Agenda and minutes

1.1 The Chair welcomed everyone to the meeting and noted apologies from Sian Wilkins, Interim Director of Senedd Business, and Uzo Iwobi, Independent Adviser. 

1.2 No interests were declared.

ARAC (24-03) Paper 1 – Draft Minutes of 3 May 2024

ARAC (24-03) Paper 2 – Summary of actions  

2.1 The minutes of the 3 May meeting were formally approved and would be published on the website in due course.

2.2 The Committee noted the progress against actions from the previous meeting.

ARAC (24-03) Paper 3 – IA activity update

3.1 The Chair welcomed Lee Glover, Head of Internal Audit, to the meeting. Lee informed the Committee that two internal audit reports (namely Programme and Project Governance, and Cyber Security) were now with management for responses and would be shared with the Committee as soon as they were available. 

3.2 Lee would be scheduling the audit work to be undertaken during 2024-25, as set out in the Internal Audit Strategy which was presented to the Committee at the previous meeting. In response to questions from Committee members, Lee and Kate confirmed that the regular Members’ Expenses audit was included in the 2024-25 work programme, the report of which would be shared with the Committee as a matter of course.    

Action

-       Include Programme and Project Governance audit report as an agenda item for the 8 July meeting.

ARAC (24-03) Paper 4 – ISA 260 Report

4.1 Audit Wales presented their findings from the audit of the Commission’s 2023-24 accounts and summarised the outstanding issues (at the time of writing). One outstanding issue was in relation to a delay in the Commission receiving required pension disclosures from MyCPS in respect of the remuneration report. Further details on this are captured under item 5.

4.2 Audit Wales proposed an unqualified ‘true and fair’ audit opinion. The wording of the final audit report would depend on receipt of the outstanding information relating to pension disclosures.  

4.3 Anthony Veale then explained the materiality reporting threshold, confirmed there were no uncorrected misstatements in the accounts, and referenced the statements which had been corrected by management. He also summarised the recommendations included in the audit report. He thanked Kate and the Finance team for their help and support in reaching the audit conclusions.  

4.4 Kate Innes was then given the opportunity to respond to the ISA 260 report. She was content with the report and its recommendations which would be taken forward. She welcomed a wider discussion on the timescales and production of the accounts and a system to track the audit process, recently introduced by Audit Wales, which she found very beneficial. 

ARAC (24-03) Paper 5 – ARA 2023-24 – cover paper

ARAC (24-03) Paper 5 – Annex A – ARA 2023-24

5.1 Arwyn Jones reminded the Committee that there had been no substantive changes to the report since the draft version was presented at the 3 May meeting. He described the process of input and clearance by the Leadership Team and Executive Board and advised that the report was on course to signed off at the Commission meeting on Monday 17 June.

5.2 Committee members suggested clarification was needed on the risk profile section to better describe the nature of each of the risks. They also suggested clarifying the challenges faced when implementing the cost of living payment which was discussed at a scrutiny session of the Finance Committee.

5.3 Focus then turned to the key performance indicators (KPIs). Committee members congratulated officials on the excellent performance overall demonstrated by the KPIs. 

5.4 In response to questions around staff sickness statistics, Arwyn Jones and Leanne Baker described the Commission’s Wellbeing Strategy and explained that a sub-group of Leadership Team had been established to review the statistics, along with the results of the recent staff survey. This would also be covered at a Leadership Team away day at the end of June. Ed Williams also described how the HR team were working with each service area to develop their wellbeing plans. A Wellbeing commitment with clear principles and an agreed charter was also in development. 

5.5 Kate presented the cover paper which focused on the accounts and the issue  around the delay in receiving pension disclosure information from MyCSP, as referenced under item 4. This was a UK-wide issue, the resolution of which depended on direction from HM Treasury, consultation on which was ongoing. Kate outlined the potential options if no direction was forthcoming and/or the information was not received in time to lay the Annual Report and Accounts before the start of the summer recess. She explained the impact of delaying the process of laying the accounts until the Autumn term which would need to be discussed with PAPAC in terms of the timing of scrutiny. She welcomed the views of the Committee on the options presented.

5.6 Arwyn noted the intention to publish other statutory Annual Reports (Diversity and Inclusion, Official Languages and Sustainability) in June as they became available. Manon and the Committee agreed this was important for scrutiny purposes. 

5.7 The Chair noted that the accounts were produced to the satisfaction of Audit Wales, officials and the Committee. He summed up the Committee’s agreement to postpone recommending to the Accounting Officer the signing of the accounts until the meeting scheduled for 8 July.

Oral Item

6.1 Kate explained that, although the Commission’s supplementary budget had been submitted, there would be a delay in approval because the Welsh Government would be unable to lay their budget until the Autumn. This was due to the unavailability of UK Government economic forecasting data which would not be available until after the General Election on 4 July. This would affect all public sector organisations. Delays with the supplementary budget had implications for the Commission that included those around staff pay negotiations.  

6.2 Hefin David, as member of the Finance Committee referred to the cross-party support for the supplementary budget and noted that the draft budget would be considered in October.

6.3 The Committee noted this update and asked Kate to provide a further update on the supplementary budget when available. 

Action

-       Kate to provide an update on supplementary budget when available.

