Audit, Risk and Assurance Committee - 12 November 2025

The formal minute of the public items of business will be available at the meeting scheduled for 12 February 2026. These will also be published on the SPA’s website. A full recording of the public items of business taken at this meeting can be accessed at Scottish Police Authority Audit, Risk & Assurance Committee - 12 November 2025 | Scottish Police Authority

ITEMS OF BUSINESS CONSIDERED
• Internal Audit progress update and reports on overtime, environment and sustainability, and complaints management
• Audit and Improvement Recommendation Trackers
• Risk Management Reporting
• Information Management Reports
• National Fraud Initiative

KEY ISSUES RAISED
• Internal Audit Reports
o Internal Audit report on overtime. The report detailed that limited assurance has been provided over both the design and operational effectiveness. Members were told mitigations will be put in place to tighten up controls whilst work continues to identify a single modern HR system. Noting that the Police Regulations state that there is an absolute entitlement without timescales for claiming overtime payment, Members suggested guidance and policies are improved to encourage early claims. Members also received information on how the overtime budget is allocated, hearing there is a contingency for unexpected overtime which is monitored.

o Internal Audit report on environment and sustainability. The report detailed limited assurance has been provided over design and moderate assurance over operational effectiveness. Members sought and received assurance that environment and sustainability is being given appropriate prioritisation and heard the report findings are in keeping with public sector trends.
o Internal Audit report on complaints management. This audit was not originally included in the internal audit plan for 2025/26 and was requested by SPA and Police Scotland. As it is an advisory review there is no assessment of assurance. Members raised concern on the backlog volume and the speed of reduction despite additional resource. Assurance was given that reducing the backlog was a continual focus but as future volume cannot be predicted it is difficult to provide metrics on timescales. Members heard that at future Complaints and Conduct Committees, recommendations will be incorporated into a wider improvement plan that will be lead to evidence of performance improvements.

• Audit and Improvement
o Police Scotland Audit and Improvement. The Committee heard a review on the whole system for engaging with scrutiny bodies has taken place which has led to a redesign of the engagement process. The review highlighted that it takes between one and two years to implement a recommendation therefore any raised in that timeframe are not being classed as backlog by Police Scotland. The review also highlighted that the majority of Internal Audit and HMICS recommendation are achieved within two years. Focus has also been strengthened in escalation procedures and timely responses. The Committee were provided a summary of the improvements being made with management recommendations which was well received with Police Scotland confirming updates on implementation of improvements will be provided to each ARACMembers sought and received assurance that improvements were being made in managing dependencies, and there was a better understanding that whole teams had to drive forward change.

o Internal Audit Update. The Committee heard a request was made to defer the communication and engagement audit as Police Scotland are working with consultants to implement new approaches in the area. BDO agree with the rational and are working with management to determine whether another audit will be brought forward in its place.

• Assurance Reporting
o Police Scotland information management report. Members raised concern on the low compliance and growing backlog of responses to SARs and FOIs. Members heard a full assurance review has taken place on SAR processes which was welcomed.

• Risk Management Reporting. The Committee received updates from SPA, Police Scotland and Forensic Services. Discussion focussed on the Police Scotland report and those risks above appetite and tolerance, and mitigations on new risks.

CONCLUSIONS/ACTIONS REACHED
Across the Committee papers, there is a theme of increasing backlog and failure to achieve statutory or agreed deadlines. As such, the Committee noted current efforts to get back on track which need to be supported/resourced. The Committee highlighted the need for a greater focus on improvement planning and looked forward to receiving regular reports confirming that progress was being delivered at pace. The Committee also specifically asked for sight of the report and the outcomes from the assurance review of SAR processes.