Minutes of the Audit and Risk Committee: February 2026

Present

David Watt, Non-Executive Director (Chair)

John Burns, Non-Executive Director

Chris Andrew, Non-Executive Director

Jennifer Connelly, Non-Executive Director

In attendance

Yvette Greener, Chief Operating Officer

Lindsey McIntosh, Director of Performance and Service Improvement (Via MS Teams)

Marlene Anderson, COPFS Director of Finance and Procurement

Sanya Ahmed, Senior Audit Manager, Audit Scotland

Paul Cooper, Internal Audit Manager (IAM)

Douglas Shepherd, Senior Internal Audit Manager (SIAM).

Pamela Wilkinson,

Katie Woods, COPFS Head of Chief Operating Officer Office (Via MS Teams)

Matthew Beattie

Christopher Hastings, COPFS Corporate Governance and Briefing Coordinator (Secretariat)

Apologies

John Logue, COPFS Crown Agent and Chief Executive

Keith Dargie, COPFS Chief Digital Officer

Rachel Browne, Audit Director, Audit Scotland

The Chair welcomed members, noted apologies, and welcomed new Non-Executive Directors Chris Andrew and Jennifer Connelly to their first meeting. No declarations of interest were raised.

It was noted that Agenda Item 4 would be taken later in the meeting due to the Crown Agent’s unavailability.

The Chair introduced ARC Paper 34 (ARC Minutes 12112025). The minutes of the meeting held on 12 November 2025 were approved.

ARC Paper 35a (Audit Action Tracker) was then introduced. The Committee reviewed the paper and expressed concern about the number of overdue and partially implemented actions. They also emphasised the need for stronger accountability, clearer ownership of actions, and more definitive status reporting. Members noted that several updates described activity but did not clearly demonstrate progress towards closure.

The Committee was clear that where actions are delayed, this should be stated explicitly, with reasons and a credible revised completion date. The quality of management responses to audit recommendations was also discussed, with emphasis on responding to the underlying risk rather than the wording alone.

ACTION: Chief Operating Officer to review outstanding audit actions, confirm which can be closed, strengthen management responses and timescales for remaining actions, and liaise with Internal Audit as required.

Internal Audit and Audit Scotland provided introductory briefings for new Committee members, outlining their respective roles, responsibilities and assurance approaches. They also offered up follow up sessions to give more in depth inductions due to the time constraints today.

The Committee welcomed the briefings and the Committee will consider the offer of follow up sessions to support members’ induction.

ACTION: Internal Audit to circulate introductory briefing materials to Committee members and the Committee consider the need for an informal follow up session ahead of the next meeting.

The Chief Operating Officer and Director of Performance and Service Improvement introduced ARC Paper 38 (Risk Approach Paper - ARC 18.02.2026)

The Director of Performance and Service Improvement discussed the proposed shift to a more mature and consistent risk management framework, including the development of a revised risk management strategy, a new corporate and strategic risk register, and clearer differentiation between strategic, corporate and directorate level risks.

The Committee supported the direction of travel but emphasised that the framework must remain practical and proportionate. The Chair stressed that the objective is stronger ownership and embedding of risk management in day to day decision making, rather than compliance with process for its own sake.

The discussion referenced recent operational pressures, including High Court time bar risks, as an example of known risks that require earlier escalation and action, reinforcing the need for the reset.

The Committee noted that risk appetite is a strategic decision and should be approved by the Strategic Board, with ARC providing scrutiny and challenge.

ACTION: Director of Performance and Service Improvement to circulate the draft Risk Management Strategy to Committee members for comment prior to consideration by the Strategic Board.

The Director of Finance and Procurement introduced the ARC Paper 39 (ARC Assurance Map Group 4 Feb 2026) and was happy to discuss the contents of it.

The Committee discussed the assurance map and raised concerns about the clarity and consistency of ratings. Members questioned what a “green” rating represents in practice and what evidence would trigger an amber assessment. They emphasised that meeting minimum requirements should not be conflated with effective assurance, and that the purpose of assurance mapping is to support the Annual Governance Statement and Board sign off.

Concern was expressed that issues identified through Internal Audit, particularly in HR and Health and Safety, were not always clearly reflected in the assurance map.

The Committee agreed that moving from a four lines to a three lines model would improve clarity.

Internal Audit presented progress updates, two final audit reports on Case Management and Health and Safety, thematic insight work, and the draft Internal Audit Plan for 2026 to 2027.

The Committee noted that both audits received reasonable assurance. A typographical error in the Health and Safety report was identified where “limited” should read “reasonable”.

The Committee challenged the realism of proposed implementation timescales in the Case Management report, queried whether March referred to 2026 or 2027, and expressed concern that some management responses appeared tactical rather than addressing strategic case management risks.

Internal Audit agreed to revisit recommendation 4 relating to NICP off table and revise.

The Committee discussed the draft Internal Audit Plan and requested greater clarity on the purpose, timing and assurance value of proposed reviews, including Designed for Success, Digital Evidence Sharing Capability and cyber resilience. The plan was not approved at this stage.

DECISION: The Committee agreed that assurance mapping should transition to a three lines of assurance model.

ACTION: Assurance mapping to be revised to reflect a three lines model, with clearer explanation of ratings, thresholds and underpinning evidence, aligned to revised operating structures and the emerging risk framework.

ACTION: Internal Audit and Chief Operating Officer to review the draft 2026 to 2027 Internal Audit Plan, including sequencing and scope, and recirculate a revised draft to Committee members.

The Director of Finance and Procurement presented ARC Paper 43 (Financial performance report P9 – ARC)

The Committee noted a balanced position at the end of December, with an underspend largely attributable to recruitment delays. The reputational risk associated with underspend was acknowledged.

Accounting policies for 2025-26 had not yet been circulated to the Committee for approval

The Committee thanked the finance team for managing a challenging financial position and noted the favourable outlook for 2026 to 2027, subject to stable casework volumes.

Audit Scotland then presented ARC Paper 45 (Audit Scotland Interim Evaluation). They provided an update on audit fee arrangements and staffing changes.

ACTION: Proposed 2025-26 accounting policies to be circulated to Committee members for approval by correspondence.

ACTION: Timetables for 2025-26 report and accounts need to be approved by the ARC Committee.

The Committee noted that the Crown Agent was unable to attend so the Chief Operating Officer provided a brief update.

ARC Paper 37 (20250806 Table of litigation for ARC) was noted.

The Committee acknowledged ongoing operational pressures in High Court casework following the loss of COVID related time bar extensions and the steps being taken to mitigate risk.

The Chair introduced ARC Paper 46 (COPFS meeting planner 2026), the draft meeting calendar and programme of work for 2026.

The Committee agreed to include HMIPS and Inspectorate Tracker updates at the May meeting and noted that Internal Audit would provide a progress update in August.

No further business was raised. The Chair thanked attendees and closed the meeting.