Report detail

1Background
The Internal Audit Plan for 2026/27 was approved by ARAC in February 2026.

Since the previous ARAC, Internal Audit have completed the following;
• SPA Board and Committee Effectiveness (Evaluation)
• Third Party Management (Audit)

Succession Planning was scheduled for presentation at August ARAC however, there have been some delays with finalising the report. This will be presented to November ARAC.

The Productions Internal Audit report was reported as a draft to the May ARAC from the 2025/26 Internal Audit Plan. This report is re-presented to ARAC to give Members visibility of the action plan. Previous reporting noted final report and management actions still to be agreed.

Summary of New Findings
TABLE

Note the Board effectiveness review is an advisory type review that has not drawn-out specific findings or recommendations (see para 1.7).
The findings from the Productions internal audit were previously reported to the May 2026 ARAC.
 
Further detail
Appendix A - SPA Board and Committee Effectiveness

Background
The Board requested a review of its effectiveness and governance arrangements. It is good practice to regularly reflect on arrangements aided by an independent review. There was also an opportunity for the review to consider the recommendation from the HMICS/ Audit Scotland inspection.

Internal Audit Findings
As this was an evaluation conducted against a Governance Maturity benchmarking model, unlike other internal audit reports, no specific recommendations are raised.
The overall assessment was positive with four categories noted as ‘operating effectively’ and four as ‘partially effective’.

SPA’s Management Response
“The SPA welcomes this BDO review and are pleased with the overall findings, that the Board is operating effectively with a low number of areas for enhancement identified.

The Authority has taken steps to continuously improve the Board’s effectiveness, our governance structures and processes, and will maintain this approach of continuous improvement going forward.

Current and ongoing examples include:
• Renewing the Board and committee priorities
• Refreshing and implementing the committee report template
• Revising the approach to Board briefings supported by a refreshed template
• The implementation of the Chief Constable’s balance scorecard to support scrutiny of policing performance
• Post Authority meetings informal session with Police Scotland
• Committee development days with key stakeholders

We will continue to work with Police Scotland and Forensic Services on other areas for enhancement, in particular:
• Content suitability for non-executives and length of submissions
• Topic coordination across committees when relevant to more than one committee
 
Appendix B - Third Party Management
Background
Refers to management of external contracts. Good arrangements are important for achieving value for money, service delivery and achievement of an effective and well-resourced policing service.

Internal Audit Findings
Areas of good practice:
• Several areas of good practice were identified including;
o Clearly defined and communicated Roles and Responsibilities.
o Performance is tracked effectively against financial and non-financial KPIs and reported comprehensively via the PS CSM.
o Contract spend is 97% compliant and has been performing in excess of 95% for the previous four quarters.
o The CSM function suitably supports and intervenes where required.
Opportunities for Improvements:
• Rated Medium significance:
o No requirements for suppliers to provide regular attestations to required ongoing compliance or certifications. Increasing risk that gaps or expired certifications are not identified and addressed.
• Rated Low significance including the use of: new contract templates, contract register detail and risk level tiering.

SPA Considerations
Six of the seven recommendations have been accepted with action plans expecting completion by March 2027. Action plans seem pragmatic and achievable.
One partially accepted recommendation is related to the functionality of the new ERP system proposed. Management notes that affordability and best value will be the driving factor in the solution design. The recommendation will be considered but may not be feasible for achievement.

Appendix C - Productions
Background
Productions often play a critical role in criminal cases. Police Scotland must maintain the integrity of these items for the duration of their required retention and ensure their sensitive disposal. This audit focused on the design and operational effectiveness of the controls, with a specific focus over the arrangements for storing and managing productions in freezer facilities.

Internal Audit Findings
The review has identified control gaps with nine findings of medium significance identified. These relate to:
1. Lack of a forensics production strategy;
2. No central equipment register;
3. Lack of temperature setting controls;
4. Productions stores conditions;
5. Inadequate temporary storage arrangements;
6. Inadequate transport arrangements;
7. Inconsistent working instructions / guidance;
8. Productions reporting data; and
9. Non-compliant transfer process.

SPA Considerations
The current position of the 22 recommendations is as below:
• All recommendations accepted
• 17 have detailed action plans
• Four are noted as complete with evidence being provided to support closure
• One noted as risk accepted related to limitations of system design

The management action plans, appear appropriate and indicate these will be fulfilled by latest date of December 2027.