ARAC Minutes - 9 September 2025

Present

Chair’s welcome, apologies and declarations

The Chair welcomed everyone present to the meeting, especially DJ as the newest ARAC member appointed by the Board in August 2025.  ARAC noted apologies from Michael Cameron (MC), SHR Chief Executive and Senior Internal Audit Manager, Louise Carmichael (LC).  It thanked IB for attending for LC.  

There were no declarations of interest.

Minutes of the previous meeting, matters arising & audit log

ARAC considered and approved the minutes from the last meeting on 15 July 2025.  ARAC considered matters arising and the audit recommendation status log.  It noted that SHR has now received pension information for 2024/25, which is being incorporated into SHR’s financial statements and once reviewed by Audit Scotland will be circulated around SHR Board for approval.  

ARAC noted the matters arising report and the audit recommendations status log. 

Internal Audit Progress Report

PC presented an update on internal audit work to ARAC. He explained that work has not started yet on the Serious Concerns review, but that he is meeting LC to discuss the scope later that day and he has started to review SHR’s related publications.  IM confirmed SHR would provide PC with an SHR contact for the review. 

PC explained that the Scottish Government’s Audit and Risk Assurance Committee met the previous day, so it was too early for key strategic messages from that meeting, but that he will provide an update to ARAC in December 2025.  

PC also highlighted the Internal Audit Bulletin as a supplementary ARAC paper that highlights a report published by the UK Committee on Standards in Public Life on early warning signs for Public Sector Bodies.  ARAC noted that supplementary papers are shared with SHR’s Borad.  

IM reported to ARAC on progress with a new MOU with Scottish Government Internal Audit.  He explained that the draft provided by Internal Audit includes a standard provision around charging based on full cost recovery. IM explained that SHR has never paid for internal audit services and that the Director of Internal Audit is due to discuss this matter further with MC.   ARAC noted recent conversations with SHR Board around recharge creep from Scottish Government and agreed any proposal for a recharge for Internal Audit services was concerning. 

IB confirmed that there has been a range of scrutiny around Oracle involving Internal Audit, Audit Scotland and wider assurance partners.  He explained that ARAC had previously received Internal Audit’s corporate systems assurance and there is nothing new to add at this time.  He also explained that as the systems bed in, further strategic messaging will emerge and that Audit Scotland will be carrying out ISA-based control work next year.  ARAC noted that for now the assurance package on Oracle is still developing.  

IM explained plans to discuss the report on early warning signs for public bodies and the related question checklist further at Management Team to consider the value of the approach and how any related work could be resourced.   ARAC noted

• this would be another layer of assurance amongst other work plan priorities, but welcomed that Management Team are considering it; and
• that Internal Audit are already helping to facilitate related discussions with other public bodies and welcomed this may also be on offer for SHR.

ARAC also discussed how there may be the opportunity for overlap with the forthcoming Committee self assurance work.   ARAC agreed the questions posed a potentially interesting exercise that might span a few sessions with SHR Board, but noted that resourcing and any existing assurance overlap is still to be discussed by Management Team and with Internal Audit.    

ARAC noted the updates.  

Board Standing Orders Review

RH presented proposals for the three yearly update to the Board’s Standing Orders.  She highlighted ARAC’s role, previous reviews including the ability to carry out interim updates as and when required and a new appendix mapping out cyclical Board decisions.

ARAC considered the proposals and discussed:

• emergency decision provisions, noting succession arrangements have commenced around the role of the ARAC Chair;
• appeals, noting that this will be revisited to reflect any forthcoming change in legislation; and
• work around the Board’s role in relation to climate change targets, asking IM to review and clarify further. 

ARAC agreed, subject to reviewing the point around climate change decisions, to recommend the proposals to the Board in October 2025 for approval.

Actions:

• IM to review the wording in relation to the Board’s role around climate change targets for clarity and update if appropriate.
• RH to propose the Standing Orders to SHR Board in October 2025 for approval.  

