Agenda and minutes

Venue: Conference Room 4B - Tŷ Hywel. View directions

Contact: Clerk: Kathryn Hughes  Deputy Clerk: Buddug Saer

No. Item


Introductions, apologies and declaration of interests


1.0   Item 1 - Introductions, apologies and declarations of interest 

1.1     One apology was received from Ann-Marie Harkin (WAO).

1.2     The Chair welcomed two new Independent Advisors to the meeting, Ann Beynon and Bob Evans.  Ann and Bob outlined their professional backgrounds and current portfolio of roles.

1.3     The Chair declared that, following the Parliamentary Review of Health and Social Care in Wales, he was now supporting the reviews of the Digital Architecture and Governance arrangements.



Minutes of 9 July, actions and matters arising


ACARAC (05-18) Paper 1 - Minutes of 9 July 2018

ACARAC (05-18) Paper 2 – Summary of actions  

2.1        With one minor change, the minutes of the meeting of 9 July were agreed. 

2.2     Action 4.3 (Welsh Consolidated Fund- WCF): Gareth Watts confirmed that the WCF Payments and Receipts accounts for the financial year ended 31 March 2018 had been certified by the Assistant Auditor General for Wales with an unqualified opinion.  The WCF Annual Governance Statement referenced the matter which had previously been discussed by the Committee and stated that  discussions between the Welsh Government, the Assembly Commission and the Auditor General for Wales would continue to establish whether any further action was required by the Welsh Government to ensure this issue was resolved.  Gareth would be involved and would update the Committee. Gareth Lucey re-confirmed that, from the perspective of both the Assembly Commission and WCF audit teams, there was no irregularity regarding the Standards Commissioner’s salary payments. 

2.3     Action 5.8: the Clerking team will consult with Committee members regarding the forward work programme.

2.4     Action 6.4 (finance system project update): now superseded, the project SRO will be invited to the February ACARAC meeting.


      Gareth Watts to provide a WCF update.

      Clerking team to share FWP with Committee members to ensure dates are suitable and to invite suggestions for future agenda items.

      Clerking team to invite Finance System project SRO to the February meeting for an update on phase 3. 



Cyber-Security Progress Update


Oral item

3.1        The Committee welcomed Mark Neilson and Richard Coombe to the meeting to present an update on cyber security.  Following their last update in April, the Windows 10 upgrade had been fully implemented.  The Committee were reassured by the security benefits of the Windows 10 platform. 

3.2     Mark outlined the timetable of future testing plans.  The Committee welcomed the Commission’s intention to join a Cyber Essentials scheme, a UK Government-backed, industry-supported scheme to help organisations protect themselves against common online threats. 

3.3     The cyber security risk radar chart illustrated progress in all areas, but raised questions about the priority of user education and awareness.  Suzy Davies encouraged Mark and his team to use the Commissioners to engage with their parties and to encourage their colleagues to take part in awareness raising and training sessions. 

3.4     Mark and Richard ensured that the Commission engaged with other organisations, including other legislatures and the National Cyber Security Centre.

3.5     Whilst recognising that cyber security requires constant vigilance, the Committee were encouraged with progress. An internal audit review of cyber security was scheduled for early 2019, and the Committee would welcome a further update in June 2019 and at least biannually thereafter. 


     Mark Neilson to use Assembly Commissioners to communicate key messages to their groups of AMs and AMSS in terms of the training available and awareness raising.

     Mark and Richard to update the Committee on cyber security in June 2019, and at least biannually thereafter.



Internal Audit Update Report


ACARAC (05-18) Paper 3 – update report

4.1        Gareth Watts presented his latest summary of the Governance and Assurance team’s work.  He referenced a GDPR training course attended by the Data Protection Officer, the CIPFA Better Governance Forum conference attended by the Governance Manager and further professional development of the trainee internal auditor.

4.2     Gareth had discussed those elements within his plan which were of most interest to the WAO, in particular regarding the financial statements. He would continue to liaise with the WAO to ensure mutual support in accordance with their joint working protocol.    

4.3     When questioned by the Committee on the use of TIAA, Gareth explained that as Head of Governance and Assurance, when areas within his responsibility were audited, a provision in the Internal Audit Charter stated that these audits had to be outsourced to ensure neutrality.  He would update the new Committee members regarding TIAA and invite a representative to the February meeting.     

