Audit and Accountability Meeting Minutes - 19 October 2022
Agenda
Chair – Welcome and Apologies
Declaration of Interests – review & update
Minutes and actions arising from previous meeting
Internal Audit – Michael Gibson, RSM
External Audit – Azets
Commissioner
Risk and Audit
Finance
Performance Management – Corporate Services
Performance Data Review and Demand Analysis
Verbal update – Commissioner & Director of Operations
Performance Management – Reviews
Any other business
Attendees
Audit & Accountability Committee
Catherine Dyer (Chair)
Elizabeth Humphreys (LH) (attending via MS Teams)
John McCroskie (JMcC)
Lena Collins (LC)
Michelle Wailes (MW) (attending via MS Teams) Robert Scott (RS)
PIRC
Michelle Macleod Commissioner (MM)
Phil Chapman Director of Operations (PC)
Sharon Smit Accountable Officer / Head of Corporate Services (SS)
Jennifer Fisher Secretariat (JLF)
Auditors
Michael Gibson, RSM (MG) (attending via MS Teams)
Nneamaka Ochuba, AZETS (NO)
Welcome and Apologies
No apologies were noted.
Declaration of Interests – review and update
No declarations were noted.
Minutes and actions arising from previous meeting
The minutes of the July 2022 meeting were approved.
Internal Audit – RSM
In addition to the Progress Reports circulated prior to the meeting, Michael Gibson (MG), of RSM UK Risk Assurance Services provided members with the following update:
Progress against the 2022/23 internal audit plan (as agreed by the Committee on 25 April 2022): 75%
The next scheduled audit is a follow-up audit of previous Internal Audit Management Following discussion with PIRC, it has been agreed that this review will take place the week commencing 7 November 2022 and will be reported to the Committee in January 2023.
Two reports have been finalised and issued since the previous Committee meeting:
HR Recruitment and Selection: This audit resulted in 1 medium and 6 low priority actions being
Creditor Payments (including Procurement Cards): This audit resulted in 1 medium and 6 low priority actions being
In relation to the HR Recruitment and Selection audit report, LH questioned if there were any plans to recruit further staff prior to the end of 2022 and if the current HR policies are in line with current legislation i.e., Equalities legislation etc. SS advised that there are still a small number of posts that PIRC is seeking to fill. MG confirmed that the policies reviewed during the HR Recruitment and Selection Audit were those available at that time. He advised that RSM are not able to provide HR or legal advice to PIRC in relation to amending policies, however, if there were any significant omissions, this would be highlighted within the audit report for PIRC to address.
SS confirmed that all HR policies are reviewed annually or bi-annually, taking cognisance of current legislation and best practice from other organisations. Any amendments to HR policies are discussed with the PIRC Staff Representative Group prior to final approval by the Senior Management Team.
LC asked if any of the highlighted issues in relation to providing evidence of information / compliance were due to changes in working practice due to COVID-19 restrictions/changes to process. SS confirmed that, due to internal changes by the third-party service provider, Optima Health, the outcome of pre-employment medical checks can be viewed online, and an email is sent confirming the outcome but that it had not been retained in staff files. This will now be done. SS also advised that PIRC obtains vetting and references for all new starts to ensure that candidates meet the requirements of the offer of employment.
JMcC questioned if PIRC were able to provide feedback to Optima Health regarding the service provision. SS advised that she meets regularly with the Optima Health Account Manager to review any issues and that the Account Manager is very responsive to feedback.
In relation to the Creditors Payments, including Procurement Cards, audit report, JMcC noted that the report was reassuring and questioned if, in relation to Management Action 6, if it would be appropriate for PIRC to develop “How to” training videos for staff in respect of procurement of goods / items / use of Procurement Cards. SS confirmed that processes were being reviewed to ensure they were fit for hybrid working and that training would take place for staff.
AP43 - PIRC to consider developing training videos for staff on procurement of goods / items rather than only referencing Procurement Manual.
Additionally, MG provided a verbal update in respect of the IT Health Check Audit report finalised in August 2022.
AP44 – provide members with a copy of FINAL IT Health Check Audit Report – Complete
This audit resulted in 1 high and 2 medium priority actions being identified. It was highlighted in the report that PIRC is heavily reliant on Scottish Government to perform regular penetration testing on systems in use but that no defined policy or Service Level Agreement (SLA) is in place to cover this aspect.
