Transparency data

Annual report to the FSA Board from the Chair of the Audit and Risk Assurance Committee (ARAC): September 2026

Published 3 September 2026

Applies to England, Northern Ireland and Wales

Report by Anthony Harbinson, Chair of the Food Standards Agency (FSA) Audit and Risk Assurance Committee (ARAC). Delivered to the FSA September 2026 Board meeting.

1. Summary

1.1 To provide the Board with a summary of the work undertaken by the FSA ARAC during 2025/26 in accordance with the ARAC’s Terms of Reference (see annex C).

1.2 The Board is asked to:

• note the work that has been undertaken by the ARAC during the 2025/26 financial year
• note that this report has been agreed with the other members of the ARAC

2. Introduction

2.1 The report sets out the work of the ARAC that I have chaired since the 1 January 2024 in relation to the Committee’s activities in England, Wales, and Northern Ireland (NI) during the year to 31 March 2026.

2.2 I would like to thank all my fellow Board Members who served on the ARAC during the year, and in particular, the Chief Executive (CE), Katie Pettifer, as well as the Board Secretariat team for their supportive and professional approach.

2.3 I would also like to thank the FSA’s Internal Audit Team, Catherine Andrews, the Head of Internal Audit, Ian Gibson, the Director of Corporate Services, other FSA officials and representatives of the National Audit Office (NAO) who have attended the meetings during the year to present reports which have provided the basis for much of the ARAC’s work.

2.4 The respective roles of the CE, ARAC and Board are set out at annex A.

3. Discussion

Key Events in 2025/26

3.1 ARAC meetings took place in June, September, and November 2025 and March 2026. ARAC meetings are held in person; however, the June meeting took place online while we were transitioning from our old London office to the new location. For details of ARAC membership see annex B.

3.2 The drafts of the Head of Internal Audit’s 2024/25 annual report and opinion and the Chair’s Annual Report to the Board for 2024/25 were discussed at the June 2025 meeting. The draft 2024/25 Annual Report and Accounts were discussed at the September and November 2025 meetings. We received NAO’s Management Letter on the 2024/25 financial statements audit at the March 2026 meeting.

3.3 The corporate risk register was presented to and discussed by the ARAC at the June, September and November 2025 meetings with the risk register and appetite also discussed at the Board retreat in January 2026. The Committee also received regular risk management updates at ARAC meetings on the FSA’s mitigations for information security risks and those in the change portfolio of programmes and projects.

3.4 ARAC reviewed, discussed and approved the draft internal audit and regulatory audit plans for 2026/27 when we met in March 2026. The audit plans were approved with the understanding that these may be subject to revision over the year in response to changes in the FSA’s risk profile or other events impacting on the FSA.

3.5 ARAC received notification of and regular updates on any investigations conducted during the year where there was potential for compliance, financial, or reputational risk. No new fraud cases required formal investigation during 2025/26 (in 2024/25 there were also no cases and in 2023/24 there were two new cases).

The FSA’s 2024/25 Annual Report and Accounts (ARA)

3.6 The Governance Statement was presented to ARAC in June 2025. The first drafts of the Annual Report and Accounts (ARA) for Westminster, Wales, Northern Ireland, and the Consolidated position were subsequently presented at the September 2025 meeting. Members did not raise any significant issues.

3.7 Due to a dependency with external pension assurances, the NAO completed its audit work in November 2025 and presented a draft Audit Completion Report (ACR) to ARAC at the November meeting. ARAC noted the updates to the ARA since its previous review and agreed that, once the ARA had been finalised and the audit concluded satisfactorily, I - as ARAC Chair - could provide the final recommendation to the CEO to sign the ARA outside of the committee meeting cycle.

3.8 Following the November ARAC meeting, the FSA and NAO continued to work closely together and agreed that all four sets of accounts would be submitted to the Comptroller and Auditor General (C&AG) for certification in early December. After receiving confirmation from the NAO that their audit work was complete and an updated ACR had been issued, I recommended to the Accounting Officer on 3 December 2025 that the ARAs be signed. The Accounting Officer approved and signed the accounts on 3 December 2025. The C&AG certified the accounts on 5 December 2025, issuing an unqualified audit opinion.

Internal and external assurance 2025/26

3.9 All final internal audit (IA) and regulatory audit (RA) reports issued during the year were shared with me. Other ARAC members receive copies of audit reports with a ‘limited’ or ‘unsatisfactory’ opinion (see annex D for audit assurance level definitions) and relevant Directors are invited to discuss such reports with ARAC.

