Audit and Risk Committee minutes – October 2024

John-Mark Frost (JMF) 

Samina Ali (SA)

Andrea Gale (AG)

Jonathan Pearce (JP) 

Ben Summers (BS)

Guests:

Lucy Dean (LD) Azets – Items 1-3 only 

Andrew Hill (AH) HSJ – Items 1&2 only 

Jonathan Maddock (JMa) TIAA – from Item 7 

Apologies:

Myra Hunt

CDPS staff:

Harriet Green (HG) – CEO  

Lisa Hobbs (LH) – Item 5 only  

Phillipa Knowles (PK) 

Kath Morgan (KM) 

Secretariat:

Jon Morris (JM) 

The meeting opened at 14:15.

0.1 JM Confirmed Board members had voted for the appointment of JMF as new ARC Chair and confirmed he had achieved the required majority.

1.1 The Chair welcomed Members to the meeting. Apologies for absence were received from Myra Hunt. 

1.2 The Chair welcomed JP to his first meeting and invited a round of introductions. 

1.3 The ARC approved the minutes of the meeting held on 24 July 2024 as a true and accurate record. 

1.4 The action log was received; Members noted the progress and the actions that had been closed. Members thanked the CDPS team for their efforts in resolving a large number of actions, noting there would only be one previous action outstanding after items being discussed in this meeting. JP asked to pick up with JM on the insurance provision for CDPS. 

ACTION: JM to engage with JP to discuss CDPS’s insurance provision.

1.5 Members confirmed that there were no items to be discussed which were not represented on the agenda. 

2.1 Members welcomed AH, Lead auditor from HSJ. AH presented results of the external audit. AH highlighted key risk areas and considerations and noted that no errors had been identified and no adjustments were recommended to the accounts.

2.2 AH concluded HSJ were happy to issue a standard and modified audit report, confirm there are no material concerns that need to be brought to ARC’s attention at this time. HSJ confirmed the accounts have been prepared in accordance with the relevant standards, namely IFRS applied in the UK and with the Companies Act.

2.3 AH noted that there were no recommendations in terms of internal controls and management procedures, although this is an area that will be revisited annually. AH commented to the ARC that the draft accounts and supporting information provided to HSJ were to a high standard. On behalf of HSJ, AH thanked KM, LD and everybody involved for their efforts and assistance during HSJ’s work. 

2.4 AH invited comments and questions form ARC members. JP requested more information regarding assessment of CDPS being a going concern through to 2025-26. AH pointed back to the Remit letter which lasts through to 2026, and the fact that there are no sources of concern. JP then queried the grant funding figures in the report as they are different from the Remit letter and the Q2 finance report. HM explained that the remit letter contained the initial budget of £4.9m, but this had been revised down on each subsequent year due to funding pressures across the public sector, and that the decrease was not linked to CDPS’s performance. 

2.5 JP asked AH is there were any upcoming changes in auditing standards. AH explained that the next standard change would be applicable to year ending March 2026, but due to the scope of the changes they are unlikely to have an impact on CDPS’s operations. 

2.6 ARC members raised no further questions, and thanked CDPS, LD and HSJ for the efforts in preparing the accounts and auditing well ahead of the Companies House submission deadline. 

DECISION: ARC approved final accounts for year ending 31 March 2024. 

ACTION: CEOs to sign and submit final accounts for year ending 31 March 2024 to Companies House 

AH left the meeting 

3.1 KM presented the finance report to the ARC and opened the floor for questions and comments.

3.2 Members thanked KM for her efforts in producing and explaining the report. JP noted the report was an extremely useful tool to bring him up to speed and offered to liaise with Kath to help develop report.

ACTION: KM to liaise with JP to develop the report based on his experience with other organisations.

3.3 Board members asked about risks involved with not receiving the grant drawdown. HG noted identification of trends in the planning of expenditure, allowing CDPS to be much more agile in its forecast management, which will reduce CDPS’s major risk from previous years – that of not spending the full grant allocation. HG also noted that PK and the rest of the SLT were tasked to find additional funds from existing budgets for delivery to aid CDPS in prioritising impact outcomes.

3.4 Board members noted the work to prioritise the delivery impact and asked if there was a wish list for projects and asked to see the backlog. 

ACTION – CEOs to share wish list/backlog of projects with Board for discussion.

LD left the meeting 

4.1 PK introduced the report, highlighting the changes made since the paper was last introduced in July 2024 and clarified that all suggested pay scale changes have been factored into ongoing budgets. PK opened the floor for discussion.

4.2 ARC members queried how CDPS has approached the pay award previously, and whether CDPS normally awards in line with Welsh Government awards. HG explained CDPS has previously pegged to the offer from Welsh Government and the wider public sector, but as we will not have a confirmed budget figure for next year until December, the CEOs have decided the proposed figure due to cumulative cost factor for future years. 

4.3 The ARC raised that there may be an expectation that CDPS will award a rate similar to WG’s and highlighted the need for careful messaging with staff. HG acknowledged there probably is that expectation amongst staff and agreed the need for careful messaging, explaining the complete package available for all staff, the consideration of cumulative effect and the need to consider staff costs in future needs, and CDPS’s commitment to spending most on impact and delivery.

4.4 Members questioned the overall benefits package for consideration. PK noted our offering is comparable, being less favourable on pension, but more generous in other areas including income protection and critical illness.

