Audit and Risk Committee

We publish the minutes of our Audit and Risk Committee meetings on this page, and from April 2011 we also publish the papers from those meetings whenever appropriate.

Audit and Risk Committee Report

Following guidance given in the HM Treasury’s Audit Committee Handbook, the Audit and Risk Committee reports annually on its work and how it has discharged its responsibilities.

• Audit And Risk Committee Annual Report 2024/25
• Audit and Risk Committee Annual report 2023/24
• Audit and Risk Committee Annual report 2022/23
• Audit and Risk Committee Annual report 2021/22
• Audit and Risk Committee Annual report 2020/21
• Audit Committee Annual Report 2019/20

Audit and Risk Committee papers and minutes

20 January 2026

1. Introductions and apologies – this was an oral item
2. Declarations of interests – this was an oral item
3. Matters arising from the previous meeting
4. Chief Executive Officer’s update – this was an oral item
5. Internal audit
   1. Internal audit update – at the time of the meeting this item was not for publication
      1. Finance target operating model (TOM) internal audit report – at the time of the meeting this item was not for publication
      2. Better Regulatory Interventions (BRI) programme governance – at the time of the meeting this item was not for publication
      3. Implementation of Enterprise Data Strategy (EDS) internal audit report – at the time of the meeting this item was not for publication
      4. Purchase to pay (P2P) internal audit report – at the time of the meeting this item was not for publication
      5. Guidance development internal audit report – at the time of the meeting this item was not for publication
6. External audit
   1. External audit plan – at the time of the meeting this item was not for publication
7. Finance
   1. Medium term financial plan – at the time of the meeting this item was not for publication
   2. Management accounts – monthly management accounts are available on the Income and Expenditure page
8. Risk management and business continuity
   1. Corporate risk management update – at the time of the meeting this item was not for publication
   2. Business continuity and cyber security update – at the time of the meeting this item was not for publication
9. Annual report and financial statements
   1. 2025/26 accounting policies – Report attached
   2. Lessons learned from 2024/25 annual report – progress update – report attached
10. Committee effectiveness review outcomes – at the time of the meeting this item was not for publication
11. Compliance report – report attached
12. Security report – at the time of the meeting this item was not for publication
13. Any other business – this was an oral item

23 October 2025

1. Introductions and apologies – this was an oral item
2. Declarations of interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Commissioner’s update – this was an oral item
5. Internal audit
   1. Internal audit update – at the time of the meeting this item was not for publication
   2. Online accessibility compliance internal audit report – at the time of the meeting this item was not for publication
   3. Payroll advisory audit report – at the time of the meeting this item was not for publication
6. External audit
   1. External audit recommendations – progress update – report attached
7. Finance
   1. Management accounts – monthly management accounts are available on the Income and Expenditure page
8. Risk management and business continuity
   1. Corporate risk and opportunity register – at the time of the meeting this item was not for publication
   2. Risk deep dive: AI and automation – at the time of the meeting this item was not for publication
9. Annual report and financial statements
   1. Annual report and financial statements 2024/25 – successes and lessons learned – report attached
   2. Annual report and financial statements 2025/26 – approach and timetable – report attached
10. Compliance report – report attached
11. Security report – at the time of the meeting this item was not for publication
12. Any other business – this was an oral item

16 June 2025

1. Introductions and apologies – this was an oral item
2. Declarations of interests – this was an oral item
3. Matters arising from the previous meeting
4. Commissioner’s update – this was an oral item
5. External audit
   1. External audit completion report – at the time of the meeting this item was not for publication
   2. Progress with external audit recommendations – report attached
6. Internal audit
   1. Internal audit update – at the time of the meeting this item was not for publication
   2. Business continuity internal audit report – at the time of the meeting this item was not for publication
   3. Fee income internal audit report – at the time of the meeting this item was not for publication
   4. Internal audit opinion 2024/25 – at the time of the meeting this item was not for publication
   5. Internal audit performance report 2024/25 – at the time of the meeting this item was not for publication
7. Annual report and related matters
   1. Accountability framework compliance – at the time of the meeting this item was not for publication
   2. Audit and Risk Committee annual report – at the time of the meeting this item was not for publication
   3. Annual report lessons learned progress – report attached
   4. Annual report data analytics advisory audit report – at the time of the meeting this item was not for publication
   5. Annual report and financial statements 2024/25 – report attached
8. Finance
   1. Management accounts – monthly management accounts are available on the Income and Expenditure page
9. Corporate risk management update – at the time of the meeting this item was not for publication
10. Lines of defence to ensure compliance with statutory obligations – at the time of the meeting this item was not for publication
11. Business continuity and cyber security update – at the time of the meeting this item was not for publication
12. Contingent Labour Fraud Update – at the time of the meeting this item was not for publication
13. Any other business – this was an oral item

