Minutes of Proceedings

Assembly Commission Audit and Risk Committee (ACARC), minutes 19 February 2025.pdf (116.52 kb)

Assembly Commission Audit and Risk Committee (ACARC)

Wednesday 19 February 2025 at 2.30pm

Present:                   

• David Murphy, Chairperson
• Ivor Johnston, Independent Member
• Maurice Keady, Independent Member
• Nuala McAllister, MLA                                                                           

In Attendance:       

• Lesley Hogg, Clerk/Chief Executive
• Gareth McGrath, Director of Parliamentary Services
• Tara Caul, Director of Legal Governance and Research Services
• Steven Baxter, Director of Corporate Services
• Paula McClintock, Head of Finance
• Donna-Marie Clark, Data Protection and Governance Officer
• Karl Hedley, Information Standards
• Suzanne Jones, Northern Ireland Audit Office (NIAO)
• Laura Murphy, NIAO
• Pauline Poots, EY
• Helen Smith, EY

David Murphy commenced the meeting at 2.30pm and formally welcomed all those in attendance.

1. Apologies

None.

2. Declaration of Interests

No interests were declared.

3. Minutes of Previous Meeting

Ivor Johnston sought clarification regarding the budget period approved by the Assembly Commission and the Assembly Audit Committee.

Lesley Hogg confirmed that the reference to the 2025-26 budget was correct, and the budget had since been agreed by the Assembly in Plenary on 9 December 2024.

The minutes of the previous meeting held on 20 November 2024, were agreed.   

4. Matters Arising

David queried where issues relating to fraud and bribery fitted within the Internal Audit Plan.  

Pauline Poots noted that fraud and bribery was not specifically referenced within the Internal Audit Plan, and that it was considered as part of individual audits. She said that EY would be liaising with senior management in the coming weeks to agree a plan for 2025-26 and that it could be considered whether some audit days should be assigned to fraud and bribery specifically.

David sought clarification that ACARC members would also be given an opportunity to comment on the Internal Audit Plan for 2025-26. Pauline confirmed that she would be liaising with ACARC members.

ACTION

EY to arrange a meeting with ACARC members to discuss the draft Internal Audit Plan for 2025-26 before the next meeting of ACARC.

5. Internal Audit Activity Update

Pauline Poots noted that the Internal Audit Review of Corporate Governance Arrangements report had been finalised. Pauline provided a summary of the recommendations with further detail provided on the two Priority One recommendations, relating to independent oversight of the Assembly Commission and ACARC, including the management responses.

David asked Lesley Hogg to comment on the Assembly Commission’s management responses.

Lesley welcomed Pauline’s summary and noted that detailed consideration had been given to all recommendations by the Assembly Commission. She advised that the Assembly Commission was content that current governance arrangements are compliant with all legislative and regulatory requirements, as well as with best practice guidance.

Lesley added that the Assembly Commission was content that the existence of ACARC as an advisory committee, combined with the Assembly Commission’s ability to appoint specialist advisers is a proportionate approach to governance, however, as outlined in the management responses, the Assembly Commission recognised that steps could be taken to enhance and improve the governance arrangements and had therefore accepted a number of the recommendations in the Review, such as agreeing to the appointment of an additional independent member on ACARC.

Pauline then provided a background summary of the Internal Audit Annual Assurance Report 2023-24 to the ACARC independent members and advised that the report had been finalised, following the finalisation of the Internal Audit Review of Corporate Governance Arrangements.

Helen Smyth summarised the findings of the Internal Audit Review of Retention and Disposal and the Internal Audit Review of Building Services. She advised that both areas had achieved Satisfactory levels of assurance, with no recommendations being made.

Pauline added that remaining outstanding reviews in the 2024-25 Internal Audit Plan were underway and planned for completion by the end of March 2025.

David queried whether there were any implications from publication of the new Global Internal Audit standards. Pauline outlined that there were no direct changes, and that EY remained compliant. She said that while there might be subtle differences in the methodology, there was likely to be no significant change to the Internal Audit approach as the guiding principles remained focused on the three lines of defence, namely the Assembly Commission, ACARC and the Executive.

ACARC considered and noted the Internal Audit 2024/25 Progress Update Report and the Internal Audit Reports presented.

6. Outstanding Audit Recommendations Monitor

Donna-Marie Clark summarised the status of the outstanding audit recommendations.   

David sought updates on all red recommendations. Steven Baxter advised that review of the Finance staff structure had been delayed due to supplier staff absence, but that the report was expected by the end of February 2025.  

