Minutes of the Audit and Risk Committee – November 2019

Present

• Robert Tinlin, Non-Executive Director (Chair)
• Vanessa Davies, Non-Executive Director
• David Watt, Non-Executive Director

In attendance

• David Harvie, Crown Agent and Chief Executive & COPFS Accountable Officer
• Robert Sandeman, Accountable Officer for QLTR (AO)
• Ian Walford, Deputy Chief Executive
• Mark Howells, COPFS Director of Finance & Procurement (DFP)
• William Wilkie, Audit Manager, SG Internal Audit
• Pamela Wilkinson, Senior Internal Audit Manager, SG Internal Audit
• Marlene Anderson, Head of Financial and Systems Accounting
• Esther Scoburgh, Senior Audit Manager, Audit Scotland
• Paulina Mejer, COPFS Secretariat
• Carla Meechan, COPFS Secretariat

Apologies

• Lindsey Miller, Deputy Crown Agent (Serious Casework)
• Gordon McAllister, Senior Auditor, Audit Scotland
• Gillian Woolman, Audit Director, Audit Services, Audit Scotland

The Chair welcomed everyone to the meeting.

The Chair received confirmation from the ARC that there were no new ones.

The committee members met with Bobby Sandeman and the Crown Agent to be briefed on the work of the QLTR.

The minutes were agreed by the Audit & Risk Committee (ARC).

The Committee notes progress made with actions as reported by action owners. Actions 6, 7, 8 and 10 are now closed, while action 1-5 and 9 remain open.

The Committee noted the progress recorded on the trackers.

During the discussion, it has been agreed that there should be a review of how the outstanding Internal Audit (IA) actions are reported (with a view to harmonising how they are presented to the Committee). The aim of this is also to make clear when COPFS/IA have both agreed that an action can be closed and be clear on any areas of variance between COPFS/IA on whether or not actions can be closed.

Action: Internal Audit, DCE and DFP to review how outstanding Internal Audit actions are reported with a view to harmonising how they are presented to the Committee.

Further discussion is required between COPFS and Internal Audit to determine how best to take forward overdue Internal Audit recommendations relating to the KPI audit.

Action: COPFS and Internal Audit to determine how best to take forward overdue Internal Audit recommendations relating to the KPI audit.

Discussion between Internal Audit and the Crown Agent is required regarding the action that has been/can be taken in relation to the Internal Audit recommendation on Business Continuity Planning training requirements.

Action: Internal Audit and the Crown Agent to discuss the action that has been/can be taken in relation to the Internal Audit recommendation on Business Continuity Planning training requirements.

DFP spoke to his paper. He advised that the paper was intended to provide the Audit and Risk Committee (ARC) with a high level summary of the latest developments in Finance and Procurement.

• 2019/20 expenditure:

I. Running Costs

DFP confirmed the assumptions that had been built into the budget setting round and provided an update on each. The first full set of full year forecasts for 2019/20 were produced in October based on the actual expenditure to the end of September. These forecast an overspend of some £2.1 million.

DFP confirmed that there are a number of “levers” to allow spending to be brought back in line with the available budgets. However, following a substantive discussion at the October Resources Committee meeting it was agreed that the Heads of Business Management work with Finance to ensure that forecasts are as accurate, realistic and robust as possible. The Resources Committee agreed that contingency plans should be developed and submitted to their November meeting to bring forecasts back into line with available funding if the next set of forecasts continue to
indicate an overspend.

II. Capital

DFP advised that the current indication is that ISD and Estates could usefully utilise some £930k more than the available budget. This allows for the switching of any Running Costs underspend to Capital if money becomes available. However, committed expenditure will be capped in line with the available funding if it does not. Scottish Government (SG) have been advised of this in-year pressure/opportunity
but as yet feedback has suggested that additional funding will not be available.

III. Potential litigation costs

DFP advised that COPFS inevitably carries an on-going risk of litigation (civil and employment related) and that these are being monitored closely.

• Spending Review 2019:

DFP advised that the situation remains fluid [redacted] Scottish budget prior to Christmas. There is a strong preference to await a UK
[redacted].

