Agenda and minutes

1.0    Item 1 - Introductions, Apologies, and Declaration of Interests

1.1    The Chair welcomed everyone to the meeting, including Lisa Bowkett to her first meeting as Chief Finance Officer. There was one apology from Aled Eirug.

2.0    Item 2 - Approval of Minutes of 18 November, Actions, and Matters Arising

ARAC (25-01) Paper 1 – Draft Minutes of 18 November 2024

ARAC (25-01) Paper 2 – Summary of actions

ARAC (25-01) Paper 3 – Cyber Assessment Framework

ARAC (25-01) Paper 4 – Bay 32 Gateway Review Stage 2 Actions

2.1    The minutes from the November meeting were approved and would be published. The action schedule had been updated with outstanding actions either completed or included on the agenda.

2.2    The Chair invited Mark Neilson to introduce the paper outlining details of the Cyber Assessment Framework (CAF) and invited questions from the Committee. Mark described the relevance of the framework to the parliamentary setting. He explained that the CAF provided a structured approach and a framework against which the management of cyber risks could be assessed by auditors. He also noted that other legislatures were adopting its use which would provide a useful benchmark for comparison.

2.3    In response to questions from the Committee, Mark explained that an independent assessment would take the form of an internal audit, with further guidance sought from the National Cyber Security Centre (NCSC). He agreed to keep the Committee informed of developments.

3.0    Item 3 - Consider Internal Audit Plan for 2025-26

ARAC (25-01) Paper 5 – Internal Audit Strategy 2024-25 to 2026-27

3.1    Lee Glover presented the three-year internal audit strategy which had been reviewed by the Committee in May 2024, as an opportunity for input into confirming the 2025-26 plan.

3.2    The Committee did not identify any specific audits to be added to the three-year strategy. In response to a question around any follow up audit of business continuity, which was not included in the strategy, officials provided a brief update on progress towards finalising a corporate business continuity plan and programme of work. This would include further testing of business continuity plans, informed by an extensive exercise carried out in the Autum.

3.3    In response to a further question from the Committee, Lee provided assurance that the strategy and plans would test the effectiveness of controls and would be reviewed and adapted to take account of emerging risks.

4.0    Item 4 - Internal Audit Plan Progress Update

ARAC (25-01) Paper 6 – Internal Audit Progress Report – Jan 2025

4.1    Lee outlined progress against the 2024-25 internal audit plan and the key objectives and timelines for the upcoming audits. 

4.2    Committee members commented on the number of audits due to be carried out in the coming months. Lee acknowledged the plan was back-loaded and reminded the Committee that the preferred timeframes were set by management, and had taken into account when the audits could add most value. The Committee discussed the potential challenges associated with this approach, particularly in relation to the resource impact on officials, and the need to allow time for Committee members to properly scrutinise audit reports. Lee assured the Committee that measures were in place to manage these challenges to ensure that the audits were carried out effectively.

4.3    The Committee agreed on the need for timely circulation of internal audit reports, including out of committee with the opportunity for discussion at future meetings.

Actions

Include the 2025-26 Internal Audit Plan as an agenda item at the May meeting

Provide an update on progress with developing and delivering the business continuity programme at the November 2025 meeting

External Audit

5.0    Item 5 - Audit Wales – February Update

ARAC (25-01) Paper 7 – Audit Wales February update

5.1    Clare Thomas provided an update on the external audit plan for 2024-25, highlighting the key areas of focus and timelines. The plan was due to be presented at the 9 May meeting but it would be circulated as early as possible. She referred to the slight increase in the audit fee which reflected planning based on there being no significant changes to accounting requirements. The Chair noted ongoing discussions around the division of the audit fee between the Commission and the pension fund.

5.2    In response to questions from the Committee, Clare outlined the planning underway for early interim audit work and a slightly later final audit to ensure a complete set of accounts.

Commission Governance

6.0    Item 6 - Budget Setting Strategy (including budget development and MTRF process)

ARAC (25-01) Paper 8 – Budget Setting Strategy

6.1    The Chair reminded the Committee that this item had been included to provide an opportunity to consider the budget process. He invited Lisa Bowkett to provide a review of the previous budget cycle, as well as presenting the strategy for the 2026-27 budget which was outlined in the paper.

6.2    Lisa highlighted the main differences in the process due to the step change in the budget relating to Senedd Reform and the need to engage more with Members.

6.3    Hefin outlined the ways in which he, and officials, had engaged with Members during the budget process which had worked well. This had led to the creation of the engagement strategy, which was included in the paper, as a way of codifying the approach. He emphasised the importance of continued political engagement and elaborated on how this strategy would be delivered for developing the 2026-27 budget.

