Agenda and minutes
Venue: Conference Room 4B - Tŷ Hywel. View directions
Contact: Clerk: Kathryn Hughes Deputy Clerk: Buddug Saer
No. | Item |
---|---|
Introductions, apologies and declaration of interests Minutes: 1.0 Item
1 - Introductions, apologies and declarations of interest 1.1 One
apology was received from Ann-Marie Harkin (WAO). 1.2
The Chair welcomed two new Independent
Advisors to the meeting, Ann Beynon and Bob Evans. Ann and Bob outlined their professional
backgrounds and current portfolio of roles. 1.3
The Chair declared that, following the
Parliamentary Review of Health and Social Care in Wales, he was now supporting
the reviews of the Digital Architecture and Governance arrangements. |
|
Minutes of 9 July, actions and matters arising Minutes: ACARAC
(05-18) Paper 1 - Minutes of 9 July 2018 ACARAC
(05-18) Paper 2 – Summary of actions 2.1
With one minor change, the minutes of the meeting of 9 July were
agreed. 2.2
Action 4.3 (Welsh Consolidated Fund- WCF): Gareth Watts confirmed
that the WCF Payments and Receipts accounts for the financial year ended 31
March 2018 had been certified by the Assistant Auditor General for Wales with
an unqualified opinion. The WCF Annual
Governance Statement referenced the matter which had previously been discussed
by the Committee and stated that
discussions between the Welsh Government, the Assembly Commission and
the Auditor General for Wales would continue to establish whether any further
action was required by the Welsh Government to ensure this issue was
resolved. Gareth would be involved and
would update the Committee. Gareth Lucey re-confirmed that, from the
perspective of both the Assembly Commission and WCF audit teams, there was no
irregularity regarding the Standards Commissioner’s salary payments. 2.3
Action 5.8: the Clerking team will consult with Committee members
regarding the forward work programme. 2.4
Action 6.4 (finance system project update): now superseded, the
project SRO will be invited to the February ACARAC meeting. Actions –
Gareth Watts to provide a WCF update. –
Clerking team to share FWP with Committee members to ensure dates
are suitable and to invite suggestions for future agenda items. –
Clerking team to invite Finance System project SRO to the February
meeting for an update on phase 3. |
|
Cyber-Security Progress Update Minutes: Oral item 3.1
The Committee welcomed Mark Neilson and Richard
Coombe to the meeting to present an update on cyber security. Following their last update in April, the
Windows 10 upgrade had been fully implemented.
The Committee were reassured by the security benefits of the Windows 10
platform. 3.2
Mark outlined the timetable of future testing
plans. The Committee welcomed the
Commission’s intention to join a Cyber Essentials scheme, a UK
Government-backed, industry-supported scheme to help organisations protect
themselves against common online threats.
3.3
The cyber security risk radar chart illustrated
progress in all areas, but raised questions about the priority of user
education and awareness. Suzy Davies
encouraged Mark and his team to use the Commissioners to engage with their
parties and to encourage their colleagues to take part in awareness raising and
training sessions. 3.4
Mark and Richard ensured that the Commission engaged
with other organisations, including other legislatures and the National Cyber
Security Centre. 3.5
Whilst recognising that cyber security requires
constant vigilance, the Committee were encouraged with progress. An internal
audit review of cyber security was scheduled for early 2019, and the Committee
would welcome a further update in June 2019 and at least biannually
thereafter. Action –
Mark Neilson to use Assembly Commissioners to communicate key
messages to their
groups of AMs and AMSS in terms of the training available and awareness
raising. –
Mark and Richard to update the Committee on cyber
security in June 2019, and at least biannually thereafter. |
|
Internal Audit Update Report Minutes: ACARAC
(05-18) Paper 3 – update report 4.1
Gareth Watts presented his latest summary of the
Governance and Assurance team’s work. He
referenced a GDPR training course attended by the Data Protection Officer, the
CIPFA Better Governance Forum conference attended by the Governance Manager and
further professional development of the trainee internal auditor. 4.2
Gareth had discussed those elements within his plan
which were of most interest to the WAO, in particular regarding the financial
statements. He would continue to liaise with the WAO to ensure mutual support
in accordance with their joint working protocol. 4.3
When questioned by the Committee on the use of TIAA,
Gareth explained that as Head of Governance and Assurance, when areas within
his responsibility were audited, a provision in the Internal Audit Charter
stated that these audits had to be outsourced to ensure neutrality. He would update the new Committee members
regarding TIAA and invite a representative to the February meeting. 4.4
He confirmed that there were no outstanding recommendations
from 2016-17. Action –
Gareth to provide the new Committee members with
further information about TIAA and to invite a representative to the February
meeting. |
|
Consider latest Internal Audit reports and Previously circulated IA Report(s) Minutes: ACARAC (05-18) Paper 4 – Events
review (Moderate Assurance) 5.1
The Committee welcomed this report. The review was initiated by changes to the
booking system and to the structure of the team. 5.2
Manon Antoniazzi described the booking system that had been in
place for over a year and the on-going need to communicate and engage with
Assembly Members. Action – Gareth to circulate the
action plan for communications and benefits realisation. ACARAC
(05-18) Paper 5 – Risk Management (Substantial Assurance) 5.3
The
Committee were encouraged by the result of this audit and paid tribute to
Kathryn Hughes and Jane Legge for their work in developing the system. 5.4
The
Chair confirmed that the Commission had demonstrated increasing risk management
maturity during his tenure, and that he was encouraged by the risk management
forums and networks in place and the involvement of staff at all levels. 5.5
Members questioned the roll-out of the new risk
management system, the training involved and how effective the risk forum was
in terms of engagement, especially if risk champions were absent from the
meeting. Gareth and Kathryn described
the training involved which included a full refresh of risk management for all
heads of service and risk champions.
