Agenda Document Pack - Audit and Scrutiny Panel - 14/05/2026
North Lanarkshire Council · 14 May 2026
Back to Audit and Scrutiny Panel — 14 May 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
5 May 2026 Members of the Audit and Scrutiny Panel Chief Executive’s Office Rachel Blair Chief Officer (Legal, Democratic and Strategy) Civic Centre, Windmillhill Street, Motherwell ML1 1AB www.northlanarkshire.gov.uk Notice is given that a Meeting of the Audit and Scrutiny Panel is to be held in the Council Chamber, Civic Centre, Windmillhill Street, Motherwell, ML1 1AB on Thursday, 14 May 2026 at 14:00 PM which you are requested to attend. The agenda of business is attached. Rachel Blair Chief Officer (Legal, Democratic and Strategy) Members : Clerk Name: Karen Swan Clerk Telephone: 07919 730272 Clerk Email: committee@northlan.gov.uk S Watson, P Kelly, C Costello, M Hughes, J Hume, D Johnston, J Leckie, A McCrory, M McCulloch, J McLaren, G Robinson. Page 1 of 238
Page 2
Page 2 of 238
Page 3
Agenda 1 Declarations of Interest In Terms of the Ethical Standards In Public Life Etc. (Scotland) Act 2000 2 Housing Performance Update Submit report by the Chief Officer (Housing and Communities) providing information to the Audit and Scrutiny Panel in relation to the non-reporting of ‘the percentage (%) of reactive repairs appointments kept’. 5 - 10 Scrutiny Related Items 3 Quarterly Performance Assurance Submit report by the Chief Officer (Legal, Democratic and Strategy) bringing together a summary of the council’s performance reports in one composite assurance overview to support the Audit and Scrutiny Panel in maintaining strategic oversight and awareness of the Council’s performance reporting arrangements in line with the Panel’s remit to provide “independent review of the council’s governance, risk management, performance, and control frameworks”. 11 - 38 Audit Related Items 4 Audit and Risk Related Items - Action Log Submit report by the Chief Officer (Audit and Risk) tracking implementation of outstanding requests and recommendations made by the Panel in respect of audit and risk-related items. 39 - 46 5 Internal Audit Progress Report Submit report to the Chief Officer (Audit and Risk) providing an overview of Internal Audit activity and audit reports issued since the last update to the Panel in March 2026. 47 - 90 6 Internal Audit Follow-up of Implementation of Audit Recommendations Submit report by the Chief Officer (Audit and Risk) providing an update on the progress made in the implementation of Internal and External Audit recommendations. 91 - 110 7 Internal Audit Charter Submit report by the Chief Officer (Audit and Risk) seeking approval for the Internal Audit Charter. 111 - 132 Page 3 of 238
Page 4
8 Internal Audit Strategy Submit report by the Chief Officer (Audit and Risk) seeking endorsement of the attached Internal Audit Strategy for 2026-27 to 2028-29. 133 - 146 9 Internal Audit Plan 2026-27 Submit report by the Chief Officer (Audit and Risk) presenting the proposed Internal Audit Plan 2026-27. 147 - 154 10 Risk Management Update Submit report by the Chief Officer (Audit and Risk) seeking to support the Audit and Scrutiny Panel in the discharge of the aspect of its remit of monitoring the effective development and operation of risk management in the Council. 155 - 164 11 Risk Management Strategy Submit report by the Chief Officer (Audit and Risk) presenting the revised Risk Management Strategy to the Panel for noting. 165 - 210 12 Corporate Fraud Policy Submit report by the Chief Officer (Audit and Risk) detailing the Council’s approach to the prevention, detection and investigation of fraud across all Council service areas. 211 - 230 13 National Fraud Initiative - Update Submit report by the Chief Officer (Audit and Risk) informing of the progress made in response to the National Fraud Initiative data matching exercise. 231 - 238 Page 4 of 238
Page 5
North Lanarkshire Council Report Audit & Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref SL/KMcG Date 14/05/26 Housing Performance Update From Stephen Llewellyn, Chief Officer (Housing & Communities) E-mail LlewellynS@northlan.gov.uk 1. Background 1.1 Panel Members will recall the ‘quarterly performance assurance review’ report presented to the Audit and Scrutiny Panel on 13/11/25, which set out the outcomes of the assurance review of reports submitted to Council Committees during cycle 3 of 2025. Executive Summary This report provides information to the Audit and Scrutiny Panel in relation to the non- reporting of ‘the percentage (%) of reactive repairs appointments kept’, within the council’s quarterly performance assurance review report. The report informs the panel of the reasons why the housing service are currently unable to report on this indicator, and outlines the actions being taken to address this issue to enable reporting on the indicator in the future. The report also provides supplementary information on alternative performance indicators which give assurance on the repairs service being provided to tenants. Recommendations It is recommended that the Audit and Scrutiny Panel (1) Note the reasons why performance information on ‘the percentage (%) of reactive repairs appointments kept’ is currently unavailable and the actions underway to ensure that reporting on this indicator can be provided in future performance reports (2) Note the alternative key performance measures currently being reported, which provide assurance on repairs service provision for our tenants. The Plan for North Lanarkshire Priority Improve economic opportunities and outcomes Ambition statement (1) Ensure a housing mix that supports social inclusion and economic growth Programme of Work Statutory / corporate / service requirement Item 2 Page 5 of 238
Page 6
1.2 The composite report presented included performance information in relation to all services of the council, including the housing service, who have 22 indicators in the Strategic Performance Framework, covering all aspects of the council’s social landlord role. 1.3 The report presented on 13th November 2025 identified 5 red indicators within the housing report, however the narrative commentary under the section ‘Areas of Performance requiring improvement’ only provided information on 2 of these indicators 1.4 A further report presented to the Audit and Scrutiny Panel on 26/2/26 explained the reason for the discrepancy between the number of red indicators highlighted and the associated narrative, along with up to date commentary for the remaining 3 indicators. 1.5 Within the performance reports presented, it was highlighted that the housing service are unable to report on the ‘Housing Repairs - % of reactive repairs appointments kept’ indicator, as we do not currently have the facility to report this. 1.6 At the meeting on 26/2/26 members of the Audit and Scrutiny Panel asked that: “A report in relation to the non-reporting of reactive repairs appointments be submitted to the next meeting of the panel” 1.7 In response to this request the panel were advised that a report would be submitted to the May 2026 meeting of the Audit and Scrutiny Panel to provide a detailed response, in line with the established approach for enquiries arising from the panel. 2. Report 2.1 This report provides an explanation for the non reporting of the ‘Housing Repairs - % of reactive repairs appointments kept’ indicator. 2.2 The ‘Housing Repairs - % of reactive repairs appointments kept’ indicator is not a Statutory Indicator and has been agreed as an internal KPI only. 2.3 Currently, performance information on reactive repairs appointments made and kept is generated from 3 separate IT systems that collectively support the end to end process. These include the Dynamic Field Services system, which is a new system that was introduced for the purpose of scheduling and reporting on repairs appointments; the council’s current Housing Services Management System (HSMS) which all repairs requests from tenants are issued and closed through; and the contractors (MEARS) Repairs Management system (MCM), which they use to manage repairs operations and report on the status and completion of all jobs for the council. 2.4 Each of the 3 systems used in the repairs management process have separate purposes and capture different elements of the repairs completion process, and at present these systems do not interface in a way that allows a consistent and reliable replication or reconciliation of appointment data across all stages of the process. This limitation within the reporting infrastructure means that the Council is unable to report with confidence, on the percentage of reactive repairs appointments kept at this time. 2.5 Since the introduction of Field Services for scheduling and reporting appointments kept, Page 6 of 238
Page 7
the housing service has undertaken regular sample reporting and audit reviews of jobs processed through the system. These reviews have identified a number of system anomalies including, booking outcome fields not being calculated, job completion dates reverting to previous years, and tenant requested appointment changes being recorded as failures, with each of these issues having an impact on reported performance in this area. 2.6 As each issue is highlighted through the ongoing sample reporting, this then requires further system investigation, development and testing prior to implementation. Unfortunately, to date each time testing is carried out after system developments to eliminate identified issues, further anomalies continue to be identified that require resolution. Each of the newly identified anomalies then have to follow the same process before being released into the live system for reporting. 2.7 Collaborative working between our Housing Repairs, Business Development & Support, Technology & Digital Strategy Teams and MEARS IT services continues to be carried out to ensure each of the issues highlighted through the testing are fully resolved and sustainable solutions are implemented as quickly as possible. 2.7 At present all failures through the system are being reviewed 4 weekly to identify any other system issues, with meetings ongoing within the service to address these system integration and reporting challenges to ensure that accurate, auditable performance information can be produced for future reporting cycles. 2.8 While it is not currently possible for us to report on the ‘Housing Repairs - % of reactive repairs appointments kept’ indicator, the housing service continues to monitor, audit and report on key performance measures, including the percentage of repairs jobs completed within timescale and Customer Satisfaction with MEARS. These measures continue to provide assurance on service performance for tenants, with the recent performance presented to housing committee on the 16 February 2026 indicating for the period July 2025 – December 2026: • 97.50% of Immediate Response Jobs were completed within timescale; • 97.04% of Normal Response Jobs were completed within timescale; • Customer Satisfaction levels with MEARS Limited is 95.06% 3. Measures of success 3.1 That members will have an understanding of the reasons why the Housing Service have not, to date, been able to report on the ‘Housing Repairs - % of reactive repairs appointments kept’ performance indicator, and will be confident that the actions being taken by the service to address this matter will enable accurate reporting on this indicator in the future. Stephen Llewellyn Chief Officer (Housing & Communities) Page 7 of 238
Page 8
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ Page 8 of 238
Page 9
If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☐ No ☒ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 9 of 238
Page 10
Page 10 of 238
Page 11
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref RB/SL Date 14/05/26 Performance reporting schedule - quarterly performance assurance review From Rachel Blair, Chief Officer (Legal, Democratic and Strategy) E-mail BlairR@northlan.gov.uk Executive Summary The purpose of this report is to bring together a summary of the council’s performance reports in one composite assurance overview to support the Audit and Scrutiny Panel in maintaining strategic oversight and awareness of the council’s performance reporting arrangements in line with the Panel’s remit to provide “independent review of the council’s governance, risk management, performance, and control frameworks”. It also supports the Audit and Scrutiny Panel’s governance and accountability role in terms of ensuring the council can demonstrate Best Value through the existence of robust arrangements for performance reporting and scrutiny. This process monitors reports which have been submitted to council committees (in line with the Strategic Performance Framework - Performance Reporting Schedule) during the previous cycle. This process began in 2023 with implementation of a quarterly performance assurance review report thereafter. This report herewith provides the Panel with the outcome from the latest quarterly performance assurance review that has been undertaken on performance reports previously submitted to council committees during cycle 1 2026 (in line with the most recent Performance Reporting Schedule which was at the Panel in August 2025). Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Review the composite overview of performance reporting provided in Appendices 1 and 2 to maintain an awareness of each report within the latest Performance Reporting Schedule, and (2) Identify whether there are any significant issues arising, from the composite performance overview presented in the attached Appendices, that the Panel considers requires additional scrutiny and a further report to be submitted from the respective Chief Officer to a future meeting of the Panel (following review through the Scrutiny Assessment and Prioritisation Process). The Plan for North Lanarkshire Item 3 Page 11 of 238
Page 12
1. Background 1.1 The quarterly performance assurance review report is now well established at the Audit and Scrutiny Panel, having been in place since May 2023. It aligns to the Performance Reporting Schedule considered by the Panel each year which sets out the reporting, review, and scrutiny arrangements for a range of performance information to be considered at each cycle of committee meetings in support of the Strategic Performance Framework. 1.2 The Strategic Performance Framework comprises performance measurement at three levels. This aims to collectively provide an overview of performance to help understand the impact of council activities on improving services and outcomes for the people and communities of North Lanarkshire. The measures in this Framework allow for day-to- day activities, and progress towards achieving the long-term vision set out in The Plan for North Lanarkshire, to be regularly monitored, reported, assessed, and scrutinised. 1.3 The supporting Performance Reporting Schedule forms a key part of the Scrutiny Work Programme that underpins the Best Value governance and accountability theme by ensuring the council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. It also aims to fulfil the Audit and Scrutiny Panel’s remit as per the Scheme of Administration to: • Review and monitor the performance of the council in delivering upon its priorities, outcomes, programme of work and targets in the council plan, specifically performance in improving local services and outcomes and in demonstrating Best Value. • Review performance to assess whether intended policy outcomes have been achieved. 1.4 The Strategic Performance Framework comprises a set of non-negotiable standards which Chief Officers are required to apply in all performance reporting that supports the Framework. These standards aim to ensure that performance reporting is: • Aligned - to The Plan for North Lanarkshire to give stakeholders an insight into the performance of council activities both in the short-term and against the long-term ambitions. • Consistent - to ensure a standard, easily recognisable, and well-established process across each different audience over time. This aims to help build credibility, reliability, and a common understanding. • Transparent - to allow stakeholders to understand what is being measured, what it means, what level of performance has actually been achieved, and what difference this means in reality for the people and communities of North Lanarkshire. • In context - to avoid the So What? question and provide a coherent narrative to ensure fully informed review, reporting, scrutiny, and decision-making processes. • Balanced - to ensure reporting contains areas in which performance has improved as well as areas where performance has not improved or has declined. Any supporting narrative in this respect must add value and tell a balanced narrative. The narrative should include reasons for performance levels not in line with targets, standards, or original plans and the remedial action undertaken to address this. Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Page 12 of 238
Page 13
1.5 The Performance Reporting Schedule highlights a significant volume of performance information scheduled for reporting to council committees throughout the year. Cycle 1 2026 reports were reviewed by the Business Management Team in April 2026 to provide assurance, in line with the Best Value duty, that performance management arrangements support the effective use of council resources, are subject to appropriate senior management scrutiny, and that performance monitoring effectively identifies and addresses areas of underperformance through agreed remedial actions. 1.6 The volume of performance information in the latest cycle has been reviewed and summarised in Appendices 1 and 2 attached - it should be noted that the performance information within these Appendices has already been reviewed by Service Committees during cycle 1 2026. The purpose of the information presented herewith is therefore to provide Audit and Scrutiny Panel members with a composite, but easily digestible, overview for governance and assurance purposes in line with the specific scrutiny and strategic oversight role of the Panel. 1.7 Should the Panel consider there are any significant issues arising from the composite performance overview which require additional scrutiny, these matters will be reviewed through the Scrutiny Assessment and Prioritisation Process (updated and approved by the Panel in September 2022 and further endorsed in September 2023), prior to being added to the Scrutiny Work Programme for a further report to be submitted from the respective Chief Officer to a future meeting of the Panel. 2. Quarterly performance assurance review 2.1 The Strategic Performance Framework - Performance Reporting Schedule sets out several aspects of performance reporting. As part of this, paragraphs 2.2 to 2.6 itemise the performance reports submitted to cycle 1 2026 committees in accordance with the timetable set out in the Schedule. (1) Chief Officer’s individual Performance Review reports at Service Committees in line with the Strategic Performance Framework. (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. (1) Chief Officer’s individual Performance Review reports at Service Committees in line with the Strategic Performance Framework. 2.2 The Strategic Performance Framework comprises a range of performance indicators from each Chief Officer’s portfolio and the latest results in this respect are aligned to the respective ambition statements in The Plan for North Lanarkshire. The three reports previously submitted to the relevant committee in cycle 1 2026 are listed in Table 1 below, along with the corresponding hyperlink for ease of access. Table 1 Report title Committee Date Latest performance results - Community Operations link to file Environment and Climate Change Committee 11 February 2026 Latest performance results - Housing link to file Housing Committee 18 February 2026 Adult social care performance - Quarter 2 (July to September 2025) link to file Adult Care and Social Work Committee 24 February 2026 Page 13 of 238
Page 14
2.3 Each council report was produced in line with a standard template and (a) provides the reader with the current context within which the service is operating, (b) highlights areas of good performance that can be evidenced in the accompanying data, and (c) provides a summary of areas of performance requiring improvement along with narrative that gives an explanation for the level of performance achieved and summarises the remedial action implemented (or to be implemented) to bring performance back on track. 2.4 A short summary analysis for each of the reports is set out in Appendix 1 against the five non-negotiable standards. (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. 2.5 This aspect relates to service specific reporting which is required to meet business and/or statutory obligations. This is included in the Performance Reporting Schedule to ensure all the council’s performance reporting arrangements are captured in the one place and the Schedule reflects a one council approach to performance reporting. 2.6 The 13 reports previously submitted to the relevant committee in cycle 1 2026 are listed in Table 2 below, along with the corresponding hyperlink for ease of access. A short summary for each of these reports is set out in Appendix 2. While this summary is set out against the five non-negotiable standards it recognises there may also be statutory specific approaches or standards which require to be adhered to. Table 2 Report title Committee Date Data protection compliance and activity - annual report 2024/25 link to file Finance and Resources Committee 4 March 2026 Senior Information Risk Owner (SIRO) interim assurance and performance report January - March 2025 link to file Finance and Resources Committee 4 March 2026 Public Sector Duties climate change annual report 2024/25 link to file Environment and Climate Change Committee 11 February 2026 Community safety hub - performance 2024/25 link to file Housing Committee 18 February 2026 Community payback order - annual report 2024/25 link to file Education, Children, and Families Committee 3 March 2026 North Lanarkshire Community Planning Partnership: annual oversight and improving outcomes report 2024/25 link to file Communities Committee 9 February 2026 Education performance update link to file Education, Children, and Families Committee 3 March 2026 Housing and corporate maintenance and investment services contract - interim report link to file Housing Committee 18 February 2026 Roads and infrastructure maintenance and improvement services contract - interim report link to file Environment and Climate Change Committee 11 February 2026 Page 14 of 238
Page 15
Report title Committee Date Revenue and benefits update link to file Finance and Resources Committee 4 March 2026 Financial monitoring report - council summary (revenue) link to file Finance and Resources Committee 4 March 2026 Financial monitoring report - council summary (capital) link to file Finance and Resources Committee 4 March 2026 Financial monitoring - savings link to file Finance and Resources Committee 4 March 2026 Next steps 2.7 Assurance reviews will continue to be undertaken and reported to the Audit and Scrutiny Panel on a quarterly basis in order to maintain the measures of success set out in paragraph 3.1. The content of the quarterly assurance review reports will continue to be informed by the Performance Reporting Schedule, most recently updated and presented to the Audit and Scrutiny Panel in August 2025. 2.8 Reports submitted to the respective committees, in line with the Performance Reporting Schedule, will continue to be kept under review by the council’s senior management team to ensure adherence to the agreed timetable. This approach also provides assurance regarding the efficient and effective operation of the council and supports the ongoing delivery of the long-term ambition set out in The Plan for North Lanarkshire, underpinned by robust corporate governance arrangements. 3. Measures of success 3.1 Measures of success include: • Regular oversight and monitoring of performance across the organisation, providing assurance on effective governance, accountability, and transparency. • Regular review and challenge processes that scrutinise council performance to ensure effective use of resources, alignment with agreed policy and priorities, sound decision-making, and clear accountability for how resources are applied to achieve improved outcomes for service users and the local community. • Robust performance monitoring, management, and reporting arrangements that support the demonstration of service improvement, improved outcomes, and the delivery of Best Value. 4. Supporting documentation Appendix (1) Chief Officer’s individual Performance Review reports at Service Committees in line with the Strategic Performance Framework. Appendix (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. Rachel Blair Chief Officer (Legal, Democratic and Strategy) 5. Impacts Page 15 of 238
Page 16
5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? The legal impact in this report is only in relation to supporting demonstration of the council’s compliance with the relevant legislation listed below. It does not introduce new legal duties or changes to the council’s statutory duty in this respect. • The Local Government Act 1992 established the role of the Statutory Direction to direct councils in terms of the “publication of information as to standards of performance”. • The Local Government in Scotland Act 2003 introduced the statutory duty of Best Value which requires the council to “make arrangements which secure Best Value” and ensure “continuous improvement in the performance of the authority’s functions”. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Page 16 of 238
Page 17
Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Implementation of the Performance Reporting Schedule, which facilitates regular reporting, review, and scrutiny processes, contributes to mitigating the risk on the Corporate Risk Register in relation to governance, leadership, and decision-making. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 17 of 238
Page 18
Appendix 1 (1) Chief Officer’s individual Performance Review reports at Service Committees in line with the Strategic Performance Framework. Report title Summary Latest performance results - Community Operations February 2026 Community Operations has 34 indicators in the Strategic Performance Framework which assess efficiency and effectiveness in terms of delivery on a day-to-day basis. A suite of benchmarking indicators also enables performance, costs, and satisfaction to be assessed and compared nationally. A single Community Operations service is in place following various structural realignments which have brought together a range of front facing services in relation to the council’s environmental assets (i.e. Street Cleaning, Grounds Maintenance, Cemetery Services, Roads Maintenance Operations, and Country Parks for the Future) as well as regulatory related services (i.e. Environmental Health and Trading Standards), and services in respect of Waste Solutions, Fleet Resources, and the Built Environment. The creation of a single front-line community operation has integrated services and enhanced natural environments and green spaces, supporting the day-to-day management of environmental, cultural, sport, and leisure assets while promoting wellbeing, social inclusion, physical and mental health, and stronger connections with the local environment. Aligned Priority: • Improve the health and wellbeing of our communities. • Enhance participation, capacity, and empowerment across our communities. Ambition statement: 14. Ensure the highest standards of public protection. 16. Transform our natural environment to support wellbeing and inward investment and enhance it for current and future generations. 17. Ensure we keep our environment clean, safe, and attractive. Consistent The pre-defined template was used to ensure a standard, easily recognisable, and well established process across each different audience over time. The use of this template aims to help build credibility, reliability, and a common understanding. Transparent Benchmarking indicators: https://www.improvementservice.org.uk/benchmarking/explore-the-data • Parks and open spaces - cost per 1,000 population • Satisfaction - with parks and open spaces • Street cleaning - net cost per 1,000 population • Satisfaction - with street cleaning services • Street cleanliness score - % assessed as clean • Satisfaction - with refuse collection • Roads - cost of maintenance per km of roads • Road network - % A class roads that should be considered for maintenance treatment • Road network - % B class roads that should be considered for maintenance treatment • Road network - % C class roads that should be considered for maintenance treatment • Road network - % Unclassified roads should be considered for maintenance treatment • Environmental health - cost per 1,000 population • Street lamps - energy usage RAG indicators: Page 18 of 238
Page 19
In context As the service’s operating environment has changed significantly in recent years, performance should be considered within the context of the following: • A rationalisation of land and waste services is underway to consolidate operations within key depots, improving efficiency, co-locating services, and generating capital through the sale of surplus sites. • The service played a key role in supporting the council’s pandemic response and recovery from 2020 to 2022, while maintaining key public health and safety services in line with legislation. Resuming business as usual activities involved significant backlogs which are now reducing with performance stabilising. • As services returned to normal, increased caseloads - particularly in environmental health - combined with the post-pandemic food law recovery plan led to higher inspection volumes and required changes to processes and ways of working. In addition, the report references the Internal Audit review reported to the Audit and Scrutiny Panel in May 2025 and confirms that the performance report implements one of the recommendations to report performance information to senior management and elected members. Work is ongoing to address the second recommendation on improving compliance with corporate processes for performance indicators, including a review of the current suite to ensure effectiveness, alignment with The Plan for North Lanarkshire, and support for continuous improvement, with new measures (including updated targets and thresholds) to be reported from April 2026. In the meantime, work is underway to align systems and integrate request processes to support a new measure tracking bins lost or damaged during collection, with data expected to be available for reporting from April 2026. Balanced Performance highlights: • Latest figures show that 32.6% of North Lanarkshire's roads overall are considered to require maintenance treatment which maintains the consistent trend over the years of less than a third of all roads requiring maintenance treatment. Performance also remains below (and therefore better than) target. • The council’s performance in respect of A class roads (i.e. major and strategic roads) which are considered to require maintenance treatment continues to remain lower than the averages for Scotland and the family group of similar councils with less than a quarter (23.8%) of A class roads in North Lanarkshire considered to require maintenance treatment compared to the Scottish average (30.6%) and the family group of similar councils (28.2%). The latest figures show a decrease in the cost of maintaining roads per kilometre, which is also lower than comparable councils, despite North Lanarkshire’s heavily used road network and higher levels of wear due to traffic density. • Overall refuse service performance remains strong, with disposal costs below target, stable customer satisfaction, a record recycling rate of 47.9% - above national and comparable councils averages - and low complaint levels at 1.3 per 1,000 household collections (which overall equates to 15,195 complaints out of over 12 million household collections during 2024/25). • The proportion of eligible premises achieving the national Food Hygiene Information Scheme (FHIS) pass award continues to perform above target. The latest year to date figures, up to and including quarter 3 of 2025/26, show 96.1% of premises (2,452 out of 2,552) achieving the pass award. Areas of performance requiring improvement: • Previous performance reports to the Environment and Climate Change Committee had noted performance in completion certificates and building warrants continuing to remain below target, however both these service areas had experienced a significant improvement as at the 2024/25 year end. This followed a prolonged period of high demand volumes combined with increased customer expectation around the completion of projects and extent of on-site activities as well as challenges around the recruitment process, long-term absences, support issues, and system outages all contributing to lower than target performance. Performance in 2025/26 to date has subsequently shown a small decline and the reasons for this are being investigated. • Enquiries closed off within response timescales in relation to roads enquiries and streetlight repairs completed within 7 days had both shown performance lower than the expected target for 2024/25. This period included the transition to a new term maintenance contractor and the implementation of a new maintenance management system, both of which encountered some teething issues that impacted on the reported performance figures; however, these have now been resolved, and it is expected that the 2025/26 figures will show improvement in this respect. • Overall, performance results in relation to unit costs available through the Local Government Benchmarking Framework (LGBF) suite of indicators represent a mixed picture across all councils in Scotland. The annual LGBF overview publication recognises general trends across Scotland, however, unit costs should never be considered in isolation and a full picture of performance is required to show the full and complete position. In addition, it should be noted that the LGBF does not cover every service delivered by Community Operations. Report title Summary Page 19 of 238
Page 20
Latest performance results - Housing February 2026 Housing has 22 indicators in the Strategic Performance Framework, covering all aspects of the council’s social landlord role, including housing management, property services, housing repairs and investment, rent and void management, tenancy management, tenant satisfaction, and homeless related services. Performance is monitored through statutory returns (the Annual Return on the Charter (ARC), the Scottish Government Housing Annual Statistical Return (HSAR), and the Scottish Government Homeless returns (HL1)), alongside service and contract indicators, with regular benchmarking and practice sharing through the Scottish Housing Network. The council’s new Local Housing Strategy for 2026-28 was approved by the Housing Committee in February 2026. This sets out the long-term vision to deliver affordable and sustainable homes in thriving communities that meet individual needs and enhance quality of life, supported by housing services that promote health, wellbeing, and opportunity for all in North Lanarkshire. As set out in the council’s Local Housing Strategy for 2026-28, there are an estimated 160,847 dwellings in North Lanarkshire, with home ownership remaining the predominant tenure and 63% of households owning their own home - of this, 37% own their home outright and 25% own it with the help of a loan or mortgage. Aligned Priority: • Improve economic outcomes and opportunities. Ambition statement: 1. Ensure a housing mix that supports social inclusion and economic growth. Consistent The pre-defined template was used to ensure a standard, easily recognisable, and well established process across each different audience over time. The use of this template aims to help build credibility, reliability, and a common understanding. Transparent RAG indicators: In context • The continued increase in the cost of living is placing substantial financial pressure on tenants, and responding to this challenge remains a central priority for the service. The Rent Assistance Fund, introduced in February 2023, has played a significant role in providing support to tenants, particularly those on low incomes. This has contributed to sustaining stable tenancies during this period of economic difficulty. To date 2,373 tenants have been helped by this innovative fund, which not only helps the tenant in their time of need but encourages continued engagement between the tenant and their housing officer. This has in turn helped reduce the overall rent arrears figure to 6.6%. • Several Scottish local authorities have formally declared a housing emergency in response to rising homelessness, severe shortages of affordable homes, and increasing pressure on statutory services. In May 2024, the Scottish Government also declared a national housing emergency, acknowledging escalating homelessness, falling housing completions, and wider affordability challenges. Over recent years, North Lanarkshire has experienced an increase in homelessness presentations, with a 13% increase recorded between 2021/22 and 2022/23 and a further 16% rise observed between 2022/23 and 2023/24. This reflects the growing pressures faced by vulnerable households. Despite these challenges, the sustained commitment and proactive prevention Page 20 of 238
Page 21
work of locality teams and support staff have enabled the council to manage resources effectively and provide targeted assistance where it is most needed. This approach has contributed to a reduction in presentation numbers (8% in 2024/25 and a further 3.5% year to date in 2025/26), indicating that interventions are delivering positive outcomes and work continues to target operational activities to address caseloads. • The service continues to comply fully with the Homeless Persons (Unsuitable Accommodation) (Scotland) Order 2014 and does not utilise B&B-type accommodation, which remains a common contingency measure in other local authority areas. Balanced Performance highlights • The percentage of rent due in the year that was lost due to properties being empty (0.67%) is sitting below (i.e. is better than) last year’s outturn of 0.80% and is below the target of 1%. Average time taken to re-let properties remains consistent with last year’s figure at 29.9 days and within the target of 30 days. • The proportion of lets to homeless people has increased further in 2025/26 to 52% to address the caseload. The latest results with the quality of temporary accommodation shows 97.8% compared to an increased target of 96%, and reflects the quality of furnishings and fittings in the accommodation as well as the high level of decoration. • The repairs service continues to perform well with the average timescale for emergency repairs completed being 2.37 hours, 0.3 hours less than last year’s outturn and well within the target timescale of 3.75 hours. The latest average of 6.7 days to complete non-emergency repairs is within the target of 7 days. Areas of performance requiring improvement • The percentage of decisions made within 28 days for households presenting as homeless (90.8%) is below the target of 95%. The percentage of decisions made within 28 days for households under 25 years old presenting as homeless (90.7%) is also below the target of 95%. These figures reflect the transient nature of the client group, where maintaining contact to allow staff to make decisions within timescale can be difficult. Service audits are ongoing to determine the reasons for the decline in performance in these areas; the main reason being lost contact from the applicant. Report title Summary Adult social care performance - Quarter 2 (July to September 2025) February 2026 The Chief Officer (Health and Social Care North Lanarkshire) holds joint quarterly performance review meetings with the Chief Executives of NHS Lanarkshire and North Lanarkshire Council. These are supported by a Chief Executive’s Performance Framework, covering key measures, targets, and trajectories across health and social work systems. In each quarter areas for improvement within the performance framework are identified through the use of a RAG rating. Measures flagged as Red or Amber are subject to improvement or corrective action, which are jointly agreed through the performance review meetings. Aligned Priority: • Improve the health and wellbeing of our communities. Ambition statement: 12. Ensure our residents are able to achieve, maintain and recover their independence through appropriate supports at home and in their communities. 13. Improve preventative approaches including self-management and giving people information and choice over supports and services. 14. Ensure the highest standards of public protection. Consistent A pre-defined Health and Social Care Partnership template is in place to ensure a standard, easily recognisable, and well established process for quarterly reporting on areas for improvement. Transparent Based on a traffic-light system there are areas for improvement identified within the performance framework each quarter for those areas that are flagged as Red or Amber. The areas for improvement identified are progressed as a matter of priority, and progress updates are reported at future meetings of the Integrated Joint Board and/or the Integration Joint Board Performance, Finance, and Audit Committee as appropriate. In context • Information from the joint quarterly performance reviews has been supplemented with additional information to offer a wider overview of performance across key areas of adult social care delivery. • Mosaic, the new Social Work Information System, went live in June 2025. This meant that all standardised reporting provided by the team required to be rebuilt and necessitated testing with live data along with verification by users of the reports. In addition, due to data recording on the previous system (SWIS) Page 21 of 238
Page 22
ceasing prior to the go-live for Mosaic, data and information from multiple sources is required to produce standardised reporting. This includes data from ELMS2 (the software solution that supports the management of community equipment services) for equipment and adaptations and the dynamic scheduling tool for home care where both systems have also recently gone live, with reporting still in development to reflect the new recording processes and subject to testing and validation. While every effort is being made to maintain continuity of reporting, the ability to provide data and information is impacted in the short- term and there is some disruption to the Social Care reporting contained within the Chief Executive’s scorecard. Some metrics therefore have no value for certain quarters as these parts of the Mosaic system are not yet operational. Balanced The purpose of the report is to provide an update on the areas for improvement what have been identified as part of the quarterly performance review. The quarter 2 report (for July - September 2025) sets out corresponding narrative and corrective actions agreed; these are summarised below. • Assistive technology - performance remains below target, largely due to improved data completeness following system changes rather than reduced activity. Better visibility from ELMS2 and Mosaic now gives a more accurate picture. Demand for assistive technology remains high, driven by hospital discharge pressures and the priority to support people at home, while capacity constraints continue to affect delivery. Work is ongoing to stabilise performance through improved alignment with home support and reablement, clearer prioritisation, refined data quality, and a review of targets, with assistive technology remaining a key enabler of discharge and community support. • Reablement and rehabilitation - the indicators for reablement presented in the scorecard in the appendix to the report have not met the targeted levels of performance. Performance in Q2 remains below target, with fewer new or increased home support cases progressing through reablement and little change in local variation. Capacity constraints, pathway complexity, and local operational pressures continue to influence decision making in this area. Overall, system pressures and local practice variation continue to constrain delivery, and further work is required to improve compliance, reduce variation, and strengthen reablement’s role within home support and discharge pathways. • Home support redesign - this programme focuses on delivering outcome-based support for individuals and families, aligned with B2B, self-directed support, and developments in hospital flow. It is supported by several products that have been produced to progress the work, including service specifications, a workforce profile, and an analysis of demand / capacity data. The proposal is for a Living Well service that provides home support to achieve individual outcomes for the people using the service and a distinct assessment and planning service, that will include Rehabilitation and Reablement services. This aims to ensure that people receive a holistic assessment of their need and are provided with the most appropriate services to meet individual outcomes. Page 22 of 238
Page 23
Appendix 2 (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. Report title Summary Data protection compliance and activity - annual report 2024/25 March 2026 This report provides a strategic assessment of the council’s performance and compliance with its statutory data protection and information governance obligations during 2024/25. It presents a detailed analysis of personal data breaches, engagement with the Information Commissioner’s Office (ICO), Subject Access Request (SAR) performance, staff training and awareness, and the effectiveness of governance and assurance arrangements. The report fulfils the requirement for the Data Protection Officer (DPO) to report assurance on the council’s overall compliance position. It provides assurance alongside the Senior Information Risk Owner (SIRO) annual report. Aligned Priority: • All priorities. Ambition statement: • All ambition statements. Consistent As a public authority and data controller, the council is subject to a comprehensive statutory framework governing the processing of personal data. Effective data protection and information governance are fundamental to maintaining public confidence, safeguarding individuals’ rights, and ensuring compliance with statutory obligations, including the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). This legislation imposes enhanced accountability obligations, requiring the council not only to comply with legal requirements but to be able to demonstrate that compliance through effective governance, documentation, and assurance. Transparent The report outlines the council’s governance arrangements that are in place to provide strategic leadership, operational oversight, and assurance in relation to information governance and data protection compliance. This comprises: • The Senior Risk Owner (SIRO) - providing strategic leadership on information governance and information risk management across the council, ensuring that information risks are identified, understood, and managed in line with the council’s risk appetite and statutory obligations. • The Data Protection Officer (DPO) - responsible for overseeing compliance with data protection legislation, including the UK GDPR and the Data Protection Act 2018, providing independent advice to the council, monitoring internal compliance, advising on Data Protection Impact Assessments (DPIAs), and acting as the primary point of contact with the Information Commissioner’s Office (ICO). • The Data Governance Board (DGB) - providing strategic oversight of data protection and information governance, with regular reporting to the Business and Corporate Management Teams. It is responsible for setting direction, overseeing implementation, and securing assurance that effective arrangements are in place across the council and its Arm’s Length External Organisations (ALEOs). The DGB is supported by a group of representatives from across services who provide operational oversight, monitor compliance, and drive day-to-day implementation and improvement. • The Information Governance Team in Legal and Democratic - providing specialist legal advice and support across a range of information governance legislation, ensuring services are supported to meet their statutory obligations. Through a combination of strategic oversight, operational monitoring, and continuous engagement, the council ensures that its approach to data protection is integrated, proactive, and aligned with best practice. In context Regulatory expectations, particularly those articulated by the ICO, have increasingly emphasised leadership accountability, evidence-based decision- making, and demonstrable continuous improvement. This report reflects that context and provides an integrated view of performance, risk, and assurance across the council’s information governance landscape. During 2024/25, the council has continued to strengthen its arrangements across the following core areas - management and reporting of personal data breaches, engagement and compliance with the ICO, delivery of mandatory and targeted staff training, compliance with individuals’ information rights (particularly SARs), and strengthening governance, assurance, and accountability structures. A strategic focus has been placed on anticipating emerging risks, embedding a culture of accountability, and ensuring that operational practices are both proactive and resilient to future regulatory developments. The council has also sought to integrate technological solutions, including SAR tracking systems Page 23 of 238
