Effective Audit and Risk Assurance Committees

Foreword

An Audit and Risk Assurance Committee (ARAC) has a vital role in helping public sector organisations ensure that Accounting Officers and Boards gain the assurance they need on:

• governance;
• risk management;
• the control environment;
• the integrity of the financial statements; and
• other elements of the Annual Report and Accounts.

The ARAC provides an important governance function, helping to ensure that an organisation has good corporate governance and that it is effective and well managed.

ARAC plays a crucial role in supporting the Board in meeting its obligations for setting an organisation’s risk appetite and ensuring that the framework of governance, risk management and controls is in place. This is highlighted in HM Treasury’s Corporate governance in central government departments: code of good practice guidance (April 2017).

ARAC’s role is a demanding one and requires strong and independent members with an appropriate range of skills and experience. It benefits from a collaborative relationship with the organisation to ensure that the committee gets the support and information that it needs.

An ARAC is essentially an oversight committee, however it has to satisfy itself that key controls are operating, that risks are being properly managed, that key accounting estimates and judgements are being properly made and that internal and external audits are effective.

ARAC should act as the conscience of the organisation, providing insight and constructive challenge where required, such as on risks arising from fiscal and resource constraints, new service delivery models, information flows on risk and control, and the agility of the organisation to respond to existing and emerging risks.

In the course of our work, the Northern Ireland Audit Office has worked closely with ARACs across the public sector, and this good practice guide draws on insights and learnings from NIAO’s attendance at many ARAC meetings. It examines the role of ARACs in local government in Northern Ireland in accordance with CIPFA’s Position Statement (2022) and how the principles apply to local government bodies in Northern Ireland.

I hope that ARAC Members, and the organisations they support, find this guide a useful tool in their continued efforts to ensure the highest standards in the delivery of public services in Northern Ireland.

Dorinnia Carville

Comptroller and Auditor General

March 2025

List of abbreviations

AI Artificial Intelligence

ALB Arm’s Length Body

ARAC Audit and Risk Assurance Committee

CIPFA Chartered Institute of Public Finance and Accountancy

DAO Dear Accounting Officer

DoF Department of Finance

ESG Environmental, Social and Governance

FRC Financial Reporting Council

GDPR General Data Protection Regulation

HMT His Majesty’s Treasury

ISA International Standard on Auditing

MoR Memorandum of Reply

NAO National Audit Office

NEBM Non-Executive Board Member (A member of ARAC who is not part of the organisation’s senior executive team)

NIAO Northern Ireland Audit Office

NICS HR Northern Ireland Civil Service Human Resources

RTTCWG Report to those charged with governance

SIRO Senior Information Risk Owner

ToR Terms of Reference

Introduction

1. An organisation’s Board is responsible for ensuring that there are effective arrangements for governance, risk management and internal control. The Board, however, should be supported by:

• an Audit and Risk Assurance Committee chaired by a suitably experienced non-executive Board member (NEBM); and
• an Internal Audit service operating to the professional standards mandated for Internal Audit in the public sector.

2. The Department of Finance’s ARAC Handbook (April 2018) states that an ARAC should:

• be made up of at least three members;
• support the Board in its role on advising the organisation on key risks;
• not have any executive responsibilities or be charged with making or endorsing any decisions;
• have adequate support, including a secretariat function;
• lead the assessment of the annual Governance Statement for the Board; and
• make publicly available its Terms of Reference (ToR).

3. The Northern Ireland Audit Office (NIAO) has a unique oversight role over a wide and diverse range of central government, arms-length and local government bodies. This good practice guide:

• supplements the large amount of relevant guidance already available from the Department of Finance (DoF), HM Treasury (HMT) and the National Audit Office (NAO) and is intended to bring all this guidance into one document to be used by all ARACs within both Central and Local Government in Northern Ireland;
• is intended to be used by ARAC members, secretariats and executive officers;
• provides examples of good practice from our own work with organisations in this area; and
• is written to promote good practice at ARACs.

4. HM Treasury’s latest guidance on Audit and Risk Assurance Committees (July 2024) sets out the following five good practice principles for ARACs, stating that each principle is of equal importance:

• Principle 1: Membership, independence, objectivity and understanding
• Principle 2: Skills
• Principle 3: The role of the ARAC
• Principle 4: Scope of work
• Principle 5: Communication and reporting

5. This guide has been split into seven core sections. The first five sections reflect the good practice principles set out in the HM Treasury’s guide. Section 6 provides details on how a high-performing ARAC can continually improve as the challenges and requirements facing it evolve. Section 7 provides guidance specific to local councils in Northern Ireland.

Membership, independence, objectivity and understanding

6. ARAC should be independent and objective; in addition, the Chairperson and at least one other member should be a non-executive, who should have a good understanding of the objectives and priorities of the organisation and of their role as an ARAC member.

Skills and experience

7. ARAC should collectively own an appropriate skill mix to allow it to carry out its overall function and duties.

Roles and responsibilities

8. ARAC should support the Accounting Officer and Board by reviewing the comprehensiveness and reliability of assurances on governance, risk management, the control environment and the integrity of financial statements and the annual report.

Scope

9. The scope of ARAC work should be defined in its terms of reference and encompass all the assurance needs of the Accounting Officer and Board. Within this, ARAC should have particular engagement with the work of Internal Audit, risk management, External Audit, counter fraud and financial management and reporting issues.

Communication and reporting

10. ARAC should ensure that it has effective communication with all key stakeholders, for example, the Board, the Head of Internal Audit, the External Auditor, Executives of the organisation including the risk manager and other relevant assurance providers, such as the counter fraud manager.

Continuous Improvement

11. As the challenges and requirements of ARACs evolve, a high-performing ARAC will strive for continuous improvement. It is important that ARACs adopt a positive attitude to learning and development, regularly appraises its performance and is open to feedback from others.

