ARAC Minutes - 15 July 2025

Present

Chair’s welcome, apologies and declarations

The Chair welcomed everyone present to the meeting.  He highlighted that it was unusual for ARAC to take place during July and thanked everyone for attending.  ARAC noted apologies from AA who was experiencing technical issues and he would join the meeting as soon as possible.  

There were no declarations of interest.

Minutes of the previous meeting, matters arising & audit log

ARAC considered and approved the minutes from the last meeting on 11 March 2025.  

ARAC considered matters arising and the audit recommendation status log.  It noted that EF has had discussions with ARAC’s previous Chair around actions connected to staff engagement as part of their handover and that this is all in hand.  

ARAC noted the matters arising report and the audit recommendations status log. 

Internal Audit Update

PM presented an update on internal audit work to ARAC.

He highlighted items detailed in his report including:

• completion of the audit work planned for 2025 and the final report on the review on Securing New Office Accommodation;
• the latest Internal Audit Strategic Matters and Strategic Best Practice/Insight Sharing;
• Audit opinion on Scottish Government Core, including on the corporate systems used by SHR;
• the annual assurance report for SHR with a substantial assurance opinion; and
• an updated Internal Audit Strategy and Charter. 

PM also highlighted two best practice presentations circulated around early warning signs for public bodies and also an Ernest & Young thought leadership update.

PM reported that 2025/26 work planning has commenced with reviews scheduled for quarter three around reporting serious regulatory concerns and quarter four for business continuity and cyber security.

MC welcomed the best practice/insight sharing and reported on considerations by SHR to utilise these.  

PM explained the context for the review on securing new office accommodation and reported on the substantial assurance audit opinion with no recommendations.  He explained SHR had considered options rigorously and applied a due diligence process ahead of moving to co-locate with Social Security Scotland at High St.  He commended the timely communications with staff throughout the process.  PM reported this had realised £140K savings per year.  PM explained that by sharing with another public body, SHR is aligned with value for money and public service reform agendas.  

ARAC considered the update and discussed:

• the audit opinion for the review on securing new office accommodation, welcoming this and thanking IM who managed the office move; and
• positive feedback on SHR’s office arrangement gained through a recent survey of SHR staff. 

LC presented Internal Audit’s Annual Assurance report on SHR for 2024/25.  She highlighted the overall Assurant opinion for the year is Substantial. LC explained that the report sets out the basis for the audit opinion as well as the wider control environment and work SHR does, including the assurance provided to it.  

ARAC considered the report and discussed follow up work around one recommendation in the de-registration of RSLs review report, noting that at the time of field work this was not completed.  IM confirmed that this had not been completed in 2024/25 and has subsequently been completed and guidance updated.

ARAC welcomed the Annual Assurance report and the related audit opinion.  It thanked all of the Internal Audit team and the staff team at SHR for their work 

ARAC noted all the Internal Audit updates.  

External Audit Plan 2024/25

LY presented on Audit Scotland’s 2024/25 Annual Audit Report.  She detailed the challenging context for the audit, including the introduction of Oracle as the new financial system during the year, the transition to the new system and how the associated workload had resulted in the audit being held later in the year to allow for preparation.  She reported that SHR is in a better place than some other public entities who have also transitioned to using Oracle.   She explained that due to this context as well as timing and sickness absence the audit was more challenging for all involved and included running new reports and checks. 

LY highlighted:

• the ISA580 letter for SHR’s Accountable Officer included in the meeting papers and the unmodified audit opinion; 
• a small amount of outstanding testing that is expected to be completed that week.  She also reported that pension information remains outstanding that is out with SHR’s control;  
• that due to outstanding testing and pension information, the Audit Report is in draft and comments can be added and if this occurs it will be recirculated; and
• the one recommendation to continue embedding and to explore the functionality of the new Oracle system.  She reported on the current stress on the system due to newness.  LY also highlighted the significant preparation work that SHR did to prepare for the Oracle transition and how the management accounts processes continued and provided assurance, including helping to correct any mistakes that emerged; and
• the Best Value arrangements SHR has in place; and
• arrangements in place to monitor work related to scrutiny by the Scottish Parliament’s Local Government and Housing Committee.    

LY thanked IM, CN and all the SHR staff team involved in the audit for their support during a challenging year. 

MC echoed the challenges that LY set out around the Oracle transition and reported that many continue, while SHR manages business as usual alongside the transition.  He also set out his appreciation for the commentary on the financial sustainability explaining that LY’s comments are helpful. 

ARAC considered the report and MC’s comments and discussed confidence in the Oracle systems, noting that LY found that due to SHR’s small size and approach to management accounts that is closely tracked and followed up she is fairly confident that SHR has a good understanding of spend.  She also reported that most costs are associated with staff and that SHR had good controls in place.  ARAC welcomed the feedback. 