SS advised members that she was in contact with SG to see what assurances they could provide, and the audit log will be updated to reflect this by the next meeting.
AP47 - Scottish Government to provide formal and documented assurance to PIRC for all penetration testing carried out.
MM advised that the recently held Business Continuity Test (20 September 2022) was designed to test staff response to a cyber-attack event. It was further noted that feedback from this test event was being collated and reviewed, by the Business Continuity Group. Once feedback was reviewed and an action plan drafted, it will be forwarded to the Senior Management Team for further review / action.
LH commented that it would be helpful if the feedback from the Business Continuity Test could be shared with members at the next meeting.
AP45: Feedback from Business Continuity Test on 20/9/2022 to be shared with members when available.
JMcC asked what steps are being taken regarding Cyber Security Training and the timescales for completion. SS advised that Cyber Security Awareness sessions are now in place for all staff with a further mandatory session taking place in January 2023.
MW asked if the opinion within the IT Health Check report had made any difference to the overall opinion of the Annual Internal Audit Report. MG advised that the Annual Internal Audit Report was currently under review by a Senior Partner and would be shared when available and that it did not alter the overall opinion.
AP46 – Provide members with a copy of Annual Internal Audit Report 2021/22 when available - Complete
LH advised that she was is the Chair of the Audit & Risk Committee for SAMH and would be happy to share her experience of Cyber Attack Recovery, if helpful. SS welcomed LH’s offer of assistance.
RS asked if the new PIRC website was stand alone and if any statements of assurance were held. PC confirmed that as part of the procurement process, assurances around security and cyber integration had formed part of the process.
JMcC questioned if there was any proposal to audit the Scottish Government IT provision in future audits. SS advised that PIRC has an SLA with the SG for IT services and that a Scottish Government IT Business Partner is involved (informally) prior to any SG IT changes or initiatives being implemented.
External Audit – Azets
In addition to the 2021/22 Annual Audit Report Progress Report circulated prior to the meeting, Nneamaka Ochuba, Audit & Assurance Manager, provided members with the following update:
The auditors were content with revised annual accounts, including audit of revisions and disclosure of changes identified during audit
In contact with Nat West Bank plc to review bank confirmation – Now Complete
All material disclosures required by relevant legislation and applicable accounting standards have been appropriately
No material weaknesses or significant deficiencies were
No potential adjustments, other than those considered to be trivial, were identified during
Strategic Plan and Business Plan 2022/23 were delayed due to the anticipated impact of legislative changes following Lady Angiolini Review – Public Consultation response.
Bullet point 56 (page 25) to be amended:
Bullet point 58 (page 25) Fraud Prevention Policy will be updated in November 2022
Page 32 – Audit Fee, to be amended to note that the Audit is for the Police Investigations and Review Commissioner – fee is
MW questioned if there would be any amendment to the report once Auditors are in receipt of the Annual Internal Audit Report 2021/22. NC advised that the opinion would not change.
MW also asked if the assurances that were noted in the AR could be circulated. – Now Complete
Annual Report including Accounts
In addition, the DRAFT PIRC Annual Report had been circulated prior to the meeting, and members suggested a number of amendments.
Update: the paragraphs were amended to read:
Page 5, Paragraph 10
“Following the publication of Dame Angolini’s preliminary report, PIRC transitioned the Audit and Accountability Committee (AAC) to a formal structure with a Chair and five non-executive members, all with relevant and diverse expertise and skills. The appointments were made through a transparent, fair and open competitive selection process which included Scottish Government representation on the appointments panel.”
Page 31, Paragraph 17
“PIRC has an AAC which met four times during the year. The AAC provides independent challenge in areas of risk management, governance, internal audit and performance. It also reviews our annual accounts and assurances provided by management.”
Page 32, Paragraphs 2-4
“The audit results provided assurance with no high risks identified. Due to circumstances beyond our control, there was a delay in the completion of the final IT health check report. This has now been concluded with final recommendations issued in August 2022. The auditors also reviewed recommendations arising from previous audits with no issues arising. All actions are recorded, and updates are reported to the Audit and Accountability Committee for oversight and approval at the quarterly meetings. They concluded that we had made good progress.”
