Minutes of the Audit and Risk Committee – February 2020

Present

• Robert Tinlin, Non-Executive Director (Chair)
• David Watt, Non-Executive Director

In attendance

• David Harvie, Crown Agent, Chief Executive and COPFS Accountable Officer
• Robert Sandeman, Accountable Officer for QLTR
• Ian Walford, Deputy Chief Executive
• Mark Howells, COPFS Director of Finance and Procurement
• Pamela Wilkinson, Senior Internal Audit Manager, SG Internal Audit
• William Wilkie, Audit Manager, SG Internal Audit
• Amy Grant, Audit Manager, SG Internal Audit
• Esther Scoburgh, Senior Audit Manager, Audit Scotland
• Gordon McAllister, Senior Auditor, Audit Scotland
• Gillian Woolman, Audit Director, Audit Services, Audit Scotland
• Carla Meechan, COPFS Secretariat

Apologies

• Vanessa Davies, Non-Executive Director 
• Lindsey Miller, Deputy Crown Agent (Serious Casework)
• Marlene Anderson, COPFS Head of Finance
• Jim Montgomery, Senior Internal Audit Manager, SG Internal Audit

The Chair received confirmation from those in attendance that there were no interests that
needed to be declared.

The Chair confirmed that the Non-Executive Directors (NXDs) had met with Internal Audit prior to the meeting to discuss the Audit Plan and for a brief introduction to Jim Montgomery who will be taking over as Senior Internal Audit Manager. The NXDs also had a meeting with Audit Scotland prior to the meeting to discuss the contents of the 2019/20 Annual Audit Plan.

The Minutes from the previous ARC meeting were agreed by the Audit & Risk Committee (ARC).

The Committee noted the progress made with actions, as reported by action owners. Actions 2, 3, 4, 6, 7, 8, 10, 11, 14 and 15 are now closed while 1, 5, 9, 12, 13, 16, 17 and 18 remain open.

DFP apologised for the late issue of the following papers, which he accepted responsibility for:

• Assurance Mapping update – covered in Actions log;
• IAD action tracker – covered in Actions log;
• 2 x IAD reports.

Hard copies of all of the documents were provided at the meeting.

Assurance Mapping update – The DFP confirmed that ARC members were familiar with the Governance statement, which is underpinned by the assurances from the DCAs in the form of Certificates of Assurance (CoA) and Internal Control Checklists (ICC). He confirmed that the proposed Assurance Mapping framework was based on the sections in the ICC, broken down into 4 blocks of 4. The suggestion is that for each meeting, one block of four is reviewed with COPFS assessing, using a RAG status approach, the level of assurance for each of the 4 lines of defence against each element of the block, recording this on the heat map; then ARC members review the assessments and, if desired, requests a completed Interrogation Questionnaire to see the evidence that supports the RAG status assessments.

IAD Action Tracker – The DFP confirmed that the front page summary has been changed to show the status of each recommendation from each audit, colour coded: Green – Fully implemented, Amber – Partially implemented, Red – Not implemented and Purple (for IAD status only) where the follow up audit has not yet been undertaken. The DFP confirmed that the intention was to allow ARC members to focus on those recommendations where a follow up audit had been undertaken and any recommendations had not been fully implemented. However, he stressed that ARC members could ask for evidence on any of the recommendations.

The Committee noted the progress recorded on the trackers.

During discussion, it was agreed that Action 9, the CFR report to be shared with other agencies to encourage network improvements, would be reviewed at the August meeting.

Action: Update action 9 – To be reviewed at the August meeting.

From the discussion it was agreed that Action 17 would be updated and a meeting would be set up for May with NXDs, DCE, DFP and Head of Finance [redacted].

Action: Update Action 17 – meeting to be arranged for May with NXDs, DCE, DFP and
Head of Finance [redacted].

The Crown Agent provided an update to the ARC on the COPFS’ current and future plans, highlighting the moves to Windows 10 and confirmed the roll out will be between now and
August.