Council Specific

12. ARACs of local councils within Northern Ireland differ somewhat to central government ARACs. Section 7 seeks to provide guidance specific to local councils.

13. Included in this guide are four appendices designed to assist ARACs in their role and to help promote and maintain good practice.

Appendix 1 - Audit and Risk Assurance Committee Self-Assessment Checklist

14. This self-assessment checklist allows for ARACs to review their overall effectiveness. It is recommended that ARACs should aim to assess their effectiveness against this checklist on an annual basis.

Appendix 2 - Example of Annual ARAC core work programme (for bodies with a March year-end)

15. This example of an annual ARAC core work programme gives suggested agenda items to present at the Audit and Risk Assurance Committee meetings.

Appendix 3 - Example of ARAC Annual Report Structure

16. Part of good practice for ARAC is producing an Annual Report to the Board highlighting the activities of ARAC for the year. Included in this guide is a template for the ARAC’s Annual Report to the Board. This template includes key areas and should be tailored to each organisation.

Appendix 4 – The role of the Chair of the Audit and Risk Assurance Committee

17. Appendix 4 provides details on a number of additional responsibilities for the Chair of ARACs.

Part One: Membership, Independence, Objectivity and Understanding

1.1 To properly fulfil its role, an effective ARAC needs to be both independent and objective:

• It should comprise at least three members.
• The Chairperson should be a Non-Executive Board Member (NEBM) with relevant experience.
• The Chairperson of the Board should not be a member of ARAC.
• There should be at least one other NEBM on ARAC.
• There should be no Senior Executive appointments to ARAC (a Senior Executive has a managing role within the organisation).
• ARAC should possess the requisite knowledge and skills to effectively engage with and challenge the organisation.
• ARAC should seek additional independent, non-executive membership to ensure an appropriate level of skills and experience, as and when required.

1.2 Whilst Executive Members of the organisation should not be appointed to ARAC, it is important for the management of ARAC business that there must be regular attendance and appropriate input from all attendees including:

• the Accounting Officer;
• the Finance Director;
• the Head of Internal Audit; and
• a representative of the External Auditor, who should routinely attend and be available to meet privately with the Committee members outside of the meeting.

1.3 It is also good practice for the Chair of ARAC to have regular meetings with the Accounting Officer and Finance Director. The Chair should also meet with the Head of Internal Audit and the External Auditor’s senior representative separate from executive members to discuss any significant issues.

1.4 In order for members to have a clear understanding of their role, all ARAC members should be provided with up-to-date ToR which incorporate:

• what is expected of them in their role, including time commitments;
• how they will be appraised;
• the duration of their appointment; and
• training required and how this will be provided.

1.5 The efficient management of ARAC business is essential. The regularity, timing and duration of meetings is therefore critical to ARAC being able to exercise its responsibilities effectively throughout the year. Strong agenda planning and management by the Chair is vital to ensuring ARAC devotes the right amount of time to issues competing for priority. A full committee cycle agenda is necessary to ensure all items are covered that are applicable throughout the financial year, including separate audit and risk requirements, especially when the committee is interacting with the Board on risk issues. Where necessary, ARAC members may wish to invite key individuals from the organisation to ARAC meetings to discuss specific issues/projects.

1.6 ARAC members must take personal responsibility for ensuring that possible conflicts of interest are properly declared. If a conflict of interest declaration is made by any ARAC member (including the Chair), the ARAC should then consider the nature of the conflict of interest before determining the course of action. This could include asking the member to leave while a particular item is being discussed or suggesting that the member should stand down where a conflict of interest is likely to exist for a long period.

1.7 We regularly observe public servants from an organisation who, because of their particular skill set, are appointed to sit on other ARACs within the public sector. It is important that these appointments are truly independent and free from any conflict of interest, and that they are able to contribute independently and objectively to each of the meetings.

1.8 Section 6.01 of the Northern Ireland Civil Service Handbook provides guidance on conflicts of interest and outlines that if a civil servant wishes to undertake any private work (paid or unpaid) with another public sector body (including another Government Department) approval must first be obtained from NICS HR Employee Relations, outlining if this work is paid or unpaid. Civil Servants may choose to apply for unpaid leave or use a portion of personal leave allowance to allow them to undertake paid work in another public sector post.

What does good practice look like?

• An ARAC needs to have a good understanding of the objectives and priorities of the organisation.
• There should be clear up-to-date Terms of Reference.
• An ARAC needs to be independent.
• An ARAC needs to have the requisite breadth of skills and experience.
• An ARAC needs to have sufficient time and access to all relevant information to allow it to perform its functions effectively and efficiently.
• An ARAC needs to have regular attendance and appropriate input from all attendees.
• The Chair should have regular meetings with the Accounting Officer and the Finance Director to discuss any significant issues.
• The Chair should have regular meetings with the Head of Internal Audit and the External Auditor separate from executive officers to discuss any significant issues.
• An ARAC needs to have strong agenda planning and management with strong secretariat support.
• All potential conflicts of interest need to be declared.
• ARAC members meet privately prior to ARAC meetings to discuss the papers and any issues that they feel need further discussion or more information on.

Our Observations

We have observed ARACs that have organised private meetings with Internal Audit and External Audit. Typically, these meetings are scheduled prior to the ARAC meeting. These pre-meetings give ARAC members the opportunity to ask questions of Internal and External Auditors and for both bodies to provide feedback to ARAC on any issues arising out of their work. These meetings are typically held at least twice per year, although we have seen instances where these meetings happen before every ARAC meeting.

Part Two: Skills and Experience

2.1 ARAC members require a wide range of skills and experience in relation to governance, risk and control. Members need to be mindful of when they need to upskill, build expertise and draw on specialist skills from elsewhere.

