Wednesday 26 February 2025
MICROSOFT TEAMS 10:00 – 13:00
(Private discussion 13:00-13:15)
ARC Members
- Maggie Waterston (Chair) NRS Non-Executive Director
- Anne Moises NRS Non-Executive Director
- Tim Wright NRS Non-Executive Director
ARC Attendees
- Alison Byrne, NRS CEO
- NRS, Director of Corporate Services & Accountable officer
- NRS, Director of Digital & Delivery
- NRS, Director of Information and Records Services
- NRS, Director of Statistics
- NRS, Director of Operations and Customer Services
- NRS, Chief Financial Officer
- Internal Auditor – Scottish Government
- Internal Audit Manager – Scottish Government
- Internal Audit Manager – Scottish Government (Observer)
- Engagement Director for NRS – Grant Thornton
- Engagement Manager – Grant Thornton
- Head of PMO (from 11:25am)
- Programme Manager, Archive Services (from 11am)
- NRS, Head of NRS Business Management
- NRS, Corporate Business Assurance Manager
- NRS, Business Management (Secretariat)
- Deputy Director, Information and Records Services (from 10:30am)
Apologies
- Internal Audit Manager – Scottish Government
- NRS, Director of Census Statistics
Welcome, Introductions and Apologies. Declaration of Interests & Matters Arising
1.1 Maggie Waterston welcomed everyone to the meeting. Apologies were noted as listed above.
1.2 There were no declarations of interests or matters arising.
2. Meeting held on 4 December 2024
2.1 The minutes for the meeting held on 4 December 2024 were approved with one minor change to para 10, fourth bullet point ‘GEAR’ to ‘GIAA (Government Internal Audit Agency)’.
2.2 A review of actions was undertaken. The action tracker would be updated accordingly.
3.1. NRS Corporate Issues Log
3.1.1 The Director of Corporate Services & Accountable officer and Corporate Business Assurance Manager introduced the NRS Corporate Issues Dashboard to the meeting and covered the following key points below:
- NRS were reviewing all risks and issues and were considering any impact in light of the TOM work
- Workshops were arranged with the senior team to review all NRS risks
- NRS were looking ahead to developing a pathway for closing each risk
- Work was progressing around moving all corporate issues to green
3.1.2 Tim Wright asked how prepared NRS were to take forward phase two of the Strategic Working Group (SWG) & Deloitte TOM work, post March 2025. NRS provided the following feedback below.
- Phase one (Jan to March) SWG were considering the initial high-level outputs of the TOM work. A period of reflection and co-production would then take place in April to consider these outputs (March - April)
- Phase two – (by the end of summer 2025) creation of a five-year delivery plan, with a ten-year target operating model
- Some of the initial outputs were informing NRS projects and risks
- ARC would receive regular updates on progress
3.1.3 Anne Moises requested target completion dates were provided in the risks and issues logs. Anne also asked how often EMB were reviewing the risks and issues logs. Alison Byrne advised EMB were carrying out deep dives on risks and issues every two months. Alison advised EMB were meeting in modes to allow more time to review issues and risks in more detail.
3.1.4 SG Internal Auditors noted staff workshops around the TOM work had been received positively and this would improve NRS transparency around decision making.
3.1.5. SG Internal Auditors asked if the Ancestry tribunal case was recorded on the risk or issues log. The Director of Corporate Services & Accountable officer confirmed this was being added to the logs. NRS were considering any potential impact and scoring was being considered as part of the ongoing litigation work.
3.1.6 Maggie Waterston thanked NRS for all the improvements made to the risk papers.
3.2. NRS Risk Dashboard & Risk Register
3.2.1 The Corporate Business Assurance Manager introduced the NRS Corporate Issues Dashboard to the meeting and covered the following key points below.
- A Risk Workshop was arranged for 6 March 2025 to review each risk in detail
Corporate Business Assurance were working with business areas to identify all risks ahead of the session
- Risk and issues escalation templates were being developed
- A RAKI Matrix was also being developed
- Corporate Business Assurance were feeding into a review of the NRS Business Continuity Plan, TOM work and a draft Climate Change Strategy
- NRS were considering scenario planning for the Ancestry tribunal case
3.2.2 Maggie Waterston noted it was good to have sight of the potential risks that were being considered by NRS.
3.2.3 Anne Moises asked how Directorate risks were escalated up to corporate level and auditors. Alison Byrne advised a risk flow diagram and the escalation process could be shared with ARC following the risk workshop. Maggie Waterson noted this would also be helpful to share with all NRS staff via a comms piece to help embed risk across the organisation.
