ARAC minutes - 6 September 2022

Present

Chair’s welcome, apologies and declarations

The Chair welcomed everyone present to the meeting, highlighting that this was the first meeting for CL.   ARAC noted that Audit Scotland had not yet assigned auditors to SHR, so there was no representation at this meeting, but that the allocation process is ongoing.  

There were no declarations of interest.

Minutes of the previous meeting, matters arising and audit log

ARAC considered the draft minutes from its meeting on 21 June 2022 and approved these as an accurate record of the meeting.

ARAC considered the matters arising and audit action logs.  It agreed to consider Best Value and Assurance Mapping under agenda planning.

SW reported that she will discuss future ARAC membership with SHR Chair. 

IM confirmed that he and CL are planning to  begin considering delivery options for a future workforce planning project in the coming weeks and highlighted the importance given the context of SHR’s budget position.

ARAC noted the updates.

Internal Audit Update

GG presented an update on Internal Audit work, highlighting that fieldwork is well underway for the Tenant Engagement review and that he will report on this to ARAC by December 2022.  He explained planning for the Cyber Security review scheduled for quarter four will commence during quarter three.

GG and JM updated ARAC on internal audit resources and reported that Karen Wilkinson who was assigned to SHR to work with GG and JM is leaving.  They assured ARAC that there are contingency plans in place to deliver SHR’s internal audit plan and new staff are joining the Directorate from September.

GG also highlighted the Internal Audit Annual report and Scottish Government’s Corporate Services Annual Assessment provided for information.  He explained the audit opinion for Corporate Services is “reasonable assurance” and this reflects the ongoing transformation work.  GG also highlighted a particular focus on fraud.

ARAC considered the update and discussed:

• cyber security, noting this is not mentioned in the Corporate Services report. JM and GG confirmed this is detailed in other Directorate reports such as Digital and agreed to provide further information for assurance;
• Internal Audit resource pressures, noting the long standing partnership arrangement with Ernest & Young, which is used to boost capacity; and
• fraud, noting the low risk around SHR’s financial transactions and plans to update SHR’s fraud incident recovery plan during 2022/23, which will be proposed to SHR’s Board for approval. JM encouraged SHR to liaise with Scottish Government colleagues when working to refresh SHR’s arrangements.

JM provided further updates including:

• on the Scottish Government Core Internal Audit plan, reporting that this includes a review of end to end controls around FOI requests;
• ongoing work around the Shared Services Programme including upgrades to financial systems and payroll. He flagged some deliverability capacity issues and explained that business continuity is to the fore – ARAC agreed the importance of this work, given SHRs reliance on many of these services;
• on the Information Commissioner’s Office (ICO) consensual audit of Scottish Government’s compliance with data protection regulations, explaining that the report is due at the end of 2022. He highlighted that this voluntary audit service is available based on risk and ICO capacity.

ARAC noted the updates, thanked GG and JM. It also agreed to note its thanks to Karen Wilkinson for her work with SHR.  

Action: JM to provide ARAC with further information for assurance on cyber security work with the Scottish Government.

Risk report

IM presented the risk register to ARAC. He explained that that this version was considered by Management Team on 11 August and provided to SHR’s Board on 23 August 2022. He highlighted changes made in relation to BI system upgrades and reported SHR’s Board received an update report on this at its recent meeting.  He also explained changes to risk R7 likelihood score, explaining that this was also discussed with SHR’s Board. 

ARAC considered the risk register and discussed:

• risk one, noting the previous discussion around shared services and that SHR is being represented at Scottish Government’s sessions around this, but that this transformation work is at an early stage and IM will keep it updated;
• how increasing risks to the sector may translate to risks for SHR. It noted the uncertainties and pace of change, including the Scottish Government’s Programme for Government, which may cover rent controls and the impact that could have on landlords and consequentially on SHR’s risk assessment and work plans; and
• Scottish Government’s budget update plans following change at Westminster, noting SHR may have to quickly reset itself in response.

