Audit, Risk and Assurance Committee

The formal minute of the public items of business will be available at the meeting scheduled for 21 May 2025. These will also be published on the SPA’s website. A full recording of the public items of business taken at this meeting can be accessed at Scottish Police Authority Audit, Risk & Assurance Committee - 6 February 2025 | Scottish Police Authority

ITEMS OF BUSINESS CONSIDERED
• Internal Audit progress update and report on Implementation of Change Projects and Realisation of the Change Benefits
• Annual Audit Plans from Internal Audit and External Audit
• Audit and Improvement Recommendation Trackers
• Best Value Updates
• Committee Effectiveness
• Risk Management Reporting
• Cyber Security Update

KEY ISSUES RAISED
• Internal and External Audit Reporting
o Internal Audit Report: Implementation of Change Projects and Realisation of the Change Benefits. Members welcomed the report and questions focussed on the actions required to meet milestones. BDO confirmed they would be looking for evidence of embedding new requirements and tracking benefits. Members were assured that a focus of the Resources Committee was on monitoring change benefits. The Committee were told of a recent change prioritisation exercise undertaken by Police Scotland, and heard how the new portfolio alignment in Police Scotland will increase the focus on change and transformation within the organisation.
o Annual Internal Audit Plan. The Committee agreed it was a comprehensive plan and welcomed the collaborative approach taken in its development. Members heard BDO consider all risk registers during development with focus given to risks that have the most impact on strategic objectives.
o Annual External Audit Plan. The Committee supported the plan. They received assurance that there was engagement with Audit Scotland to mitigate the risk of delays in the completion of pension funds accounts that impact on the SPA Annual Report and Accounts. Members were also informed that the Best Value Audit would not impact the deadlines for completing the Annual Report and Accounts.

• Audit and Improvement
o Police Scotland Audit and Improvement. Discussion focussed on the number of open and past due recommendations. Whilst recognising that the management of recommendations will be considered as a specific internal audit later this year, Members encouraged appropriate prioritisation as well as discussions to determine whether evidence is good enough to mitigate against the original risk. The Committee were informed that all recommendations are aligned with Best Values themes to support preparedness for the Best Value Audit.
o SPA Audit and Improvement Recommendations Update. The Chief Executive confirmed she was satisfied that 77% of the corporate strategy milestones had been achieved. Members heard another 14 were due to be delivered within the final quarter which the Committee welcomed.
o Internal Audit Update. Discussion focussed on an outstanding recommendation for Forensic Services relating to case file management. The Committee heard further discussions were required and noted the possibility that the new process set out to consider disputed recommendations may be used and reported to the next Committee. Assurance was provided that all Internal Audit Reports scheduled to come to the next Committee were on track and no delays were anticipated.

• Assurance Reporting
o Police Scotland Best Value. The Committee were provided with an update on progress. A self-assessment survey was completed by Senior Leaders with more detailed workshops being undertaken. The overall results will be reported to the Committee in due course. The Committee noted an agreed deadline for self-assessments had not been given but Police Scotland were working towards April 2025 as indicated in the initial correspondence. The Committee were assured Police Scotland will seek clarity on what is expected from HMCIS and Audit Scotland in relation to evidence.
o SPA and Forensic Services Best Value. Discussion focussed on compliance levels and evidencing continuous improvement.
o Committee Effectiveness. The Committee welcomed the report and discussed where Committee improvements can be made, citing equality and diversity reporting, and the volume and length of reports as examples. Members noted that the overall results for all SPA Committees will be reported to the next ARAC meeting.
o Cyber Security Update. An update was received from Police Scotland on current activity where discussion focussed on lessons learned.

• Risk Management Reporting. The Committee received updates from SPA, Police Scotland and Forensic Services. Discussion focussed on risks out with tolerance and actions being taken to bring into tolerance.

CONCLUSIONS/ACTIONS REACHED
• The Committee approved the Annual Internal Audit Plan.
• The Committee recommended the SPA Strategic Risk Review to the Authority for approval.
• The Committee remain concerned on the number of open recommendations and associated level of delays.
• The Committee are seeking an update at the next meeting on progress to resolve a disputed recommendation relating to Forensic Services, as well as progress on two high risk recommendations relating to ICT delivery.