They agreed that risk champions should be encouraged to attend, but felt
that the forum was established and robust enough to cope with a fluctuating
membership. Forum minutes were
circulated to Heads of Service and published internally which Kathryn felt kept
those involved updated. 5.6
The Committee queried the absence of issue
management reporting. This was in
development and would be presented by Dave at the February meeting. Action – Dave Tosh to present the
Committee with an issue management log. ACARAC (05-18) Paper 6 – Assurance
Framework (Advisory Review, no assurance opinion) 6.1 The
Committee welcomed the positive review.
They suggested that a process flowchart would have helped clarify the
report, and that third line assurance should include the Independent Adviser
review of directorate governance statements. |
|
Review HMT/other guidance for Audit and Risk Assurance Committees (Chair and Head of Internal Audit) Minutes: Oral item 7.1
The HM Treasury audit and risk assurance committee
handbook published in March 2016 remained the most up to date version. The Clerking team confirmed that the terms of
reference and forward work programme were based on the latest version of the
handbook. The Chair remained a member of
the WAO Committee Chairs forum and encouraged the future Committee chair to
become involved next year. He would share the latest WAO ARAC Chairs Forum
papers with Committee members and officials.
He also highlighted NAO guidance for digital transformation programmes,
challenging costs in major projects and excellence in reporting. 7.2
Gareth Watts had previously shared National Audit
Office, CIPFA and TIAA updates with Committee members and welcomed questions on
the information circulated. 7.3
Committee members asked if the WAO had any examples
of good practice to share with the Committee.
Gareth Lucey described a Good Practice hub on the WAO website for public
sector organisations and charities. The
Clerking team would ensure a link was circulated. Action – Eric Gregory to
circulate latest WAO ARAC Chairs Forum papers to Committee members and
officials (complete). |
|
Updates from WAO Minutes: ACARAC
(05-18) Paper 7 - WAO update ACARAC
(05-18) Paper 8 - 2019 audit plan 8.1
Gareth Lucey confirmed that there was no outstanding
work from the 2017-18 audit. He would
shortly confirm the final out-turn, which was likely to be below the initial
estimate (post-meeting: final cost is £57,255, £703 below Audit Plan
estimate). 8.2
The 2019 Audit Plan had been shared and discussed
with officials previously. Initial planning meetings had taken place and the
audit approach and provisional timings remained fundamentally unchanged. The
audit team would remain unchanged and Gareth anticipated being able to confirm
the fee early in 2019. 8.3
As the new Auditor General for Wales was an employee
of the Commission for part of 2018-19, the Assistant Auditor General would certify
the Commission 2018-19 financial statements.
8.4
The WAO outlined some key changes to the
International Financial Reporting Standards (IFRS) over the next two financial
years, including the introduction of IFRS 9 (financial instruments) and IFRS 15
(revenue from customer contracts) in 2018-19.
The introduction of IFRS 16 (leases) had already been reported to the
Finance Committee (FC) and the Committee agreed that Nia Morgan should inform
the FC of the delay, with the effective date moving from 2019-20 to
2020-21. 8.5
The Committee encouraged the WAO and the finance
team to continue to exploit additional efficiency benefits of the NAV finance
system for the external audit of the Assembly Commission’s financial
statements. -
Nia
Morgan to inform the Finance Committee of the delay in the implementation of
IFRS 16 (leases). |
|
Feedback on recent Finance Committee and Public Accounts Committees Minutes: ACARAC (05-18) Paper 9 - Finance
Committee and Public Account Committee (PAC) Update ACARAC (05-18) Paper 9 - Appendix 1 ACARAC (05-18) Paper 9 - Appendix 2 9.1
Nia presented the Committee with updates on the
Commission’s recent scrutiny sessions.
