Minutes of Proceedings

Download as PDF

Assembly Commission Audit and Risk Committee (ACARC) 

Wednesday 13 May 2026 at 3.00pm

Room 106

Agreed

Present:

David Murphy, Chairperson

Ivor Johnston, Independent Member

Dónall Curtin, Independent Member

In Attendance:

Lesley Hogg, Clerk/Chief Executive

Gareth McGrath, Director of Parliamentary Services

Tara Caul, Director of Legal, Governance and Research Services

Karen Steele, Deputy Head of Finance (Secretariat) (Item 8)

Suzanne Murphy, Deputy Head of Finance (Members) (Item 8)

Nathan Lynch, Information Standards

Conor McGeown, NIAO

Stephanie McKevitt, NIAO

Helen Smyth, EY                                                                                               

David Murphy commenced the meeting at 3.05pm and formally welcomed all those

in attendance.

1. Apologies

Apologies were received from Nuala McAllister, MLA, Steven Baxter, Director of Corporate Services, Paula McClintock, Head of Finance, and Pauline Poots, EY.

2. Declaration of Interests

No interests were declared.

3. Minutes of Previous Meeting

The minutes of the previous meeting, held on 18 February 2026, were agreed, subject to amending the date for the expiry of the Internal Audit Contract to 27 July 2026.

4. Matters Arising

Internal Audit rationale for deprioritisation of the Reviews of Equality and Good Relations and Staff Pensions.

Helen Smyth noted that the Internal Audit Strategy and Value Charter 2025/26 Year 3 Update had been agreed by ACARC at its meeting on 12 June 2025, and that she had circulated an email to ACARC members outlining the rationale for changes to the Internal Audit Plan.

Letter of Delegation from the Assembly Commission to the Clerk/Chief Executive

Lesley advised that she had provided a copy the Letter of Delegation from the Assembly Commission to her, as Clerk/Chief Executive, to ACARC members on 17 April 2026.

ACARC considered and noted the matters arising.

5. Internal Audit Activity Update

Helen summarised the Internal Audit Activity Update Report, noting that four audit reports had been completed since the last meeting. She stated that two reports were outstanding; the Review of Business Continuity Planning which was awaiting management responses, and the Annual Follow Up Review of Outstanding Recommendations which was in draft pending resolution of some queries.

Helen provided an overview of key findings from the four completed audit reports, namely Review of the Office of the Examiner of the Statutory Rules;  Review of Information Management: Data Protection and FOI; Review of Roof Remediation Works; and Review of Members’ Costs, Winding Up Costs and Financial Assistance for Political Parties (FAPP),  noting that all had received a satisfactory rating.

Helen noted that the Office of the Examiner of Statutory Rules was a very well-run office and outlined the three priority three recommendations. Tara Caul welcomed the recommendations and noted that work has begun on implementation.

In the Review of Information Management: Data Protection and FOI, Helen advised that four priority two and three priority three recommendations had been made. Dónall Curtin sought and received clarification on the time taken to respond to requests and also requested further information about FOI procedures. Tara advised that as part of the ongoing work to address the Internal Audit recommendations, the FOI procedures are being reviewed and that an update on this work would be provided to ACARC members before the ACARC meeting in October 2026.

Regarding the Review of Roof Remediation Works, Helen noted that the audit focused on governance, document management and project management methodology, with four priority two and one priority three recommendations made. She added that the success of the project relied upon the operation of the Project Board.

David asked about the frequency of Project Board meetings and the role of the Project Board. Lesley advised that the Project Board meets monthly and is responsible for the delivery of the project, and that strategic decisions are made by Senior Management Team and the Assembly Commission.

Lesley noted that PRINCE2 is the Assembly Commission’s project management methodology, and that the Project Manager was PRINCE2 accredited, but that exploratory work is being undertaken as to whether this is the most appropriate methodology.

David asked why the roof repair project was not originally included on the CRR. Lesley advised that the roof defects were initially routine project defects and it was only when it became apparent that the issues were not being resolved in a timely manner and legal action was being considered, that the risk was added to the CRR.