6.4    Lisa outlined the timetable for preparing the 2026-27 budget, starting with a refresh of the Medium-Term Resource Framework in April, followed by detailed budget preparation between April and July, and finalisation over the summer. She also highlighted the impact of major programmes and projects such as those relating to Senedd Reform and Bay 32 on the budget.

6.5    Committee members commented on the positive outcome, and the professional approach and engagement strategy being adopted. They also noted the importance of continued engagement activity, particularly as further increases in the budget would be necessary.

6.6    The Chair asked to be kept informed of progress with the budget setting process and for key documentation to be shared with the Clerking team for inclusion in the ARAC Members’ Library when available.  

7.0    Item 7 - Annual Review of Accounting Policies

ARAC (25-01) Paper 9 – Annual Review of Accounting Policies

7.1    Lisa Bowkett presented the paper which included details of minor changes for accounting standards and disclosure requirements, as set out in HM Treasury’s Financial Reporting Manual (FReM). The changes related mainly to pensions and McCloud with no significant impact on the Commission’s accounts.

7.2    The Committee noted, and thanked Lisa for the update. 

8.0    Item 8 - Governance Update Report

ARAC (25-01) Paper 10 – Governance Update Report – Feb 2025

8.1    Phil Boshier presented the paper which provided an update on recent governance activity. He highlighted the following important developments:

Risk Management Framework – a set of risk appetite statements had been approved by the Commission. These were developed with input and good engagement by the Executive Board, other senior officials and Commissioners which demonstrated a good level of understanding. The statements would be brought into use to inform decision-making.

8.2    Assurance Framework – a revised approach to gathering assurances to present to the Accounting Officer to inform the Annual Governance Statement. The changes would better aid the identification of any gaps or weaknesses in assurance and allow better alignment with independent assurances, such as those from internal audit. There would also be a collective assurance statement from Executive Board members to the Accounting Officer, replacing the Director statements previously produced.

8.3    In response to questions from the Committee around the rationale for the change of approach to assurance gathering, Phil explained that this was partly in response to feedback received from ARAC members’ scrutiny of the Director assurance statements in March 2024. This included suggesting that the statements to the Accounting Officer could be more corporate and cross-cutting. Phil also outlined timings for completion of the assurance work and clarified that the single corporate assurance statement and supporting documentation would be presented at the scrutiny meeting scheduled for 24 March.

8.4    In response to further questions, Phil assured the Committee that the assurance gathering approach would be evaluated to ensure it continued to meet the Accounting Officer’s needs, with a view to keeping it proportionate and continuous improvements in future years. He also outlined plans to work with risk owners to better frame the controls, to clarify their ownership and to test coverage across the three lines of assurance. In relation to questions around risk appetite statements, Phil outlined the steps to be taken to bring their use into operation and agreed to share the risk appetite statements with the Committee members.

Action

Phil Boshier to share details of risk appetite statements with Committee members (existing papers).

9.0    Item 9 - Update on the Use of Artificial Intelligence (AI) across the Commission

Oral item

9.1    Arwyn Jones provided an update on the use of AI from his perspective as Chair of the AI Opportunities Group, noting that he was also working closely with Matthew Richards, SIRO and Chair of the AI Governance Group. 9.2      Both groups were working well and feedback gathered monthly from those with test CoPilot licences was demonstrating some efficiencies. The feedback, which covered use, productivity, accessibility, and well-being, was also being used to inform improvements to CoPilot, in dialogue with Microsoft. Overall, the Commission’s approach was cautious and led by governance principles but officials recognised the potential opportunities AI could bring.  

9.3    Arwyn and Matthew noted developments in terms of the Commission’s AI policy and the management of risks, and that work was due to begin on training and guidance for rolling out a number of CoPilot licences to the party groups. Arwyn agreed to share further details with the Committee on proposals for the future use of AI which had been presented to the Commission.

9.4    The Chair welcomed these developments and invited questions from the Committee. He also invited Clare Thomas to comment on the approach being taken by Audit Wales on the use of AI. Whilst recognising the potential to significantly enhance the efficiency and effectiveness of audit processes, Clare stressed the importance of careful and cautious use of AI, particularly in handling client data. She outlined the steps being taken to ensure that AI was used responsibly and ethically, with a focus on maintaining data security and privacy.

9.5    Validera also agreed with the cautious approach being adopted by Audit Wales, noting the potential to pull out common themes across a variety of audits, but did not see AI streamlining front-end internal audit processes. 

