Annual Report of the Audit and Risk Committee (ARC) The Pensions Authority for year ended 31 December 2022
Annual Report of the Audit and Risk Committee (ARC) The Pensions Authority for year ended 31 December 2022
Introduction
The Audit and Risk Committee (ARC) is part of the control environment within the Pensions Authority. The ARC is tasked with providing independent advice to the Authority on matters including the suitability and robustness of the organisation’s internal control, risk management, governance procedures and the reliability of financial reporting.
The ARC is independent of the day-to-day financial management of the organisation which is the responsibility of the Executive. In particular, the ARC independently monitors the internal control systems including audit activities.
Membership of the ARC
The ARC consists of four members: an independent Chairperson, an independent non-executive member, a representative of the Department of Social Protection, and a representative of the Department of Finance.
Schedule of attendance
A schedule of attendance at the ARC meetings for 2022 is set out below.
|
ARC meetings 2022 Number of meetings held: 5 |
||
|
Name |
Position |
Number of meetings attended |
|
Patricia Barker* |
Chairperson |
2/2 |
|
Bill Cunningham |
Chairperson |
3/3 |
|
Kevin Barron |
Representative of the Department of Social Protection |
5/5 |
|
Brendan O’Leary |
Representative of the Department of Finance |
5/5 |
|
Michael Roche |
Independent non-executive member |
1/1 |
|
Cliodhna Judge |
Independent non-executive member |
3/3 |
* Patricia Barker attended the September ARC meeting as an observer prior to formally commencing in her role as Chair of the ARC.
ARC Charter
The ARC’s terms of reference are set out in its Charter. The ARC conducted its annual review of the Charter in 2022 and it was approved by the Authority at its meeting on 26 April 2022.
Work of the ARC in 2022
The ARC, in fulfilling the requirements of its advisory function, assessed the performance of the key elements of the systems of internal control in operation in the Authority in 2022. The ARC held its meetings virtually or in a hybrid fashion during 2022.
Internal audit
Internal audit provides an objective evaluation of, and opinion on, the overall adequacy and effectiveness of the Authority’s system of governance, risk management and internal controls. The 2022 internal audit work programme was approved by the ARC. The ARC met with the internal auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2022. The ARC also met with the Internal Auditors with no Executive members present. The 2022 audits were conducted remotely.
Details of the 2022 audit work programme are set out below.
|
Internal controls audit completed in 2022 |
|
|
High level review of internal controls in the Authority. |
The objective of the audit was to provide the ARC with an opinion on the level of reliance that can be placed on the operation of the Authority’s internal controls. |
|
Outcome of the audit |
The audit assessment indicates that that reasonable assurance can be placed on the adequacy and operating effectiveness of the controls tested to mitigate and/or manage risks to which the audit areas within scope may be exposed. The Executive are addressing the two low level findings raised. |
|
Data Protection, Freedom of Information (FOI) and Protected Disclosures audit completed in 2022 |
|
|
A high-level review of the Authority’s Data Protection, Freedom of Information (FOI) and Protected Disclosures procedures. |
The objective of the audit was to provide the ARC with an opinion on the level of reliance they can place on the design and operation of the Authority’s Data Protection, Freedom of Information (FOI) and Protected Disclosures procedures. |
|
Outcome of the audit |
The audit assessment indicates that substantial assurance can be placed on the adequacy and operating effectiveness of controls, policies and procedures in place at the Authority to mitigate and/or manage risks associated with Data Protection, FOI and Protected Disclosures. The Executive has resolved the two low level findings raised. |
Internal audit of IT systems
The internal auditors were due to undertake an audit of IT systems in the Authority in Q4 2022. However, as a new IT manager started in late November 2022, this audit was postponed to Q2 2023.
IT security audit
CommSec Security carried out penetration testing of the Authority’s IT servers in December 2021 and delivered their report in January 2022.
The Authority migrated to the OGCIO Desktop as a Service system in October 2021. The servers that were previously used by the Authority, located in Verschoyle House, have now been decommissioned, as the OGCIO are now hosting the IT systems that were running on those servers.
The audit found 28 vulnerabilities, which were categorised according to risk level; high (five findings) medium (nine findings) and low (14 findings). The ARC monitored the progress of addressing these issues throughout 2022. All issues have now been resolved.
External audit
The Comptroller and Auditor General (C&AG) is the external auditor of the Authority. The ARC met with the external auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2022. The ARC also met with the C&AG team with no Executive members present. The 2022 audit was conducted remotely.