2.2 At least one member of ARAC should have recent and relevant financial experience sufficient to allow them to competently analyse the financial statements and recognise good financial management disciplines. The Accounting Officer and Board, in conjunction with the Chair of ARAC, should periodically review and agree on any additional skills that ARAC may require to maintain its effectiveness.

2.3 Where necessary, ARAC should have the authority to co-opt members or procure specialist advice to provide required skills, knowledge and experience to properly fulfil its role. It is important to ensure that any co-opted members are free from any conflicts of interest.

2.4 All ARAC members, whatever their status or background, will have training and development needs, especially for recent developments or emerging risk areas. Those who have recently joined ARAC will need induction training, to help them understand their role and/or the organisation. Those joining a public sector ARAC for the first time with no experience of government will need training to help them understand the public sector accountability framework, especially those elements relating to governance and accountability.

2.5 The Chair should, in addition, ensure that all committee members have an appropriate programme of engagement with the organisation and its activities to help them understand the organisation, its objectives, business needs, priorities and risk profile. The Department of Finance’s ARAC Handbook (April 2018) provides further guidance on the role of the Chair (included at Appendix 4).

2.6 An effective Chair should display the following characteristics:

• an ability to plan the work of ARAC over the year and beyond;
• skills to manage meetings;
• an ability to bring an objective attitude;
• a core knowledge and skills required of other ARAC members; and
• a clear focus on the role of ARAC and the ambition to lead ARAC in line with good governance principles.

What does good practice look like?

• ARAC as a whole should have an appropriate mix of skills that enables it to provide assurance to the Accounting Officer and Board.
• ARAC members should have a timely induction programme which outlines the requirements of the role, the organisation and, for those new to government, an understanding of public sector governance principles and processes.
• Training and development should be flexible, timely and tailored to individual member’s needs.
• Skills and experience should be tailored to the challenges and objectives of the organisation.
• The skills mix should be regularly reviewed to ensure ARAC is equipped to discharge its responsibilities to the Accounting Officer and Board.
• ARAC members should be made aware of any relevant training opportunities and encouraged to attend where necessary.
• ARAC members should engage with the organisation to understand its objectives, business needs, priorities and risk profile.

Other skills

2.7 ARACs should additionally consider whether they have the skills and capabilities to challenge organisations across a number of existing and emerging risk areas, some of which are outlined in this section. Areas requiring skills and expertise develop over time and differ from organisation to organisation. Skills requirements and gaps should be continually monitored. Examples of skills requirements we have seen in relation to existing and emerging risks in recent years include:

• Cyber and digital
• Information Security
• Climate Change and Environmental, Social and Governance (ESG)
• Artificial Intelligence
• Projects and Programmes
• Procurement

Cyber and digital

2.8 Cyber security is a key area of management activity that ARACs should review on a regular basis. In such circumstances, ARAC should support the Accounting Officer and Board in reviewing and mitigating cyber and digital risks. ARAC should be confident in its ability to challenge management’s assessment of cyber and digital risk – and know when and how to draw upon expertise as and when required. ARACs should be able to understand whether the organisation is adopting a clear approach to cyber risk.

2.9 The assurance provided by ARACs to the Board that the organisation is properly managing its cyber risk does not necessitate understanding the full detail of the technology involved; rather that it can confirm that the appropriate framework is in place and that continuous monitoring and improvement initiatives are adopted and sustained.

2.10 In particular, to assess the organisation’s cyber resilience, ARAC should evaluate whether the organisation has reviewed its cyber risk in relation to:

• governance, including management of system access;
• threat to protecting critical infrastructure;
• the identification and deployment of skills and capability in this area;
• training available for all staff to ensure appropriate levels of compliance;
• structure and resources;
• incident response; and
• the impact of any governance failings publicly reported elsewhere.

2.11ARAC could consider using the organisation’s Senior Information Risk Owner (SIRO) to provide assurance over these and other issues through regular briefs, including an annual report at year end.

What does good practice look like?

• The ARAC should regularly be provided with a paper setting out an evaluation of the organisation’s response to cyber security which confirms that:
  • the organisation has properly identified and evaluated the cyber security risk;
  • there is sufficient assurance that the organisation is properly managing its cyber risk;
  • there are proper governance arrangements and controls to protect from, detect and respond to cyber security attacks/incidents;
  • the organisation has suitably skilled and experienced staff, or access to such staff, to deal with any cyber security related incidents; and
  • there is suitable awareness and ongoing training within the organisation on the risk from cyber-attack.
• The ARAC should understand how cyber and digital risks impact on the organisation.
• The ARAC should have the level of skills and expertise required to challenge management and provide assurance to the Board that the organisation is properly managing its cyber and digital risks.

Information Security

2.12Information security is the protection of sensitive information against unauthorised access, disclosure, use, alteration or disruption. ARAC should support the Accounting Officer and Board in reviewing information risks. ARAC should be confident in its ability to challenge management’s assessment of information security. ARAC should regularly review the organisation’s information security policies, ensuring that they comply with General Data Protection Regulations (GDPR).

What does good practice look like?

• ARAC members are aware of the organisation’s plans to manage information risk.
• ARAC should understand the requirements for information security set out in GDPR.
• ARAC members should obtain assurance that an appropriate information security policy in place which is regularly reviewed and updated.
• ARAC members should obtain assurance that suitable processes are in place to ensure information is guarded (i.e. controls are designed to prevent and detect security breaches).
• ARAC members should obtain assurance that information security incidents are suitably recorded, and the organisational response is reviewed to ensure it is appropriate.

Climate change and Environmental, Social and Governance (ESG)

2.13 ARAC should critically assess the organisation’s progress with ESG responsibilities and commitments. Disclosures should be in line with relevant up-to-date standards and ARAC should be satisfied that the organisation is appropriately managing its ESG risks.

2.14 ARACs should have the ability to assess the process for managing climate-related risks and understand how they can impact on organisations.

What does good practice look like?