9.6    Arwyn wanted to reassure the Committee that societal concerns were being considered, including through trade union representation on the opportunities group. He added that efficiencies from using AI would free up resource to do more value-added work, as opposed to replacing staff. The Senedd was leading on many aspects of AI and Mark Neilson should be credited for liaising with other legislatures who were interested in the Senedd’s approach and seen as leading the way. Officials were also working with Microsoft on improvements such as the use of transcriptions and issues around Welsh language recognition.

9.7    The Committee recognised the positive approach to the use of AI and would welcome future updates on all aspects of AI.   

Action

Arwyn to share further information (existing papers) on the use of AI

10.0     Item 10 - In-Year Report on Data Breaches

ARAC (24-01) Paper 11 – Data Breaches

10.1  Matthew Richards presented the in-year report on data breaches. He explained that there had been two relatively minor breaches, neither of which were reportable to the Information Commissioner's Office (ICO) as they did not effectively damage any individual's interests.

10.2  The Committee noted, and thanked Matthew for the paper. 

11.0  Item 11 - Corporate Risks

ARAC (25-01) Paper 12 – Corporate Risk

ARAC (25-01) Paper 12 – Annex A -  Summary Corporate Risk Register

ARAC (25-01) Paper 12 - Annex B – Corporate Risks plotted

11.1  The Committee reviewed the corporate risks, noting that there had been no significant changes since the last meeting, other than the addition and subsequent removal of a risk relating to legislation software which had been largely resolved.

11.2  In response to questions from Committee members, officials noted that the Seventh Senedd Programme provided mitigation for risks relating to the outcome of the next election. The corporate risk on Senedd Reform also provided the Committee with information on the management of risk, and included details of scenario planning. The Committee were also receiving the regular dashboards on progress of the Seventh Senedd and Ways of Working programmes. The Chair suggested that a briefing session on the Seventh Senedd could be arranged at a future meeting. 

11.3  The Committee discussed areas of risk for consideration at future meetings, including those around dignity and respect and capacity. It also noted the ongoing assessment of risks relating to the Commission’s support for Members in response to the work of the Independent Remuneration Board.

11.4  The Committee noted the updates to the risk register. 

12.0  Item 12 - Critical Examination of One Identified Corporate Risk or Topical Issue – Senedd Reform Driven Estates Projects

Oral item (referring to the update in the Corporate Risk Register - item 11)

12.1  Ed Williams, Nicky Morgan and James Herman provided an update on the estates projects, including works in Tŷ Hywel and the Siambr. They explained that the projects were progressing well, with key milestones being met and any issues being addressed promptly.

12.2  Throughout the projects, James and his team had continuously engaged with Members, Chiefs of Staff and Party Chairs by arranging drop-in sessions during Plenary and attending group meetings, with final design options being presented in December 2024. 

12.3  James highlighted some key accessibility changes to the Siambr along with other considerations such a lighting and acoustics. Siambr Hywel in Tŷ Hywel would be used as a replacement to the Senedd Siambr for a nine month period from April 2025. 

12.4  It was also noted that the Senedd building would remain open to the public and the estates team were working closely with staff in Committee Services and the Engagement Service to minimise disruption to staff and other stakeholders.

12.5  The Committee discussed the need for clear lines of accountability and regular updates on project developments to ensure that all stakeholders were kept informed.

12.6  Overall, the Committee was assured by the progress being made on the estates projects and thanked all those involved for their work to date. 

Committee Business

14.0  Item 14 - Forward Work Programme

ARAC (25-01) Paper 14 – Forward Work Programme

14.1  The Chair reminded the Committee that, should the July meeting not be needed for recommending the signing of the accounts, it would be an opportunity for less formal discussions on wider Commission activity.

14.2  The Committee reflected on areas such as decarbonisation and the Official Languages Scheme, which had been considered less formally in the past, and suggested covering areas relating to people at forthcoming meetings. The Chair suggested this could cover Dignity and Respect and the Workforce Plan (related to the Corporate Capacity and Capability risk). He also requested an update on the estates projects in the Autumn and it was noted this would be covered by the corporate update items as a matter of course.

14.3  The Committee discussed Member and support staff response rates for Dignity and Respect surveys and asked officials to share details of any proposed actions to increase future participation.

14.4  During the meeting, the Committee had also requested updates on business continuity which would be included in the Governance Update at the November meeting, and an update on the use of AI which would be provided under the corporate risk item at future meetings.

Action
Include the following items on the Forward Work Programme:

-      Dignity and Respect; and

-      Workforce Plan (related to the Corporate Capacity and Capability risk).