3.10 Two audits completed during 2025/26 which resulted in a ‘limited’ opinion were discussed at ARAC during 2025/26 and another will be discussed during 2026/27 (all from RA). No audits had an ‘unsatisfactory’ opinion.

3.11 The executive summary of each report with a ‘substantial’ or ‘moderate’ opinion was shared with ARAC members as part of the respective progress reports on internal and regulatory audit activities presented to ARAC meetings. The Committee was updated regularly on actions taken by management teams to address the issues raised in all internal and regulatory audit reports.

3.12 A summary of assurance activities and outputs for 2025/26 is in the table below. The figures for 2024/25 are provided for comparison.

Internal audit reports

Assurance activities and outputs	Number of reports 2024/25	Number of reports 2025/26
Substantial	0	1
Moderate	2	7
Limited	2	0
Unsatisfactory	0	0
Advisory reports/management Letters	4	2
Total number of reports issued	8	10
Number of planned audits	9	10

Regulatory audit reports

Assurance activities and outputs	Number of reports 2024/25	Number of reports 2025/26
Substantial	0	0
Moderate	1	1
Limited	0	3
Unsatisfactory	0	0
Opinion Not applicable	0	0
Total number of reports issued	1	4
Number of Planned Audits	4	4

3.13 The Committee also received summaries of reports in relation to external audits and reviews conducted by third parties such as an in-country audit from USA reviewing the food safety system for meat products, an Investigatory Powers Commissioner’s Office inspection into the National Food Crime Unit (NFCU)’s acquisition of communication data under the Investigatory Powers Act 2016 and a review by HMRC looking at the current implementation of Microsoft Purview (data security) environment. Full reports of such reviews and audit reports are provided to ARAC members on request.

3.14 In respect of the FSA assurance map, at the November meeting the ARAC received an update on progress with pilot verification assessments, including findings from testing the quality and effectiveness of controls within Communications (as a functional standard) and our Food Hygiene Rating Scheme (bespoke FSA controls). Building on this, ARAC received the refreshed assurance map at their March meeting, reflecting an annual update of assurance activity, aligning with the Risk Control Framework set in the updated UK Government guidance for risk management, the ‘Orange Book’. The March paper also set out how insights from the assurance map and verification work will inform a targeted, risk-based schedule of future verification assessments, designed to complement existing assurance and avoid duplication with Internal Audit. ARAC were supportive of progress made with the assurance map and verification approach.

ARAC effectiveness

3.15 In July 2025 committee members and standing attendees completed our annual self-assessment on the effectiveness of the ARAC in line with HM Treasury guidance utilising the NAO self-assessment tool. We saw a small decrease in our scores from the previous year but were still either meeting or excelling against the required criteria. We identified some areas where we could improve such as range of skills, risk management, internal control, financial reporting, assurances and external audit. An action plan to improve these areas was developed and has been implemented. The emerging results from the July 2026 assessment indicate an increase in all the scores reflecting the impact of the actions including the training detailed below.

3.16 ARAC members continued to access a range of training opportunities during the year, especially those new to the Committee. I have continued the ‘information sessions’ after ARAC meetings to upskill the Committee in areas such as the work of the NFCU, regulatory audit, counter fraud and procurement. There have also been teach-ins on performance management and the risk assurance framework, budgeting and the annual accounts and risk assessment (as part of Market Authorisations).

3.17 In June 2025, members of the Committee held bilateral meetings with representatives of the FSA’s external auditors, the NAO, and the Head of Internal Audit. These meetings ensured that there is a clear understanding of expectations and mutual understanding of current issues. The Committee also concluded that there is a good working relationship between Finance, external auditors, and internal and regulatory audit.

Adequacy of risk management, control and governance arrangements

3.18 I am satisfied that sufficient and comprehensive work was undertaken by ARAC, and internal and external assurances were received during the year to adequately inform ARAC’s assessment on the effectiveness of FSA risk management, control and governance arrangements. Based on this, it is my view, as Chair of the Committee, that the arrangements in place during the year were satisfactory.

Future ARAC meetings

3.19 During 2025/26 ARAC meetings were held approximately two weeks before Board meetings to enable a written report of ARAC meetings to be presented at the Board meeting. It is expected that the Committee will continue with this approach and will meet four times in 2026/27 with no increase in resource requirements anticipated.

Annex A: role of the ARAC

1 The Committee’s prime purpose is to provide advice to the Board and the Accounting Officer on internal control, risk management and governance.

2 Internal and external auditors attend ARAC meetings. Others may be asked to attend where the Committee wishes to review progress on specific issues.

