Public minutes of the Audit and Risk Assurance Committee meeting

on Monday 14 October 2024 at 10.30am
MSTeams

Members

• Liz Butler - Chair
• Richard Hughes
• Kalpesh Brahmbhatt

In attendance

• Shayne Coulson - MHCLG Policy Lead: Affordable Housing, Regulation and Investment
• Lisa Harvey - Audit Manager, Government Internal Audit Agency
• Fiona MacGregor - Chief Executive
• Mike Newbury - NAO, Audit Director
• Jenny Obee -Engagement Lead, Government Internal Audit Agency
• John O’Mahony - Assistant Director Corporate Services (for item 9)
• Sandy Pacek -Head of Corporate Services (for item 8)
• Richard Peden - Director, Finance and Corporate Services
• Richard Smith - NAO, Engagement Manager
• Emma Tarran - Senior Assistant Director Head of Legal and Company Secretary
• Jonathan Walters - Deputy Chief Executive and Accounting Officer

Minutes

• Chris Kitchen - Board Secretary

1. Welcome and apologies

01/10/24 The Chair welcomed Shayne Coulson and others to the meeting.

2. Declarations of Interest

02/10/24 There were no new declarations of interest.

3. Minutes of the last meeting

03/10/24 The minutes from 17 June 2024 were approved.

4. Matters Arising

04/10/24 11/11/24: NAO audit lessons learned: MN confirmed the NAO audit team have carried out a review of the 2022-23 audit and will be implementing improvements going forward. It is hoped that 2022-23 accounts will be signed off by the NAO shortly. This will remain on matters arising.

18/11/24 Strategic Risk Register: The Board teach in on risk appetite & tolerance will be scheduled once the new ARAC Chair is in post.

5. NAO Update

05/10/24 MN introduced this item.

06/10/24 In respect of the 2023-24 accounts, MN advised that the NAO have the team in place to complete the audit and are awaiting confirmation of timings for when it can be presented to ARAC and Board. RBP said that as the November date is no longer viable, the next meeting of ARAC and Board is January if the NAO are able to complete their audit within that timeframe. MN said that this would additionally be dependent on the LGPS actuary reports being received in time, but did not currently see a problem with meeting the January date.

07/10/24 MN advised that for the 2024-25 audit, NAO’s ambition is that the audit will be back on track to the original timetable (October) but again dependent on LGPS assurance being received and pressures on the NAO from other Government bodies. RBP said that we must aspire to get the audit completed by the summer parliamentary recess. LB requested that the NAO keep us informed and give us as much notice as possible if there is going to be any change with the completion of the audit.

6. GIAA update

08/10/24 LH introduced the GIAA report, which provided an overview of progress against the 2024-25 plan, including changes to the 2024-25 IA Plan, and an overview of the outcomes of the three audits, since the last ARAC meeting:

• Expanded Consumer Regulation Remit
• Registrations
• Governance and Whistleblowing.

LH advised the proposal was that Procurement and Payment Controls audit be done in Q3 due to a commission from MHCLG. The Q4 Consumer Regulations audit and Resourcing and Resilience is due to be scoped later this month and will be completed on time. RBP to discuss the IA plan with GIAA. Action: RBP

09/10/24 JO advised that the recommendations from the other audits in the 2024/25 programme are either completed or on track for completion:

• Expanded Consumer Regulation – substantial rating – no significant issues. The new regime was implemented on 1 April 2024.
• Governance and Whistleblowing – overall substantial assurance rating.Two recommendations: one low and one medium priority respectively.
• Registrations – moderate rating – four medium and one low recommendations

10/10/24 Expanded consumer regulation audit: KB asked about progress on the implementation review plan . FM replied that there are a number of strands to completing the review. We continue to gather feedback from the provider after every inspection and we also carry out internal reviews of the processes. Work is on-going to produce a brief to carry out an impact assessment of our inspection process, which is in early stages of development. It was agreed that when complete, it would be reported to Board and ARAC will be kept informed on progress.

11/10/24 Governance: there was one low priority recommendation relating to a decision on when the NRC self-assessment will take place. RH raised of the issue that in some cases Board member terms have had to be extended beyond the recommended maximum term, due to delays in appointments of new Board members. There was acknowledgment this was out of the control of the RSH but was worth highlighting. SC acknowledged this was a valid point and it was being considered by the department (MHCLG).

Whistleblowing: one medium priority recommendation relating to the refreshed whistleblowing policy needing approval, communication to staff and full implementation, with ongoing oversight of the process and regular communications to staff to raise awareness of the policy and its processes.

12/10/24

Registrations: the following actions were recommended:

• A review by the Executive of our approach to registrations, including aconsideration of risks, risk appetite and a sense check of whether ourapproach is still appropriate in the changing regulatory and politicallandscape.
• That the RAC is chaired by a member of the Exec to bring it in line withother assurance panels.
• To strengthen evidencing of quality control processes to include approvalemails being filed with casework evidence.
• To review externally facing guidance and application forms for consistencyof tone and the standard letter templates used to communicate withapplicants.
• To implement a process to document high level registration procedurescovering in-house end to end processes.