ARAC is aware and understands how management:

• is managing its ESG responsibilities and risks;
• has introduced and implemented its governance of climate change risk;
• builds awareness and understanding of climate change responsibilities across the organisation;
• identifies, assesses, mitigates and evaluates climate risk; and
• monitors and reports on climate risk.

Artificial Intelligence

2.15 The use of Artificial Intelligence (AI) has been expanding rapidly across society, particularly with the development of generative AI. AI has the potential to transform public services, but also presents risks and challenges and is becoming an emerging oversight responsibility for ARACs. ARAC should ensure that its members have sufficient training when it comes to emerging risk areas such as AI.

What does good practice look like? 

ARAC is aware and understands how management:

• is responding to the emerging risks and challenges associated with AI, both in relation to its use within the organisation and its use by any services or suppliers of the organisation/stakeholders;
• is managing any AI services and risks and ensuring they are aligned with ARAC’s risk appetite.
• has prepared the organisation for any new regulations regarding AI.

Projects and programmes

2.16 Government organisations regularly manage a number of projects and programmes. ARACs play a key role in challenging management throughout the project or programme lifecycle, so it is important that ARACs understand how and when to assess and challenge any significant project and programme risks.

What does good practice look like?

• ARAC is appropriately briefed on significant projects and programmes throughout their lifecycle.
• ARAC has the skills and expertise to provide effective critical challenge on the financial management, delivery risks and overall progress of projects or programmes.

Procurement

2.17 In providing assurance to the Accounting Officer and Board over risk management and the control environment, ARAC should have the necessary skills and expertise to understand the complexities of procurement and challenge organisations to provide value for money for goods and services.

2.18 Additionally, the Department of Finance’s Procurement policy notes outline mandatory procurement guidance for government public bodies.

2.19 Depending on the size of the organisation, there may be other committees with Terms of Reference related to projects, programmes and procurement and ARACs will need to understand the remits and activities of these committees as part of overall governance arrangements.

What does good practice look like?

• ARAC is aware of key procurement activities.
• ARAC has an appreciation of the risks associated with procurement in the public sector context.
• ARAC has the skills and expertise to challenge commercial activities and the procurement of goods and services.

Our Observations

We have observed ARACs which have included training and development as a standing item on their meeting agenda. A record of all formal training courses attended by members is maintained to ensure that ARAC has adequate knowledge of issues currently affecting the organisation, or new areas that have the potential to affect the organisation. This agenda item also provides the opportunity to highlight upcoming training courses available to ARAC members.

Part Three: Roles and Responsibilities

Assurance

3.1 The scope of ARAC’s work should be clearly defined in its ToR and should encompass all the assurance needs of the Accounting Officer and Board. It is vital that ARACs understand how they receive its assurance and can identify any significant gaps. This will give ARACs the best possible chance of focusing on high-priority issues and fulfilling their role effectively.

3.2 An effective ARAC can help the Accounting Officer and Board to formulate their assurance needs, and then consider how well the assurance received actually meets these needs by gauging the extent to which assurance on the management of risk is comprehensive and reliable.

3.3 An effective model used widely across both the public and private sectors to categorise the various sources of assurance is the ‘three lines of defence’. An understanding of the three lines of defence can help ARAC play a key role in helping the Accounting Officer and Board establish an optimum mix of assurance. The three lines of defence are as follows:

• First line of defence – Managers and staff who are responsible for identifying and managing risk;
• Second line of defence – Risk Management and Compliance Function; and
• Third line of defence – Independent and more objective assurance, including the role of Internal Audit.

3.4 Overall assurances provided to the Accounting Officer and Board should be reviewed and constructively challenged by ARAC. Where it identifies any significant risk, governance and control issues which are not being subjected to sufficient review, it should also be proactive in commissioning assurance work from appropriate sources.

What does good practice look like?

• Assurance is central to ARAC’s role in providing an independent assessment on governance, risk management and control processes.
• Assurance modelling, such as the “three lines of defence”, will draw attention to the aspects of risk management, governance and control that are functioning effectively and, just as importantly, the aspects which need to be given more attention.
• ARAC should be proactive in commissioning work where assurance gaps have been identified from appropriate sources.

Governance

3.5 It is essential that ARAC understands how governance arrangements support achievement of the organisation’s strategies and objectives.

3.6 It should understand the operational systems in place to ensure effective organisational accountability, performance and risk management.

What does good practice look like?

• ARAC must have a clear understanding of how governance arrangements support achievement of the organisation’s strategic objectives.
• ARAC should monitor developments in corporate governance so that it can proactively advise the Accounting Officer and Board on any changes to assurance requirements.

Risk management and internal controls

3.7 It is essential that ARAC understands the organisation’s business strategy, operating environment, the framework for risk assessment and the associated risks. It should critically challenge and review the risk management and assurance framework and the adequacy and the effectiveness of associated control processes, to provide assurance that the arrangements are actively working in the organisation.

3.8 ARAC should discuss with the Board its policies, attitude to and appetite for risk, to ensure these are appropriately defined and communicated and that management operates within these parameters. Its role should include horizon scanning for potential issues that could affect the organisation in the future, together with reviewing and challenging, where appropriate, the risk management and assurance framework. It then can help provide assurance that the arrangements are actively working.

3.9 It should challenge and review the adequacy and effectiveness of the systems of control (including risk registers) in responding to risks within the organisation’s governance, operations, compliance and information systems, including undertaking deep dives into significant risks.

3.10 It should invite risk owners along to ARAC meetings to challenge and review the classification of the risk and any control mitigations.

What does good practice look like?