Page 24
and secure communication platforms, to enhance efficiency and reduce human error. Balanced Overall, the council has demonstrated measurable and sustained improvement across several key areas of compliance. In particular, notable progress has been achieved in the management and governance of SARs within social work services, the development and delivery of targeted service-specific training, and a significant increase in completion rates for mandatory data protection and information security training. These improvements reflect strengthened leadership oversight, clearer accountability, and increased organisational focus on information governance as a core corporate responsibility. Notwithstanding this progress, the report also identifies areas where further improvement is required to ensure full and consistent compliance with statutory requirements and regulatory expectations. Increased scrutiny from the ICO, particularly in relation to SAR performance, underscores the need for continued focus on timely and high-quality responses, improved recording and tracking arrangements, and sustained staff awareness to prevent avoidable personal data breaches. A clear programme of ongoing and planned improvement actions is therefore set out to address these risks and to support continuous improvement. The report also provides strategic insight into emerging legislative frameworks, technological enablers, and organisational trends that will influence the council’s information governance practices over the next three to five years. Report title Summary Senior Information Risk Owner (SIRO) - interim assurance and performance report January - March 2025 March 2026 The Senior Information Risk Owner (SIRO) report provides assurance that the council’s information governance, data protection, and information security arrangements remain effective, proportionate, and appropriately overseen. These arrangements support the council in meeting its statutory, regulatory, and good practice obligations, while protecting the confidentiality, integrity, and availability of information essential to service delivery and public trust. The report covers the interim period from January to March 2025. It has been prepared to close out reporting under the previous calendar-year SIRO reporting cycle and to support the transition to annual SIRO reporting aligned to the financial year (April to March), in line with other corporate governance, risk, and assurance reports considered by the same committee. Aligned Priority: • All priorities. Ambition statement: • All ambition statements. Consistent • The SIRO role is mandatory for public sector organisations and organisations which are contracted to deliver services under the NHS standard contract. The report sets out the SIRO responsibilities which includes: - Leadership and overall ownership of the council’s corporate governance action plan in terms of acting as corporate champion for information governance. - Acting as Executive Sponsor and advocate for the management of information governance at a senior level. - Providing advice and reports in respect of information incidents and risks, including informing the content of the council’s Annual Governance Statement relating to information risk. - Owning the management of information governance and associated risk assessment processes within the council. - Understanding how the strategic priorities of the council may be impacted by information governance risks, and how these risks need to be managed including the adequacy of resources and levels of independent scrutiny. Transparent • The report advises that SIRO responsibilities had previously been aligned with the Chief Officer (Business and Digital) remit since September 2019, but following consideration of the One Place, One Plan - Governance update report at Policy and Strategy Committee in September 2024, this responsibility transferred to the Chief Officer (Legal and Democratic) from April 2025. This change strengthens alignment between information governance, legal compliance and corporate assurance, and future SIRO reports will reflect this revised governance structure. • The primary purpose of the interim report is to: - Provide clear, concise and proportionate assurance across the key areas for which the SIRO is accountable. Page 24 of 238
Page 25
- Confirm whether any material changes to assurance positions arose during the January-March 2025 period. - Provide forward-looking context by summarising known improvements and developments being delivered during 2025/26, ensuring the report remains relevant when considered by committee. • To support clarity and transparency, the report adopts a structured, assurance-based approach, presenting the council’s position through a single consolidated assurance table at Appendix 1. This approach avoids duplication with detailed operational reporting, strengthens the line of sight between assurance and risk, and enables Members to readily understand three key points in relation to assurance and risk - what assurance was previously provided, whether that assurance position has changed, and what further improvements are being delivered. In context • The report sets out the contents within which information governance and information security responsibilities are distributed across the council, i.e. across multiple officers, teams, and governance structures. • While specialist functions provide expertise and operational delivery, effective information governance relies on strong leadership, clear accountability, robust assurance mechanisms and consistent organisational compliance. The SIRO acts as the council’s corporate champion for information governance, providing senior-level ownership of information risk and assurance to the Corporate Management Team and the Finance and Resources Committee. This includes oversight of compliance with data protection legislation, information security standards, records management obligations, and associated risk management arrangements. Balanced The report provides the following assessment of the council’s information governance arrangements for the period January to March 2025, representing an interim assurance position ahead of the move to annual financial-year SIRO reporting: • The council has well-established information governance, data protection, and information security arrangements, embedded within its wider corporate governance, risk management, and internal control framework. These arrangements are supported by documented policies and standards, technical controls, mandatory training, and structured governance oversight. • Oversight of information governance continues to be provided through the Data Governance Board (DGB), which monitors compliance, risk, incidents, improvement activity, and assurance across the organisation. This is supported by specialist operational teams with responsibility for data protection, cyber security, records management, and digital services. • Previous SIRO reports have confirmed that the council operates at a developing level of data and information management maturity, with sustained and measurable improvement achieved over recent years. This has been driven by targeted investment in systems, strengthened governance, improved training compliance, and increased senior oversight of information risk. To improve transparency, readability, and Elected Member assurance, this interim report presents the SIROs assurance through a consolidated assurance table which is attached to the report at Appendix 1, covering the key statutory and good-practice areas relevant to the SIRO role. This includes data protection compliance, cyber security, incident management, risk management, records management, training and awareness, and corporate accountability. • Based on the evidence reviewed, the report states that the SIRO is satisfied that appropriate and proportionate information governance, data protection, and information security arrangements were in place during the period January to March 2025. No material deterioration in assurance was identified during this interim period, and no regulatory enforcement action was taken against the council. • The transition to financial-year SIRO reporting will enable stronger alignment with corporate planning, risk management, audit and digital transformation activity, and will allow future reports to provide a more comprehensive, outcome-focused, and forward looking assurance position. Report title Summary Public Sector Duties climate change annual report 2024/25 February 2026 The Climate Change (Duties of Public Bodies: Reporting Requirements) (Scotland) Order 2015 introduced a legal obligation for public bodies to report annually on their compliance with the duties specified in the Climate Change (Scotland) Act 2009 and its subsequent amendments. The report is produced annually for the most recently completed financial year with a national submission date of 30th November each year. The report provided the Environment and Climate Change Committee with a summary of the content of the Public Sector report on Compliance with Climate Change Duties submitted on behalf of the council in November 2025 for the 2024/25 reporting year. It also provides an update on progress against carbon budgets set within the council’s Climate Plan ACT2030 and work that contributes to the overall net-zero ambition. Aligned Priority: • All priorities. Page 25 of 238
Page 26
Ambition statement: • All ambition statements. Consistent • A standard report template is provided to all local authorities which comprises a number of sections that require information on the organisation’s profile, governance, emissions and projects, adaptation, procurement, and validation as well as a non-mandatory section in relation to wider influence. Within the council, this information is collated annually and verified for submission by the relevant council service. • The report follows on from that at Committee in 2023 and uses an organisational carbon boundary. An organisational carbon boundary is a visual representation of the scope of activities, assets, and emissions sources that are included when calculating the carbon footprint. Those sources outwith the carbon boundary are ones where they are not organisational emissions (such as domestic consumption) or there is no data available to provide a meaningful result. The council’s carbon boundary was determined by looking at how buildings are used, how transport is used for service delivery, and how waste is managed. Transparent The February 2026 report shows a summary of the council’s greenhouse gas emissions in terms of carbon tonnes equivalent (CO2e) from the baseline year (2015/16) to the end of the latest reporting year (2024/25). This includes the annual emissions target set. A breakdown of emissions and the emissions source is also contained within an appendix to the report. • For 2024/25 the council’s greenhouse gas emissions totalled 57,155 tCO2e. This has been achieved via reductions in scope 1, 2, and 3 emissions (2.3%, 5%, and 17.8% respectively). - Scope 1 emissions accounted for 29,066 tCO2e, a 2.3% reduction from last year achieved through less use of natural gas, kerosene, and diesel. - Scope 2 emissions arise solely from electricity use, which decreased year-on-year, reducing emissions. - Scope 3 emissions for the reporting year are 17.8% lower than 2023/24 with reductions in grey fleet (business mileage) and various waste streams contributing to the overall reduction, with the most significant reduction in refuse municipal to landfill realising a 7% reduction in related emissions. The overall reduction in scope 3 emissions since baseline year is 23,593 tCO2e (59.1%). • The statutory reporting process is supported by the Sustainable Scotland Network who also analyse annual submissions from the public sector bodies’ reports and report their overall findings publicly. This includes identifying strengths and weaknesses (https://sustainablescotlandnetwork.org/organisation-report/north-lanarkshire-council/ ). In context The report advises that: • The council’s progress towards net zero has benefitted from deliberate climate action. Progress can be impacted on by policy decisions and hence why it is important for services to complete Carbon Impact Assessments to inform decision-making. • The council has continued to deliver climate action and has realised good outcomes that goes beyond emission reductions such as helping those in fuel poverty and improving wider poverty outcomes as well as improving the physical wellbeing of residents. • Adapting to a changing climate is an essential consideration for the council and future action will be wider than flood prevention as other impacts, such as severe heat, are becoming more frequent. Balanced The report highlights some of the council’s climate activity and actions incorporated into the submission. These actions contribute to reducing North Lanarkshire’s emissions as well as encouraging more sustainable practices within the area. • The Energy Efficiency Standard for Social Housing (EESSH) was developed to help improve the energy efficiency of the social housing stock in Scotland. Enhancing the energy efficiency of council homes contributes to reductions in domestic emissions and the carbon footprint of North Lanarkshire. In 2024/25, the council’s pass rate for EESSH was 87%. Note, the EESSH is due to be replaced by the Social Housing Net Zero Standard which will have a particular focus on clean heat. • The council has a key role in the promotion of energy efficiency in the private housing sector through schemes such as Energy Company Obligation (ECO) phase 4. The Statement of Intent sets out how the council aims to help the most vulnerable households and increase the uptake of energy efficiency improvements for such households. Since 2013, 27,767 households have had 45,380 energy efficiency measures installed through ECO. • Non-Domestic Energy Efficiency (NDEE) - a suite of energy conservation measures has been delivered across 26 sites and is expected to realise savings and a carbon reduction of 774 tCO2e. These measures include Building Energy Management Systems (BMS) upgrades, LED lighting, electric boilers and boiler upgrades, recommissioning CHPs (combined heat and power), fridge and freezer optimisation, solar photovoltaics, air handling unit optimisation, insulation, air conditioning optimisation, and voltage optimisation. Page 26 of 238
Page 27
• New build homes - 48 new homes were completed in February 2025 at Brandon Street, Motherwell. All the homes are heated by a ground source heat pump system and to a high level of energy efficiency, employing innovative use of both internal and external wall insulation as well as triple glazed windows and roof-mounted photovoltaic panels. • Town and community hubs - Orbiston Community Hub located in Bellshill is the council’s first fully electric town and community hub, delivering a 90% reduction in carbon emissions and a 60% reduction in energy consumption compared to the previous school buildings. • Dumbreck and Garrell project - local volunteers were upskilled in practical conservation and habitat management, delivering works such as lapwing scrapes, sand martin wall repairs, planting, and path improvements, alongside new benches to improve site accessibility for the wider community. The report also notes that the council has a duty to act in a way that supports the successful delivery of the Scottish National Adaptation Plan 2024-29. Examples of adaptation action carried out within the council to date include: • Water management - where activity has focused on reducing flood risk through maintenance planning for watercourses and structures, completion of flood risk assessments, progress on the Kilsyth Flood Risk Reduction Scheme, delivery of local flood plan actions, and finalisation of actions from the Clyde and Loch Lomond Local Flood-Risk Management Plan. • Tree management - which includes better use of data to manage storm-related tree impacts. Report title Summary Community safety hub performance and development February 2026 A report in 2020 provided a one off update on the performance of the Community Safety Hub following its merger into the council’s Housing service. In order to ensure ongoing performance monitoring this report has since been incorporated into the service’s programme of annual service performance reports. Aligned Priority: • Improve the health and wellbeing of our communities. Ambition statement: 1. Ensure the highest standards of public protection. Consistent A standard set of measures are in place which are recorded and monitored consistently in order to provide a live and complete picture of community safety across North Lanarkshire. These measures focus on incidents captured (criminal incidents, community safety incidents, and anti-social incidents), environmental incidents, evidence requests (evidence disks and review requests), and missing persons. Transparent A breakdown of all types of incidents is provided in various data tables throughout the report. In context The Plan for North Lanarkshire aims to make North Lanarkshire a better place to live, learn, work, invest, and visit, where homes and public spaces are safe - and feel safe - for everyone. The work of the Community Safety Hub plays a key role in this respect by improving community safety through CCTV, tackling anti-social behaviour, managing the homeless out-of-hours calls, and ensuring public protection. The Community Safety Hub currently delivers: • Provision of 24 hour/365 days per year proactive monitoring of 1,376 public space CCTV cameras across North Lanarkshire. • 3 autonomous re-deployable trailers capable of sustaining four to six weeks without a dedicated power supply. • Evidence disks for Police Scotland, the Crown Office, and the Procurator Fiscal. • Call handling for the anti-social behaviour service 24/7, and the out-of-hours anti-social behaviour witnessing service. • Out-of-hours telephony service for emergency homelessness, and organisation of the out-of-hours homeless standby provision. • Co-location of Police Scotland officers. • Winter preparedness support for roads and land maintenance services. • An emergency response centre, including using CCTV images to support council resilience during major incidents, severe weather, and emergencies. • Provision of rest centres in the event they are required during incidents and / or emergencies. • Gypsy traveller liaison remit, including management of unauthorised encampments. Balanced Key highlights in the report include the following. Page 27 of 238
Page 28
• The programme to upgrade CCTV cameras in housing areas has now concluded, with 170 cameras replaced by high-definition units capable of operating in low-light conditions. This has significantly improved monitoring, with clearer images supporting crime detection and prevention, anti-social behaviour monitoring, fly-tipping and littering enforcement, and wider community safety. • Deployments of re-deployable mobile CCTV trailers continued throughout the year to assess the need for permanent installations. At four locations, costs were developed to consider permanent cameras: two permanent cameras have been installed at one site, installation is underway at a second site, and planning is nearing completion at the remaining two. This demonstrates the value of trailer deployment in informing investment decisions. • Work is progressing to deploy the Noise App for use by North Lanarkshire residents (the Noise App is an alternative to installation of sound monitoring equipment). Following trial and procurement, planning is underway to support investigations into anti-social behaviour and noise complaints, and future reports will provide updates on roll-out and uptake. • To tackle anti-social behaviour across North Lanarkshire, the Break the Cycle programme continues as a pilot to Friday/Saturday Night Projects attended by young people. The programme aims to educate on anti-social behaviour and its community impact, with ongoing engagement with Education colleagues to support roll-out within secondary schools. • To improve incident recording within the CCTV control room, the previous Access database has been replaced with a new Microsoft Lists database. Introduced in April 2025, this has improved accuracy, flexibility, and access to information, allowing live updates to categories and ongoing development of dashboards to support reporting and analysis. • Work has also been undertaken to update CCTV information within the council’s GIS mapping system. CCTV locations are now available on the internal council GIS Viewer via the CCTV layer on the Inside NL homepage. Key points in respect of performance in 2024/25 include the following: • Operating 1,376 cameras 24/7, CCTV monitoring continues to perform to a high standard. A total of 4,360 incidents were recorded, including criminal, community safety, anti-social and environmental incidents. The service produced 570 evidence disks, processed 1,711 review requests, supported 508 apprehensions, cautions or fixed penalties, and assisted with 137 missing person cases, highlighting its significant role in community safety. • CCTV incident data shows criminal incidents as the largest proportion of activity (42.6%), followed by community safety incidents (30.4%), with anti-social behaviour (13.3%) and environmental incidents (13.7%) making up smaller but similar shares. This reflects a primary focus on crime prevention alongside broad support for community safety and environmental issues. • The anti-social behaviour call handling and out-of-hours service handled 16,400 calls during the year, resulting in 10,064 service requests, with strong demand outside normal working hours. The out-of-hours witnessing service attended 992 call-outs and issued 115 warnings, demonstrating a key preventative and enforcement role in tackling anti-social behaviour and supporting community safety. • The out-of-hours anti-social behaviour services manages the deployment and assessment of sound monitoring equipment to investigate noise complaints. In 2024/25, 45 referrals were received, with only three cases on the waiting list and one in progress at year end. No instances of excessive noise were identified, indicating effective case management and low overall demand for formal noise enforcement. • The out-of-hours homeless service saw high demand in 2024/25, handling 8,764 calls outside normal working hours, averaging 24 calls per day. Of these, 2,164 calls (around 25%) were passed to standby officers to support homelessness assessments, emergency accommodation placements and welfare checks, highlighting the service’s critical role in supporting vulnerable individuals out-of-hours. Report title Summary Community Payback Order annual report 2024/25 March 2026 Community Payback Orders (CPOs) were introduced in Scotland in 2011 as an alternative to custody. They are intended to ensure that individuals convicted of offences make restitution to the community, while engaging in interventions that support rehabilitation, reduce reoffending, and promote social inclusion. The report provides an overview of service delivery, performance, key issues and outcomes relating to Community Payback while also providing information on the impact on individuals who are subject to CPOs and the tangible benefits provided to local communities. Aligned Priority: • Improve the health and wellbeing of our communities. Ambition statement: 14. Ensure the highest standards of public protection. Page 28 of 238
Page 29
Consistent • Section 227ZM of the Criminal (Procedure) Scotland Act 1995 places a duty on local authorities to prepare an annual report (outlining the operation of CPOs) which requires to be submitted to both the Scottish Government and Community Justice Scotland. • Community Justice Scotland collates these returns and summarise them in a report which is laid before Scottish Parliament. • To support the reporting requirement, Community Justice Scotland - in collaboration with Justice Social Work, the Scottish Government, and Social Work Scotland - have developed a template of questions for local areas to complete. Transparent This report outlines activity that includes: • The scale and nature of Community Payback Orders imposed in North Lanarkshire. • Examples of trauma-informed, person-centred practice. • Case studies demonstrating impact on reducing reoffending and addressing underlying needs. • Delivery and benefits of unpaid work and other activity requirements. • Feedback from service users and community beneficiaries. • Partnership working with third sector, health, housing, and employability services. • Organisational improvements and ongoing pressures, including increasing Multi-Agency Public Protection Arrangements (MAPPA) demand. In doing this, the report highlights the positive contribution of Community Payback to communities across North Lanarkshire, alongside challenges associated with rising complexity of need, mental health demand, poverty, and public protection responsibilities. The covering report provides an overview with more detail on specific activities included in the appendix to the report. In context • The National Community Justice Strategy sets out four national aims for Community Justice, and 13 priority actions and provides context for the delivery of justice social work services at local level. This is reflected in the North Lanarkshire Community Justice Partnership Board publication of their North Lanarkshire Community Justice Outcome Improvement Plan for 2023-28. While the work described within the report is guided by the national vision and policy as well a core statutory responsibilities in this area, the report reflects also that the role of justice services within North Lanarkshire is aligned to the council’s Programme of Work and supports the wider ambitions of The Plan for North Lanarkshire’s vision and priorities. • Prior to 1 October 2022, individuals subject to court-mandated unpaid work requirements were given up to 12 months to complete these hours, following emergency provisions introduced by the Scottish Government under the Coronavirus (Scotland) Act 2020 to address pandemic-related backlogs. From October 2022, the timescale reverted to the standard six-month completion period for new unpaid work requirements. Balanced During 2024/25 North Lanarkshire justice services delivered person-centred, trauma-informed CPO interventions that prioritised community safety, rehabilitation and reducing reoffending. Key highlights include the following: • 898 new supervision requirements were imposed, including 551 with unpaid work. • Strong outcomes were evidenced through intensive supervision, multi-agency working, and targeted interventions, including women’s services, domestic abuse programmes, and mental health support. • Holistic support remained central, with partnership working across addiction, mental health, employability, and third-sector services, generating £650,201 through income maximisation. • Unpaid work delivery remained strong, with almost 91,000 hours of activity completed, 554 bespoke items produced, and 364 refurbished bikes donated, supporting communities, wellbeing, and employability. • Other activity interventions continued through third-sector partnerships, offering mentoring, counselling, training, and digital learning. • Service user and community feedback was overwhelmingly positive, highlighting consistent support, skill development, and high-quality unpaid work. • Conduct requirements remained the most commonly used CPO requirement after supervision and unpaid work. • MAPPA workload increased by 8.5%, reflecting growing complexity, risk, and challenges linked to staffing, recruitment, system pressures, and poverty. • Partnership working remained a key strength, supporting training, employment, wellbeing, and reintegration. • Future priorities include exploring the Caledonian Programme and strengthening support for individuals unsuitable for group interventions. Appendix 2 to the report includes a range of examples in relation to unpaid work which takes place in a number of different settings across local areas: • Individual placements - working in charity shops, maintaining parks, community facilities, local food banks, and sheltered housing complexes. • Squad placements - landscaping, maintaining gardens of community buildings, and being part of North Lanarkshire’s gritting plan. Page 29 of 238
Page 30
• The Restorative Justice Hub in Bellshill - containing a number of workshops that focus on utilising existing skills or creating new skills for service users to make a practical contribution to North Lanarkshire. This includes woodwork, the bike workshop, home improvement workshop, laundry, and preparing food parcels. • Justice Hub in Motherwell - unpaid work at this hub focuses on practical skills that do not involve machinery, e.g. making crafts to be sold for the local community and healthy cooking on a budget. • Allotment Hub at the Clydeside - unpaid work at this hub provides outdoor placements in nature, which help individuals get involved in the growing of fruit and vegetables that benefits local communities. A cooking group then follows the journey of seed to plate. The allotment also hosts a number of rescued battery chickens offering an opportunity to learn animal care. Report title Summary North Lanarkshire Community Planning Partnership: annual oversight and outcomes report 2024/25 February 2026 • The Community Empowerment (Scotland) Act 2015 introduced a range of requirements on local authorities and community planning partners to empower and strengthen community involvement in the design, planning, and delivery of local services and in enabling community management or ownership of buildings and land. • The Act requires all public sector bodies to work together and engage with local communities on the issues that matter most to them with the shared aim of improving outcomes in these priorities. There is a particular focus on tackling inequalities, poverty, and socio-economic disadvantage within local communities. Community planning partners must also report publicly on progress, demonstrating where outcomes have improved through joint planning, collaboration, and effective partnership working - both operationally and strategically. • This annual oversight and outcomes report highlights the positive impact of community planning in North Lanarkshire, showcasing strengthened partnership working and improved outcomes aligned with The Plan for North Lanarkshire’s shared ambitions. Aligned Priority: Enhance participation, capacity, and empowerment across our communities. Ambition statement: 20. Improve the involvement of communities in the decisions, and development of services and supports, that affect them. 24. Review and design services around people, communities, and shared resources. Consistent All Community Planning Partnerships are required to annually review and report on their progress. Transparent • The report provides assurance that the North Lanarkshire Community Planning Partnership has identified communities experiencing significantly poorer outcomes compared to other areas within the local authority. For these communities, individual Locality Improvement Plans are developed and published, outlining the specific issues to be addressed and the actions partners will take to improve outcomes. This report provides assurance that the North Lanarkshire Community Planning Partnership is fulfilling these statutory obligations. • A detailed summary, attached as an appendix to the report, highlights collaborative efforts between public sector partners, the voluntary sector, and residents in planning, delivering, and resourcing services aimed at improving outcomes and tackling inequalities. In context • The report advises that an integrated programme of reporting activity supports the North Lanarkshire Community Planning Partnership in monitoring progress against priorities while fulfilling its statutory reporting obligations. This includes - consideration of the annual Outcomes report by the North Lanarkshire Partnership Strategic Leadership Board and the Communities Committee, followed by publication on the council’s website. It also includes submission of a composite performance report to the North Lanarkshire Partnership Strategic Leadership Board every six months, detailing partnership activity and progress on identified priorities and actions across the nine Local Outcome Improvement Plans (similar reports are considered by the Communities Committee and published online), as well as preparation and publication of annual progress reports on delivery of individual Local Outcome Improvement Plan actions for each area, considered by the relevant Community Board, and annual reporting by statutory partnerships and other working groups on thematic plans (such as the Children’s Services Plan and Tackling Poverty Action Plan). Balanced Key highlights - described more fully in the appendix accompanying the report - include the following: • Community empowerment - the Partnership successfully advanced the implementation of Local Outcomes Improvement Plans across all nine Community Board areas, supported by strengthened Local Partnership Teams and enhanced improvement planning through Community Board Chairs. Page 30 of 238
Page 31
• Community wealth building - a comprehensive multi-agency Community Wealth Building Statement and Implementation Plan were developed, embedding Community Wealth Building principles across procurement, employment, land use, finance, and inclusive ownership, while maintaining active engagement with the national Community Wealth Building Practitioners Network. • Local Employability Partnership - collaborative efforts were intensified to expand initiatives targeting priority groups and to strengthen stakeholder partnerships, ensuring the delivery of inclusive and sustainable employment pathways. Report title Summary Education performance update March 2026 This report provides an update on North Lanarkshire’s educational performance for the 2024-25 session across key measures including attainment within the broad general education (from early learning and childcare to end of S3) measured via Achievement of a Level (ACEL) data, attendance and exclusion, teacher numbers, and the pupil teacher ratio. The report includes local authority comparison data compiled from national statistics published in December 2025 (https://www.gov.scot/collections/school-education-statistics/ ). The report also provides a summary of HMIe and Care Inspectorate inspection outcomes for 2024-25 and, where applicable, outlines impact, progress to date, and planned next steps. Aligned Priority: • Support all children and young people to realise their full potential. Ambition statement: 6. Raise attainment and skills for learning, life, and work to enhance opportunities and choices. Consistent • Local authorities have a duty to improve standards in education, challenging and supporting educational establishments to ensure continuous improvement. North Lanarkshire’s quality improvement framework, updated in session 2022-23, empowers school leaders to secure continuous improvement while providing assurance to stakeholders on the quality of education provided for learners. Transparent • The report outlines the key strategies implemented in 2024-25 to further support the quality improvement framework and facilitate improvement across North Lanarkshire’s educational establishments. The framework is managed by Education and Families Managers who, along with heads of establishment, use ACEL data to support improvement discussions, attainment reviews, raise attainment, and close the poverty related attainment gap. In context • The report sets the context in respect of attainment within the broad general education highlighting that the Curriculum for Excellence (CfE) is divided into two phases - the broad general education (BGE) and the senior phase. • The BGE has five levels (Early, First, Second, Third, and Fourth). It begins in early learning and childcare and continues to the end of S3 (the third year of secondary school). As illustrated in the table below, broadly speaking at the primary stages, progress through a level can take up to three years, although the curriculum is designed to allow pupil progress to be accelerated to ensure breadth, depth, and challenge across and within levels. • ACEL data is the measure of attainment within the BGE. It is based on Teacher Professional Judgement of a pupil’s attainment in literacy (listening and talking, reading, and writing) and numeracy for all pupils at P1, P4, P7 and S3. This data is collected by the Scottish Government at the end of each academic session and published, nationally, in December each year. • Analysis of the published data informs the council’s future improvement planning and enables performance tracking against national averages and comparable local authorities, particularly within the West Partnership and the family group of similar councils (which in this instance is based on the level of deprivation - as per the Scottish Index of Multiple Deprivation (SIMD) - and comprises Dundee City, Glasgow City, East Ayrshire, Inverclyde, North Ayrshire, North Lanarkshire, West Dunbartonshire, and the Western Isles. Page 31 of 238
Page 32
Balanced • The report comprises a number of detailed data tables that show North Lanarkshire’s performance over time as well as a comparison with the national average and family group average of similar councils. Data in these tables relates to the following: - P1, P4, P7 combined data for literacy and numeracy. - Performance within Curriculum for Excellence organisers - this shows attainment data across the literacy and numeracy organisers which provides valuable insights to support the service’s strategic planning, including staff training and the allocation of support. The data is shown as the proportion of P1, P4, and P7 achieving expected Curriculum for Excellence levels. The report also includes data for S3. - Information on alignment with national patterns notes that North Lanarkshire’s attainment broadly mirrors national trends across the primary stages, reflecting post-pandemic stabilisation. Recent slight dips in P1 and P4 literacy and P4 numeracy align with national slowing following earlier recovery, while strengths in listening and talking, and stronger early numeracy, remain consistent with Scotland-wide patterns. - Combined data for literacy and numeracy, highlighting learners’ attainment at Curriculum for Excellence 3rd and 4th level. - Cohort comparison in respect of ACEL data - comparing 2025 to 2022 data allows performance to be tracked in terms of the progress of the same cohort of pupils who have moved from P1 to P4, P4 to P7, and P7 to S3 over the four year period. - Progress towards closing the poverty related attainment gap over time. The latest national figures indicate that the poverty-related attainment gap continued to narrow, with the primary literacy gap reducing to its lowest recorded level (19.4 percentage points) in 2024-25. The primary numeracy gap also narrowed to its lowest recorded level (16.6), driven by improved attainment among pupils in SIMD Quintile 1 (most deprived). In 2024-25, the S3 Curriculum for Excellence 3rd level or better attainment statistics gap in literacy reduced from 12.7 to 10.8 percentage points, and in numeracy from 12.0 to 11.6. These are the lowest levels on record, with greater improvement among pupils in the most deprived areas. - Senior phase pre appeal data, pupil numbers, teacher numbers, the pupil teacher ratio, attendance, and exclusions. - HMIe and Care Inspectorate inspection outcomes - from August 2025 to January 2026, 14 North Lanarkshire schools were involved in inspection activity (9 primary schools, 3 secondary, and 2 additional support needs). A summary of these outcomes, against each quality indicator, is shown in the graph on the right - this is based on six inspection reports published to date. - Ratings for four nursery inspections - these reported mainly satisfactory performance across key quality indicators, with one area rated as weak; all gradings rated as weak require an action plan to be developed to ensure the establishment has the capacity to improve. Report title Summary Housing and corporate maintenance and investment services contract - interim report February 2026 Operational, since July 2024, the housing and corporate maintenance and investment services contract has allowed the council to access a range of maintenance, repair, and essential compliance services for its housing and corporate property portfolio. The report provides the latest results against the contract through a set of performance measures, as well as performance in relation to the Scottish Housing Regulator and measuring the charter outcomes. The report also includes an overview of the contractor’s performance against social value targets, contract spend, any applicable service credits and strategic maturity monitoring for each contractual year. It aims to ensure the Housing Committee has sufficient information to assess how contract performance supports the council in delivering against The Plan for North Lanarkshire, as well as producing a high level of service delivery, legal compliance, and customer satisfaction. Page 32 of 238
Page 33
Aligned Priority: • All priorities. Ambition statement: • All ambition statements. Consistent • To ensure regular updates on the contract are reported to committee, an annual report is scheduled to be presented to the Housing Committee in cycle 3 each year. Transparent • The report sets out a range of performance outputs in two detailed appendices showing data for housing and corporate measures. • In addition, Appendix 3 to the report provides an update on core projects awarded (and not awarded), and Appendix 4 reports on performance indicator exclusions with reasons and remedial actions. • The report notes that from contract commencement to 31st December 2025, a total of 33 additional contracts have successfully transitioned to the contract with services being provided. In context • The report provides information in respect of the transition of contracts in scope. In addition, a summary of community benefits is reported to show the benefits at a local area which was a key aspect of the procurement along with the contractor’s social value commitments (e.g. including the creation of new jobs, craft and modern apprenticeship programmes, work placements, and employing locally). Balanced • Social value highlights delivered during the latest reporting period of the contract include 36 craft trade apprenticeships, 17additional jobs created, 365 hours volunteering for St Andrews Hospice/projects, work ongoing re the North Lanarkshire Deaf Hub, St Aidan’s flexible learning space enhancing inclusive education, a Christmas Appeal, support for homeless in North Lanarkshire, and the provision of winter warmer packs. • To accompany the detailed data appendices, the covering report shows the latest performance position between 1st July and 31st December 2025: - Housing property - performance exceeded targets across all repair measures - 97.5% of immediate response jobs, 97.0% of normal response jobs, and 98.2% of void repair orders were completed within timescale, all above the 95% target. Customer satisfaction was 95.1%, meeting the target and exceeding the 2024/25 Scottish average of 87.0%, while the right first time measure is currently under review due to a potential calculation anomaly, with corrective work underway. - Corporate property - 97.96% of immediate response jobs and 99.02% of normal response jobs were completed within timescale, both exceeding the 95% target. Customer satisfaction is currently under review, with data presently collected at the post-inspection stage by technical officers. - 52 stage one complaints were upheld or partially upheld. All complaints are analysed to identify recurring issues and drive service improvement actions. There were no complaints relating to corporate property during this period. - 6 stage two complaints were upheld / particularly upheld. • The report includes a section on core project contractor performance. As well as traditional contract administration methods of contract and supplier management, contractor performance is also monitored for the delivery of these contracts using balanced scorecards to capture performance indicator scores against an agreed scoring framework and assign a RAG status. Report title Summary Roads and infrastructure maintenance and improvement services contract - interim report February 2026 This report provides an interim performance update up to the first anniversary of the commencement of the roads and infrastructure maintenance and improvement services contract (awarded to Hochtief PPP Solutions GmbH). Since October 2024, this contract has been used to deliver a range of maintenance, repairs, and investment services for the council’s roads and related infrastructure assets. The report provides the latest results against the contract through a set of performance measures, as well as information on the enhanced contract management that has been developed around the enterprise contracts. It aims to ensure the Environment and Climate Change Committee has sufficient information to assess how the contractor’s performance supports the council in delivering against The Plan for North Lanarkshire, as well as producing a high level of service delivery, legal compliance, and customer satisfaction. Aligned Priority: • All priorities. Page 33 of 238
Page 34