A summary of the audit is set out below.
|
Audit completed in 2022 |
|
|
Audit of the Authority’s financial statements 2021. |
To provide independent assurance on the truth and fairness of the financial statements of the organisation. |
|
Outcome of the audit |
The C&AG issued an unqualified audit opinion for the Authority’s 2021 financial statements. The Executive has resolved the two low level findings raised. |
Finance oversight
The ARC has no responsibility for the day-to-day financial management or operations of the organisation which is the responsibility of the Executive. During 2022, the ARC reviewed the quarterly management accounts and examined and discussed with the Executive the reasons for any material variances from planned expenditure. The ARC reviewed the investments of the Authority each quarter. The ARC also monitored the future cash flows of the Authority in the light of significant planned capital expenditure and received reports on the progress of the relevant projects.
The Authority has a significant programme of capital expenditure planned for 2023 and future years. The ARC noted and commented to the Authority on the importance of effective project management being applied to these key projects.
The ARC reviewed and provided their comments to the Authority on the fee structure and fee rates proposals expected to be implemented for 2024. The ARC will keep the future financing of the Authority as a standing item on its agenda during 2023.
The ARC also reviewed and provided comments to the Authority on the 2023 budget.
Risk management
A risk register is compiled and managed by the Executive and identifies key risks facing the Authority and the actions being taken by the Executive, to the extent possible, to mitigate those risks. The ARC provided feedback to the Authority on their quarterly review of the risk register.
The ARC is satisfied that the process of identifying, assessing and addressing key risks is sufficiently robust to ensure that an effective system of risk management was in place in the Authority in 2022.
The ARC has agreed with the Executive that the Risk Register for 2023 will be designed and presented in such a way that the highest priority risks facing the Authority and the possible causes of these risks coming to pass if not addressed are clearly identified and brought to the ARC’s attention.
Corporate governance
During 2022, the ARC received updates from the Pensions Regulator on the supervision activities of the Authority and on matters including pensions reform initiatives, the transposition of the IORPS II Directive, IT systems development and data management projects, fee income and human resources.
The ARC, as a matter of course, meets for a short period, with no Executive members present, at the end of each of its meetings.
The ARC presented a report to the Authority after each of its meetings in 2022. The ARC was compliant with its obligations under the Code of Practice for the Governance of State Bodies in 2022.
In meeting the requirements of the Code, the ARC conducted a self-assessment of its own performance in 2022. The outcome of the self-assessment was positive and was brought to the attention of the Authority at their meeting on 13 December 2022.
Plan for 2023
To implement forward-looking risk-based supervision in line with the requirements of the IORP II Directive, the ARC is conscious of the challenges and risks that face the Authority in ensuring that effective change and business change management occurs both externally and internally to successfully deliver this new supervisory regime.
The growth in employee numbers and the ongoing development of the data systems and IT infrastructure necessary to support the new supervisory regime and to meet increased internal and EU data reporting obligations will have a considerable impact on expenditure in the coming year which will need to be monitored closely. The ARC’s advice is that strong change and project management procedures need to be in place for this significant project, and the sub-projects supporting it, with the associated risks and organisational changes envisaged.
The internal audit schedule planned for 2023 includes:
-
Q1 – Human resources and people management
-
Q2 – ICT systems
-
Q3 – Hybrid working
-
Q4 – High level review of Internal Controls
In addition to the programme of work set out in its charter, the ARC will monitor the impact these challenges will have on the maintenance of a robust system of internal control and risk management within the Authority and on the financial resources available to the Authority.
Conclusion
The ARC is satisfied that a robust system of internal control and financial management is in place in the Authority. It is also satisfied that there is an appropriate system in place for effective risk management in the Authority. These systems will continue to be monitored by ARC.
I would like to thank my fellow ARC members for the considerable time spent in preparing for and attending meetings and their valued contributions on the wide range of issues examined in 2022.
I would also like to thank and acknowledge the hard work and valuable contributions of Bill Cunningham (Chairman) and Mick Roche (independent member) of the Audit and Risk Committee who both stepped down during 2022 having served the maximum two terms.
The ARC would like to express its appreciation for the ongoing support it receives from the members of the Authority.
On behalf of the ARC, I would like to thank the Executive for their ongoing commitment in supporting the work of the ARC.
Patricia Barker
ARC Chair
March 2023