24 April 2025

1. Introductions and apologies – this was an oral item
2. Declarations of interests – this was an oral item
3. Matters arising from the previous meeting – the minutes from the previous meeting are below
4. Deputy Chief Executive Officer’s update – this was an oral item
5. Internal audit
   1. Internal audit update – at the time of the meeting this item was not for publication
   2. Penalty Setting internal audit report – at the time of the meeting this item was not for publication 
   3. Key financial controls: fixed assets internal audit report – at the time of the meeting this item was not for publication
   4. Research, intelligence and analysis internal audit report – at the time of the meeting this item was not for publication
6. External audit
   1. External audit progress update – at the time of the meeting this item was not for publication
   2. External audit recommendations progress update – at the time of the meeting this item was not for publication
7. Finance
   1. Management accounts – monthly management accounts are available on the Income and Expenditure page
8. Annual report and related annual compliance reports
   1. Annual report: review of draft of Part B (assurance report) section – covering report attached. The final full annual report is available here.
   2. Draft Audit and Risk Committee annual report – covering report attached. The final Audit and Risk Committee annual report is available at the top of this page.
   3. Cyber security assurance report – at the time of the meeting this item was not for publication
   4. Environmental, social and governance (ESG) reporting – at the time of the meeting this item was not for publication
   5. Risk management – Orange Book compliance – report attached
   6. Annual report lessons learned update – report attached
9. Corporate risk management update – at the time of the meeting this item was not for publication
10. Business continuity strategy statement – annual review – at the time of the meeting this item was not for publication
11. Audit and Risk Committee effectiveness review – report attached
12. Audit and Risk Committee annual work programme – at the time of the meeting this item was not for publication
13. Compliance report – report attached
14. Security report – at the time of the meeting this item was not for publication
15. Any other business – this was an oral item

23 January 2025

1. Introductions and apologies – this was an oral item
2. Declaration of Interests  – this was an oral item
3. Matters arising from the previous meeting – the minutes from the previous meeting are below
4. Deputy Chief Executive Officer’s update – this was an oral item
5. Internal audit
   1. Internal audit update – at the time of the meeting this item was not for publication
   2. Service complaints – at the time of the meeting this item was not for publication
   3. Widening FOI regulatory interventions – at the time of the meeting this item was not for publication
6. External audit and annual report 
   1. External audit plan 2024/25 – at the time of the meeting this item was not for publication
   2. Changes to accounting treatments and specialist report commissioning – report attached
   3. Implementation of external audit recommendations – report attached
   4. Annual report approach and timetable – report attached
   5. Implementation of lessons learned from 2023/24 ARA production – report attached
7. Finance 
   1. Management Accounts – monthly management accounts are available on the Income and Expenditure page
   2. Draft Financial Scenarios - Medium Term Financial Plan (MTFP) – at the time of the meeting this item was not for publication
8. Corporate risk management – at the time of the meeting this item was not for publication
9. Business continuity and cybersecurity update  – at the time of the meeting this item was not for publication 
10. For assurance (discuss by exception):
    1. Compliance report – report attached
    2. Security report – at the time of the meeting this item was not for publication
    3. Any other business – this was an oral item

17 October 2024 

1. Introductions and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Commissioner’s update – this was an oral item
5. Internal audit
   1. Internal audit update – at the time of the meeting this item was not for publication
   2. Transformation programme – at the time of the meeting this item was not for publication
   3. Conflicts of interest – at the time of the meeting this item was not for publication
6. Risk and Opportunity Management – annual review – at the time of the meeting this item was not for publication
7. Audit and Risk Committee effectiveness review – report attached
8. Annual report – lessons learned – report attached
9. Finance 
   1. Management Accounts – monthly management accounts are available on the Income and Expenditure page
   2. Finance Target Operating Model (TOM) update – report attached
   3. Implementation of external audit recommendations – report attached 
10. Security report – at the time of the meeting this item was not for publication
11. Internal compliance report – report attached
12. Any other business – this was an oral item

