Audit, Risk and Assurance Committee

ITEMS OF BUSINESS CONSIDERED
• Internal Audit progress update and reports on estates and asset management; ICT general controls; grant management; health and safety (transportation of dangerous goods); and cash and drug productions and high value store
• Annual Internal Audit Report
• Audit and Improvement Recommendation Trackers
• HMICS Scrutiny Plan
• Best Value Updates
• Accounting Policies, judgements and estimates
• Integrated Assurance Statement
• SPA Corporate year end performance
• ARAC Annual Report
• Committee Effectiveness
• Risk Management Reporting
• Information Management year end reports

KEY ISSUES RAISED
INTERNAL AND EXTERNAL AUDIT REPORTING
• Internal Audit report on estates and asset management. Noting the biggest issue was data. Members were assured work was progressing to introduce an estates database but until that point, accuracy checking would continue to be manual. Members welcomed the direction of travel.
• Internal Audit report on grant management. Members welcomed the proactive request for this audit to help highlight issues and how they could be addressed. The Committee agreed the grant amounts were not significant in value but by nature and assurance was provided that improved policies and procedures were now in place.
• Internal Audit report on health and safety (transportation of dangerous goods). Members also welcomed the proactive request for this audit, noting it showed a level of maturity, transparency and desire for improvement. Members heard Police Scotland were anticipating the results therefore a number of actions have already been put in place to address the recommendations. Members were assured Forensic Services have considered the findings and will also learn from the report.
• Internal Audit report on cash and drug productions and high value store. Members were assured all recommendations would be responded to and a short life working group had been established to address some.
• Annual Internal Audit Report. Discussion focussed on themes which had emerged during the year, including central oversight, roll out of policies and procedures, and prioritisation. Noting four audits provided limited assurance, Members were told this conclusion was due to Internal Audit not being content with the level of risk being carried and improvement actions were recommended.

AUDIT AND IMPROVEMENT
• Police Scotland Audit and Improvement. Discussion focussed on the interdependencies leading to delays and how the outstanding recommendations on vetting can be progressed. Members heard work is being accelerated and it was hoped HMICS recommendations would be closed soon with BDO ones to follow.
• Internal Audit Update. The Committee discussed mitigations for long stand recommendations, recognising that prioritisation and management of resources is key as well as a realistic approach to setting and managing timescales. Members noted an Internal Audit report on management of recommendations was forthcoming.

ASSURANCE REPORTING
• HMICS Scrutiny Plan. Discussion focussed on the range of public interest items, the level of public engagement which had taken place and HMICS’s intention to work with partners to provide a whole system assurance approach.
• Police Scotland Best Value. The Committee welcomed the public update, noting extensive discussions on preparation had taken place at a recent Committee development day. An initial meeting was scheduled for 22 May with Police Scotland, SPA, Forensic Services, HMICS, Audit Scotland, Grant Thornton and Scottish Government in attendance.
• SPA Best Value. The SPA provided the results of their Best Value self-assessment. Members welcomed the continued level of improvement and progress over the last three years.
• Integrated Assurance Statement. Members raised concern regarding unsupported financial software but received assurance that it was being treated as a priority and a decision would be made imminently on addressing it. The Accountable Officer noted it was fundamental to the financial integrity of the Authority.
• SPA Corporate Year end performance. Members welcomed the report and heard that due to resource constraints, vacancies and the delivery plan were approached based on what was required to be done as opposed to what could be done. Members heard that to help drive improvement, a light touch review of the structure was taking place and would report internally in September 2025.
• Information Management Year End Reports. The Committee received updates from SPA and Police Scotland. Discussion focused on how Police Scotland mitigate the risks from the increased demand in subject access requests.

RISK MANAGEMENT REPORTING
The Committee received updates from SPA, Police Scotland and Forensic Services. Discussion focussed on the financial risk as well as Police Scotland’s risk training and approach to scoring.

CONCLUSIONS/ACTIONS REACHED
• Police Scotland agreed to provide a list of what the Grant Management fund covers.
• The Committee welcomed Craig Naylor’s attendance and overview of the HMICS Scrutiny Plan.
• The Committee requested that roles are attached to management responses instead of personal names, in line with good practice.