Corporate report

Minutes of the Audit Risk Assurance Committee: 19 June 2025

Updated 1 October 2025

Applies to England

Present

Martin Spencer, Chair

Laura Wyld, Board member

Jo Moran, Board member

Ian Looker, Co-opted member 

Jon Yates, Board member 

Also in attendance

Martyn Oliver, His Majesty’s Chief Inspector (HMCI)

Matthew Coffey, Deputy His Majesty’s Chief Inspector

Louise Grainger, Chief Financial Officer

Principal Private Secretary to HMCI and Head of Private Office

Head of Corporate Governance

Corporate Governance Officer

Financial Controller

Khadija Qidwai, National Audit Office (NAO)

Adeel Shameem, EY

Hassan Rohimun, EY

Tony Smith, Government Internal Audit Agency (GIAA)

Curtis Yapp, GIAA

Phil Byrne, GIAA (item 6)

Neil Greenwood, National Director, Digital and Operations (item 6)

Mike Farrington, Deputy Director, Technology (items 6 and 14)

Rory Gribbell, Director, Strategy and Engagement (items 10 and 11)

Head of Strategy Delivery, Strategic Priorities, Risks and Compliance Lead (item 13)

Head of Security and Information Management (item 14)

Status

Approved at the Audit and Risk Assurance Committee (ARAC) meeting on 24 September.

1. Chair’s introduction, declarations of interest, minutes, actions and matters arising 

The minutes of the last meeting were approved as a correct record.

All actions from last meeting were closed.

2. Verbal report from HMCI 

HMCI updated the committee on the Spending Review 2025 settlement. The committee agreed that the outcome was excellent and reflected the government’s confidence in Ofsted’s work.

The committee discussed the delay to the inspection improvement consultation response as agreed with the Department for Education, and the revised publication date of early September. The committee agreed that whilst the delay is regrettable, it will result in a better and more effective inspection regime. The committee noted that the delay will not impact the timeline for delivery of the revised inspection frameworks in November.

3. Progress against audit recommendations 

The committee noted that 9 actions have been completed since the last report to ARAC, 5 actions are on track to meet the original target completion date​ and 2 actions are on track to meet the revised target completion date. One action related to the payroll audit (2024-25) is reported as missed against the revised target date of May. The committee queried this delay and were assured that the issue will be fully resolved by July.

4. Draft Internal Audit Charter 2025-26

The committee approved the Internal Audit Charter 2025-26.

5. Internal audit progress report 

The committee noted that the 2024-25 internal audit plan has now been delivered in full.

ARAC noted that a planned audit of the Big Listen Action Monitoring report has been postponed to November. The committee noted that challenge sessions are planned with the Board Chair to scrutinise delivery of actions committed to in the Big Listen, and that this will provide assurance to the board intervening period.

6. Issued internal audit reports

The final 2 reports in the audit plan 2024-25 have been completed since last meeting: Cyber incidents response plan and Control of Ofsted policies.

The committee discussed the Control of Ofsted policies audit report, which had a ‘limited’ opinion. The committee noted that this audit had been conducted at the specific request of HMCI and that all the recommendations had been accepted.

The committee discussed the Cyber Incidents Response and Information Security report, which had a ‘limited’ opinion. The committee noted that whilst Ofsted’s cyber security and incident preparedness arrangements were effective, some weaknesses in information assurance had been identified. The committee discussed actions in progress to improve information assurance controls.

7. Head of Internal Audit annual opinion and report 2024-25: for discussion

The committee noted that for the period 2024-25 the Head of Internal Audit gave a ‘moderate’ opinion, stating that overall Ofsted’s framework of governance, risk management and control was largely adequate and effective.

This was the same opinion as the previous year, but set in the context of Ofsted’s progress in delivering against the actions arising from the Big Listen and the independent learning review, reported via the Big Listen Action Monitoring Report, as well as other developments during 2024-25, including the introduction of changes to strategic risk management and governance.

Overall, GIAA issued 5 ‘substantial’, 2 ‘moderate’ and 2 ‘limited’ reports, and considered that there is an improving direction of travel in relation to Ofsted’s framework of governance, risk management and control.

The committee discussed the Head of Internal Audit’s findings in depth.

8. External audit completion report

The committee discussed the draft NAO Audit Completion Report.

The committee noted that EY and the NAO colleagues anticipate recommending to the Comptroller and Auditor General (C&AG) that he should certify the 2024-25 financial statements with an unqualified audit opinion without modification in respect of both regularity and the true and fair view on the financial statements.

9. Value for money and insight work: to note

The committee noted the recent and upcoming NAO value for money and insight publications.

10. Finance report

The committee noted Ofsted’s financial position as of the end of period 1.

The committee discussed ongoing work to keep pace with the increase in children’s homes applications. The committee sought further assurance on this and agreed to monitor this through their scrutiny of the strategic risk register.

The committee discussed the recent outcome of the Spending Review 2025 in depth and noted that the settlement would enable for longer term financial planning and would support delivery of key strategic priorities.

11. Draft Annual Report of the Audit and Risk Assurance Committee

The committee approved the report, which accounts for ARAC’s activity in the year 2024-25 as per ARAC’s Terms of Reference and the Corporate Governance Framework. The committee noted that the report would proceed to the board for approval at the June meeting.

12. Annual Report and Accounts 2024-25

The committee reviewed the draft Annual Report and Accounts and agreed to advise the board to recommend that HMCI approve the report.

13. Strategic risk

The committee discussed the strategic risk register and approved the current position of the risks and risk tolerance. The committee discussed the process for escalating risks with no path to tolerance to the board in future.

14. Annual information assurance and cyber security report

The committee noted the report. The committee gave their support for the Cyber Security Strategy, the intention to align with a recognised cyber security framework to improve Ofsted’s security posture. The committee supported the priorities for the next 12 months.

15. Departmental Security Health Check update and Quality Assurance Test

The committee noted the outcome of the Quality Assurance Test which assessed Ofsted’s compliance with physical standards.

The committee noted the planned actions to address the recommendations, and steps taken to ensure future self-assessments are robust and provide assurance to HMCI on the physical security measures in place.

16. AOB

There was no other business.