Ambition statement: • All ambition statements. Consistent • To ensure regular updates on the contract are reported to committee, an annual report is scheduled to be presented to the Environment and Climate Change Committee in cycle 3 each year. This will provide an overview of achievements against the performance indicators, as well as social value outcomes, contract spend, any applicable service credits, and strategic maturity monitoring for each contractual year. Transparent • The report sets out the contract’s governance arrangements which involves multiple layers of governance to provide essential scrutiny and oversight and set out clear roles and responsibilities for operational ownership, contract management, and contract development activity. This includes details of the governance groups, their roles, meeting frequencies, and council membership. • The report also sets out a range of performance outputs in Appendix 1, showing data against each performance indicator reference number. • The report includes performance narrative in the appendix in terms of reporting frequency and targets for each indicator in Appendix 2. It also summarises, in Appendix 3, the core projects undertaken or initiated during the reporting period (in addition to the annual improvement programmes undertaken for roads and infrastructure assets such as carriageways, footways, street lighting, drainage, and signs). • Appendix 4 reports on performance indicator exclusions with reasons and remedial actions. In context • As well as key social value highlights, the report includes information on the contractor’s Connecting Communities programme designed to deliver community benefits including time, finance, and physical resources to support voluntary, community and social enterprises operating locally. Balanced • Social value highlights delivered during the latest reporting period of the contract include 5 new apprenticeships created across the contract and supply chain, £8.6m spent through local supply chain, 64% of workforce locally based, Gold Award status via the NL Employee Charter, Disability Confident accreditation from the council, Age Friendly Employer Pledge signatory with Centre for Ageing Better, 11 site visits for school children or local residents, 12 women hired on the contract along with 3 armed forces veterans employees, 6 disabled employees, 99 residents employed directly or through the supply chain, and 155 local direct employees hired or retained on the contract. • Round one of Connecting Communities saw 9 organisations awarded over £17k and receive over 48 hours of staff resources to support local initiatives. • The report and supporting appendix demonstrate compliance with statutory requirements for the day-to-day management and co-ordination of road works. This includes performance on reactive maintenance (for roads, lighting, and other infrastructure assets, including potholes, drainage issues, street lighting faults, bollards, signs, fences, and walls), incident response to emergencies, and winter maintenance. • Compliance, safety, and value for money is also reported and - during the first year of the contract - the report states there were no formal interventions from regulatory bodies, including the Health and Safety Executive, the office of the Scottish Roadworks Commissioner, or other recognised authorities. Report title Summary Revenues and benefits update March 2026 This report provides a regular update on the payment performance for the administration and collection of all local taxation in North Lanarkshire in the form of council tax and non-domestic rates. In addition, the service is responsible for administering a number of benefits for the residents of North Lanarkshire (including housing benefits, council tax reduction, Scottish Welfare Fund, Discretionary Housing Payments, free school meals, clothing grants, and blue badges). It provides an update on performance as at 31st December 2025. Aligned Priority: • Improve North Lanarkshire's resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. Consistent • Produced quarterly, this report provides detailed in-year performance figures which can be compared to the same period in previous years. Transparent • The year to date performance set out in the report covers a wide range of service activities as well as the amount of funding paid out to help households in need in order to provide a safety net for local people on low incomes. Page 34 of 238
Page 35
In context • The report includes the latest context within which the service is operating; this is of particular relevance given the aforementioned administration of grants and support payments required for low income households. The report also advises of any new national grants when they are introduced, or will cease, and the qualifying conditions for receipt of such. • Specific context is also provided in relation to Discretionary Housing Payments (DHP) and the Scottish Welfare Fund (SWF), along with grants allocated to the council and paid through these supports. Balanced The report provides a high-level summary of the highlights which shows that: • As at 31st December 2025, 82.11% of council tax due for 2025/26 had been collected - a marginal increase from the same period last year (+0.37%). • Non-domestic rates collection at 31st December 2025 had reached 64.65% of the total annual charge, lower than the previous year (81%). • The service continues to meet statutory timescales for administering benefits applications and changes. The latest performance shows this to be an average of 15 days for new claims and 11 days for changes of circumstances, both lower than the DWP targets of 30 and 16 days respectively. In addition, for 2025/26 to date (as at December 2025): • Blue badges - the council continues to administer the Blue Badge scheme in line with national guidance, assessing eligibility where automatic entitlement does not apply. To date 8,743 applications have been processed, with 7,125 awarded - an 81.5% award rate, compared to 89.7% over the same period last year. Although national guidance allows up to 12 weeks for decisions, the council is currently determining applications within 6 weeks. • Clothing grants and free school meal applications - 11,187 clothing grants were administered and paid out (compared to 11,711 at the same point last year), and 10,211 free school meal applications were awarded (slightly higher than the 10,167 awarded during the same period last year). • Discretionary Housing Payments - the council continues to manage housing support funding for tenants facing housing-related financial pressures. Total payments for support reached £6.115m, up from £5.956m at the same point in 2024/25, with a further £0.433m (75.94%) of funding for wider housing and homelessness pressures paid or committed. • Scottish Welfare Fund - the council continues to manage a £2.760m annual support fund for residents facing severe financial hardship, focusing on the most vulnerable through high-priority assessment. To date, 17,010 applications were assessed, resulting in 12,763 awards, compared with 18,731 applications and 13,261 awards as at the same time last year. To date, £2.158m (64%) of the available budget has been paid, with full spend expected by year-end, while urgent cases (e.g. linked to homelessness) continue to be prioritised and support offered where applications are unsuccessful. Report title Summary Financial monitoring report - council summary (revenue) March 2026 This report updates on the overall financial position for the General Fund Account, Housing Revenue Account, and Adult Health and Social Care. (Note, the Council set its Revenue Budget and Council Tax for 2026/27 and provided a forecast Revenue Budget position for financial years 2026/27 and 2028/29 at the committee meeting in February 2026). Aligned Priority: • Improve North Lanarkshire’s resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. 25. Ensure intelligent use of data and information to support fully evidence-based decision making and future planning. Consistent • The report at each financial period end consolidates the budget monitoring position of all council services into one council summary, highlighting and explaining major variances as per the council’s approved Financial Regulations. • The March 2026 report presents the council’s revenue monitoring position for the financial year 2025/26 as at the end of period 10 (i.e. from 1st April 2025 to 2nd January 2026). Transparent • The report highlights / explains major variances as per the council’s approved Financial Regulations which require services to remain within their approved budgeting provision, and to report all significant deviations - defined as the higher of £100,000 or 5% - within budget monitoring reports. • Following Committee agreement, this report also provides financial performance information in relation to the council’s Arm’s Length External Organisations (ALEOs) (i.e. North Lanarkshire Properties, Fusion Assets Limited, and Routes to Work Limited). Page 35 of 238
Page 36
In context • All activities undertaken by the council are subject to risk, and in acknowledging the council’s approved Risk Management Strategy, services manage risks as part of their overall corporate and service planning processes. The March 2026 report states that the current economic climate and pay and non-pay inflation, continuing at historically high levels, are some of the key factors that have the potential to impact on the council’s ability to provide quality services within approved budget levels. Balanced • Where significant deviations are identified, services must provide explanatory commentary, outline the action required to rectify such deviations and, where relevant, highlight any impact on other budget headings. This information is captured by Finance and summarised in the overall council report. • A summary by division for the period ending 2nd January 2026 (P10) is included in an appendix to the report, as is a note of anticipated commitments against earmarked and other reserves, and available general fund balances. Report title Summary Financial monitoring report - council summary (capital) March 2026 This report provides an update on the 2025/26 resources and expenditure for the council's Strategic Capital Investment Programme. The report also shows the 2025/26 projected outturn position and resultant variances. (Note, the Strategic Capital Investment Programme for 2024/25 to 2028/29 was approved by Policy and Strategy Committee in March 2024, with an update reported on March 2025 and March 2026). Aligned Priority: • Improve North Lanarkshire’s resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. 25. Ensure intelligent use of data and information to support fully evidence-based decision making and future planning. Consistent • The report at each financial period end consolidates the capital monitoring position of all council services into one council summary. • The March 2026 report summarises the overall council Strategic Capital Investment Programme for 2025/26 in relation to resources and expenditure and the 2025/26 projected outturn position and resultant variances. Transparent • The report notes that Strategic Capital Investment Programme 2024/25 to 2028/29 was approved at Policy and Strategy Committee in March 2024, with updates provided in March 2025 and March 2026. It represents the total Community Investment Programme incorporating the General Services Capital Programme and HRA Capital Programmes. • The programme was developed in conjunction with services and led by the Strategic Capital Delivery Group (SCDG) using the principles established by the council’s Capital Strategy. In context • The report states that the General Services Capital Programme (supported by General Services resources) demonstrates to communities that the place making vision for towns remains a priority, and that the approved 5-year capital investment plan supports delivery of The Plan for North Lanarkshire. • The programme includes investment in Town and Community Hubs, the City Deal programme, and external grant funding. In addition, the Housing Revenue Account (HRA) resources support several HRA Capital Investment Programmes including the mainstream programme for investment in the council’s existing estate and delivery of the ambition for additional supply through the new build and council buyback programmes. Balanced • The report notes the current financial position in respect of the 2025/26 General Services Capital Programme and the Housing Revenue Account. This reflects the approved budget and subsequent decisions made at the Strategic Capital Delivery Group (SCDG) in accordance with the SCDG terms of reference, and where appropriate by the individual service committees, Finance and Resources Committee, or the Policy and Strategy Committee (as per the Scheme of Administration). • A breakdown of the overall 2025/26 budget by service programme and associated approved budget movements is included in an appendix to the report. • In acknowledging the risks, the report recognises that the capital programme continues to face challenges in relation to the wider economic climate, linked to availability of materials, contractors, and inflationary pressures. These are managed by services and Project Boards associated with specific programme delivery and will continue to be monitored throughout the year in accordance with the SCDG Terms of Reference. Page 36 of 238
Page 37
Report title Summary Financial monitoring - savings March 2026 This report provides an update on the achievement of the three-year financial savings targets and progress. Aligned Priority: • Improve North Lanarkshire's resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. Consistent • This regular report ensures ongoing oversight by Elected Members of the Finance and Resources Committee in terms of implementing savings. Transparent • The report provides an update on the achievement of the three-year financial savings total of £8.326m approved as part of the 2025/26 budget setting process and advises it is projected that 89% will be delivered within the financial year, with replacement savings identified to fully address the shortfall. In addition, it is currently anticipated that there will be no recurring savings gap arising from the 2025/26 to 2027/28 approved savings. In context • Appendices to the report provide a review of budget savings by exception and a summary of service specific information on savings; the report states that more detailed information in relation to savings is reported through the relevant service committee. Balanced • Each service report, that supports the production of this composite report, sets out the context for savings in that services are required to monitor the delivery of their target savings to ensure they remain within their approved budgets. Periodic progress updates are required within individual service revenue monitoring reports, identifying alternative solutions to any in-year shortfall envisaged. In addition, services are required to monitor whether the original approved saving has been implemented and if not, provide an explanation along with alternative action required to ensure the recurring financial saving will be achieved going forward. This information is captured by Finance and summarised in the overall council report. Key to RAG status green Performance is on target and/or within acceptable thresholds red Performance does not meet target and is outwith acceptable thresholds blue Performance surpasses the target and exceeds expectations Page 37 of 238
Page 38
Page 38 of 238
Page 39
North Lanarkshire Council Report Audit & Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/ASP/ALMay26 Date 14/05/26 Audit and risk related items: Action log From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Francis Scott Chief Officer (Audit and Risk) Executive Summary The purpose of this report is to allow elected members to track implementation of outstanding requests and recommendations made by the Panel in respect of audit and risk- related items. The attached log (at Appendix 1) records those audit and risk-related requests and recommendations made by the Panel and when these were addressed and/or are expected to be addressed. Any actions that have previously been reported as complete and noted by the Panel have been removed from the log. Recommendations The Panel is invited to note the report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 4 Page 39 of 238
Page 40
2 Appendix 1 Audit and Risk related items: Outstanding action log Date Requests or agreed action Status March 2026 Can an update be provided to the next meeting of the Panel to clarify how many volunteers require/already have PVG’s and how these will be recorded internally and the arrangements to be put in place to ensure records are and remain up to date? Complete – the Chief Officer (Education – North) and the Chief Officer (People Resources) have provided an update to the questions arising from the Panel meeting in March and will attend Panel meeting in May to answer any further questions. Previous audit report on PVGs attached for information. Page 40 of 238
Page 41
3 INTERNAL AUDIT REPORT PROTECTING VULNERABLE GROUPS Headlines The Council has a statutory responsibility to ensure that individuals working with children and protected adults are members of the Protecting Vulnerable Groups (PVG) scheme. The PVG scheme is managed by Disclosure Scotland and involves conducting criminal record checks on its members to ensure that individuals who are unsuitable to work with children and protected adults cannot undertake regulated roles with these groups. As part of the changes arising from the introduction of the Disclosure (Scotland) Act 2020, from April 2025, it is now a legal requirement for individuals undertaking regulated roles to be a member of the PVG scheme and non-compliance with this requirement is now a criminal offence. Further changes to the PVG scheme are expected, including the requirement for PVG memberships to be renewed every five years. The purpose of this audit was to assess the adequacy and effectiveness of the Council’s arrangements for managing PVG scheme membership for its employees and volunteers undertaking regulated roles. Based on the results of our work, we are generally satisfied that there are appropriate processes in place for identifying regulated roles, ensuring that new employees and volunteers undertaking regulated roles hold the appropriate PVG membership and that records held to confirm PVG membership comply with data protection legislation. We have therefore categorised this audit as offering reasonable assurance. However, the arrangements for recording whether a post is regulated and that individuals hold a valid PVG membership are not always clear and consistent. As a result, it was difficult to verify the completeness of records in order to demonstrate that all employees in regulated roles hold the appropriate PVG membership. Additionally, the PVG Scheme and Disclosure Information Policy only refers to employees and does not currently reflect the changes arising from the updated legislation, and there is a lack of clear processes for school volunteers. We have highlighted a number of areas for improvement, which are detailed in section 3 of this report and include: • An urgent need to improve the recording arrangements around PVG membership for employees and volunteers. • A need to review the Policy, processes and governance arrangements to fully reflect current legislation and expected practice. • The PVG arrangements and processes in place for school volunteers need to be clearly defined and implemented. Internal Audit Opinion Reasonable assurance Priority of Recommendations High Medium Low 1 2 1 Organisational Impact Moderate Report status FINAL Audit ref 0900/2026/007 Date Issued 12/02/26 Audit Team Kimberley Hall and Lesley Armstrong Issued To Chief Officer (People Resources) and Chief Officers (Education) (Rec 3 only) Copied To Chief Executive and Deputy Chief Executive Page 41 of 238
Page 42
4 1. Executive Summary Objectives The audit sought to provide assurance on the following areas: • There are adequate written policies covering the requirements of the PVG scheme and these are aligned with current legislation and Disclosure Scotland guidance. • Roles and responsibilities for PVG compliance are clearly defined and communicated across Services. • Appropriate arrangements are in place to correctly identify and document all roles undertaken by employees and volunteers which involve regulated work and ensure that all individuals in such roles have a valid and appropriate PVG. • There are robust processes in place for verifying identity and eligibility of individuals and ensuring that PVG checks are completed and approved before individuals commence regulated work. • PVG information and records are stored securely, with retention and disposal of such records complying with data protection legislation and council policy. Work undertaken included confirming and reviewing the actions taken to ensure the Council’s continued compliance with Disclosure requirements as a result of the changes to Disclosure legislation introduced from April 2025 as well as checks on a sample of employees in regulated roles to confirm that they have the appropriate PVG membership. This engagement has been conducted in accordance with the Global Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • The HR Business Partner team undertook a review of all posts within the Council to identify any additional roles which require a PVG/Disclosure as a result of the changes to legislation. • PVG checks are undertaken by the Workforce Resourcing Team for new employees in regulated roles as part of the pre-employment checks, with valid membership in place prior to individuals commencing their employment with the Council. • An exercise was undertaken to process retrospective PVG applications for current employees categorised in ‘regulated roles’ to ensure that appropriate staff have valid PVG membership. Key areas requiring management action (High Priority) The following key areas requiring urgent management action have been identified: • There is an urgent need to improve the recording arrangements around PVG membership for employees and volunteers. Other areas for improvement (Medium Priority) A number of other areas for improvement were also identified: • There is a need to review the Policy, processes and governance arrangements to fully reflect current legislation and expected practice. • The PVG arrangements and processes in place for school volunteers need to be clearly defined and implemented. Page 42 of 238
Page 43
5 3. Action Plan Protecting Vulnerable Groups 0900/2026/007 Ref Finding 1 There is an urgent need to improve the recording arrangements around PVG membership for employees and volunteers. The new legislation, implemented from April 2025, resulted in a large scale, complex exercise for People Resources to identify newly regulated roles and ensure that the individuals in those roles obtained PVG membership. We note that significant work has been undertaken to update and improve the records held to enable easier identification of regulated roles and confirmation that postholders hold the appropriate PVG membership. A list of regulated roles has been produced, which details the type of PVG or disclosure check each role requires, and the requirement for a PVG (child, adult or both) has been added to the relevant posts and positions within iTrent. Completed and in-progress PVG and disclosure checks for employees and other parties undertaking regulated work on behalf of the Council are recorded on tracker spreadsheets and an exercise is currently underway to improve the recording of PVG membership and completed disclosure checks for employees by logging this information against their individual record on iTrent to ensure that a single, complete record is held. We obtained a report from iTrent which details all posts and positions within the Council, whether they require a PVG and if so, which type and whether the postholder holds the appropriate PVG membership. We undertook a review of this report including comparison against the list of regulated roles and the tracker spreadsheet for recording PVG and disclosure checks and identified the following issues: • The iTrent report contains 300 entries where the requirement for/type of PVG required for the post and position do not match. • The iTrent report contains 1,500 entries where the post/position requires a PVG, but the employee’s iTrent record does not indicate that they have one. We were advised that this gap was due to the transition of PVG information from the Service files to iTrent, and on completion of the exercise each iTrent record will have been updated. Our testing on a targeted sample of 25 of these entries confirmed that PVG membership was held and the details were recorded elsewhere. • There are instances where the requirement for/type of PVG differs between the iTrent report and list of regulated roles. • The list of regulated roles contains a number of posts which no longer exist (e.g. Heads of Service) or the post has been renamed. • There were inconsistences between the type of PVG required for some posts and the type of PVG held by the postholder. Whilst we acknowledge that the exercise to record all PVG memberships on iTrent is still ongoing, the issues highlighted above make it difficult to verify the completeness of information in order to demonstrate that all employees in regulated roles hold the appropriate PVG membership. We therefore, consider that it is important that these records are updated fully and accurately as soon as possible. We were also advised that, once these arrangements are fully implemented, there are plans for ongoing review and update to provide assurance that all individuals undertaking regulated roles hold a valid and appropriate PVG membership. Implication Recommendation Priority Management response Implementation Date If the arrangements for recording regulated roles, the type of PVG membership required and individual employees with PVG membership are not robust, there is a risk that an employee may be employed in a regulated role without PVG membership which could result in placing vulnerable groups at risk of harm, reputational damage or financial risk. The Chief Officer (People Resources) should: (1) As a matter of urgency, continue to progress the project for improving the recording of regulated roles against posts, positions and individual employees on iTrent, with a view to holding a complete record of all regulated roles and associated PVG membership for employees. (2) Produce and review regular exception reports from iTrent to identify any anomalies with regulated roles, including those referred to in the finding above and potential individuals who do not hold a valid and appropriate PVG membership. Action to resolve any issues identified should be taken as appropriate. (3) Consider whether a centralised record confirming PVG membership should be maintained for all parties undertaking regulated work. High Agree Gillian Quinn, Employee Service Centre Manager The Service agrees that recent and planned future changes to the scheme now require improvements to previous arrangements for the recording of PVG’s. Work is well underway in this regard and will be progressed as quickly as possible. Once complete, this will allow for regular exception reporting to be established to provide ongoing assurance of compliance with the scheme and the regulations. Once work is complete on recommendations 1 and 2, consideration will be given to recommendation 3, although it is expected that this will be complex as it involves non-employees. It will not be possible to hold both non-employee PVG and employee PVG records on iTrent and therefore other arrangements will have to be considered. December 2026 Page 43 of 238
Page 44
6 3. Action Plan Protecting Vulnerable Groups 0900/2026/007 Ref Finding 2 There is a need to review the Policy, processes and governance arrangements to fully reflect current legislation and expected practice. The Chief Officer (People Resources), as lead signatory for the Council, has overall responsibility for ensuring that disclosure information is handled properly, with responsibility for processing PVG applications and ensuring that individuals in regulated roles have the appropriate PVG membership being delegated to relevant teams within Services. However, there is no individual officer with overall responsibility for ensuring that all parties undertaking work on behalf of the Council have been considered and that relevant Services have appropriate arrangements in place for processing applications and recording PVG membership. Changes to the core legislation governing the PVG Scheme were implemented from April 2025, with further changes in relation to the movement from lifetime to five-year membership expected in April 2026. Whilst the Council has a PVG Scheme and Disclosure Information Policy, this was last updated in 2016, and from our review of this Policy, we noted that it only relates to employees and elected members and does not reflect the governance arrangements for other parties undertaking regulated work on behalf of the Council (including volunteers, self-employed contractors or agency workers) or details of key contacts. Additionally, the Policy does not yet reflect the recent legislative changes or resulting amendments to the Council’s processes and governance arrangements arising from these changes. We recognise, however, that there are further expected changes to the legislation and Disclosure Scotland guidance and note that People Resources acknowledged the need for the Policy to be updated within their report to CMT in August 2025 which outlined the changes to the PVG scheme. Implication Recommendation Priority Management response Implementation Date If policies do not fully reflect legislation or expected practice, the Council may fail to comply with legal and statutory requirements, which could result in reputational damage or financial penalties and there may be inconsistencies in the way in which officers carry out required tasks. The Chief Officer (People Resources) should: (1) Undertake a review of the governance arrangements for PVGs to establish clear roles and responsibilities and processes, giving due consideration to the need for an officer with overall responsibility. (2) Undertake a review of the Policy to ensure that it fully reflects the changes arising from the new legislation and any resultant amendments to the Council’s processes and governance arrangements, covers all parties undertaking regulated work on behalf of the Council and provides details of key contacts/countersignatories for processing applications. Medium Agree Linda Cullen, Employment & Policy Manager Changes to the scheme are still ongoing. For example, the implementation of the five-year scheme, which will affect the majority of Council staff who currently hold a PVG, does not commence until April 2026. Once all final changes to the scheme have been implemented, the policy will be fully updated to reflect all requirements arising from the new legislation. This will include clear governance arrangements for the operation of the scheme, including defined roles and responsibilities going forward. January 2027 Page 44 of 238
Page 45
7 3. Action Plan Protecting Vulnerable Groups 0900/2026/007 Ref Finding 3 The PVG arrangements and processes in place for school volunteers need to be clearly defined and implemented. From our audit work, we consider that the PVG processes in place for new employees are generally satisfactory, with PVG membership being confirmed by the Workforce Resourcing Team as part of the pre-employment checks and prior to the employee commencing employment. There are similar arrangements in place for elected members, social work carers and ActiveNL volunteers, however, we identified a number of issues with the arrangements for school volunteers as follows: • At the start of the audit, we had difficulty identifying the arrangements and responsible officer for PVGs for school volunteers. We were advised that these were previously undertaken by ActiveNL, however, this was transferred to Education prior to summer 2025 and no alternative responsible officer was identified at that time. • We issued a questionnaire to Headteachers to confirm their understanding of the requirement for school volunteers to have PVG membership and the process for requesting a PVG application. The outcome of this questionnaire highlighted that there is a lack of understanding around regulated roles and when a PVG is required, there is no clear process in place for requesting a PVG and there is a lack of awareness of key contacts and countersignatories. Interim arrangements have now been put in place to undertake retrospective checks, with the longer-term arrangements being progressed and an email has been issued to Headteachers to provide examples of regulated roles and advise the actions required and nominated key contacts. Implication Recommendation Priority Management response Implementation Date If the processes and arrangements for PVG are not clear, officers may not fully understand their responsibilities, which could lead to staff and volunteers undertaking regulated roles not having the appropriate PVG membership. The Chief Officers (Education) should ensure that the retrospective checks for school volunteers identified as a result of the communication issued to Headteachers are progressed promptly and that, as a matter of urgency, the longer-term arrangements are fully established, implemented and communicated to Headteachers. Medium Agree James McParland / Barry Smedley, Chief Officers (Education) A report will be submitted to the Service SMT meeting on 4 March 2026 which will include reference to the PVG requests which are currently awaiting a response and will outline previous practice, issues raised by headteachers, required changes to practice to address the updated PVG regulations and the further steps required to develop a formal Service policy on this subject. The new Service policy will be operational from the start of the 2026/27 academic term. August 2026 Page 45 of 238
Page 46
8 4. Action Plan Protecting Vulnerable Groups 0900/2026/007 Ref Finding 4 A small number of other areas for improvement in respect of PVGs were identified. Our testing identified a small number of other areas for improvement as follows: • The Council has a legal duty to notify Disclosure Scotland of individuals ceasing to undertake regulated work as they are no longer a person of interest. From our review of a sample of leavers in regulated roles, we identified one employee where Disclosure Scotland had not been notified, as the People Operations Team were unaware that the employee held a PVG membership as it was not recorded on the employee’s record on iTrent and they did not undertake any further enquiries. The Workforce Resourcing Manager confirmed that Disclosure Scotland has now been notified. • Whilst employees in newly identified regulated roles were notified that they were now required to have PVG membership, there has been no formal communication from the Council advising of the changes to the PVG scheme, particularly in relation to advising that it is now a criminal offence for both the organisation and individuals undertaking regulated work if they do not hold a valid and appropriate PVG membership. Implication Recommendation Priority Management response Implementation Date Delays in notifying Disclosure Scotland that individuals are no longer persons of interest could result in a data protection breach. Individuals may be unaware that it is now a criminal offence, for both individuals and organisation, to undertake a regulated role without a valid and appropriate PVG membership. The Chief Officer (People Resources) should: (1) Ensure that, as part of the leavers process, the People Operations Team establish whether the position is a regulated role and if so, promptly notify Disclosure Scotland that the individual is no longer a person of interest. (2) Issue a communication to all employees advising of the legislative changes to the PVG scheme, particularly the new criminal offence for individuals. Low Agree Gillian Quinn, Employee Service Centre Manager (1) As part of the transfer of PVG records to iTrent, this work is already underway and all roles within iTrent that require a PVG are now clearly identified. Additionally, Disclosure Scotland has recently provided direct self-service access to its new system, which will allow the Employee Service Centre to directly indicate when the Council is no longer an interested party. This will make the leavers process significantly more efficient going forward, and the new facility is currently being tested. Previously, the Council had to notify Disclosure Scotland in writing when a staff member left, which was both time consuming and slow. (2) A communication will be drafted in March to issue to all staff, including information on the legal requirement to hold a PVG and to notify staff of the upcoming transition from the lifetime scheme to the five-year scheme. Information will also be included in the regular People Resources newsletter, which already goes to managers and staff on a regular basis. Thereafter, periodic communications will be issued to staff to remind them of their responsibilities. December 2026 Page 46 of 238
Page 47
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/ASP/PRMay26 Date 14/05/26 Internal Audit: Progress Report From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Executive Summary The purpose of this report is to provide an overview of Internal Audit activity and audit reports issued since the last update to the Panel in March 2026, namely: • Roads and Infrastructure Maintenance and Improvement Services Contract • Self-Directed Support • Education Establishment Visits • Procurement Compliance • Contract Management • Clyde Valley Waste Contract This report will also provide an update on performance management. Recommendations The Panel is invited to: (a) note the content of the Internal Audit reports together with the associated management responses. (b) consider whether there are any issues raised by Internal Audit which the Panel consider are sufficiently significant to require a further report from management to be submitted to a future meeting of the Panel. (c) request that Internal Audit report to future meetings of the Panel on the progress in implementing agreed management actions categorised as ‘High’ or ‘Medium’ priority, and (d) otherwise note this report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 5 Page 47 of 238
Page 48
1. Background 1.1 The 2025-26 Internal Audit Plan was approved by the Audit and Scrutiny Panel in May 2025. The Internal Audit Charter requires that Internal Audit Progress Reports are presented to each meeting of the Panel, providing an update on the progress against the Internal Audit Plan and any other Internal Audit activity. 2. Report Audit reviews completed in the period 2.1 The audit reports summarised below have been completed since the last meeting of the Panel in May 2026. Panel should note that two of these reports have been assessed as providing a limited level of assurance on the control environment. Management have responded positively to all reports and satisfactory responses and commitments to audit recommendations have been received. 2.2 Appendix 1 provides detailed definitions of the priorities assigned to audit recommendations, and the factors considered when determining the level of assurance provided in the audit opinion. Full copies of these audit reports have been included in the meeting paper in line with the approved reporting protocol. Roads and Infrastructure Maintenance and Improvement Services Contract Internal Audit Opinion Reasonable assurance Recommendations High 0 Medium 1 Low 2 2.3 This audit reviewed the Council’s governance and contract management arrangements for the mobilisation and implementation of the Roads Contract. We are generally satisfied that these arrangements are effective, provide a robust framework for monitoring and reviewing performance and are broadly consistent with good practice expectations, relevant council policies, and contractual requirements. 2.4 The main area for improvement identified relates to the need for robust Key Performance Indicator (KPI) verification processes to confirm that data is complete, accurate, aligned with contractual requirements and with sample checks undertaken to confirm the accuracy of source information. Self-Directed Support Internal Audit Opinion Limited assurance Recommendations High 1 Medium 3 Low 1 2.5 The purpose of this audit was to assess the adequacy and effectiveness of the Council’s arrangements for ensuring that SDS budgets are calculated fairly and consistently in line with guidance and are monitored to ensure that they are being used appropriately by service users. 2.6 While we found strong financial oversight arrangements and no evidence of incorrect budgets or misuse of SDS funds, significant weaknesses were identified in the application of agreed procedures, the retention of key documentation and the consistency of Direct Payment (DP) monitoring. These weaknesses could lead to DP Page 48 of 238
Page 49
funds being misused without detection or not being used in line with assessed needs and agreed outcomes, potentially affecting the support being received by individual service users and exposing the Council to potential financial loss and reputational damage. 2.7 Further areas for improvement were noted relating to the consistent application of DP management and monitoring procedures across all localities, updating the SDS Good Practice Guide, strengthening procedures for retaining key documentation and consistently applying agreed SDS procedures and establishing a formal training programme. Education Establishment Visits Internal Audit Opinion Limited assurance Recommendations High 1 Medium 1 Low 2 2.7 The purpose of this audit was to provide assurance on compliance with Council policies and procedures across a sample of schools in respect of financial activities, physical security, health and safety and information security, and we are generally satisfied that the procedures and processes in these areas are being followed. 2.8 However, our review of a sample of schools highlighted significant levels of non- compliance in relation to school funds procedures, and insufficient oversight and involvement by Heads of Establishment and school Senior Management. Although the Service introduced a framework for monitoring the governance of school funds, this has not yet been fully implemented due to resource constraints, therefore spot checks are not being undertaken, and the quality of annual submissions are not being reviewed. Weaknesses in the control environment around school funds have been the subject of repeated Internal Audit activity over the last few years, and these issues have been referenced in the Chief Officer (Audit and Risk)’s annual report and discussed in detail by the Audit and Scrutiny Panel. 2.9 Further areas for improvement were noted relating to authorised signatories, insurance limits for safes and procedures for inactive petty cash imprest accounts, all of which have been reported as part of previous audits. Compliance with General Contract Standing Orders Internal Audit Opinion Reasonable assurance Recommendations High 0 Medium 1 Low 1 2.10 This audit aimed to provide assurance that procurement activities across the Council are being conducted in accordance with the GCSOs, procurement regulations and guidance. We were satisfied that procurement and tendering activities are being undertaken in compliance with these requirements and are generally supported by appropriate and adequate documentation. In addition, we found that robust and appropriate processes are generally in place for inviting contractors, evaluating tenders and awarding contracts. Page 49 of 238
Page 50
2.11 The main area for improvement identified relates to the need to strengthen the arrangements for verifying the authenticity of signatures on key procurement documentation. Contract Management Internal Audit Opinion Reasonable assurance Recommendations High 0 Medium 4 Low 0 2.12 This audit reviewed the arrangements for reviewing Services’ compliance with the Council’s Contract and Supplier Management (CSM) guidance. Based on the results of our work, we consider that the planned assurance activities set out within the guidance are appropriate to support the monitoring of CSM activity. These arrangements are relatively new and, as a result, are not yet fully embedded. 2.13 The arrangements do, however, require further development. Areas for improvement identified include refining the annual poll used to evidence CSM activity, strengthening the CSM sample testing process, formal monitoring and reporting of mandatory CSM training and ensuring that the outcomes of CSM assurance are reported to the senior management in line with CSM guidance. Clyde Valley Waste Contract Internal Audit Opinion Substantial assurance Recommendations High 0 Medium 0 Low 1 2.14 The Clyde Valley Waste Contract (CVWC) is a partnership between North Lanarkshire Council (Lead Authority), East Dunbartonshire Council, East Renfrewshire Council, North Ayrshire Council and Renfrewshire Council for the provision of joint residual waste treatment and disposal services. 2.15 The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s role as Lead Authority for the CVWC. Based on the results of our work, we consider that, to date, the CVWC Management Team have discharged their obligations as expected, with appropriate arrangements in place for monitoring waste processing information, processing payments and monitoring the contractor’s performance. Performance Management 2.16 In line with Internal Audit performance management framework, two performance indicators are subject to quarterly reporting to the Panel. 2.17 The first indicator is the implementation of agreed actions arising from Internal Audit reports by the implementation date. In the period to March 2026, 69% of agreed actions have been implemented by the implementation date (the previous update for the period to December 2025 had a 62% completion rate). 2.18 The second performance indicator measures client satisfaction. The results received in the period continue to show positive feedback, with 100% of respondents agreeing that Internal Audit added value by assisting in providing assurance, that findings were clearly and accurately communicated and that audit staff were professional and courteous, and 94% agreeing that the audit reports were relevant and Page 50 of 238
Page 51
constructive. Appendix 2 provides a summary of the questions we ask audit clients at the conclusion of each audit. 3. Measures of success 3.1 Internal Audit reports annually on its performance to the Panel and is also subject to review annually by the Council’s appointed external auditors. 4. Supporting documentation Appendix 1 Audit Grading Definitions Appendix 2 Internal Audit Client Feedback Results Francis Scott Chief Officer (Audit and Risk) Page 51 of 238
Page 52
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ Page 52 of 238
Page 53
If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective responses by management to the weaknesses, control issues and/or areas of improvement identified by Internal Audit will increase the likelihood of the Council achieving its ambitions by improving control frameworks and more effectively mitigating potential risks and threats to the achievement of planned outcomes. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 53 of 238
Page 54
Appendix 1 Audit Grading Definitions Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Substantial Assurance There are minimal or minor control weaknesses that present low risk to the control environment. The control environment has substantially operated as intended although some minor errors have been detected. Very few or no improvements are needed. Reasonable Assurance There are some control weaknesses that present a low to medium risk to the control environment. The control environment has mainly operated as intended although errors have been detected. Some improvements should be made. Limited Assurance There are significant control weaknesses that present medium to high risk to the control environment. The control environment has not operated as intended. Significant errors have been detected. Substantial improvements should be made. No Assurance There are fundamental control weaknesses that present an unacceptable level of risk to the control environment. The control environment has fundamentally broken down and is open to significant error or abuse. Immediate and major changes need to be made. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant, but it is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action were taken. Prompt action is required Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 54 of 238
Page 55
Appendix 2 Internal Audit Client Feedback Results Responses received in this period from 17 clients related to assignments reported to the Panel (note these responses primarily relate to audit assignments reported in the Internal Audit Progress Reports presented to the November 2025 and March 2026). Question Strongly Agree or Agree (%) Neither Agree nor Disagree (%) 1. Internal Audit added value to my area by assisting in providing assurance and/or identifying weaknesses and/or improvements in relevant governance/business process and internal controls 100% 0% 2. Internal Audit findings were accurate and clearly communicated 100% 0% 3. The audit report made relevant, constructive and practical recommendations to help improve operations 94% 6% 4. Internal Audit staff were professional and courteous throughout the audit process 100% 0% Where management raise concerns over Internal Audit’s work, these matters are discussed with relevant senior management to fully understand the nature of any concerns and, where it is considered appropriate, to identify areas for improvement. We also seek Services’ views on what they liked or disliked about the audit process and comments received are used to inform future action plans for improving the service provided by Internal Audit. Page 55 of 238
