Minutes of the Audit and Risk Committee – May 2019

First published

30 May 2019

Last updated

30 May 2019

COPFS Audit and Risk Committee

Present

  • Robert Tinlin, Non-Executive Director (Chair)
  • Vanessa Davies, Non-Executive Director
  • David Watt, Non-Executive Director

In attendance

  • Ian Walford, Deputy Chief Executive
  • Mark Howells, COPFS Director of Finance & Procurement (DFP)
  • William Wilkie, Audit Manager, SG Internal Audit
  • Jim Montgomery, Senior Internal Audit Manager, SG Internal Audit
  • Lindsey Miller, Deputy Crown Agent (Serious Casework)
  • Marlene Anderson, Head of Financial and Systems Accounting
  • Douglas Taylor, Head of Management Accounting and Planning
  • Esther Scoburgh, Senior Audit Manager, Audit Scotland
  • Gordon McAllister, Senior Auditor, Audit Scotland
  • June Campbell, COPFS Secretariat
  • Paulina Mejer, COPFS Secretariat

Apologies

  • David Harvie, Crown Agent and Chief Executive
  • Gillian Woolman, Audit Director, Audit Scotland
  • Pamela Wilkinson, Senior Internal Audit Manager, SG Internal Audit

Welcome

The Chair welcomed everyone to the meeting and introductions were made, for the benefit of the new member of the secretariat

Feedback on pre meetings

Non-Executive Directors (NXDs) had a general discussion with Internal Audit and External Audit teams.

Minutes of previous meetings – 7 February 2019

The minutes were agreed by the Audit & Risk Committee (ARC).

Declaration of interests

The Chair received confirmation from the ARC that there were none.

COPFS ARC Action Tracker

Action 1 is ongoing, as it relies on the COPFS Strategic plan to be finalised. Action 4 now closed, as it is now included in the Internal Audit Directorate (IAD) audit plan. Action 5 is ongoing, as following discussion it was agreed the IAD would consider a rolling strategic audit plan over a shorter time scale. Actions 6 and 8 ongoing. All other actions are closed.

Audit Action Tracker

Internal Audit Action Tracker – Summary of progress:

Audit title Recommendation Subject Status ARC response
ICT assurance 5 Business Resilience and Disaster Recovery Not yet fully implemented ARC to review at August 2019 meeting
Validation of KPIs 2, 4, 5 KPI strategy/source data/procedures Not yet fully implemented ARC to review at August 2019 meeting
Corporate processes 5 HR case management/payroll and finance budget/in-year forecasting software system to provide "one version of the truth" Not yet fully implemented ARC noted 12 month delay. Progress to be reviewed at August 2019 meeting
Information management assurance phase 1 1 GDPR Implemented Now business as usual (BAU) activity.
2, 3, 4 Project methodology/data handling policies/data breach logs Partially implemented ARC to review at December 2019 meeting.

External Audit Tracker (Audit Scotland) – Summary of progress

Subject Recommendation Status ARC response
Disposal of assets 1 Implemented Now Business As Usual activity – to be
raised as part of annual audit if applicable.
Development expenditure 2 Implemented Now Business As Usual activity – to be
raised as part of annual audit if applicable.
Digital Strategy 3 Implemented ARC to be advised of progress against
Implementation Plan at its August 2019
meeting.
IT capital projects - Governance/ Business cases 4 Implemented Now Business As Usual activity (BPIC
approve business cases).
Cyber security/resilience 5 Implemented Now Business As Usual activity. Any
instances will be reported to the EB. RMG
will monitor the risk management process.
Finance capacity 6 Implemented ARC asked that this be a standing item in the Finance and Procurement update paper
provided to each meeting.
Strategic financial planning 7 Pending Reassurance on the level of funding to be
made available to cover the significant
increase in employer’s pension contributions
had only been provided in the last week.
However, this does now allow COPFS to make progress on a number of fronts eg the
Strategic Plan, the Finance strategy, 2019-
20 budget allocations.

The Committee agreed most of the Audit Scotland outstanding action tracker items could now be closed.

Finance Report

In response to Action 6 on the External (Audit Scotland) Audit tracker the Director of Finance and Procurement Director (DFP) provided the Audit and Risk Committee (ARC) with a summary of staffing changes and associated risks in the 3 functions within Finance and Procurement.

DFP invited the Committee to note that:

Production of the Annual Accounts is in line with the Accounts Production timetable;

The 2018/19 outturn indicates small ‘cash’ underspend. This is subject to any adjustments required as part of the Audit Scotland Review;

The timetable for production of the 2019/20 annual accounts will specify the exact timing of the “window” for NXDs to review the annual accounts. The review with the NXDs of the structure of the accounts in December and the
narrative in early May will facilitate the short timeframe that will be available in late May – as this will only be around the financial figures;

Finance will submit an action plan in respect of the ideas and options put forward at the Non-Staff Expenditure workshop, to the June Resources Committee meeting.

The Deputy Chief Executive (DCE) spoke of the Finance Strategy, noting that this had been delayed due to budget negotiations with Scottish Government (SG). DFP confirmed that, as the situation was now clearer, we will be able to move forward with the Strategic Plan, Finance strategy and 2019-20 budget allocations.

SG internal audit update

IAD provided reasonable assurance on risk management, control and governance arrangements. An update was provided on all planned activity being completed, with the exception of Information Management Assurance Phase Two, which has been deferred until 2019-2020 at the request of Crown Office and Procurator Fiscal Service (COPFS). Confirmation was provided that all the recommendations were accepted and implemented. No fraudulent activity within COPFS has been reported to IAD within 2018-2019.

IAD commented on the Audit Report with Strategic Benefits Realisation Phase 1, with its action plan and all the updates on the recommendations provided within. Reasonable assurance was provided. DCE said that work is in hand to implement the recommendations by December 2019.

Audit Scotland

Audit Scotland provided ARC with a review of internal controls in financial year 2018-2019, concluding that appropriate and effective internal controls were in place for the key financial systems they have reviewed.

Audit Scotland thanked Finance and HR for their help with the above review.

Corporate Risk Register

The chair of Risk Management Group (RMG) provided ARC with a summary of recent progress and advised that further discussions relating to the Local Court Function Risk Register would take place in early July.

The chair of RMG spoke of the risks 4 and 7 in particular, providing an update of the controls in place and actions planned to reduce the risk score.

The chair thanked RMG for their report and highlighted how helpful the report was in terms of providing a clear sense of management of RMG.

Internal audit recommendations – KPI

Deputy Crown Agent (DCA) provided a brief verbal update on current situation within Specialist Casework Group and listed Key Performance Indicators (KPI) implemented following Internal Audit recommendations
(consultations took place before KPIs were set). DCA advised of the process in place for ensuring cases are dealt with within relevant timelines.

Action: DCA to provide statistics relevant to KPI progress at the ARC meeting in August.

Assurance map

DFP provided ARC with an overview of progress made so far in respect of refreshing of the Assurance Mapping arrangements in COPFS. ARC noted the updates provided and requested that further work be undertaken ahead of the next substantive meeting.

Action: DFP to undertake assurance mapping work and to report to the August ARC meeting.

Any other business

ARC noted the work that Finance had undertaken in respect of the National Fraud Initiative (NFI) and the report on NFI data matches, which confirmed no fraud or errors had occurred.

The chair thanked June Campbell for her service and valued support over the years and wished her well for the next chapter of her life.

Date of next meeting

The next meeting (which is for discussion of the COPFS and QLTR annual accounts only) will take place on 3 rd July 2019 in COPFS. The next substantive ARC meeting will be on 21st August 2019.

Sections in this page