Annual report of the Audit and Risk Committee The Pensions Authority for the year ended 31 December 2024

Introduction

The Audit and Risk Committee (ARC) is part of the control environment within the Pensions Authority. The ARC is tasked with providing independent advice to the Authority on matters including the suitability and robustness of the organisation’s internal control, risk management, governance procedures and the reliability of financial reporting.

 

The ARC is independent of the day-to-day financial management of the organisation which is the responsibility of the Executive. In particular, the ARC independently monitors the internal control systems including audit activities.

Membership of the ARC

The ARC consists of five members: an independent Chairperson, two independent non-executive members, a representative of the Department of Social Protection, and a representative of the Department of Finance. 

Schedule of attendance

A schedule of attendance at the ARC meetings for 2024 is set out below. 

ARC meetings 2024 Number of meetings held: 5
Name	Position	Number of meetings attended
Patricia Barker	Chairperson	5/5
Brendan O’Leary	Representative of the Department of Finance	5/5
Cliodhna Judge	Independent non-executive member	5/5
Odelle Coogan	Representative of the Department of Social Protection	4/5
Conor Sexton	Independent non-executive member	5/5

ARC Charter

The ARC’s terms of reference are set out in its Charter. The ARC conducted its annual review of its Charter in 2024, and it was approved by the Authority on 22 October 2024. 

Work of the ARC in 2024

The ARC, in fulfilling the requirements of its function, assessed the performance of the key elements of the systems of internal control in operation in the Authority in 2024. The ARC held its meetings in-person and supported virtual attendance at the meetings where necessary throughout 2024. 

Internal audit

Internal audit provides an objective evaluation of, and opinion on, the overall adequacy and effectiveness of the Authority’s system of governance, risk management and internal controls. The 2024 internal audit work programme was approved by the ARC. The ARC met with the internal auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2024. The ARC also held a private meeting with the Internal Auditors independent of the Executive. The 2024 internal audits were conducted remotely.

 

Details of the 2024 audit work programme are set out below. 

Internal controls audit completed in Q1 2024
High level review of internal controls in the Authority.	The objective of the audit was to provide the ARC with an opinion on the level of reliance that can be placed on the operation of the Authority’s internal controls.
Outcome of the audit	The audit assessment indicates that reasonable assurance can be placed on the adequacy and operating effectiveness of the controls tested to mitigate and / or manage risks to which the audit areas within scope may be exposed. The Executive has addressed the three low level findings raised.

 

Strategic planning audit completed in Q2 2024
A high-level review of the Authority’s strategic planning processes and controls.	The objective of the audit was to assess the processes adopted by the Authority and management to develop, implement and deliver on the Authority’s strategic goals while embedding the organisation’s values. The Executive is addressing the three low level findings raised.
Outcome of the audit	The audit assessment indicates that reasonable assurance can be placed on the adequacy and operating effectiveness of existing processes, practices, and controls in place in the Authority to mitigate and manage risks associated with its strategic planning and monitoring processes. The Strategic Plan produced in 2022 was adequate for the Authority’s requirements at that time, comprehensive, mature, and in line with best practices.

 

Business continuity, disaster recovery and cyber security incidence response audit completed in Q4 2024
A high-level review of the Authority’s policies and procedures relating to the development and maintenance of plans and processes to manage business continuity events including cyber security.	The objective of the audit was to provide the ARC with an opinion on the level of reliance they can place on the plans and processes in place in the Authority to manage business continuity events including cyber security.
Outcome of the audit	The audit assessment indicates that reasonable assurance can be placed on the adequacy and operating effectiveness of the Authority’s business continuity and disaster recovery processes and controls. The Executive is addressing the three medium and one low level findings raised.

External audit

The Comptroller and Auditor General (C&AG) is the external auditor of the Authority. The ARC met with the external auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2024. The ARC also held a private meeting with the C&AG team independent of the Executive members, no issues of concern were raised. A hybrid approach was adopted in conducting the audit using a combination of remote and in-person meetings.

 

A summary of the audit is set out below. 

Audit completed in 2024
Audit of the Authority’s financial statements 2023.	To provide independent assurance on the truth and fairness of the financial statements of the organisation.
Outcome of the audit	The C&AG issued an unqualified audit opinion for the Authority’s 2023 financial statements. The Executive has resolved the two low level findings raised.

Finance oversight

The ARC has no responsibility for the day-to-day financial management or operations of the organisation which is the responsibility of the Executive. During 2024, the ARC reviewed the quarterly management accounts and examined and discussed with the Executive the reasons for any material variances from planned expenditure. The ARC reviewed the investments of the Authority each quarter. The ARC also monitored the future cash flows of the Authority in the light of planned capital expenditure and received reports on the progress of the relevant projects.