ARAC asked Management Team to consider its feedback when it next reviews the register during September 2022.

 Actions:  Management Team to consider ARAC feedback when it next reviews the register during September 2022.

ARAC Self-Assessment Approach

CL presented options for self-assessment to ARAC.  She highlighted the previous rotation of methodology in alternative years and recommendation for a survey-based approach in 2022.  ARAC considered and discussed the source of the question themes.  It noted that these were drawn from the Audit Committee Handbook.  JM confirmed this had been reviewed recently with only marginal changes that would not impact the questions set out.  

ARAC agreed to proceed with a survey approach for 2022/23 and to complete this to allow for consideration at its meeting in December 2022.

Actions: CL to work with SW to survey ARAC members and report results to the December ARAC meeting.

Standing Orders Review

RH presented a review of SHR’s Standing Orders.  She highlighted updates and work to build in further resilience.  She also set out a proposal to look further at the voluntary deregistration procedures with a view to potential streamlining decision making and ARAC approved further exploration.

ARAC considered the Standing Orders and discussed:

• appeal panel arrangements, agreeing that it did not wish to recommend additional arrangements for the Board to deem certain decisions as low risk and choose not to put in place potential appeal panel arrangements for these;
• timescales for urgent Board business, agreeing there is sufficient provision and no additional clarification is required;
• comments from members unable to attend a meeting, agreeing that these could be received by the Chair or any acting Deputy for that meeting;
• increase the number of Board members to be contacted for an urgent business decision to at least three in addition to the Chair or whomever is deputising;
• provision for urgent ARAC business and consultation of the ARAC Chair, asking RH to clarify if this is covered by ARAC’s terms of reference;
• references made to Board members in the Orders, agreeing to standardise these replacing any reference to Non-Executive Directors; and
• to clarify the decision relationship with Scottish Government policy that impacts Board membership further.

JM set out provision in the Audit Committee handbook for external cooperative membership.   ARAC asked RH to confirm if this is applicable to SHR’s ARAC.

ARAC agreed to propose all the recommended updates to SHR Board with the addition or adjustments discussed.  It agreed for RH to further explore with Regulation colleagues the approach to voluntary deregistration decisions.

Actions: RH to:

• further explore the procedures around voluntary deregistration;
• clarify if the ARAC terms of reference covers provision for consultation with the ARAC Chair where an urgent decision is required;
• clarify if SHR is permitted to allow for externally coopted ARAC membership; and
• update the draft amendments to SHR’s standing orders to reflect the feedback from ARAC and propose this to SHR’s Board in October 2022.

Agenda Planner, AOB, DONMs & Effectiveness of meeting and papers

IM presented the agenda planner to ARAC.  He set out that range of staff changes that have happened and are ongoing in the Digital & Business Support group and new work for the Group that is impacting work plans.   He explained the capacity issues for delivering set piece work such as Best Value and highlighted that continued uncertainties for SHR provide further challenges.   ARAC considered the update and discussed Best Value.  It noted member experience of different approaches in other organisations and welcomed further information from SW.  It discussed the potential interest that Audit Scotland will have on how SHR delivers Best Value, noting that there could be different ways for SHR to demonstrate the duty aside from a set piece review approach. 

ARAC considered and agreed that there were no new matters for consideration for audit activity. 

ARAC discussed meeting dates and welcomed that SW and CL are working on proposals for 2023 dates.   ARAC agreed to aim to meet in person in December 2022, virtually in March 2023 and in person in June 2023.  

ARAC noted that BG will step down from ARAC and SHR Board in March 2023, so a new member would be required to join.  

ARAC discussed the experience of having two staff members on one video call to ARAC from SHR’s office.  It noted their own experience of using the office based technology and provided feedback on how that was received remotely. 

Actions:

• SW to share further information on different approaches to Best Value that she has encountered.
• CL to confirm forward meeting dates for 2023.

DONM

13 December 2022 - in person

Private Session

ARAC members held a private session with SHR’s Auditors.