ARAC Minutes - 10 December 2024

Present

Chair’s welcome, apologies and declarations

The Chair welcomed everyone present to the meeting, especially new ARAC member AA and staff observer SD.  ARAC noted apologies from Senior Internal Audit Manager for Scottish Government Louise Carmichael and Audit Scotland Audit Manager Sanya Ahmed. 

There were no declarations of interest.

Minutes of the previous meeting, matters arising & audit log

ARAC considered and approved the minutes from the last meeting on 10 September 2024. 

ARAC considered the matters arising and the audit recommendation logs and discussed the introduction of Oracle: the new HR and finance system provided by Scottish Government.  It noted this commenced as planned in October 2024, but that implementation issues experienced by all customers have diverted SHR resources, so related policy and procedures reviews will now take place in quarter four.  It noted that SHR staff are working through system process challenges with Scottish Government colleagues.   CN confirmed that year-end processes to close accounts will need to be worked through and that there may be further challenges, but as SHR is small in size with limited transactions it has managed to continue producing management accounts to date.   MC reported that SHR’s experience reflects that of all system uses across Scottish Government and delivery bodies.  ARAC also noted how the Oracle implementation features in SHR’s risk register.  

LY confirmed that Audit Scotland is aware of the challenges and that she will be discussing planning for audit work with CN/IM.  She also explained that to date SHR has had good controls in place, so this should support year-end preparations and resolution of any issues that emerge.  

ARAC noted that updated internal procedures for notifiable events are expected to be approved during December. 

ARAC noted the matters arising and audit action log. 

Internal Audit Update

PM presented an update on internal audit work to ARAC. He  explained that LC is attending another audit committee that clashes with SHR’s meetings and plans to attend alternate meetings.   PM highlighted items detailed in his report including:

• audit work completed to date and planned;
• key strategic messages form Internal Audit with a focus on the new Global Internal Audit Standards from January 2025;
• the quarterly Internal Audit bulletin, which includes reflections from the Director of Internal Audit, a spotlight on counter fraud services; and a report by EY on leadership considerations. 

He also highlighted work by the core Internal Audit team to consider the Oracle implementation and that that he has observed the challenges described by the SHR team elsewhere in the Scottish Government and in public bodies using the new system.

PM reported that work on business continuity and SHR’s office move will commence in early 2025 alongside early planning for 2025/26.   He also reported that a follow up review of notifiable events has been completed and that the agreed medium priority recommendation has been fully implemented.  Finally PM highlighted some training opportunities for ARAC members. 

ARAC considered the update and discussed:

• training opportunities, asking PM to provide more information on cost and themes and noting the link for members to register on the mailing list;
• External Quality Assessments, noting these are planned for Autumn 2025 to allow for the new Global Standards and that internal self-assessment is ongoing in preparation.  ARAC also noted alignment with the Chartered Institute code and public sector standards and the new Global Standards for Internal Audit;
• the network for Audit Committee Chairs, noting this is open to all of the public sector and welcomed that EF will seek to attend some future meetings, asking SW to share his contact details with organisers; and
• forthcoming work on SHR’s office move, noting that staff have settled in well.

ARAC noted the update report and thanked PM.  

Actions:

• PM to provide more information on training opportunities for ARAC members.
• SW to share EF’s contact details with the Audit Chairs network so he can seek to attend future meetings.

Risk Report

IM presented SHR’s risk register to ARAC.  He explained that the register is the same as that presented to SHR Board on 3 December 2024 and SHR Management Team is due to review it later in January 2025.   IM explained that since ARAC last considered it two risk likelihood scores had been increased (risks R2 and R9). 

IM also explained that there was a risk around Oracle recharges being introduced, but this has been paused until 2025/26.  MC confirmed there is growing pressure to recharge all services SHR receives from Scottish Government. He explained the historic context -  the agency-lite set up at establishment and the assumptions that related service resources were embedded in Scottish Government core with no cost to SHR in perpetuity. MC reported on his dialogue with current Scottish Government colleagues to explain both the agency-lite model and the financial implications for SHR of any future recharges.  

The Board considered the update on recharges and discussed:

• if there is any evidence of the establishment set up, noting this pre-dates the current SHR leadership team and for Scottish Government the context has moved on;
• scale of recharge, noting this is likely to be based on headcount, but that has not been clarified and that even a funded recharge could lead to overhead costs instead of savings; and
• SHR’s options in terms of service provision, noting that it could not fund procurement and contract management associated with service provision outwith Scottish Government. 

ARAC considered the risk register.  It discussed the narrative on risk changes in the cover paper and the changes indicated in the register, noting the register shows changes from the last review and that the cover report narrative covers changes since the last ARAC meeting.   It also noted the appended summary table of changes.

IM updated the Board on feedback from the November SHR Board meeting on the risk register.  AA set out his observations of SHR’s approach to risk as a new Board and ARAC member.  ARAC discussed:

• the importance of the SHR’s assurance map, noting ARAC will review this during 2025;
• the risk register, noting it is both a tool for Management and a source of assurance for the Board;
• how risk mitigation is set out in SHR’s operating plan;
• forthcoming membership changes in ARAC and the Board;
• development of the current strategy and register was with ARAC and SHR Board, noting the strategy was agreed by the Board in March 2024 with the next review due in 2027;
• the implementation of the strategy and the register, agreeing it is important to test effectiveness over time;
• SHR’s overarching risk, how the risk management approach has evolved over time and the work with Internal Audit on that;
• SHR’s Board’s quarterly review of the risk register alongside the corporate performance report and potential to review the presentation of information to the Board; and
• the prior experience of members as they encountered and became familiar with SHR’s approach to risk management.  

ARAC noted the risk register, welcomed the discussion and opportunities to continue tweak and fine-tune SHR’s approach over time. 

ARAC Self Assessment Approach

CN presented the outcome of ARAC’s annual self-assessment.  SW explained the approach. 

ARAC noted a comment around matters arising reports should be disregarded as these are in place already and was added by a member in error. 

ARAC considered the outcome of the survey and focussed on communications with SHR staff team.  It noted that while the assessment was mostly effective, it agreed that it was worth exploring what more could be done.  The Committee discussed:

• how ARAC can highlight risk management and mitigation work to staff;
• ARAC updates to all staff sessions, noting a new Board member rota for 2025 will be issued soon;
• staff observers, noting the positive feedback from Internal and External Auditors that it is unusual for staff observers to attend audit committees and that this suggests staff have a good awareness of ARAC as there are regularly taking up the opportunity;
• Board updates, noting the draft minutes are provided under the consent agenda and members can already if they wish discuss or highlight any topic covered by ARAC at Board meetings.  It also noted the annual statement on ARAC’s work to SHR Board and Accountable officer;
• previous scores for the same topic, noting that these are identical;
• agenda planner discussions and if ARAC could use these in the future to identify any key issues to highlight with SHR staff team & Board via the briefing sessions, intranet or summary email updates; and
• previous updates to the staff team from SW summarising ARAC’s work during each year.  

ARAC noted the outcome of the survey and agreed to consider the suggestions discussed for implementation during 2025.  

Action: SW/EF/CN to consider the suggestions discussed by ARAC around communicating with staff for implementation during 2025.  

Agenda Planner, AOB, observer feedback

ARAC considered the agenda planner for 2025.  It noted that the Internal Audit report on business continuity and SHR’s office move is likely to come to the June rather than March ARAC meeting.  ARAC noted the agenda planner. 

ARAC thanked SW for her work as Chair and noted that EF will take over the role from January 2025.

Private session

ARAC held a private meeting with the auditors.