• ARAC has a key role to play in providing assurance regarding the organisation’s risk management processes.
• ARAC understands the risk management framework of the organisation and the assignment of responsibilities.
• ARAC critically challenges the effectiveness of the organisation’s risk management frameworks, policies and processes.
• ARAC regularly reviews the Corporate Risk Register.
• ARAC monitors the organisation’s risk culture, in addition to reviewing how well risk appetite is understood across the organisation.
• ARAC has a key role in providing assurance on systems of internal control and assuring the Accounting Officer and Board that controls are effective in mitigating the risks identified by management.
• ARACs should have a clear understanding of management’s control environment and how it is designed to mitigate risk across the organisation.

Counter fraud and raising concerns

3.11 ARAC should consider counter fraud arrangements on a regular basis to understand the main fraud and error risks affecting the organisation and management actions to mitigate these risks. They should satisfy themselves that there is an appropriate anti-fraud policy in place which is regularly reviewed and updated.

3.12 NIAO has published a range of guidance on managing different types of fraud risks, including:

• Planning Fraud Risk Guide (published March 2023)
• Internal Fraud Risk Guide (published February 2022)
• Grant Fraud Risk Guide (published October 2021)
• Procurement Fraud Risk Guide (published November 2020)
• COVID-19 Fraud Risk Guide (published August 2020)

3.13 ARAC should assure themselves that suitable processes are in place to ensure fraud is guarded against and that losses and responses to them are suitably recorded and appropriate.

3.14 ARAC should review regular reports on any major incidents and near misses as well as details of any special investigations, raising concerns incidents and their outcome.

What does good practice look like?

• An appropriate anti-fraud policy and fraud response plan is in place and is regularly reviewed and updated.
• Suitable processes are in place to ensure fraud is guarded against (i.e. controls are designed to prevent and detect fraud and error).
• Losses are suitably recorded and the organisational response is reviewed to ensure it is appropriate.
• Raising concerns incidents are regularly reviewed and updated.

Financial reporting

3.15 ARAC should consider significant relevant accounting policies, any changes to them and any significant estimates and judgements, if possible before the start of the financial year.

3.16 At year end, ARAC should receive a comprehensive overview of the financial statements from the Finance Director, including comparisons with the prior year and current year budget, and an explanation for any significant issues arising. It should also review the clarity and completeness of disclosures in the year-end financial statements and consider whether the disclosures made are set properly in context.

3.17 ARAC should consider the control arrangements in place within the organisation for the preparation of the accounts. It should consider the advice and findings from External Audit and, if required, engage constructively with it to assist in the resolution of any disputes between External Audit and those preparing the accounts.

What does good practice look like?

• ARAC should have a thorough understanding of the processes in place to produce the financial statements to enable it to challenge the quality of the annual report and accounts;
• ARAC should seek assurances from senior management on the quality of the disclosures within the organisation’s annual reports and accounts;
• ARAC should consider the contents of the Annual Report to ensure it is reasonable and in accordance with its understanding of the organisation;
• ARAC should engage constructively with the External Auditor, consider their reports and findings, especially the Report to those Charged with Governance, and follow up on all recommendations; and
• ARAC should hold the finance team accountable for adhering to the timetable agreed with External Audit for the production of the annual report and accounts.
• All ARAC members should be in attendance at the meeting that the Annual Report and Accounts are being proposed to be signed.

Our Observations

We have observed “deep dive” sessions by ARACs into significant risks affecting organisations. At these “deep dive” sessions during ARAC meetings, risk owners are invited to present in detail information relating to the risk. This allows ARAC members to fully understand the risk, critically challenge and review the adequacy and effectiveness of control processes in place.

Part Four: Scope

4.1 It is important that ARAC fully understands the scope of its work, and that this is set out clearly in its ToR. ARAC, the Accounting Officer and Board must be clear on their respective responsibilities – particularly when it comes to assurance requirements. Being clear on expectations and accountabilities will ensure that ARAC focuses its time and resources on its core requirements. ARAC should understand how it interacts with the organisation’s various safeguards and how it should engage with other providers of assurance, such as Internal and External Audit.

Terms of Reference

4.2 ARAC’s ToR should be agreed by the Accounting Officer/Board and made publicly available (including on the organisation’s website). They should be reviewed regularly alongside the performance of ARAC. The responsibilities assigned to ARAC should not compromise its independence; it should not have any executive responsibilities or be charged with making or endorsing any decisions.

4.3 Under its ToR, ARAC should be able to request any employee of the organisation to report on the management of risk or on the control environment within their areas of responsibility. It should set a minimum number of meetings (at least four a year) and should have access to funding to cover the costs incurred in fulfilling its role. It will also need adequate secretariat support to perform its function.

4.4 A schedule of ARAC’s agreed delegations from the Board, and the mechanisms for feedback and assurance, should be documented in the Board Operating Framework.

What does good practice look like?

The ToR should:

• be reviewed by ARAC on an annual basis;
• be agreed by the Board, made publicly available and reviewed regularly;
• clearly establish the independence and core responsibilities of ARAC;
• set a minimum number of meetings (at least four a year);
• include the possibility to hold a separate meeting to discuss the Annual Report and Accounts; and
• ensure access to funding to cover the costs incurred in fulfilling its role.

Internal Audit

4.5 The work of Internal Audit must be independent from the operations that it evaluates, reporting their work directly to the Board, typically via ARAC to provide effective oversight and governance. It is likely to be the single most significant resource used by ARAC in discharging its responsibilities. This is because the head of Internal Audit, in accordance with Internal Audit professional standards, has a responsibility to provide an annual opinion on the overall adequacy and effectiveness of the organisation’s governance, risk management and control processes. The role of ARAC in relation to Internal Audit should include advising the Accounting Officer and Board (through ARAC) on:

• the Internal Audit strategy and periodic Internal Audit plans, forming a view on how well they reflect the organisation’s risk exposure and support the Head of Internal Audit’s responsibility to provide an annual opinion;
• the adequacy of the resources available to Internal Audit;
• the Internal Audit Charter/Terms of Reference for Internal Audit;
• the results of Internal Audit work, including reports on the effectiveness of systems for governance, risk management and control, management responses to issues raised, and progress made by management addressing all recommendations;
• the annual Internal Audit opinion and annual report; and
• the performance of Internal Audit, including conformance with the applicable standards, expected performance measures, and the results of both internal and external quality assessments.

