ARAC minutes - 10 March 2026

Present

Chair’s welcome, apologies, and declarations

The Chair welcomed everyone present, especially staff observer AH and additional auditor colleagues ERD and IB.    

EF reported that SHR Board approved appointment of DJ as ARAC Chair from 1 April 2026.  ARAC noted PC has offered an introductory discussion with DJ following her appointment.   

ARAC noted apologies from Nicola Kane (NK), SHR Business Support Officer.   

There were no declarations of interest.

Minutes of the previous meeting, matters arising & audit log

ARAC considered and approved the minutes from the last meeting on 9 December 2025. 

ARAC considered and noted the matters arising report and the audit recommendation status log. 

Internal Audit Progress Report

IB, LC and PC presented an update on internal audit work.  

LC highlighted key strategic messages around:

• a public sector continued professional development event hosted by the Director of Internal Audit who is also the head of profession for the public sector in Scotland.  She explained that assessment tools find an overall high level of maturity for the profession in Scottish Government;
• changes to the Scottish Government Director General (DG) structure that now aligns Internal Audit with the DG Exchequer, Strategy and Performance, but that the reporting line into the Scottish Government’s Audit and Assurance Committee and Permanent Secretary remains;
• a counter-fraud toolkit and how it is being used in DG Economy;
• a thematic insight report on cyber security and resilience, noting SHR welcomed it and will consider this when looking at the outcome and recommendations from the ongoing Internal Audit review.  It also noted that Internal Audit would welcome feedback to inform future reports and that it will produce a further version for sharing in the public sector.  ARAC agreed this could have useful messages for social housing landlords; and
• external five yearly quality assessment work that was recently completed on Internal Audit and reported to the Scottish Government’s Audit Committee, noting this will be shared with ARAC. 

ARAC noted the strategic updates.  It discussed training links for Board members highlighted in the report, agreeing to highlight these to SHR Board members via the ARAC minutes and potentially consider as a future development session.

PC presented an audit review of serious concerns.  He explained that he considered the process, controls and governance and the outcome is a substantial assurance rating with one medium rated recommendation, which is in two parts.   PC explained the first part relates to an update to the Internal Procedure Note and the second is a system adjustment to fit with the response target.  CN confirmed work is ongoing around both recommendations with the aim of completing them by the end of March 2026 subject to IT supplier capacity. 

ARAC discussed capacity to flex SHR’s systems to fit with differing targets.  It noted that as part of SHR’s ongoing review of its operating model sustainability of all targets will be considered, so there may need to be further system changes. 

PC confirmed follow up work will be scheduled to review the actions in response to the recommendation during 2026/27.  

ARAC thanked PC and welcomed the substantial assurance reported.

PC presented the annual Internal Audit Plan.  He explained that it is flexible and can be updated during the year.   PC explained that the plan is the outcome of discussions with SHR and horizon scanning carried out by Internal Audit, including reference to the Risks in Focus report previously circulated.  PC reported that the plan covers two activities, one an advisory on SHR’s operating model review and the other focussed on risk management.  He explained the background to the risk management work and ARAC noted SHR Board has asked DJ to take forward a review of SHR’s approach to risk management.  It noted that the Internal Audit work will involve discussions with Board members to understand the breadth of perspectives around presentation and understanding.

LC explained that once approved by ARAC then Internal Audit will work with SHR Management to agree plan timings and this will be considered alongside wider client resourcing.   ARAC noted that advisory work can be broken up into stages to fit with SHR’s needs and that plans can be amended to fit with any change in risk or priorities.  ARAC agreed it would be useful to have the risk work inform the operating model review and there may be a need for some work to take place in parallel.   It noted the high-risk scores currently and agreed to discuss this further under item five.  

ARAC thanked Internal Audit colleagues and approved the audit plan subject to timing arrangements .

Action: PC to implement the Internal Audit Plan and agree timings with SHR Management, including engagement with SHR Board members. 

External Audit

ERD presented Audit Scotland’s annual audit plan for 2025/26.  She highlighted materiality levels for audit, explaining this has been set at 2% of the benchmark which is gross expenditure.  ERD also reported that like all public bodies fraud caused by mismanagement is identified as a potential risk and will be considered alongside wider scope and best value topics covering financial sustainability.  ERD highlighted the audit timeline and reported that the recently completed interim audit found no control weaknesses.  

ARAC welcomed the interim audit findings.  It noted and approved the audit plan.

IM reported that Audit Scotland is currently consulting on a review of the Code of Audit Practice and this includes proposals that would impact smaller bodies.  ARAC agreed to consider SHR’s input further with IM by email.  

Actions: 

• ERD to implement to 2025/26 audit plan.
• IM to provide ARAC with further information on Audit Scotland’s review of the code of audit practice by email.   