The Lord Advocate is due to have a bilateral meeting with Mr Mackay on 20th November and the Cabinet is due to have a discussion on the budget on 26th November.

I. Beyond 2019/2020

DFP advised that confirmation of the 2020/21 budget will allow COPFS to refresh and republish the Medium Term Financial Plan (MTFP) and that finalisation of the Strategic Plan will allow refreshing and publishing of the COPFS Finance Strategy.

Robert Sandeman (AO) updated the committee on the work of the QLTR. Business volumes have risen over the year, along similar lines to previous years, and the office is in the process of tendering for new legal services under the Scottish Government’s procurement framework. Bids are expected to be received around mid-December, with an appointment made during the course of January.

The office has recently moved within the Scottish Government building, and the opportunity was taken to reduce rental costs by reducing the physical footprint. The team is in the process of reviewing the physical files, with a view to replacing them with digital only scanned versions, reducing rental costs further.

AO also explained that the work of the unit is increasingly aware of the wider external policy and operational environment; work is underway with Scottish Government to explore the issues raised by this. 

The Audit Manager for Internal Audit provided an overview of the recent progress report. Fieldwork for the Change and Project Management audit is complete and the draft report is with COPFS management for review. The fieldwork for the Workforce Planning audit is ongoing and fieldwork for the remaining 2019-20 assurance audit (Review of Information Management Arrangements – Phase Two) is due to commence in December.

2020/21 Internal Audit Planning is to be started in mid-December and meetings will be scheduled with relevant managers and COPFS ARC Members.

The Senior Internal Audit Manager provided a brief review of recent guidance on the use of assurance mapping and suggested that it might be useful background for the forthcoming meeting to discuss assurance mapping for COPFS. She offered to circulate the background papers to ARC members ahead of the meeting on 22 November.

Action: Senior Internal Audit Manager to circulate the materials ahead of the Assurance Mapping meeting.

The Senior Audit Manager presented an update on the final version of the IT audit report, following a review meeting with the Deputy Chief Executive in August 2019. The main changes involved some of the overly-ambitious deadlines for some of the recommendations to be fully implemented having been pushed back to allow full completion.

[Redacted].

[Redacted].

The Chair of the Risk Management Group (RMG) provided the Committee with his report covering the two most recent RMG meetings. He advised the Committee that the Group looked closely at the information management and data protection, focusing on articulation of controls and mitigating actions. The Committee thanked the Chair for his useful and comprehensive report.

Corporate Risk Register was discussed in terms of changes introduced, mainly scoring changes to the risk 7 and agreed plans to separating risk 4. The Committee also agreed that further discussion needs to take place in February 2020 in respect of risk 5, once the risk owner is present at the meeting.

The minutes of the recent RMG meeting were noted by the Committee.

Deputy Crown Agent (Serious Casework) was unable to attend. She had previously advised that she will provide the outstanding paper for the next meeting (in February 2020) and that she will attend the meeting in person.

Action: Secretariat to invite Deputy Crown Agent (Serious Casework) to the February 2020 meeting.

DFP confirmed that a meeting had been arranged for Friday 22nd November for the NXDs to discuss their requirements with the DCE, DFP and Head of Finance.

ARC self-assessment

The Self-Assessment document was compiled by a number of the stakeholders ahead of the meeting, with respective members adding their comments where they considered appropriate. It was noted that the members agreed on the majority of the points.

The Chair of ARC suggested that at the meeting on Friday 22nd November 2019 the
attendees discuss how to deal with gaps in the Self-Assessment document and get back to Crown Agent with their ideas.

Action: NXDs, DCE, DFP and Head of Finance to discuss how to deal with gaps in the Self-Assessment document and get back to Crown Agent with their ideas.

Audit Manager for Internal Audit advised that the Committee handbook will be reviewed within the next 18 months, so that might help in filling in the future self-assessments.

Fraud

The Committee discussed and agreed that in the future potential fraud issues should be added to the agenda for discussion.

Action: Potential fraud issues to be added to the agenda for future meetings.

The next meeting will be held on 26th February 2020.