Transparency data

RSH ARAC minutes - 15 January 2024 (accessible version)

Published 10 May 2024

Applies to England

Public minutes of of the Audit and Risk Assurance Committee meeting

on Monday 15 January 2024 at 10.00am
PG53 and MSTeams

Members

• Liz Butler - Chair
• Richard Hughes
• Kalpesh Brahmbhatt (Via MS Teams)

In attendance

• Fiona MacGregor - Chief Executive
• Jonathan Walters - Deputy Chief Executive and Accounting Officer
• Richard Peden - Director, Finance and Corporate Services
• Emma Tarran - Senior Assistant Director Head of Legal and Company Secretary
• James Dunbar - Head of Finance (for item 6)
• Mike Newbury - Audit Director NAO (via MS Teams)
• Richard Smith - Engagement Manager NAO
• Lisa Harvey - Head of Internal Audit, Government Internal Audit Agency
• Jenny Obee - Engagement Lead, Government Internal Audit Agency
• Kashif Zaman - Department of Levelling up, Housing and Communities (via MS Teams)

Minutes

• Christine Kitchen - Committee Secretary

1. Welcome and apologies

01/01/24 The Chair welcomed everyone to the meeting. There were no apologies.

2. Declarations of Interest

02/01/24 There were no new declarations of interest.

3. Minutes of the last meeting

03/01/24 The minutes from 27 November 2023 were approved.

4. Matters Arising

04/01/24 The actions were noted. The NAO confirmed that a lessons learned will be scheduled as part of the 2023-24 planning. IA confirmed that they have been attending risk meetings with risk owners and RBP confirmed that the Strategic Risk Register will be reviewed after April which will also give new Board members an opportunity to be involved in the discussion on risk.

5. NAO Completion Report

05/01/24 MN introduced the completion report for 2022-23. The report is based on the agreed audit plan. MN had spoken with the Chair to discuss the delay to the audit and the report, which had been as a result of resource issues at the NAO. He confirmed that planning for the 2023-24 interim audit has started to avoid a repeat of delays to the 2023-23 audit. He confirmed that the completion report was noting an unqualified audit with no high risk areas and reflects a business that is on top of all its activities and financial reporting. MN thanked RBP, JD and the finance team for their help and co-operation.

06/01/24 RS advised that the contents of the report had been discussed at the November meeting of ARAC and confirmed that the assurance on the pensions had now been received from Grant Thornton. He said that the LGPS pension asset description in the completion report was a LGPS level adjustment in their accounts and is not a concern for the RSH figures. It is based on how the validation is done so does not need to be adjusted in the RSH accounts and in any case is below materiality levels.

08/01/24 Letter of representation: RBP advised that the figures of the unadjusted errors are provided to us by the NAO and is explained in the letter of representation.

6. Annual Report and Accounts 2022-23

09/01/24 The members had reviewed the ARA. The Governance Structure section in the ARA about the ARAC refers to the self-assessment effectiveness reviews carried out and it was suggested that reference should be made to the externally facilitated board effectiveness review carried out by GGI, which had included the ARAC. There were no other issues, and it was agreed that ARAC will recommend the approval of the Annual Report and Accounts to the AO for sign-off.

10/01/24 The Chair thanked the auditors and RBP and the RSH finance teams for all their hard work.

7. Internal Audit Progress report

11/01/24 LH and JO presented the January 2024 Progress Report which included:

• Overview of progress against the 2023-24 plan in the period, including agreed changes to the plan.
• Overview of the outcomes of key engagements since the last ARAC meeting.
• Proposed audit areas for the 2024-25 Internal Audit Plan. The final Plan will be presented at the April 2024 ARAC meeting.

12/01/24 2023-24 plan:

Consumer Regulations Pilots Lessons Learned: the audit was completed as planned in Quarter 3. The audit was given a Substantial rating and JO confirmed that the purpose and approach of the pilots was clearly articulated, appropriate evaluation criteria were identified and there was a robust process for gathering feedback from staff and providers on the outcome of the pilots. The pilots provided the RSH with valuable learning which has been incorporated into subsequent waves of pilots and has informed thinking about the implementation of the new approach to consumer regulation in April 2024. JO confirmed that the pilots have shown that the Regulator’s approach is workable and able to provide the level of assurance it requires to issue regulatory judgements on the Consumer Standards. GIAA were assured that staff had received very good training and guidance during the pilots, and that there was a good level of communication across the organisation to raise awareness around the new approach to regulating consumer standards. There had been good levels of engagement with providers during the pilots and after the completion of the assessment in the feedback sessions and will be used the feedback to inform the inspections from April.

13/01/24 The Chair thanked JO and asked if GIAA had sought feedback from providers and it was confirmed that LAs are giving their feedback to senior RSH staff which was the preferred option and has been well received. The Chair issued caution that providers might err on the side of giving favourable feedback this early in the process.

14/01/24 QA Consistency on ‘For Profits’ Judgements: terms of reference were issued as planned in Quarter 3, but it was agreed with management that the fieldwork will now be carried out in Quarter 4 due to resource constraints at GIAA and will report to the April ARAC. Fieldwork for this audit has started.

15/01/24 New Data Capture System: The Regulator has requested that the planned audit be deferred from Quarter 4 to 2024-25 due to resource constraints. Management had reported that no issues arose during the implementation of the new system and so it considered the risks related to this have reduced. GIAA are content to defer the audit and reconsider it for the 2024-25 Plan, based on their assessment of risk.