Risk Register

IM presented SHR’s risk register to ARAC.  He explained that this was the same register recently provided to SHR Board on 24 February 2026, but that it had been reviewed monthly by Management Team since ARAC last considered risk in December 2025.  IM highlighted an upward trend in scores, following clarification of SHR’s budget settlement.   He explained that the ongoing review of SHR’s operating model is the key action to address this.

ARAC considered the risk register. In a wide-ranging discussion:

• it noted the high scores and discussed what assurance it and SHR Board need around mitigation actions; 
• MC explained the forthcoming review of SHR’s operating model. He detailed that both the strategic review and the 2026/27 operating plan aim to ensure sustainability with wellbeing and supported staff contributions being a key priority. He noted that MT will seek to manage the short-term capacity risk by reducing the volume of normal business and as well as freeing up resources to carry out the operating model review.
• ARAC discussed gross and net risk and what is acceptable subject to mitigating actions.  It noted that SHR has used several different risk management models over the years and previously considered the value of each before arriving at the current approach. It noted that SHR Board has requested a review of the current approach to risk management, which will be supported by Internal Audit. 
• MC reported that the key risk for SHR is a lack of resources to continue with the current operating approach and explained that the  only treatment is change, which is likely to mean that a higher level of risk will need to be tolerated.  ARAC noted the challenges. 
• ARAC discussed the issues identified to most likely lead to risks crystalising as set out in the current register.  It noted that the introduction of the 35-hour working week took place around  18 months ago and discussed at what point this should no longer be reflected as an issue.  More broadly, ARAC agreed it would be useful to have further clarity around when actions have mitigated successfully so that issues can be removed. 

IB welcomed the ARAC discussion and noted that this reflected that it is clear a great deal of mitigation work is already happening and risk is being actively considered by SHR Board and Management and the risk register and operating plan are useful tools that are currently informing decisions. 

ARAC agreed that the Management Team is working hard to mitigate risks to SHR and that the risk review is primarily about the presentation of information to the Board. 

ARAC also discussed to the risks of a potential insolvency of a social landlord and how SHR would respond.

ARAC thanked IM for the comprehensive risk report and welcomed the discussions it generated, especially ahead of the Internal Audit work on risk management.  and the benefit for Internal Audit in participating ahead of audit work.  It noted the high-risk scores and concerns for staff wellbeing.  ARAC also noted the layers of mitigation work ongoing to address both short and longer terms risk and their complexity.  It welcomed work plans to review SHR’s approach to risk management and future opportunities for ARAC input. 

Assurance Mapping

IM presented a six-monthly review of SHR’s assurance map, explaining that Management Team recently considered it and had not identified any gaps, but had noted an upward trend in risks.  ARAC considered the Assurance Map and discussed with those present:

• if there are any gaps in assurance controls and risk mitigation.  ARAC noted that that the reduction in SHR’s budget is a strategic circumstance that is out with SHR’s control and that it requires a strategic response from SHR to address;
• how assurance mapping details the assurance that the Board receives around normal activity and the current situation is a shift in SHR’s strategic context, which requires a strategic response to the specific budget circumstances;
• rising risk in the social housing sector and the challenges of how SHR responds with less resources;
• the review of the operating model and how that will need to include testing if SHR can continue to sustain all the assurance controls mapped out, noting the output of next six-monthly review of the assurance map might be quite different; and
• escalation to core Scottish Government if risks to regulated bodies materialise, noting the input from Scottish Government varies depending on the issue and different teams can bei involved and/or resources for the failing or rescue organisation and this has been handled on a case-by-case basis rather than through formally established routes.

ARAC thanked IM and noted the assurance map. 

Review of Fraud, Bribery and Whistleblowing policies

IM presented updated review of:

• Anit-fraud policy and response plan;
• Anti – bribery policy; and
• Whistleblowing policy.

He explained the process for recommending these to the Board for approval in March 2026.   IM reported that there are minimal changes to the Anti-fraud and Bribery policies, but that the Whistleblowing one has been updated to align with the Scottish Government’s approach and that staff training will follow. 

ARAC considered the reviewed policies.  It asked IM to check the Fraud Response Plan to ensure that it refers to  the Fraud Response Officer and not  IM .     

ARAC agreed to recommend the policies to SHR Board for approval in March 2026. 

Action: IM to make a minor correction to the Fraud Response Plan and submit all the policies for approval to SHR’s Board in March 2026 with ARACs recommendation.

Agenda Planner & AOB

ARAC considered and noted the agenda planner. 

AH welcomed the opportunity to observe ARAC and provided feedback on her experience. 

There were no matters raised under AOB.

Private session

ARAC held a private meeting with the auditors.