NRS Audit and Risk Committee (ARC) Meeting
Thursday 19 June 2025
ARC Members
- Maggie Waterston - NRS Non-Executive Director (Chair)
- Anne Moises - NRS Non-Executive Director
- Tim Wright - NRS Non-Executive Director
ARC Attendees
- Alison Byrne (NRS, CEO – In Person)
- NRS, Director of Corporate Services & Accountable officer
- NRS, Director of Statistics
- NRS, Director of Operations and Customer Services
- NRS, Interim Director for Digital & IT Services
- NRS, Chief Financial Officer
- Engagement Director for NRS – Grant Thornton
- Senior Internal Audit Manager – Scottish Government
- Internal Audit Manager – Scottish Government
- Internal Audit Technician – Scottish Government
- SG, Senior Engagement Manager
- NRS, Corporate Business Assurance Manager
- NRS, Business Management (Secretariat)
- NRS, Deputy Director, Information and Records Services
- NRS, Corporate Governance Manager
- NRS, Programme Manager, Archive Services (Item 5.1)
- NRS, Head of PMO (Item 5.2)
Apologies
- NRS, Director of Digital & Delivery
- NRS, Director of Information and Records Services
- Engagement Manager – Grant Thornton
- NRS, Director of Census Statistics
- NRS, Head of NRS Business Management
1. Welcome, Introductions and Apologies. Declaration of Interests & Matters Arising
1.1 Maggie Waterston welcomed everyone to the meeting. Apologies were noted as listed above.
1.2 There were no declarations of interests or matters arising.
1.3 Alison Byrne updated ARC on recent NRS Director appointments:
- Director of Corporate Services and Accountable Officer
- Director of Operations, Customer Service and Archives
- Interim Director for Digital & IT Services
2. Meeting held on 26 February 2025
2.1 The minutes from the last meeting on 26 February 2025 were approved and would be published on the NRS website.
2.2 A review of actions was undertaken. The action tracker would be updated accordingly.
3. ARC Terms of Reference
3.1 ARC members reviewed the Terms of Reference(ToR) and requested the updates below:
- Update ToR with two new NXD members, who will join after they onboard in the Autumn
- Update ARC Quorum from two to three
- Update the personnel noting the position e.g. CEO rather than names
- Director of Corporate Services & Accountable office to consider any impact to ToR in light of the newly established NRS People Board
3.2 ARC members noted the updated ToR would be presented for approval at the ARC meeting on 28 Aug 2025 and be implemented at the following ARC meeting.
4.1. NRS Corporate Issues Log
4.1.1 The Corporate Business Assurance Manager and the Director of Corporate Services & Accountable officer introduced the NRS Corporate Issues Log to the meeting and covered the following key points below:
- NRS continued to proactively monitor and manage issues to mitigate these from becoming corporate risks. Issues were reviewed monthly at EMB meetings
- The NRS Business Continuity plan had been shared and agreed by EMB. Sarah Clarkson, NRS Corporate Business Continuity Lead, undertook a programme of work to implement the framework
- Updates on issues for next EMB in July were Cyber Essential Plus + & accreditation & potential closure of the D&G Cyber incident.
4.2 NRS Risk Dashboard & Risk Register
4.2.1 The Corporate Business Assurance Manager provided the following update on the Risk Dashboard:
- Corporate risk update based on the draft risk register which had been developed as part of the Director risk workshops undertaken which formed part of the six-month period review NRS set against implementing the Scottish Government Risk Framework and guidance
- The organisation was focussing on specific corporate risks rather than generic and this had helped generate much more clear and concise risks along with the path to green. There are still a few loose ends to tidy up before NRS will utilise the information within the risk register in terms of governance and dashboards
- NRS had been proactive in reviewing of risk scoring both current & target risk score
- Scottish Government had accepted the risk regarding a recent Tribunal on reuse of public sector information and wider implications. NRS would continue to monitor and update accordingly.
- The third and final Risk Workshop with Directors included Census 2031 (which would be brought along to the next EMB for approval, Cyber, portfolio funding and Climate Change
- All risks would be allocated a risk appetite scoring, owner and refreshed target dates at the next workshop
- NRS were also keeping a close eye on the Strategy and Target Operating Model (TOM) work being undertaken and likely to review the Corporate Risk Register, pending the completion of the Strategy and Planning work
Risk workshop
The final risk workshop with all Directors would cover the remaining risks as well as consideration and finalising the risk appetite scoring and controls confidence.
The workshop would include NRS risk leads/owners to attend alongside NRS Directors to discuss a presentation on risk escalation and the new risk material.
Further progress had been made to develop a raft of supporting material (in addition to the already accessible SG framework/guidance and mandatory risk training) for all colleagues within NRS to utilise when considering and developing risk.