Page 56
1 INTERNAL AUDIT REPORT ROADS AND INFRASTRUCTURE MAINTENANCE AND IMPROVEMENT SERVICES CONTRACT Headlines The Enterprise Project supports delivery of The Plan for North Lanarkshire by creating an integrated approach to repairs, maintenance and investment for the Council’s housing, corporate and roads and infrastructure assets. As part of this project, in March 2024, the Council awarded the Roads and Infrastructure Maintenance and Improvement Services contract (the ‘Roads Contract’) to Hochtief Ltd. The contract commenced in October 2024 and enables the Council to access a range of maintenance, repair and investment services for its roads and related infrastructure assets. The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s contract management arrangements for the mobilisation and implementation of the Roads Contract. Based on the results of our work, we have categorised the audit as offering reasonable assurance. We are generally satisfied that the governance and contract management arrangements for the Roads Contract are effective, provide a robust framework for monitoring and reviewing performance and are broadly consistent with good practice expectations, relevant council policies, and contractual requirements. As the contract is still at an early stage, we did not undertake a detailed review of individual performance indicator results. The audit did, however, identify some areas for improvement. These are outlined in section 3 of this report and include the need for robust Key Performance Indicator (KPI) verification processes to confirm that data is complete, accurate, aligned with contractual requirements and supported by sample checks to confirm the accuracy of source information. Internal Audit Opinion Reasonable assurance Priority of Recommendations High Medium Low 0 1 2 Organisational Impact Moderate Report status FINAL Audit ref 0900/2026/009 Date issued 21/04/2026 Audit Team Susan Whyte and Lesley Armstrong Issued To Chief Officer (Community Operations), Chief Officer (Assets and Procurement), Roads and Asset Services Manager and Contract Performance and Assurance Manager Copied To Chief Executive and Depute Chief Executive Page 56 of 238
Page 57
2 1. Executive Summary Objectives The audit sought to provide independent assurance on the following areas: • There are appropriate governance arrangements, with clearly defined roles and responsibilities, for overseeing the new contract. • Mobilisation is underpinned by well-structured arrangements including a clear and comprehensive plan outlining timelines, critical milestones, dependencies, resource requirements and risk management provisions. • Contract management arrangements are consistent with contractual terms, council policies and include appropriate mechanisms for monitoring quality and performance. • Elected members and senior management receive regular updates on contract management and performance. This engagement has been conducted in accordance with the Global Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • A detailed governance structure has been established which includes five levels of governance groups with clearly defined roles and responsibilities and which meet regularly to discuss and consider both strategic and operational issues. Documented Terms of Reference set out the required frequency, membership and reporting arrangements for these governance meetings, which are further supported by structured agendas, formal minutes and clear escalation routes. • Comprehensive contract management arrangements have been developed including a wide range of standardised toolkits and templates, such as a change control register, spend tracker, risk register, service credit calculator and a social value tracker, to support consistent processes. • Independent oversight is provided by the Contract Performance and Assurance team, and all contract documents are held in a central location accessible to relevant officers from both the Council and Hochtief. • Detailed KPIs and Strategic Performance Indicators (SPIs) have been developed and are fully documented, both within the contract and within a separately developed Performance Handbook, which includes definition sheets outlining calculation methodology, data sources and responsibilities. • Structured change control and risk management processes are in place, with a formal change control procedure, a change control register, and a live contract risk register which is regularly reviewed through monthly governance meetings and regular standalone risk sessions. • Arrangements have been established for regular reporting of performance information to senior officers through the Contract Service Management Group (Level 3) and Contract Delivery Management Group (Level 4) governance meetings. Although not yet fully established, twice-yearly reporting to the Environment and Climate Change Committee has been agreed, and reports will cover issues including KPI and SPI performance, social value outcomes, contract expenditure and service credits. Key areas requiring management action (High Priority) No areas requiring urgent management action have been identified. Other areas for improvement (Medium Priority) One other area for improvement was identified: • There is a lack of independent verification of KPI calculations and underlying source data to confirm the accuracy, consistency and reliability of reported performance information. Page 57 of 238
Page 58
3 3. Action Plan Roads and Infrastructure Maintenance and Improvement Services Contract 0900/2026/009 Ref Finding 1 There is a lack of independent verification of KPI calculations and underlying source data to confirm the accuracy, consistency, and reliability of reported performance information. We noted that detailed governance arrangements are in place for the Roads Contract, with contract performance being subject to regular review and discussion through frequent governance meetings, where issues and performance matters, including KPI-related underperformance, are routinely identified, discussed, and addressed. However, our review identified issues in relation to the calculation, verification and reporting of performance indicator data, which is likely to affect assurance over the accuracy and reliability of reported performance information, including: • The Council does not currently undertake routine verification, sense-checking, or independent review of source data used to calculate KPI figures to identify, challenge and correct anomalies or inaccurate entries. Testing on a sample of two KPIs identified inconsistencies between Hochtief’s reported figures, the underlying source data, and the performance results calculated by the Council. Additionally, our review of records extracted from Confirm (the system used for issuing Work Orders and calculating a number of the KPIs) identified data quality issues including jobs with the same start and completion date and time, jobs recorded as starting before being committed and target dates that did not align with the priority rating and committed date. As a result, it is unclear whether performance data currently reported to Committee and governance groups is accurate, reflects the original source data, or complies with contractual requirements for KPI calculation. • Two quarterly KPIs (KPI 3.6 – Percentage of routine maintenance work undertaken to date compared to the Contractors Annual Plan and KPI 8.20 – Customer satisfaction with completed planned schemes achieved through post-scheme surveys over a 12-month rolling period) are not yet being calculated or reported due to lack of available data. We noted that this issue has been discussed at governance meetings, with additional sessions held to address gaps in the data and current reporting challenges arising due to the early stage of the contract and that officers have been assigned to ensure the required data is in place for full reporting from year two of the contract. We were advised that plans to strengthen the verification and assurance of performance information are being developed by the Contract Performance and Assurance and Roads teams, in conjunction with Hochtief, however, these arrangements and improvements have not yet been fully established. Implication Recommendation Priority Management response Implementation Date Performance information may be inaccurate, undermining the reliability of governance oversight, Committee reporting and decisions linked to KPI results. Incomplete KPI reporting reduces awareness of contractor performance and may result in non-compliance with contractual monitoring requirements. The Chief Officer (Community Operations) should ensure that: (1) A robust process for regular quality assurance and verification is developed and implemented which ensures that all KPI figures are accurate, supported by source data, and calculated in accordance with contract requirements. This should include sample checks of KPI source data to ensure that any inaccuracies or errors are promptly identified, challenged and resolved. (2) The current work to review and refine KPI data is finalised, ensuring all required data, including KPIs 3.6 and 8.20, is available, accurate, and fully reported to senior officers and elected members. Medium Agree Scott Walker, Roads and Asset Services Manager Work to address this recommendation has commenced. June 2026 Page 58 of 238
Page 59
4 3. Action Plan Roads and Infrastructure Maintenance and Improvement Services Contract 0900/2026/009 Ref Finding 2 Any future mobilisation exercises should be supported by a complete and up-to-date audit trail, with all actions and risks either recorded as closed or clearly transferred for ongoing monitoring. We consider that, generally, appropriate governance arrangements were in place during the mobilisation of the Roads Contract. These included regular meetings, a detailed Mobilisation Plan, a risk register, and a Mobilisation Outputs Report that recorded all actions arising from the meetings, the officers responsible, and whether each action remained open or had been closed/completed. From our review of these arrangements, however, we noted that the Mobilisation Outputs Report has not been fully updated and includes a number of mobilisation tasks which appear to remain outstanding, and the associated mobilisation risk register does not clearly reflect any tasks which have been transferred to the contract risk register. It is, therefore, difficult to confirm which, if any, mobilisation issues or risks remain unresolved or to trace a complete audit trail linking outstanding items to current action logs or risk registers. We were advised that, following mobilisation, there were changes in key staff within both the Council and Hochtief and, as a result, it is likely that monitoring documentation was not finalised and updated, rather than the actions themselves not being completed. Current governance and risk management arrangements in place for the contract appear robust, and therefore the likelihood of any material mobilisation issues remaining outstanding and unaddressed would generally appear to be low, however, we consider that opportunities exist to strengthen the mobilisation activity for future contracts. Implication Recommendation Priority Management response Implementation Date Without a complete and up-to-date mobilisation audit trail, there is a risk that important actions or risks may be overlooked or not fully handed over to live contract management, which could lead to gaps in oversight, unresolved issues, or reduced assurance over contract readiness. The Chief Officer (Community Operations) should consider incorporating an action into the Lessons Learned Register to strengthen the handover processes between mobilisation and ‘business as usual’ contract management for any future contracts, to ensure that there is a clear audit trail demonstrating that all tasks, risks, and responsibilities have either been fully completed or formally transferred into ongoing contract management. Low Agree Ross Dunn, Contract Performance and Assurance Manager June 2026 Page 59 of 238
Page 60
5 3. Action Plan Roads and Infrastructure Maintenance and Improvement Services Contract 0900/2026/009 Ref Finding 3 There is a need to more fully align governance meetings with the agreed framework and record the reasons for any variations. We consider that the governance arrangements for the Roads contract are generally robust and operating in accordance with contractual arrangements with appropriate frequency, attendance, and inclusion of expected topics. We noted, however, a small number of minor issues in relation to the operation of the Contract Delivery Management Group (Level 4) and Contract Service Delivery Group (Level 5) governance meetings, as follows: • Level 5 meetings are not currently being chaired or routinely attended by the officers specified in the contract and several key agenda items (including KPI performance, change management, and subcontractor monitoring) have not been clearly established as standing agenda items and are therefore not consistently discussed or formally recorded in meeting minutes. • One of the required agenda items (sub-contractor monitoring) has not yet been fully incorporated into the Level 4 meeting agendas and is therefore not being routinely discussed at these meetings. The Roads and Asset Services Manager acknowledged these gaps during the audit and has committed to taking appropriate action. Implication Recommendation Priority Management response Implementation Date Incomplete compliance with governance meeting requirements may reduce oversight and assurance over contract performance. The Chief Officer (Community Operations) should review and update arrangements to support full compliance with contractual requirements for Level 4 and Level 5 governance meetings. This should include ensuring that: • Officers identified in the contract routinely attend. • Meetings are chaired in accordance with the contract schedules. • All required agenda items are included, discussed and recorded. • Any variations to the contract expectations are agreed and document. Low Agree Scott Walker, Roads and Asset Services Manager April 2026 Page 60 of 238
Page 61
6 INTERNAL AUDIT REPORT SELF-DIRECTED SUPPORT Headlines Self-directed support (SDS) empowers individuals to have control over their care and support services, allowing them to make choices that best suit their needs and preferences. The Social Care (Self-directed Support) (Scotland) Act 2013 sets out the duties of relevant authorities to offer choice when arranging care and support. The Act is supported by four statutory principles – participation and dignity, involvement, informed choice, and collaboration. Service users can choose from four delivery options: • They receive the money directly to pay and manage their own support (direct payments). • They choose the service provider, and the local authority manage the arrangements and payments. • The local authority selects, arranges and pays a service provider. • A mixed approach with a combination of direct payments and council-arranged support. The purpose of this audit was to assess the adequacy and effectiveness of the Council’s arrangements for ensuring that SDS budgets are calculated fairly and consistently in line with guidance and are monitored to ensure that they are being used appropriately by service users. Based on the results of our work, we have categorised this audit as offering limited assurance. While we found strong financial oversight arrangements (including appropriate authorisation of new or amended budgets, regular reconciliations and robust invoice checks) and no evidence of incorrect budgets or misuse of funds, significant weaknesses were identified in the application of agreed procedures and the retention of key documentation across all SDS options, as well as the consistency of monitoring Direct Payment (DP) expenditure. Although the Service is progressing the implementation of Mosaic, which is expected to significantly improve the management of SDS arrangements, a number of areas for improvement are detailed in the action plan at section 3 of this report. These include ensuring DP management and monitoring procedures are applied consistently across all localities to support early identification of issues and timely corrective action, ensuring the SDS Good Practice Guide is routinely reviewed and updated, strengthening procedures for retaining key documentation and consistently applying agreed SDS procedures and establishing a formal training programme with periodic refresher training. Internal Audit Opinion Limited assurance Priority of Recommendations High Medium Low 1 3 1 Organisational Impact Moderate Report status FINAL Audit ref 0510/2026/001 Date issued 30/04/2026 Audit Team Susan Whyte and Lesley Armstrong Issued To Chief Officer (Adult Social Work Services), Senior Manager Adult Social Work and Business Support and Operations Manager Copied To Chief Executive and Depute Chief Executive Page 61 of 238
Page 62
7 1. Executive Summary Objectives The audit sought to provide assurance on the following areas: • Appropriate policies, procedures and guidance are in place for SDS budgets and payments, and these have been provided to staff and service users as appropriate. • Service users are assessed on a consistent basis, in line with policies and guidance and SDS budgets are accurately calculated, appropriately authorised and correctly paid. • Effective monitoring arrangements are in place to ensure that SDS budgets are used properly, in accordance with service users’ support plans and where they aren’t, appropriate and prompt remedial action is taken. The work included selection of a sample of 15 service users across the six social work localities, supported by discussions with key staff and a review of relevant documentation and case notes. The sample included nine individuals receiving DPs, as these arrangements are more complex, and six supported through other SDS options. This engagement has been conducted in accordance with the Global Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • An SDS Good Practice Guide is in place, which outlines the procedures to be followed and the documentation that must be retained. Supplementary guides and process documents have also been developed to provide additional guidance on specific elements of the SDS framework. • SDS leaflets have been developed to assist service users in understanding SDS arrangements and to assist with decision making. • Standard forms, including Guided Self Assessments (GSAs) and scoring sheets, have been developed to support consistent calculation of service user budgets. • Locality Enablement Group (LEG) meetings are held fortnightly for all localities to review and approve new or revised service user budgets, and details of discussions are formally recorded. Senior Managers also review budgets independently to ensure these reflect LEG discussions. • Detailed Funding Schedule and DP Masterfile spreadsheets are maintained and updated every four weeks. Changes in payments for external providers or DP service users are only made following confirmation and approval from the Senior Manager Adult Social Work. • Payments to external providers are reconciled on a four-weekly basis, enabling timely identification and resolution of any over- or underpayments. • Robust processes are in place to review, verify and resolve any issues with invoices from external providers before they are authorised for payment. Key areas requiring management action (High Priority) One key area requiring urgent management action has been identified: • There is an urgent need to strengthen arrangements for managing and monitoring direct payments made to service users. Other areas for improvement (Medium Priority) A number of other areas for improvement were also identified: • The SDS Good Practice Guide should be regularly reviewed and updated to ensure it remains accurate, comprehensive and aligned with current legislation and good practice. • There is scope to improve the arrangements for retention of key documentation and consistent application of agreed SDS practices. • A formal training programme and arrangements for periodic refresher training should be established. Page 62 of 238
Page 63
8 3. Action Plan Self-Directed Support 0510/2026/001 Ref Finding 1 There is an urgent need to strengthen arrangements for managing and monitoring direct payments made to service users. Documented procedures are in place which outline the arrangements for regularly reviewing DP spending to confirm that funds are used appropriately and support continues to meet service user needs. We were advised that management recently reviewed compliance with these procedures, including whether DP Returns were being submitted regularly and whether allocated workers were monitoring DP arrangements in line with required processes and timescales. This review highlighted significant issues and associated risks with the application of the expected procedures for managing and monitoring DP arrangements and as a result, the Service has recently introduced additional training and implemented quarterly management review arrangements. Our review of a sample of service users in receipt of a DP supports Service management’s findings and confirms that significant issues remain in this area. We noted the following issues: • DP Returns are not being submitted consistently every four weeks as required, and arrangements for addressing non-submission of DP Returns, including issuing reminders and taking follow-up action, are not being applied consistently across all localities. • Where returns were provided, several were incomplete or contained errors, such as incorrect balances, and there was no evidence that these issues had been followed up or resolved. • Reviews of expenditure and supporting documentation, such as bank statements and receipts, are not being undertaken regularly in line with agreed procedures to enable early identification of unusual or unapproved spending or to confirm that DP funds continue to be used in accordance with each service user’s Support Plan. • Documentation supporting the set-up or review of DP arrangements, including new DP forms, DP Review forms and Bank Mandate forms, was not always available, and in some cases, did not reflect the most recent budget changes. • For one service user, the balance held in the DP bank account exceeded the agreed limit, however, there was no evidence that this had been reviewed or discussed with the service user or their representative, no evidence of a justification for the additional funds being held and no action being taken to recover unused funds in the absence of a valid reason for retaining these. Although our testing identified a number of issues, there was no evidence of misuse of direct payment funds by our small sample of service users. Implication Recommendation Priority The absence of regular and consistent submission of DP Returns, combined with limited review of expenditure and supporting documentation, increases the risk that DP funds may be misused without detection or may not be used in line with assessed needs and agreed outcomes, potentially affecting the quality and appropriateness of support being received by individual service users and exposing the Council to potential financial loss and reputational damage. The Chief Officer (Adult Social Work Services) should, as a matter of urgency: (1) Continue to monitor and evaluate the arrangements to strengthen the management of DPs to ensure that reviews of DP expenditure and supporting documentation are carried out consistently, regularly, and in line with agreed procedures. This should include the timely identification and robust follow-up of any errors, unusual or unapproved transactions, or surplus balances until fully resolved. Relevant supporting documentation and evidence confirming completion of the reviews should also be consistently recorded and retained. (2) Reinforce established arrangements across all localities for addressing non-submission of DP documentation, including issuing reminders, escalating concerns and taking proportionate action where issues persist. (3) Provide additional guidance or targeted support to service users or workers where recurring issues or non- compliance with agreed procedures are identified. High Page 63 of 238
Page 64
9 3. Action Plan Self-Directed Support 0510/2026/001 Management response Implementation Date Agree Claire Leslie, Service Manager and Andrea Breen, Senior Manager Adults (1) The Area Wide Social Work Service will continue its improvement activity from April 2025, with a focus on compliance with DP returns. Quarterly, area-wide reviews of DP returns have been undertaken, with early findings identifying ongoing issues with the quality and timeliness of DP returns across all areas. In response, additional awareness sessions were delivered to support staff in meeting required standards, however, subsequent audits have not demonstrated sustained or significant improvement. (2) In response to the ongoing issues, contractual arrangements have been strengthened in conjunction with Legal Services and Quality Assurance. A revised DP contract has been developed and issued to all DP holders which sets out clear and explicit obligations regarding the submission of DP returns, including timescales and evidential requirements. This process will be fully completed by June 2026. Following completion of the contract rollout, DP returns will be monitored over a 12-week period. If there are no improvements, a further formal letter will be issued to all DP holders, reiterating mandatory requirements and the potential consequences of non-compliance. (3) Existing training materials will be reviewed and updated. Targeted training and mentoring will also be provided to social workers undertaking assessment and review, with a focus on identifying errors or omissions in DP returns, ensuring returns are consistent with approved support plans, and issues are addressed at an early stage. Clear guidance and practical support will also be provided to all relevant staff to strengthen practice and improve oversight of DP monitoring. Audit findings and improvement actions will be formally reported to the Senior Management Team. Additionally, due to the ongoing risks identified, DP returns will be added to the Social Work Risk Register to ensure appropriate corporate oversight and escalation where necessary. December 2026 Page 64 of 238
Page 65
10 4. Action Plan Self-Directed Support 0510/2026/001 Ref Finding 2 The SDS Good Practice Guide should be regularly reviewed and updated to ensure it remains accurate, comprehensive and aligned with current legislation and good practice. The Health and Social Care North Lanarkshire (HSCNL) SDS Good Practice Guide, which was last updated in September 2021, and supplementary guidance (including process maps, flowcharts and checklists) have been developed to provide guidance for staff to be followed when establishing or reviewing individual SDS arrangements. Whilst there have been no significant legislative changes since this date, key Scottish Government policy updates, such as the SDS Framework of Standards and the National SDS Improvement Plan, have been introduced, therefore the current Good Practice Guide does not yet fully reflect these developments. In addition, the Good Practice guidance contains references to outdated processes, forms and enablement group arrangements which no longer align with current expectations. We noted that work to review and align the Good Practice Guide with updated policy requirements is underway and has been significantly progressed, however, this had not been fully completed at the time of the audit and as a result, current guidance does not fully reflect the most up to date policy expectations or good practice requirements. There is also no formal, scheduled review cycle in place for the SDS Good Practice Guide or related documentation. Updates are generally reactive and driven by significant changes in legislation rather than through regular planned review. We were advised that the Quality Assurance team, within HSCNL, is currently progressing a project to establish a single, centralised location for procedural documentation which will include assigning document owners who will have responsibility for regularly reviewing and ensuring procedures are up to date. As this project has not yet been completed, arrangements for retaining and updating procedures and guidance are not always consistent, increasing the risk that staff may be unable to access the most up-to-date information when required. Implication Recommendation Priority Management response Implementation Date If procedures are not up-to- date or readily accessible, there is a risk that staff may rely on outdated guidance or fail to apply current legislative and good-practice requirements. This could lead to non-compliance, inconsistent practices being applied across different localities, adverse outcomes for service users, and potential reputational damage to the Council. The Chief Officer (Adult Social Work Services) should ensure that: (1) The ongoing review of the SDS Good Practice Guide is completed to ensure it is aligned with current Scottish Government policy, including the SDS Framework of Standards and the National SDS Improvement Plan. Once updated, the Guide should be shared with relevant staff and be subject to regular review to ensure ongoing alignment with legislative and policy developments. (2) The project to establish a central area for all key procedural documentation continues to be progressed and completed, with clear ownership and effective processes for ongoing review and updating of all procedures. Medium Agree Lisa Barbour, Service Manager and Andrea Breen, Senior Manager Adults (1) The revised Good Practice Guide for SDS is in draft and progressing through senior management sign-off. The updated guide reflects the new SDS operating model, revised processes, and key developments, including the SDS Framework of Standards and the SDS Improvement Plan. Once approved, the guide will be formally shared across the workforce to ensure consistent understanding and application in practice. To ensure ongoing accuracy and relevance, review timescales have been incorporated into the document, with the area-wide team undertaking annual or, where required, more frequent reviews, for example in response to significant service changes such as the full implementation of Mosaic. (2) Management will continue to work in partnership with Quality Assurance colleagues to ensure the Good Practice Guide is stored centrally, version-controlled, and accessible to all staff. The documentation will also be made available to staff via MyNL, providing a single point of access to current SDS guidance. September 2026 Page 65 of 238
Page 66
11 3. Action Plan Self-Directed Support 0510/2026/001 Ref Finding 3 There is scope to improve the arrangements for retention of key documentation and consistent application of agreed SDS practices. We recognise that the Service is in the process of implementing a new system, Mosaic, which is intended to significantly strengthen the management of SDS arrangements by providing a single system for recording case information, storing key documentation and tracking, monitoring and approving budgets. However, as Mosaic is not yet fully developed or implemented, staff continue to rely on multiple interim systems and arrangements, including an Access database for recording minutes and decisions made at LEG meetings, SWIS for case information, elements of Mosaic, and SharePoint folders for storing key service user documentation. Testing on a sample of service users in receipt of SDS, to confirm whether they were assessed in line with policies and guidance, identified several issues in relation to the availability of key documentation to support the assessment and annual review processes, which were exacerbated by the continued reliance on multiple interim systems whilst Mosaic is under development. The absence of such documentation made it difficult to verify decisions made including whether budgets accurately reflected assessments undertaken or had been calculated consistently and in line with expected practice. We noted the following: • Key documentation, including Guided Self Assessments (GSAs), scoring sheets, Support Plans and evidence of annual Community Care Reviews was frequently missing or out of date. • For one service user, there were several differences between responses recorded on the GSA and associated scoring sheet. • For several service users, budget figures on scoring sheets did not align with those approved at LEG meetings. • Annual reviews were either not being completed or had no evidence confirming that they had been completed in line with expected timescales and although LEG minutes record the dates that annual reviews were due, reviews were often deferred with no clearly recorded explanation or revised date. Management have recently introduced independent, second officer checks to confirm whether DP Returns are being submitted in line with agreed timescales, however, there are currently no equivalent arrangements to periodically review other key aspects of the SDS process, such as the completion and retention of required documentation or the timeliness of annual reviews. Implication Recommendation Priority Failure to retain complete, accurate and up-to-date documentation could undermine the Council’s ability to demonstrate compliance with statutory requirements and internal procedures, increasing the risk of decisions being based on incomplete information and the potential for inconsistent or unfair outcomes for individual service users, which could expose the Council to potential challenge, financial loss and reputational damage. If regular reviews of service user circumstances are not consistently completed, and routine second-officer checks are not undertaken to identify when these reviews are missed, material changes in circumstances may not be detected promptly potentially leading to prolonged over- or underpayments, or support that no longer meets service user’s needs. The Chief Officer (Adult Social Work Services) should: (1) Ensure that the development of the Mosaic system is finalised and once implemented, is used as the single system for managing SDS and retaining supporting documentation. (2) Ensure that, in the interim, adequate and appropriate documentation is retained, to provide a clear and complete audit trail of all decisions made. (3) Ensure that periodic reviews of service users’ needs, circumstances and outcomes are completed within required timeframes, with results fully recorded and retained. (4) Remind relevant staff of the requirement to follow procedures and retain appropriate documentation to support conclusions and decisions made. (5) Consider undertaking periodic second officer quality checks on various aspects of the SDS process to ensure that assessments have been undertaken in line with procedures and decisions made are fully supported by appropriate documentation. Medium Page 66 of 238
Page 67
12 3. Action Plan Self-Directed Support 0510/2026/001 Management response Implementation Date Agree Claire Leslie, Service Manager, Lisa Barbour, Service Manager and Andrea Breen, Senior Manager Adults (1) The development and configuration of the Mosaic system for SDS has been prioritised to ensure it is fully functional and capable of holding all relevant assessments, decisions, reviews and supporting documentation. Once implemented, Mosaic will be used as the single system of record for the management of SDS cases. This will provide a consistent, secure and auditable approach to SDS case management, reducing duplication and risk associated with parallel systems. (2) Until Mosaic is fully implemented, it will be reiterated area wide that adequate and appropriate documentation needs to be retained within the areas of Mosaic which are currently available to provide a clear, complete and chronological audit trail of all SDS-related decisions, including rationale, authorisation and supporting evidence. This will provide assurance that decisions are transparent, defensible and compliant with audit requirements during the transition period. Interim operational guidance will be developed in the meantime. (3) Procedures will be reinforced to ensure that reviews of service users’ needs, circumstances and outcomes are completed within required timescales. Review outcomes, decisions and any changes to support arrangements will be fully recorded and retained. This will provide assurance that SDS packages remain responsive, proportionate and outcomes-focused, with risks identified and addressed promptly. Practitioners and Team Managers will be overseen through routine case supervision and performance monitoring. (4) All assessing staff will be reminded of the requirement to follow SDS procedures and to retain appropriate documentation that clearly evidences assessments, professional judgement, conclusions and decision-making. To achieve this, all senior social work managers will be fully briefed. This will be supported through team briefings and management communications, supervision discussions and access to updated procedural guidance which will provide improved consistency in practice and stronger evidential standards across SDS activity. (5) Consideration will be given to introducing periodic second officer quality assurance checks on key aspects of the SDS process. These checks will focus on compliance with assessment and review procedures, quality and sufficiency of recorded evidence and alignment between assessed needs, outcomes and approved decisions. Findings from these checks will be used to inform learning, improvement activity and targeted support for practitioners or teams where required. This will provide increased confidence that SDS decisions are consistent, proportionate and fully supported by appropriate documentation. August 2027 December 2026 December 2026 December 2026 December 2026 Page 67 of 238
Page 68
13 3. Action Plan Self-Directed Support 0510/2026/001 Ref Finding 4 A formal training programme and arrangements for periodic refresher training should be established. Given the complex nature of SDS procedures and processes, it is important that staff responsible for undertaking SDS reviews and assessments are fully aware of, and understand, their roles and responsibilities. Our review identified some issues in relation to training as follows: • While it is noted that the ethos of SDS is incorporated into mandatory Assessment and Care Planning and specific training is offered when requested by individual localities or when specific performance issues are identified, there are currently no arrangements for consistently and systematically identifying the need for, and delivering, periodic refresher training across the Service. • While attendance at individual training sessions is recorded and locality management is responsible for identifying staff training needs and facilitating access to training where required, there is currently no systematic process to identify training gaps or monitoring whether all relevant staff across the Service have undertaken appropriate training to ensure that they are aware of their responsibilities to consistently and accurately follow required SDS procedures. We noted that, for the most recent training held on DP Return monitoring arrangements, approximately only half of relevant staff appear to have attended. A comprehensive training programme which will reflect the Council’s approach to SDS is currently being prepared however is not yet finalised or fully implemented. Implication Recommendation Priority Without appropriate training, staff responsible for establishing and reviewing SDS arrangements may not fully understand their roles and responsibilities, increasing the risk of errors, inconsistent decision-making, and potential non- compliance with agreed internal procedures, legislative requirements or good practice. The Chief Officer (Adult Social Work Services) should: (1) Finalise and fully implement the comprehensive training programme for SDS, which covers core processes, good practice, expectations regarding the completion and retention of essential documents and DP monitoring requirements. The programme should include arrangements for monitoring attendance and periodic refresher training to enable timely identification and resolution of any training gaps and ensure ongoing awareness of responsibilities and continued compliance with legislation, internal procedures, and good practice. (2) Consider whether SDS training, covering the key requirements and expectations in relation to SDS procedures, should be made mandatory for relevant staff. Medium Management response Implementation Date Agree - Claire Leslie, Service Manager, Lisa Barbour, Service Manager and Andrea Breen, Senior Manager Adults (1) Assessment and Care Planning training has been co-produced to embed SDS principles and ensure staff understand SDS legislation, values, and good practice. This establishes a consistent, compliant, and person-centred baseline across the service. Building on this, enhanced SDS training will be rolled out to address more complex areas, including General Support Assessment completion, support planning and review, and the set-up, monitoring, and governance of DPs, including scrutiny of DP returns and alignment with approved support plans. This enhanced SDS training will be delivered on a routine and ongoing basis, ensuring staff have regular access to up-to-date information and guidance. The approach is intended to mitigate risks relating to inaccuracies in practice, non-compliance with documentation requirements, and weaknesses in DP monitoring and returns. The training programme will support staff to understand not only how to complete required documentation, but also why accurate completion and effective monitoring are essential to legislative compliance, financial governance, and positive outcomes for individuals. We will link with our training department to ensure this is fully tracked and feedback available. (2) In recognition of the responsibilities associated with SDS delivery, this training will be mandatory for all social work staff who undertake roles involving SDS assessments, support planning, and DP monitoring. Attendance will be monitored, and completion reinforced through line management and supervision arrangements. This mandatory SDS training will ensure staff have the required skills and knowledge and support consistency of practice, and ongoing compliance with legislation, procedures, and good practice. May 2027 Page 68 of 238
Page 69
14 3. Action Plan Self-Directed Support 0510/2026/001 Ref Finding 5 A small number of other minor issues in respect of SDS were also identified. During the course of our review, we identified the following minor issues where we consider there is scope for improvement: • We noted that the SDS information on the Council website includes a link to outdated Scottish Government guidance issued during COVID. Although the Children and Families SDS page on the Council website contains a link to current legislation, a range of other relevant and up-to-date SDS resources are available across various external websites but these are not specifically referenced or linked from the Council’s webpages. • Although standard DP contracts generally appear to be robust and sufficiently detailed, the information currently provided to SUs does not fully or clearly state that SUs must promptly inform HSCNL of relevant or significant changes in their circumstances including health, support needs, or hospital admissions that could affect their funding entitlement. Implication Recommendation Priority Management response Implementation Date Links to outdated SDS guidance and legislation on the Council website may increase the risk of service users or carers misunderstanding their rights, responsibilities, and available options. If changes in circumstances are not reported promptly, there is an increased risk of service users continuing to receive DP payments which do not accurately reflect their support needs, increasing the risk of public funds being misused. The Chief Officer (Adult Social Work Services) should consider updating: (1) The SDS information and links on the Council website to ensure they are current and direct service users to the most relevant and up-to-date guidance. (2) Information and guidance provided to service users to clearly state their responsibility to promptly notify HSCNL of any changes in circumstances that may affect their DP entitlement. Low Agree Lisa Barbour, Service Manager and Andrea Breen, Senior Manager Adults (1) Immediate action has been taken to remove the outdated link to COVID-19 guidance from the Council website. As part of the SDS Improvement Plan, a robust and systematic review of all website content relating to SDS is being undertaken to ensure all information, guidance and links are accurate, current and fully aligned with the most up to date legislation and statutory guidance. This ongoing work informed our self-evaluation, capturing what information people value and how they want to access it. (2) As part of the development and implementation of the new operating model, it was considered essential that refreshed website content consistently aligns with the new service approach, including the use of appropriate language, accessibility requirements and supporting graphics. This will ensure that published information is clear, consistent and reflects current practice. Completing the review will provide assurance that content is up to date, compliant, and supportive of those accessing SDS. August 2026 Page 69 of 238
Page 70
15 INTERNAL AUDIT REPORT EDUCATION ESTABLISHMENT VISITS Headlines North Lanarkshire Council’s school estate comprises secondary, primary and additional support needs schools as well as family learning centres. Whilst Heads of Establishment are the leaders of learning and teaching in their school, they also have operational responsibilities to ensure that appropriate arrangements are in place to manage the school’s financial activities including Establishment Funds (also known as school funds) and that Council policies and procedures are properly implemented and followed by all staff and pupils as appropriate. The purpose of this audit was to provide assurance on schools’ compliance with Council policies and procedures in respect of financial activities, physical security, health and safety and information security. Weaknesses in the control environment around school funds have been the subject of repeated Internal Audit activity over the last few years, and these issues have been referenced in the Chief Officer (Audit and Risk)’s annual report and discussed in detail by the Audit and Scrutiny Panel. Based on the results of our work, we are generally satisfied that the procedures and processes in these areas are being followed. We have, however, categorised this audit as offering limited assurance. While the Service has prepared and implemented Educational Establishment Fund Financial Procedures, our review of a sample of schools highlighted a diverse range of compliance with expected practice, with some schools having significant levels of non-compliance with important aspects of the procedures and insufficient oversight and involvement in the management of the school fund by Heads of Establishment and school Senior Management. Additionally, although the Service introduced a framework for monitoring the governance of school funds, we noted that this has not yet been fully implemented due to resource constraints, therefore spot checks are not being undertaken, and the quality of annual submissions are not being reviewed. We have highlighted a number of areas for improvement, which are detailed in section 3 of this report. In addition to the need for the Service to review, strengthen and fully implement the governance, oversight, and operational arrangements relating to school funds, a number of other areas of concern, some of which have been reported previously by Internal Audit, require to be addressed. Internal Audit Opinion Limited assurance Priority of Recommendations High Medium Low 1 1 2 Organisational Impact Moderate Report status FINAL Audit ref 0450/2026/001 Date issue 20/04/26 Audit Team Lynn McCrum and Lesley Armstrong Issued To Chief Officers (Education – North and Education – South) and Senior Education and Families Manager Copied To Chief Executive and Depute Chief Executive Page 70 of 238
