Introduction

The ARC is part of the control environment within the Authority providing independent advice on matters including the suitability and robustness of the organisation’s internal control, internal audit, risk management, governance systems, the reliability of financial reporting and overseeing the external audit of accounts. 

The ARC terms of reference are set out in its Charter, which was updated and approved by the Authority in December 2018.  A number of changes were made to the Charter to reflect the advisory role of the ARC.  The ARC reports to the Authority reviewing and commenting upon relevant matters which the Authority then consider before making a decision.  

The ARC also provides independent advice to the Executive of the Authority who are responsible for all matters relating to the presentation of financial statements and all issues arising from internal and external audits of the Authority. 

Membership of the ARC

The ARC consists of four members:

• an independent Chairman
• a non-executive member
• a representative from the Department of Employment Affairs and Social Protection
• a representative from the Department of Finance.  

The membership of the ARC at the end of 2018 was as follows:

• Mr. Bill Cunningham, Chairman
• Mr. Michael Roche, non-executive member
• Mr. Kevin Barron, representative of the Department of Employment Affairs and Social Protection
• Mr. Sean Kinsella, representative of the Department of Finance 

Work of the ARC in 2018

The ARC met five times in 2018 with full attendance of all members.  

Internal control

Throughout 2018 the ARC evaluated the robustness of the internal control environment.  It did so by reviewing findings from internal and external audit reports, and monitoring the implementation of recommendations from internal and external auditors by the Executive.  The ARC also met with external and internal auditors independently of the Executive to assess the effectiveness of the audits carried out.  The ARC sought updates at each of its meetings from the Executive of any instances of non-compliance or failures in the control systems.  The ARC is satisfied that there were robust systems of internal control in place in the Authority in 2018. 

Internal auditor

As part of the implementation of a ‘three line of defence’ approach to risk management, the Authority has arranged for an annual internal audit to be carried out.  The ARC is responsible for recommending the appointment of the internal auditors and agreeing the work plan for the auditors.  Following a tender process under the OGP framework internal auditors, Crowleys DFK, were appointed in September 2018 by the ARC for a thirty three month term.  

In 2018, the internal audit programme consisted of:

• an audit of the General Data Protection Regulation (GDPR) readiness and Freedom of Information systems, policies and procedures
• a high-level review of the effectiveness of internal controls. 

The outcome of these reviews were positive and no significant issues of concern were raised.  The ARC monitors the work of the Executive to ensure any issues raised in audits are addressed. 

External audit

The external auditor is the Comptroller and Auditor General (C&AG).  The external audit was conducted by the C&AG in April 2018.  The ARC considered the findings from the external audit.  The ARC met with representatives of the C&AG to discuss the audit findings. 

The C&AG issued an unqualified report for the Authority’s 2017 accounts. 

Risk management

The ARC reviewed the risk management policies and procedures and the risk appetite statement during 2018 which are designed to ensure that risks are identified, assessed and controls put in place to manage identified risks.  The ARC assessed the senior management team’s quarterly reviews of the risk register, examining the risks identified and any changes to risks or risk scoring.  The ARC is satisfied that the process of identifying, assessing and addressing key risks was sufficiently robust to ensure that an effective system of risk management was in place in the Authority in 2018. 

Corporate governance

Full compliance with the updated Code of Practice for the Governance of State Bodies (2016) was achieved in 2017.  In meeting the ongoing requirements of the Code, the ARC conducted a self-assessment of its own performance in 2018.  The outcome of the self-assessment was positive and was shared with the Chairman of the Authority in advance of his review of the Chairman of the ARC.  

Training

Members of the ARC undertook training on the role of the ARC in public sector organisations and completed additional training on risk management.  This training assisted the ARC in enhancing its overall effectiveness.  

Financial reporting and financial management

The ARC assessed the financial reporting processes in the Authority by reviewing quarterly management accounts and the annual financial statements.  The ARC reviewed expenditure against budget and examined and discussed with the Executive the reasons for any material variances from planned expenditure.  The ARC has no responsibility for the day-to-day financial management or operations of the organisation which is the responsibility of the Executive.  The ARC conducted a review of the investments of the Authority on a quarterly basis.  

The ARC reviewed and provided comments to the Authority on:

• the 2019 budget
• the fee recommendation for 2019 

Other activity in 2018

Over the course of its meetings in 2018 the ARC:

• received updates from the Pensions Regulator on the compliance activities of the Authority and on matters including pensions reform initiatives, the transposition of the IORPS II Directive, staffing, EIOPA pensions data project, IT systems development projects, GDPR and data management
• received a presentation from the Head of the Regulatory Intelligence Unit on the findings from an ICT security audit. 

Outlook for 2019

The Authority faces a number of significant challenges in 2019 with the implementation of IORPS II and other reform initiatives. These changes will have a significant impact on the work of the Authority as it moves to a prospective risk based model of supervision.  Ongoing development of staff resources will be required by the Executive as these changes take place and new practices and procedures are introduced following the implementation of the reform initiatives. 

New data reporting obligations from EIOPA will come into effect in 2019.  The Authority will need to make a considerable investment in new technology to meet these reporting requirements.  There is a great deal of uncertainty around the costs associated with meeting these requirements.  The Authority will need to closely monitor expenditure on this activity.  

The ARC will monitor the impact these challenges will have on the maintenance of a robust system of internal control and risk management within the Authority.  

Conclusion

The ARC is satisfied that a robust system of internal controls and financial management is in place in the Authority.  It is also satisfied that there is an appropriate system in place for effective risk management and the maintenance of a high standard of corporate governance. 

On behalf of the ARC I would like to thank the Executive for their ongoing commitment in supporting the work of the ARC.  I would also like to thank my fellow ARC members for the considerable time spent in preparing for and attending meetings and their valued contributions on the wide range of issues examined in 2018. 

The ARC would also like to express its appreciation for the ongoing support it receives from the members of the Authority. 

Mr Bill Cunningham
Chairman
February 2019