Risk Report

IM presented SHR’s risk register to ARAC.  He explained that this was the same register recently provided to SHR Board and that Management Team are due to review it next week.  IM provided some background to the changes made to the register over the last two quarters.  He highlighted recent increases in likelihood scoring due to resource and budget pressures, and updated ARAC  on plans to discuss projections and SHR’s approaches with SHR Board during September and at future meetings and workshops.   

ARAC considered the risk report and discussed:

• the budget review and planning  work with the Board starting on 16 September;
• if risk seven is becoming more likely due to increases in local authorities experiencing systemic failure around homelessness services.  It asked Management Team to consider this at the next review of risk scoring;
• risks around the ability to find rescue partners and if that is reflected in risk seven; and
• likely public perception if a landlord fails and how that may impact SHR’s reputation.     

ARAC noted the risk register and welcomed the discussions.  IM confirmed he will feed back to Management Team and explained that it is alive to the challenges that the sector is facing and will be considering if these impact on scores.  

Actions: Management Team to consider ARAC’s feedback on the risk register.     

ARAC self-assurance approach

CN presented proposals for ARAC’s forthcoming self assessment review.  She highlighted that this is detailed in the ARAC’s Terms of Reference and normally the format alternates between a survey and a structured conversation.  CN also highlighted the previous discussion questions used in 2023 and that there is a checklist provided in the Audit Committee handbook.  She explained that she will review the handbook and consider alongside that the early warning signs for Public Sector Bodies.  ARAC considered the proposal and discussed:

• the importance of adequate agenda time for discussion in December 2025;
• the Audit Committee handbook checklist, noting a review is underway and that Internal Audit will provide ARAC with any relevant updates; and
• the importance of feedback from the Accountable Officer, noting plans to involve MC in discussions.

ARAC approved a discussion-based approach to self assessment for 2025 and the preparation plans. It also noted that the ARAC Chair will facilitate the discussion.  

Action: ARAC to carry out a discussion based self assessment in December 2025.

Best value

IM presented the second annual review of SHR’s approach to Best Value, explaining how the duty applies to all public bodies in Scotland.   He highlighted SHR’s external auditor’s positive assessment of SHR’s Best Value approach as part of its wider audit review. He summarised the second annual Best Value review, highlighting:

• there is strong coverage of the themes across papers to SHR Board and ARAC meetings;
• not all themes are relevant to SHR’s Board and ARAC; and
• Management Team has not identified any coverage gaps, and considers the approach to be mainstreamed.

ARAC considered the review and discussed:

• the importance of Best Value, especially in the context of resource pressures on SHR and in the wider public sector;
• consistency, noting the role of Directors and the Chief Executive in approving papers, as well as work IM has done to raise awareness with Management Team;
• benefits and challenges, noting that the approach gives assurance that SHR is mindful of the key themes and provides confidence that there are no blind spots.  ARAC noted the various approaches SHR applied to Best Value in the past and that the current one is proportionate and works well for SHR, allowing it to demonstrate an overview. 

ARAC welcomed and noted the review.  It agreed to continue with the current approach.  

Assurance Mapping Six - month review

IM presented SHR’s Assurance Map review.  He explained ARAC last reviewed the Map in March 2025 and made some additions at that time and that he is proposing one update to capture a forum, which has been in place for some time, but not captured in the map.   IM also explained how Management Team had considered the review and it is content with controls and that there are no gaps to report to ARAC. 

ARAC welcomed the review. It  discussed SHR’s operational business continuity plans for a cyber security incident, noting arrangements in place.  IM explained  that despite its planning, if a cyber attack was successful, it would be very challenging for SHR to operate.  ARAC noted the experience of other organisations, including some public bodies.  It also noted forthcoming work planned with Internal Audit around cyber security and business continuity.

ARAC also discussed the appended logic model, noting this background paper was produced to support development of SHR’s 2024 – 2027 Strategy and it may be updated to inform the mid term Strategy review later in 2025/26. 

ARAC noted and approved the Assurance Map review. 

Agenda Planner & AOB

ARAC considered and noted the agenda planner for 2025/26.  CN reported that NK will be in touch with members with date proposals for 2026 by email. 

ARAC noted the update. 

Private session

ARAC held a private meeting with the auditors.