ARC background reading papers included:
- Risk and issues escalation and de-escalation forms
- Risk and Issues escalation process framework document with diagrams
- Risk and Issues draft template
- RACI Matrix outlining each role played by Boards, EMB and individuals across the organisation
- NRS had also recently engaged with Statistics team around the development of a corporate performance dashboard. This work was also likely to include development of visuals as part of the dashboards (risk and issues plus others) aimed at reducing paper content while improving the narrative
- Staff communications would be arranged later in 2025 to update staff on all the risk progress and links to the framework/documents etc
4.2.2 Anne Moises asked why the Tribunal risk was closed. The Corporate Business Assurance Manager advised the original risk was closed as the risk was escalated to SG DG risk register but it remained on the NRS Issues log. Anne requested update Action comments to advise of this. The Corporate Business Assurance Manager confirmed this would be updated for clarity.
4.2.3 Tim Wright asked how NRS were considering NRS Intellectual Property. The Director of Operations and Customer Services advised a paper would be presented to ARC in August and NRS were taking forward short-term priority actions around intellectual property. The Director of Corporate Services & Accountable officer advised that NRS will develop future commercial planning approaches.
4.2.4 ARC noted the updates and praised the new dashboard format.
5. Update on NRS Major Projects and Programmes
5.1. Archive services programme
The Archive Services Programme Manager provided an update on Archive services programme and covered the following key points below:
Archive services programme
- Major Project Assurance will be applied with a Gateway 0 review and Risk profile Analysis
- Similar governance approach implemented as with Census, recognising that Archive Services is a large-scale project
- Interim and Full Operating Model prepared for Archive Storage with draft Roadmap
- Linking all this work into the five-year corporate plan and dovetailing into NRS operating model
- Work was underway to action internal audit recommendations on Archive Storage, coordinating within the programme
- Strategic Outline Case completed on Archive Services
- Engagement with Culture cluster stakeholders ongoing around the public sector requirement for collection storage and looking to coordinate the NRS storage business case with this work to secure investment for physical storage
- Looking to free up existing space in the NRS estate for short term space solutions through a space optimisation review. This independent specialist review would carry out a full estate space planning exercise and develop recommendations in an options paper
- Archive Services Budget approved for 2025/2026
- Digital Preservation System - Business case approved by EMB
- Archive Environment Project - updated business case had also been approved by EMB
- Moving into procurement space for some projects
- Reviewing legacy cataloguing software to identify future solution
- Looking to service design pilot project
- Providing wider support to NRS staff for archive expansion project
Governance Update
- Programme in formal Initiation Phase
- Programme Initiation Document and Terms of Reference in final stages of approval
- Programme Board formed – 3 formal meetings so far plus two additional sessions to discuss and agree scope
- Key Milestone Plan ready for baselining
Physical Storage Project update
- Short-term opportunities PID in final stages of approval
- First 3 of 8 scheduled workshops complete aimed at short listing record sets for moving/consolidating and storage opportunities to increase internal capacity
- Requirements ready for procurement of an NRS estate wide space planning survey
- Target Achievements – Next period
- Completed workshops and prepared options paper
- Short-listed options selected and plans approved for creating space internally during
- 2025/26
- Commence NRS estate wide space planning survey
Digital Archiving Project Update
- Budget approved for 2025/26
- Key Design Decision (KDD) approved by NRS Architecture Review Board (ARB) based on a Hybrid Solution: buying a ‘core’ supplier platform and build & integrate
- NRS components (such as NRS cloud storage instance).
- Full Business Case for a new Digital Preservation System in final stages of approval by the Executive Management Board (EMB)
- Target Achievements – Next period
- Complete digital storage high-level design
- Prepare Statement of Requirements (SoR)
- Issue Invitation to Tender (ITT)
Archive Environment Project Update
- Budget approved for 2025/26
- Updated Business Case in final stages of approval by the Digital & Strategy Board (DSB)
- Monitoring Services Contract - SoR provided to procurement
- Target Achievements – Next period:
o Stage 1 - Completion including closure report
o Stage 2 - Contract Award for the fit out of the updated Physical Environment
o Stage 2 - Contract Award for the fit out of the new Treatment Space
5.1.1 Anne Moises asked how the culture cluster project was being managed. The Archive Services Programme Manager advised NRS were leading on the project and reporting. The Archive Services Programme Manager advised the Archive Services Programme were also providing oversight of this. Alison Byrne advised NRS were building trust and taking a collaborative approach and were looking for a strategic commitment from SG that this was a priority. Alison advised NRS would need to invest to move forward to next level of project and keep the culture cluster aligned.
5.1.2 Tim Wright asked if benefits realisation was included business case. The Archive Services Programme Manager confirmed this. Tim requested NRS to ensure full consideration of all areas of NRS potential benefit realisation was covered.