In the Review of Members’ Costs, Winding Up Costs and Financial Assistance for Political Parties (FAPP), Helen noted that no errors in processing or application of guidelines had been identified and that one priority two recommendation had been made

David queried whether the new Finance system would improve efficiency. Lesley confirmed that the new system would make significant efficiency savings compared to the current labour-intensive process, with the added benefit of a budget reporting function being accessible to Members.

Helen advised that the two outstanding reports would be finalised and issued upon resolution of queries and receipt of management responses. She added that the Annual Assurance Report had been drafted; that noting no control weaknesses had been identified; and that a provisional satisfactory rating had been awarded subject to the finalisation of outstanding reports.

David noted that finalisation of the ACARC Annual Report is dependent on receipt of the opinion in the Annual Assurance Report, and that it could be agreed by correspondence upon receipt of the Annual Assurance Report.

Dónall queried when the outstanding reports would be completed. Lesley advised that management responses for the Review of Business Continuity Planning were being drafted, pending the return of the Director of Corporate Services, and would be finalised by the beginning of June. Lesley advised that the assurance rating was satisfactory.

David asked for Internal Audit to provide a draft three-year plan at the next meeting, expressing the preference that audit work is started earlier in year to avoid a backlog of reports at the end of the year.

Action: Tara to send an update on FOI procedures to ACARC members before the October 2026 ACARC meeting.

Action: EY to provide draft three-year plan at next meeting.

ACARC considered and noted the Internal Audit Activity Update.

6. Internal Audit End of Year Report

The Internal Audit Annual Assurance End of Year Report was deferred to the June 2026 Meeting.

7. Outstanding Audit Recommendations Schedule

The Outstanding Audit Recommendations Schedule was deferred to the June 2026 meeting.

Karen Steele and Suzanne Murphy joined the meeting

8. Draft Annual Report and Accounts for the Year Ended 31 March 2026

Karen Steele presented an overview of the draft 2025-26 Annual Report and Accounts, noting that some third-party information was still outstanding.

Karen provided an overview of the draft figures and outlined the additional sustainability reporting requirements. She also advised that the option to value non-property assets was no longer permitted and that the Assembly Commission had to revert to Modified Historical Cost.

Karen asked that any comments on the draft Annual Report and Accounts be provided by 18 May 2026 to enable them to be considered prior to submission to NIAO.

Ivor Johnston thanked the Finance Team for their hard work on the draft Annual Report and Accounts. Lesley also recorded her thanks, noting the earlier completion this year and the significant additional requirements relating to sustainability reporting.

ACARC noted the draft Annual Report and Accounts for the Year Ended

31 March 2026 and that any comments should be provided to Karen by 18 May 2026.

Karen Steele and Suzanne Murphy left the meeting

9. NIAO Update on the Audit of the Financial Statements for the Year      Ended 31 March 2026

Conor McGeown noted that NIAO had commenced its audit of the Financial Statements and that there were currently no issues to raise with ACARC. Conor confirmed the Report to Those Charged With Governance would be presented at the next meeting.

ACARC noted the update provided. 

10. Corporate Risk Register

Tara summarised the changes to the CRR presented.

David queried if work had commenced on the installation of a partial Electronic Access Control (EAC) system. Lesley confirmed the supplier had been appointed and much of the equipment procured and work would be completed during the summer recess, to minimise disruption.

David queried if the replacement of IS Office policies and procedures, due by 31 March 2026, had been completed. Gareth McGrath confirmed all policies had been completed and are on the staff intranet.

Dónall asked if live testing of cyber security measures is planned. Gareth confirmed that a tabletop exercise supported by the National Cyber

Security Centre (NCSC) is planned during summer recess. Gareth also advised that the Assembly Commission works very closely with colleagues in other parliaments, Microsoft and NCSC on best practice; and that the implementation of the Security Operations Centre was critically important as the Assembly Commission is under constant cyber-attack. He noted that good progress has been achieved following a huge amount of work.