16/01/24 Changes to the 2023-24 plan were discussed: Members noted that management had requested a replacement audit for Quarter 4, of the Fees Setting Model as we will be charging fees to Local Authority Registered Providers for the first time from July 2024, and would like independent assurance that the proposed model is equitable between categories of registered providers. GIAA confirmed their acceptance of this change to the 2023-24 Plan. The Terms of Reference for the audit are with management for agreement, and the report will be submitted to the April ARAC meeting. Action: GIAA

17/01/24 Capacity and Capability: three recommendations were made in relation to this audit - two medium and one low, these are not yet due.

IT Controls audit: as previously reported, management had agreed to extend the due date for one low recommendation until a new Assistant Director of Digital was in post. This new Assistant Director has now joined the RSH, so an update will be provided on this audit. No new recommendations have been raised since the previous ARAC.

18/01/24 Members NOTED the changes to the 2023-24 Plan, the delivery progress against the 2023-24 plan and the audit recommendations.

2024–25 audit plan

19/01/24 Members noted the proposed 2024-25 audit plan.

20/01/24 GIAA also mentioned other potential areas of audit to be discussed for 2025-26. LH confirmed that GIAA have the resources and will be able to flex in the planning for the audits and RBP added that should we wish to have more than the usual five audits, there will be a review of the fees.

21/01/24 LH mentioned the Memorandum of Understanding that had been included in the pack and it was agreed that this will be reviewed by the regulator along with the fee letter and signed. The Chair thanked LH and JO for their reports and discussion.

8. Strategic Risk Register

22/01/24 RBP introduced the paper as an update. The SRR is regularly reviewed by risk owners in meetings facilitated by corporate services. The report has highlighted the updates to the register, and committee noted:

• Single uncontrolled provider failure - we have a high level of assurance over the viability of providers from the recent round of stability checks. Asset management outliers work and rent outlier work show no significant cause for concern. Recruitment is progressing well, and two controls relating to capacity and capability on this risk have increased from moderate to high, and from low to moderate effectiveness since the last quarter. We recommend lowering the controlled likelihood score from 2 to 1, bringing the risk to appetite.

• Implementation of proactive consumer regulation - the Consumer Standards consultation is complete, the new regulatory engagement directorate has been launched, recruitment is progressing and training, onboarding and induction is underway. Staff engagement has been carried out and will continue into quarter four. An internal review of the pilots has returned an opinion of substantial assurance with no actions required. We recommend lowering the controlled likelihood score from 3 to 2 to reflect where we are in relation to the implementation of proactive consumer regulation. The score will remain above appetite.

• Capacity and capability We recommend continuing to tolerate our current controlled risk score until the Transformation 2024 programme is complete.

• Security - this is a developing area of risk focus for the regulator, due in part to our planned transfer of digital services from Homes England in 2023/24. The Chair asked about the increased risk of cyber-attacks on organisations and RBP confirmed that as we are currently still part of the HE IT structure we are dependent on their systems. However, we can take assurance that their security systems have been re-accredited, and we hope to shortly move to the IT infrastructure of DLUHC. It was confirmed that under either structure, if there was an attack and the systems went down, we would also be impacted. We would have to find workarounds for things like pay role for staff, but our regulatory work could continue with workarounds. Currently we do have a system in place to message staff in the event of an incident which is working well. The Chair noted that this risk was above appetite and suggested a further discussion to discuss tolerance would be helpful. JW confirmed that we could include this and other areas which might be out of our control when we review the risk register and appetite and tolerance. We recommend therefore that the score remains unchanged; above appetite.

23/01/24 There was a query on operational risk 6 - failure to implement proactive consumer regulation and RBP gave assurance that the work is going well and so there is a decreasing risk, hence the recommendation that we continuing to tolerate our current controlled risk score until the Transformation 2024 programme is complete.

24/01/24 The Chair on behalf of the committee thanked the team for the report.

9. In-depth assurance planning – Fee charging

25/01/24 RBP presented the paper as there has been discussion at Board on fee setting and cross-subsidy charging. This paper will feed into the GIAA internal audit and builds on what we have done in the past when we allocated costs between those that were chargeable to fees and those that were chargeable to grant in aid. The majority of our costs relate to staff and the paper sets out our approach which has been modified to deal with the allocation between PRPs and LAs, but the underlying mechanics remain unchanged. The paper set out the proposed changes to the fee principles and identified the key points relevant to cost allocation and fee recovery and the process is considered to be clean and straightforward and we will be able to clearly show the costs allocated to LAs and PRPs. RBP confirmed that FRAP will discuss these proposals which will hopefully remove any doubts in the sector on fee allocation. The decision to not use time recording was endorsed by members and MN advised that CQC have carried out a similar exercise to consider calculations and RBP agreed to have a discussion with MN on this. The Chair suggested that we have a prepared summary to show the share of costs and RBP confirmed the figures will be available should they be requested.

26/01/24 Members thanked RBP for a very informative and well presented paper and suggested it should be sent to members of the Board for information. Action: CK

10. Forward Planner

27/01/24 noted.

11. Any other business

28/01/24 There were no other matters of business.

Date of next meeting: to be confirmed