ACARC considered and noted the Outstanding Audit Recommendations Monitor.

7. NIAO Audit Strategy for the Year End 2024-25

Suzanne summarised the strands of the Audit Strategy for 2024-25 and outlined the proposed audit timetable.

Ivor queried if staffing issues in the Finance Office posed a risk to the deadline for production of the annual report and accounts. Paula confirmed that arrangements were in place to meet the audit timetable.

ACARC noted the NIAO Audit Strategy for 2024-25.

8. ACARC Objectives 2025-26

Donna-Marie presented the draft ACARC Objectives 2025-26.

ACARC agreed the draft ACARC Objectives for 2025-26.

9. ACARC Terms of Reference

Donna-Marie presented the ACARC Terms of Reference, as recently updated by the Assembly Commission, and asked whether ACARC members wished to propose any further changes for consideration by the Assembly Commission.

Ivor said that his preference was for bilateral meetings with Internal Audit and the NIAO. Lesley advised that the Terms of Reference set out the minimum requirement and that further meetings could be held as desired. David agreed that further additional meetings would be agreed on the basis of the meeting agenda and be held immediately before the ACARC meeting.

ACARC considered the Terms of Reference and agreed that no further changes were to be proposed to the Assembly Commission.

10. Corporate Governance Framework

Tara Caul noted the review of the Corporate Governance Framework had been paused pending the outcome of the Internal Audit Review of Corporate Governance Arrangements. She stated that all necessary changes had been made to align the Corporate Governance Framework with the revised ACARC Terms of Reference and Risk Management Strategy.

ACARC considered and noted the Corporate Governance Framework.

11. ACARC Cyclical Work Plan

Donna-Marie presented the ACARC Biennial Cyclical Plan for the period May 2025 to February 2027.

Pauline requested that the plan be amended to list the FAPP audit as an independent report, and that the reference to Internal Audit Strategy Review be amended to Internal Audit Plan.

Action: Donna-Marie to amend and circulate ACARC Biennial Cyclical Plan.

ACARC considered and agreed the ACARC Biennial Cyclical Plan.

12. Corporate Risk Register (CRR)

Donna-Marie Clark summarised the changes to the CRR brought about by the zero-base review.

Lesley clarified that many of the risks presented were similar to the previous risks, but with a difference focus. She said that the most notable change was the removal of the risk regarding the 2025/26 budget, now that it had been agreed by the Assembly. 

ACARC considered and noted the CRR.

13. NAO Cyber Security and Information Risk Action Plan Monitoring

Donna-Marie presented the Cyber Security and Information Risk Action Plan.

Gareth McGrath confirmed that the Information Technology Security Officer (ITSO) post had been recruited on agency basis in the interim and that the postholder is expected to commence in the next few weeks.

ACARC noted the Cyber Security and Information Risk Self-Assessment and Action Plan.

14. Fraud and Bribery Action Plan Monitoring

Donna-Marie presented the Fraud and Bribery Action Plan.

ACARC noted the Fraud and Bribery Action Plan Monitoring.

15. Fraud and Bribery

Lesley summarised her memo to ACARC regarding the Review of the Use of Certain Allowances under the Assembly Members (Salaries and Expenses) Determination (Northern Ireland) 2016 and reported that specific aspects had been reported to the NIAO and PSNI in accordance with the Fraud and Bribery Policy.

Paula confirmed that there had been no reports of Fraud and Bribery since the last meeting.

ACARC noted the update provided.

16. Whistleblowing

Steven confirmed that there had been no reports of Whistleblowing since the last meeting.

ACARC noted the update provided.

17. Key Guidance from the Department of Finance

David noted that since the last ACARC meeting there had been one DAO letter and one Finance Director (FD) letter issued by DoF, the impact of which had been outlined in the covering memo.

Paula advised that these were routine cyclical correspondence relating to the preparation of the year end accounts.

ACARC noted the update provided.

18. AOB

Fraud and Bribery Policy and Response Plan

Paula apologised for the delayed distribution of her memo and summarised the changes to the Fraud and Bribery Policy and Response Plan.

Lesley suggested that, given the delayed distribution of the memo, ACARC members review the documents at their convenience and submit their feedback via correspondence to Paula. ACARC was content with this approach.

ACARC to consider the Fraud and Bribery Policy and Response Plan and submit feedback to the Head of Finance.

19. Date of Next Meeting

David asked that meeting dates for May and June be circulated and agreed.

 The meeting ended at 4.15pm