4.5 HG noted development of our rewards and recognition approach with CDPS’s employee forum and explained this would be a bonus approach rather than increase in salary. 

4.6 The discussion ended, to be continued in the absence of CDPS staff.  

ACTION: JMF to let HG, PK and JM know outcome of the Pay Award discussion. 

LH joined the meeting 

5.1 LH presented the paper, explaining the main changes in the paper, and invited ARC members to discuss. 

5.2 ARC members discussed succession planning and building a community of CDPS alumni in the public sector in Wales. Members questioned whether the key point of the mission support the digital capability in Wales means that we need to look at career paths slightly differently than we would in a commercial company, and lean more into the benefits of staff moving on from CDPS to new roles in the wider Welsh public sector. The committee recognised that this is an ongoing question and should not be a blocker to the presented paper going live.  

5.3 Members agreed it was good to see in the paper that CDPS is beginning to think about separation of staff and how that's actively managed to benefit Wales. HM added that she and MH support growing capacity for Wales, and that they want CDPS to be “a great place to work and a great place to move on from”. 

5.4 The ARC questioned the budget for training for each member of staff. LH explained that every staff member has an individual training budget. This budget is allocated to them to aid career development and requires approval from their line manager. 

5.5 PK noted that in addition to the lines in this paper, there would be a wider EDI discussion on the agenda for November’s Board meeting. HG took the opportunity to congratulate PK for her silver award for Digital Inclusion at the recent Mastering Diversity Awards 2024. 

DECISION: ARC approved People Strategy and People Plan for implementation. 

LH left the meeting 

6.1 JM presented the new risk registers, explaining the implementation rationale for change in approach from the previous “Corporate Risk Register”, and invited ARC members to discuss. 

6.2 The committee welcomed the new format for the risk registers as the clarity of the information had greatly improved. Committee members suggested improvements for the formatting, including a line-by-line consideration of the impact of controls and forms of assurance, though this was decided to be too complex to be of significant value. Other suggestions considered included: Adding a target score to risks, including details from the Risk Appetite Statement to create a single location for information, ensuring risks and mitigations are limited to a single page, and prioritising control measures and forms of assurance per risk. 

6.3 The ARC agreed that they would like to see the Strategic Risk Register at every meeting, and a summary of the top three operational risks & any hot topics at every meeting. Members acknowledged that, though useful to see, their impact should concentrate on the Strategic Risks rather than Operational, Cyber, and Project levels. 

ACTION: ARC Members to email suggestions for Risk Register improvements to JM and PK. 

ACTION: JM to iterate the Risk registers based on feedback received and expected from ARC members. 

ACTION: JM & PK to consider how to best present risks for future ARC meetings. 

JMa joined the meeting 

7.1 There were no instances of departure from normal procurement policy and guidance to bring to the attention of the ARC members this quarter. 

8.1 There were no new items identified in the Fraud Register for discussion and consideration by the ARC. 

9.1 JMa introduced the SICA report and progress against the annual plan. JM noted GIAS standards are mainly aimed for the private and third sector, but we will be incorporating best practice from the standard where applicable whilst still being bound by public sector standards. 

9.2 ARC members questioned the distribution method for Client Briefing Notes received from TIAA. JM explained that all CBNs are revied on receipt and if applicable to CDPS they are distributed to the appropriate audience. ARC members were content with this approach and happy for it to continue unchanged.

9.3 JMa introduced the results of the two audits conducted during Q2, Cyber Security and People Management. JMa noted that both audits had achieved an assessment of “Substantial Assurance”, the highest possible grades. ARC members had no comments or concerns on either audit, and noted that CDPS should be proud of achieving such good results.

9.4 JM ran the committee through the recommendation's tracker, accessible on TIAA’s portal, and explained progress made on outstanding recommendations. The committee were content with progress made and raised no concerns. 

10.1 Members were invited to suggest future agenda items to PK.

10.2 The committee saw value in conducting a deep dive on Risk Controls and noted that this was in the annual audit plan to be completed during the next quarter. 

11.1 There were no items raised by any attendee. 

12.1 In-camera session between ARC members and JMa. No CDPS staff attended, and the discussion was not noted.  

The meeting closed at 16:45.

4.7 Non-executive Directors decided: 

• The rationale for a 3.7 per cent increase felt strong and responsible. 
• There were concerns about the reactions of staff receiving less than Welsh Government colleagues and the importance of ensuring effective landing of the messaging on this front was emphasised. 
• There was a request that a broader discussion was had with ARC / Board around rewards and recognition before any change to current practice was implemented. 

DECISION: The proposal presented in the paper to ARC was endorsed.

Additional: At the end of November 2024, CDPS was notified by the Partnership Team that the Cabinet Secretary had agreed to baseline the 5% pay award to staff (i.e. build it into the core budgets) in the sponsored bodies, including CDPS for 2024-25, and baselined into the 2025-26 budget. 

In this context a 5% settlement for staff and CEOs becomes cumulatively affordable for CDPS for this year, next and ongoing. A revised report was issued for ARC members to consider. ARC decided that 5% pay award for all staff including CEOs was affordable and were supportive of CDPS accepting the additional monies from WG and increasing the consolidated pay award for staff to +5%.