Concise Minutes - National Assembly for Wales Commission Audit and Risk Assurance Committee

Meeting Venue:

Conference Room 4B - Tŷ Hywel

Meeting date: Monday, 27 November 2017

Meeting time: 10.00 - 12.30




Eric Gregory, Independent Advisor and Committee Chair 

Keith Baldwin, Independent Advisor and Committee Member  

Hugh Widdis, Independent Committee Member



Manon Antoniazzi, Chief Executive and Clerk, and Accounting Officer 

Dave Tosh, Director of Resources 

Nia Morgan, Director of Finance 

Gareth Watts, Head of Internal Audit 

Matthew Coe, Wales Audit Office (WAO) 

Gareth Lucey, WAO

Kathryn Hughes, Committee Clerk and Risk Manager  

Buddug Saer, Deputy Committee Clerk 

Phil Turner, Senior Business Analyst (item 3)

Lowri Williams, Head of HR (item 3)

Anna Daniel, Head of Strategic Transformation (items 11 and 12)


Suzy Davies, AM and Commissioner 

Ann-Marie Harkin, WAO 


1       Introductions, apologies and declaration of interests

1.1     The Committee noted apologies from Suzy Davies and Ann-Marie Harkin. They welcomed a new representative from the Wales Audit Office, Gareth Lucey and wished Matthew Coe the best of luck on his forthcoming secondment. The Chair asked for responses to the comments from Suzy Davies on the papers to be appended to the minutes.  

1.2     Eric Gregory declared that he was the business representative for the Parliamentary Review of Health and Social Care in Wales. 

1.3     No other interests were declared.

2       Minutes of 18 July, actions and matters arising

ACARAC (05-17) Paper 1 - Minutes of 18 July 2017

ACARAC (05-17) Paper 2 – Summary of actions  

2.1The minutes of the meeting on 18 July were agreed and the updates on actions captured in paper 2 were noted.   

2.2     Action points 4.4 and 12.2 (project prioritisation) – Dave Tosh confirmed that a paper detailing the prioritisation criteria was presented at Investment and Resources Board (IRB) in June. Applying the criteria would be tested by IRB in December 2017. 

2.3     Action points 4.7 and 4.9 (Auditor General for Wales (AGW) Salary and Consolidated Fund) – Nia Morgan and Gareth Watts met with Welsh Government representatives over the summer recess to discuss the treatment of payments for the AGW.  They were both assured that proper processes were in place for the next AGW appointment and were awaiting an update before the end of the year.  


-      Gareth to update Committee on Welsh Government process for appointment and payment of AGW once information was received. 

3       Capacity review

ACARAC (05-17) Paper 3 – Capacity Review Supporting Analysis

ACARAC (05-17) Paper 3 – Annex A – Terms of Reference for Capacity Review 

3.1        Gareth Watts and Phil Turner presented an overview of the Capacity Review where they shared the Review’s objectives and some initial findings.       

3.2        The Committee provided some welcome challenge and useful pointers which would be taken on board in preparation for presenting the Review’s findings to the Assembly Commission in January. 

3.3        The Committee suggested the report should clarify that the Commission were starting from a strong base regarding the quality and due diligence of their work, and should maintain that whilst raising efficiency, they should provide practical examples here (e.g. more robust scrutiny of resource requests). They also stressed the importance of using both qualitative and quantitative data in the final report to demonstrate further potential efficiencies whilst maintaining effectiveness. 

3.4        Gareth and Phil welcomed the opportunity for this critical challenge and hoped the Committee could provide further assistance if timing allowed.


-      Gareth Watts to share updated supporting analysis paper with the Committee when available.

-      Independent Advisers to be involved in progressing the capacity review as appropriate.

4       Internal Audit Activity Report

ACARAC (05-17) Paper 4 – IA progress report and monitoring recommendations

4.1     Gareth presented his activity report and update on recommendations.  The Capacity Review was consuming much of Gareth’s time and changes to his 2017-18 audit plan may be necessary as a result.  The Committee noted the plan to defer the audit on change management.  

monitoring recommendations

4.2    Gareth presented his activity report and update on recommendations.  The Capacity Review was consuming much of Gareth’s time and changes to his 2017-18 audit plan may be necessary as a result.  The Committee noted the plan to defer the audit on change management.  

5       Latest Internal Audit Report

ACARAC (05-17) Paper 5 – New Finance System Controls

Reports/updates circulated out of committee

ACARAC (05-17) Paper 6 – Review of Committee Integrated Teams

ACARAC (05-17) Paper 7 – Internal Audit Recommendations – MBS Follow up report

ACARAC (05-17) Paper 8 – Fraud Prevention and Detection

5.1     All four audit reports were noted and Gareth had responded to the points raised by the Committee on the pre-circulated reports. The Committee were very impressed with the turnaround of the recommendations in the report on the Finance System Controls.

5.2    Nia was bitterly disappointed with the Limited Assurance rating, especially when compared to the Strong rating given last time. She assured the Committee that this was not a reflection of her team or the new system in place and there had been no deterioration in services.  Recommendations concerning the documenting of tasks had been tightened, as had the process of monitoring the time taken to approve credit card purchases.  Nia would now see a list of outstanding actions on a monthly basis to ensure the level never rose to that identified by the audit.  An exercise to review the usage and number of credit cards was scheduled for December. 

5.3    The Committee also noted and discussed the responses to recommendations in the Review of Committee Integrated Teams, in particular the acceptance and timeliness of their implementation.

