Annual report of the Audit and Risk Committee The Pensions Authority for year ended 31 December 2020

Introduction

The Audit and Risk Committee (ARC) is part of the control environment within the Pensions Authority. The ARC is tasked with providing independent advice to the Authority on matters including the suitability and robustness of the organisation’s internal control, risk management, governance procedures and the reliability of financial reporting.

 

The ARC is independent of the day-to-day financial management of the organisation which is the responsibility of the Executive. In particular, the ARC independently monitors the internal control systems including audit activities.

Membership of the ARC

The ARC consists of four members: an independent Chairperson, an independent non-executive member, a representative of the Department of Social Protection, and a representative of the Department of Finance.  

Schedule of attendance

A schedule of attendance at the ARC meetings for 2020 is set out below.

ARC meetings 2020 Number of meetings held: 5
Name	Position	Number of meetings attended
Bill Cunningham	Chairperson	5/5
Kevin Barron*	Representative of the Department of Social Protection	4/5
Brendan O’Leary	Representative of the Department of Finance	4/5
Michael Roche	Ordinary member	5/5

*Kevin Barron was re-appointed by the Authority for a second three-year term on 8 December 2020. 

ARC Charter

The ARC’s terms of reference are set out in its Charter. The ARC conducted its annual review of the Charter during 2020 and it was approved by the Authority on 8 December 2020. 

Work of the ARC in 2020

The ARC, in fulfilling the requirements of its advisory function, assessed the performance of the key elements of the systems of internal control in operation in the Authority in 2020. The ARC held its meetings remotely during 2020 in compliance with Government Covid-19 restrictions and guidelines. 

Internal audit

Internal audit provides an objective evaluation of, and opinion on, the overall adequacy and effectiveness of the Authority’s system of governance, risk management and internal controls. The 2020 internal audit work programme was approved by the ARC. The ARC met with the internal auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2020. The ARC also met with the Internal Auditors with no executive members present. The audits were conducted remotely in 2020.

 

Details of the 2020 audit work programme are set out below.

Internal controls audit completed in 2020
High level review of internal controls in the Authority.	The objective of the audit was to provide the ARC with an opinion on the level of reliance that can be placed on the operation of the Authority’s internal controls.
Outcome of the audit	The audit assessment indicates that significant assurance can be placed on the sufficiency and operation of the Authority’s internal control framework. The audit also confirmed that controls have continued to operate as intended during movement restrictions in place due to the Covid-19 pandemic. Management is addressing the 2 low level findings raised.

 

Culture audit completed in 2020
Review of organisational culture in the Authority	The objective of the audit was to provide the ARC with an opinion on the organisation’s cultural characteristics and determine how they support the achievement of the organisation’s success.
Outcome of the audit	The internal auditors concluded that the Authority’s policies and procedures, practices and actions to promote and develop its culture are satisfactory. Management is addressing the 2 low level findings raised.

IT security audit

An IT security audit was completed in Q3 2020. The audit was divided into two parts: the first examined specific areas of the ICT infrastructure and the second part carried out penetration testing of the Pensions Data Register (PDR) system.

 

The Executive have worked through resolving the issues raised in the audit report in order of priority. The Executive confirmed in a presentation to the ARC in March 2021 that all the issues raised in the audit report that were feasible to fix had been attended to. The Executive also noted that any issues that were not addressed did not, in their opinion, represent a substantial risk to the Authority.

 

The Authority is currently planning to move as many of its ICT systems as possible to infrastructure and services offered by the Office of the Government Chief Information Office (OGCIO) later in 2021. Progressing this migration project.is a key priority for the Authority and the remaining issues raised in the IT security audit will be addressed in the infrastructure design. 

External audit

The external auditor of the Authority is the Comptroller and Auditor General (C&AG). The ARC considered the findings of the C&AG annual audit and met with the C&AG team, to discuss the audit findings. The ARC monitored the implementation of audit recommendations by the Executive throughout 2020. The ARC also met with the C&AG team with no executive members present. The audit was conducted remotely in 2020.

 

A summary of the audit is set out below.

Audit completed in 2020
Audit of the Authority’s financial statements 2019.	To provide independent assurance on the truth and fairness of the financial statements of the organisation.
Outcome of the audit	The C&AG issued an unqualified audit opinion for the Authority’s 2019 financial statements. Management is addressing the 3 low level findings raised.

Finance oversight

The ARC has no responsibility for the day-to-day financial management or operations of the organisation which is the responsibility of the Executive. During 2020, the ARC reviewed expenditure against budget each quarter, and examined and discussed with the Executive the reasons for any material variances from planned expenditure. The ARC reviewed the investments of the Authority each quarter. The ARC also monitored the future cash flows of the Authority in the light of significant planned capital expenditures and received reports on the progress on the relevant projects.

 

The ARC also reviewed and provided comments to the Authority on:

• the 2021 budget, and
• the fee recommendation for 2021. 

Risk management

A risk register is compiled and managed by the Executive and identifies key risks facing the Authority and the actions being taken by the Executive, to the extent possible, to mitigate those risks. The ARC reviewed the risk management policies and practices of the Authority and conducted a quarterly review of the Authority’s risk register and provided feedback to the Authority on their quarterly review of the risk register.

 

During 2020, the ARC reviewed with the Executive the Authority’s risk appetite, risk management policy and procedures and the implementation of the recommendations from the 2019 internal audit of the risk management process. The risk management process was updated to make the risk scoring, control effectiveness and risk monitoring clearer and more informative.

 

The ARC is satisfied that the process of identifying, assessing and addressing key risks is sufficiently robust to ensure that an effective system of risk management was in place in the Authority in 2020. 

Plan for 2021

As the Authority continues to implement forward-looking risk-based supervision in line with the requirements of the IORP II Directive, challenges will arise in ensuring that the right mix of employees is in place to deliver this model of supervision. The Authority will also continue to incur significant capital investment in developing the IT infrastructure and data systems necessary to support the new supervisory regime and to meet increased internal and EU data reporting obligations.

The growth in employee numbers and the development of the IT infrastructure and data systems will have a considerable impact on expenditure in the coming year which will need to be monitored closely.

 

In addition to the programme of work set out in its charter, the ARC will monitor the impact these challenges will have on the maintenance of a robust system of internal control and risk management within the Authority and on the financial resources available to the Authority. 

Corporate governance

During 2020, the ARC received updates from the Pensions Regulator on the supervision activities of the Authority and on matters including pensions reform initiatives, the transposition of the IORPS II Directive, IT systems development and data management projects, fee income and human resources.

 

The ARC, as a matter of course, meets for a short period, with no Executive members present, at the end of each of its meetings.

 

The ARC presented a report to the Authority after each of its meetings in 2020. The ARC was compliant with its obligations under the Code of Practice for the Governance of State Bodies in 2020. In meeting the requirements of the Code, the ARC conducted a self-assessment of its own performance in 2020. The outcome of the self-assessment was positive.

 

The Chairman of the Authority noted his satisfaction in the performance of the ARC and the ARC Chairman at the Authority meeting 20 April 2021. 

Conclusion

The ARC is satisfied that a robust system of internal control and financial management is in place in the Authority. It is also satisfied that there is an appropriate system in place for effective risk management in the Authority.

 

I would like to thank my fellow ARC members for the considerable time spent in preparing for and attending meetings and their valued contributions on the wide range of issues examined in 2020.

 

The ARC would like to express its appreciation for the ongoing support it receives from the members of the Authority. 

 

On behalf of the ARC, I would like to thank the Executive for their ongoing commitment in supporting the work of the ARC.

 

Mr Bill Cunningham
Chairman
March 2021