ACARC considered and noted the Corporate Risk Register

11. Directorate Risk Registers

Tara presented the Directorate Risk Registers and summarised the changes set out in the Risk Cluster Analysis. 

ACARC considered and noted the Directorate Risk Registers and Risk Cluster Analysis. 

12. Stewardship Statements

Directors presented their Stewardship Statements. 

Gareth noted the good progress made in recruitment within the Parliamentary Services Directorate; that key positions had been filled; and that resources were in place to adequately support the Assembly as the end of mandate approaches.

Tara also noted the good progress made in recruitment within the Legal, Governance and Research Services Directorate, but that there had been difficulty in recruiting a temporary Data Protection and Governance Officer and that a Legal Adviser was currently covering the essential duties of the DPO aspect of the post.

Lesley provided an update on the Corporate Services Directorate in Steven

Baxter’s absence, highlighting planned recruitment to a Strategic Planning/Corporate Reporting role and the planned implementation of the partial EAC system in summer 2026.

ACARC noted the Stewardship Statements.

13. Draft ACARC Annual Report and Self-Assessment

David presented the draft ACARC Annual Report and Self-Assessment noting that the Annual Report would be agreed by correspondence upon receipt of the Internal Audit Annual Assurance Report.

David suggested updating the chairperson’s foreword to reflect that the substantive audit work should be completed by 31 March each year, giving ACARC adequate time to consider the findings before completion of its Annual Report.

ACARC members considered the self-assessment and agreed its contents.

Action: David Murphy to circulate an updated Chairperson’s Foreword to the ACARC Annual Report to ACARC members.

ACARC considered and agreed the ACARC Annual Report and Self-Assessment, subject to finalisation following receipt of the Internal Audit Annual Assurance Report.

14. Risk Management Self-Assessment Checklist Action Plan

Tara presented the Risk Management Self-Assessment Checklist Action Plan, noting that one action relating to the IT recovery plan had changed from green to amber, to reflect the need to update the IT recovery plan to reflect updates in the technical environment.

ACARC noted the Risk Management Self-Assessment Checklist Action Plan.

15. NAO Cyber Security and Information Risk Action Plan Monitoring

Tara presented the Cyber Security and Information Risk Action Plan, noting that the next biennial review is due to be completed in Autumn 2026.

Dónall asked for an update to be provided by correspondence to ACARC on the two current overdue actions ahead of the next review.

Action: Information Standards to circulate update on outstanding actions to ACARC ahead of next biennial review.

16. Fraud and Bribery Self-Assessment Action Plan Monitoring

Tara presented the Fraud and Bribery Self-Assessment Action Plan Monitoring, noting that all actions are complete and the biennial exercise is due for completion again in Autumn 2026.

ACARC considered and noted the Fraud and Bribery Self-Assessment Action Plan Monitoring.

17. Fraud and Bribery

Lesley summarised the memo from Steven Baxter, noting that the matter referred to at the previous meeting did not meet the threshold for escalation under the Assembly Commission Fraud Prevention and Anti-Bribery Policy, and that there had been no fraud and bribery cases reported or suspected since the last meeting.

ACARC noted the update provided. 

18. Whistleblowing

Lesley confirmed that there had been no incidents of Whistleblowing since the last meeting.

ACARC noted the update provided.

19. Key Guidance from the Department of Finance

Lesley noted that since the last meeting there had been two DAO letters and two FD letters issued by DoF of relevance to the Assembly Commission, the impact of which were outlined.

ACARC noted the update provided.

20. Any Other Business

David noted ACARC Members preference to combine the pre meetings with the Internal and External Auditors for future meetings.

Action: Information Standards to facilitate joint meetings between Internal and External Auditors and ACARC Independent Members for future meetings.

21. Date and time of next meeting

A meeting date and time was agreed for the afternoon of 24 June 2026.

Helen Smyth left the meeting at 4.35pm.

22. Internal Audit Contract

Lesley noted that a 12-month extension to the EY Internal Audit contract had been exercised and agreed, effective 28 July 2026.

ACARC noted the update provided.

The meeting ended at 4.38pm.