Action A31/25: Share Risk Flow Diagram and risk escalation process with ARC and All NRS staff. Action Owner: Corporate Business Assurance Manager
3.2.4 Iain Burns asked how NRS considered capacity to resolve risks and if risk concurrency was guiding NRS business decisions. Alison Byrne advised that risk scoring and risk appetite would be reviewed at the risk workshop as some risks had high scoring. The Director of Corporate Services & Accountable officer advised NRS would provide more granular detail around the handling of risks.
3.2.5 SG Internal Auditors asked how NRS marked and recorded any interdependencies between issues and risks. The Director of Corporate Services & Accountable officer advised a collection of activity was recorded within the risk register and NRS would look to strengthen the linkage between these. The Corporate Business Assurance Manager advised the new escalation process would also help to capture more granular detail.
3.2.6 Alison Byrne advised that NRS had regular meetings with SG to review if NRS risks impacted on the wider SG portfolio. Alison advised any significant NRS risk that could impact SG could be escalated to SG. Alison advised she would circulate a paper presented to SG to ARC. Risks included Funding and financial impact of the Ancestry Tribunal.
Action A32/25: Circulate NRS paper submitted to SG with ARC. Alison Byrne
3.3. Tribunal Follow Up – For Discussion
3.3.1 The Director of Corporate Services & Accountable officer provided an update on the Ancestry Ireland vs ICO tribunal with the key points below.
- Ancestry Ireland had requested around 25 million digital images from NRS
- The vast majority of these were available from Scotland’s People Website
- The request was refused on discretion available to NRS under re-use of public information legislation
- Ancestry Ireland had challenged the NRS decision and ICO had upheld the original decision
- NRS were awaiting the outcome of the Tribunal and were planning for all potential outcomes
- NRS had received good feedback on the representations made at the tribunal
- NRS Framework would be reviewed with SG
- A paper updating EMB on the Tribunal would be shared with ARC
- NXDs would be kept up to date on progress of the tribunal
Action A33/25: Circulate EMB Tribunal update paper with ARC. Director of Corporate Services & Accountable officer
3.3.2 Tim Wright asked if NRS were considering a communications strategy for all outcomes and if NRS had plans for additional legislation to be brought in given the wider implications. The Director of Corporate Services & Accountable officer advised NRS were currently a third party at this stage of the tribunal and that ICO would have policy views for the wider UK legislative framework. The Director of Operations and Customer Services advised NRS were taking advice from SGLD legal colleagues on a communications strategy.
3.3.4 Maggie Waterston asked if there was potential to charge organisations for re-use of the information requested. The Director of Corporate Services & Accountable officer advised NRS did not currently have this business model but other organisations had digitised some of their assets and made them available under licence. Alison Byrne advised she was meeting with The National Archives to discuss how they managed their commercial assets.
3.3.5 Alison Byrne and NXDs gave thanks to all staff involved in this work.
3.4. Collection Audit Update – For Discussion
3.4.1 The Deputy Director, Information and Records provided an update on the Collection Audit with the key points below.
- NRS were in the process of meeting with all risk owners
- NRS were collaborating with 13 institutions on a communications strategy and had briefed SG on all the work
- NRS were on course to complete this work by the end of the financial year
3.4.2 Tim Wright asked what the overall response was from the meetings held. The Deputy Director, Information and Records advised all meetings had been received positively. Owners were pleased that NRS were carrying out proactive engagement and had been complimentary of NRS due diligence. The Deputy Director, Information and Records advised NRS were engaging with press and were planning to provide a full narrative and interviews ahead of a public announcement regarding the work. Alison Byrne advised SG had said it was testament to NRS to recover and preserve all records.