Both sessions resulted in various recommendations for the Commission,
although the PAC report was yet to be published. 9.2
FC received a detailed outline of the 2019-20 draft
budget which was subsequently agreed by the Assembly on 14 November 2018. During the scrutiny session Suzy, Manon and
Nia highlighted areas of priority which were the Youth Parliament, Assembly
Reform and Legislation Workbench. 9.3
As the Youth Parliament project was innovative and
had not been mirrored by other legislatures, exact costs were difficult to
predict and could be challenged at future Finance and PAC meetings. 9.4
The Committee were encouraged by the elevated
transparency evident in the scrutiny
sessions and the level of preparation involved across the organisation,
especially by the Finance team. They
thanked Nia, Manon and Suzy for their contributions to this item. |
|
Update on 2018-19 Financial Position and 2019-20 Budget Minutes: ACARAC (05-18) Paper 10 - Update on 2018-19 Financial
Position and 2019-20 Budget 10.1 Nia
presented an update on the 2018-19 financial position, confirming that outturn
will not exceed budget and that the value for money and prompt payment targets
will be met. The 2019-20 budget, agreed
by the Assembly in November, uses an alternative model to address FC and PAC
concerns regarding the Remuneration Board’s Determination Budget, and reflects
an increase of 1.67%. 10.2 The
Committee welcomed this overview, and requested further detail on the terms of
the business efficiency savings. Action –
Nia
Morgan to produce an addendum to the minutes detailing the business
efficiency element of the value for money savings. |
|
Corporate Risks Report Minutes: ACARAC
(05-18) Paper 11 – Corporate Risk ACARAC
(05-18) Paper 11 – Annex A – Summary Corporate Risk Register ACARAC
(05-18) Paper 11 – Annex B – Summary Corporate Risks plotted 11.1
Dave highlighted changes to the Corporate Risk Register
following the Executive Board’s review in October. The Youth Parliament safeguarding risk had recently been proposed as a corporate
risk, and the project team had engaged the NSPCC to provide external assurance
of the draft induction manual. 11.2
There had been delays in securing staff DBS
clearances, but the project had now focused applications on a priority basis
and DBS checks for all staff working directly with young people will be
conducted in December and January. The Assembly had accepted that the critical
rating of this risk would remain unchanged due to the nature of the work
involved. 11.3
The previous Dignity and Respect risk had been
replaced by a new risk focussed on the potential loss of confidence in the
Dignity and Respect regime, and a series of actions are underway to improve and
embed the desired Dignity and Respect culture.
The Committee thanked Dave and Manon for this update and requested that
the new Dignity and Respect risk (CAMS-R-95) be critically examined in
February. Action – Clerking
team to arrange for a critical examination of the Dignity and Respect risk at
the February meeting. |
|
Critical examination of one identified or emerging risk Minutes: Oral update on inter-related risks around Assembly reform 12.1
The Chair welcomed Anna Daniel and Matthew Richards
to update the Committee on the work being undertaken as part of the Assembly
reform programme. Their focus had been
on stakeholder engagement and scenario planning for additional Assembly
Members. Anna described their approach
as being agile to ensure that they could react to unforeseen incidents. 12.2
Whilst welcoming the associated public
consultation, the Committee noted that there was a relatively low response rate
of 1830, and that this would require ongoing scrutiny. They thanked both Anna and Matthew for the
comprehensive update and would welcome further updates in future. |
|
Departure Summary Minutes: ACARAC
(05-18) Paper 12 – Departure Summary 13.1 There
had been four departures from normal procurement procedure to report to the
Committee: an HR and Employment Law advice portal; CIPD HR partner training;
Media Access Licence; and the 20-year anniversary campaign. The Committee noted all four departures as
appropriate but were disappointed that the 20-year anniversary campaign had
attracted only one bid. |
|
Update from the Chair on presentation of the ACARAC Annual Report to the Assembly Commission Minutes: Oral
Update 14.1
The Chair and Suzy confirmed that
the Commission had welcomed the ACARAC annual report in July. |
|
Forward Work Programme Minutes: 15.1 This
would be subject to change depending on suggestions from the new Independent
Advisors. Next meeting is scheduled
for 11 February 2019. |