ARAC minutes - 8 December 2020

Present

Chair's welcome

The Chair welcomed everyone present to the meeting.

Apologies

Apologies were submitted from Mike Dailly, SHR Committee member and Nick Bennett, Audit Partner, Azets.

Declaration of interest

There were no new declarations of interest.

Minutes of the previous meeting, matters arising and audit log

ARAC considered the draft minutes from its meeting on 8 September 2020 and approved these as an accurate record of the meeting.

ARAC considered and noted the matters arising and audit action logs. It noted the matters arising actions from 8 September 2020 meeting had all been completed.  It discussed other outstanding items.    

SW has confirmed the current Code of Audit Practice continues to apply and Audit Scotland will engage with stakeholders around a revised code, which it is aiming to publish in 2021.  SW reported that she will follow up on this in early 2021. 

ARAC considered work plans around Best Value and workforce planning.  It noted these were now rescheduled to March 2021, noting that there are no statutory deadlines to meet.  IM explained this work may slip into 2021/22 due to resourcing pressures and other potential priorities.  ARAC discussed the benefit in delaying workforce planning work until SHR has more information on future budget settlements.  It agreed to revisit Best Value when considering the assurance map later in the meeting. 

Action: SW to seek update from Audit Scotland on plans for the Code of Audit Practice. 

Business Intelligence System Strategy update

RL presented an update on SHR’s business intelligence systems (BIS).  He outlined the context set by the BIS strategy 2020-25, explaining how this is aligned with the Scottish Government’s digital strategy and the key purposes. RL highlighted the benefits of cloud-first approach to software replacement.  He set out progress made to date since SHR Board approved the strategy in July 2020.  RL highlighted work plans for December through to February 2021, which will achieve significant strategy milestones and realise savings for SHR.  RL also explained upgrade work plans for 2021, confirming these are subject to availability of capital funding. 

ARAC considered his update and discussed:

• Digital First assurance, noting SHR provides regular updates to the Unit and that ITECS assisted SHR with digital security risk assessments as well as the Digital Unit being involved in contact review and preparation of tender documentation. RL also reported he is a member of the Digital Unit’s cloud community;
• the pace of work, noting this was intensive and there are challenges in satisfying the Scottish Government’s risk assessments, which are further complicated by its own ongoing digital transformation;
• keys risks, noting data and data privacy are the primary risks, but these would be a risk even if premise-based, as data centres are subject to attack and noting the importance of Cyber Essential Plus Accreditation for SHR, as well as adequate penetration testing. It also noted the complexities of working with multiple suppliers, and noted that SHR has excellent working relationship with its suppliers;
• capital funding, noting the business case that SHR has submitted to Scottish Government for future funding over the following two years.

ARAC thanked RL for his update presentation and noted progress.

Internal Audit

MH presented a progress update. She reported that fieldwork on complaints has been completed as well as the exit meeting and the draft report was issued on 7 December 2020 with substantial assurance and one low level recommendation. MH explained this should be concluded before Christmas

MH reported that delivery of the 2020/21 plan is on track and work will also commence soon to plan for 2021/22.  She explained that this will be informed by risk discussions.  MH also presented an updated MOU which was signed for SHR by the accountable officer - MC - and going forward will be reviewed annually.  She highlighted Internal Audit’s quarterly bulletin and risk in focus publication, which will also inform future audit work plans.  MH confirmed there is no follow up work to report on, as any recommendations were low le

ARAC welcomed the progress and noted that change to the MOU was only around the review timescales.  It asked for the accountable officer’s name to be added below his signature for clarity. 

ARAC discussed how it inputs into audit planning work.  It noted the role that the Chair has and that it meets with the auditors in private at the end of each ARAC meeting.   It agreed to hold an additional private meeting with the auditors early in 2021 ahead of considering the audit plans for approval in March 2021. It noted that it will need to feedback on any meeting outcomes to ensure this is captured in work plans.  

ARAC thanked MH and JM and noted the updates.

Actions

• MH to add SHR’s Accountable Officer’s name to the MOU.
• ARAC and auditors to meeting to discuss work plans in early 2021 and feedback on any outcome to ensure capture in the work plans that ARAC will formally consider for approval in March 2021.

Risk Management

CN presented SHR’s risk register to the Committee.  She highlighted that the register was last considered by SHR’s Management Team on 19 November 2020 and no scores had been amended at that point.  IM explained that the SHR Board will have an opportunity to carry out an annual review of all risks at a forthcoming workshop on 19 January 2021. 

MC explained since the MT discussion, Scottish Government has confirmed an in-year budget uplift for 2020/21 so this will impact risk R7 in the short term, but that there is still no clarity on future funding.  He confirmed that risk R7 has been trending up.

ARAC also discussed Brexit and agreed the January SHR Board workshop would be a good opportunity to consider any impact on SHR’s risk register. It noted for SHR it may be the consequences of Brexit that present the risks and that the Internal Audit’s risk focus publication is a useful contextual source of information at a macro level. 

Internal Audit reported it was assured by SHR’s approach to risk management and welcomed forthcoming risk register review plans.

ARAC noted the update on risk management. 

ARAC Terms of reference

CN presented ARAC’s terms of reference, reporting these were previously reviewed one year ago and that she is not recommending any changes.   CN confirmed that there is nothing within the terms to limit length of appointments to the Committee.  It noted that the minutes from ARAC form the report to SHR Board and the terms of reference will be appended in the February 2021 Board pack to allow for formal approval.

Action: SW to present the terms of reference to SHR Board for formal approval in February 2021.    

ARAC Self-Assessment

SW set out  findings of the recent self-assessment undertaken by ARAC. 

ARAC discussed communications with SHR staff, noting some similar themes to a recent Board survey.  SW agreed to prepare an update on ARAC work for staff and  invite staff to observe future meetings.   Members agreed to emphasise this in any blogs for staff.  ARAC also discussed member induction and agreed this should be tailored to the skills of any new member joining, as often they may have a lot of audit committee experience already and this can be handled through a meeting with the Chair.  It noted that the neutral responses around this were made by SHR staff members as Committee induction would not be applicable to them. 

Action: SW to prepare an update for staff on ARAC work and encourage observers.

Assurance Map

ARAC considered SHR’s assurance map.  It discussed the 

• review process, noting this is currently done annually and agreed to consider the map twice each year to ensure it is kept up to date; and
• Best Value as a source of assurance and agreed to add a comment to reflect that this work has been delayed until March 2021.

ARAC noted the assurance map agreeing it was very comprehensive.

Actions:

• ARAC to review the assurance map twice per year.
• CN to add a note to the map on Best Value work plans.

AOB - Agenda Planner

1. ARAC considered the agenda planner. It agreed to add in the assurance map in June and keep Best Value update for March

2. CN reported that meeting date proposals will be issued shortly.

3. MH reported that the outcome of the complaints audit would be provided by correspondence and she plans to report on the audit of the statutory managers list will in March 2021.

4. ARAC agreed there was no new areas for additional audit activity.

5. SW reported that she will discuss ARAC membership with SHR Chair, as MD retires from SHR at the end of February 2021.

6. CN explained plans to close the SHR ARAC Knowledge Hub group as ARAC now uses Objective Connect. ARAC agreed the proposal. 

Action: CN to close SHR ARAC’s Knowledge Hub group.

DONM

2 March 2021

Private meeting

ARAC held a private meeting with the Internal and External Auditors.