4.4     He confirmed that there were no outstanding recommendations from 2016-17.


     Gareth to provide the new Committee members with further information about TIAA and to invite a representative to the February meeting.



Consider latest Internal Audit reports and Previously circulated IA Report(s)


ACARAC (05-18) Paper 4 – Events review (Moderate Assurance)

5.1        The Committee welcomed this report.  The review was initiated by changes to the booking system and to the structure of the team. 

5.2     Manon Antoniazzi described the booking system that had been in place for over a year and the on-going need to communicate and engage with Assembly Members.


      Gareth to circulate the action plan for communications and benefits realisation. 

ACARAC (05-18) Paper 5 – Risk Management (Substantial Assurance)

5.3     The Committee were encouraged by the result of this audit and paid tribute to Kathryn Hughes and Jane Legge for their work in developing the system. 

5.4     The Chair confirmed that the Commission had demonstrated increasing risk management maturity during his tenure, and that he was encouraged by the risk management forums and networks in place and the involvement of staff at all levels. 

5.5     Members questioned the roll-out of the new risk management system, the training involved and how effective the risk forum was in terms of engagement, especially if risk champions were absent from the meeting.  Gareth and Kathryn described the training involved which included a full refresh of risk management for all heads of service and risk champions.  They agreed that risk champions should be encouraged to attend, but felt that the forum was established and robust enough to cope with a fluctuating membership.  Forum minutes were circulated to Heads of Service and published internally which Kathryn felt kept those involved updated.      

5.6     The Committee queried the absence of issue management reporting.  This was in development and would be presented by Dave at the February meeting.   


      Dave Tosh to present the Committee with an issue management log. 

ACARAC (05-18) Paper 6 – Assurance Framework (Advisory Review, no assurance opinion)

6.1     The Committee welcomed the positive review.  They suggested that a process flowchart would have helped clarify the report, and that third line assurance should include the Independent Adviser review of directorate governance statements.



Review HMT/other guidance for Audit and Risk Assurance Committees (Chair and Head of Internal Audit)


Oral item

7.1        The HM Treasury audit and risk assurance committee handbook published in March 2016 remained the most up to date version.  The Clerking team confirmed that the terms of reference and forward work programme were based on the latest version of the handbook.  The Chair remained a member of the WAO Committee Chairs forum and encouraged the future Committee chair to become involved next year. He would share the latest WAO ARAC Chairs Forum papers with Committee members and officials.  He also highlighted NAO guidance for digital transformation programmes, challenging costs in major projects and excellence in reporting.            

7.2     Gareth Watts had previously shared National Audit Office, CIPFA and TIAA updates with Committee members and welcomed questions on the information circulated.     

7.3     Committee members asked if the WAO had any examples of good practice to share with the Committee.  Gareth Lucey described a Good Practice hub on the WAO website for public sector organisations and charities.  The Clerking team would ensure a link was circulated.    


      Eric Gregory to circulate latest WAO ARAC Chairs Forum papers to Committee members and officials (complete). 



Updates from WAO


ACARAC (05-18) Paper 7 - WAO update

ACARAC (05-18) Paper 8 - 2019 audit plan

8.1        Gareth Lucey confirmed that there was no outstanding work from the 2017-18 audit.  He would shortly confirm the final out-turn, which was likely to be below the initial estimate (post-meeting: final cost is £57,255, £703 below Audit Plan estimate).   

8.2     The 2019 Audit Plan had been shared and discussed with officials previously. Initial planning meetings had taken place and the audit approach and provisional timings remained fundamentally unchanged. The audit team would remain unchanged and Gareth anticipated being able to confirm the fee early in 2019.

8.3     As the new Auditor General for Wales was an employee of the Commission for part of 2018-19, the Assistant Auditor General would certify the Commission 2018-19 financial statements. 

8.4     The WAO outlined some key changes to the International Financial Reporting Standards (IFRS) over the next two financial years, including the introduction of IFRS 9 (financial instruments) and IFRS 15 (revenue from customer contracts) in 2018-19.  The introduction of IFRS 16 (leases) had already been reported to the Finance Committee (FC) and the Committee agreed that Nia Morgan should inform the FC of the delay, with the effective date moving from 2019-20 to 2020-21.       

8.5     The Committee encouraged the WAO and the finance team to continue to exploit additional efficiency benefits of the NAV finance system for the external audit of the Assembly Commission’s financial statements.


-        Nia Morgan to inform the Finance Committee of the delay in the implementation of IFRS 16 (leases).  