What does good practice look like?

• There is effective cooperation between the Head of Internal Audit and ARAC.
• ARAC advises the Accounting Officer and Board on the work of Internal Audit as a key strand of its assurance.
• ARAC seeks assurance from the Accounting Officer that any weaknesses identified are promptly addressed or mitigated.
• ARAC follows up on all recommendations raised in Internal Audit reports, while taking into account the priority rating of each point raised.

External Audit

4.6 ARAC should have ongoing engagement with the External Audit function (which for most Northern Ireland public sector bodies is the Northern Ireland Audit Office (NIAO)). It should consider both the External Auditor’s audit strategy and the results of External Audit work as well as resolution of any identified weaknesses. It should seek assurance that the External Auditor has liaised with Internal Audit and where appropriate has taken assurance from their work where their objectives cover areas of joint interest.

4.7 In addition, it should review and consider the potential implications for the organisation of the wider work carried out by the External Auditor, for example, any relevant recommendations from its programme of Public Reporting, including the content of any relevant good practice guides.

What does good practice look like?

• ARAC Chair has regular informal meetings with the External Auditor separately from the organisation’s executive staff to establish open working relationships and provide auditors with the opportunity to discuss any issues of concern.
• ARAC asks open-ended questions to provide an understanding of the External Auditor’s perspectives about sensitive and judgemental accounting policies, accounts and transactions.
• The work of External Audit is normally primarily conducted for the benefit of the NI Assembly/Council – but the process and conclusions are a significant source of independent and objective assurance for ARAC to draw on.
• ARAC follows up on all recommendations raised by External Audit, while taking into account the priority rating of each point raised.

Our Observations

We have observed ARACs that have performed annual reviews of their ToR at one ARAC meeting during the year. The ToR was presented to each ARAC member for review prior to the meeting. At the meeting, members were invited to provide their comments on the updated ToR and to approve it prior to being brought to the Board for approval. After the Board approved the updated ToR, it was then published on the organisation’s website.

Part Five: Communication and Reporting

5.1 To be successful, ARAC must have clear lines of communication with the Accounting Officer, the Board and other key stakeholders. Establishing an effective mechanism for working with the Board is particularly important.

5.2 Communication should be tailored to the requirements of key stakeholders and should be a way to ensure that ARAC can perform at its optimum effectiveness.

5.3 After each ARAC meeting, a report/minute should be prepared for the Accounting Officer and Board, setting out the business discussed by ARAC and offering advice on those issues that the Accounting Officer and Board should act upon. Such reports should be shared with the Internal Auditor and External Auditor.

5.4 ARAC should also provide an Annual Report, timed to support the preparation of the Annual Governance Statement, taking into account assurances from other parts of the organisation in respect of key risks. The Annual Report should summarise ARAC’s work for the past year, as set out in para 6.5 of the Audit Risk and Assurance Committee Handbook. Appendix 3 provides further guidance on the structure of ARAC Annual Report.

5.5 The reports received by ARAC to exercise its responsibilities should be at the right level of detail and presented in a manner which makes it easy for members to review and challenge. Reports from ARAC to the Board should meet the Board’s expectations in terms of content, scope and proportionality.

5.6 There should be mutual rights of access to information between the Chair of ARAC, the Board, risk manager, head of Internal Audit and the External Auditor. Regular discussions should take place (at least annually) outside formal meetings to ensure that expectations are managed and that there is mutual understanding of current risks and issues.

What does good practice look like?

• ARAC has identified its key stakeholders and ensures that there is effective two-way communication with them. Relevant stakeholders include, for example, the Board, the head of Internal Audit, the External Auditor, and any other relevant assurance providers.
• There are regular reports from ARAC to the Board.
• An annual report is completed to support the preparation of the Annual Governance Statement.

Our Observations

We have observed numerous ARACs producing its annual report to the Board. The annual report is presented at an ARAC meeting (in advance of the Annual Governance Statement being prepared) inviting comments from all ARAC members. The report provides a detailed account of the work of ARAC during the year and is presented in a clear, concise and easily understandable manner.

Part Six: Continuous Improvement

6.1 As the challenges and requirements of ARACs evolve, a high-performing ARAC will strive for continuous improvement. It is important that ARAC adopts a positive attitude to learning and development, regularly appraises its performance and is open to feedback from others.

6.2 An ARAC’s effectiveness should be judged by the contribution it makes to, and the beneficial impact it has on, the organisation’s business. Evidence of effectiveness will usually be characterised as ‘influence’, ‘persuasion’ and ‘support’. A good standard of performance against recommended practice, together with a knowledgeable and experienced membership, are essential requirements for delivering effectiveness.

6.3 The Chair should take the lead in ensuring that ARAC members are provided with appropriate appraisal of their performance as a committee member and that training needs are identified and met. The Chair should seek appraisal of their own performance from the Accounting Officer (or Chair of the Board, as appropriate).

6.4 The Chair should ensure that there is a periodic review (at least annually) of the overall effectiveness of ARAC – Appendix 1 provides a self-assessment checklist to aid this process. The Chair should ensure any areas of concern from the reviews are considered and actioned.

What does good practice look like?

• As part of the self-assessment process, the Chair assesses the performance of individual members and ARAC as a whole and as a team. In addition, the Chair should seek appraisal of their own performance from the Accounting Officer.
• Feedback is sought from ARAC’s key stakeholders, for example, the Executive, Internal Audit, External Audit.
• Clear actions are identified and addressed to drive improvement.