Page 71
16 1. Executive Summary Objectives The audit sought to assess the adequacy and effectiveness of controls in place within schools and the extent to which these comply with Council policies and procedures. The audit involved unannounced visits to a sample of five schools, to observe practices and undertake testing on financial activities (including Establishment Funds), physical security, health and safety and information security. This engagement has been conducted in accordance with the Global Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • The Council and Service have policies and procedures in place with regards to security, health and safety and financial management which all Services and their employees must adhere to. • The Council has mandatory training modules in place in relation to information security and data protection, and Heads of Establishment monitor completion of these by their staff. • The Service has implemented Educational Establishment Fund Financial Procedures which provide guidance and expected practice to Heads of Establishment in the administration and management of school funds. These procedures are supported by a short e-learning module to help them understand their role and responsibilities with regards to Establishment Funds. • The Education and Families Managers are required to complete a Link Visit Record during in-year discussions with the Heads of Establishment. This includes specific questions designed to confirm that the processes and guidance outlined in the Establishment Fund Financial Procedures are being implemented and record detail of barriers faced and action being taken where there are areas of non-compliance. • Heads of Establishment are required to submit a Compliance Checklist, Annual Income and Expenditure Statement, Independent Reviewer’s Report, year-end bank reconciliation and associated bank statement to Education and Families HQ by 31st October each year. Reminders for submission of this documentation are included within the Education and Families Newsletter. • Establishment Funds is a standing agenda item at the Head Teachers’ Resources Briefings. • The annual submissions received from Heads of Establishment are monitored and an update provided to the Education and Families Senior Management Team, highlighting the level of returns received and providing detail on those education establishments with either a partial or nil return, including narrative on why all required documentation has not been submitted. Key areas requiring management action (High Priority) The following key area requiring urgent management action has been identified: • There is an urgent need for the Service to fully implement the governance, oversight, and operational arrangements relating to the management of school funds across educational establishments and appropriately challenge where these arrangements are not operating effectively in practice. Other areas for improvement (Medium Priority) One other area for improvement was also identified as detailed below: • A number of other areas of concern, which have been reported previously by Internal Audit, require to be addressed. Page 71 of 238
Page 72
17 5. Action Plan Education Establishment Visits 0450/2026/001 Ref Finding 1 There is an urgent need for the Service to fully implement the governance, oversight, and operational arrangements relating to the management of school funds across educational establishments and appropriately challenge where these arrangements are not operating effectively in practice. Many educational establishments operate school funds in addition to their delegated school budget. These monies are generated by schools through donations, fundraising, uniforms, payments for school trips and excursions, etc. Although school funds are not Council monies, the Council has a responsibility to ensure adequate stewardship of these monies, therefore, the Establishment Fund Procedures, which provide guidance and expected practice to Heads of Establishment in the administration and management of school funds, have been prepared and implemented. As at November 2025, the school funds for all establishments totalled almost £2.5 million. Despite the Service creating and implementing Establishment Fund procedures, delivering training and establishing a governance and oversight framework for monitoring adherence to the procedures, our testing identified a number of instances where the issues previously identified have not yet been resolved or are not operating effectively in practice. Heads of Establishment are now required to submit documentation (compliance checklist, Annual Income and Expenditure Statement, Independent Reviewer’s Report, year-end bank reconciliation and corresponding bank statement) annually to Education and Families HQ. We were pleased to note that the annual submissions from the Heads of Establishment are monitored and an update on the status of such returns is provided to the Education and Families Senior Management Team, with the most recent update reporting that 76% had submitted fully completed returns for session 2024/25, with most other establishments providing part completed returns. However, as recognised by the Service, whilst the information submitted gives a broad indication that establishments are adhering to their governance responsibilities, it does not provide assurance on the quality or accuracy of the information received. Furthermore, whilst the Service has previously acknowledged the need for spot checks and has secured approval for a small resources team to undertake such checks, the planned programme of spot checks has not yet been delivered due to resource constraints as this team has not yet been established, limiting the capacity for effective monitoring and support. Our review of the annual returns submitted for 2024/25 also identified areas of non-compliance with expected practices and procedures, including financial information being submitted for the incorrect period; balances per the bank reconciliation not agreeing to those recorded on the Annual Income and Expenditure Statement; and the Annual Income and Expenditure Statement not being presented in prescribed format, not providing the necessary information (e.g. opening and closing balances) or containing errors or incorrect entries. Additionally, during our unannounced visits to a sample of schools, we noted a diverse range of compliance with the procedures. Of the five schools visited, two were generally adhering to the procedures, however, the remaining three had differing levels of non-compliance, some of which were significant. The issues identified over all five schools included weaknesses in Establishment Committee arrangements and constitutions, income recording, cash handling, banking practices, record-keeping, reconciliations, and overall management oversight. Errors, omissions, inconsistent practices, and inadequate separation of duties were also noted, including an Independent Reviewer at one school visited being directly involved in the day-to-day financial processes that they were responsible for reviewing. Further details of the issues identified are contained at Appendix 2 with Head Teachers being notified under separate cover of those issues specific to their school. Operational challenges were also identified and reported by Heads of Establishment regarding banking processes, particularly the declining acceptance of cheques and practical difficulties in cashing cheques for school fund petty cash, which has contributed to some schools adopting workarounds that are inconsistent with expected procedures. Current guidance does not fully reflect these practical constraints, therefore we consider that it requires review to ensure that transactions are properly recorded and accounted for. These issues have highlighted a need for training and support for all staff responsible for managing school funds to ensure that they are fully aware of their responsibilities and requirements. Page 72 of 238
Page 73
18 4. Action Plan Education Establishment Visits 0450/2026/001 Implication Recommendation Priority Management response Implementation Date Non-compliance with financial management procedures, inconsistent financial practices and a lack of management oversight of school funds could increase the risk of errors, irregularities and potential misappropriation of school fund monies going undetected. If establishments are not notified of areas of non- compliance and no action is taken to address these issues, there is a high probability that errors or malpractices will be carried forward and repeated in future years which increases the potential risk of theft or misappropriation of funds. The Chief Officers (Education - North and Education - South) should, as a matter of urgency: (1) Ensure that the governance and monitoring framework for school funds is fully implemented including completion of spot checks and a robust review of the quality, accuracy and completeness of annual submissions with any areas identified for improvement being monitored to ensure that they have been understood and are being effectively implemented. (2) Reinforce to Heads of Establishment that they have ultimate responsibility for ensuring that the school fund is appropriately managed and the Establishment Fund Procedures are fully adhered to. (3) Review, update and communicate the Establishment Fund Procedures and associated Compliance Framework to reflect current operational challenges (e.g. reduced acceptance of cheques and practical issues with petty cash) and to provide clearer guidance on expected processes, recording requirements and separation of duties. (4) Develop and deliver appropriate training and awareness raising sessions on all relevant aspects of the Establishment Fund Procedures for Heads of Establishment and other staff members who are involved in the operation, management and oversight of the school fund. (5) Ensure that appropriate action is taken to resolve the issues identified within the individual schools visited (as reported under separate cover). High Agree Barry Smedley, Chief Officer (Education North) (1) A job description has been prepared for a new post whose responsibilities will include establishment fund spot checks and ongoing support, guidance and training for school staff. This job description is awaiting formal HR job evaluation prior to being advertised. The monitoring framework will fully commence following appointment of the postholder, with a summary report to SMT in February 2027. (2) and (3) Further instruction will be provided to Heads of Establishment at the next quarterly briefing session. (4) Following appointment of the postholder per recommendation 1 above, a further training programme will be rolled out to school staff during academic session 2026/27. (5) A report will be submitted to the next Service Management Team incorporating recommended actions to be implemented in respect of individual establishments identified by Internal Audit. May 2026 (approval of post) February 2027 (spot checks and annual review) June 2026 August 2026 – June 2027 May 2026 Page 73 of 238
Page 74
19 3. Action Plan Education Establishment Visits 0450/2026/001 Ref Finding 2 A number of other areas of concern, which have been reported previously by Internal Audit, require to be addressed. During the course of the audit, we identified the following other areas of concern: • The authorised signatories for the school fund bank account for three schools visited did not match the records held by the Council’s Treasury Management section, with the latter including staff who were no longer employed in the school/nursery. • Staff within two of the schools visited were unaware of the insurance limits for their safe. On one occasion, this was due to the school having moved premises and now having a new safe. • The petty cash imprest accounts for two of the schools visited, had little, or no, activity in recent years. Records held show that the last imprest claims were September 2018 and April 2024 (albeit an imprest claim form for the latter had been completed but not yet submitted at the time of our visit). These issues have been reported as part of previous audit reports and whilst appropriate action to address the findings raised was taken, the issues do not appear to have been fully resolved. Implication Recommendation Priority Management response Implementation Date Inefficiently managed bank signatories may result in fraudulent activity and delays in transactions being processed. If schools are unaware of the safe limits, then the balance of cash held may be in excess of these limits and would not be covered by the Council’s insurance policies. Holding an unused imprest account could lead to an increased risk of fraudulent activity and/or misappropriation of funds. The Chief Officers (Education - North and Education - South) should: (1) Ensure that the signatories for all school funds are reviewed on an annual basis to determine whether these remain appropriate and agree with the list of signatories held by the Treasury Management section. Any changes should be promptly notified to the Treasury Management section. (2) Review and update the list of safes and other secure facilities held at all educational establishments to ensure that the information held is accurate and fully reflective of any change in premises. The updated list should be passed to the Insurance section to enable them to determine and advise on the level of insurance cover required and provided for each establishment and thereafter, Heads of Establishment should be advised of their safe limits. (3) Advise Heads of Establishment that, where their petty cash imprest account has remained inactive for an extended period, they should liaise with the Treasury Management section with a view to arranging for the closure of the account. Medium Agree Barry Smedley, Chief Officer (Education North) (1) The list of authorised signatories was previously reviewed and updated in September 2025. Going forward, the Service will ensure this exercise is formally undertaken on an annual basis. (2) A review of establishment safes and other secure facilities was previously undertaken and forwarded to the Insurance Section in July 2025. Going forward, the Service will ensure this exercise is formally undertaken on an annual basis. (3) Further instruction on the management of petty cash will be provided to Heads of Establishment at the next quarterly briefing session. September 2026 September 2026 June 2026 Page 74 of 238
Page 75
20 3. Action Plan Education Establishment Visits 0450/2026/001 Ref Finding 3 Security issues identified during the audit visits require to be considered and addressed. For the sample of school visits carried out, we identified, or were advised of, the following safety and security issues: • Upon arrival at each of the schools, we were asked to identify ourselves and sign the visitor’s log, however, on three occasions we were not asked to provide identification prior to being granted access to the school. • The Heads of Establishment at three of the schools visited expressed various security concerns regarding access to/from the building, playground and/or car park areas. We understand that these concerns have previously been raised with the Service, however, no action to rectify the concerns has been taken to date. • The inventory of electronic devices (iPads, laptops, etc.) held for one school recorded items in bulk by device type and the department in which they were held. As a result, it did not capture key details, including serial numbers for individual devices or to whom each was allocated. Implication Recommendation Priority Management response Implementation Date There may be significant safeguarding and security risks as unauthorised individuals could gain access to pupils and staff. Unless combination codes are changed when a staff member leaves, there is an increased security risk as former employees could gain unauthorised access to cash or confidential documents. If a register of devices does not record who each device is allocated to, there is a risk that such devices cannot be accounted for resulting in an increased likelihood of loss or theft. The Chief Officers (Education - North and Education - South) should: (1) Liaise with the Heads of Establishment at each of the three schools to discuss areas of concern and determine what, if any, action can be taken to alleviate these concerns and ensure the safety and security of both pupils and staff. (2) Remind staff of the importance of ensuring that: (a) Identification is requested and checked prior to visitors being allowed access to the school. (b) The inventory of electronic devices (iPads, laptops etc.) clearly records each device individually, including key details such as serial numbers and the name of the individual to whom each device has been allocated. Low Agree Barry Smedley, Chief Officer (Education North) (1) A meeting has been convened with the three Heads of Establishment to gain a full understanding of their concerns and confirm what short and long actions can be implemented. (2) Further instruction will be provided to Heads of Establishment at the next quarterly briefing session. April 2026 June 2026 Page 75 of 238
Page 76
21 3. Action Plan Education Establishment Visits 0450/2026/001 Ref Finding 4 There is a need for action to resolve ongoing banking issues and the lack of clerical support within one school. In one of the schools visited, the Head Teacher advised that the school’s only member of clerical staff (who is responsible for the day-to-day administration of the school fund and petty cash imprest etc. and is the only person with access to the safe and its contents) has been absent since October 2025. As neither the Head Teacher or Deputy Head Teachers have access to the safe or financial records for the petty cash imprest or school fund, we were unable to carry out verification checks on the petty cash or school fund during out visit. Although the Head Teacher advised that activity within the school fund is minimal, with income being restricted to fundraising and donations, we consider that at least two people should have access to the safe and financial records. The Head Teacher also advised that the school had relocated and changed its name in August 2025 and that prior to the move, the school’s safe, and its contents (small cash balance, cheque books and pay-in books) was stolen from the previous premises. Whilst the cheque and pay-in books were cancelled, the school is experiencing difficulties in updating the new name, address and signatories and is therefore not receiving bank statements and are having issues changing signatories and obtaining replacement cheque and pay-in books. Implication Recommendation Priority Management response Implementation Date Without adequate clerical support and access to financial records, there is a risk that the petty cash imprest and school fund are not being properly administered, recorded or monitoring which could result in increased errors, irregularities or potential misappropriation going undetected. The absence of bank statements and cheque and pay-in books may result in establishments being unable to bank cash promptly, issue payments and carry out timely bank reconciliations all of which may increase the potential risk of theft or misappropriation of funds remaining unidentified. The Chief Officer (Education - South) should liaise with the Head Teacher at the school referred to in the finding: (1) To ensure that appropriate access and business continuity arrangements are put in place for the management of the school fund and petty cash imprest, with at least two members of staff having access to the safe and financial records and interim clerical support being put in place whilst the substantive postholder remains absent. (2) To signpost the school to the Treasury Management section for assistance in resolving the outstanding banking issues, including updating the bank with the new school name, address and authorised signatories, arranging for replacement cheque and pay-in books and ensuring the school receives regular bank statements, including copy bank statements for those not received. Low Agree Barry Smedley, Chief Officer (Education North) A meeting has been convened with the Head of Establishment, HQ officers and Treasury Section to gain a full understanding of the outstanding actions required to restore the establishment fund, petty cash and banking arrangements to standard operational functionality as outlined in recommendations 1 and 2. May 2026 Page 76 of 238
Page 77
22 INTERNAL AUDIT REPORT COMPLIANCE WITH GENERAL CONTRACT STANDING ORDERS Headlines Section 81 of the Local Government (Scotland) Act 1973 requires councils to have contract standing orders to regulate procurement activity and the award of contracts to ensure that procurement is controlled and managed effectively and strives to achieve best value. The Council’s General Contract Standing Orders (GCSOs) set out the procedures, controls and responsibilities that apply to the procurement of supplies, services and works across the organisation. The GCSOs are reviewed regularly to reflect legislative and organisational changes, with the latest update being April 2025. For the period under review (January 2024 to August 2025), the Council awarded 128 contracts totalling almost £4 billion (excluding VAT). The purpose of this audit was to provide assurance that procurement activities across the Council are being conducted in accordance with the GCSOs and procurement regulations and guidance. Based on the results of our work, we have categorised the audit as offering reasonable assurance. Overall, we were satisfied that procurement and tendering activities are being undertaken in line with corporate requirements and are generally supported by appropriate and adequate documentation, as required by the Council’s GCSOs and related procurement guidance. In addition, we found that robust and appropriate processes are generally in place for inviting contractors, evaluating tenders and awarding contracts in accordance with established procedures and corporate expectations. We have identified a small number of areas for improvement, however, which are detailed at Section 3 of this report and include the need to strengthen the arrangements for verifying the authenticity of signatures on key procurement documentation. Internal Audit Opinion Reasonable assurance Priority of Recommendations High Medium Low 0 1 1 Organisational Impact Minor Report status FINAL Audit ref 0900/2026/008 Date issued 30/04/26 Audit Team Euan Campbell and Lesley Armstrong Issued To Chief Officer (Assets and Procurement) and Procurement and Support Manager Copied To Chief Executive and Depute Chief Executive Page 77 of 238
Page 78
23 1. Executive Summary Objectives The objective of this audit was to provide assurance that procurement activities across the Council are conducted in accordance with the GCSOs and procurement regulations and guidance. Specifically, the review sought to confirm whether goods, services and works have been procured consistently, and whether appropriate processes are being applied for inviting competition, evaluating tenders, and awarding contracts. Audit work involved examining a sample of eight completed regulated procurements recorded in the Council’s contract register between January 2024 and August 2025, covering a range of Services and contract values and delivered through a range of procurement routes (e.g. open procedure, direct award and mini-competition). Each procurement was assessed against checklists prepared using the requirements set out within the GCSOs. The audit did not consider the procurement with suppliers not included in the contract register as this was covered during the recent audit on non-contract spend. This engagement has been conducted in accordance with the Global Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • The Council has GCSOs and associated procurement guidance in place which set out the internal rules for the procurement of supplies, services and works. • The Council has a well-established, comprehensive procurement toolkit and supporting procedures, which are maintained by the Corporate Procurement Team (CPT). The toolkit includes procurement journey maps, workflows and standard documents and provides a consistent approach to regulated procurement activity. • For procurements with an estimated value exceeding £50,000 for supplies and services and £500,000 for works: o Prior to commencing the procurement process, Services are required to notify the CPT to ensure that the procurement is included on the contract register. o A Contract Strategy is required to be approved by the Chief Officer (Assets and Procurement) prior to the commencement of the procurement exercise. The Contract Strategy sets out the key details of the procurement, including budget and timetable, the proposed procurement approach and options appraisal, anticipated benefits and evaluation methodology. o Details of the contract award are required to be reported to committee, either in the form of a summary report by the Chief Officer (Assets and Procurement) or a detailed report from the appropriate Chief Officer (depending on the contract value). • The e-mailbox containing submitted tenders are opened promptly after the tender deadline by two officers within the CPT ensuring appropriate separation of duties from those evaluating the tender. • The CPT has developed an Open Procedure Tender Evaluation Matrix that consolidates all evaluation information and scores into a single document. The matrix incorporates automated formulae to calculate price and evaluation scores, ensuring accuracy of calculations and promoting a consistent evaluation approach across contracts. Key areas requiring management action (High Priority) No areas requiring urgent management attention have been identified. Other areas for improvement (Medium Priority) One other area for improvement was also identified: • There is scope to strengthen the arrangements for verifying the authenticity of signatures on key procurement documentation. Page 78 of 238
Page 79
24 6. Action Plan Compliance with General Contract Standing Orders 0900/2026/008 Ref Finding 1 There is scope to strengthen the arrangements for verifying the authenticity of signatures on key procurement documentation. The Council has longstanding requirements for evidencing authorisation of key procurement and tender evaluation documentation. Historically, this was achieved through printed documents bearing ‘wet’ signatures, which were scanned and retained on the Council’s IT network to evidence responsibility, ownership and authenticity. Since the transition to MS Teams and the shift to hybrid working, obtaining physical signature has become increasingly challenging. This issue has previously been reported by Internal Audit on more than one occasion and, as a result, the CPT issued several Procurement Advisory Notices outlining acceptable approaches for confirming authorisation, including the use of supporting emails where wet signatures or appropriate e-signature solutions were not available. This issue was further considered by a short life working group, chaired by the Depute Chief Executive and comprising several senior managers, resulting in the introduction of a corporate signature protocol which was approved by CMT in March 2024. This protocol consists of four tiers of authorisation including system-based authorisation (e.g. PECOS, iTrent), ‘wet’ signatures, auditable electronic signatures (e.g. Adobe Acrobat, Docusign or equivalent) and emails being retained to support typewritten or cut and paste signatures in Word or Excel documents. Our review of the procurement and tender documentation for the eight contracts selected, again identified a number of instances where documents were not appropriately signed or the documentation held did not provide sufficient evidence of authenticity of signatures. Several documents contained either typewritten or electronic signatures which could easily be copied and pasted into other documentation, providing no assurance over the integrity of authorisation. This indicates that the corporate signature protocol has not yet embedded effectively in practice and that the underlying control weakness remains. We also noted that some of the templates and working documents used within the procurement process, in particular, the recently introduced Open Tender Procedure Summary Matrix, do not include a section for formal sign-off as confirmation of agreement of the final price/quality assessment and approval of the recommended contract award by the evaluation team. Whilst we consider that authorisation of all procurement documentation would be disproportionate, we consider there to be key decision points during the procurement and tender evaluation process where formal documented approval is necessary to evidence governance and accountability. Implication Recommendation Priority Management response Implementation Date Without clear evidence of authorisation, the Council may not be able to demonstrate that procurement decisions have been properly reviewed and agreed by appropriate officers. The Chief Officer (Assets and Procurement) should: (1) Review the procurement process and supporting templates to identify key stages where formal officer sign-off is required to confirm the accuracy and integrity of procurement outcomes and thereafter, update the relevant templates. (2) Reinforce expectations to Services regarding the expected methods and standards for completing, authorising and retaining procurement documentation, to ensure that all staff clearly understand their responsibilities throughout the procurement process. Medium Agree Brian Ferguson, Procurement and Support Manager (1) The procurement process and supporting templates will be reviewed, with regards to GCSOs, to identify the necessary checkpoints requiring authorisation. CPWG will be asked to review and agree the signatory checkpoints. The relevant documents will then be updated to include the most appropriate ‘tier of authorisation’ with regards to the corporate signature protocol. (2) A procurement advisory notice will be published to reinforce the protocols for authorisation of specific procurement documents, and the roles and responsibilities. October 2026 Page 79 of 238
Page 80
25 3. Action Plan Compliance with General Contract Standing Orders 0900/2026/008 Ref Finding 2 A number of areas of non-compliance with the Council’s GCSOs were identified. Whilst our review of a sample of eight procurements confirmed that key procurement expectations as set out in the Council’s GCSOs and procurement procedures were generally being complied with by Services, we identified a small number of instances of non-compliance, as follows: • GCSO 4.4.2 states that a contract award procedure should not commence until the Contract Strategy is completed and approved by the appropriate Chief Officer (Assets and Procurement), however, for one contract, the Procurement Engagement Document and Contract Strategy were not fully completed and signed as approved by the appropriate Chief Officers. • For two contracts, there were no complete Conflict of Interest Declaration forms for some members of the evaluation team. • One contract where the price of the winning tender exceeded the budgeted contract value recorded in the Contract Strategy and, whilst the budget was increased to a value higher than the price of the winning tender, there was no evidence of approval being sought to increase the budget. • Whilst procurement guidance states that the price evaluation should be undertaken by two evaluators, we identified one contract where the price evaluation was undertaken by only one evaluator. • The contract award for one contract for supplies and services with a value of over £500,000 was not reported to the Service committee in line with GCSO 21.3. The contract was awarded in May 2025, and the next appropriate committee meeting was not until August 2025, however, despite a contract award report being prepared, it was not presented to committee. • GCSO 21.13.1 states that the Chief Officer (Assets and Procurement) should publish a Contract Award Notice no later than 30 days after the issues of the letter of award of the contract, however, for one contract the Contract Award Notice was not published until 81 days after the award letter was issued. Implication Recommendation Priority Management response Implementation Date The absence of consistently complete, properly authorised and well-retained procurement documentation increases the risk of gaps in the audit trail and may reduce assurance that procurement decisions are transparent, compliant and supported by appropriate oversight. The Chief Officer (Assets and Procurement) should remind officers responsible for undertaking procurements of the need to ensure that all aspects of the Council’s GCSOs and procurement procedures are complied with, specifically highlighting the issues outlined in the finding above. Low Agree Brian Ferguson, Procurement and Support Manager The ‘procuring officer’ in each procurement process should use a checklist to ensure procedural steps are followed, including relevant authorisation; this would improve compliance. The Procurement and Support Manager will review the findings from the audit sample and create a ‘lessons learned’ procurement advisory to cover the issues identified. Thereafter, officers will be reminded of expected practice and a template checklist to assist the procuring officers will be established. January 2027 Page 80 of 238
Page 81
26 INTERNAL AUDIT REPORT CONTRACT MANAGEMENT – QUALITY ASSURANCE ARRANGEMENTS Headlines Effective contract management arrangements increase the likelihood that the Council’s contracts are sustainable, achieve expected outcomes and represent best value. An Internal Audit report issued in April 2023 identified the need for a formal mechanism for assessing whether effective Contract Supplier Management (CSM) is being undertaken across the Council. In response to this, the Corporate Procurement Team (CPT) developed a CSM assurance framework, designed to monitor and evaluate CSM activities and assess the level of compliance across Services with key corporate expectations. Details of this framework, together with the principles and requirements underpinning proportionate and effective CSM, are set out in the Contract and Supplier Management Key Principles and Guidance document, developed by the CPT and approved by the Corporate Procurement Working Group (CPWG) in February 2025. The purpose of this audit was to provide assurance on the adequacy and effectiveness of the arrangements for reviewing Services’ compliance with the Council’s CSM guidance. Based on the results of our work, we consider that the planned assurance activities set out within the CSM assurance framework are appropriate to support the review and monitoring of CSM activity. We recognise that the arrangements are relatively new and, at the time of the audit, only one full assurance cycle had been completed. As a result, they are not yet fully embedded. Although we have categorised this audit as providing reasonable assurance, we consider that the arrangements require further development to fully demonstrate compliance with the General Contract Standing Orders (GCSOs) and CSM guidance. A number of areas for improvement are detailed in the action plan at section 3 of this report and include refining the CSM assurance poll to enhance its effectiveness, strengthening the CSM sample testing process to provide sufficient and reliable assurance of compliance with corporate expectations, introducing formal monitoring and reporting of mandatory CSM training and ensuring that the outcomes of CSM assurance activity are reported to the CPWG and Chief Officers in line with CSM guidance. Internal Audit Opinion Reasonable assurance Priority of Recommendations High Medium Low 0 4 0 Organisational Impact Moderate Report status FINAL Audit ref 0600/2026/002 Date issued 30/04/26 Audit Team Euan Campbell and Lesley Armstrong Issued To Chief Officer (Asset and Procurement) and Procurement and Support Manager Copied To Chief Executive and Depute Chief Executive Page 81 of 238
Page 82
27 1. Executive Summary Objectives The audit sought to provide assurance on the following: • A framework for monitoring compliance with the CSM principles and guidance has been established and this covers all aspects of the guidance. • The compliance framework is being operated in line with Council expectations. • There is evidence that timely and appropriate management action has been taken where the compliance framework highlights areas of potential concern. • There is periodic reporting to key stakeholders on the outcome of the assurance work undertaken as part of the compliance framework. This engagement has been conducted in accordance with the Global Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • The Service has implemented a multi-layered assurance framework incorporating Chief Officer declarations, Contract Manager attestations, sample-check activity and mandatory training, providing a structured foundation for assessing and monitoring compliance with the CSM guidance. • The CPT has produced Contract and Supplier Management Key Principles and Guidance which outlines the process for contract management assurance, including standards and roles and responsibilities. • Mandatory CSM e-learning has been introduced for all staff assigned Contract Management Authority, establishing a consistent baseline of competency across services. Key areas requiring management action (High Priority) No areas requiring urgent management attention have been identified. Other areas for improvement (Medium Priority) A number of other areas for improvement were also identified: • There is scope to refine the CSM assurance poll to enhance its effectiveness. • There is a need to strengthen the CSM sample checking process to provide sufficient and reliable assurance of compliance with corporate expectations. • There is a need to introduce formal monitoring and reporting of mandatory CSM training. • There is a need to ensure that the outcome of CSM assurance activity is reported to the CPWG and Chief Officers in line with CSM guidance. Page 82 of 238
Page 83
28 7. Action Plan Contract Management Quality Assurance Arrangements 0600/2026/002 Ref Finding 1 There is scope to refine the CSM assurance poll to enhance its effectiveness. GCSO 23.1 requires Services to put appropriate arrangements in place for managing contracts. It states that the Contract Manager, who has a Contract Manager Assurance (CMA) role, is responsible for monitoring and managing the contract and sets out the minimum aspects to be addressed (i.e. contractor’s performance, compliance with specification and contract terms, cost, Best Value requirements, risk and compliance with any guidance issued by the Chief Officer (Assets and Procurement)). The requirements are supplemented by part 3 of the CSM guidance, which provides further detail on the expectations associated with each aspect. As part of the CSM Assurance Framework, the CPT committed to issuing an annual poll to officers assigned a CMA role to confirm the CSM activities which are undertaken and can be evidenced. This poll includes questions to confirm whether the respondent is the Contract Manager, which of the CSM requirements set out in GCSO 23.1 they can evidence and whether they have completed the CSM e-learning modules. The first poll was issued in November 2024 to officers identified as Contract Managers for contracts awarded during 2023/24, with the process completed in January 2025. At the time of our audit fieldwork, the equivalent exercise for contracts awarded during 2024/25 had not been completed and was behind schedule. Our review of the poll for contracts awarded during 2023/24 identified the following issues: • The aspects stated in GCSO 23.1, the CSM guidance and the poll are not fully aligned. While they broadly cover similar areas, the CSM guidance includes an aspect relating to delivery of community benefits and social value that is not reflected in the poll. Conversely, the poll includes two additional aspects relating to the use of CSM guidance (such as balanced scorecards) and any Service-specific CSM practices, which are not explicitly referenced in GCSO 23.1. • Officers who undertake the CMA role for multiple contracts are required to complete the poll only once, with their responses applied to all contracts for which they are responsible. Given the diverse range of values, durations, risk profiles and terms and conditions of contracts, this approach does not provide assurance that the CSM requirements are being consistently met for each individual contract. We consider that separate responses should be obtained for each contract. • Section E of the Contract Strategy sets out the intended CSM approach for the contract. Given that this is a mandatory element of the procurement toolkit for all contracts included on the Council’s contract register, the poll does not include any question to confirm whether the CSM approach set out in the Contract Strategy is being implemented in practice. • The guidance note issued alongside the poll stated that it applied to contracts and frameworks awarded during the 2023/24 financial year and provided a list of agreements requiring Contract Manager response. However, comparison of this list with the spreadsheet of collated responses identified inconsistencies, including contracts included in the spreadsheet of collated responses that were not on the original list provided, and vice versa. This indicates that not all relevant Contract Managers were identified or responded to the poll. Page 83 of 238
Page 84
29 5. Action Plan Contract Management Quality Assurance Arrangements 0600/2026/002 Implication Recommendation Priority Management response Implementation Date If minimum CSM requirements are not clear and fully aligned across documents, they may not be applied consistently or sufficiently across contracts. The Council may be unable to demonstrate compliance with the minimum CSM requirements for all contracts which could result in increased non- compliance which may go undetected. The Chief Officer (Assets and Procurement) should: (1) Review and update the GCSO 23.1 requirements, CSM guidance and annual poll to ensure that all documents are fully aligned and consistently reflect the minimum CSM requirements. (2) Update the arrangements for completing the CSM assurance poll to require completion on a contract basis rather than a single response covering multiple contracts. (3) Consider updating the CSM assurance poll to include specific questions confirming whether the CSM approach set out in the Contract Strategy is being implemented in practice and if not, to provide an explanation and any mitigating actions. (4) Review the arrangements for identifying in-scope contracts and assigned Contract Manager prior to issuing the annual poll and ensuring that all Contract Managers complete the poll. This should include validation checks to ensure that all relevant contracts and Contract Managers are included in the exercise and have submitted a response. Medium Agree Brian Ferguson, Procurement and Support Manager (1) A Practice Note per GCSO 2.8 will be put in place to cover an interim update to the wording in GCSO 23.1 on Contract Management which will align with the clearer wording in the CSM Guidance document to improve consistency. The actual GCSO 23.1 update will be changed at next full GCSO review (likely within 2027 to tie in with expected changes to national procurement thresholds). (2) This will be updated in the CSM assurance poll to be conducted at the end of 2026. (3) This will be updated in the CSM assurance poll to be conducted at the end of 2026. (4) In advance of the next annual CSM Assurance Poll, CPT will review the arrangements for identifying in-scope contracts and ensuring that the most up to date information on Contract Managers is held. Where responses are not received, these will be referred to the relevant Chief Officer. September 2026 (Practice note) December 2027 (GCSO update) December 2026 December 2026 September 2026 Page 84 of 238
Page 85
30 3. Action Plan Contract Management Quality Assurance Arrangements 0600/2026/002 Ref Finding 2 There is a need to strengthen the CSM sample checking process to provide sufficient and reliable assurance of compliance with corporate expectations. As part of the CSM Assurance Framework, the CPT committed to undertaking annual checks on a sample of 5% (or minimum 10) of contracts included in the Procurement Register to obtain assurance that appropriate CSM practices are in place, and can be evidenced, to satisfy GCSO 23.1. Our review of the sample checking process undertaken for the initial poll covering 2023/24 contracts identified a number of issues in the design and operation of the sample checking process. The sample reviewed was not selected in line with the agreed methodology, as contracts were drawn from responses to the CSM assurance poll rather than the Procurement Register and the sample size did not meet the minimum requirements, with only 8 contracts selected from a population of 69. Additionally, the approach to sample selection was not risk-based, with contracts selected randomly and no consideration given to Service area, contract characteristics, risk profile or responses provided in the poll. While sample checks were undertaken, these largely focused on confirming the existence of documentary evidence declared as available by the Contract Managers. There was limited challenge of the quality, completeness or appropriateness of the evidence provided, or of whether it was sufficient to demonstrate compliance with GCSO 23.1 and CSM guidance. There was also no evident follow-up of negative responses to the assurance poll. Despite variations in the level and quality of supporting documentation, including one instance where no supporting evidence was held, all contracts in the sample were assessed as fully compliant. The recording of sample checks was also limited, with the summary spreadsheet used to record results stating only that contracts were fully compliant, with no clear commentary or rationale supporting these conclusions. Although a working version contained some additional detail, this was inconsistently applied and did not form part of the formal assurance record. Furthermore, there are no formal arrangements in place for providing feedback to Contract Managers on the outcome of sample checks, or for identifying, recording and monitoring improvement actions arising from the review process. While management advised that feedback is provided informally, no evidence was seen of issues being identified or raised, or improvement actions being agreed or tracked. As a result, the current process provides limited assurance and does not fully support the identification or remediation of weaknesses in contract management practices. Implication Recommendation Priority Management response Implementation Date Deficiencies in sampling methodology, scrutiny of evidence, documentation, and feedback arrangements limit the effectiveness of the assurance process and reduce confidence in reported compliance with GCSO 23.1. As a result, weaknesses in contract management practices may not be systematically identified, escalated, or rectified. The Chief Officer (Assets and Procurement) should review and update the CSM sample checking process, taking cognisance of the issues highlighted in the finding above, to ensure that it is consistently applied, adequately documented and includes appropriate challenge, feedback and follow-up and therefore, provides sufficient and reliable assurance over compliance with CSM requirements and corporate expectations. Medium Agree Brian Ferguson, Procurement and Support Manager The CSM sample checking process will be reviewed for the next assurance exercise to address the findings and improve the reliability of the assurance process. Approval will be sought from CPWG prior to any updates. March 2027 Page 85 of 238
Page 86