15.0  Item 15 - ARAC Annual Report – Areas for Inclusion

Oral item (last year’s ARAC Annual Report was circulated out of committee ahead of the meeting)

15.1  Due to the schedule of Commission meetings this year, the production of the ARAC Annual Report would be earlier in the year than normal.

15.2  The Committee discussed the areas for inclusion, with a focus on the governance changes, internal audit arrangements, project and programme governance changes and senior management changes at Executive Board level.

15.3  The Committee also discussed how the report might be a shorter document with supplementary information included as annexes. 

15.4  Due to the tight turnaround, the Clerk and Chair would welcome comments and the Committee’s input by email. It might also be necessary to approve the report out of committee if a draft was not agreed ahead of the 9 May meeting. 

Corporate Updates

16.0  Item 16 - People and Remuneration Project (HR/Payroll System)

Oral item

16.1  Eve Jennings provided an update on the People and Remuneration Project, highlighting the key milestones and progress made. She described the effective transition to the new HR/payroll system which went live in January.  

16.2  Demonstrations to Commission staff had been delivered as part of the project, and the Members’ Business Support had also held drop-in sessions for Members and their support staff to demonstrate the new system.

16.3  There had been an issue with the service provider relating to HMRC activation codes but this had been resolved in time for the go-live date.

16.4  There were a number of issues outstanding, including those relating to the Members’ Pension Scheme and MyCSP, for which workarounds were likely to be in place until April. The Committee asked to be updated on these, and the full implementation of other parts of the system (see paragraph 16.4) in due course.

16.5  A lessons learned meeting had been scheduled with the service provider. Eve hoped that the issues raised by the Commission would help future projects undertaken by the service provider. Preparations for delivery of phase 2 of the project were well developed. This would include the facility to record flexi time, and the Learning Management System.   

16.6  Ed (project SRO) provided further assurance around documentation of the issues which arose and lessons learned. He, and the Committee, praised Eve for her work and dedication to this project and thanked all those involved. Eve also thanked the Committee for its input.  

17.0  Item 17 - Ways of Working

Oral item - some details have not been captured in these minutes due to the commercial confidentiality 

17.1  Ed Williams provided an update on the Ways of Working Programme, highlighting the key areas of focus and progress made. The outline business case for the Bay 32 project had been approved by the Commission and the contract notice had been issued. Ed also outlined the timeline for the project which was currently running behind schedule. 

17.2  Ed outlined a number of key activities and milestones over the coming months. He then described the internal resources in place and the clear lines of accountability. He also responded to questions around the resources for the project and the procurement process. This included responding to questions around opportunities for Welsh suppliers, and diversity and social value included in terms and conditions, which Ed assured the Committee were in line with the Commission’s Procurement Strategy. As scheduled in the Committee’s forward work programme, a further update on the estates projects would be provided in the Autumn. 

17.3  The Committee welcomed the detailed update from Ed on this programme and asked to be kept informed of progress.    

18.0  Item 18 - Seventh Senedd Programme

Oral item

18.1  Anna Daniel provided an update on the Seventh Senedd Programme, highlighting the key areas of focus and progress made. She outlined the work being taken forward by the various committees, on which the Commission would need to respond. This included the work of the Future Senedd Committee, which was due to report in May, the Business Committee, the Senedd Reform Bill Committee, and the Standards of Conduct Committee.

18.2  Anna also provided an update on the work being taken forward by the Independent Remuneration Board and its ongoing dialogue with the Commission. The Board would shortly be working at full capacity when recruitment to two vacancies had been approved. It was currently consulting on the support for Members leaving office at the next election, and had been engaging with Members and their support staff on its pay and grading review in relation to a framework for future job roles. A full consultation would follow and this would determine the total allowance provision for the Seventh Senedd. Officials were assessing the risks in terms of supporting Members through these changes.

18.3  In terms of the work being taken forward by the Commission, Anna highlighted the communication and engagement strategy, plans for election transition, regular briefings to the Commission on delivery of the Seventh Senedd Programme and business preparedness. This included reviewing the common assumptions and detailed scenario planning.

18.4  The Chair welcomed the suggestion of sharing additional documentation with the Committee. Anna agreed to consider what could be usefully shared over and above the oral corporate updates and risk updates at each meeting, and the Change Board dashboard which the Committee received regularly, and would discuss this with the Chair.     

AOB

19.0  Item 19 - Any Other Business

Oral item

19.1  No other business was raised.

A private session with Lee Glover, Head of Internal Audit and members of the Committee would be rescheduled.

Next meeting is scheduled for 9 May 2025.