Annual report of the Audit and Risk Committee The Pensions Authority for year ended 31 December 2021

Introduction

The Audit and Risk Committee (ARC) is part of the control environment within the Pensions Authority. The ARC is tasked with providing independent advice to the Authority on matters including the suitability and robustness of the organisation’s internal control, risk management, governance procedures and the reliability of financial reporting.

 

The ARC is independent of the day-to-day financial management of the organisation which is the responsibility of the Executive. In particular, the ARC independently monitors the internal control systems including audit activities.

Membership of the ARC

The ARC consists of four members: an independent Chairperson, an independent non-executive member, a representative of the Department of Social Protection, and a representative of the Department of Finance.

 

A schedule of attendance at the ARC meetings for 2021 is set out below.

ARC meetings 2021 Number of meetings held: 6
Name	Position	Attendance
Bill Cunningham	Chairperson	6/6
Kevin Barron*	Representative of the Department of Social Protection	6/6
Brendan O’Leary	Representative of the Department of Finance	6/6
Michael Roche	Independent non-executive member	6/6

ARC Charter

The ARC’s terms of reference are set out in its Charter. The ARC conducted its annual review of the Charter during 2021 and it was approved by the Authority at its meeting on 26 April 2022. 

Work of the ARC in 2021

The ARC, in fulfilling the requirements of its advisory function, assessed the performance of the key elements of the systems of internal control in operation in the Authority in 2021. The ARC held its meetings remotely during 2021 in compliance with Government Covid-19 restrictions and guidelines. 

Internal audit

Internal audit provides an objective evaluation of, and opinion on, the overall adequacy and effectiveness of the Authority’s system of governance, risk management and internal controls. The 2021 internal audit work programme was approved by the ARC. The ARC met with the internal auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2021. The ARC also met with the Internal Auditors with no executive members present. The 2021 audits were conducted remotely.

 

The ARC oversaw the appointment of internal auditors following a tender process during 2021. The ARC agreed a work programme for the internal auditors for the 2021-2023 period. Recognising the growth in the size and complexity of the Authority, the scope of Internal Audit will be expanded from 2022 to include an extra audit.

 

The ARC met with the Internal Auditors with no executive members present.

Details of the 2021 audit work programme are set out below. 

Internal controls audit completed in 2021
High level review of internal controls in the Authority.	The objective of the audit was to provide the ARC with an opinion on the level of reliance that can be placed on the operation of the Authority’s internal controls.
Outcome of the audit	The audit assessment indicates that significant assurance can be placed on the sufficiency and operation of the Authority’s internal control framework. The audit also confirmed that controls have continued to operate as intended during movement restrictions in place due to the Covid-19 pandemic. The Executive is addressing the one low level finding raised.

 

Procurement audit completed in 2021
A high-level review of the Authority’s procurement procedures	The objective of the audit was to provide the ARC with an opinion on the level of reliance they can place on the design and operations of the Authority’s procurement procedures
Outcome of the audit	The audit assessment indicates that the ARC can place reasonable assurance on the design and operating effectiveness of the Authority’s procurement policy and procedures. The Executive is addressing the two low level findings raised.

IT security audit

The Authority migrated its IT infrastructure to the OGCIO Desktop as a Service offering in October 2021. As a result of this move the annual IT security audit was moved out to December 2021. The Executive is currently reviewing the draft audit report and while no issues of significant concern have been raised, the ARC will review the audit findings once the report has been finalised. 

External audit

The Comptroller and Auditor General (C&AG) is the external auditor of the Authority. The ARC met with the external auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2021. The ARC also met with the C&AG team with no executive members present. The 2021 audit was conducted remotely.

 

A summary of the audit is set out below.

Audit completed in 2021
Audit of the Authority’s financial statements 2020.	To provide independent assurance on the truth and fairness of the financial statements of the organisation.
Outcome of the audit	The C&AG issued an unqualified audit opinion for the Authority’s 2020 financial statements. The Executive is addressing the two low level findings raised.