6       Review HMT/other guidance for Audit and Risk Assurance Committees

Oral update

ACARAC (05-17) Paper 9 – NAO Guidance – Cyber and Information Security

6.1     Dave provided an update on cyber and information security activity and future plans.  There was currently a focus on raising awareness with Assembly Member Support Staff (AMSS) at Constituency Offices.  Mock phishing exercises on Assembly Commission staff had proved positive in highlighting vulnerabilities and the sharing of information between external organisations that Dave and his colleagues were in contact with was also proving useful.  Further information on testing and recovery procedures was also discussed but due to the nature of the discussion, detail minutes were not taken. 


-         Dave to share details of existing vulnerabilities and resolution plan with Committee members.

7       Update on Policy Management Framework

ACARAC (05-17) Paper 10 – Policy Management Framework

7.1     Gareth presented this paper asking the Committee to note the work being undertaken and the proposed next steps.  When complete, the policies would all be branded and have clear review dates which was seen as essential in terms of good governance. 

7.2        Although the Committee questioned the timing of this work, Gareth assured members that this project was identified in 2014 and was not starting from scratch.  The impact on resource was low and was being managed by a member of the Governance and Assurance team.  

8       Finance Update

ACARAC (05-17) Paper 11 – Finance Update

8.1     Nia asked the Committee to note the update which detailed the latest financial position for 2017-18 which was monitored by IRB on a fortnightly basis.

8.2        The Committee welcomed this comprehensive paper and appreciated the financial pressures the organisation was facing.


-         Nia to share details of budget modelling with Committee members.

9       Summary of Scrutiny Sessions (Finance and Public Accounts Committee)

ACARAC (05-17) Paper 12 – Finance Committee and Public Accounts Committee Update

ACARAC (05-17) Paper 12 – Appendix 1 FC report

ACARAC (05-17) Paper 12 – Appendix 2 Response to FC report

9.1     Nia and Manon Antoniazzi thanked the Committee for their extremely valuable input in their preparation for the scrutiny sessions held in October.  Following these sessions, a number of recommendations had been suggested by the Finance Committee and the Assembly Commission had formally responded.  The budget for 2018-19 was approved in Plenary on 15 November 2017 and Nia confirmed that she would be considering how the Determination on Members’ Pay and Allowances was treated in other legislatures.      

9.2        The Committee praised Manon for her performance at the sessions, especially considering this was her first as Chief Executive and Clerk, and Accounting Officer.  They also welcomed the offer of an update on the building proposals once the Commission had made its decision in the New Year.  

10   Approve the Committee's effectiveness survey

ACARAC (05-17) Paper 13 – Committee’s Effectiveness Survey

ACARAC (05-17) Paper 13 – Annex A - Effectiveness Survey Questionnaire

10.1The Committee agreed to the questions contained within the survey which would be circulated in December.  After some internal analysis, the results would be presented to the Committee in February. 


-      Committee members and attendees to complete the ACARAC effectiveness survey by 5 January 2018.

11   Corporate Risk Report

ACARAC (05-17) Paper 14 – Corporate Risks

ACARAC (05-17) Paper 14 – Annex A - Corporate Risks Summary Report

ACARAC (05-17) Paper 14 – Annex B - Corporate Risks plotted

Item 12 – Critical examination of one identified or emerging risk

ACARAC (05-17) Paper 15 – Managing the Commission’s Inter-related Corporate Risks

ACARAC (05-17) Paper 15 – Annex A - inter-related risks and common mitigation

11.1 The Committee welcomed Anna Daniel, who had been involved in the drafting of the paper on the inter-related risks.

11.2 The Committee noted the current status of the Commission’s corporate risks and analysis of how the combined impact of the inter-related risks were being managed.  Dave described how the Capacity Review work was driving the focus of the inter-related risks.  He also explained that, despite the strength of the controls in place, the impact ratings on most of the risks remained high and a number of events were beyond the Commission’s control, for example Assembly reform and Brexit.

11.3    Anna described the scenario planning for Brexit and the training scheduled for Assembly Members and AMSS prior to the new powers under the Wales Act coming into force in April 2018.

11.4    The Chair welcomed this level of analysis which he had rarely seen elsewhere, and appreciated the complexity of the risk landscape and the limited control the organisation had in some areas.

12   Critical examination of one identified or emerging risk

12.0   See above.

13   Updates from WAO

ACARAC (05-17) Paper 16 – WAO audit update

ACARAC (05-17) Paper 17 – 2018 audit plan

13.1 Matthew Coe presented an update document on the WAO’s work to date and the detail of the 2018 audit plan.  He assured the Committee that there was no outstanding work from the 2016-17 audit and that a detailed handover would take place with the new member of the audit team. 

13.2    The Committee welcomed both documents.  They queried why the audit fee was not yet ratified.  Matthew confirmed that this was still going through the internal approval process and would be shared with the Committee as soon as it was available.

14   Departure Summary

ACARAC (05-17) Paper 18 – Departure Summary

14.1 The Committee noted four departures from normal procurement procedure.   

15   Draft Corporate Performance Report (KPI report)

ACARAC (05-17) Paper 19 – KPI Report Apr-Sept 2017

15.1 The Committee noted this draft KPI report that was due to be reviewed by the Assembly Commission in December.  They noted one area that had spiked significantly, which was viewing figures. Dave and Manon explained the shift from viewers watching proceedings on to YouTube, which proved that users were preferring to access the material using different social media channels. 

15.2 Dave explained that Heads of Service had been asked to review the KPI sub-indicators, especially in light of the Capacity Review and the recommendations made by the Finance Committee.     

16   Forward Work Programme

ACARAC (05-17) Paper 20 – Forward Work Programme

16.1The Committee noted the updated forward work programme.

Next meeting is scheduled for 5 February 2018.