31 3. Action Plan Contract Management Quality Assurance Arrangements 0600/2026/002 Ref Finding 3 There is a need to introduce formal monitoring and reporting of mandatory CSM training. Section 5 of the CSM guidance states that, from 2025/26, officers assigned a CMA role will be required to complete mandatory e-learning modules via the NLC Procurement Training and Development Programme on LearnNL, which cover the fundamental requirements of CSM outlined in GCSO 23.1, together with guidance, templates and examples on how to undertake each of the required CSM activities. The purpose of this training is to ensure that Contract Managers have a current knowledge and understanding of the minimum standards for CSM. From our review of the e-learning modules, we consider that the content is informative and would assist both experienced and inexperienced Contract Managers to understand the expectations and requirements of the CMA role and how these should be applied to contracts. However, we noted that, despite the modules being mandatory, there has been limited uptake to date, with only 33% of officers identified as Contract Managers for the 2024/25 assurance exercise being recorded on LearnNL as having completed the training. Additionally, the CPT does not currently obtain or review reports from LearnNL to monitor completion rates or escalate non-compliance. Implication Recommendation Priority Management response Implementation Date Insufficient monitoring of mandatory training and low completion rates reduce assurance that contract managers have the necessary knowledge to apply required standards, increasing the risk of inconsistent or non‑compliant contract management practices. The Chief Officer (Assets and Procurement) should establish and implement a process for routinely monitoring completion of CSM training and following-up non-completion, including targeted reminders and escalation as appropriate, to ensure that all relevant officers complete the training within a defined timeframe. Consideration should be given to reporting the uptake of training to CPWG to enable them to identify and inform Contract Managers within their Service of the requirement to undertake the training. Medium Agree Brian Ferguson, Procurement and Support Manager The Procurement and Support Manager will liaise with colleagues in Talent and Organisational Development to establish: (a) A process for providing the names of officers nominated as Contract Managers or with a CMA role for one or more live contracts who are required to undertake the training. (b) Setting the eLearning as a mandatory training requirement for those specified officers with a CMA role. (c) Associated reporting. December 2026 Page 86 of 238
Page 87
32 3. Action Plan Contract Management Quality Assurance Arrangements 0600/2026/002 Ref Finding 4 There is a need to ensure that the outcome of CSM assurance activity is reported to the CPWG and Chief Officers in line with CSM guidance. Section 5 of the CSM guidance states that it is necessary to have organisational assurance that there is effective CSM in place for all live contracts and outlines the methods that the Council has established for obtaining assurance for CSM. This includes the CPT administering a poll for completion by officers assigned a CMA role and sample checks on contracts awarded and logged in the Procurement Register to ensure that CSM practice, which satisfies the requirements of GCSO 23.1, can be evidenced. The CSM guidance also states that the results of both exercises will be repeated annually for all live contracts and that the results will be reported to the CPWG and Chief Officers. The initial poll and spot checks were undertaken for contracts awarded during 2023/24, with the exercise being completed in February 2025, however, we noted that no reporting of the outcome of these exercises has been undertaken to date. Implication Recommendation Priority Management response Implementation Date Inadequate reporting of CSM activity limits organisational oversight, resulting in reduced assurance that contract management performance, compliance with GCSOs and CSM guidance and capability gaps are being effectively identified, monitored and addressed. The Chief Officer (Assets and Procurement) should ensure that, in line with the requirements of CSM guidance, a report should be submitted to the CPWG and Chief Officers on an annual basis, confirming the CSM assurance activity undertaken during the year, together with the outcome, areas of non-compliance and any required improvement actions. Medium Agree Brian Ferguson, Procurement and Support Manager The CPWG will be updated annually on the results of the CSM Assurance Poll and sample checks. Chief Officers will also be updated on the outcome of the sample checks in their Service. September 2026 Page 87 of 238
Page 88
33 INTERNAL AUDIT REPORT CLYDE VALLEY WASTE CONTRACT Headlines The Clyde Valley Waste Contract (CVWC) is a partnership between North Lanarkshire Council (Lead Authority), East Dunbartonshire Council, East Renfrewshire Council, North Ayrshire Council and Renfrewshire Council for the provision of joint residual waste treatment and disposal services. As Lead Authority, the Council was responsible for the procurement and award of the contract. Viridor was appointed in 2019, and the contractual arrangements are documented within the Project Agreement and supporting Authority Requirement between North Lanarkshire Council and Viridor Clyde Valley Limited. The terms of the partnership are contained in the Inter Authority Agreement (IAA), which sets out the scope of the agreement and the key obligations of the Lead Authority and the Partner Authorities. A Variation Agreement relating to the IAA was approved by the Partner Authorities in April 2026 to reflect variations and updates to these arrangements, and to ensure ongoing compliance with legislation requirements and to support the effective management of the contract. The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s role as Lead Authority for the CVWC. Based on the results of our work, we consider that, to date, the CVWC Management Team (CMT) have discharged their obligations as expected, with appropriate arrangements in place for monitoring waste processing information, processing payments and monitoring the contractor’s performance. We have therefore, categorised the audit as offering substantial assurance. In accordance with the IAA, the Lead Authority’s Internal Audit service is required to provide a biennial statement of assurance regarding the project’s governance arrangements relating to payment processes and project monitoring, to confirm compliance with the IAA, the Project Agreement and other contract documents. Based on the results of this audit, we intend to return this assurance statement to the Joint Steering Board (JSB) stating that there are no significant matters that require to be raised which could have a material impact on the delivery of the Project Agreement or compliance with the IAA for 2025-26. Internal Audit Opinion Substantial assurance Priority of Recommendations High Medium Low 0 0 1 Organisational Impact Minor Report status FINAL Audit ref 0800/2026/002 Date Issued 30/04/26 Audit Team Elaine MacDonald, Lynn McCrum and Lesley Armstrong Issued To Depute Chief Executive, Chief Officer (Community Operations) and Contract Manager (Clyde Valley) Copied To Chief Executive Page 88 of 238
Page 89
34 1. Executive Summary Objectives This audit sought to provide assurance on the extent to which the Council, as Lead Authority, has managed payment processes and project monitoring arrangements in line with key expectations laid out in the IAA. It involved reviewing invoices from the Contractor and recharge invoices for the Partner Authorities to ensure that the revised budget proportions have been accurately calculated and comply with the requirements set out in the IAA, and completion of a checklist to ensure that contract performance is being monitored on a regular basis and in line with key expectations. This engagement has been conducted in accordance with the Global Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • The Council has appointed a Project Director, Contract Manager and supporting Contract Management Team, with responsibility for monitoring and reviewing performance and delivery. • A JSB has been formed to oversee the operation and performance of the Project, and Terms of Reference outline the role and remit for the Board. The Board meets regularly and is attended by key contract representatives, including a nominated party from each Partner Authority. The Contract Manager submits a service report to each Board meeting. • Contractor monthly unitary charge invoices are supported by the contractor’s monthly performance report, spreadsheets of monthly waste activity and weighbridge turnaround times. Costs are promptly and accurately recharged to each Partner Authority in line with the contract. • The contractor produces monthly and annual performance reports in line with the Performance Measurement Framework as set out in the Authority Requirements document which forms part of the contract. • The Contract Management Team undertake monthly site visits to satisfy themselves of the adequacy and accuracy of the contractor’s performance monitoring processes. A checklist based upon the KPIs is populated for each visit and retained as evidence. Key areas requiring management action (High Priority) No key areas requiring urgent management action have been identified. Other areas for improvement (Medium Priority) There were no other areas for improvement identified. Page 89 of 238
Page 90
35 8. Action Plan Clyde Valley Waste Contract 0800/2026/002 Ref Finding 1 Some minor areas for improvement were identified. A JSB has been established to oversee and monitor the operation and performance of the CVWC. The IAA, which sets out the scope of the agreement and key obligations of the Lead Authority and Partner Authorities, includes a number of tasks that the JSB is required to complete within specified timescales. Our review of the IIA identified a small number of instances where these were not completed within the timescales prescribed. These include: • Section 7.5 of the IAA requires the JSB to consider and approve the Annual Budget for the following financial year by 30 November each year, however, the 2026/27 Annual Budget was not approved until December 2025. • Section 10.3 of the IAA requires that the JSB approve the Contract Management Plan (CMP) no later than 31 December in each contract year. We noted that neither the 2025/26 nor 2026/27 CMPs were approved in accordance with this requirement. The 2025/26 CMP, due for approval in December 2024, was not approved until December 2025 and the 2026/27 CMP, due for approval in December 2025, was not approved until March 2026. Additionally, the contractual arrangements with the contractor, Viridor are set out in a Project Agreement and supporting Authority Requirement agreed between North Lanarkshire Council and Viridor. We noted that, in recent years, changes to certain aspects of the contractual arrangements have been agreed with Viridor and the Partner Authorities and subsequently implemented, however, a formal deed of variation to reflect these changes has not yet been finalised and approved. We understand that this was delayed to allow for recent legislative changes to be incorporated. Similar issues relating to non-compliance with the timescales set out in the IAA and delays in formally documenting changes through a deed of variation have been reported previously. Implication Recommendation Priority Management response Implementation Date If key documentation is not presented to the JSB for review and approval in line with the IAA, this may impact on the ability of the JSB to properly discharge its duties and this may lead to decisions being made or agreed without full awareness of the budget and/or key outcomes. Changes to the Project Agreement may not be contractually binding despite being operationally applied. The Depute Chief Executive, as Contract Director, should ensure that: (1) Going forward, the Annual Budget and CMP are presented to, and approved by, the JSB in accordance with the timescales set out in the IAA. (2) Ensure that all agreed changes to the Project Agreement are formally captured in a deed of variation and that this is approved by all parties at the earliest opportunity. Low Agree Jackie Lytlle, Contract Manager (Clyde Valley) Steering Group meetings are now (and have been since November 2025) booked in at least 6 months in advance to ensure deadlines for approvals are met. April 2026 Page 90 of 238
Page 91
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/LM/ASP/May 2026 Date 14/05/26 Internal Audit: Follow-up of implementation of audit recommendations From Francis Scott, Chief Officer (Audit and Risk) E-mail ScottFr@northlan.gov.uk Executive Summary The purpose of this report is to update the Panel on the progress made by management in the implementation of Internal and External Audit recommendations. In the period to 31 March 2026, of the 29 High and Medium priority recommendations that were due, 20 have been fully implemented and nine remain outstanding. Of the nine recommendations that remain outstanding, two have an implementation date which is more than 12 months overdue. Since April 2021, 97% of all relevant audit recommendations have been satisfactorily implemented by Services, meaning that only 3% of these audit recommendations remain outstanding. In respect of recommendations from External Audit reports, nine of the 20 agreed actions have been completed, four are partially implemented, one is no longer relevant and six are not yet due. Recommendations The Panel is invited to: (a) Note the contents of this report. (b) Consider whether there are any issues arising from this report on which they wish to receive further information from relevant management. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work All Programmes of Work Item 6 Page 91 of 238
Page 92
1. Background 1.1 This report presents an overview of the progress of all High and Medium priority Internal Audit recommendations in the period to 31 March 2026. 1.2 This report also provides an update on progress made in addressing recommendations arising from External Audit reports issued as part of the 2022-23, 2023-24 and 2024- 25 audits. 1.3 The updates from management on progress to date have been verified on a sample basis by Internal Audit as part of the preparation of this report. However, it should be noted that this review has focused on whether planned actions have been completed and has not included detailed substantive testing of whether the implemented actions have been effective in addressing previously identified weaknesses. 2. Report Internal Audit recommendations 2.1 Table 1 below summarises the progress of all High and Medium priority recommendations which were due to be completed in the period to 31 March 2026. Overall, 20 of the agreed actions have been completed and nine remain outstanding. Table 1 Completed No Longer Relevant Outstanding Total Chief Officer Area Asset and Procurement 3 0 0 3 Community Operations 4 0 2 6 Education 0 0 2 2 Finance and Technology 2 0 0 2 Housing and Communities 3 0 3 6 Legal, Democratic and Strategy 3 0 1 4 People Resources 5 0 1 6 TOTAL 20 0 9 29 2.2 For the nine outstanding recommendations, revised implementation dates have been agreed. Appendix 1 provides detail of these recommendations with an update on progress provided by service management. Appendix 1 also references instances where the original implementation date of a recommendation was more than 12 months overdue. In this period there are two such actions, referenced 1.1 - 1.2 in the appendix. Relevant Chief Officers have been invited to attend the Panel meeting to provide explanations. 2.3 As at 31 March 2026, 97% of all relevant audit recommendations, where the original agreed implementation date was either due or had passed, have been fully implemented by Services, meaning that the percentage overall of all audit recommendations made since April 2021, which remain outstanding, is 3%. This shows an increase in performance since the last period when 94% were complete and 6% were outstanding. Page 92 of 238
Page 93
External Audit recommendations 2.5 Table 2 shows the status of actions agreed by management in response to External Audit reports issued as part of the 2022-23, 2023-24 and 2024-25 audits. As at 31 March 2026, nine of these recommendations are complete, four are partially implemented, six are not yet due and one is no longer relevant. Appendix 2 provides detail on the status of these recommendations with an update on progress provided by service management. Table 2 Completed Partially implemented Not yet due No longer relevant Total Report Title 2022-23 Annual Report 2021/22 1 1 0 1 3 Best Value Thematic Report 3 0 0 0 3 2023-24 Annual Report 2 2 1 0 5 Best Value Thematic Report 2 1 0 0 3 2024-25 Annual Report 1 0 3 0 4 Best Value Thematic Report 0 0 2 0 2 TOTAL 9 4 6 1 20 2.6 The action reported as no longer relevant refers to issues relating to capital processes. Two of the three points made within this action have been implemented and the third has been superseded by an action raised in the 2024-25 External Audit Annual Report. 3. Measures of success 3.1 Internal Audit reports each cycle to the Audit and Scrutiny Panel on the progress made by management in implementing actions in response to Internal and External Audit reports. 4. Supporting documentation Appendix 1 Register of Outstanding Internal Audit Recommendations Appendix 2 External Audit Recommendations Francis Scott Chief Officer (Audit and Risk) Page 93 of 238
Page 94
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure by Services to address previously identified issues and/or weaknesses will impact on the effectiveness of the relevant control framework. This, depending on the nature of the issue, will be captured and should be reflected in the relevant service risk register or the corporate risk register (as appropriate). 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 94 of 238
Page 95
APPENDIX 1 – Register of Outstanding Internal Audit Recommendations Ref. Report Details Recommendation Original & revised timescales Management update 1.1 Chief Officer (Education) School Excursions (October 2023) The Chief Officers of Education (North and South) should ensure that: (1) A comprehensive formal review of both the Council’s Educational Excursions and Outdoor Activities Policy and the Risk Assessment Guidance on Educational Excursions and Outdoor Activities is undertaken to revisit and refresh all aspects of these documents with a view to improving the robustness of the Council’s arrangements associated with school trips and excursions. This should take account of, but not limited to, the information contained in Appendix 2 and the need for roles and responsibilities of all relevant parties, including those within other Council services to be clearly documented in the revised guidance. (2) Any revised arrangements are fully communicated to all Council Services with a role in the process. (3) They explore how best to gather/record details of all school trips and excursions and thereafter monitor compliance with the Council’s expected arrangements associated with such trips and excursions. Priority: High April 2024 March 2025 September 2025 June 2026 (>12 months overdue) A review has been undertaken by HQ officers to re-assess the scope and delivery time of the project. This review identified a number of technical tasks which require to be undertaken, including systems reviews and alignment with other Service and Council policies. The Head Teachers have been briefed on the requirement to undertake a review of the policy, and a short life working group has been created. Due to the nature of the task, and to comply with all of the Internal Audit recommendations, this work will now be undertaken in line with the Council’s project management arrangements/guidelines. A project outline, work plan and risk register has been developed with formal working group meetings meeting on a number of occasions since January 2026. The working group have considered National Guidance and critically reviewed the existing policy to identify information which needs to be either updated or amended. Consideration is also being given as to whether cash receipts should continue versus an online only system. In the interim, best practice advice has, and will, continue to be given to schools based on the existing policy. The delay in implementation is largely due to staff resources being allocated to responding to school transport issues and enquiries. Going forward, there will be greater clarity regarding the post(s) within the Resources Team which will have HQ governance responsibility for overseeing school trip/excursion policy and activity. Page 95 of 238
Page 96
Ref. Report Details Recommendation Original & revised timescales Management update 1.2 Chief Officer (Education) School Excursions (October 2023) The Chief Officers of Education (North and South) should: (1) as part of the formal review referenced at Action Plan point 1 above, ensure that this includes the creation of a dedicated section within the policy and/or associated procedures which outlines clear expectations around the financial aspects associated with the organisation and execution of trips. This should include, but not be limited to: (a) A clear and detailed protocol for booking trips where a travel company/tour operator is not going to be used ensuring arrangements minimise the risks associated with such payments and ensure that the use of personal credit cards to book trips is prohibited. (b) Consideration to promoting iPay Impact as the primary means for collecting monies in schools thus reducing cash payments and the subsequent flow of physical cash in the school. (c) Determining the additional checks/monitoring that need to be carried out at establishment level to ensure all monies due are received and duly banked in line with Council policy. (d) clear guidance on the levels of physical cash that can/should be taken on a trip/excursion, the required records to be completed and documentary evidence required/expected to support any such spend. Priority: High April 2024 March 2025 September 2025 June 2026 (>12 months overdue) A review has been undertaken by HQ officers to re-assess the scope and delivery time of the project. This review identified a number of technical tasks which require to be undertaken, including systems reviews and alignment with other Service and Council policies. The Head Teachers have been briefed on the requirement to undertake a review of the policy, and a short life working group has been created. Due to the nature of the task, and to comply with all of the Internal Audit recommendations, this work will now be undertaken in line with the Council’s project management arrangements/guidelines. A project outline, work plan and risk register has been developed with formal working group meetings meeting on a number of occasions since January 2026. The working group have considered National Guidance and critically reviewed the existing policy to identify information which needs to be either updated or amended. Consideration is also being given as to whether cash receipts should continue versus an online only system. In the interim, best practice advice has, and will, continue to be given to schools based on the existing policy. The delay in implementation is largely due to staff resources being allocated to responding to school transport issues and enquiries. Going forward, there will be greater clarity regarding the post(s) within the Resources Team which will have HQ governance responsibility for overseeing school trip/excursion policy and activity. 1.3 Chief Officer (Community Operations) Fleet Management (October 2025) The Chief Officer (Community Operations) should: (1) Consider introducing second-officer verification for critical data inputs into Freeway, particularly during vehicle profile setup, to improve data accuracy and reliability. (2) Consider expanding the existing compliance audit process currently used in waste management to cover the wider fleet, ensuring consistent oversight and promoting continuous improvement across all service areas. Priority: Medium October 2025 August 2026 Compliance checks across the entire fleet are still in progress and have not yet been completed. The process is expected to be fully completed in line with the revised timescale. Delay in implementation is largely due to this action requiring a significant resource commitment. Page 96 of 238
Page 97
Ref. Report Details Recommendation Original & revised timescales Management update 1.4 Chief Officer (People Resources) ESC: Selected Controls (July 2025) The Chief Officer (People Resources) should identify and correct any issues/errors arising from the finding, particularly in relation to casual worker payments being allocated to posts with contracted hours and/or casual/sessional workers in receipt of payments which they are not entitled to. Priority: Medium October 2025 July 2026 Due to staffing changes, there was a delay in actioning this recommendation. Going forward, each of the cases identified will be individually reviewed to determine the inaccuracies. The values involved are likely to be minimal and as such any inaccuracies resulting in overpayments will not be pursued as they will fall under the threshold set by Finance for economical recovery. Any resultant underpayments will be calculated and paid to the relevant employees. Discussions are ongoing to determine the most practical method of doing so. 1.5 Chief Officer (Housing and Communities) Community Assets Transfer (October 2025) To take cognisance of the areas for improvement highlighted in the finding, the Chief Officer (Strategy and Engagement) should: (1) Ensure the guidance notes are finalised and issued, and that formal written policies are developed and implemented to guide officers in reviewing and assessing CAT applications. (2) Implement a conflict of interest declaration process for all officers involved in assessing and making decisions on CAT applications. Priority: Medium December 2025 March 2026 September 2026 A review of the documentation is underway, and early meetings have taken place with key Services to consider the best approach. A report was presented to the Community Asset Leadership Group in April 2026, to agree the process for review of CAT assessment and decision-making processes. This will now be taken forward. There has been an element of challenge in securing dates for review meetings within the original timescales which has led to a delay in the implementation of the recommendation. Such meetings are required to ensure that the approach is collaborative and meets the needs of the key Services. Those involved are keen to ensure that the review is robust. 1.6 Chief Officer (Legal, Democratic and Strategy) Information Governance (October 2025) The Chief Officer (Legal and Democratic), in conjunction with the Data Governance Board (DGB), should continue to review/enhance the information governance arrangements. This should include, but not be limited to, ensuring that: both the reviews of the Council’s Data Sharing agreements, Third Party Processing Agreements, Retention Plans and Retention Schedules; and development and update of information on the Council’s Information Asset Register are completed within a reasonable timescale. Priority: Medium January 2026 September 2026 Reviews of the Council’s Data Sharing, Third Party Processing and Retention Reviews are currently underway and are being progressed through the DGB and DMCG. Agreement has been reached with the DGB to change the completion dates for review to June 2026. A final review report will thereafter be presented at DGB. An improvement plan has been developed which identifies actions to be delivered with regards to the Information Asset Register. This will include refining the list, developing procedures and reviewing the role of the Information Asset Owner document. Delay in implementation is largely due to responsibility for managing the Information Asset Register only transferring to Legal and Democratic Services at the end of January 2026. Page 97 of 238
Page 98
Ref. Report Details Recommendation Original & revised timescales Management update 1.7 Chief Officer (Community Operations) Fleet Management (October 2025) The Chief Officer (Community Operations) should undertake a reconciliation or fact-finding exercise across all Council Services, to identify any additional vehicles acquired through informal means that may not yet be known to Fleet Management. The outcome of this exercise should be used to update Freeway records and ensure that all vehicles are brought under appropriate inspection, certification and maintenance regimes. Priority: High March 2026 August 2026 The Service have undertaken a review of all light fleet vehicles which included evaluating service patterns, identifying responsible officers for each vehicle and confirming the assigned drivers within each department. The vehicles have been added to the fleet system but due to staff shortages the system has not been updated to include the service and inspection intervals. 1.8 Chief Officer (Housing and Communities) Community Asset Transfers (October 2025) The Chief Officer (Strategy and Engagement) should update the Policy to clearly state whether and how the Leadership Group should be notified of CAT enquiries and that submission of a risk assessment or risk management plan is a mandatory requirement for all applications. The policy should also be updated to include clear eligibility requirements and the required essential criteria to support consistent CAT applications. Priority: Medium March 2026 July 2026 The Community Ownership and Management of Assets Policy is currently under review, specifically around the Common Good Assets and approach to standard securities and protections. A desktop review is underway to identify policy improvements and additions, and this will reflect audit recommendations. A report will be presented to Policy and Strategy Committee in June 2026. The delay in implementation was due to a wider review of the Policy being needed and this being presented to the Policy and Strategy Committee in June 2026. 1.9 Chief Officer (Housing and Communities) Community Asset Transfers (October 2025) The Chief Officer (Strategy and Engagement) should: (1) Update the log of enquiries and applications for CATs to provide more detailed information on the progress of each CAT application, including, but not limited to, the areas highlighted in the finding. (2) Consider introducing a process for monitoring the log on a regular basis to ensure that it is fully and promptly updated for all applications and chasing up any outstanding information. Priority: Medium March 2026 September 2026 A review of the documentation is underway, and early meetings have taken place with key Services to consider the best approach. A report was presented to the Community Asset Leadership Group in April 2026, to agree the process for review of CAT assessment, decision-making processes and associated logs and paperwork. This will now be taken forward. There has been an element of challenge in securing dates for review meetings within the original timescales which has led to a delay in the implementation of the recommendation. Such meetings are required to ensure that the approach is collaborative and meets the needs of the key Services. Those involved are keen to ensure that the review is robust. Page 98 of 238
Page 99
APPENDIX 2 – External Audit recommendations Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2022/23 – Annual Report 2.1 Land and Buildings Valuations The Council should continue to consider its approach to the valuation of land and buildings going forward and continue to ensure this is appropriate to assess whether asset values have moved materially in year and as at 31 March. The Council should work with its valuers to ensure valuations are in accordance with accounting code requirements. Appropriate scrutiny of the valuation work completed should be undertaken to ensure these are consistent with the Council’s records. The Council will continue to review its revaluation policy in line with code requirements and in conjunction with the professional valuers. This will take cognisance of the recommended actions from the Audit Scotland round table discussion including that ‘where the valuation exercise is carried out in- year but earlier than 31 March for reasons of expediency, any material changes in value in the interim should be adjusted for’. The Council will give full consideration to the practicalities of undertaking valuations at 31 March to ensure this will not impact the annual statutory requirement to submit the unaudited accounts by 30 June. The Council will also continue to assess whether there is a material difference between the carrying value in the fixed asset register and current value, and ensure the accounts are code compliant. Chief Officer (Finance) Chief Officer (Asset and Procurement) June 2024 June 2025 Ongoing Ongoing. Audit Scotland 2024-25 Annual Audit report has this item categorised as ‘Work in progress’ as the Council team has arrangements in collaboration with the external valuers to make an assessment of any material change in value between 1 February and 31 March to ensure that the carrying value of land & buildings is accurate and is not materially mis-stated. Recent history has shown there has not been any material movement to the carrying value. This will continue to be considered in light of potential future changes to accounting requirements around valuations of non-current assets. The valuation date used is under continual review in discussion with Council’s appointed valuation team, taking into consideration the practicalities and impacts of moving to a 31 March valuation date on the process and timely production of the unaudited accounts. Any material changes in value between the valuation date and 31 March will continue to be assessed and adjusted for, as appropriate. This practice has been acceptable by external auditors for the last two annual valuations. Page 99 of 238
Page 100
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2.2 Capital Processes The Council should review a number of its capital processes to ensure the value of assets is correctly held in the accounts, including: • The Council should review the revaluations provided by its valuers to ensure all assets have been included. • The Council should review its capital impairment process to ensure it is robust enough to identify potential indicators of impairment across all assets. • The Council should also consider how assets are held on its fixed asset register to ensure compliance with the componentisation requirements of the Code. The Council will: • review the revaluation practices to ensure all relevant assets are incorporated • review the process of identifying impairments to ensure all assets are considered • review and consider how assets are held on its fixed asset register to ensure full compliance with the componentisation aspects of the code Chief Officer (Finance) Chief Officer (Asset and Procurement) June 2024 June 2025 No longer relevant. While the first two points have been fully implemented (see narrative below), the third has been superseded by the Replacement of Assets recommendation made in the 2024/25 External Audit Annual Report. • Complete - reviews are undertaken of Fixed Asset Register (FAR) when selecting the representative sample of 20% across all asset categories to ensure that all assets that required to be incorporated (e.g. last valuation was 5 years ago etc) are included in the valuation programme. • Complete - a revised process has been established. A list of all assets within the FAR is provided to Chief Officers as part of the year-end exercise to ensure full consideration of assets within service. Any impairments are considered as part of the valuations process. 2.3 Significant Trading Operation The Council should review the trading operation to examine the cost effectiveness of the service provided to ensure that it continues to represent best value for the Council. As currently presented the Trading Account shows a rolling three-year deficit. However, this performance incorporates non-cash adjustments for Employee Benefits. Following the same accounting treatment as Council, these costs would be reversed back out resulting in a cumulative three-year surplus being reported, demonstrating continued value for money in the operation of the Council's Trading Account. The Council will seek to amend the presentation of the Trading Account note for the 2023/24 annual accounts to reflect the cash and non-cash elements of Trading Account operations. Chief Officer (Finance) June 2024 Complete. Reported to Panel in August 2024. Page 100 of 238
Page 101
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2022/23 – Best Value Thematic Report 2.4 Involvement of Members in Strategic Planning The Council should look to improve its existing processes for engaging elected members on the overall strategic planning process. As part of its scheduled annual review, we will refresh the narrative presently contained within the Strategic Policy Framework in respect of elected members’ strategic planning role and will thereafter emphasise through the CMT and Community Co-ordinator role the importance of engaging elected members on the strategic elements of the integrated Programme of Work Delivery Plan. Elected member role in strategic planning to also be clearly documented in the developing Programme of Work Governance Framework. Chief Officer (Business and Digital) September 2024 Complete. Reported to Panel in November 2024. 2.5 Engagement with Communities The Council should consider how it measures the level of engagement with communities and equalities groups. This will be aligned with actions arising from new communication strategy to be considered by council in March 2024. The strategy will also define what is meant by seldom-heard communities and groups. Chief Officer (Strategic Communication and Engagement) March 2024 Complete. Reported to Panel in August 2024. Page 101 of 238
Page 102
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2.6 Elected Members Training and Development Programme The Council should work with members to understand the reasons for the poor attendance to ensure its training and development programme is fit for purpose. The number of attendees at development sessions has been low, however there has been a slight increase in numbers attending recent events. The Talent and Organisational Development Team will continue to communicate regularly with Political Group Business Managers to encourage discussions around training, low attendance and engagement to be included on business meeting agendas. A survey will be sent to all Elected Members to help identify any restrictions and reason for low attendance. Development of the Elected Members area on LearnNL will continue, with all development session recordings and presentation slides being uploaded for members to access at any time. A monthly communication is sent to all Elected Members with direct links to new recorded sessions. Chief Officer (People Resources) November 2023 Complete. Reported to Panel in February 2024. 2023/24 – Annual Report 2.7 Replacement of Assets Management should establish a process to ensure assets replaced are appropriately removed from the asset register and accounted for as a disposal appropriately. In the absence of componentisation, it is unclear as to how we can put in place a process to remove the value of elements of assets which have been replaced. However, we will commit to a review of expectations around componentisation with a view to future discussions with External Audit. Chief Officer (Finance) June 2025 Complete. Reported to Panel in November 2025. Page 102 of 238
Page 103
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2.8 Statutory Override The Council should proactively work with CIPFA and the wider local government sector to arrive at appropriate solution for the implementation of accounting for infrastructure assets. The Council will work with CIPFA and the wider Local Government sector as appropriate to inform a decision on the accounting treatment for infrastructure assets. Chief Officer (Finance) Ongoing Not yet due. Position as at May 2026. CIPFA/LASAAC issued a consultation for the 2025/26 accounting code which includes the proposal to extending the statutory override within the UK. The statutory override has been extended until 2026/27 in Scotland and 208/29 in England and Wales. The Council will continue to work with CIPFA and the wider Local Government sector, as appropriate, to inform a decision on the accounting treatment for infrastructure assets over the longer term. 2.9 Reinforced Autoclave Aerated Concrete (RAAC) For those properties where RAAC was confirmed, the Council should determine a more accurate measure of the level, of impairment in line with the requirement of accounting standards. Further engagement with the Council’s valuers is required to determine an appropriate methodology, subject to full investigation being carried out to determine the extent of costs/remedial works required. Chief Officer (Finance) Chief Officer (Asset and Procurement) June 2025 Complete. Reported to Panel in November 2025. 2.10 Continuity and Security of IT Operations The Council should ensure that there is appropriate oversight of its continuity and security of IT operations and ensure the necessary assurances are obtained for externally hosted systems. Services will continue to own and manage their Business Continuity arrangements – with support and guidance from the Resilience Planning Team. Business Continuity testing framework has been implemented. It is recommended that Services test their plans annually and a corporate test will be arranged every 3 years. Depute Chief Executive November 2026 Complete. Reported to Panel in May 2025. Page 103 of 238
Page 104
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2.10 Continuity and Security of IT Operations The Council should ensure that there is appropriate oversight of its continuity and security of IT operations and ensure the necessary assurances are obtained for externally hosted systems. Oversight of IT security and IT Disaster Recovery will continue to be managed through established corporate working groups and Service Management Teams. Development of assurances on externally hosted systems will be monitored through the established arrangements of the Digital North Lanarkshire Programme of Work. Chief Officer (Business & Digital) April 2025 Ongoing Business and Digital Ongoing. A project to formally improve DR planning management practices has commenced, with phase one focusing on the Council’s in-house IT estate. Integration with business continuity planning management processes is under way. An exercise has been undertaken to identify the IT systems used to support the delivery of critical Council functions. The Council’s IT service management system is being evaluated to record DR- specific information. New DR templates for individual systems will be developed as part of this project. New software for Business Continuity Planning has been procured which will enable the Council to better manage arrangements. Roll out of the new software will be in a phased integration approach with services between June - December 2026. The exercise to obtain assurances on the reviewing and updating of existing DR plans is scheduled to complete at the end of March 2026. These arrangements, however, will be superseded by the improvements being made through the adoption new DR planning management processes. A new cyber incident response plan has been approved by the Data Governance Board. This updates incident management arrangements specified as part of DR planning arrangements. This will be supported by specific playbooks being developed over the course of 2026/27 which are based on the Scottish Government’s Cyber Incident Response Toolkit. The Council is currently onboarding the Scottish Government-sourced supply chain cyber assurance software provided by Supply25. Further refinements of supply chain assurance processes continue to take place as per the Council’s Programme of Work ambitions. Page 104 of 238
Page 105
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2.11 Public Performance Reporting The Council should improve its public performance reporting to provide its citizens and communities with a clear summary of performance. Following various programme of work reports to each committee cycle throughout the year, regular news articles and updates on delivery and performance are reported through the council’s website. With the Programme of Work to 2028 and its associated governance arrangements well established, work will be undertaken during 2025/26 to formally review and redevelop public performance reporting arrangements. Chief Officer (Strategic Communication and Engagement) March 2026 June 2026 Ongoing. The Council is in the process of creating a bespoke landing page on its website to publicly report service delivery performance. This will include an overview of the strategic alignment of The Plan for North Lanarkshire and other major strategies and updates on the agreed health check indicators. There will be links to performance outcomes for other high-level strategies. As part of this piece of work, the Council will include the reporting of progress against its 28 Health Check Indicators to ensure it is more accessible to the public. It is anticipated that this page will be live by 30 April 2026. Although the 28 health check indicators section will be complete by 30 June 2026. In addition, an annual update on performance over 2025/26 will be produced, which will also sit on this performance landing page. Page 105 of 238
Page 106
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2023/24 – Best Value Thematic Report 2.12 Acting on Staff Engagement Feedback As the council develops its staff engagement approach, it should ensure that as well as providing information to staff on council decisions, it also incorporates the views of staff and trade unions to support transparent decision making, and evidence how it is acting on findings from the Summer 2024 Roadshow sessions. There are several strands of work underway which will allow the council to progress this recommendation, including a refreshed staff survey and a review of trade union consultation arrangements. These will be taken forward along with the feedback from our 2024 Roadshow sessions to deliver an improved engagement approach. Chief Officer (People Resources) December 2025 May 2026 Refresh of staff survey – Complete The Councils revised staff survey based on the fair work first framework, has now been developed and launched across all services. The survey was piloted in three services initially, covering more than 800 staff, with a summary of the results reported to Policy & Strategy Committee in December 2025. A further revised staff survey was launched in March 2026 and will be open to all staff until August 2026, with regular updates to Chief Officers with completion levels in their Service. A full update will be presented to Committee in December 2026. Review of trade union consultation arrangements – Ongoing The revised Trade Union Recognition Agreement was approved at the Joint Consultative Committee for Local Government Employees (JCC) on 24 March 2026. It will now be submitted to the Finance and Resources Committee on 27 May 2026, in line with the updated constitutional requirements. Following approval, the agreement will be published, and the revised consultation, negotiation, and collective bargaining processes will take effect immediately. 2.13 Hybrid Working Policy The council should continue to monitor the impact of its hybrid working approach. It should continually assess the impact of increasing the number of office days, in terms of performance, staff wellbeing, and recruitment and retention. The council will continue to monitor the impact of its permanent Hybrid Working Scheme, through both manager and staff surveys, and in terms of performance, recruitment and retention in hybrid roles. Chief Officer (People Resources) January 2026 Complete. A staff survey was issued in October 2025 and the responses received were positive with staff content with the current Hybrid Working Scheme. Page 106 of 238
Page 107