Our Observations

We have observed ARACs that have included requirements for their self-assessment review within their ToR. Comments provided on the self-assessment review are relevant and provide insightful detail of ARAC’s performance. Reflecting on self-awareness adds value to ARACs and gives ARAC members greater confidence that they are fully meeting the demands of their challenging roles, particularly where self-assessment is undertaken on an ongoing basis and includes training. We have also seen some ARACs benchmark against other similar or same group ARACs and also the development of a network of ARAC chairs/members within the same departmental family and holding regular relevant training events to discuss similar type issues.

Part Seven: Local Government Guidance

7.1 The constitution and membership of ARACs in local councils in Northern Ireland differs somewhat from central government public bodies. Core membership is made up of elected representatives and ARAC often has different titles and ancillary responsibilities, and reports to the Council rather than a Board. Notwithstanding these differences, they should strive to follow best practice in line with a central government ARAC.

Membership, Independence, Objectivity and Understanding

7.2 It is recommended that suitable independent members are appointed to all local council ARACs. The role of the Chair of ARAC is key to the effectiveness of the Committee and best practice of having an independent chair comes from other sectors. Whilst there is no requirement for local authorities to adopt this, consideration should be given to having an independent member to chair ARAC as:

• it helps to ensure that the committee is chaired by someone with appropriate knowledge and expertise;
• it reinforces the independent and objective nature of the work of an ARAC; and
• it provides continuity in the chairing of the committee.

7.3 An external and independent view can often bring new experiences and approaches to ARAC discussions. Independent members’ appointments should be for a fixed term and be formally approved by the Council. While operating as a member of ARAC, all independent members should follow the organisation’s code of conduct and a register of interests should be maintained.

Skills and Experience

7.4 Consideration should be given by full Council to extending the appointment of the Chair of ARAC and all ARAC members for more than one year, which would bring continuity and experience to the role. ARAC members require a wide range of skills and experience in relation to governance, risk and control and it is important that ARAC members are appointed with the right skills.

7.5 The selection of the Chair should take into account the characteristics required of an effective Chair, as outlined in paragraph 2.6 of this guide.

Roles and Responsibilities

7.6 ARAC members should have a timely induction programme which outlines the requirements of the role including the Council’s accountability framework, priorities and risk profile.

7.7 ARACs are a key component of a council’s governance framework. ARAC’s purpose is to provide an independent and high-level focus on the adequacy of governance, risk and control arrangements. ARAC’s role in ensuring that there is sufficient assurance over governance, risk and control gives greater confidence to all those charged with governance that those arrangements are effective.

7.8 The full council is the body charged with governance. ARAC may be delegated some governance responsibilities but is accountable to the full council.

7.9 ARAC has oversight of both Internal and External Audit together with the financial and governance reports, helping to ensure that there are adequate arrangements in place for both internal challenge and public accountability.

Scope

7.10 CIPFA’s Position Statement for local government bodies (2022) outlines that the core functions of ARAC are to provide oversight of a range of core governance and accountability arrangements, responses to the recommendations of assurance providers, and assist in ensuring robust arrangements are maintained.

7.11 The specific responsibilities include:

• maintenance of governance, risk and control arrangements;
• financial and governance reporting; and
• establishing appropriate and effective arrangements for audit and assurance.

Communication and Reporting

7.12 ARAC should report annually on how it has discharged its responsibilities and include an assessment of its performance.

Continuous Improvement

7.13 The Chair should take the lead in ensuring that training needs are identified and met for all ARAC members and that there is a periodic review (at least annually) of the overall effectiveness of ARAC – Appendix 1 provides a self-assessment checklist to aid this process, with Part 7 of this Appendix providing further details on ARACs for local councils in Northern Ireland. The Chair should ensure any areas of concern from the reviews are considered and actioned.

What does good practice look like?

• The Council ARAC reports directly to the full Council rather than another committee.
• At least one independent member should be appointed to the Council ARAC.
• The Chair should be strong and independently minded, displaying a depth of knowledge, skills and experience.
• Consideration should be given to appointing an independent member as Chair of the Council ARAC.
• ARAC members should strive to be in attendance at each meeting of the ARAC.
• All ARAC members should be in attendance at the meeting that the Annual Report and Accounts are being proposed to be signed.

Our Observations

We have observed a local council that has appointed an independent member as Chair of the Council ARAC. This independent Chair has been in this position for more than one year, bringing continuity, knowledge and experience to the ARAC. Having an independent member as Chair reinforces the independence and objective nature of the work of the Council ARAC.

Appendix 1: Audit and Risk Assurance Committee Self-Assessment Checklist

This self-assessment checklist is a comprehensive way for ARACs to review their overall effectiveness. We recommend that it is completed annually.

Each section of the questionnaire has been split into three distinct areas:

• Essential Requirements – these questions reflect guidance set out in the body of the HM Treasury Audit and Risk Assurance Committee Handbook (July 2024). Paragraph references to the appropriate section in the HM Treasury ARAC Handbook are included in each question.
• Other Good Practice arrangements – these questions go beyond basic requirements and set a standard for ARACs to demonstrate leading behaviours.
• Additional Comments and key takeaways – at the end of each section is a space for ARAC to add its commentary and highlight any actions that have arisen.

A downloadable copy of the checklist is available on the NIAO website.

