Summary Report from Audit, Risk & Assurance Committee

MAIN ITEMS OF BUSINESS

Audit and improvement progress

Internal Audit Reports on organisational learning and cyber security

Internal Audit Annual Plan (2023-24)

Change Portfolio Update

Police Scotland Best Value

Risk management updates (SPA and Police Scotland)

Productions Re-modelling Deep Dive

KEY ISSUES RAISED

Audit and Improvement Progress. Discussion on Police Scotland’s Audit and Improvement Recommendations focussed on the proposal to close a recommendation relating to Benefits Realisation. Further discussions will take place on evidence required and until such time they will remain open. Members welcomed assurance that work is progressing to address discriminations culture whilst the outcomes of the Independent Review Group are awaited. During discussion of SPA’s Audit and Improvement Recommendations, Members were informed a review of ill health retirement documentation was ongoing and outcomes would be reported to the Legal Committee.

Internal Audit Reporting

Internal Audit Report on organisational learning and cyber security. Members welcomed both reports and the status and progress of recommendations agreed. Regarding the organisational learning report, assurance was provided that a mid-point check would be undertaken and the outcome would be reported to the November meeting.

Internal Audit Annual Plan. Members were informed SPA have worked with internal audit on the development of the proposed plan and sought views of key partners including Police Scotland, HMICS and external audit. The plan will be discussed with BDO who take over as Internal Audit in April 2023, and any proposed changes will be brought back to the Committee for discussion. Members welcomed the intention to undertake longer term horizon audit plan with the new provider.

Assurance Reporting

Change Portfolio Update. The Committee were provided with a further update on the DESC pilot. Members were assured there were strong roadmaps prepared and partnership to manage the pilot and learn for future iterations. Members heard the partnership and Senior Information Risk Owners (SIRO’s) have come together to mitigate risks such as cloud storage. The Committee were provided assurance that Police Scotland was content that there are sufficient mitigations in place to allow the pilot to proceed. Members were also provided a progress update on the Body Worn Video FBC.

Police Scotland Best Value. Members were encouraged by the progress in establishing a Best Value team and the work undertaken already. Members supported the decision to pilot within procurement.

Productions Remodelling Deep Dive. Members were provided an overview of the productions remodelling project and discussed the impact of projects such as DESC and Body Worn Video.

Risk management. Members received updates on risk management, with questions focussed on mitigation work and the outcome of scoring re-evaluation

CONCLUSIONS/ACTIONS REACHED

When BDO commence work, SPA will discuss the use of KPI’s in relation to open recommendations.

Police Scotland and Azets to reach agreement on what evidence can be accepted to close recommendations relating to benefits realisation.

The Committee approved the Internal Audit Annual Plan.

The Committee requested future Change Portfolio Updates to include an overall summary of progress.

Police Scotland Best Value will be reported to the Committee twice yearly.

Timescales for Phase 2 of the productions remodelling project will be provided to Members.

Members endorsed the SPA Strategic Risk Review being presented to the Authority Meeting on 23 February 2023