4. Update on Data Sharing and Information Governance workstreams
4.1 The Director of Statistics provided an update on Data Sharing workstreams with the key points below.
- The Working Group were on track for completion of project recovery tasks by the end of March 2025
- The key outcomes of the work were to reduce any identified risks to an acceptable level
NRS were reviewing and updating IT documentation and supplier management and assurance
- NRS were renewing SLA and funding for 2025-2026 and were looking to ensure this was completed by the end March 2025
- A list of activities would be taken beyond NHS CR Working Group. This included Data Protection policy and DPIA Review
- NRS had introduced multi-factor authentication to improve security
- NRS had accelerated the option of alternative accommodation
- This would remove reliance on NHS network and shift NRS staff over to the Scots network
- NRS held positive discussions with SG Digital Health and Care colleagues to form a delivery board that would develop a strategic roadmap for NHS CR Services
4.3 The Director of Information and Records Services provided an update on IG workstreams with the key points below.
- All data sharing arrangements and security and information assets would be reviewed as part of the discovery work
- NRS were updating the data sharing register which provided clarity on where to focus NRS resources to improve data sharing agreements and improvements to data sharing flows
Improvements made to DSAs and the data sharing review escalation process
- Engagement with data sharing business leads
- NRS were reviewing charging for some DSAs
- Some of the workstreams would link into the Fees, Charges and Income project
- The project was on track to be completed by the end of June 2025
4.4 Anne Moises asked if NRS had any informal data sharing arrangements. The Director of Information and Records Services confirmed there were some informal legacy agreements and discovery work was prioritising the risks of any informal agreements identified. The Director of Information and Records Services advised NRS were expanding the data sharing register to prioritise risks.
4.5 Tim Wright asked if any stakeholders had pushed back on formal DSAs being agreed. The Director of Statistics advised some stakeholders had pushed back but these were considered low risk. The Director of Statistics advised NRS Data Strategy proposals would be presented to EMB in March 2025, including lessons learned from NHS CR. This work would build on progressing NRS data maturity ambitions.
4.6 Maggie Waterston asked if the work planned around policies, procedures and training was on track. The Director of Information and Records Services confirmed these workstreams were on track to meet deadlines. SG Internal Auditors advised a follow up audit for advisory piece of work would be requested in July 2025.
5. Progress Report: Archive Services: Strategic Outline Case – Update
5.1 The Director of Information and Records Services provided an update on the Archive Services Strategic Outline Case with the key points below.
- The Archive Services Project Manager joined NRS in January 2025 and were taking this work forward
- The Archive Services Programme Board held its first meeting on 25 February 2025. The board would review progress of the Digital Archiving, Physical Storage and Environment Projects. The Director of Operations and Customer Services was confirmed as the SRO of the board
- The TOM work was helping to develop the business case for physical requirements
- Business case engagement and commitment was really high across the directorate.
- Workshops were held on the TOM which had helped to reduce siloed working
- Directorate staff were receiving weekly email updates on progress which also provided a feedback loop to Directors
- An Archive Services Session would be arranged for NXDs following completion of the Archive Services initiation work and TOR work
- NRS had assurance engagement with the DAO on the Digital Archiving project
- NRS would look to obtain assurance for the whole the programme to meet triple PA assurance
- A Terms of Reference was being developed for the new Digital Preservation System
- A Treatment area had been set up in TTH and work was underway to get working environments stabilised
- NRS were in collaboration with the SG culture cluster to consider shared storage challenges
5.2 ARC discussed internal audit recommendations in relation to agenda item 10.3 - Internal Audit Storage of Assets - Final report for ARC. Lorriane Twyford advised the main recommendations were to implement service agreements, implementing policies and procedures to better interlink the organisation and to have consistency across processes such as reporting, escalation, and scrutiny.
5.3 Anne Moises asked if NRS were feeding in any lessons learned and synergies into other NRS projects. For example, were any lessons learned from the Physical Storage Project fed into the Data Strategy project. The Director of Information and Records Services advised NRS were working through the definition and scope of NRS data to establish clarity around these terms and how they interlinked. The Director of Information and Records Services advised a common theme across NRS was keeping policies, procedures and accreditations up to date and NRS would consider how this was joined up.
5.4 The Director of Digital & Delivery advised data maturity work was underway to understand NRS data flows and interdependencies. The Director of Digital & Delivery advised Data Maturity and Data Strategy EMB updates would be shared with ARC at the next meeting. The Director of Statistics advised NRS would ensure these strategies were coherent with the wider SG data maturity programme.
