Group Audit and Risk Assurance Committee (ARAC) Terms of Reference

8. Duties and Delegated Responsibilities

8.1 The Committee shall have oversight and carry out the duties detailed below for the Company, major subsidiary undertakings and the Group as a whole, as appropriate.

8.2 The Committee shall discharge these responsibilities on a risk-based and proportionate basis through its annual workplan, focusing on matters that are material to the Group’s financial reporting, risk profile, internal control environment, assurance framework, public accountability obligations or Board decision-making.

8.3 Examples included in this section are illustrative and shall not limit the Committee’s authority to consider any matter within its remit. Detailed cyclical requirements may be captured in the annual ARAC workplan, policy approvals schedule or delegated authority frameworks.

A. Financial Information and Reporting

8.A1 Monitor the integrity, clarity and completeness of the Company’s and Group’s financial statements, Annual Report and Accounts and related formal reporting, and report to the Board on significant financial reporting matters and judgements.

8.A2 Review and challenge significant accounting policies, estimates, judgements, methodologies and treatments, including, where material, expected credit losses, fair value valuations, overlays, staging and significant or unusual transactions.

8.A3 Review material disclosures and information presented with the financial statements, including strategic, governance, audit, risk management and internal control reporting.

8.A4 Review, challenge and, where within delegated authority, approve material financial information to be provided to the Shareholder, Government or Parliament, including reporting required under the Shareholder Relationship Framework, Managing Public Money, Government Accounting requirements or other applicable public-sector requirements.

8.A5 Where the Company is responsible for providing to the Department for Business, Innovation, Science and Trade (or successor Department) financial reporting information for assets and liabilities that are held directly on their Statement of Financial Position the Committee shall review, challenge, and approve before this information is provided at key reporting dates including year-end. This includes, but is not limited to, the Covid Guarantee Loan Schemes Expected Credit Losses and fraud estimates and Future Fund fair valuations.

8.A6 Review going concern and viability assessments, associated disclosures and relevant Shareholder support or assurance arrangements, and advise the Board accordingly.

8.A7 Recommend the Annual Report and Accounts, or relevant financial statements, to the Board for approval.

B. Narrative Reporting, Sustainability and Statutory Disclosures

8.B1 Review the Annual Report and Accounts and advise the Board on whether, taken as a whole, it is fair, balanced and understandable and provides the information necessary for stakeholders to assess the Group’s performance, business model, risk profile, climate-related disclosures, and strategy

8.B2 Review material narrative reporting and disclosures within the Committee’s remit, including statements on risk management, internal controls, principal and emerging risks, going concern, viability including sustainability-related matters.

8.B3 Review, where material or legally required, non-financial reporting and related assurance arrangements, including the integrity of climate-related financial disclosures, sustainability disclosures, wider climate and sustainability related matters, and the Modern Slavery Statement.

C. Risk Appetite, Risk Management and Risk Strategy

8.C1 Review and recommend to the Board the Group’s overall risk appetite, tolerance and risk strategy, and oversee performance against approved appetite.

8.C2 Review the Group’s current and prospective risk profile, including principal and emerging risks, material concentrations, risk-return considerations, public policy objectives and strategic plan delivery.

8.C3 Review the effectiveness of the Group’s Risk Management Framework, Risk Taxonomy, principal risk methodologies, key risk policies and risk assessment processes, including whether these remain appropriate to the Group’s activities, scale, complexity and risk profile.

8.C4 Review reports on material breaches of risk appetite, limits or policy requirements and the adequacy of management’s proposed actions.

8.C5 Review material risks associated with major programmes, interventions, guarantees, investment activities and other Board-referred matters.

8.C6 Review, where material, sustainability, climate, cyber, operational resilience, reputational, financial crime, subsidy control and other compliance-related risks within the Committee’s remit.

8.C7 Advise the Board on the adequacy of risk governance, controls and assurance arrangements for material risks.

D. Internal Controls and Assurance

8.D1 Support the Board in establishing, maintaining and reviewing the effectiveness of the Group’s risk management and internal control framework, including material financial, operational, reporting and compliance controls.

8.D2 Review management’s assessment of material internal controls, including the methodology, evidence, assurance and conclusions supporting any Board declarations or Annual Report disclosures.

8.D3 Review assurance from Internal Audit, External Audit, Risk, Compliance and other assurance providers on the effectiveness of governance, risk management and internal controls.

8.D4 Review significant deficiencies, control failures, material weaknesses and remediation plans, including management’s assessment of root causes, progress and effectiveness of actions taken.

