Audit, Risk and Assurance Committee

The formal minutes of the public items of business will be available at the meetings scheduled for 6 February 2024. These will also be published on the SPA’s website. A full recording of the public items of business taken at these meetings can be accessed at Scottish Police Authority Audit, Risk & Assurance Committee - 7 November 2023 | Scottish Police Authority (spa.police.uk).

ITEMS OF BUSINESS CONSIDERED

• Internal Audit Reports (Decision making processes (governance); Ill health retirements and injury; and Biometrics)
• Internal Audit Update
• Police Scotland and SPA Audit and Improvement Recommendation Trackers
• ICO Audit of Police Scotland
• SPA Best Value
• SPA Public Duties
• Police Scotland Change Portfolio Update
• Police Scotland, Forensic Services and SPA Risk Management Reporting
• Police Scotland and SPA Information Management Reporting
• Cyber Security Update

KEY ISSUES RAISED

• Internal Audit Reporting
o Internal Audit Report on Decision Making Processes (governance); Ill Health retirements and injury; and Biometrics. Members welcomed the reports on each and recognised the links with the People Committee in respect of the ill health retirements and injury. Whilst the People Committee will also have sight of the report and examine some detail further, the Audit, Risk and Assurance Committee will continue to monitor progress against the recommendations.
• Assurance Reporting
o Police Scotland Audit and Recommendation Tracker. Discussion focussed on the number of open recommendations as Members raised concern over the increase in numbers and delays in some. It was noted the number of recommendations from HMICS had increased greatly during the last quarter and many recommendations were complex with interdependencies across the organisation or with key partners. Members were assured that internal scrutiny is regular and action plans and evaluations are used to manage progress. Members questioned the impact of the current financial challenges and were assured most recommendations don’t require additional cost; however, any costs and budget planning are factored into timescales. The Committee emphasised the importance of progressing high risk recommendations.
o Police Scotland Change Portfolio Update. Discussion focussed on the timing of change requests brought to formal governance meetings, and the impact of financial challenges. The Committee were assured no change activity had been stopped due to financial constraints, and costs were factored into current change timelines and future change plans.
o ICO Audit of Police Scotland. The Committee noted the audit was technical and detailed and had led to a number of recommendations. Assurance was provided that a large proportion would be completed by the end of the calendar year. Due to the number and complexity, Members indicated they would like to see further reporting.
o The Committee welcomed the reports in relation to SPA Best Value and SPA Public Duties, and acknowledged the positive progress made thus far, and plans for future development.
o Information Management 6 monthly Report. Members heard an update from Police Scotland and SPA where discussion focussed on the potential impact of having further information available online.
o Cyber Security. Members were provided with an update on current activity and strategic direction, and discussion focussed on financial resource.
• Risk Management Reporting. Members received updates from Police Scotland, Forensic Services and SPA where discussion focussed on new risks and those that sat above tolerance. Approaches to risk management is to be discussed during the Committee Development Day on 24 November.

CONCLUSIONS/ACTIONS REACHED

• This was the last Change Portfolio Update presented to the Committee as following the recent governance review, oversight of change will now be monitored by the Resources Committee.
• The Forensic Services Strategic and Corporate Risk Review will now be presented to the Committee on a quarterly basis along with Police Scotland’s and SPA’s
• Members requested to be provided with further information on the proposal to set aside recommendation 6 from the HMICS Assurance Review of the Toxicology.
• The Committee requested a report be brought to the February 2024 Committee on progress of discharging recommendations from the ICO Audit Report.