ARAC (24-03) Paper 6 – Governance Update

7.1 Phil Boshier presented the update report on activity carried out by the Governance team. He highlighted the following:

- completion of work on the Assurance Framework, with the Annual Governance Statement now included in the 2023-24 Annual Report and Accounts;

- the work taken forward by the Procurement team, and noted the training they were undertaking on forthcoming procurement reform;

- progress with the Strategic Planning, and Portfolio Management Framework, noting that the Portfolio Management Group had recommended that the Executive Board provided authority to spend a percentage of the relevant Portfolio 24 projects and all had been approved; and

- the implementation of recommendations from the Internal Audit report on programme and project governance relating to the Ways of Working programme.

7.2 The Committee thanked Phil for his update and would welcome sight of the Portfolio Strategy document when available. 

ARAC (24-03) Paper 7 – Corporate Risk

ARAC (24-03) Paper 7 – Annex A - Summary Corporate Risk Register

ARAC (24-03) Paper 7 – Annex B - Corporate Risks plotted

8.1 The Committee noted the Commission’s Corporate Risk Register and the intention to reconfigure the risks around Senedd Reform. The focus of this item was on the Cyber Attack risk (reference ICT-R-64) and the Chair welcomed representatives from ICT to present an update, and noted agreement that the quarterly Cyber Security Assurance Report was to be presented at the November meeting.   

8.2 The following points were raised by officials:

- The current cyber security threat landscape was forever changing and organisations were more likely than ever to be subject to an attack.

- The focus on continually improving controls to prevent and detect attacks, particularly as technological advancements and events such as conflict and elections were prevalent, as well as the sophisticated nature of tactics being used by attackers.   

- The ICT team were reviewing updates issued by the National Cyber Security Centre and were involved in inter-parliamentary round table discussions to share information on vulnerabilities and to understand what other legislatures were focusing on.

- The measures being taken to encourage further uptake of the Multi-factor authentication (MFA) within the MyView application. 

8.3 The Committee welcomed this update and questioned the supply chain risks relating to third party suppliers.

8.4 Mark Neilson noted that mitigation around cyber security risk was built into the contract negotiation stage of the procurement process, as part of non-functional requirements. Where appropriate and achievable this included a requirement of compliance with Cyber Essential Plus and other certifications. For the duration of a contract with a supplier, the Cyber Security team continued to assess compliance with agreed standards. Arwyn verified how thorough the team were in challenging cyber security credentials of suppliers to mitigate the risks.

Action

-       Include details of third party supply chain security in the Cyber Security Assurance Report and on the agenda for the November meeting.

ARAC (24-03) Paper 8 – Departure summary

9.1 The Committee noted two departures from normal procurement procedures.

ARAC (24-03) Paper 9 – draft ARAC Annual Report 2023-24 - cover paper

ARAC (24-03) Paper 9 – Annex A - draft ARAC Annual Report 2023-24

10.1 The Chair and Committee members expressed their thanks to the Clerking team for pulling together such a comprehensive draft of the Committee’s Annual Report for their review. The Chair outlined the following key messages which he intended to relay to the Commission when he presented the report on Monday 15 July:

- substantial progress on budget and financial frameworks;

- programme and project management methodology being adopted for the two major transformation programmes;

- the informal review of the Communications and Engagement Strategy;

- changes to the internal governance arrangements; and

- progress around Dignity and Respect policies and procedures. 

10.2 Committee members agreed with these key messages and suggested this would also provide an opportunity to remind the Commission of the need for continued focus on cyber security, and to stress the human factors.

10.3 The Chair also highlighted the suggested areas of focus for 2024-25. He also noted the suggestion of reference, in the financial management section, to an agenda item at each Spring meeting on the three-year budget process.

10.4 The Chair thanked the Committee for their input and asked for comments to be sent to Kathryn Hughes.  

ARAC (24-03) Paper 10 – Forward Work Programme

11.1 The Committee noted the forward work programme and requested that an update be scheduled during 2024-25 on progress against the Carbon Neutral Strategy, particularly in relation to the impact of a reduction in capital investment due to the budget constraints.  

Action

-       Include an update on progress against the Carbon Neutral Strategy during 2024-25

Oral item

12.1 The Chair welcomed Anna Daniel to the meeting to present an update on the management of risks relating to Senedd Reform. Anna updated the Committee in the following areas:

- The Senedd Cymru (Members and Elections) Bill was on course for Royal Assent. This milestone meant that the Commission could make the necessary financial commitments to implement changes to the Siambr and office accommodation. 

- The Reform Bill Committee had concluded Stage 1 scrutiny of the Senedd Cymru (Electoral Candidate Lists) Bill with its report due to be debated in Plenary on 16 July, when the Welsh Government are expected to respond in relation to legislative competence. 

- Commission officials were planning for various potential scenarios around the passing of legislation and discussions with the Llywydd were on-going as were regular briefings with the new First Minister.

12.2 In response to questions from Committee members, officials elaborated on the scenarios being considered and the plans for wider engagement on Senedd Reform.

12.3 The Committee thanked Anna for this update and would welcome a further update on progress at the November meeting.

Oral item

13.1 Ed Williams updated the Committee on the three live projects within the Ways of Working programme. Plans for 36 new Member and support staff offices were underway and initial proposals were being prepared for consideration and approval at a Commission meeting in July.

13.2 The Committee questioned the future obligations and pressure on the Commissioner for Standards. Although more Members would not necessarily lead to more complaints, officials assured the Committee that the Standards of Conduct Committee were reviewing the framework in preparation for the Seventh Senedd. The Committee’s current inquiry into the Standards Framework would feed into that review.

14.1 No other business was raised.

Anthony Veale, Audit Wales attended a private session with members of the Committee once formal proceedings had concluded. No Commission officials were present, and no minutes were taken.

Next meeting is scheduled for 8 July 2024.