The role of the FSA Board

3 This annual report by the Chair of the ARAC provides the Board with an independent view of how assurance and risk matters are being handled within the FSA. The Board’s role is to note and comment on the activities of the ARAC.

The role of the Chief Executive

4 HM Treasury has appointed the Chief Executive as the Principal Accounting Officer of the FSA. The Chief Executive has a direct, personal responsibility to the Westminster Parliament for the propriety and regularity of FSA expenditure. The Chief Executive also signs the financial statements in respect of the monies from the Welsh Government and the NI Assembly.

5 The Chief Executive is required to sign the annual Governance Statement, which is published in the Annual Report and Accounts.

Annex B: membership of the FSA Audit and Risk Assurance Committee 2025/26

Members:

• Anthony Harbinson - Chair
• Timothy Riley - Member
• Margaret Gilmore - Member (to 17 November 2025)
• Mark Rolfe - Member (to 17 November 2025)
• Fiona Gately - Member (to 31 December 2025)
• Frank Atherton - Member (from 1 August 2025)
• Clare Evans - Member (from 1 August 2025)
• Susan Paterson - Member (from 1 August 2025)

Standing Attendees:

• Katie Pettifer - Chief Executive
• Ruth Nolan - Director of People and Resources (to 25 July 2025)
• Ian Gibson - Director of Corporate Services (from 13 October 2025)
• Ed Clift - Deputy Director of Finance, Planning and Commercial (to 1 March 2026)
• Steve Churchyard - Deputy Director of Finance, Planning and Commercial (from 2 March 2026)
• Catherine Andrews - Head of Internal Audit
• Michael Todd - Head of Planning, Performance and Risk
• James Robinson - General Counsel
• James Edmands - NAO
• Stuart Dawkins Costello - NAO

Annex C: Terms of Reference for the FSA Audit and Risk Assurance Committee

Purpose

The Audit and Risk Assurance Committee (ARAC) is an advisory Committee of the FSA Board with no executive powers. It is responsible for reviewing, in a non-executive capacity, the comprehensiveness and reliability of assurances on governance, risk management and the control environment.

The ARAC will approve the Annual Reports and Accounts (ARAs) on behalf of the FSA Board, with the recommendation that the Accounting Officer sign the accounts on approval. It shall additionally have responsibility for reviewing the integrity of financial statements.

Membership

A minimum of four Members of the FSA Board appointed by the FSA Chair under delegated powers following consultation with the Committee Chair. At least one of those appointed will be a Board Member for Wales or Northern Ireland. The Deputy Chair, Chair of the Business Committee, will attend ARAC to ensure effective communication and co-ordination between the committees.

The term of appointment will normally be coterminous with an individual’s term of appointment to the FSA Board and will automatically cease if an individual ceases to be a Board Member.

At least one of the Committee members should have recent and relevant financial experience.

All new members will be provided with induction training, and the FSA will provide for any additional development which is deemed necessary for the member to fulfil their role on the Committee. The Chair of the ARAC will hold an annual review with each member and any training or development needs will be taken forward with the agreement of the Chair and Accounting Officer.

Committee Chair 

Appointed from the membership of the Committee by the Chair of the FSA under delegated powers. The term of appointment will normally be coterminous with an individual’s term of appointment to the FSA Board.

Co-option

The Committee may co-opt additional members (whether members of the FSA Board or not) for a period of up to one year to provide specialist skills, knowledge or experience. Co-opted members will have a right to speak, but not vote. Co-opted members will not be included in any calculation of the quorum.

Quorum

Three Non-Executive Board Members.

Attendance 

The Chief Executive, as Accounting Officer, the Director of Corporate Services, the Deputy Director of Finance and Planning, the Head of Planning and Performance, the Head of Internal Audit, the Head of Delivery Assurance, General Counsel and a representative of the external auditors would normally be invited to attend. Directors and other officials will be invited to attend as required.

Reporting 

The ARAC Chair will provide the Chair of the FSA and the Board with a written update on the key elements of Committee meetings. The ARAC will report formally in writing to the Board, annually, to support the finalisation of the accounts and the Governance Statement and to update the Board on the work of the Committee, internal and external audit and any areas requiring specific attention.

Meetings

The ARAC will meet at least four times a year. The Chair of the Committee will convene additional meetings as necessary. The Committee has the right to sit privately without any non-members present for all or part of a meeting.

Additionally, the members of the Committee will meet with the Head of Internal Audit and, separately, the External Auditors, annually, in closed meetings when the efficacy of the processes, trust, co-operation and any other issues can be discussed, and future action agreed.

