Department of Finance

SARC noted the key guidance that had been issued by the Department of Finance since the February 2020 SARC meeting.

18. AOB

There were no other items of business.

19. Date of Next Meetings

It was agreed that the date of the next meeting would be confirmed once there was a clearer indication of when the Report and Accounts for the year ended 31 March 2020 would be ready for final review, prior to certification.

The meeting ended at 3.40pm