Page 33 – Remuneration – Staff resources:
In 2021-2022, the total remuneration for the members of the Audit and Accountability Committee was £4,425.00.
LH noted that the report was well written and congratulated all staff involved.
CD advised that once the above amendments were made, she would be content to receive members endorsement via email of the Annual Report. CD asked that future Annual Reports are shared with members in a more timeous fashion to allow a longer time to review and provide feedback in advance of the relevant Committee meeting.
Commissioner
MM provided a written update to members on a range of ongoing work, including:
Sheku Bayoh Public Inquiry
Lady Angiolini Review – Public Consultation response submission
Civil Case
Performance Reporting Review (See agenda item 10)
Stakeholder Engagements
Revised Statutory Guidance issued to Equality and Human Rights Commission (EHRC)
Joint Audit between PIRC and SPA – of the Complaint Triage by Police Scotland’s national Complaint Assessment and Resolution Unit (NCARU)
Website / Intranet Development Members noted the update
Risk and Audit
SS advised that two Strategic Risks have increased in residual risk score since the last Committee: Risk 1 (Capability and Capacity) and Risk 3 (Finance).
In terms of Risk 1 - SS advised that a request for additional funding has been submitted for 2023 to Scottish Government to maintain current staffing levels.
In terms of Risk 3 – SS advised that the Scottish Government is aware and regularly appraised in respect of the increased costs associated with the Public Inquiry legal fees which are out with PIRC’s annual budget.
JMcC questioned if Risk 4 (Recommendations of Review) should be increased in residual risk scoring if Risk 1 and 3 have been increased. MM advised that PIRC await the outcome of the Dame Angiolini Review - Public Consultation (expected in November 2022), and once received, a further review of residual risk scoring will be undertaken.
MM noted that the Scottish Government has been advised that additional funding will be required if PIRC is to undertake additional responsibilities as outlined within the Dame Angiolini Review. MM further noted that implementation of some recommendations would be cost neutral, however, others would have significant financial implications.
RS asked for clarification when an applicant within the “pool” would become an employee. SS confirmed that when a vacancy arises, or is identified, applicants within the “pool” would be contacted to confirm availability and the on boarding process would commence.
LH queried if there was a review of current recruitment marketing. SS advised that despite best efforts, PIRC is not attracting many applications from candidates from minority groups. SS further noted that she has contacted HR counterparts within other Non- Departmental Public Bodies (NDPB’s) to learn from their experiences and best practice.
LH asked, in terms of Risk 2 (Confidence and Trust), if wider inequalities are considered other than the protected characteristics including, for example, poverty. SS advised that the Equality and Diversity group minutes are provided to the Senior Management Team for review and approval and that feedback from recently held in-house Equality and Diversity training sessions is under review. SS further advised that PIRC are taking steps to raise awareness and highlight all issues relative to Equality and Diversity.
PC advised that the Communications team have been tasked to establish key contacts which could be utilised as a network of people who could be used in an advisory capacity in terms of the development of policies and procedures going forward.
Audit Action Log
SS provided a detailed summary of the Audit Log to September 2022 (circulated in advance).
SS highlighted actions 57-58 (Review of Trainee Programme) are now complete, as are actions 59-60 (IT Health Check). Action 61 (IT Health Check) is in progress. The actions from the Recruitment and Creditor Payments audit will be added to the log and an update given at next meeting.
Finance
SS provided a summary of the Management Accounts as at end September 2022 (circulated in advance).
SS reiterated that a request for additional funding has been submitted to Scottish Government to maintain current staffing levels.
RS noted his concern following the announcement of a 5-year flat budget and asked for assurance that Scottish Government is aware of the PIRC position in terms of budgets and projected overspends going forward. SS advised she and the Finance Manager regularly meet to monitor budgets and discussions from these meetings are escalated to Scottish Government.
MM further noted that she maintains regular contact with the Safer Communities Director and Deputy Director, and both are fully appraised of PIRC forecast expenditure.
Additionally, MM advised that the Director is fully appraised of the Legal Costs associated with PIRC’s participation. MM further noted that Sharon Clelland, Head of Legal Services is spending 60-70% of her time working on the Public Inquiry in order to mitigate legal fees of our appointed Senior and Junior Counsel.