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2.14 Temporary Workforce The council should include data reporting on its temporary workforce as part of published workforce data, and once available it should include data on agency workers. Work is underway to implement a more centralised approach to reporting on and managing temporary workforce resources, including agency workers. This work will be fully progressed to improve future reporting. Chief Officer (People Resources) December 2025 Complete. Data on temporary workforce is now included within the Workforce Dashboard which was presented to both CMT and Policy & Strategy Committee in December 2025. Data regarding agency workers (non-payroll) is now being gathered and reported on with oversight and governance through the Workforce Steering Group. This includes approval for agency spend. The Steering Group will also be provided with regular reports detailing consolidated spend on agency workers to ensure that this is being tracked. 2024/25 – Annual Report 2.15 Fixed Asset Register The Council should undertake a review of the fixed asset register to assess its capability to support accurate reporting. The Council fully reviews and reconciles all fixed asset transactions within the overall Fixed Asset Register to the financial ledger and financial statements to ensure accurate reporting. However, the Council will review the specific summary FAR extract report and reporting tool mechanics relating to depreciation charged to enhance reconciliations processes. Chief Officer (Finance and Technology) June 2026 Complete. The Council has reviewed and updated its specific summary Fixed Asset Register extract reports to now incorporate current year depreciation figures from the financial ledger which will enhance reconciliation processes of the FAR to the financial statements. 2.16 Common Good Assets The Council should continue to review requirements to disclose Common Good assets separately from council assets. The Council agrees to continue to review the disclosure requirements in respect of Common Good assets. Chief Officer (Finance and Technology) June 2026 Not yet due. Position as at May 2026. In preparing its 2025/26 draft accounts, the Council will ensure the value of common good assets held on the balance sheet are fully disclosed within the notes to the accounts. Page 107 of 238
Page 108
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2.17 Strategic Use of Reserves The Council should undertake a review of its reserves to determine what the planned or targeted level of reserves is appropriate. It should also look to define when certain earmarked reserves such as those earmarked for future budget pressures would be utilised as it is unclear whether these would be used to address short term pressures or to support investment to support long-term sustainability and improved outcomes. The Council will undertake a review of its reserves to determine a planned/target level appropriate and timing of use. Chief Officer (Finance and Technology) June 2026 Not yet due. Position as at May 2026. A revised Reserves Policy was approved by Policy and Strategy Committee on 4th December 2025. This revised policy includes targets for the level of reserves held in relation to both Contingency Fund and Future Budget Pressures. 2.18 Exit Packages There are opportunities for the council to enhance the standard of documentation of early retirement decisions. The council should also review its policies and procedures to ensure that exit packages of senior officers are subject to additional scrutiny. The Council intends to undertake a wider review of its democratic, committee and decision-making governance procedures with a report due to be presented to Policy and Strategy Committee on 25 September 2025. Phase 4 of this review includes a review and update of the Scheme of Administration and Delegation, which will now incorporate consideration of the governance around early release of senior staff. Chief Officer (Legal and Democratic) December 2026 Not yet due. Position as at May 2026. An update on the review of the Council’s democratic, committee, and decision-making governance procedures was presented to Policy and Strategy Committee on 19 March 2026. Phase 4 of the review includes a review and update of the Scheme of Administration and Delegation is still scheduled to be completed by December 2026. Page 108 of 238
Page 109
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2024/25 – Best Value Thematic Report 2.19 Benefits Realisation The Council should prioritise completion of its benefits realisation framework and incorporate reporting on both financial and non-financial benefits into regular monitoring reports. Given the financial challenges the council is facing there is a need to increasingly monitor and track cost and benefits of transformation projects. This will help inform officers and members of the extent to which transformation projects are delivering their intended benefits. Following the Framework to the One Service Board in March 2025, arrangements are being made to roll this out to all of the other Programme of Work Boards. Chief Officer (Strategy and Engagement) June 2026 Not yet due. Position as at May 2026. Work is ongoing to implement this recommendation in line with the agreed action. 2.20 Improving Public Reporting of Progress Against the 28 Health Check Indicators The council should ensure that the reporting of progress against its 28 Health Check Indicators is more accessible to the public. There is a dedicated section within the Programme of Work pages on the website for “Performance”, however this is under re development to ensure it captures, and provides access to, all relevant and already existing Council and Programme of Work performance in one place. This will include regular updates on the 28 health check indicators in a way that is meaningful to the reader. Chief Officer (Strategy and Engagement) June 2026 Not yet due. Position as at May 2026. The Council is in the process of creating a bespoke landing page on its website to publicly report service delivery performance. This will include an overview of the strategic alignment of The Plan for North Lanarkshire and other major strategies and updates on the agreed health check indicators. There will be links to performance outcomes for other high-level strategies. As part of this piece of work, the Council will include the reporting of progress against its 28 Health Check Indicators to ensure it is more accessible to the public. It is anticipated that this page will be live by 30 April 2026. Although the 28 health check indicators section will be complete by 30 June 2026. In addition, an annual update on performance over 2025/26 will be produced, which will also sit on this performance landing page. Page 109 of 238
Page 110
Page 110 of 238
Page 111
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref FS/ASP/Charter2026 Date 14/05/26 Internal Audit Charter From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk 1. Background 1.1 The Internal Audit Charter is a formal document that defines Internal Audit’s purpose, mandate, authority and responsibility. It establishes Internal Audit’s position within the Council, including detailing the nature of the Chief Officer’s (Audit and Risk) functional reporting relationship with senior management and the Panel, authorising access to records, personnel and physical properties relative to the performance of audit engagements, and defining the scope of Internal Audit activities. 1.2 As part of the requirements of the Global Internal Audit Standards, the Charter should be approved by the Panel on an annual basis. Executive Summary The purpose of this report is to seek approval for the Internal Audit Charter, which sets out the purpose, mandate, authority and principal responsibilities of the Council’s Internal Audit function. The content of the revised Internal Audit Charter has been agreed with the Chief Executive and the Chief Officer (Finance and Technology) (as the Council’s Section 95 officer). In line with the Global Internal Audit Standards, the Internal Audit Charter will be revised and updated annually and submitted to the Panel for consideration and approval. Recommendations The Panel is invited to approve the revised Internal Audit Charter at Appendix 1. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 7 Page 111 of 238
Page 112
2. Report 2.1 From 1 April 2025, Internal Audit teams across the UK are working to new mandatory professional standards, replacing the previous Public Sector Internal Audit Standards (PSIAS). These standards will be a combination of: • The Global Internal Audit Standards (GIAS). • The Application Note “Global Internal Audit Standards in the UK Public Sector”. • For Local Authorities, the Code of Practice on the Governance of Internal Audit. Together, these standards are referred to as the GIAS (UK Public Sector). 2.2 Although the GIAS are now effective, Internal Audit teams are not expected to demonstrate full compliance immediately but must work in accordance with the new standards to build up their conformance, and progress against this will be presented to future meetings of the Panel. 2.3 A key requirement of the GIAS (UK Public Sector) is the inclusion of a specific Internal Audit Mandate setting out the authority, roles and responsibilities of Internal Audit. This is included within the Charter document. 2.4 The revised Internal Audit Charter document is included at Appendix 1, and it is a requirement that it is approved annually by the Panel. The previous version was approved by the Panel in May 2025, and there have been no significant amendments arising from this annual review. 2.5 The content of the Internal Audit Charter has been agreed with the Chief Executive and the Chief Officer (Finance and Technology), as the Council’s Section 95 officer. 3. Measures of success 3.1 The Council is required to ensure that it has an effective internal audit function which conforms with the GIAS. Conformance is self-assessed on an annual basis, with an independent external quality assessment being undertaken at least every five years. 4. Supporting documentation 4.1 Appendix 1 – Internal Audit Charter Francis Scott Chief Officer (Audit and Risk) Page 112 of 238
Page 113
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☐ No ☒ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? . 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 113 of 238
Page 114
INTERNAL AUDIT CHARTER Page 114 of 238
Page 115
Document control Title Internal Audit Charter Owner Francis Scott, Chief Officer (Audit and Risk) Contact scottfr@northlan.gov.uk Governance Group Audit and Scrutiny Panel Author Francis Scott, Chief Officer (Audit and Risk) Contact scottfr@northlan.gov.uk Revision History Number Originator Date Review Commenced Revision description/record of change 1.0 Ken Adamson August 2021 Review and update to confirm consistent with PSIAS which had been updated 2.0 Paula Hendry July 2024 Update and refresh of document 3.0 Francis Scott March 2025 Updated to reflect the requirements of the Global Internal Audit Standards (UK Public Sector) 4.0 Francis Scott March 2026 Update document for annual approval Document Approvals Number Governance Group Date approval granted Date approval to be requested (if document still draft) 1.0 Audit and Scrutiny Panel February 2018 2.0 Audit and Scrutiny Panel September 2021 3.0 Audit and Scrutiny Panel August 2024 4.0 Audit and Scrutiny Panel May 2025 5.0 Audit and Scrutiny Panel 14 May 2026 Consultation Record (for most recent update) Status of document consulted upon N/A Stakeholders consulted/date Chief Executive, Chief Officer (Finance and Technology) – March 2026 Strategic Alignment The Internal Audit Charter is a formal document that defines Internal Audit’s purpose, mandate, authority and responsibility and establishes Internal Audit’s position within the Council. Next review date Review Date March 2027, then annually thereafter Page 115 of 238
Page 116
CONTENTS 1 Introduction 4 2 Purpose of Internal Audit 4 3 Internal Audit Mandate 5 4 Definitions 5 5 Independence, Positioning and Reporting Relationships 6 6 Internal Audit Authority and Oversight 7 7 Internal Audit Objectives and Responsibilities 8 8 Management Responsibilities 12 9 Scope and Types of Internal Audit Services 12 10 Internal Audit Plan 13 11 Resourcing 14 12 Prevention and Detection of Fraud and Corruption 15 13 Follow-up of Audit Recommendations 15 14 Quality Assurance and Improvement Programme 16 15 Annual Reporting and Overall Opinion 16 16 Communication and Reporting 17 17 Approval and Changes to the Internal Audit Mandate and Charter 18 18 Approvals 18 Page 116 of 238
Page 117
1. INTRODUCTION 1.1 The Local Authority Accounts (Scotland) Regulations 2014 require the Council to operate a professional and objective internal auditing service in accordance with recognised standards and practices. 1.2 The Global Internal Audit Standard (GIAS) came into effect in January 2025 and together with the Application Note: GIAS in the UK Public Sector, provides the framework for the practice of internal auditing in the UK Public Sector. For UK Local Authorities, the CIPFA Code of Practice on the Governance of Internal Audit in Local Government also provides guidance on the interpretation of the essential conditions of the GIAS. 1.3 The GIAS require the Chief Audit Executive (CAE) to implement and maintain an Internal Audit Charter, which sets out the Purpose of Internal Audit, the Internal Audit Mandate, and the position and scope of Internal Audit in the Council. The Internal Audit Charter is reviewed and approved annually by the Corporate Management Team and the Audit and Scrutiny Panel. 2. PURPOSE OF INTERNAL AUDIT 2.1 In line with the GIAS, the purpose of Internal Audit is to strengthen the Council’s ability to create, protect and sustain value by providing the Council and management with independent, risk-based and objective assurance, advice, insight and foresight. 2.2 Internal Audit enhances the Council’s successful achievement of its objectives, its decision making and oversight, and the governance, risk management and control processes. In doing so, Internal Audit contributes to the Council’s reputation and credibility with its stakeholder and its ability to serve the public interest. 2.3 The Council’s Internal Audit function is most effective when: • It is performed by competent professionals in conformance with the GIAS (UK Public Sector). • It is independently positioned with direct accountability to the Audit and Scrutiny Panel. • Internal Auditors are free from undue influence and committed to making objective assessments. 2.4 Internal Audit assurance is provided by delivering an annual programme of audit work that independently and objectively assesses the design and effectiveness of the controls established to manage the Council’s most significant risks. The scope of Internal Audit covers all Council activities. 2.5 The CAE will report annually to the Audit and Scrutiny Panel and the Corporate Management Team on the function’s conformance with the GIAS (UK Public Sector), which will be assessed through a Quality Assurance and Improvement Programme (QAIP). 2.6 In addition to their primary role, the CAE will also support the Council’s Chief Executive, the Section 95 Officer and the statutory Monitoring Officer in undertaking Page 117 of 238
Page 118
their duties. The CAE will also advise on the control implications of system or process changes, assist management in their duties to prevent and detect fraud and corruption, and aim to add value to the Council in all its undertakings. 3. INTERNAL AUDIT MANDATE 3.1 The authority for Internal Audit is derived from the Local Authority Accounts (Scotland) Regulations 2014. This mandate sets out the authority, roles and responsibilities, and empowers Internal Audit to provide the Audit and Scrutiny Panel and senior management with independent, risk-based, and objective assurance, advice, insight and foresight. 3.2 Internal Audit’s authority is created by its direct reporting relationship to the Audit and Scrutiny Panel. Such authority allows for unrestricted access to the Audit and Scrutiny Panel, and authorises Internal Audit to: • Have full and unrestricted access to all functions, data, records, information, physical property, and personnel pertinent to carrying out Internal Audit responsibilities. • Allocate resources, set frequencies, select subjects, determine scopes of work, apply techniques and issue communications to accomplish Internal Audit’s objectives. • Obtain assistance from the necessary personnel of the Council, and services from within or outside the Council to complete Internal Audit services. 3.3 Internal Auditors are accountable for confidentiality and safeguarding records and information. The GIAS set out the duty on Internal Auditors to be faithful custodians of the information they gather, sharing only in limited, defined and controlled ways, and describes the need for awareness of responsibilities in protecting information and demonstrating respect for the confidentiality, privacy and ownership of information. 3.4 In line with GIAS (UK Public Sector), Internal Auditors must also be aware of circumstances under which sharing or publication of information will be required. They must be aware of their Council’s policies and procedures for routine publication of certain information and where there are statutory obligations to share or publish information (for example, Freedom of Information requests). 4. DEFINITIONS 4.1 The following definitions have been adopted as set out in the GIAS 2024 Glossary: • Internal Audit – an independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation establish its objectives by bringing a systematic approach to evaluate and improve the effectiveness of risk management, control and governance processes. • Assurance Services – services through which Internal Auditors perform objective Page 118 of 238
Page 119
assessments to provide assurance. The nature and scope of assurance services are determined by Internal Audit. • Advisory Services – Services through which Internal Auditors provide advice to an organisation’s stakeholders without providing assurance or taking on management responsibilities. The nature and scope of advisory services are subject to agreement with relevant stakeholders. • Independence – Freedom from conditions that threaten the ability of the Internal Audit activity to carry out Internal Audit responsibilities in an unbiased manner. 4.2 In addition, key roles within the Council are fulfilled as follows: • Chief Audit Executive (CAE) is fulfilled by the Chief Officer (Audit and Risk). • Chief Financial Officer (CFO), is the designated statutory Section 95 Officer and is fulfilled by the Chief Officer (Finance and Technology). • Senior Management, is fulfilled by the Council’s Chief Executive, the Corporate Management Team (CMT) (for all-service approval) and the Business Management Team (BMT) (in relation to oversight, monitoring and implementation of outcomes of the annual plan). • The role of the Board, is undertaken by the Audit and Scrutiny Panel. 5. INDEPENDENCE, POSITION AND REPORTING RELATIONSHIPS 5.1 The GIAS state that the CAE should be positioned at a level in the Council that enables Internal Audit services and responsibilities to be performed without interference from management, thereby establishing the independence of the Internal Audit function. 5.2 As CAE, the Chief Officer (Audit and Risk) reports functionally to the Audit and Scrutiny Panel, administratively to the Chief Executive and is a member of the Corporate Management Team. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit and Scrutiny Panel, when necessary, without interference, and supports the Internal Auditors’ ability to maintain objectivity. 5.3 The CAE is required to confirm to the Audit and Scrutiny Panel, at least annually, the organisational independence of Internal Audit. If the governance structure does not support organisational independence, the CAE must document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. The CAE must disclose to the Audit and Scrutiny Panel any interference Internal Auditors encounter related to the scope, performance or communication of Internal Audit work and results. The disclosure will include communicating the implications of such interference on Internal Audit’s effectiveness and ability to fulfil its mandate. 5.4 To ensure that Internal Audit independence and objectivity is maintained for assurance services, Internal Audit will remain free from interference from anyone within the Council in relation to audit selection, scope, procedures, frequency, timing and report content. Page 119 of 238
Page 120
5.5 Where Internal Audit also has responsibility for non-audit activities, the GIAS require that appropriate arrangements are established to avoid conflicts of interest. The CAE has operational responsibility for the Council’s Risk Management team, and suitable mitigations are in place to ensure the independence and robustness of future audits of risk management. This involves the Audit Manager (who has no responsibility for risk management) managing the whole audit process without input from the CAE, with the CAE solely being the audit client. 5.6 Additionally, Internal Audit will not be permitted to audit any activities for which they have previously been responsible within a period of one year and will not engage in any other activity that may impair judgement or independence. 5.7 For advisory (including critical friend services), the Internal Audit role will be specifically restricted to providing guidance, views and opinions. To comply with independence requirements, Internal Audit will not be involved in any aspects of operational decisions subsequently taken by management. 6. INTERNAL AUDIT AUTHORITY AND OVERSIGHT 6.1 To establish, maintain and ensure that the Council’s Internal Audit function has sufficient authority to fulfil its duties, the Audit and Scrutiny Panel will approve: • The Internal Audit Charter, which includes the Internal Audit Mandate and scope and types of Internal Audit Services. • The risk-based annual Internal Audit plan. 6.2 The Internal Audit Charter will be updated on an annual basis to consider changes affecting the Council, such as changes in the type, severity and interdependencies of risk. Following this, the Internal Audit Charter will be submitted to the Audit and Scrutiny Panel for review and approval. 6.3 Additionally, the Audit and Scrutiny Panel will: • Consider with the CAE and senior management, the appropriate authority, role, responsibilities, scope and services (assurance and/or advisory) of the Internal Audit function. • Ensure the CAE has unrestricted access to, and communicates and interacts directly with, the Audit and Scrutiny Panel, including in private meetings without senior management present. • Consider, with the CAE and senior management, any other topics that should be included in the Internal Audit Charter. • Participate in discussions with the CAE and senior management about the ‘essential conditions’ described in the GIAS which establish the foundation that enables an effective Internal Audit function. • Review the Internal Audit function’s budget and other resources. • Provide input to senior management on the appointment and removal of the CAE, ensuring adequate competencies and qualifications, and conformance with the GIAS (UK Public Sector). Page 120 of 238
Page 121
• Review and provide input to senior management on the CAE’s performance. • Receive communications from the CAE about the Internal Audit function, including its performance relative to its plan. • Ensure that a Quality Assurance and Improvement Programme (QAIP) has been established and review the results annually. • Make appropriate inquiries of senior management and the CAE to determine whether scope or resource limitations are appropriate. 6.4 The Audit and Scrutiny Panel, CAE and senior management will ensure that Internal Audit at all times: • Has unrestricted access to all Council records, cash, property, assets and people, where necessary on demand and without prior notice. • Can obtain explanations as is required to satisfy the probity of any matter under consideration. • Can require the production of any records and other such property as is deemed necessary. 6.5 All senior officers must report to the CAE at the earliest opportunity all actual or perceived losses (cash, stock, equipment or data), all suspected or actual instances of theft, embezzlement, fraud, corruption or any other impropriety. This is set out in the Council’s Corporate Fraud Policy. Page 121 of 238
Page 122
7. INTERNAL AUDIT OBJECTIVES AND RESPONSIBILITIES 7.1 Ethics and Professionalism The CAE will ensure that Internal Auditors: • Conform with the GIAS (UK Public Sector) including the principles of Ethics and Professionalism – integrity, objectivity, competency, due professional care, confidentiality and the Seven Principles of Public Life. • Understand, respect, meet and contribute to the legitimate and ethical expectations of the Council, and can recognise conduct that is contrary to those expectations. • Encourage and promote an ethics-based culture in the Council. • Report organisational behaviour that is inconsistent with the Council’s ethical expectations, as described in applicable policies and procedures. 7.2 Objectivity The CAE will ensure that the Internal Audit function remains free from all conditions that threaten the ability of Internal Auditors to carry out their responsibilities in an unbiased manner, including matters of engagement, selection, scope, procedures, frequency, timing and communication. If the CAE determines that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties. Internal Auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality and do not subordinate their judgement on audit matters to others, either in fact or appearance. Internal Auditors have no direct operational responsibility or authority over any of the activities they review. Accordingly, Internal Auditors will not implement internal controls, develop procedures, install systems or engage in other activities that may impair their judgement, including: • Assessing specific operations for which they had responsibility in the previous year. • Performing operational duties for the Council or its affiliates. • Initiating or approving transactions external to the Internal Audit function. • Directing the activities of any employee that is not employed by the Internal Audit function, except to the extent that such employees have been appropriately assigned to Internal Audit teams or to assist Internal Auditors. Internal Auditors will: • Disclose impairments of independence or objectivity, in fact or appearance, to the CAE as soon as possible. • Exhibit professional objectivity in gathering, evaluating and communicating information. • Make balanced assessments of all available and relevant facts and circumstances. Page 122 of 238
Page 123
• Take necessary precautions to avoid conflicts of interest, bias and undue influence. The CAE will disclose impairments of independence or objectivity to the Audit and Scrutiny Panel at least annually. 7.3 Managing the Internal Audit Function The CAE has the responsibility to: • At least annually, develop a risk-based Internal Audit plan that considers the input of the Audit and Scrutiny Panel and senior management. • Discuss the plan with the Audit and Scrutiny Panel and senior management and submit the plan to the Audit and Scrutiny Panel for review and approval. • Communicate the impact of resource limitations on the Internal Audit plan to the Audit and Scrutiny Panel and senior management. • Review and adjust the Internal Audit plan as necessary in response to changes in the Council’s business, risks, operations, programmes, systems and controls. • Communicate with the Audit and Scrutiny Panel and senior management if there are significant interim changes to the plan. • Ensure Internal Audit engagements are performed, documented and communicated in accordance with the GIAS. • Follow up on audit findings to confirm the implementation of significant recommendations or action plans and communicate the results of Internal Audit services to the Audit and Scutiny Panel and senior management. • Ensure that the Internal Audit function collectively possesses or obtains the knowledge, skills and other competencies and qualifications needed to meet the requirements of the GIAS and fulfil the Internal Audit mandate. • Identify and consider trends and emerging issues that could impact the Council and communicate these to the Audit and Scrutiny Panel and senior management as appropriate. • Consider emerging trends and successful practices in internal auditing. • Establish and ensure adherence to methodologies designed to guide the Internal Audit function. • Ensure adherence to the Council’s relevant policies and procedures unless such policies and procedures conflict with the Internal Audit Charter or GIAS. Any such conflicts will be resolved or documented and communicated to the Audit and Scrutiny Panel and senior management. • Coordinate activities and consider relying upon the work of other internal and external providers of assurance and advisory services. If the CAE cannot achieve an appropriate level of coordination, the issue must be communicated to senior management and if necessary, escalated to the Audit and Scrutiny Panel. 7.4 Communication with the Audit and Scrutiny Panel and Senior Management The CAE will report to the Audit and Scrutiny Panel and senior management on: Page 123 of 238
Page 124
• The Internal Audit function’s mandate. • The Internal Audit plan and performance. • Internal Audit resources. • Significant revisions to the Internal Audit plan and resources. • Potential impairments to independence, including relevant disclosures as applicable. • Results from the QAIP, which include the Internal Audit function’s conformance with the GIAS (UK Public Sector) and action plans to address the Internal Audit function’s deficiencies and opportunities for improvement. • Significant risk exposures and control issues, including fraud risks, governance issues and other areas of focus for the Audit and Scrutiny Panel that could interfere with the achievement of the Council’s strategic objectives. • Outcomes of assurance and advisory services. • Management’s responses to risk that the Internal Audit function determines may be unacceptable, or acceptance of a risk that is beyond the Council’s risk appetite. Page 124 of 238
Page 125
8. MANAGEMENT RESPONSIBILITIES 8.1 Management will cooperate with Internal Audit on audits and provide access to records, systems and personnel as required within a reasonable timeframe following the request. 8.2 Assurance engagements will be subject to a written terms of reference and report. Advisory and agile engagements will be agreed in writing (for example, via email or written terms of reference) and a relevant output agreed (for example, full report, summary findings, focussed feedback or an action plan). 8.3 Draft reports will be shared with management for agreement as to the factual accuracy of draft findings raised and understanding of Internal Audit recommendations designed to address the control weaknesses identified. The opportunity to have a clearance meeting to discuss the findings will be offered to management when issuing the draft report. 8.4 It is management’s responsibility to agree to either: • Accept and fully implement all Internal Audit recommendations. • Address the risks identified by adopting an alternative approach to that recommended by Internal Audit. • Accept the risk associated with not implementing Internal Audit recommendations with supporting rationale. 8.5 When a draft report is delivered, management are required to agree to the recommendations in the action plan, including specifying officer responsibility and anticipated dates for implementation of the recommendations. Internal Audit will consider the timeliness of implementation dates according to the associated risk level identified. 8.6 Management is responsible for ensuring that the agreed management actions are implemented in full and effectively sustained. 8.7 The GIAS require the CAE to report to both senior management and the Audit and Scrutiny Panel, details of management’s response to risk that (based on the CAE’s judgement) may be unacceptable to the Council. Consequently, any Internal Audit findings where management has accepted the risk will be highlighted in the Internal Audit reports. 9. SCOPE AND TYPES OF INTERNAL AUDIT SERVICES 9.1 The scope of Internal Audit services covers the entire breadth of the Council’s services, and includes all functions, activities, assets, data, projects and personnel. 9.2 The scope of Internal Audit activities also encompasses, but is not limited to, objective examinations of evidence to provide independent assurance and advisory services to the Audit and Scrutiny Panel and management on the adequacy and effectiveness of governance, risk management and control processes for the Council. 9.3 The nature and scope of any advisory services will be agreed with the party requesting Page 125 of 238
Page 126
the service, provided that the Internal Audit function does not assume management responsibility. Opportunities for improving the efficiency of governance, risk management and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management. 9.4 Internal Audit engagements may include evaluating whether: • Risks relating to the achievement of the Council’s strategic objectives are appropriately identified and managed. • The actions of Council officers, Chief Officers, management, employees and contractors (or other relevant parties) comply with the Council’s policies and procedures, and applicable laws, regulations and governance standards. • The results of operations, projects and programmes are consistent with established goals and objectives. • Operations, projects and programmes are being carried out effectively, efficiently, ethically and equitably. • Established processes and systems enable compliance with the policies, procedures, laws and regulations that could significantly impact the Council. • Fraud risks are being managed effectively. • The integrity of information and the means used to identify, measure, analyse, classify and report such information is reliable. • Resources and assets are acquired economically, used efficiently and sustainably, and protected adequately. 10. INTERNAL AUDIT PLAN 10.1 The CAE will submit an annual Internal Audit Plan to the Audit and Scrutiny Panel for review and approval, which is designed to support the provision of an evidence based annual opinion. The Plan will be developed using a risk-based methodology. The CAE will seek input from a range of key stakeholders including Elected Members, the Chief Executive, senior management and the Corporate Risk Management team. 10.2 The nature of evolving risks makes it likely that the audit assignments included in the Internal Audit Plan may be subject to change. Consequently, the Internal Audit Plan will be subject to regular review by the CAE and any proposed changes to the approved plan (due to emerging risks, suspected fraudulent activity, or other issues or factors that result in changes to the planned Internal Audit activities) will be communicated to senior management and approved by the Audit and Scrutiny Panel. 10.3 The GIAS (UK Public Sector) requires the CAE to coordinate with internal and external assurance providers to consider relying on their work and minimise duplication of effort. 10.4 The GIAS (UK Public Sector) recognises that there are various relevant outside assurance providers whose authority flows from separate legal or regulatory sources beyond the control or influence by the CAE, and they may not have any ability to access the work of those assurance providers or gain insight into the scope and timing Page 126 of 238
Page 127
of their work. Under these circumstances, the CAE must consider whether it is possible or practical to coordinate. 10.5 Where adopted, a consistent process for the basis of reliance should be established as, where reliance is placed on the work of others, the CAE remains accountable and responsible for ensuring that there is adequate support for conclusion and opinions reached where reliance has been placed on work performed by other assurance providers. 10.6 Therefore, when dealing with an external party, Internal Audit will clearly define the respective roles, responsibilities and other expectations (including restrictions on distribution of results of the engagement and access to engagement records). 10.7 Internal Audit also reserves the right to raise findings on areas that have not been specifically included in the Internal Audit Plan where significant or systematic control gaps are evident. 11. RESOURCING 11.1 The GIAS (UK Public Sector) requires the CAE to effectively deploy and manage financial, human and technological resources to implement the Internal Audit Strategy and achieve the Internal Audit Plan and Mandate. The Application Note: GIAS in the UK Public Sector notes that funding processes for Internal Audit functions in the public sector vary and may prevent the CAE from being able to seek or obtain additional funding due to other funding priorities within the Council. This may impact the way in which the CAE uses resources. In line with the GIAS (UK Public Sector) the basis for conformance is: • Where there are constraints on resources, the CAE must develop a resource strategy which suggests practical approaches for consideration by the Audit and Scrutiny Panel. • The CAE must inform the Audit and Scrutiny Panel of the impact of insufficient resources and any options available to mitigate that impact. • Where there are no constraints, the CAE must set out what alternative approaches apply to the Internal Audit service and then seek to manage financial, human and IT resources within those constraints. 11.2 The CAE must inform the Audit and Scrutiny Panel of any resource management arrangements at the Council that may put at risk the ability of the Internal Audit function to fulfil its mandate. 11.3 The Council’s Internal Audit Plan will include the budgeted resource requirements needed to deliver the proposed audit engagements. It will also include a contingency to address unplanned work. Should circumstances arise during the year that suggest that available resource levels appear to be falling below the level required to deliver the Internal Audit Plan, the CAE will communicate the impact of resource limitations to senior management and the Audit and Scrutiny Panel. Page 127 of 238
Page 128
12. PREVENTION AND DETECTION OF FRAUD AND CORRUPTION 12.1 Council management is responsible for the prevention and detection of fraud or corruption. Internal Audit will assist management in the discharge of this responsibility. Audit procedures alone, even when performed with due professional care, cannot guarantee that fraud or corruption will be detected. Internal Audit will however exercise an appropriate level of professional scepticism during audit work and be alert to risks and exposure that could allow the opportunity for fraud or corruption to occur. 12.2 Managers, staff and elected members must always be alert to the risk of fraud, theft, bribery and corruption. Discovery of any suspected or actual fraud or irregularity that affects the Council should be reported immediately to the CAE and information on suspected or actual fraud may inform the annual audit opinion and the risk-based Internal Audit Plan. The CAE may then direct Internal Audit resources to investigate, or assist management investigations, into suspected or actual cases. 12.3 The Council has a zero-tolerance attitude and will not accept any level of fraud, bribery or corruption. The Council’s Corporate Fraud Policy sets out clear procedures for the reporting and investigation of actual or suspected fraud. 13. FOLLOW-UP OF AUDIT RECOMMENDATIONS 13.1 Management is responsible for implementing audit recommendations with agreed timescales. Management should inform Internal Audit of the progress of implementation and providing appropriate evidence to support closure of each recommendation. Internal Audit will review the evidence provided, and where necessary may undertake proportionate reperformance testing to confirm that the recommendations have been effectively implemented and sustained. 13.2 Internal Audit will report on the progress made by management in the implementation of recommendations to each regular meeting of the Audit and Scrutiny Panel. 13.3 Following initial agreement to implement a recommendation, management may subsequently inform Internal Audit that the action cannot be implemented as agreed and decide to accept the risk associated with the original audit finding. Management should inform Internal Audit of the justification for this decision and detail any mitigating actions and residual risks and monitor the ongoing risk through the appropriate risk management process (for example, corporate or service risk registers). Internal Audit will note the recommendation as ‘Closed – Management Accepts Risk’, and all risk acceptances will be reported to the Audit and Scrutiny Panel. Page 128 of 238
Page 129
14. QUALITY ASSURANCE AND IMPROVEMENT PROGRAMME (QAIP) 14.1 The CAE is responsible for ensuring the quality of audit work and that the Internal Audit function is continuously seeking improvement. The GIAS (UK Public Sector) defines quality as a combined measure of conformance with the GIAS and achievement of the Internal Audit function’s performance objectives. 14.2 The CAE will develop, implement and maintain a Quality Assurance and Performance Programme (QAIP) that covers all aspects of the Internal Audit function. The QAIP will include external and internal assessments of Internal Audit’s conformance with the GIAS (UK Public Sector), as well as performance measurement to assess Internal Audit’s progress towards achievement of its objectives and promotion of continuous improvement. If applicable, the assessment must include plans to address the function’s deficiencies and opportunities for improvement. 14.3 The CAE will report annually to the Audit and Scrutiny Panel and senior management on progress with the QAIP, including the results of internal assessments (ongoing monitoring and periodic self-assessments) and external assessments. 14.4 External assessments will be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the Council, whose qualifications must meet the requirements set out in the GIAS (UK Public Sector). The Council’s next external assessment is due to take place in late 2028. 14.5 Compliance with the CIPFA Code of Practice on the Governance of Internal Audit in Local Government must also be reflected in internal and external quality assessments. 15. ANNUAL REPORTING AND OVERALL OPINION 15.1 In line with the GIAS (UK Public Sector) the CAE must, at least annually: • Conclude on the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control (the Annual Internal Audit Opinion). • Include a statement on conformance with the GIAS (UK Public Sector) and the results of the QAIP. 15.2 The Internal Audit Annual Report and Opinion for the Council is based on the outcomes of the audits included in the Internal Audit Plan, progress in addressing any prior year significant issues, progress with the implementation of agreed audit actions by management, the result of any other Internal Audit activities that have identified control gaps exposing the Council to risk, and the professional judgement of the CAE. Page 129 of 238
Page 130
16. COMMUNICATION AND REPORTING 16.1 The CAE will report regularly to the Audit and Scrutiny Panel on the progress with, and the results of the work of Internal Audit, enabling review and scrutiny of the following areas as required by GIAS. REPORT FREQUENCY Internal Audit Charter Annually Internal Audit Strategy Annually Annual Internal Audit Plan Annually Internal Audit Progress Reports (including planned audits, other Internal Audit activity and recommendation follow-up reports) Each meeting of Audit and Scrutiny Panel Proposed material changes to the Annual Internal Audit Plan At least six-monthly Internal Audit Annual Report and Opinion, including: • Effectiveness of the governance, risk management and control framework. • Internal Audit independence. • Conformance with the GIAS (UK Public Sector) including ethics and professionalism requirements. Annually Internal Quality Assessments (including results of assessments, progress of collective action points and compliance with the CIPFA Code of Practice for the Governance of Internal Audit in the UK) Annually External Quality Assessments At least every five years 16.2 Progress against the work in the Internal Audit Plan, and the outputs of this work will also be reported to appropriate meetings of the BMT and CMT. Page 130 of 238
Page 131
17. APPROVAL AND CHANGES TO THE INTERNAL AUDIT MANDATE AND CHARTER 17.1 The Internal Audit Charter is subject to approval by the Chief Executive, Section 95 Officer and Audit and Scrutiny Panel on an annual basis. Approval is evidenced through the CMT and Audit and Scrutiny Panel meeting papers and minutes, and the approval in Section 18 below. 17.2 Circumstances may justify a discussion between the CAE, the Audit and Scrutiny Panel and senior management on the Internal Audit Mandate or other aspects of the Internal Audit Charter. Such circumstances may include but are not limited to: • A significant change in the GIAS. • A significant reorganisation within the Council. • Significant changes in the CAE, the Audit and Scrutiny Panel and/or senior management. • Significant changes to the Council’s strategies, objectives, risk profile or the environment in which the Council operates. • New laws or regulations that may affect the nature and/or scope of Internal Audit services. 18 APPROVALS Approved by the Audit and Scrutiny Panel Date: Audit & Scrutiny Panel (minutes available) 14 May 2026 Approved by the Chief Executive Date: 31 March 2026 Approved by the Chief Officer (Finance & Technology) (Section 95 Officer) Date: 31 March 2026 Approved by the Chief Officer (Audit and Risk) Date: 31 March 2026 Page 131 of 238
Page 132
Page 132 of 238
Page 133
North Lanarkshire Council Report Audit & Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref FS/ASP/Strategy2026 Date 14/05/26 Internal Audit Strategy From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Executive Summary The Internal Audit Strategy sets out the strategic objectives of the Council’s Internal Audit section and how these will be delivered. The purpose of this report is to seek endorsement of the attached Internal Audit Strategy for 2026-27 to 2028-29 (at Appendix 1) which has recently been reviewed and revised to conform with the Global Internal Audit Standards. In updating the Strategy, consideration has been given to how the Internal Audit team will operate going forward to best meet our audit objectives. Recommendations The Audit and Scrutiny Panel is invited to approve the revised Internal Audit Strategy at Appendix 1. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 8 Page 133 of 238
Page 134
1. Background 1.1 The Internal Audit Strategy is a formal document that defines Internal Audit’s strategic objectives and outlines how these will be achieved. 1.2 The most recent Internal Audit Strategy was approved by the Panel in November 2024. This report outlines the outcome of the most recent review and update of the Strategy for 2026-27 to 2028-29 to ensure compliance with the Global Internal Audit Standards. 2. Report 2.1 From 1 April 2025, Internal Audit teams across the UK are working to new mandatory professional standards, replacing the previous Public Sector Internal Audit Standards (PSIAS). These standards will be a combination of: • The Global Internal Audit Standards (GIAS). • The Application Note “Global Internal Audit Standards in the UK Public Sector”. • For Local Authorities, the Code of Practice on the Governance of Internal Audit. Together, these standards are referred to as the GIAS (UK Public Sector). 2.2 Although the GIAS are now effective, Internal Audit teams are not expected to demonstrate full compliance immediately but must work in accordance with the new standards to build up their conformance, and progress against this will be presented to future meetings of the Panel. 2.3 The GIAS (UK Public Sector) requires that the Chief Officer (Audit and Risk) develops and implements a strategy for the internal audit function that supports the strategic objectives and success of the organisation and aligns with the expectations of the Panel, senior management and other key stakeholders. The revised Internal Audit Strategy is included at Appendix 1. 2.4 Although the period covered by the Strategy is three years with the next version due for approval in 2029, the Chief Officer (Audit and Risk) may decide to undertake a more frequent review of the Strategy where there are changes in the Council’s strategic objectives or stakeholders’ expectations. All future revisions of the Strategy will be presented to the Audit and Scrutiny Panel for approval. 3. Measures of success 3.1 The Council is required to ensure that it has an effective internal audit function which conforms with the GIAS. Conformance is self-assessed on an annual basis, with an independent external quality assessment being undertaken at least every five years. 4. Supporting documentation 4.1 Appendix 1 – Internal Audit Strategy Francis Scott Chief Officer (Audit and Risk) Page 134 of 238
