Annual report of the Audit and Risk Committee The Pensions Authority for year ended 31 December 2023

Introduction

The Audit and Risk Committee (ARC) is part of the control environment within the Pensions Authority. The ARC is tasked with providing independent advice to the Authority on matters including the suitability and robustness of the organisation’s internal control, risk management, governance procedures and the reliability of financial reporting.

The ARC is independent of the day-to-day financial management of the organisation which is the responsibility of the Executive. In particular, the ARC independently monitors the internal control systems including audit activities.

Membership of the ARC

The ARC consists of four members: an independent Chairperson, an independent non-executive member, a representative of the Department of Social Protection, and a representative of the Department of Finance.

Schedule of attendance

A schedule of attendance at the ARC meetings for 2023 is set out below.

ARC meetings 2023 Number of meetings held: 5
Name	Position	Number of meetings attended
Patricia Barker	Chairperson	5/5
Brendan O’Leary	Representative of the Department of Finance	4/5
Cliodhna Judge	Independent non-executive member	5/5
Odelle Coogan	Representative of the Department of Social Protection (appointed on 21/08/2023)	3/3
Kevin Barron*	Representative of the Department of Social Protection	2/2

* Kevin Barron’s term of appointment came to an end on 07/06/2023 having served two terms on the ARC.

ARC Charter

The ARC’s terms of reference are set out in its Charter. The ARC conducted its annual review of its Charter in 2023 and agreed a revised Charter and Terms of Reference to reflect current best practice. While the remit of the ARC remains unchanged the Charter and Terms of Reference was extended to include providing advice on the adequacy of the Authority’s initiatives on Environment, Social and Governance (ESG) matters. The revised ARC Charter and Terms of Reference were approved by the Authority at its meeting on 24 October 2023.

Work of the ARC in 2023

The ARC, in fulfilling the requirements of its advisory function, assessed the performance of the key elements of the systems of internal control in operation in the Authority in 2023. The ARC held its meetings in-person and supported virtual attendance at the meetings throughout 2023.

Internal audit

Internal audit provides an objective evaluation of, and opinion on, the overall adequacy and effectiveness of the Authority’s system of governance, risk management and internal controls. The 2023 internal audit work programme was approved by the ARC. The ARC met with the internal auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2023. The ARC also held a private meeting with the Internal Auditors independent of the Executive. The 2023 internal audits were conducted remotely.

Details of the 2023 audit work programme are set out below.

Internal controls audit completed in Q1 2023
High level review of internal controls in the Authority.	The objective of the audit was to provide the ARC with an opinion on the level of reliance that can be placed on the operation of the Authority’s internal controls.
Outcome of the audit	The audit assessment indicates that reasonable assurance can be placed on the adequacy and operating effectiveness of the controls tested to mitigate and / or manage risks to which the audit areas within scope may be exposed. The Executive have addressed the two low level findings raised.

HR and people management audit completed in Q1 2023
A high-level review of the Authority’s Human Resources and people management systems, policies and procedures.	The objective of the audit was to provide the ARC with an opinion on the level of reliance they can place on the design and operation of the Authority’s Human Resources and people management systems, policies and procedures.
Outcome of the audit	The audit assessment indicates that substantial assurance can be placed on the adequacy and operating effectiveness of controls, policies and procedures in place at the Authority to mitigate and/or manage risks associated with Human Resources and people management function. There were no findings of weakness identified.

 

Hybrid working audit completed in Q2 2023
A high-level review of the Authority’s hybrid working systems, procedures and controls.	The objective of the audit was to provide the ARC with an opinion on the level of reliance they can place on the design and operation of the Authority’s hybrid working policies and procedures.
Outcome of the audit	The audit assessment indicates that substantial assurance can be placed on the adequacy and operating effectiveness of controls, policies and procedures in place at the Authority to mitigate and/or manage risks associated with hybrid working arrangements. The Executive is addressing the one low levelfinding raised.

ICT systems audit completed in Q3 2023
A high-level review of the Authority’s ICT systems, procedures and controls.	The objective of the audit was to provide the ARC with an opinion on the level of reliance they can place on the design and operation of the Authority’s ICT systems policies and procedures.
Outcome of the audit	The audit assessment indicates that reasonable assurance can be placed on the adequacy and operating effectiveness of controls, policies and procedures in place at the Authority to mitigate and/or manage risks associated with ICT systems, procedures and controls. The Executive is addressing the five medium level and three low levelfindings raised which largely relate to the Pensions Data Register (PDR) system which is scheduled to be replaced in early 2025.

External audit

The Comptroller and Auditor General (C&AG) is the external auditor of the Authority. The ARC met with the external auditors to discuss the outcome of the audit findings and monitored the implementation of audit recommendations by the Executive throughout 2023. The ARC also held a private meeting with the C&AG team independent of the Executive members, no issues of concern were raised. A hybrid approach was adopted in conducting the audit using a combination of remote and in-person meetings.

 

A summary of the audit is set out below.

Audit completed in 2023
Audit of the Authority’s financial statements 2022.	To provide independent assurance on the truth and fairness of the financial statements of the organisation.
Outcome of the audit	The C&AG issued an unqualified audit opinion for the Authority’s 2022 financial statements. The Executive has resolved the two low level findings raised.