20 June 2024

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. External audit update – at the time of the meeting this item was not for publication
6. Internal audit
   1. Internal audit progress – at the time of the meeting this item was not for publication
   2. Internal audit opinion – at the time of the meeting this item was not for publication
7. ICO accountability framework – at the time of the meeting this item was not for publication
8. Audit and Risk Committee annual report - at the time of the meeting this item was not for publication
9. Annual Report and Financial Statements 2023/24
10. Business Continuity and Cyber Security update – at the time of the meeting this item was not for publication
11. Internal Compliance lines of defence – at the time of the meeting this item was not for publication
12. Corporate risk management – at the time of the meeting this item was not for publication
13. Finance – at the time of the meeting this item was not for publication
    1. Recent income and expenditure – at the time of the meeting this item was not for publication
    2. Single ender contract awards – at the time of the meeting this item was not for publication
14. Security report – at the time of the meeting this item was not for publication
15. Implementation of lessons learned from 2022/23 ARA production – at the time of the meeting this item was not for publication
16. Any other urgent business – this was an oral item

25 April 2024

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. Internal Audit Update:-
   1. Internal Audit update - at the time of the meeting this item was not for publication
   2. Audit reports completed since the last meeting - at the time of the meeting this item was not for publication
   3. Annual internal audit plan 2024/25 - at the time of the meeting this item was not for publication
6. External audit update:-
   1. External audit update - at the time of the meeting this item was not for publication
   2. Environmental, Social and Governance (ESG) report
   3. Annual report – draft part B (Accountability Report)
7. Finance
   1. Most recent income and Expenditure report – monthly management accounts are available on the Income and Expenditure page
   2. Specialist reports to be commissioned from third parties on areas of particular judgements estimates or valuations – this is an oral item
   3. Single tender contract awards - at the time of the meeting this item was not for publication
8. Risk
   1. Corporate risk management - at the time of the meeting this item was not for publication
   2. Risk – Orange Book compliance
   3. Cyber Security assurance report - at the time of the meeting this item was not for publication
9. Draft Audit and Risk Committee Annual Report
10. Fraud and Whistleblowing report
11. Security Report – at the time of the meeting this item was not for publication
12. Audit and Risk Committee effectiveness review – progress update
13. Implementation of lessons learned from 2022/23 ARA production
14. Audit and Risk Committee annual work programme - at the time of the meeting this item was not for publication
15. Any other urgent business – this was an oral item

18 January 2024

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. Finance
   
   a. Scenario planning for financial outcomes – at the time of the meeting this item was not for publication
   
   b. Most recent income and expenditure report - monthly management accounts are available on the Income and Expenditure page
   
   c. Changes to accounting treatments – this was an oral item
   
   d. Single tender contract awards – this was an oral item
6. Risk and opportunity management
   
   This risk and opportunity register is available as a paper on the Management Board page
   
   a) Business Continuity and Cyber Security update, including annual review of Business Continuity Policy Statement - at the time of the meeting this item was not for publication
   
   b) Corporate risk review outcomes, including annual review of Risk Management Policy - at the time of the meeting this item was not for publication
   
   c) Counter fraud risk assessment findings - at the time of the meeting this item was not for publication
7. External audit and Annual Report
   
   a) External audit plan 2023/24 - at the time of the meeting this item was not for publication
   
   b) Implementation of lessons learned from 2022/23 ARA production
   
   c) Annual report approach and timetable 2023/24
8. Internal Audit
   
   a. Internal audit quarterly update - at the time of the meeting this item was not for publication
   
   b. Audit reports completed since the last meeting – at the time of the meeting these items were not for publication
9. Fraud and Whistleblowing
10. Security Report – at the time of the meeting this item was not for publication
11. Any other urgent business – this was an oral item