ARAC also discussed planning for future budgets given the expected challenges, noting that SHR has a clear plan in place for the current year and is managing vacancies to achieve reductions and that it is anticipating coming in on budget.  MC reported continued uncertainty around pay increases and National Insurance contributions and the assumptions that SHR has made.  It also noted that Scottish Government is planning a spending review for December, with the ambition of a multi-year budget and that makes longer term financial planning very difficult.  MC reported SHR has good financial projections and tools to help it understand the impact of the review.  

LY confirmed as part of the annual audit process she will meet with SHR to discuss any lessons learned to improve the next audit. 

ARAC thanked all involved in the audit and noted the outcome and work still to be completed. 

Draft Annual Report & Accounts

CN presented SHR’s draft annual report and accounts for 2024/25, explaining the input from colleagues across SHR.  CN explained that the outstanding pension information may not come to SHR until 31 August 2025 and if this is the case arrangements will be put in place to allow the report and accounts to be considered by SHR’s Board in August and for the signing to take place later subject to agreement with SHR’s Board.  CN reported that since members had last seen the report there have been some adjustments in response to audit guidance and that as checks are concluded and design work done there could be further minor adjustments.  ARAC considered the report and accounts and discussed:

• ARAC’s recommendation to the Board, noting that this would be subject to the completion of data and checks; and
• a small inconsistency around the number of meetings with advice agencies, noting RH will work with LP to ensure this is correctly reported and it agreed that as there is not space to name all agencies to remove reference to some and explain that the discussions focussed primarily on homelessness during 2024/25.

ARAC agreed subject to completion and final adjustments to recommend that the SHR Board approves the Annual Report and Accounts for signing by MC as Accountable Officer.  

Actions:

• RH to work with LP to update information on meetings with advice agencies during 2024/25 as discussed with ARAC.
• ARAC to recommend that the SHR Board approves the Annual Report and Accounts for signing by MC as Accountable Officer subject to completion and final adjustments.  

Fraud, Security and Whistleblowing

CN presented the annual report on fraud, security and whistleblowing to ARAC.  She reported that there were two minor personal data breaches, but there was no fraud or whistleblowing.  She highlighted the appended Data  Protection compliance report provided by SHRs Data Protection Officer.  CN explained the breaches involved emails to the wrong recipients and the actions taken.  She reported that these were deemed low risk and did not require reporting to the Information Commissioner.  CN also highlighted training and other work with staff to keep awareness of data protection to the fore.  

ARAC welcomed and noted the report.

2024/25 Statement of Assurance form ARAC to SHR Board and Accountable Officer

CN presented the draft statement of assurance for SHR Board and Accountable Officer.  She explained how this summarises ARAC’s work and the assurances it has sought and gained throughout the year. 

ARAC agreed that it was content it was an accurate statement and it was content for EF to sign and present it to SHR Board and Accountable Officer in August 2025.

Action: EF to sign and present the annual statement of assurance to SHR’s Board and Accountable Officer in August 2025.

Risk Report

IM presented SHR’s risk register to ARAC.  He explained that there had been an upward trend from some risks in the second half of the last financial year and while there were no score changes made during quarter one 2025/26 by Management Team, the scores that had increased earlier remained heightened.   IM reported that Management Team are keeping a close watch on risks around correspondence with the Scottish Parliament, challenges relating to the new Oracle IT system and stakeholder engagement around homelessness and systemic failure and the mitigating actions.  ARAC considered the risk report and discussed:

• risk scores relating to SHR’s budget, noting that these are being kept under review by Management Team subject to clarity around pay and National Insurance.  It noted the challenges around effective budget planning without certainty, the tools SHR has to manage it during 2025/26, but that further challenges are expected in 2026/27;
• impact of the budget on other risks in terms of delivery and workload, noting that SHR will flex its operating plan in response to change and use this as a mitigation tool and will draw in SHR Board if there are significant changes required to work plans.  It noted that MC is confident that SHR will deliver the current operating plan, but that challenges lie ahead for 2026/27;
• how SHR plans for the future and makes any necessary changes, noting that a workshop with SHR Board is planned for January 2026 focussed on this and that Management Team has already started to discuss regulatory risk tolerance and how that reflects activities as well as explore efficient ways of delivery including what more IT and AI can do.  It noted that work being developed will be brought to the Board for consideration at the January workshop; and
• impact of the vacancy level and changes in working approaches on SHR’s staff in terms of wellbeing and if the risk and mitigation measures should be reflected in the risk register.   It noted that balancing resources, delivery and wellbeing is important to Management Team and that wellbeing is essential for sustaining delivery.   It asked Management Team to discuss the connection with the risk register further.

ARAC noted the risk register and welcomed the discussions.

Actions: Management Team to consider ARAC’s feedback on the risk register and in particular consider if wellbeing and mitigating actions should be reflected in it.     

Agenda Planner & AOB

ARAC considered and noted the agenda planner for 2025/26. 

ARAC thanked PM for his work with SHR, noting that this was his last meeting and that PC will take over from him as Internal Audit Manager.  

There were no other AOBs.

Private session

ARAC held a private meeting with the auditors.