Audit, Risk and Assuranace Committee

The formal minutes of the public items of business will be available at the meetings scheduled for 9 May 2024. These will also be published on the SPA’s website. A full recording of the public items of business taken at these meetings can be accessed at Scottish Police Authority Audit, Risk and Assurance Committee | Scottish Police Authority (spa.police.uk)

ITEMS OF BUSINESS CONSIDERED

• Internal Audit Update and report on New Legislation
• Annual Internal and External Audit Plans
• Police Scotland and SPA Audit and Improvement Recommendation Trackers
• ICO Audit of Police Scotland
• HMICS Inspection - SPA Validated Self-Assessment update SPA Public Duties
• Police Scotland, Forensic Services and SPA Risk Management Reporting
• Police Scotland DESC Update

KEY ISSUES RAISED

• Internal and External Audit Reporting
o Internal Audit Update. Members expressed disappointment only one of four scheduled reports was completed and presented. The Chief Executive confirmed a meeting had been requested with relevant teams in SPA and Police Scotland to ensure draft reports are responded to.
o Internal Audit Report on New Legislation. Members welcomed the report and discussed the wider impacts whilst acknowledging the main driver was to provide a financial perspective.
o Annual Internal and External Audit Plans. Members welcomed both reports and their approval was sought for the Internal Audit Plan. Discussion on the External Audit Plan focussed on materiality threshold and additional costs for pension audit work. Members were assured the materiality threshold is reviewed annually, and additional costs related to the complexity of Police Scotland pensions following an initial fee based on other public sector bodies.
• Audit and Improvement Progress
o Police Scotland Audit and Recommendation Tracker. Discussion focussed on assurances that closed recommendations have the desired impact and high-risk recommendations are prioritised. Members encouraged indicative timelines are added to pending recommendations with no completion dates.
o SPA Audit and Recommendation Tracker. Members shared the Chief Executive’s concerns over the re-opening of two recommendations from the HMICS Toxicology inspection. The Committee supported the Chief Executive’s reluctance to allocate staff resource to an area of work which Scottish Government have already ruled out.
• Assurance Reporting
o ICO Audit of Police Scotland. The Committee received progress updates on work to complete ICO Audit recommendations, and the mobile phone data extraction project. The Committee were assured that recommendations from both were anticipated to be completed on time.
o Police Scotland DESC Update. Members were provided with a progress update on the pilot and an overview of the Pilot Evaluation Report. The Committee acknowledged the system is working well but noted some compliance issues still needed to be fully resolved.
• Risk Management Reporting. Members received updates from Police Scotland, Forensic Services and SPA. Whilst the Committee’s focus of the Forensic Services Risk Review is on trends, it was noted that the People Committee would be provided an update on the people and wellbeing impacts of risks. Discussion on the Police Scotland Risk Review focused on risk appetite and tolerance, and the Committee was asked to recommend the SPA Strategic Risk Review to the Authority.

CONCLUSIONS/ACTIONS REACHED

• The Committee approved the Annual Internal Audit Plan
• The Committee agreed to schedule an additional meeting in March to allow reporting of delayed Internal Audit reports.
• The Committee noted a report to the Authority may be required to gain a definitive SPA position on two re-opened recommendations from the HMICS Toxicology Inspection.
• The Committee recommended the SPA Strategic Risk Review to the Authority for approval.
• Police Scotland committed to updating the Committee on the outcome of their review of risk appetite.
• Members and Police Scotland leads agreed that timescales for DESC go-live may need to move to ensure compliance agreements are in place. The outcome of the SIRO review of DESC will also be reported to the SPA.