Section 1: Membership, Independence, Objectivity and Understanding

Other Good Practice Arrangements

Section 2: Skills and Experience

Other Good Practice Arrangements

Training and Development

Other Good Practice Arrangements

Cyber and Digital

Information Security

Climate Change and ESG

Projects and Programmes

Procurement

Section 3: Roles and Responsibilities - Assurance

Other Good Practice Arrangements

Governance

ARAC understands how governance arrangements support achievement of the organisation’s strategies and objectives. (5.19) In particular, ARAC understands:

Other Good Practice Arrangements

Risk Management and internal controls

Other Good Practice Arrangements

Training and Development

Other Good Practice Arrangements

Financial Reporting

Other Good Practice Arrangements

Section 4: Scope - Terms of Reference

As a minimum, the following areas are covered by ARAC’s Terms of Reference (5.26):

Other Good Practice Arrangements

Internal Audit

Other Good Practice Arrangements

External Audit

Other Good Practice Arrangements

Section 5: Communications and Reporting

Other Good Practice Arrangements

Section 6: Continuous Improvement

Other Good Practice Arrangements

Section 7: Council Specific

Appendix 2: Example of Annual ARAC core work programme (for bodies with a March year-end)

Appendix 3: Example of ARAC Annual Report Structure

Introduction

The introduction should provide a summary of the role and activities of ARAC within the organisation, including the reporting structure, its independence and the steps taken to obtain the necessary assurance around the year-end process, culminating in the Annual Report and Accounts, including the Governance Statement.

Membership

All ARAC members should be listed (including dates of appointment), highlighting who the Chairperson is, Non-Executive Board Members (NEBMs) and if there were any new appointments or resignations in the year.

Meetings

It is important that members are in regular attendance. The attendance statistics for each meeting during the year should be published. This ensures that the quorum is being met. See below a suggested table which should be tailored to each organisation.

In addition, commentary should be included as to how:

• an agenda, together with relevant documentation, was circulated to Committee members in advance of each meeting;
• conflicts of interest were handled;
• minutes of each meeting were approved; and
• at the end of each meeting, Committee members met privately with Internal Audit and External Audit.

Risk Management

There should be an update on the arrangements for risk management and the ongoing monitoring and oversight of the corporate risk register.

Internal Control Assurances

There should also be a section highlighting the internal control mechanisms, policies and additional assurance statements considered and discussed by the Committee during the year, examples such as:

• Annual IT Assurance Statement;
• Annual Report on complaints, fraud and raising concerns;
• Annual Report on cyber-security;
• Annual Report on procurement; and
• Annual Report on ESG.

Internal Audit

This section provides an overview of the work performed by Internal Audit and their approach to their responsibilities during the year, including their Annual Report. See below a suggested table for providing details of Internal Audit reports.

External Audit

This section provides an overview of the work performed by External Audit and their approach to their responsibilities during the year, including their reports. There is also the opportunity to include the findings of other public reports published by External Audit and any impact on the organisation.

Governance

This section provides an opportunity for ARAC to comment on any issues in relation to the Governance Statement or to bring to the attention of the Accounting Officer or Board.

Conclusion - ARAC Effectiveness

ARAC should conclude:

• its view on its own effectiveness;
• as to whether it is satisfied that it has fulfilled its duties as guided by its Terms of Reference;
• that by reviewing the work of Internal and External Audit and other assurances provided to the Committee, every effort has been made to review and oversee internal control and risk management arrangements; and
• if sufficient assurance has been provided to the Accounting Officer in the discharge of his/her accountability obligations.

Appendix 4: The role of the Chair of the Audit and Risk Assurance Committee

The role of the Chair of ARAC goes beyond chairing meetings. It is key to the effectiveness of the Committee. Their role includes a number of additional responsibilities beyond Committee meetings themselves, including:

• Before each meeting the Chair and the Committee Secretary should meet to discuss and agree the scheduled business for the meeting. The Chair should take ownership of, and have final say in, the decisions about what business will be conducted at any particular meeting.
• ARAC meeting time should be optimised by ensuring that all agenda papers are issued in good time. Each paper should be summarised with an outline provided of the key points, which are then cross referenced to the organisational business and risk agenda. In addition a brief comment should be included to clarify what Committee action is required.
• Ensuring that after each meeting appropriate reports are prepared from ARAC to the Accounting Officer and Board. They should also provide an annual report to the Accounting Officer and Board.
• The Chair should have bilateral meetings at least annually with the Accounting Officer, the Head of Internal Audit and the External Auditor. Where any person is appointed to these positions the Chair should meet them as soon as practicable after their appointment.
• The Chair should ensure that all ARAC members have an appropriate programme of engagement with the organisation and its activities to help them understand the organisation, its objectives, business needs and priorities.
• The Chair should establish a mechanism to enable key stakeholders to consider the overall risk and assurance needs.
• The Chair should encourage good, open relationships between ARAC, Accounting Officer, Finance Director and Internal and External Auditors.
• The profile of ARAC can be raised to support and add weight to audit work by:
  • promoting audit issues with the Board and other directors to make sure they appreciate the purpose and value of audit;
  • holding managers within the organisation to account for the implementation of all audit recommendations; and
  • when appropriate calling business heads to meetings, for example, to clarify issues and explain how they are delivering agreed actions for risks for which they are responsible;
  • arranging separate meetings for the Chair, NEBMs and Internal and External Auditors to help establish good open working relationships;
  • arranging meetings with Internal Auditors and the Finance Director etc in the weeks leading up to ARAC meetings to discuss potential agenda items and papers that should be provided;
  • arranging pre-meetings with the Internal Auditors (and possibly External Audit) immediately before ARAC meeting to help focus discussions; and
  • the Chair should ensure that there is an appropriate process between meetings for action points arising from Committee business to be appropriately pursued. The Chair should also ensure that members who have missed a meeting are appropriately briefed on the business conducted in their absence. Chairs may choose to rely on the Secretariat to take responsibility for these actions.
• Committee Appraisal: The Chair should take the lead in ensuring that Committee members are provided with appropriate appraisal of their performance as a Committee member and that training needs are identified and addressed. They should seek appraisal of their own performance from the Accounting Officer (or Chair of the Board, as appropriate). In addition, they should ensure that there is a periodic review of the overall effectiveness of ARAC and of its terms of reference.
• Committee Appointments (Central Government only): The Chair should be involved in the appointment of new Committee members. Their advice should be sought in relation to the skills and experience being sought by the Committee when a new member is appointed.