LC asked if there were any increased costs associated with increase in energy prices. SS advised that there was a slight increase but nothing of significant variance.
Performance Management – Corporate Services
SS provided a detailed summary of the Corporate Services Workload report to September 2022 (circulated in advance), drawing attention to the following areas:
Annual Leave and Flexi Balances
SS advised that the figures provided within the report do not take into account leave pre-booked for October 2022 (School Mid-Term break) or December 2022 / January 2023 (Christmas and New Year period) where a considerable amount of leave will be taken by staff, reducing the balance.
Members noted the update provided.
Performance Data Review and Demand Analysis
MM advised members that, as alluded to at the July 2022 meeting, she had identified a staff member to undertake a Performance Data Review and Demand Analysis.
MM confirmed that Deputy Senior Investigator (DSI) Conway had been tasked to undertake an in-depth review of all aspects of management information, consider the feasibility of existing KPIs and to make recommendations.
MM advised that the review has concluded, and the final report has been shared with both the Investigations and Review Senior Management staff for factual accuracy checking. Feedback from each department is due to be returned to PC by close of business today, 19 October 2022.
MM noted that she has reviewed the draft report and recommendations contained within. The recommendations and findings will form the basis of a paper that will be prepared and shared with the Committee in January 2023, setting out the proposed KPIs going forward. It will take account of the increasing workload and information we have obtained through benchmarking. Thereafter, it will be the basis of the PIRC Strategic Plan for the next 2-years.
PC provided an overview and the rationale for undertaking the review, explaining that the Investigations and Review departments have worked in isolation from one another, with no synergy in the working practices or statistical counting rules for CHRs and Investigations.
PC added that there is a heavy reliance on both Department Heads to manage their own statistical returns, which becomes a significant issue if they are on leave or absent for any reason.
PC advised that DSI Conway had reached out to counterparts within Police and Public Service oversight agencies to benchmark working practices and performance arrangements i.e., Police Ombudsman for Northern Ireland (PONI), Independent Office for Police Conduct (IOPC), Garda Síochána Ombudsman Commission (GSOC) and Scottish Public Services Ombudsman (SPSO). PC noted that each organisation was experiencing similar themes – disparity in KPIs, significant increase in workload, far more complex and protracted CHRs and Investigations and a significant increase in the number of Human Right’s complaints being received.
PC noted that a lack of robust statistical business counting rules, can lead to confusion and lack of clarity around what the statistical data actually means in real terms. Recommendations have been made in respect of:
Producing Organisational Business Rules in terms of statistical performance; using a common language for category of cases and drafting a ‘deductible time’ policy for matters falling out with PIRC
The need for consistency in the timescales allowed for ‘papers to be provided’ by policing bodies.
Introduction of a Single Point of Contact such as a ‘Senior Administrator’ who would have sole ownership and responsibility along with the departmental Administrative Teams for the collection and reporting of Performance Reports for each department on a monthly and quarterly
Members noted the update provided.
Performance Management – Reviews
PC advised that it had become apparent during a Reviews Departmental Workshop held in May 2022 that there had been significant activity around status and miscellaneous enquiries within the Reviews Department which the Senior Management Team did not consider core to the Team’s responsibilities or good use of resource.
PC highlighted that before PIRC can undertake a CHR, the complaint must have been completed by the policing body and a final letter of response issued. If this criterion has not been met, PIRC would consider the application to be premature and are not required to take the matter any further.
PC further explained that several years ago, whilst refining their own complaint process, Police Scotland devised a process of assessment and categorisation, whereby Police Scotland may deem a complaint to be ‘not relevant’ and classify this as a ‘Miscellaneous Inquiry’ file (MI) and are not required to communicate any formal response to the complainer. As Police Scotland do not publicise contact details for the Professional Standards Department (PSD), invariably the complainer, dissatisfied with the lack of any response, makes contact with PIRC and requests a CHR to be conducted. Rather than re-direct the complainer back to PSD, PIRC staff have been carrying out a review and making requests for information from PSD, then conducting reviews, with correspondence being exchanged between PIRC / PSD and complainers.