5.5 Tim Wright noted concerns with NRS capacity to carry out all change projects, audit recommendations along with BAU. Alison Byne advised the TOM work would help to plan and sequence all workstreams and advised a Delivery partner would be starting in June 2025 to help with the delivery plan, the five-year strategy and NRS workforce planning.
5.6 Tim Wright asked how NRS were tracking the interdependencies between projects. The Director of Corporate Services & Accountable officer advised the internal audit recommendations had helped to improve communications between directorates and developed an improvement pathway to balance out pressures and tracking actions to take forward. Maggie noted future budget allocations wouldn’t be set so financial planning would be difficult. Alison noted this would be a real challenge with the current financial landscape.
6.1. Census Programme Closure
6.1.1 The Head of Census PMO provided an update on 2022 Census with the key points below.
- The programme would close on 13 March 2025
- Last release on multivariant data and flexible table builder published
- Further Census products were to be delivered through BAU
- The remaining Census outputs carried a residual risk at lower level of delivery
- NRS would review and consider key lessons learned from programme assurance reviews
- Census benefits and case studies were captured and had been shared with analysists
6.1.2 ARC noted the update.
6.3 The Head of Census PMO provided an update on FoPS with the key points below.
- Formal consultation on FoPS was set to begin
- The Strategic outline case funding bid was unsuccessful
- Negotiations with the Scottish Government (SG) were ongoing; NRS were seeking compromise on funding. Partial funding may come from core NRS resources
- NRS could not baseline the forward Delivery Plan at this stage
- Data sets were being secured from HMRC
- FoPS initiation phase would conclude by March 2025
- Governance structure for FoPS had been drafted
- Engagement had taken place with ONS and Northern Ireland counterparts
6.4.1 Tim Wright inquired about funding clarity. The Head of Census PMO confirmed a decision was expected by March 2025.
7. Operations and Customer Services
- The Director of Operations and Customer Services provided an update on Service Delivery Performance, Sustainability, and KPIs with the key points below.
- Q3 KPIs were presented
- Proposal to merge KPI 2 and KPI 3
- Some KPI data was delayed due to Oracle Cloud issues
- Next steps included development planning for 2025/26
- EMB would continue to review strategic KPIs over the coming months
- KPI scope would expand to include additional metrics
- Service mapping was underway
- A corporate dashboard was being developed to enhance KPI data presentation
8.1 NRS Financial Report
8.2 The Chief Financial Officer presented the NRS Financial Report with the key points below. The Chief Financial Officer advised since the paper had been drafted some figures had moved on slightly.
Next steps and actions:
- Finance would continue to report financial performance against budget for 2024/2025 as a formal update to ARC with ad hoc updates as required
- Finance would continue to engage with portfolio and FBP colleagues on 2024/2025 and future year budget allocations
- Finance were undertaking a different approach to income forecasting going forward and would report findings to ARC on assured forecasts
- Finance would continue to monitor capital expenditure and inform ARC of variances
- Future years financial planning would continue. Finance were working with the Portfolio, SG Finance and budget colleagues
- NRS Finance would outline future spending plans and priorities in line with strategic objectives
- Guide funding allocations provided NRS with a strategic risk in relation to commencement of year one of FoPS
- A decision was to be taken on the FoPS funding for 2025/26. ARC members would be updated once a solution had been agreed.ARC noted the 2024/25 forecast outturn position at January 2025 (Period 10) and plans for 2025/26
8.3 Maggie Waterston raised concerns around the accuracy of NRS’s forecasting. Maggie questioned the accuracy of budget allocations and forecasts and if staff required training in forecasting. The Chief Financial Officer noted some gaps were due to vacancies not being filled, some teams had significant buffers and emphasized the importance of setting realistic annual budget plans. The Director of Corporate Services & Accountable officer highlighted that the Oracle rollout, recruitment freeze (July–Nov) and emergency spending review had also significantly impacted NRS resourcing and planning. The Director of Corporate Services & Accountable officer advised a risk-based approach and lessons learned were being applied to future forecasting. NXDs noted savings were returned to SG.
