Audit and Risk Committee – Terms of Reference

The Board has established an Audit and Risk Committee (“the Committee”) as a committee of the Board to support the Accountable Officer and Board in their responsibilities for matters of risk, control and governance and associated assurance (including assurance over the principal risks to the achievement of the organisation’s strategic objectives) through a process of constructive challenge.

The Committee will have at least three members of which at least two will be non-executive members of the Board. The Board may appoint up to two independent, external members for terms of up to three years (which may be renewed for total service of up to six years).

The members of the committee are:

• non-executive directors: Marion Mcdonald, James Walker and Jane Clark Hutchison
• independent external members: none

The committee will be Chaired by Marion Mcdonald.

The committee will be provided with a secretariat function by the Operations Team (Ifthakhar Eresh).

The current Committee members and their terms of appointment are set out in Appendix A.

The committee will formally report in writing to the Board and AO after each meeting. A copy of minutes of the meeting may form the basis of the report.

The committee will provide the Board and AO with an Annual Report, timed to support finalisation of the accounts and the governance statement, summarising its conclusions from the work it has done during the year.

The committee will advise the Board and AO on:

• the strategic processes for risk, control and governance and the governance statement
• the accounting policies, the accounts, and the annual report of the organisation, including the process for review of the accounts prior to submission for audit, levels of error identified, and management's letter of representation to the external auditors
• the planned activity and results of both internal and external audit
• the adequacy of management response to issues identified by audit activity, including external audit's management letter/report
• the effectiveness of the internal control environment
• assurances relating to the corporate governance requirements for the organisation
• (where appropriate) proposals for tendering for either internal or external audit services or for purchase of non-audit services from contractors who provide audit services
• anti-fraud policies, whistle-blowing processes, and arrangements for special investigations

In considering the assurance needs of the Accountable Officer and Board, the Committee should consider the adequacy, reliability and coverage of assurance available collectively, including any significant gaps or areas where further assurance may be required.

The Audit and Risk Committee will also periodically review its own effectiveness and report the results of that review to the Board and AO.

The Audit and Risk Committee may:

• co-opt additional members for a period not exceeding one year, and with the approval of the organisation’s Chair and/or the Accountable Officer, to provide specialist skills, knowledge and experience
• procure specialist ad-hoc advice, at the expense of the organisation, subject to budgets agreed by the Board and/or the Accountable Officer

The Head of Internal Audit and the representative of External Audit will have free and confidential access to the Chair of the Committee.

The procedures for meetings are:

• the committee will meet at least four times a year. The Chair of the Committee may convene additional meetings, as he/she deems necessary
• a minimum of two members of the committee will be present for the meeting to be deemed quorate
• committee meetings will normally be attended by the AO, the Finance Director, the Head of Internal Audit, and a representative of External Audit
• the committee may ask any other officials of the organisation to attend to assist it with its discussions on any particular matter
• the agenda will be agreed by the Chair, informed by the ARC Annual Work Programme and current or emerging risks and assurance needs. The Chair may vary the order and emphasis of business to ensure the Committee focuses its time where assurance is most needed
• the committee may ask any or all of those who normally attend but who are not members to withdraw to facilitate open and frank discussion of particular matters
• the Board or AO may ask the committee to convene further meetings to discuss particular issues on which they want the committee's advice

For each meeting the Committee will be provided with:

• a report summarising any significant changes to the organisation's Risk Register
• a progress report from the Head of Internal Audit summarising
• work performed (and a comparison with work planned)
• key issues emerging from Internal Audit work
• management response to audit recommendations
• significant changes to the audit plan
• any resourcing issues affecting the delivery of Internal Audit objectives
• a progress report from the External Audit representative summarising work done and emerging findings

As and when appropriate, the committee will also be provided with:

• business update reports from the AO
• the Charter / Terms of Reference of the Internal Audit Directorate
• the Internal Audit Strategy
• the annual Internal Audit Plan
• the Head of Internal Audit's Annual Opinion and Report
• quality assurance reports on the Internal Audit function
• the draft accounts of the organisation
• the draft governance statement
• a report on any changes to accounting policies
• External Audit's management letter/report
• a report on any proposals to tender for audit functions
• a report on the Counter Fraud and Bribery arrangements and performance
• reports from other sources within the “three lines of assurance” integrated assurance framework (e.g. Best Value self-assessment Reviews, Gateway Reviews, Health Check Reviews, Major Digital Project Assurance Reviews,, Procurement Capability Reviews, Procurement Key Stage Reviews).

The above list suggests minimum requirements for the inputs which should be provided to the committee. In some cases more may be provided. N.B The Integrated Assurance framework previously carried out Digital Scotland Service Standard reviews, however this is now the responsibility of the Senior Responsible Officer(s) within the Public Body. See guidance for details.

Marion Mcdonald, Chair

Appointed 02.02.2026 to 02.02.2029

James Walker

Appointed 19.04.2022 to 30.06.2024

Reappointed 12.03.2024 to 31.03.2028

Jane Clark Hutchison

Appointed 02.02.2026 to 02.02.2029