5.1.3 Maggie Waterston asked when the final business case would be submitted to SG and timescales. The Archive Services Programme Manager stated the initial approach was to carry out initial engagement and provide indicative figures in the strategic outline case. The Director of Corporate Services & Accountable officer advised culture cluster discussions and spending review timelines would influence timings of the next stage in the business case. The Director of Corporate Services & Accountable officer advised NRS were hoping to submit an outline business case in next year’s budget cycle (2026/7) and advised estimated start date for building work would begin 2031, at the earliest, subject to securing funding. The Director of Corporate Services & Accountable officer stated funding and design would have to be carried out prior to this. Alison Byrne confirmed the programme would require a collective approach from the culture cluster group to agree what storage was required. ARC noted the update and requested NRS continue to lead on this important work as noted some organisations would have different timescales.
5.2. Census 2031
The Head of Census 2031 PMO provided an update on the Census 2031 programme and covered the following key points below:
- NRS had secured Census funding for 2025/26. Census OBC completed June 2025 and submitted to SG. NRS were currently in initiation phase and working through recommendations from gateway review. The main recommendation highlighted the risk of multi-year funding. NRS were looking to secure support for multi-year funding
- The programme remained Amber for this period reflecting a) NRS still had to complete a number of initiation activities ahead of internal deadline of end June and b) the outcome of a Gateway 0 (strategic assessment) review which provided an Amber stage gate assessment
- The review found that NRS approach to programme initiation had been effective, but three specific issues required management attention were:
- uncertainty regarding securing the programme budget throughout the programme lifecycle
- securing a comprehensive understanding across key SG stakeholders of the importance of successfully delivering the Census 2031
- securing a Memorandum of Understanding with ONS by 2026
- SG annual budget allocation approach was identified as a risk requiring ongoing management given impact on NRS ability to commit to a multi-year MoU with ONS
- NRS completed development of the Outline Business Case (OBC) which was submitted to Scottish Government on 3 June
- SG functional leads would provide independent review, RAG status and feedback before the OBC was taken to SG Executive Team (Investment Mode)
- Agreement had been reached with Ministers to publicly announce (17 June) the intention to undertake a 2031 Census, alongside similar announcements by ONS and NISRA
- A Programme Initiation Document was being developed to set the scene on the broad purpose of the programme and how NRS intend to deliver it
- In tandem NRS have developed workstream briefs to clarify respective scopes, timelines, dependencies this year and related risks etc across all the programme’s workstreams and ensure common understanding across the delivery teams
- NRS have also refreshed the risk register to align with the OBC and take account of the Gateway review findings
- Work continues to engage with ONS and NISRA to understand how NRS would work in effective partnership and shared key priorities for 2025-26 in that UK context, essentially to develop respective high-level designs for 2031, and reflecting what NRS will collaborate on (such as shared collect platforms) and what NRS would deliver
- Some early discussions had been held in a design context via the (UK) Quality & Design Group and NRS were considering how this would feed through into NRS Design & Integration Group which would be established in the next period
5.3 ARC were pleased with the comprehensive update and the progress that had been made. ARC were assured that the programme was progressing well.
6. Draft NRS Governance Statement
6.1 The Director of Corporate Services & Accountable officer presented the draft Accountable Officer governance statement for the Annual Report and Accounts. ARC had no comments on the Draft NRS Governance Statement and noted that a separate meeting held prior to ARC had been very beneficial to agreeing the statement.
7.1. Draft NRS Annual Report and Accounts 2024-2025
7.1.1 The Chief Financial Officer thanked members for reviewing the draft NRS Annual Report and Accounts (ARA).
7.1.2 The Chief Financial Officer advised the External Audit of NRS Annual Reporting and Accounts was in progress. The final draft of the Annual Report and Accounts would be shared at the next ARC meeting on 28 August 2025 for sign-off by ARC and laid in the Scottish Parliament shortly after that meeting.
7.1.3 The Committee thanked The Chief Financial Officer and team for their hard work.
7.1.4 Tim Wright advised the report was too long and encouraged the use of infographics. Tim advised section on principle risks was difficult to understand. The Chief Financial Officer advised NRS had tried to reduce the length of ARA previously but auditors had requested additional information be included in reporting.
7.1.5 ARC noted major challenges with the new Oracle Cloud finance system having been introduced during the year and thanked finance team for their efforts in preparing the ARA.
7.2 Finance Report
7.2.1 The Chief Financial Officer provided an update on 2024/2025 draft outturn, statutory audit plans and 2025/2026 budget update. ARC noted the risk of underspend due to delays in planned recruitment. ARC noted the updates and requested finance provide quarter one updates to ARC via correspondence in July 2025.