8.4 Maggie Waterston linked these issues to KPIs and stressed NRS needed to understand resourcing needs to ensure end-to-end delivery.
8.5 Maggie Waterston requested the Chief Financial Officer provide an update via correspondence prior to the end of the financial year following the EMT planning session.
Action A34/25: Chief Financial Officer to provide a paper update to ARC via correspondence prior to the end of the financial year following the EMT planning session. Action owner: Chief Financial Officer
8.6 Anne Moises asked if the proposed Delivery Partner contract was flexible. The Director of Corporate Services & Accountable officer advised the contract had some flexibility as it took an outcome-based approach which wasn’t tied to spending or projects. Alison Byrne advised NRS were carrying out discovery work.
9. External Audit: Annual Audit Plan for financial year 2024/25 audit
9.1 Grant Thornton provided an update on external audit work with the key points below.
- The audit plan outlined the approach to reviewing financial statements and NRS ledger
- Accounts were expected mid-June, with a site visit scheduled for the last two weeks of June
- The audit was being conducted in the context of the current financial climate, though no significant changes had been noted
- Additional work was required due to the new ledger implementation, which would incur an additional fee
- The key developments of the audit documentation were outlined, including identified risks and date of ledger migration
- Confident ledgers would match by the end of the financial year
Interim audit work completed to date was outlined. Focus areas included:
- Income and expenditure journals.
- Materiality thresholds
- Performance materiality
9.2 ARC noted the update.
10.1 Internal Audit: Draft Internal Audit Plan for the coming financial year
10.2 Iain Burns provided introductions and gave a summary of wider SG audit work.
10.3 SG Internal Auditors introduced the Internal Audit progress reports for 2024/25 with the key points below.
- The 25/26 audit plan would have three audit reviews planned with time set aside for data and information sharing follow up audit
- 25/26 charges were delayed
10.4 Tim Wright asked if internal and external audit work were joined up in any way. SG Internal Auditors advised external audit did not place reliance on internal audit work and that internal audit focused on governance, risks and controls. Grant Thornton advised external audit had different areas of focus and were reviewing auditing standards, accounts, controls, corporate risks and governance. Iain advised SG internal audit were encouraging SG to carry out longer term financial projections.
10.5 Anne Moises noted internal audit were looking at planning for future changes to automation and AI. Anne noted this was a specialist area and asked if NRS were bringing in additional resource and expertise. SG Internal Auditors advised internal audit brought in EY to develop testing and would be taking this forward in 2025/26.
10.2 Progress reports on active/follow-up audits
10.3 Internal Audit: Storage of Assets - Final report for ARC
10.4 This item was covered earlier in the meeting under para 5.2.
11. NRS Audit Recommendations Status Report
11.1 The Committee noted the report.
12. Committee Reports - To Note and Questions
NRS Governance Report
12.1 The Committee noted the report.
NRS Portfolio report
12.2 The Committee noted the report.
NRS Assurance update
12.3 The Committee noted the report.
12.4 Maggie Waterston noted there were no cyber incidents over the festive period. The Director of Digital & Delivery advised NRS would be taking part in a multi-organisation cyber security exercise. A tabletop exercise was planned for later in 2025. The Director of Corporate Services & Accountable officer advised NRS staff had also attended counter terrorism training. ARC noted these were valuable exercises for cyber security and business continuity planning.
12.5 Tim Wright asked about the 17-week delay to the NRH roof repair. The Director of Corporate Services & Accountable officer advised that professional service advisors and scaffolding contractors had carried out a review in November 2024 and had identified additional activities due to the complex roof structure. The Director of Corporate Services & Accountable officer advised NRS had received assurances on costs. NRS had updated the business case plans and the project was due to be completed by the end March 2026.
13. To Note: ARC Forward Look for year ahead
13.1 The Forward Look was noted by all Committee members.
13.2 Maggie Waterston asked for the forward look to be updated so the timings for cyber discussions aligned with audit timescales.
Action A35/25: forward look to be updated so the timings for cyber discussions aligned with audit timescales. Action Owner: BMU
14. AOB & Date of Next Meeting
14.1 The Head of NRS Business Management advised NXD recruitment was live and new NXDs were estimated to start in May 2025.
15. The date of the next meeting was noted as 19 June 2025.
End
