Audit and Risk Committee DRAFT Minutes – September 2026

The members of the Audit and Risk Committee (‘the Committee’), Internal Audit (IA) and External Audit (EA) attended a private session.

The Chair welcomed Committee members and attendees to the meeting, alongside ESS Board member observers LA and PMc.

MS declared an interest in relation to her position as standing Deputy Chair of the Water Industry Commission for Scotland. Apologies were received from SJ, KH and IB.

MR introduced the ESS Programme Management set-up project. MR outlined the background to the change project, its purpose and the outcomes ESS seeks to achieve to support organisational planning and resilience. In discussion, the Committee:

• noted the importance of establishing clear and measurable success criteria for the programme
• highlighted the need for appropriate business continuity arrangements throughout the implementation of the Programme Management project
• recognised the importance of adopting agile principles to support future continuous improvement

The Committee welcomed the update and noted that a detailed presentation, with further discussion, would be provided at the next Board meeting.

Action: MR/KH to develop and share programme success criteria within the Programme Management system.

The minutes of the previous meeting held on 22 June 2026 were approved.

The running list of matters arising and the audit tracker were provided for the Committee’s information. MF provided an update on the November 2026 development session, outlining the proposed agenda and key topics for discussion.

RP presented the 2025/26 expenditure position to date, noting ongoing recruitment activity and progress on planning for the 2027/28 budget. In discussion, the Committee:

• noted the ongoing recruitment activity and budget monitoring arrangements
• highlighted the importance of embedding efficiency improvements in organisational processes

The Committee noted the paper.

RP presented a proposal to convert an existing vacant fixed-term post to a permanent position for external advertising. The Committee considered the rationale and anticipated benefits of the proposal and approved the recommendation for onward consideration by the Board.

AS presented the Corporate Risk Register, highlighting updates and areas that have been escalated. In discussion, the Committee:

• noted the ongoing capacity and prioritisation approaches
• highlighted appetite scoring on registers and considered a review of scoring
• considered exploring an assurance mapping arrangement with IA to strengthen evidence-based assurance reporting

It was agreed that the Corporate Risk Register would be presented at the 2 October 2026 Board meeting.

Action: MR/IA/NO to explore assurance mapping opportunities.

RP presented the revised Annual Report and Accounts. In discussion, the Committee:

• noted there were no matters of concern relating to contingent liabilities beyond those disclosed within the accounts, as well as no undisclosed off-balance-sheet arrangements
• considered minor presentational and formatting amendments
• thanked the Corporate Services and Communications team and the External Audit team for their hard work throughout the 2025/26 audit process

The Committee approved the revised Annual Report and Accounts for onward submission to the Board, subject to minor amendments.

RP presented the forward work plan, outlining recurring agenda items and future reporting requirements for the next year. The Committee noted the plan, highlighting the useful overview of future planning.

The Committee noted the recent fraud and irregularities update shared by IA, highlighting the opportunity to learn from wider public sector cases.

IA presented the Audit Committee Progress Report 2026/27, highlighting key updates. In discussion, the Committee:

• noted the Scottish Government Annual Assurance Opinion had moved from “reasonable” to “limited” assurance
• noted the revised Audit and Assurance Committee Handbook places greater emphasis on cyber security, risk appetite, governance arrangements, assurance mapping and stress testing
• highlighted the Institute of Internal Auditors’ latest “Risk in Focus” publication highlighted cyber security as a continuing priority risk area

The Committee noted the update, further discussing the value of an organisational stress-test exercise.

Action: RP to consider future timing of an organisational stress-test.

EA presented the draft International Standard on Auditing (ISA) 260 (ISA 260) report and gave a verbal update on the progress of ESS’ annual audit, noting the positive progress made and thanking ESS for its assistance. PM noted the remaining audit work related to final quality assurance and audit completion procedures.

The Committee noted the update and approved the ISA 260 report for onward consideration to the Board, subject to the agreed amendments and final audit completion procedures.

MF noted the schedule of forthcoming meetings and looked forward to the planned in-person Audit and Risk Committee development session in November 2026.

Marie Fallon

Chair, Audit and Risk Committee
Environmental Standards Scotland

[DATE]