Feedback on recent Finance Committee and Public Accounts Committees


ACARAC (05-18) Paper 9 - Finance Committee and Public Account Committee (PAC) Update

ACARAC (05-18) Paper 9 - Appendix 1

ACARAC (05-18) Paper 9 - Appendix 2

9.1        Nia presented the Committee with updates on the Commission’s recent scrutiny sessions.  Both sessions resulted in various recommendations for the Commission, although the PAC report was yet to be published.   

9.2     FC received a detailed outline of the 2019-20 draft budget which was subsequently agreed by the Assembly on 14 November 2018.  During the scrutiny session Suzy, Manon and Nia highlighted areas of priority which were the Youth Parliament, Assembly Reform and Legislation Workbench.

9.3     As the Youth Parliament project was innovative and had not been mirrored by other legislatures, exact costs were difficult to predict and could be challenged at future Finance and PAC meetings. 

9.4     The Committee were encouraged by the elevated transparency evident in the  scrutiny sessions and the level of preparation involved across the organisation, especially by the Finance team.  They thanked Nia, Manon and Suzy for their contributions to this item.



Update on 2018-19 Financial Position and 2019-20 Budget


ACARAC (05-18) Paper 10 - Update on 2018-19 Financial Position and 2019-20 Budget

10.1     Nia presented an update on the 2018-19 financial position, confirming that outturn will not exceed budget and that the value for money and prompt payment targets will be met.  The 2019-20 budget, agreed by the Assembly in November, uses an alternative model to address FC and PAC concerns regarding the Remuneration Board’s Determination Budget, and reflects an increase of 1.67%. 

10.2    The Committee welcomed this overview, and requested further detail on the terms of the business efficiency savings.


      Nia Morgan to produce an addendum to the minutes detailing the business efficiency element of the value for money savings. 


Corporate Risks Report


ACARAC (05-18) Paper 11 – Corporate Risk

ACARAC (05-18) Paper 11 – Annex A – Summary Corporate Risk Register

ACARAC (05-18) Paper 11 – Annex B – Summary Corporate Risks plotted

11.1     Dave highlighted changes to the Corporate Risk Register following the Executive Board’s review in October.  The Youth Parliament safeguarding risk  had recently been proposed as a corporate risk, and the project team had engaged the NSPCC to provide external assurance of the draft induction manual.

11.2    There had been delays in securing staff DBS clearances, but the project had now focused applications on a priority basis and DBS checks for all staff working directly with young people will be conducted in December and January. The Assembly had accepted that the critical rating of this risk would remain unchanged due to the nature of the work involved. 

11.3    The previous Dignity and Respect risk had been replaced by a new risk focussed on the potential loss of confidence in the Dignity and Respect regime, and a series of actions are underway to improve and embed the desired Dignity and Respect culture.  The Committee thanked Dave and Manon for this update and requested that the new Dignity and Respect risk (CAMS-R-95) be critically examined in February.


      Clerking team to arrange for a critical examination of the Dignity and Respect risk at the February meeting. 


Critical examination of one identified or emerging risk


Oral update on inter-related risks around Assembly reform

12.1     The Chair welcomed Anna Daniel and Matthew Richards to update the Committee on the work being undertaken as part of the Assembly reform programme.  Their focus had been on stakeholder engagement and scenario planning for additional Assembly Members.  Anna described their approach as being agile to ensure that they could react to unforeseen incidents. 

12.2     Whilst welcoming the associated public consultation, the Committee noted that there was a relatively low response rate of 1830, and that this would require ongoing scrutiny.  They thanked both Anna and Matthew for the comprehensive update and would welcome further updates in future. 



Departure Summary


ACARAC (05-18) Paper 12 – Departure Summary

13.1     There had been four departures from normal procurement procedure to report to the Committee: an HR and Employment Law advice portal; CIPD HR partner training; Media Access Licence; and the 20-year anniversary campaign.  The Committee noted all four departures as appropriate but were disappointed that the 20-year anniversary campaign had attracted only one bid.



Update from the Chair on presentation of the ACARAC Annual Report to the Assembly Commission


Oral Update

14.1     The Chair and Suzy confirmed that the Commission had welcomed the ACARAC annual report in July. 



Forward Work Programme


15.1     This would be subject to change depending on suggestions from the new Independent Advisors.


Next meeting is scheduled for 11 February 2019.