8.D5 Review the effectiveness and coordination of the Group assurance framework, including first, second and third line assurance arrangements, and report its overall conclusions to the Board.

E. Compliance, Fraud, Financial Crime, and Whistleblowing

8.E1 Review the adequacy and effectiveness of whistleblowing and Speak Up arrangements, including arrangements for confidential reporting, independent investigation, follow-up action, themes and lessons learned.

8.E2 Review the adequacy and effectiveness of arrangements for preventing, detecting, responding to and reporting fraud, bribery, corruption, money laundering, sanctions and other financial crime risks including the annual Money Laundering Reporting Officer report.

8.E3 Review significant legal, regulatory, compliance, shareholder, Government and Parliamentary accountability matters within the Committee’s remit, including material findings from second-line compliance activity.

8.E4 Approve or recommend to the Board, where required under the Policy Governance Framework or applicable delegations, policies, statutory strategies (e.g. tax strategy) or statements within the Committee’s remit.

F. Risk and Compliance Function and Chief Risk Officer

8.F1 Keep under review the remit of the Risk and Compliance function and ensure it has the appropriate resources and capabilities alongside access to information to enable it to perform its function effectively and in accordance with the relevant professional standards

8.F2 Recommend to the Board the appointment or removal of the Chief Risk Officer and provide input into the Chief Risk Officer's performance assessment and remuneration arrangements where appropriate.

8.F3 Ensure the Chief Risk Officer has unrestricted access to the Committee and Committee Chair, including private meetings without executive management present.

8. F4 Review material reports from the Chief Risk Officer, significant risk and compliance findings, management responses and progress implementing agreed actions.

8.F5 Oversee the remit, standing, independence, effectiveness, resourcing and access of the Risk and Compliance Function, including reviewing material reports from the Chief Risk Officer, monitoring management responsiveness to findings and recommendations, ensuring appropriate direct access to the Committee Chair and Board Chair.

8.F6 Assess annually the effectiveness, independence, objectivity and quality of the Risk and Compliance Function including relevant expectations under applicable professional standards.

G. Internal Audit

8.G1 Approve and annually review the Internal Audit Charter, including Internal Audit’s mandate, authority, role, responsibilities, scope and services.

8.G2 Approve the risk-based annual Internal Audit Plan and review whether Internal Audit has sufficient budget, resources, skills, access and information to deliver it effectively.

8.G3 Authorise the appointment and removal of the Managing Director Internal Audit and approve or provide input to remuneration and performance evaluation in accordance with applicable Company processes.

8.G4 Ensure the Managing Director Internal Audit has unrestricted access to the Committee and Committee Chair, including private meetings without executive management present.

8.G5 Review Internal Audit reports, the annual Internal Audit opinion, significant findings, management responses and progress implementing agreed actions.

8.G6 Oversee the remit, standing, independence, effectiveness, resourcing and access of the Internal Audit Function, including reviewing material reports from the Managing Director Internal Audit, monitoring management responsiveness to findings and recommendations, ensuring appropriate direct access to the Committee Chair and Board Chair.

8.G7 Assess annually the effectiveness, independence, objectivity and quality of Internal Audit, including the quality assurance and improvement programme and relevant expectations under applicable internal audit standards including the Global Internal Audit Standards.

H. External Audit

8.H1 Oversee the relationship with the External Auditor and discharge, to the extent applicable to the Company, responsibilities under the Financial Reporting Council Audit Committees and the External Audit: Minimum Standard, including the matters set out below.

8.H2 recommending the appointment, re-appointment or removal of the External Auditor, subject to the Shareholder Relationship Framework and applicable approvals;

8.H3 approving the External Auditor’s terms of engagement, remuneration, audit scope and annual audit plan;

8.H4 reviewing and monitoring the External Auditor’s independence, objectivity, qualifications, expertise, resources and compliance with relevant ethical and professional requirements;

8.H5 developing and monitoring policies on non-audit services and the employment of former External Auditor staff;

8.H6) reviewing audit findings, significant accounting and audit judgements, errors, representation letters, management letters and management responses; and

8.H7 assessing the effectiveness and quality of the external audit process

8.H8 ensure the External Auditor has unrestricted access to the Committee and Committee Chair, including private meetings without executive management present at least annually.

I. Strategic Transactions, Programmes and Public Accountability

8.I1 Where requested by the Board, review the material risk, control and assurance implications of proposed strategic initiatives, major programmes, Government interventions, guarantees, investment activities and funding schemes before final Board approval.

8.I2 Review significant issues arising from Public Accounts Committee, National Audit Office, Shareholder or Government reviews where they fall within the Committee’s remit, and monitor management’s responses and agreed actions.