[Redacted]

The Crown Agent advised that there is a robust contingency plan in place in relation to the recent outbreak of the Coronavirus.

DFP presented his paper, advising that this was to provide the ARC with a high level summary of the latest developments in Finance and Procurement:

2019-20 budget monitoring

DFP explained that the 2019-20 forecasts currently indicate a [redacted] overspend excluding the movement in employee benefits (untaken annual leave). [Redacted]. The SG have confirmed that they will provide a letter
authorising an overspend to this level.

How COPFS intends to further enhance budget monitoring arrangements during 2020-21 and beyond

DFP advised that given the issues that have arisen this year and that budgets are becoming increasingly tight, steps have been taken to put in place a process that will allow almost real time costing of staff in post. This will be introduced from the start of 2020-21.

Efforts will be re-doubled to ensure that all non-staff expenditure is process via the P2P system

2020-21 budget setting

DFP stated that although there was an apparent significant increase in our overall running costs budget (£11.5m initially with a commitment of a further £3.2m in year), the vast majority of the money was needed merely to allow the organisation to consolidate its current position: [redacted]

[redacted]

Work is underway to produce a balanced budget before the start of the financial year.

It was noted that there will be a new IT Procurement Business Partner joining the Central Procurement Team on the 1st April taking over from the contractor who is currently covering this role and that Finance had been operating with 3.5 FTE vacancies out of a total of just over 12 (circa 30%) for several, very busy, months including an intensive Spending Review process. Although all but one of the posts had now been filled, it will take time for staff to get up to speed and, in the meantime, the new Head of Finance has had to take extended annual leave at short notice.

Robert Sandeman (RS) updated the Committee on the work of the QLTR. He advised that by the end of the 19/20 financial year QLTR will have paid [redacted] over to the Scottish Consolidated Fund.

He advised that QLTR are strengthening resilience and potential capacity. They will soon appoint Anderson Strathern as external legal advisers after a recent procurement exercise had been carried out.

RS confirmed that QLTR had strengthened processes:

1. Where they receive money from solicitors who cannot trace their former clients. They have worked with the Law Society to produce new guidance for solicitors; this is working well; and
2. Where they are dealing with land. In this regard:

QLTR are strengthening their relationship with Revenue Scotland and with HMRC, and have referred one case to them which they are currently investigating.

QLTR are members of the Scottish Government’s land reform network, and have started a discussion with other agencies about steps that might be taken to improve corporate
responsibility when winding up companies to avoid land being “dumped” on the State.

DH and RS had met with the Registrar of Companies for Scotland, [redacted], in January; and are due to meet the Keeper of the Registers of Scotland, [redacted], in April. RS has also met with the head of Compliance at Revenue Scotland, [redacted], who is actively investigating a case initially referred to QLTR.

RS is due to speak next month at SOLAR’s (the Local Authority Lawyers’ Association) annual conference, about QLTR work.

[Redacted]

The District Valuer Service are reviewing their processes for valuing land referred to by QLTR: to increase transparency around charging and the valuation process itself, and to build in a new procedure to allow interested third parties to put submissions about valuation to them as part of that process. RS envisages issuing an interim report, at which point submissions would be made, and then a final report.

Anticipating that QLTR may need to share data more regularly with other agencies, RS has carried out a review of QLTR’s data arrangements against the requirements of the new GDPR and Data Protection legislation, and published ICO guidance. RS has also prepared
a DP Assessment document which they will review annually and also updated the QLTR’s
privacy statement online.

Action: QLTR AO to provide a copy of the revised QLTR Risk Register for the next ARC meeting.

WW provided an overview of the recent Progress Report. Since the last update to the ARC in November 2019, Internal Audit have completed a further two of the four planned Assurance Audits from the 2019-20 Internal Audit Plan. The Internal Audit Plan is progressing well, with three reviews now complete and it is anticipated that all planned Internal Audit work within the Crown Office and Procurator Fiscal Service (COPFS) will be completed by 31st March 2020.