3rd November 2023

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. Risk Register Annual Report – at the time of the meeting this item was not for publication
6. Internal Audit
   1. Internal audit update - at the time of the meeting this item was not for publication
   2. Audit reports completed since the last meeting
      1. Cyber security report – at the time of the meeting this item was not for publication
      2. Conflicts of interest - at the time of the meeting this item was not for publication
      3. Binding corporate rules (BCR) assessment management - at the time of the meeting this item was not for publication
7. Annual Report- lessons learned
8. Audit and Risk Committee annual effectiveness review
9. Finance
   1. Most recent income and expenditure reports– monthly management accounts are available on the Income and Expenditure page
   2. Single tender contract awards – at the time of the meeting this item was not for publication
10. Security report- at the time of the meeting this item was not for publication
11. Fraud and Whistleblowing
12. Any other urgent business – this was an oral item

30 June 2023

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. External audit annual report – at the time of the meeting this item was not for publication
4. Audit and Risk Committee Annual Report 2022/23 - at the time of the meeting this item was not for publication
5. Annual Report and Financial Statements 2022/23 – at the time of the meeting this item was not for publication
6. Any other urgent business – this was an oral item

19 June 2023

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this was an oral item
5. External audit annual report – this was an oral item
6. Update on Estates, Climate and Environment
7. Cyber Security Assurance Report -at the time of the meeting this item was not for publication
8. ICO Data Protection Compliance
9. ALB Audit Chair’s Assurance Letter
10. Audit and Risk Committee Annual Report 2022/23 - at the time of the meeting this item was not for publication
11. Annual Report and Financial Statements
12. Oversight of arrangements for compliance with statutory obligations at the time of the meeting this item was not for publication
13. Government Functional Standards
14. Fraud reporting
15. Risk and opportunity management – corporate risk review outcomes
    • The risk and opportunity register is available as a paper on the Management Board page
16. Business continuity and Cyber Security update – at the time of the meeting this item was not for publication
17. Audit and Risk Committee effectiveness review progress update
18. Internal audit - at the time of the meeting this item was not for publication
19. Finance – single tender contract awards - at the time of the meeting this item was not for publication
20. Any other urgent business – this was an oral item

24 April 2023

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. Internal audit –
   1. Case Management
   2. Risk management
   3. Procurement and contract management
   4. Guidance development
   5. Civil monetary penalty recording
   6. Follow up report
   7. Annual report
6. Annual internal audit plan - at the time of the meeting this item was not for publication
7. Risk and opportunity management
   • This risk and opportunity register is available as a paper on the Management Board page
8. Finance
   • Income and Expenditure report – monthly management accounts are available on the Income and Expenditure page
   • Specialist reports to be commissioned from third parties on areas of particular judgements, estimates or valuations - this is an oral item
   • Single tender contract awards - at the time of the meeting this item was not for publication

9. External audit – at the time of the meeting this item was not for publication
10. Annual report update
11. Audit and Risk Committee annual work programme
12. Security Report – at the time of the meeting this item was not for publication
13. Fraud and Whistleblowing
14. Any other urgent business – this was an oral item

17 January 2023

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. Business Continuity Strategy Statement – Annual Review (statement 1, statement 2)
6. Ransomware Desktop Assessment / Playbook – this is an oral item
7. Risk and opportunity management

• • Risk Management Policy Review - at the time of the meeting this item was not for publication
  • Corporate Risk Outcomes - at the time of the meeting this item was not for publication
  • This risk and opportunity register is available as a paper on the Management Board page

8. External audit – at the time of the meeting this item was not for publication
9. Annual Report and Financial Statements approach
10. Finance

• November 2022 Income and Expenditure report – monthly management accounts are available on the Income and Expenditure page
• Changes to accounting standards - this was an oral item
• Single tender contract awards – at the time of the meeting this item was not for publication

11. Internal Audit Update - at the time of the meeting this item was not for publication
12. Corporate Charge Cards Audit Progress Report
13. Outstanding audit recommendations - at the time of the meeting this item was not for publication
14. Security report – at the time of the meeting this item was not for publication
15. Fraud and whistleblowing report
16. Any other urgent business – this was an oral item