 

The ARC kept the future financing of the Authority as a standing item on its agenda during 2024 and were provided with regular updates from the Executive. The ARC will continue to monitor the Executive’s progress in developing a sustainable funding model that will provide the Authority with adequate future income.

 

The ARC also reviewed the draft 2025 budget at their meeting in November and provided their feedback to the Authority. 

Risk management

A risk register is compiled and managed by the Executive and identifies key risks facing the Authority and the actions being taken by the Executive, to the extent possible, to mitigate those risks. The ARC provided feedback to the Authority on their quarterly review of the risk register.

 

During 2024 the ARC undertook a deep dive into key risks at each ARC meeting. Executives with specific responsibility for key risks provided the ARC with detailed presentations on the following risks: 

• developing a new IT system which will support the delivery of the Authority’s strategic objectives;
• failure to deliver a strategic project;
• negative impact of hybrid working; and
• management capacity.

These presentations provided the ARC with an opportunity to gain a greater understanding of the risks faced by the organisation and obtain assurances from the Executive that there are appropriate controls in place to manage those risks.

 

The ARC is satisfied that the process of identifying, assessing and addressing key risks is sufficiently robust to ensure that an effective system of risk management was in place in the Authority in 2024.

 

During 2024 the ARC also received presentations from relevant members of the Executive on the following: 

• Health & Safety
• Fraud, corruption, and bribery prevention measures
• Data Protection and records management
• Procurement and purchasing

Corporate governance

During 2024, the ARC received updates from the Pensions Regulator on the supervision activities of the Authority and on matters including pensions reform initiatives, the implementation of the IORPS II Directive, Liability Driven Investments, IT systems development and data management projects, auto-enrolment, fee income and human resources.

 

The ARC also reviewed the Authority’s Equality, Diversity and Inclusion policy and the ethics code as set out in the Authority’s Code of Business Conduct. The ARC provided the Executive with feedback for consideration as part of the next annual review of the Code of Business Conduct.

 

The ARC, as a matter of course, meets for a short period, with no Executive members present, at the end of each of its meetings.

 

The Chair of the ARC presented a report to the Authority after each of its meetings in 2024. The ARC was compliant with its obligations under the Code of Practice for the Governance of State Bodies in 2024.

 

The ARC undertook a skills audit to assess if the ARC had access to the relevant skills and knowledge to fulfil its duties. A lacuna was identified in the area of ICT governance and cybersecurity. Following a recruitment process an additional member was appointed to the ARC in March 2024 to address this gap.

 

In meeting the requirements of the Code, the ARC conducted a self-assessment of its own performance in 2024. 

Plan for 2025

The ARC is alert to the many risks faced by the Authority as it progresses with the implementation of forward-looking risk-based supervision as required by the IORP II Directive and will continue to monitor these risks throughout 2025.

 

The growth in employee numbers and the ongoing development of the data systems and IT infrastructure necessary to support the new supervisory regime and to meet increased internal and EU data reporting obligations will continue to generate new challenges and risks for the Authority over the coming year and these will need to be monitored closely. Having strong change and project management procedures in place will help support the effective delivery of the new supervisory regime, and the sub-projects supporting it, with the associated risks and organisational changes envisaged.

 

In addition to the programme of work set out in its charter, the ARC will monitor the impact these challenges will have on the maintenance of a robust system of internal control and risk management within the Authority and on the financial resources available to the Authority.

 

The internal audit schedule planned for 2025 includes:

• Q1 – Organisational culture
• Q2 – Forward looking risk-based supervision

A tender process for internal audit services will be undertaken in the second half of 2025 when the contract with the current provider expires. 

Conclusion

The ARC is satisfied that a robust system of internal control and financial management is in place in the Authority. It is also satisfied that there is an appropriate system in place for effective risk management in the Authority. These systems will continue to be monitored by the ARC.

 

I would like to thank my fellow ARC members for the considerable time spent in preparing for and attending meetings and their valued contributions on the wide range of issues examined in 2024.

 

I would also like to thank and acknowledge the hard work and valuable contribution of Brendan O’Leary (Department of Finance representative) to the work of the ARC. Brendan stepped down at the end of 2024 having served two terms.

 

The ARC would like to express its appreciation for the ongoing support it receives from the members of the Authority.

 

On behalf of the ARC, I would like to thank the Executive for their ongoing commitment in supporting the work of the ARC.

 

Patricia Barker
ARC Chair
March 2025