Finance oversight

The ARC has no responsibility for the day-to-day financial management or operations of the organisation which is the responsibility of the Executive. During 2023, the ARC reviewed the quarterly management accounts and examined and discussed with the Executive the reasons for any material variances from planned expenditure. The ARC reviewed the investments of the Authority each quarter. The ARC also monitored the future cash flows of the Authority in the light of planned capital expenditure and received reports on the progress of the relevant projects.

The ARC kept the future financing of the Authority as a standing item on its agenda during 2023 and were provided with regular updates from the Executive. The ARC will continue to monitor the Executive’s progress in developing a sustainable funding model that will provide the Authority with adequate future income.

The ARC also reviewed the draft 2024 budget at their meeting in December and provided their feedback to the Authority.

Risk management

A risk register is compiled and managed by the Executive and identifies key risks facing the Authority and the actions being taken by the Executive, to the extent possible, to mitigate those risks. The ARC provided feedback to the Authority on their quarterly review of the risk register.

During 2023 the ARC undertook a deep dive into two key risks at each ARC meeting. Executives with specific responsibility for key risks provided the ARC with detailed presentations on the following risks:

• developing a new IT system which will support the delivery of the Authority’s strategic objectives;
• mitigating the risks regarding compliance with the IORP II Directive;
• overview of the key person risk;
• failure to deliver a strategic project;
• management capacity; and
• negative impact of hybrid working.

These presentations provided the ARC with an opportunity to gain a greater understanding of the risks faced by the organisation and obtain assurances from the Executive that there are appropriate controls in place to manage those risks.

The ARC is satisfied that the process of identifying, assessing and addressing key risks is sufficiently robust to ensure that an effective system of risk management was in place in the Authority in 2023.

During 2023 the ARC also received presentations from relevant members of the Executive on the following:

• Health & Safety
• Fraud, corruption, and bribery prevention measures
• Data Protection and records management
• Procurement and purchasing

Corporate governance

During 2023, the ARC received updates from the Pensions Regulator on the supervision activities of the Authority and on matters including pensions reform initiatives, the implementation of the IORPS II Directive, Liability Driven Investments, IT systems development and data management projects, auto-enrolment, fee income and human resources.

The ARC reviewed the Authority’s incident response plan to assess if appropriate business continuity plans were in place in the event of a crisis. Following a recommendation from the ARC the Executive completed a crisis communications drill to test the effectiveness of the organisational response. The outcome of this exercise was positive and provided assurance to the ARC as to the effectiveness of the incident response plan.

The ARC also reviewed the Authority’s Equality, Diversity and Inclusion policy and the ethics code as set out in the Authority’s Code of Business Conduct. The ARC provided the Executive with feedback for consideration as part of the next annual review of the Code of Business Conduct.

The ARC, as a matter of course, meets for a short period, with no Executive members present, at the end of each of its meetings.

The Chair of the ARC presented a report to the Authority after each of its meetings in 2023. The ARC was compliant with its obligations under the Code of Practice for the Governance of State Bodies in 2023.

During 2023 the ARC undertook a skills audit to assess if the ARC had access to the relevant skills and knowledge to fulfil its duties. A lacuna was identified in the area of ICT governance and cybersecurity. The ARC recommended to the Board that an additional member with this expertise be appointed to the ARC to address this gap. The Board approved the recommendation, and a recruitment process will be undertaken in 2024 to source a suitable candidate.

In meeting the requirements of the Code, the ARC conducted a self-assessment of its own performance in 2023. The outcome of the self-assessment will be brought to the attention of the Authority at their meeting in January 2024.

Plan for 2024

The ARC is alert to the many risks faced by the Authority as it progresses with the implementation of forward-looking risk-based supervision as required by the IORP II Directive and will continue to monitor these risks throughout 2024.

The growth in employee numbers and the ongoing development of the data systems and IT infrastructure necessary to support the new supervisory regime and to meet increased internal and EU data reporting obligations will continue to generate new challenges and risks for the Authority over the coming year and these will need to be monitored closely. Having strong change and project management procedures in place will help support the effective delivery of the new supervisory regime project, and the sub-projects supporting it, with the associated risks and organisational changes envisaged.

The internal audit schedule planned for 2024 includes:

· Q1 – Strategic planning

· Q2 – Business continuity planning, disaster recovery and cyber security

· Q4 – High level review of Internal Controls

In addition to the programme of work set out in its charter, the ARC will monitor the impact these challenges will have on the maintenance of a robust system of internal control and risk management within the Authority and on the financial resources available to the Authority.

Conclusion

The ARC is satisfied that a robust system of internal control and financial management is in place in the Authority. It is also satisfied that there is an appropriate system in place for effective risk management in the Authority. These systems will continue to be monitored by ARC.

I would like to thank my fellow ARC members for the considerable time spent in preparing for and attending meetings and their valued contributions on the wide range of issues examined in 2023.

I would also like to thank and acknowledge the hard work and valuable contribution of Kevin Barron (Department of Social Protection representative) to the work of the ARC. Kevin stepped down during 2023 having served the maximum two terms.

The ARC would like to express its appreciation for the ongoing support it receives from the members of the Authority.

On behalf of the ARC, I would like to thank the Executive for their ongoing commitment in supporting the work of the ARC.

Patricia Barker

ARC Chair

December 2023