Action A36/25: Finance to provide quarter one updates to ARC via correspondence in July 2025. Action Owner: Chief Financial Officer
8.1. Internal Audit charter, Strategy and confirmed Audit Plan for 25/26
8.1.1 The SG Internal Audit Manager presented the Internal Audit charter, Strategy and confirmed Audit Plan for 25/26. The papers were noted by the committee.
8.1.2 Tim Wright requested an outline of timescales for audit planning work. The Senior Internal Audit Manager advised only fee-paying clients received an outline of audit timescales. Senior Internal Audit Manager advised this was scoped internally and not included in the audit plan.
8.1.3 ARC noted discussions around future charging were ongoing. The Senior Internal Audit Manager advised there would be consultation and SG shared services provision were leading on this.
8.2. Internal Audit Annual Assurance Report for the financial year 24/25
8.2.1 The Senior Internal Audit Manager introduced the Annual Assurance Report for 2024/25 and this was noted by the committee. The overall assurance opinion for last year was Limited Assurance. The Senior Internal Audit Manager noted that the report set out the reasons for this and recognised that some were time limited factors and work had already been undertaken to address these. The other factor was the lack of archive storage capacity to undertake statutory functions. Alison Byrne noted the work being undertaken by NRS to address these points. ARC members noted the progress that has been made during the second half of the financial year to improve internal controls and to address the issues of archive storage.
8.3 Internal Audit progress reports on active/follow-up audits
8.3.1 The SG Internal Audit Manager presented the Internal Audit progress reports on active/follow-up audits and Storage of Assets Review. The Progress Report against the audit plan for 2024/25 was noted by the committee.
8.3.2 Tim Wright requested clarity around proposed dates of audits for Q1. The SG Internal Audit Manager advised she had met with BMU and proposed dates for the next two audit reviews dates for Q3 and Q4. Lorriane advised this was to ensure adequate resourcing. ARC noted they would be updated at the next meeting.
9. External Audit update
9.1 Grant Thornton provided an oral update on external audit work with the following key points below:
- External Audit had presented their main outputs at the last ARC meeting in February 2025
- Eternal Audit would present their annual audit reports at the August ARC meeting
- External Audit had met with chair and senior management and were briefed on issues as they arose
- NRS Annual Accounts and working papers were received on time for audit review in preparation for the SG target of signing off the Annual accounts at the August meeting
- The Grant Thornton external audit on NRS Annual Report and Accounts would conclude mid-July 2025
- There were no new accounting, auditing or scoping procedures
10. NRS Audit Recommendations Status Report
10.1 The Director of Corporate Services & Accountable officer presented the NRS Audit Recommendations Status Report.
10.2 Anne Moises asked if all recommendations were on schedule for completion of the storage of assets collections audit by June 2025. The Deputy Director, Information and Records Services advised there were some residual follow up outstanding. Internal audit advised the deadline for completion could be adjusted if required. The Deputy Director, Information and Records Services advised she would share the Collection Audit Closure report with ARC prior to the next meeting.
Action A37/25: The Deputy Director, Information and Records Services to share the Collection Audit Closure report prior to the next meeting. Action Owner: The Deputy Director, Information and Records Services
11. Committee Reports - To Note and Questions
NRS Governance Report
11.1 The Committee noted the report.
11.2 Tim Wright noted short term external recruitment for SAS to Open Source Skills gap and asked where this would leave NRS in future. The Director of Corporate Services & Accountable officer advised NRS needed to balance headcount control and expertise required for the range of projects over the next five years. Anne Moises asked if NRS could source SAS to Open Source Skills from other public bodies and organisations. The Interim Director for Digital & IT Services advised NRS planned to upskill existing NRS staff on cloud platforms it was difficult to attract Change Architects to the public sector. The Director of Statistics advised NRS were working on long term pathway to solutions.
NRS Portfolio & IT Services report
11.3 The Committee noted the report.
NRS Assurance update
11.4 The Committee noted the report.
12.1 Draft Committee Annual Report
12.1.1 The Committee noted the draft annual report. The final Annual Report would be shared with all attendees for comment in advance of the next meeting.
12.2 Self-Assessment Checklist
12.2.1 The Committee noted the checklist.
12.3 Checklist of Improvement Actions
12.3.1 The Committee noted the Checklist of Improvement Actions.
13. To Note: ARC Forward Look for year ahead
13.1 The Forward Look was noted by all Committee members. ARC requested a meeting to discuss the ARC forward look for 2025-2026 once new NXDs were appointed.
Action A38/25: NXDs requested a meeting to discuss the ARC forward look for 2025-2026 once new NXDs were appointed. Action Owner: BMU
14. AOB & Date of Next Meeting
14.1 ARC gave thanks to The Chief Financial Officer, , Director of Information and Records Services and the Chief Purchasing/Procurement Officer for their service and wished them well for their futures.
14.2 The date of the next meeting was noted as 28 August 2025 and Close
End