From an initial assessment of the working arrangements in 2021/22, it is reported that 682 Centurion files were created for enquiries received to the Reviews department. Of those, only 271 CHR applications were reported through the current management framework and KPIs, whilst the vast majority were dealt with as premature or out with the PIRC remit. This has resulted in a significant body of work which has taken resources to complete at the expense of more timeously completing competent CHRs. The practice of carrying out formal reviews of MI cases will cease unless instructed by the Director of Operations or the Commissioner.
PC provided a detail summary of the Reviews Performance Management Reports (circulated in advance) drawing attention to the following areas:
As at the end of September 2022 (Q2).
16 unallocated CHRs.
51 CHRs
97 Cases
46 discretionary / decision cases
59 CHR/ Discretionary Decisions under
66% of complaints were found to be reasonably handled by Police
64 Recommendations have been
7 Learning points
KPI 1 (80% of cases closed within 4-months (of 2022/23 applications) has been achieved.
KPI 2 has not been achieved, however staff continue to make good progress in completing historical
JMcC welcomed the outcome of the Performance Data Review and Demand Analysis as it would allow for better scrutiny and decisions on resourcing and improved accuracy of reporting of performance data.
LH questioned how Police Scotland will be advised that members of the public enquiring about matters that had been designated MI by Police Scotland would now be redirected to PSD. It was confirmed that the Commissioner will write to the ACC of PSD.
Performance Management – Investigations
MM provided a confidential update to members on high profile and significant operational work currently being undertaken by the Investigations staff.
MM suggested that at the April 2023 meeting, it would be beneficial to provide members with an investigations case study explaining how investigations are tasked, lines of investigation carried out etc
AP48 – Case Study to be provided in April 2023
MM advised members of an inaccuracy contained within the July 2022 Investigations Performance Management Report in terms of the KPI relating to reports submitted to the referring body within 3 months of the start of the investigations. In July PIRC reported that this was 83% for Q1, however, as part of the Performance Data Review and Demand Analysis, it was revealed that this figure was incorrect, and the correct value is 51%. MM offered her apologies to members and reiterated that as per the recommendations of the Performance Data Review and Demand Analysis, future statistical reports will be undertaken by an independent administrator who will collate the data for both Investigations and Reviews departments.
PC provided a detail summary of the Investigations Performance Management Reports (circulated in advance) drawing attention to the following areas:
As at the end of September 2022 (Q2).
KPI 1 has not been
Increase in the number of referrals received
Increase in the number of investigations undertaken
Significant increase in the number of ‘Death Following Police Contact’ Investigations undertaken believed to the as a result of an increased focus on some cases by Crown Office & Procurator Fiscal Service as highlighted within the PIRC Annual Report
LH noted her thanks for the transparency and candour of the update provided by both MM and PC.
CD thanked MM and PC for the update provided and noted that the Committee were aware of the additional pressures faced by the organisation at this time.
LC asked if management were aware of or have been advised of any pressures on staff in respect of the number of Article 3 cases under review. MM advised that the Senior Investigators regularly communicate with the staff within the Assessment Unit and Investigations department and are actively contributing to a departmental review of the staffing model within the Assessment Unit.
RS asked for clarification of the data set contained within the ‘total’ column contained within the Investigations Annual Workload report. PC confirmed that this was the total of each year dating back to 2013, however, only data from 2017 forward was viewable in the current report format. RS asked that, given it is not of assistance to the Committee, the total column is removed from the report.
AP49 – Investigations Performance Report – remove ‘total’ column
Any other business
Update: PIRC Annual Report:
MM advised that the suggested amendments to the Annual Report would be circulated to members via email on 20 October for review. CD advised that she would be happy to accept endorsement of the Annual Report amendments via correspondence.
Update: Complete
Update: Annual Internal Audit Report 2021/22:
SS advised that the Annual Internal Audit Report would be available no later than Wednesday, 26 October 2022.
As per AP45 – Provide members with a copy of Annual Internal Audit Report 2021/22 when available - Complete
Proposed 2023 Meetings Schedule
CD advised that the proposed 2023 meeting schedule, as indicated on the agenda, was not suitable for all members. Further discussion will be held and the 2023 meeting schedule agreed. Dates will be communicated to members under separate cover.
AP50 - Review meeting dates for 2023 and once approved by Chair, advise members accordingly – Complete