The Audit Manager detailed the 2019-20 Internal Audit Plan and the four main assignments.

Main audit assignments

• Business Continuity Planning Arrangements;
• Change and Project Management Arrangements;
• Workforce Planning; and
• Information Management and Assurance Phase Two

Internal Audit carried out initial follow-up work in November 2018 and provided updates to COPFS management and ARC members on the status of the recommendations. Since then they have carried out a final follow up review in February 2020 and found that whilst significant progress has been made, three recommendations are only partially implemented. For two of the partially implemented recommendations the delay largely relates to the development of the COPFS strategy and the related refresh of KPIs. The delay in full implementation of one recommendation is due to the requirement for input and engagement across the wider Criminal Justice Network. COPFS management should determine the most appropriate method of implementing the recommendations and tracking the status and mitigating any outstanding risk relating to this in the meantime.

Internal Audit has now completed their planning process for 2020-21.

The Audit Manager also explained the proposed future Internal Audit work. The Crown Agent and NXDs found this very helpful as the plan is linked to the Risk Register.

It was noted that the Fair Futures project is now closed.

It was also noted that from the 1st April 2020 Jim Montgomery will be taking over as the Senior Internal Audit Manager (SIAM) for COPFS and the Chair thanked Pamela for all her efforts on behalf of COPFS and the ARC.

COPFS

The Director for External Audit provided an overview of the COPFS Annual Audit Plan report, providing details on the significant audit risks (which are outlined in the plan).

She explained that there were modest increases in the fees for both the COPFS and QLTR audits this year.

Action: NXDs asked that the Quality Control results are shared with the ARC, Audit Scotland to provide a copy at next ARC meeting.

Action: DFP to check dates are in the diary for NXDs to review accounts.

QLTR

The Senior Auditor from Audit Scotland provided an overview of the QLTR Audit Plan together with Risks and planned work. It was noted that ES is now the lead External Auditor for QLTR.

The DFP provided an overview of the Accounting Policies paper.

Action: NXDs asked that timescales are reviewed within note 1.9 Depreciation to determine whether ranges of Useful Economic Lives can be provided. DPF to review for the next meeting.

Action: NXD asked that the paragraph in note 1.45 Early retirement, be split in two.

Action: NXD asked that the figures in note 1.51 IFRS 16 to be changed to thousands instead of £s.

The DFP provided an overview of the progress that has been made to develop the format of the Annual Report and Accounts.

He confirmed that the Internal Communications team had been working closely with the Finance Team. However, the new formatting had only become available relatively recently, meaning that it had not yet been possible to make the changes that had been discussed at the December meeting with NXDs. DFP advised that he hoped that these would be completed in the next month. The Chair thanked the Finance Team for taking this forward and for their input at such a busy time in the financial year.

RMG Chair Report

The Chair of the Risk Management Group (RMG) provided the Committee with his report
covering the most recent RMG meeting, highlighting the risk relating to the relationship with [redacted] which is an area of development (Local Court Risk Register risk 13 and Corporate Risk Register (CRR) risk 6).

It was agreed that [redacted] will have specific risk implications and future consideration will be given as to how these are captured, including the implications for the Corporate Risk Register (CRR) by March 2020.

[Redacted]

There was discussion on how the corporate risk register might be refreshed following the finalisation of the new COPFS Strategic Plan. The current thinking is that a workshop will be held in the spring for NXDs and Senior Managers.

[Redacted]

The Chair noted that this standing Agenda item gave an opportunity for the COPFS ARC to learn from the work of other ARCs but there was no specific learning points at this time.

The Chair thanked Ian, Mark and Marlene for their input into the Assurance Mapping Framework. The framework’s format will be refined as lessons are learned from its practical
application. 

The next meeting will be on Friday 29th May 2020.