The FSA Chair, the Board or the Accounting Officer may ask the ARAC to convene further meetings to discuss specific issues on which they want the Committee’s advice.

Responsibilities

The ARAC will advise the FSA Board and Chief Executive on:

1. The strategic processes for risk management, the high-level control and governance framework and the effectiveness of its operation in practice.
2. The contents of the Governance Statement.
3. The accounting policies, the accounts, and the annual report of the FSA, including the judgements used in producing the accounts, the adequacy of disclosures, the process for review of the accounts prior to submission for audit, levels of error identified, and management’s letter of representation to the external auditors.
4. The effectiveness of the design and operation of financial systems and controls.
5. The planned activity and results of internal, regulatory and external audit and the results of other, external assurance reports.
6. The resourcing and effectiveness of the internal audit function.
7. Provide independent scrutiny of the audit process of the regulatory audit system.
8. The adequacy of the management response to issues identified by audit activity, including external audit management letters.
9. Assurances relating to the corporate governance requirements for the organisation.
10. Proposals for tendering for either internal or external audit services or for the purchase of non-audit services from contractors who provide audit services.
11. Counter-fraud and internal whistle-blowing policies and processes, and arrangements for special investigations.
12. The Committee’s effectiveness having reviewed its own performance, constitution and terms of reference and recommending any changes it considers necessary.

Information Requirements

The ARAC will be provided with, where appropriate:

1. Any changes to the organisation’s Corporate Risk Register that are relevant to the responsibilities of the Committee.
2. The risk management strategy.
3. Management assurance reports, and reports on the management of major incidents (which are relevant to governance, risk management and internal control) ‘near misses’ and lessons learned including those from serious case reviews.
4. A bi-annual overview of external complaints and related data.
5. An annual report of FSA’s Senior Civil Servant’s declarations of interest.
6. An annual report on and the performance of the FSA’s arrangements for counter fraud, bribery and corruption.
7. An annual overview of the Business Appointment Rules.
8. Information Security annual report and periodic updates.
9. Environmental, climate change and net zero annual update.
10. Periodic updates summarising significant Projects and Programmes.
11. Periodic updates on the procurement pipeline and commercial activity.
12. A bi-annual overview of current litigation and associated risks.
13. Progress reports from both the Head of Internal Audit and Head of Delivery Assurance summarising: work performed (and a comparison with work planned); key issues emerging from their respective audit work; management action in response to issues identified and agreed; changes to their respective audit plans; any resourcing issues affecting the delivery of their objectives.
14. Progress reports from the External Audit representatives summarising work done and emerging findings.
15. External assurance and compliance reports in relation to the FSA’s activities.
16. Internal audit and regulatory audit strategies and annual plans.
17. The Head of Internal Audit’s Annual Opinion and Report.
18. Quality Assurance reports on the internal audit and regulatory audit functions.
19. An annual overview of the FSA’s assurance map.
20. The draft accounts of the organisation.
21. The draft Governance Statement.
22. Any changes to accounting policies.
23. Proposals to tender for audit functions.
24. Summary of findings of every internal audit and regulatory audit report.
25. External Audit’s management letter.
26. A report on cooperation between the FSA auditors and external auditors.

The ARAC will work with the FSA’s Executive Management Team to ensure that the Board can be confident that risk management processes, content, mitigating and recovery actions are appropriate and correctly resourced.

Notes

1. The Chair of the ARAC will have free and confidential access to the Chair and Chief Executive of the FSA whenever appropriate.

2. The Head of Internal Audit and the representatives of External Audit will have free and confidential access to the Chair of the Committee.

3. The Committee may procure specialist ad-hoc advice at the expense of the FSA, subject to the cost being agreed by the Chief Executive as Accounting Officer.

(Agreed by the Board December 2025).  

Annex D: assurance level definitions as applied to FSA assurance audit reports (excluding LA audit reports)

Assurance levels assigned to assurance audits as defined in the Government Internal Audit Manual:

Audit Opinion	Definition
Substantial	In my opinion, the framework of governance, risk management and control is adequate and effective. Green
Moderate	In my opinion, some improvements are required to enhance the adequacy and effectiveness of the framework of governance, risk management and control. Yellow
Limited	In my opinion, there are significant weaknesses in the framework of governance, risk management and control such that it could be or could become inadequate and ineffective. Amber
Unsatisfactory	In my opinion, there are fundamental weaknesses in the framework of governance, risk management and control such that it is inadequate and ineffective or is likely to fail. Red