ARAC Minutes - 11 March 2025

Present

Chair’s welcome, apologies and declarations

The Chair welcomed everyone present to the meeting, especially new Internal Audit Manager PC. Everyone introduced themselves.  ARAC noted this is the first meeting as Chair for EF. ARAC noted apologies from SHR Board member SW, who attended later.  

There were no declarations of interest.

Minutes of the previous meeting, matters arising & audit log

ARAC considered and approved the minutes from the last meeting on 10 December 2024. 

ARAC considered the matters arising and the audit recommendation logs. 

EF confirmed SW has shared details of the Chairs’ forum with him.   EF also reported that he will be providing an update on the Board and ARAC’s work at the April all staff briefing.  ARAC noted that SHR’s Chair highlighted to the all staff at the last briefing that observers are welcome. CN confirmed she will set up a meeting with EF and SW to cover any handover arrangements and discuss staff involvement further.  

ARAC noted that preparation of the annual report and accounts is ongoing with the audit taking place in June 2025.  It noted that the transition to Oracle will mean that the previous journal system will change to one based on purchase orders.  

ARAC also noted that SHR Board approved the proposed terms of reference in February 2025. 

ARAC noted the matters arising and audit action log. 

Action: CN to set up handover meeting for EF and SW and cover staff involvement with ARAC.

Internal Audit Update

PM presented an update on internal audit work to ARAC.

He highlighted items detailed in his report including:

• audit work completed to date and plans to conclude the review on Securing New Office Accommodation;
• the phased handover to PC, explaining that both will attend the next ARAC meeting in July 2025; and
• key strategic messages around information for accountable officers on the new Global Internal Audit Standards, the Internal Audit update bulletin and audit work connected to the Scottish Government’s new HR and Finance system - Oracle.

ARAC noted the updates and discussed the variety of internal and external audit work that is ongoing around Oracle.  PM and LY explained these further, including how duplication is avoided and that the assurance timeframes inform audits this year and also stretch into 2026. 

PM set out the draft annual internal audit plan proposals, explaining that these are risk based and draw from SHR’s risk register, horizon scanning and discussions with IM and EF.   PM detailed plans for two reviews covering business continuity / cyber security and also looking at regulatory serious concerns, as well as the normal engagement with ARAC and SHR staff and any required follow-up work from 2024/25. 

ARAC welcomed the audit plan and noted that PM will circulate a final version.

ARAC also discussed the transition planning for the Internal Audit Managers.  It noted that SHR has experienced a higher than anticipated turnover of managers and noted that some continuity remained at more senior and junior levels.   It welcomed that PS and PM have worked closely together for many years and will continue to do so in order to allow for knowledge transfer.   PC explained the phased transition further.  ARAC noted that both PC and PM have extensive experience working in regulated environments, primarily around European Structural Funds and that as that work has come to an end more resources are becoming available within the Directorate. 

ARAC noted the updates.  

Action: PM to circulate final internal audit action plan

External Audit Plan 2024/25

LY presented the external audit plan for 2024/25. She highlighted:

• the key risks identified around management override (which features in most public sector audits) and the implementation of Oracle.  LY reported on the interim audit work carried out recently and explained the work that SHR’s staff team has done to prepare for and to implement the new Oracle systems, but reported that despite this, there could still be year-end issues;
• significant wider scope risks including financial sustainability due to uncertainty around SHR’s future funding;
• the audit timetable, thanking ARAC for adjusting meeting dates to mid July for this year, explaining that in the future the audit timetable may be able to revert back to the normal cycle and that the new Oracle systems could help with this.   

ARAC noted the update and that there will not be a meeting in June 2025 as this has been rescheduled for 15 July 2025 instead.  

Risk Report

IM presented SHR’s risk register to ARAC.  He explained that the register is the same as that considered by SHR’s Board on 25 February 2025 with the quarterly corporate performance report.   He highlighted the upward score movements since it was last reviewed by ARAC and the discussions with Board and Management Team.  IM also highlighted a new appendix that accompanied the quarterly performance report to the Board, explaining that this maps out all SHR’s operating plan activities against each of the risks in the register.  

ARAC welcomed the inclusion of the new table, noting SHR’s work in relation to each risk.  It agreed it would be useful to have access to this on a regular basis .  It also welcomed the risk score changes log.  

ARAC considered the increase in risk 9 scores in relation to Scottish Government’s headcount controls.  It noted that SHR has had emergency spend controls in place since mid year to align to Scottish Government’s position and that further controls are expected to come into force that may apply to public bodies.  ARAC noted these controls may go beyond normal budget setting controls in place for non-core public organisations, such as SHR.  

ARAC also discussed:

• controls and measures to reduce risk scores, how this can be linked to an acceptable risk appetite or tolerance level;
• how SHR Board and ARAC to have oversight of risk appetite/tolerance and assess if enough mitigation action is in place;
• previous approaches SHR has applied in the past that attempted to quantify risk tolerance and that these were removed due to complexity, which was judged not to have enhanced risk conversations;
• SHR’s current focus on good quality informed conversations about risk at Management Team, ARAC and Board level and how these relate and inform any next steps;
• SHR’s risk strategy, noting that following review, the Board approved the most recent Risk Management Strategy just one year ago, but that ARAC could recommend changes;
• risks, noting some are outwith SHR’s control, in terms of being fully able to reduce the scores through mitigation activity;  
• the importance of SHR’s priorities and that any change proposals to the Risk Management Strategy should demonstrate value and best use of resources, noting these are already under pressure.
• how well the current approach works, agreeing it works well and informs the structured and focussed discussions at Management Team, Board and ARAC; and
• alternative approaches taken by other Boards, noting these include periodic risk appetite reviews that can be externally facilitated, which SHR may wish to consider in the future.

ARAC noted the risk register, welcomed the discussions and new appendices to the register.  

Assurance Map

IM presented SHR’s assurance map.  He highlighted that the six monthly review cycle with ARAC and the amendments, which reflect discussions from the last review in September 2024, some streamlining and feedback from a recent Management Team discussion, where no assurance gaps had been identified.  IM explained that the mapping approach sits alongside SHR’s logic model, Best Value work and Risk Management Strategy.  

ARAC considered the map and discussed:

• the layout, welcoming the amendments and agreeing these enhanced clarity; and
• a reference to regulatory case conferences, noting the purpose of these to challenge and determine next steps including statutory intervention, which involve officers from across SHR. It also noted the place of case reviews that regularly examine engagement approaches, including considering if any statutory action should be continued or ended. 

ARAC thanked IM, welcomed the presentation of the map in the current formal and noted the content.  

Agenda Planner & AOB

ARAC considered the agenda planner for 2025/26.  It noted that:

• the next meeting planned for June meeting has been rescheduled to 15 July 2025; and
• the Internal Audit report on securing SHR’s office accommodation will be presented to ARAC in July 2025.  

ARAC noted the agenda planner. 

Private Session

ARAC held a private meeting with the auditors.