Finance oversight

The ARC has no responsibility for the day-to-day financial management or operations of the organisation which is the responsibility of the Executive. During 2021, the ARC reviewed the quarterly management accounts and examined and discussed with the Executive the reasons for any material variances from planned expenditure. The ARC reviewed the investments of the Authority each quarter. The ARC also monitored the future cash flows of the Authority in the light of significant planned capital expenditure and received reports on the progress of the relevant projects.

 

During 2021 the Authority made a submission to the Minister on the future fee levels and funding of the Authority. The ARC reviewed and commented on the draft submission and reviewed and discussed with the Executive and the Authority the funding and cashflow implications of the approved fee increases.

 

The Authority has a significant programme of Capital Expenditure planned for 2022 and future years. The ARC reviewed and commented to the Authority on the project management which is being applied to the key projects and the funding of these projects.

 

The ARC also reviewed and provided comments to the Authority on the 2022 budget. 

Risk management

A risk register is compiled and managed by the Executive and identifies key risks facing the Authority and the actions being taken by the Executive, to the extent possible, to mitigate those risks. The ARC provided feedback to the Authority on their quarterly review of the risk register.

 

The risk management process was updated for 2021 to make the risk scoring, control effectiveness and risk monitoring clearer and more informative and to link the risk assessment to the Authority’s risk appetite statement.

 

The ARC is satisfied that the process of identifying, assessing and addressing key risks is sufficiently robust to ensure that an effective system of risk management was in place in the Authority in 2021. 

Corporate governance

During 2021, the ARC received updates from the Pensions Regulator on the supervision activities of the Authority and on matters including pensions reform initiatives, the transposition of the IORPS II Directive, IT systems development and data management projects, fee income and human resources.

The ARC, as a matter of course, meets for a short period, with no Executive members present, at the end of each of its meetings.

 

The ARC presented a report to the Authority after each of its meetings in 2021. The ARC was compliant with its obligations under the Code of Practice for the Governance of State Bodies in 2021. In meeting the requirements of the Code, the ARC conducted a self-assessment of its own performance in 2021. The outcome of the self-assessment was positive.

 

The Chairman of the Authority noted his satisfaction in the performance of the ARC and the ARC Chairman at the Authority meeting on the 26 April 2022. 

Plan for 2022

As the Authority continues to implement forward-looking risk-based supervision in line with the requirements of the IORP II Directive, challenges will arise in ensuring that the right mix of employees is in place to deliver this model of supervision. The Authority will also incur significant capital investment in developing the data systems and IT infrastructure necessary to support the new supervisory regime and to meet increased internal and EU data reporting obligations.

 

The growth in employee numbers and the development of the data systems and IT infrastructure will have a considerable impact on expenditure in the coming year which will be closely monitored by the ARC.

 

In addition to the programme of work set out in its charter, the ARC will monitor the impact these challenges will have on the maintenance of a robust system of internal control and risk management within the Authority and on the financial resources available to the Authority.

 

With the expansion of the role of the Authority in supervision and the growth in employee numbers and investment in IT developments, the future funding model for the Authority will have to be reviewed and agreed with the Minister. The ARC will monitor the development of the funding proposals and will comment on them to the Authority. The ARC will review the impact of any approved funding model on the finances and cashflows and will comment on the results to the Authority. 

Conclusion

The ARC is satisfied that a robust system of internal control and financial management is in place in the Authority. It is also satisfied that there is an appropriate system in place for effective risk management in the Authority.

I would like to thank my fellow ARC members for the considerable time spent in preparing for and attending meetings and their valued contributions on the wide range of issues examined in 2021.

 

The ARC would like to express its appreciation for the ongoing support it receives from the members of the Authority.

 

On behalf of the ARC, I would like to thank the Executive for their ongoing commitment in supporting the work of the ARC.

 

Mr Bill Cunningham
Chairman
March 2022