10 October 2022

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. NAO Audit and Risk Committee effectiveness tool
6. Reserves Policy
7. Internal Audit Update:-
   • Internal Audit Progress Report – at the time of the meeting this item was not for publication
   • Core Financial Controls – Corporate Credit Cards – at the time of the meeting this item was not for publication
   • Cyber Security Audit Follow Up – July update – at the time of the meeting this item was not for publication
8. External audit update – this is an oral item
9. Annual Report Lessons Learned
10. Risk and opportunity management
    • This risk and opportunity register is available as a paper on the Management Board page
    • Risk Register Annual Report - at the time of the meeting this item was not for publication
11. Finance
    • August 2022 Income and Expenditure report – monthly management accounts are available on the Income and Expenditure page
    • Single tender contract awards – at the time of the meeting this item was not for publication
12. Outstanding audit recommendations - at the time of the meeting this item was not for publication
13. Security Report – at the time of the meeting this item was not for publication
14. Fraud and Whistleblowing
15. Any other urgent business – this was an oral item

20 June 2022

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. Internal audit
   • Internal audit progress report
   • Workforce planning audit report
   • Performance reporting and management information audit report
   • Internal annual report
6. Audit and Risk Committee Annual Report – at time of the meeting this item was not for publication
7. External Audit – at the time of the meeting this item was not for publication
8. Annual Report and Financial Statements 2012/22 -
9. ICO Data Protection Compliance
10. Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018
11. ALB Chair’s assurance letter
12. NAO Audit and Risk Assurance Committee effectiveness tool
13. Risk management- Corporate Risk Review Outcomes- at the time of this meeting this item was not for publication
14. Finance
    • Most recent income and expenditure report monthly management accounts are available on the Income and Expenditure page
    • Single tender contract awards- at the time of the meeting this item was not for publication
15. Outstanding audit recommendations - at the time of the meeting this item was not for publication
16. Indicative three-year internal audit plan
17. Any other urgent business – this was an oral item
18. Internal audit provision- update on proposals for future internal audit provisions from April 2023- at the time of the meeting this item was not for publication

25 April 2022

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. Compliance Assurance – at the time of the meeting this item was not for publication
6. Update on Estates and Climate and Environment
7. Procurement Update – at the time of the meeting this item was not for publication
8. Internal Audit:-
   
   • Internal Audit update
   • Cyber Security audit recommendations update – at the time of the meeting this item was not for publication
9. Annual Internal Audit Plan
10. Risk Management
    • Corporate Risk Target Score Deep Dive – at the time of the meeting this item was not for publication
    • Corporate Risk Review Outcomes
    • The risk and opportunity register is available as a paper on the Management Board page
11. External audit update – at the time of the meeting this item was not for publication
12. Annual Report – draft Audit Committee Annual Report and draft “Part B” Accountability Report – at the time of the meeting this item was not for publication
13. Finance
    
    • Most recent income and Expenditure report – monthly management accounts are available on the Income and Expenditure page
    • Single tender contract awards – at the time of the meeting this item was not for publication
14. Audit & Risk Committee Annual Work Programme
15. Outstanding audit recommendations - at the time of the meeting this item was not for publication
16. Security Report – at the time of the meeting this item was not for publication
17. Fraud and Whistleblowing
18. Any other urgent business – this was an oral item

10 January 2022

1. Introduction and apologies – this was an oral item
2. Declaration of Interests – this was an oral item
3. Matters arising from the previous meeting – the minutes of the previous meeting are below
4. Deputy Chief Executive Officer’s Update – this is an oral item
5. Internal Audit
   1. Internal Audit Progress Report
   2. Cyber Security Audit Report – at the time of the meeting this item was not for publication
   3. Cyber Security Additional Information – at the time of the meeting this item was not for publication
   4. Core Financial Controls Audit Report
   5. Stakeholder Management Audit Report
6. Compliance with Government Functional Standards
7. Business Continuity Strategy Statement
8. Risk Management Policy
9. Corporate Risk Review Outcomes
10. Finance
    • November 2021 income and Expenditure report – monthly management accounts are available on the Income and Expenditure page
    • Changes to accounting standards
    • Single Tender Contract awards – at the time of the meeting this item was not for publication
11. External audit update – at the time of the meeting this item was not for publication/ this is an oral item
12. Annual Report Timetable
13. Outstanding audit recommendations - at the time of the meeting this item was not for publication
14. Fraud and Whistleblowing
15. Security Report – at the time of the meeting this item was not for publication
16. Any other urgent business – this was an oral item