JW advised that Executive had been aware that a review of Registrations is timely, and welcomes the recommendations. KB asked about the areas highlighted in the report which play into our overall risk of ensuring a continuing focus on economic regulation. FM gave assurance that the registrations process is robust but that areas identified were useful to pick up. It was also noted that that our strategic appetite and our decisions are set within the legislation that applies to registrations.

13/10/24 The supplementary ARAC pack was noted and LB thanked LH and JO for very good reports.

7. Counter fraud, bribery and corruption update

14/10/24 RBP introduced the report which was a routine review of the policy and action plan and the table set out the areas of change. LB suggested that the checklist for staff on page 2 of the response plan include the amendment in respect of the delegation of the Chief Executive’s role should both the CEO and DCEO be unavailable. The suggested changes were discussed and found to be appropriate. Action: RBP

8. Procurement exemption

15/10/24 RBP explained the procurement exemptions listed in the paper, none of which were major items or high amounts. Members were given assurance that the next renewal will be carried out under a framework agreement and there will be more than 8 providers to choose from. The report was noted.

9. Strategic Risk Register

16/10/24 JOM and SP joined the meeting and this was to be a full review of the SRR which ARAC have regular sighting of and had been previously discussed with Executive and risk controllers. It is proposed that following the ARAC review of the target risk scores and the revised register, it will be taken to Board in November. JOM advised that the further actions were designed to increase the effectiveness of the control but would not guarantee this will bring the risk back to appetite. It is the view of the team and Executive that we keep the risk appetite where it is and then review the risk tolerance. LB stated that in some cases, we do not have a choice on the risk tolerance as it could be outside of our control and this should be kept in mind when reviewing the register.

17/10/24 Members considered the risks and made the following comments on each:

Risk 1: consider the proximity timescale – can/should it be reduced?

Risk 2: members felt this risk can be linked to risks 1 and 5 as they are all evidence based risks. Suggested the narrative is reviewed for all three. We should be able to document the evidence as it exists.

Risk 3: members challenged Executive on this articulation of this risk - is the real risk that we get the balance wrong, or that objectively speaking the balance is wrong. It was felt that the narrative currently reads we could get things wrong, when in fact we are in control of our regulatory approach. FM said that some of the risks are within our control, whilst some are not, so accepted that the inherent score could be lower and the narrative could better differentiate between internal and external risks.

Risk 4: the individual factors were accepted. Members also felt it would be helpful to make the financial element of the risk explicit in the articulation.

Risk 5: It was suggested that the distinction between this risk and the one above could be more clearly drawn, as it is no longer just a H&S risk. Recommend the articulation more explicitly focusses on our consumer remit, as we have done for the economic risk. There was a query as to whether we could include more on tenant/consumer regulation. JW flagged that we need to be mindful that we are not the only regulator – building issues have other regulators – we could potentially add another risk to cover “other significant risks” – Executive to consider.

Risk 6: members recognised that these risks could crystallise in the short term but as long as we regulate well, sometimes a legal challenge could be useful.

Risk 7: our new remit is now embedded, but our agreed approach to regulation will never be such that it satisfies everyone. Executive asked to consider if the likelihood score should be higher?

Risk 8: members acknowledged that the people plan is being developed and will pick up these controls. As this is in our gift, it was suggested that the target could be lower.

Risk 9: the current situation in respect of digital risks is unusual, however these are not expected to be long term risks. Lots of the risks are within our control to manage and RBP gave assurance that once a decision is reached on our IT infrastructure these risks will reduce.

Risk 10: members asked about cyber-attacks and RBP confirmed that reporting is good but agreed to increase the residual risk score.

18/10/24 Officers thanked members for their input. It was agreed that the amendments/comments will be reflected in the version taken to board in November. Action: RBP

10. Pensions update

19/10/24 RBP gave a verbal update and advised that the transfer from HCAPS to the Civil Service Pension Scheme had been successful and there have been no issues reported either on the transfer or from staff.

11. ARAC report to the Board

20/10/24 This is the annual report from the ARAC to the Board covering the previous 12 months to March 2024. Members were content but asked that the paragraph on committee membership is reviewed to pick up on terms that have gone over the 6 year maximum term for the version that goes to board in November. Action: RBP

12. Forward Planner

21/10/24 Members noted the items on the Forward Planner. The length of the January meeting to be extended to allow a full discussion on the ARA and it would be preferable if this was a full face to face meeting. Action: CK

13. Any other business

22/10/24 There was no other formal business. LB thanked members and officers for their input to the discussions.

Date of next meeting: 20 January 2025