Page 135
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ Page 135 of 238
Page 136
5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☒ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 136 of 238
Page 137
INTERNAL AUDIT STRATEGY Page 137 of 238
Page 138
Internal Audit Strategy 2026-2029 2 Document control Title Internal Audit Strategy Owner Francis Scott, Chief Officer (Audit and Risk) Contact scottfr@northlan.gov.uk Governance Group Audit and Scrutiny Panel Author Francis Scott, Chief Officer (Audit and Risk) Contact scottfr@northlan.gov.uk Revision History Number Originator Date Review Commenced Revision description/record of change 1.0 Ken Adamson April 2018 Update and refresh of document Ken Adamson May 2019 Updated to recognise the ongoing transformation and change within the Council Paula Hendry August 2024 Update and refresh of document Francis Scott March 2026 Update and refresh of document Document Approvals Number Governance Group Date approval granted Date approval to be requested (if document still draft) 1.0 Audit and Governance Panel February 2015 2.0 Audit and Scrutiny Panel April 2018 3.0 Audit and Scrutiny Panel June 2019 4.0 Audit and Scrutiny Panel October 2024 5.0 Audit and Scrutiny Panel 14 May 2026 Consultation Record (for most recent update) Status of document consulted upon N/A Stakeholders consulted/date N/A Strategic Alignment The Internal Audit Strategy is a formal document that sets out Internal Audit’s strategic objectives and outlines how these will be delivered. Next review date Review Date April 2029, then every 3 years thereafter Page 138 of 238
Page 139
Internal Audit Strategy 2026-2029 3 1. OUR AUDIT ENVIRONMENT 1.1 This document sets out the Internal Audit Strategy for 2026-27 to 2028-29. This remains a very uncertain and challenging time for the Council and the local government sector generally and this strategy reflects how we intend to support the Council’s senior management and elected members in responding to the challenges facing the Council. 1.2 The Council’s strategic plan, The Plan for North Lanarkshire, and its associated Programme of Work sets out the Council’s strategic ambitions and those key activities designed to deliver against them and to address the challenges facing the people and communities of North Lanarkshire. 1.3 The Council continues to seek to achieve its ambitions against a backdrop of significant financial pressures, increasing demands for many key services and ever-changing expectations about how services will be delivered. These challenges mean that the Council will continue to face difficult decisions around financial sustainability and significant ongoing pressure to ensure that services are delivered in a cost-effective manner. The Council also needs to respond to the impacts on it and its communities of a range of Scottish and UK Government policies. Finally, external events (such as the ongoing cost of living crisis, the subdued performance of the UK and Scottish economies and the increase in geopolitical conflict) pose immediate challenges to which the Council and create considerable additional longer term risks and uncertainties. 1.4 Our audit environment continues to evolve at a rapid pace. The Programme of Work commits senior management to a challenging agenda which requires to be underpinned by sound leadership, effective financial management and robust governance arrangements. These arrangements will require to be supported by effective performance and risk management arrangements and an increased emphasis on project and programme management, service redesign, contract management, commissioning and contracting and maximising the benefits of new digital technology and transformation. 1.5 The Council, therefore, faces significant challenges balancing the day-to-day delivery of services with achieving its wider strategic priorities, while delivering efficiencies, driving service improvements and managing and delivering large scale transformational change. 1.6 In this context, the role of Internal Audit has never been more important. Our independence and commitment to high quality work will provide senior management and the Audit and Scrutiny Panel with appropriate assurance and insights into the use of public funds and on the adequacy and effectiveness of the Council’s corporate governance, risk management and internal control arrangements. 1.7 Our vision is to ensure our work adds real value to senior management and elected members as we focus on the issues of greatest priority and have the capacity and resources to support accountability and drive corporate and service improvement. Page 139 of 238
Page 140
Internal Audit Strategy 2026-2029 4 2. OUR STRATEGIC OBJECTIVES 2.1 In this environment, Internal Audit will need to continually reflect and evolve what it does and how it does it in order to ensure that it can continue to operate efficiently and effectively, demonstrate relevance and provide value to the Council. 2.2 Our strategic aim is to provide a high quality and customer focused internal audit service which is responsive, flexible and consistent with best professional practice. We aim to concentrate on key areas of significance, utilise resources in an efficient and effective manner, and for Internal Audit to be seen by stakeholders as a value- adding function, offering meaningful insights and making a dynamic and significant contribution to the Council. We will do this by: • Supporting elected members and senior management in undertaking their respective roles by providing an independent, objective assurance and consulting activity designed to add value and improve the effectiveness of the Council’s operations. • Delivering an internal audit service which fulfils the role and responsibilities given to it formally by the Council as laid out in the Internal Audit Charter approved by the Audit and Scrutiny Panel, the Chief Executive and the Council’s s95 officer. • Providing an internal audit service consistent with best professional practice in accordance with the Global Internal Audit Standards (GIAS), the associated Application Note: GIAS in the UK Public Sector and the CIPFA Code of Practice on the Governance of Internal Audit in Local Government. • Driving improvements in the Council’s risk management, internal control, governance and service delivery arrangements in order to make a positive contribution to the overall management and operation of the Council. • Focusing our resources on providing assurance on the management of the Council’s core governance processes, strategic priorities and key corporate risks. 2.3 Sections 3 to 12 of this document highlight how we aim to deliver these objectives. Page 140 of 238
Page 141
Internal Audit Strategy 2026-2029 5 3. INDEPENDENCE, INTEGRITY AND OBJECTIVITY 3.1 Although Internal Audit is a service within the Council, independence, integrity and objectivity are essential attributes for us, not only in complying with best professional practice, but in ensuring that we can contribute most effectively to the Council’s governance arrangements. We greatly value our independence, integrity and objectivity and are fully committed to demonstrating these attributes in all that we do. 4. PROVIDING ASSURANCE AND ADDING VALUE 4.1 We will deliver our strategy through a range of assurance outputs for senior management and the Audit and Scrutiny Panel focused on coverage of core corporate governance processes, key strategic priorities and programmes of work, corporate risks and key financial systems. 4.2 Our work will include in-depth assessments of how well key risks, priorities, projects and programmes of work are being managed by examining and reporting on the adequacy, efficiency and effectiveness of management arrangements. 4.3 We will add value by highlighting scope for improvements and providing those we audit with better insight into how they manage and use public money. 4.4 We will seek to contribute to the Council’s achievement of best value and value for money by providing independent assurance and highlighting where scope for improved efficiency may exist. 5. STAKEHOLDER ENGAGEMENT 5.1 Recognising the importance of pro-active stakeholder engagement, we will continue our approach in this area through our annual planning arrangements and the issue and discussion of terms of references for each audit assignment. Formal audit closure meetings will continue with Chief Officers, to discuss findings, issues and recommendations arising from each audit. By collaborating in this way, we will enhance audit effectiveness and foster a culture of transparency and trust. 5.2 We currently have a well-established planning methodology which includes consideration of a wide range of factors such as the relative scale, significance and complexity of systems; previous audit activity; horizon scanning; review of key corporate risks and the controls in place to mitigate these; and possible impact of any failures on the achievement of the Council’s objectives, priorities and ambitions. We will continue to evolve our approach to audit planning through improved stakeholder engagement and collaboration. 5.3 A formal process of consultation with all Chief Officers will be undertaken as preparation of the annual plan to consider potential areas of risk and uncertainty, service developments or areas of concern more fully. Page 141 of 238
Page 142
Internal Audit Strategy 2026-2029 6 6. SECURING INFLUENCE THROUGH CONSULTING AND AGILE AUDITING 6.1 We want Services to view Internal Audit as a valuable resource that can help them to achieve corporate and service objectives. We will seek, where appropriate and without compromising our primary function and independence, to become involved in relevant emerging issues or new systems or process development at an early stage and to provide advice and guidance to prevent problems or weaknesses from arising, and to ensure effective and efficient use of Council resources. 6.2 We will continue to explore auditing with agility as a mechanism to ensure that we are able to respond to the changing environment the Council is operating in and to enhance and protect organisational value. 7. SUPPORT FOR THE AUDIT AND SCRUTINY PANEL 7.1 We will develop an effective working relationship with the Convener of the Audit and Scrutiny Panel to provide support for their role and help them shape the work of the Panel. We will seek to work closely with the Audit and Scrutiny Panel members to help them discharge their duties and responsibilities and to respond more quickly to emerging issues. 7.2 We will support and provide assistance to the Audit and Scrutiny Panel to undertake self-assessment against the CIPFA Position Statement on Audit Committees in Local Government (2022) (and any future updates of this statement) and evaluate its effectiveness in discharging its duties. Aligned to this we will also facilitate the development and delivery of a training programme based on needs identified by the Panel. 8. CORPORATE FRAUD ARRANGEMENTS 8.1 We will work with management to continually improve the Council’s corporate fraud arrangements and to ensure that key fraud risks are identified and appropriately managed. This will include raising awareness of the Corporate Fraud Strategy. 8.2 We will respond appropriately, and in a timely manner, to reports or disclosures of alleged fraud brought to our attention by elected members, management and members of the public, in accordance with the Corporate Fraud Strategy. 9. MODERNISING THE INTERNAL AUDIT FUNCTION 9.1 We will continue to review the processes and methods used by the team to ensure that they meet best professional practice and embrace modern auditing techniques. 9.2 We will also explore the introduction of an audit management system, to improve workflow and provide a more efficient method of recording the work of the team and tracking progress with audit recommendations. Page 142 of 238
Page 143
Internal Audit Strategy 2026-2029 7 9.3 A key focus over the period of this Strategy will be to embed the use of data analytics and AI within our processes and outputs to enhance our performance, and inform and improve the quality of our findings and support to clients. 10. RESOURCE REQUIREMENTS 10.1 Internal Audit services are expected to be fully provided by an in-house team during the period covered by this strategy. The Chief Officer (Audit and Risk) (as head of the function) will continue to annually assess the level and capacity of internal audit resources and will report to the Audit and Scrutiny Panel on the adequacy, or otherwise, of the resources available to them. 10.2 The current structure for the audit team and will be reviewed and monitored on an ongoing basis to ensure it remains effective and provides the best possible level of service. 11. DEVELOPING OUR STAFF 11.1 The environment within which we and the Council are operating continues to change and this will need to be reflected in our staff. As well as investing in our core internal audit skills, we will continue to enhance the range of other skills and abilities within Internal Audit to allow us to focus our work on the key governance processes and strategic risks and priorities faced by the Council. 11.2 Investing in our staff is critical to our success. We want to embed a culture of continuous learning and development, whereby we help our staff to keep their skills at the desired level and develop the skills they need for the future. To achieve this, we will support our staff seeking further develop across relevant areas, including technological and methodological skills, digital skills, sector and cross-government knowledge and personal effectiveness skills. 11.3 The need for Internal Audit to adapt to the changing landscape while providing ‘business as usual’ assurance has been identified as a key development objective for all internal audit teams. With the increased focus on developing use of data analytics and AI, we will ensure our staff are equipped with the skills and knowledge to embrace these developments and embed them into the everyday work of the team. 12. DELIVERING HIGH PERFORMANCE 12.1 We will measure the success of this Strategy through our performance management framework (shown in Appendix 1). We will also continue to challenge ourselves to work as efficiently as possible by ensuring that our own use of resources is cost- effective and to seek continuous improvements in our audit methodologies and other internal processes. 12.2 Our most recent independent External Quality Assessment (EQA) of our compliance with the Public Sector Internal Audit Standards (PSIAS) was reported in April 2024 and Page 143 of 238
Page 144
Internal Audit Strategy 2026-2029 8 confirmed we were fully compliant with all aspects of the detailed requirements of PSIAS. Some recommendations for continuous improvement were made and we continue to work to fully address these. 12.3 The PSIAS were replaced by the Global Internal Audit Standards (GIAS) in 2025 and placed additional requirements on the internal audit team. The first EQA to check compliance with the GIAS is scheduled for 2028, and during the period of this Strategy we will work toward ensuring full compliance. 13. REVIEW OF THE STRATEGY 13.1 This Strategy document covers a three-year period until 2028-29 and is due for review in April 2029 by the Chief Officer (Audit and Risk). 13.2 The Chief Officer (Audit and Risk) may decide to undertake a more frequent review of the Strategy where there changes in the Council’s strategic objectives or stakeholders’ expectations. Factors that may lead to this include : • Significant Changes in the Council’s Plan for North Lanarkshire or the Programme of Work. • Changes to the maturity of the Council’s governance, risk management and control processes. • Changes to the Council’s policies and procedures, or laws and regulations which the Council is subject to. • Changes to the membership, role or function of the Audit and Scrutiny Panel. • Changes to the senior management of the Council, including the Chief Officer (Audit and Risk). • Results of the internal and external assessments of the internal audit function. 13.3 Future revisions of this Strategy will be presented to the Audit and Scrutiny Panel for approval. Page 144 of 238
Page 145
Internal Audit Strategy 2026-2029 9 APPENDIX 1 – INTERNAL AUDIT PERFORMANCE FRAMEWORK Category Measure Reported to Chief Executive/CMT A&SP (Quarterly) A&SP (Annual) 1. Delivery of Annual Plan Percentage completion of agreed plan X X 2. Targeting Percentage of key corporate risks and key financial systems over which assurance provided X X 3. Efficiency Cost of Internal Audit per £ million revenue budget X 4. Efficiency Percentage of productive hours delivered v Plan X 5. Delivery / recommendations Percentage implementation of agreed actions by implementation date (cumulative year to date) X X X 6. Delivery / other Number of significant investigations (fraud and irregularity) X X 7. Customer satisfaction results Scores from customer satisfaction questionnaires (cumulative year to date) X X X 8. Customer satisfaction results Scores from key stakeholders (CMT and A&SP) questionnaires (overall performance of the function) X X 9. Quality / standards Quality review outcomes – EQA and internal self-evaluation X X 10. Delivery of Annual Report Annual opinion and report prepared by 31 May annually X X 11. Targeting Approval by CMT and A&SP of Annual Internal Audit plan by 31 May annually X X Page 145 of 238
Page 146
Page 146 of 238
Page 147
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref FS/ASP/May26 Date 14/05/26 Internal Audit Annual Plan 2026-27 From: Francis Scott, Chief Officer (Audit and Risk) E-mail: scottfr@northlan.gov.uk Executive Summary The purpose of this report is to present the proposed Internal Audit Plan 2026-27 to members of the Audit and Scrutiny Panel for their consideration and approval. The report sets out the background and context within which the internal audit planning process is undertaken and provides a high-level overview of how it is proposed Internal Audit resources will be allocated in 2026-27. The Plan follows a well-established planning methodology which is designed to ensure internal audit coverage of key corporate risks, priorities and projects, governance arrangements and financial systems. Recommendations The Panel is invited to approve the proposed Internal Audit Plan for 2026-27 (at Appendix 1). 1. Background 1.1 The Global Internal Audit Standards in the UK Public Sector (GIAS (UK Public Sector)) require the Chief Officer (Audit and Risk) to submit an annual Internal Audit Plan to the Audit and Scrutiny Panel for consideration and approval. This report outlines the proposed Internal Audit Plan for North Lanarkshire Council for 2026-27. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 9 Page 147 of 238
Page 148
2. Report 2.1 Internal Audit is an assurance function whose work is designed to evaluate and improve the effectiveness of the Council’s risk management, control, and governance processes, with the aim of providing an independent and objective opinion on the control environment within the Council. The annual Internal Audit Plan is designed to assist the Chief Officer (Audit and Risk) in formulating that opinion. 2.2 From the 1 April 2025, Internal Audit work is undertaken in accordance with the GIAS (UK Public Sector). Conformance against these standards is self-assessed on an annual basis, with an independent external quality assessment being undertaken every five years. The first external assessment of the Internal Audit function under the GIAS (UK Public Sector) is scheduled for 2029. 2.3 The purpose, mandate, authority and principal responsibilities of the Council’s Internal Audit function are set out in the Internal Audit Charter, which is approved by the Panel, the Chief Executive and the Chief Officer (Finance and Technology), as the Council’s Section 95 Officer. 2.4 As detailed in the Internal Audit Strategy, Internal Audit aims to provide a high quality and customer-focused service, which is responsive and flexible, consistent with best professional practice, focuses on areas that matter, uses resources efficiently and effectively and is seen by stakeholders as adding value, providing valuable insights and making a positive contribution to the Council’s activities. 2.5 Although Internal Audit is a service within the Council, it is operationally independent which provides a core basis for its work. Internal Audit’s ongoing independence and objectivity also forms an important element in ensuring that it can effectively meet stakeholders’ needs and expectations. The post of Chief Officer (Audit and Risk) has sufficient status within the organisation (being a member of both the Business Management and Corporate Management Teams and reporting directly to the Chief Executive) to ensure the continuing independence of the Internal Audit service and its ability to act in accordance with best professional practice, free from undue interference by management and Elected Members The Wider Audit Environment 2.6 The Council’s strategic plan, The Plan for North Lanarkshire, and its associated Programme of Work to 2028, sets out the Council’s strategic ambitions and the key activities designed to deliver them, for the Council to address the challenges facing the people and communities of North Lanarkshire. 2.7 The Council continues to seek to achieve its ambitions against a backdrop of significant financial pressures, increasing demands for many key services and ever-changing expectations about how services will be delivered. The Council also needs to respond to the impacts on it and its communities of a range of Scottish and UK Government policies. There also continues to be significant change in governance structures and processes across the Council. Finally, external events, such as the ongoing cost-of- living crisis, the performance of the UK and Scottish economies and ongoing geopolitical destabilisation, pose immediate challenges to the Council and also create considerable additional longer-term risks and uncertainties. Planning Considerations 2.8 In developing the Internal Audit Plan, a wide range of factors were considered including the relative scale, significance and complexity of systems, previous experience of the relevant control environments, the potential financial, operational and reputational consequences of any significant failures in relevant internal controls and the possible impact of any failures on the achievement of the Council’s objectives, priorities and Page 148 of 238
Page 149
ambitions. 2.9 The Chief Officer (Audit and Risk) also held discussions with the Chief Officers responsible for each Council Service, to understand the challenges and risks faced in delivering their services, recent or proposed changes to the operating environment and any areas across the Council where they felt additional assurance would be required. Although senior management were consulted in the development of the plan, the Chief Officer (Audit and Risk) is solely responsible for determining the content of the Internal Audit Plan. 2.10 The Plan takes account of the key risks identified by senior management for inclusion on the Corporate Risk Register, and consideration is also taken of assurance available from other sources (such as external regulators and selected high-quality relevant internal sources). 2.11 Internal Audit will continue to work closely with Audit Scotland, the Council’s appointed external auditors, to ensure that all audit activities are properly coordinated to minimise any duplication of work. Resources 2.12 In 2026-27, approximately 1,130 audit days will be available to undertake the work included in the Internal Audit Plan. This allocation is based on a funded budget of 6.5 FTE members of Internal Audit staff and assumes the successful recruitment of the current vacant auditor position early in 2026/27. This budget is broadly consistent with the total audit days in the prior year. 2.13 I am satisfied that the resources available are adequate for the Internal Audit team to carry out its role effectively. Should there be a change to these resources during the year which will impact the completion of the plan, this will be discussed initially with the Convener and, if necessary, highlighted at the next Panel meeting. Internal Audit Reporting 2.14 The Internal Audit Plan shows the outputs which members and Chief Officers can expect from Internal Audit during 2026-27. Each Internal Audit report will be issued to the relevant Chief Officer and copied to the Chief Executive and Depute Chief Executive, highlighting any control weaknesses together with recommendations for improvement. Reports on the work of Internal Audit will also be presented regularly during the year to the Council’s Business and Corporate Management Teams. 2.15 Internal Audit will report progress against the plan during 2026-27 to the Audit and Scrutiny Panel. Progress reports will include high-level summary of all audit outputs in the plan, with full copies of all reports being made available to the Panel. Where the Chief Officer (Audit and Risk) considers there are significant matters arising from an audit report, these will be brought to the Panel’s attention in appropriate detail. 2.16 The main output of Internal Audit in 2026-27 will be the Internal Audit Annual Report prepared by the Chief Officer (Audit and Risk), which will include an opinion on the adequacy and effectiveness of the Council’s control environment. This report is used to inform the Council’s Annual Governance Statement which is incorporated into the Council’s financial statements. The Internal Audit Annual Report and opinion in relation to 2026-27 will be presented to the Panel in June 2027. Categories of Work in the 2026-27 Internal Audit Plan 2.17 The proposed Internal Audit Plan for 2025-26 is detailed at Appendix 1, with reference to entries on the Corporate Risk Register where appropriate. There are three major categories of work within the Annual Plan. These include: • Key Strategic/Corporate Risks – including work on procurement, resilience Page 149 of 238
Page 150
planning, climate change, cyber security, the housing repairs contract and project management. • Financial Management and Key Financial Systems – including work on treasury management, Council Tax, creditors and debt recovery. • Service/Operational/Programmes of Work – including developer contributions, kinship care payments, IT applications, IR35 arrangements, succession to tenancy, contract and supplier management, school excursions and education establishment visits. 2.18 The Internal Audit team will continue to support services to ensure management implement the recommendations arising from audit reports. Quarterly updates on management’s progress in implementing High and Medium priority recommendations will be provided to the Panel. 2.19 The Internal Audit team will also continue to contribute to a wide range of corporate working groups and Project Boards and be available to provide ad hoc advice and guidance to Council services and officers. The team will also provide an internal audit service to the North Lanarkshire Health and Social Care Integrated Joint Board. 2.20 The GIAS (UK Public Sector) requires that the Internal Audit Plan be kept under review to reflect any changing priorities and emerging risks relating to the Council’s business, operations, programmes, systems, and controls. We will therefore ensure the Plan remains relevant and reflects any changes to the inherent risks in the Council. The Audit and Scrutiny Panel will be advised of any material changes to the Internal Audit Plan during the year. 3. Measures of success 3.1 Provision of independent assurance in accordance with the GIAS (UK Public Sector). 3.2 Completion of the planned audit work within 2026-27, in order to provide an annual opinion on the Council’s control environment. 3.3 Positive assessment of the work of Internal Audit by key stakeholders including senior management and members of the Audit and Scrutiny Panel. 4. Supporting Documents Appendix 1 Proposed Internal Audit Plan 2026-27 Francis Scott Chief Officer (Audit and Risk) Page 150 of 238
Page 151
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi- Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ Internal Audit forms part of the control framework for the management of several corporate risks relating to corporate governance issues and these are documented in the relevant corporate risk ‘deep dive’ documents which are subject to periodic review by management. Operational risks for the Service itself are documented in the Service’s risk register and are regularly reviewed by the Chief Officer (Audit and Risk) and the service management team. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ Page 151 of 238
Page 152
5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 152 of 238
Page 153
APPENDIX 1 – Internal Audit Plan 2026-27 AUDIT CATEGORY AUDIT SERVICE AREA INDICATIVE DAYS LINK TO CORPORATE RISK REGISTER Key Strategic/ Corporate Risks Cyber Security Legal, Democratic & Strategy 25 Cyber Security Housing Contract Housing & Communities 30 Enterprise Contract Management Climate Change Assets & Procurement 25 Climate Change Resilience Planning Corporate Review 25 Failure of the Council’s Resilience Planning Procurement – Demolition Framework Housing & Communities 25 Procurement Risk Procurement – Education Non-Contract Spend Education 25 Procurement Risk Procurement – Below Threshold Spend Corporate Review 25 Procurement Risk Project Management (25/26) Corporate Review 25 Governance, Leadership & Decision Making Financial Management & Key Financial Systems Treasury Management Finance & Technology 20 Financial Sustainability Creditors – Purchase 2 Pay Finance & Technology Assets & Procurement 30 n/a Council Tax – Discounts and Exemptions Finance & Technology 25 Financial Sustainability Council Tax – Second Empty Homes Premium Finance & Technology 20 Financial Sustainability Debt Recovery (25/26) Finance & Technology 20 n/a Service/Operational/ Programmes of Work IR35 Arrangements Corporate Review 30 n/a Education Establishment Visits Education 25 Health & Safety Education Leavers Process Education 25 Human Resources Succession to Tenancy Housing & Communities 25 n/a Subject Access Requests Legal, Democratic & Strategy 20 Information Governance Freedom of Information process Legal, Democratic & Strategy 20 Information Governance Developer Contributions Place 30 n/a School Excursions Education 30 Improving Educational Outcomes Contract & Supplier Management Corporate Review 30 Delivery of Approved Programme of Work Page 153 of 238
Page 154
APPENDIX 1 – Internal Audit Plan 2026-27 AUDIT CATEGORY AUDIT SERVICE AREA INDICATIVE DAYS LINK TO CORPORATE RISK REGISTER Kinship Care Payments Education, Families, Justice & Integrated Practice 30 n/a Safeguarding Corporate Review 30 Public Protection IT Application Audit Corporate Review 30 ICT Operational Capacity Contribution to Good Governance Participation in Corporate Working Groups Corporate Review 40 Governance, Leadership & Decision Making Ad hoc advice to services Corporate Review 40 Governance, Leadership & Decision Making Fraud & Irregularity Corporate Fraud Awareness n/a 15 Serious Organised Crime, Fraud & Corruption National Fraud Initiative n/a 30 Serious Organised Crime, Fraud & Corruption Allowance for fraud and irregularity investigations n/a 70 Serious Organised Crime, Fraud & Corruption Audit Committee/ External Audit Facilitating work of Audit & Scrutiny Panel n/a 30 Governance, Leadership & Decision Making Follow-up of IA and EA recommendations n/a 50 n/a Follow-up - Audit Scotland/Accounts Commission National Reports n/a 10 n/a Liaison with External Audit n/a 5 n/a Provision of Internal Audit to Third Parties North Lanarkshire Integrated Joint Board (IJB) n/a 30 n/a Other GIAS (UK Public Sector) – implementation and self-assessment n/a 30 Governance, Leadership & Decision Making Recruitment n/a 10 n/a Flexible Capacity n/a 75 n/a Contingency n/a 50 n/a TOTAL INDICATIVE AUDIT DAYS 1,130 Page 154 of 238
Page 155
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/ASP/RMMay 26 Date 14/05/26 Risk Management Update From Francis Scott, Chief Officer (Audit and Risk) E-mail ScottFr@northlan.gov.uk Executive Summary This report seeks to support the Audit and Scrutiny Panel in the discharge of the aspect of its remit of monitoring the effective development and operation of risk management in the Council. The report provides an overview the Corporate Risk Register (CRR) and developments on Corporate Risks since the February update. The report also includes a high-level overview of Horizon Scanning activity, the product of which will be used to inform deliberation on entries on CRR and Service Risk Registers (SRR). The report concludes with a summary of other risk management developments and the key considerations of the Risk Management Corporate Working Group (RMCWG) within the reporting period. Recommendations The Panel is asked to consider the contents of the report and note: (1) the CRR for 2025-26 as detailed in Appendix 1. (2) the changes to corporate risk assessments in sections 2.2 – 2.6. (3) the Horizon Scanning information detailed in sections 2.7 – 2.8 and Appendix 2. (4) the summary of other risk management developments as noted is sections 2.9 – 2.12. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 10 Page 155 of 238
Page 156
1. Background 1.1 The Audit and Scrutiny Panel terms of reference include the remit to monitor the effective development and operation of risk management in the Council. This report supports the Panel in discharging that aspect of its remit by providing an overview of how certain requirements of the Risk Management Strategy have been delivered during the reporting period. 2. Report Corporate Risk Register 2025-26 2.1 The CRR for 2025-26 is included at Appendix 1. This version includes any changes captured since the update to Panel in February. Risks on the CRR are subject to ongoing monitoring and review, with higher scoring risks being subject to more frequent review. Management considers factors such as changes in the operating environment, the effectiveness of existing controls, the development of additional controls and progress of agreed actions to determine whether it would be appropriate to adjust the risk assessment in line with the Risk Management Strategy. Changes to Corporate Risk Assessments 2.2 There have been no changes to corporate risk assessments or scoring since the previous update to the Panel in February. During the reporting period, 19 risks were reviewed, with controls and actions updated to reflect current management activity. Additional controls were introduced where necessary to reflect enhanced risk mitigation. 2.3 The Power resilience (Black Start) risk has been retitled as National Power Outage and Recovery to more accurately reflect the risk context of a national power outage event and the Council’s response and recovery. 2.4 Due to recent leadership changes, ownership of the Digital Adoption has been updated, with the risk owner now being the chair of the Digital Culture, Leadership and Knowledge sub-group (currently the Chief Officer (Housing and Communities)). Ownership of other corporate risks is under review and communication of further changes will be provided at the next update to the panel. 2.5 In the February update, the newly developed Information Governance risk was incorrectly reported with a risk score of 20 due to a typing error. The risk score is and has always been 16, with a likelihood rating of 4 and impact rating of 4. This has been amended in the CRR table included in Appendix 1. Horizon Scanning 2.6 The Corporate Risk Team undertakes an annual Horizon Scanning exercise to inform deliberations on matters for inclusion on the CRR and SRRs. The main source of information used in this year’s exercise in the World Economic Forum’s Global Risks Report 2026. The report is underpinned by the Global Risks Perception Survey (GRPS) which captures views on the risk landscape from a range of stakeholders. Our analysis narrows in on the responses from government stakeholders with a focus on the risks perceived as having at the most impact over the short term (2 years) and over the long term (10 years). Page 156 of 238
Page 157
2.7 Based on the information in the report, Appendix 2 presents the top 10 risks as perceived by government respondents in the short and long term. These are listed alongside the results from all stakeholder groups for comparative purposes. This information will be shared with colleagues internally and will inform our next review of the CRR. Other Risk Management Developments 2.8 The RMCWG co-ordinates activities and resources to implement the Risk Management Strategy and promote good risk management practice throughout the Council. There were two sessions of the RMCWG since the last report to Panel, with the notable discussion points noted below: 2.9 The RMCWG has continued to support risk management training and awareness across the risk network. • Mandatory internal training, acting on feedback to develop service specific examples. All service examples have now been drafted and are at approval stage before being added to the online training system NL Learn. • Support has been provided to new Risk Facilitators by providing training on the corporate risk management information system Figtree. • Introduction of Horizon Scanning guidance materials to Risk Champions and Facilitators to assist with horizon scanning exercises at service level. 2.10 Following recent leadership and structure changes in the Strategy and Engagement function within the Chief Executive’s Service, some service level risks have been reassigned across the service risk registers. • Community Partnership risks have been moved from the Chief Executive’s service risk register to the Enterprise and Communities risk register, reported under Housing and Communities. • Strategy and Customer Experience risks have remained on the Chief Executive’s service risk register, but are now reported under Legal, Democratic and Strategy. 2.11 The revised 2026-29 Risk Management Strategy was approved at the Policy and Strategy Committee in March and has now been published. The new strategy includes changes in response to recent internal audit recommendations, and several key development initiatives which will further strengthen risk management arrangements. 3. Measures of success 3.1 The Corporate Risk Team will continue to report quarterly to BMT and the Audit and Scrutiny Panel, providing an overview of key developments in risk management and updating on progress in respect of planned improvements to the Council’s risk management arrangements. 3.2 The adequacy and effectiveness of the Council’s risk management arrangements will be subject to independent review by Internal Audit, who will report directly on the results of that work to the Audit and Scrutiny Panel. 3.3 Effective risk management arrangements assist the Council in achieving planned outcomes and/or help the Council mitigate the impacts of adverse events. Page 157 of 238
Page 158
4. Supporting documentation Appendix 1: Corporate Risk Register 2025-26 Appendix 2: Horizon Scanning Summary Francis Scott Chief Officer (Audit and Risk) Page 158 of 238
Page 159
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements will enable the Council to manage its risks more effectively, increasing the likelihood of the Council achieving its plans and ambitions by minimising or mitigating potential threats to planned outcomes. A robust risk management strategy lays out the framework and underpins all risk management activity across the organisation. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 159 of 238
Page 160
Appendix 1 – Corporate Risk Register 2025-26 CORPORATE RISKS (Operational) Likelihood Impact Rating Evaluation Change 1. Cyber Security 4 5 20 High No 2. Home support 4 5 20 High No 3. ICT operational capability 5 4 20 High No 4. Information governance 4 4 16 High No 5. Human resources (workforce planning) 4 4 16 High No 6. Public protection 4 4 16 High No 7. Health and Safety 5 3 15 Medium No 8. Business continuity planning 5 3 15 Medium No 9. Terrorism 3 5 15 Medium No 10. Information Security 4 3 12 Medium No 11. Governance, leadership and decision-making 3 4 12 Medium No 12. Procurement risk 3 4 12 Medium No 13. RAAC 3 4 12 Medium No 14. Failure of Council’s Resilience Planning Arrangements 2 5 10 Medium No 15. Enterprise Contract Management 2 5 10 Medium No 16. Serious organised crime, fraud and corruption 3 3 9 Medium No CORPORATE RISKS (Strategic) Likelihood Impact Rating Evaluation Change 17. Tackling poverty 5 4 20 High No 18. National Power Outage and Recovery 4 5 20 High Risk title updated 19. Digital adoption 4 4 16 High No 20. Improving educational outcomes 4 4 16 High No 21. Financial sustainability 3 5 15 Medium No 22. Digital and IT strategy 4 3 12 Medium No 23. Climate change 3 4 12 High No 24. Engagement and consultation 3 3 9 Medium No 25. Delivery of approved programme of work 2 4 8 Low No Page 160 of 238
Page 161
Appendix 2 – Horizon Scanning Summary (Source: World Economic Forum. The Global Risks Report 2026) * Numbers represent stakeholder ranking of likely impact (severity) of risks in the relevant timeframe, 1 = most severe Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) Geoeconomic confrontation (sanctions, tariffs, investment screening) Deployment of economic levers by global or regional powers to reshape economic interactions between nations, restricting goods, knowledge, services or technology with the intent of building self-sufficiency, constraining geopolitical rivals and/or consolidating spheres of influence. Includes, but is not limited to: currency measures; investment controls; sanctions; state aid and subsidies; and trade controls. 1 1 Misinformation and disinformation Persistent false information (deliberate or otherwise) widely spread through media networks, shifting public opinion in a significant way towards distrust in facts and authority. Includes, but is not limited to: false, imposter, manipulated and fabricated content. 2 5 2 4 Societal polarization Present or perceived ideological and cultural divisions within and across communities leading to declining social stability; gridlocks in decision-making; economic disruption; and increased political polarization. 3 9 3 9 State-based armed conflict (hot wars, proxy, civil wars, coups, terrorism, etc.) Bilateral or multilateral use of force between states and/or between a state and non-state actor(s), often with ideological, political or religious goals, manifesting hot war and/or organized, sustained violence. Includes, but is not limited to: hot wars; proxy wars; civil wars; guerilla warfare; terrorism; genocide; and assassinations. 4 5 Page 161 of 238
Page 162
Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) Cyber Insecurity The state of vulnerability in digital systems, either accidental or deliberate in nature, that can be exploited by cybercriminal or malicious actors. Includes, but is not limited to: cybercrime (including ransomware, data theft and online fraud) and exploitation by cybercriminals or malicious actors to interfere with government operations, conduct espionage and impact national security. 5 8 6 8 Inequality (wealth, income) Present or perceived substantive disparities in the distribution of assets, wealth or income within or between countries, resulting in material differences in related economic outcomes. Includes, but is not limited to: growing or persistent poverty; and economic polarization. 6 7 7 7 Extreme weather events (floods, heatwaves, etc.) Loss of human life, damage to ecosystems, destruction of property and/or financial loss due to extreme weather events. Includes, but is not limited to: land-based (e.g. wildfires), water- based (e.g. floods) and atmospheric and temperature-related (e.g. heatwaves) events, including those exacerbated by climate change 7 1 4 1 Pollution (air, soil, water, etc.) Introduction of harmful materials into the air, water and soil stemming from human activity, resulting in impacts to and loss of human life, financial loss and/or damage to ecosystems. Includes, but is not limited to: household and industrial activities; environmental accidents such as oil spills; and radioactive contamination. 8 9 10 Page 162 of 238
Page 163
Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) Economic Downturn (recession, stagnation) Near-zero or slow global growth lasting for several years or a global contraction (recession or depression). 9 Erosion of human rights and/or civic freedoms Loss of protections for rights inherent to all human beings, regardless of individual status, and/or the freedoms that underpin civic space. Includes, but is not limited to the right to: life and liberty; work and education; freedom of expression; peaceful assembly; non- discrimination based on gender, race ethnicity and other characteristics; and privacy. 10 8 Involuntary migration or displacement Forced movement or displacement across or within borders. Stemming from, but not limited to: persistent discrimination and persecution; lack of economic advancement opportunities; human-made disasters; natural disasters and extreme weather events, including the impacts of climate change; and internal or interstate conflict. 10 Biodiversity loss and ecosystem collapse Severe consequences for the environment, humankind and economic activity due to destruction of natural capital stemming from a result of species extinction or reduction, spanning both terrestrial and marine ecosystems. 2 2 Critical change to Earth systems Long-term, potentially irreversible and self-perpetuating changes to critical planetary systems, as a result of breaching a critical climatic or ecological threshold or “tipping point”, at a 3 3 Page 163 of 238
Page 164
Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) regional or global level. Includes, but is not limited to: sea level rise from collapsing ice sheets; carbon release from thawing permafrost; and disruption of ocean or atmospheric currents. Adverse outcomes of AI technologies Intended or unintended negative consequences of advances in AI and related technological capabilities (including generative AI) on individuals, businesses, ecosystems and/or economies. 4 5 Natural resource shortages (food, water) Supply shortages of food or water for human, industry or ecosystem use, manifesting as food and water insecurity at a local, regional or global level. Stemming from, but not limited to: human overexploitation and mismanagement of critical natural resources; climate change (including drought and desertification); and/or a lack of suitable infrastructure. 6 6 Concentration of strategic resources and technologies Concentration of strategically important resources (minerals, materials, technologies) among a small number of individuals, businesses or states that can control access and dictate discretionary pricing. 10 Page 164 of 238
Page 165
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/RMS/ASP/May26 Date 14/05/26 Risk Management Strategy From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Executive Summary The purpose of this report is to present the revised Risk Management Strategy to the Panel for noting, following approval of the document at the Policy and Strategy Committee in March 2026. The Council’s Risk Management Strategy sets out a clear direction for how the Council will develop its risk management arrangements to support achievement of the Council’s objectives and The Plan for North Lanarkshire. Effective risk management arrangements form an important element of good corporate governance and are designed to ensure that the Council operates systematic and logical processes for managing uncertainty within a comprehensive framework, ensuring that identified risks are managed consistently, effectively, efficiently and coherently across the Council. The Audit and Scrutiny Panel has oversight of the Council’s risk management arrangements and receives regular reports on risk management issues and changes to corporate and service risk registers. Recommendation It is recommended that the Audit and Scrutiny Panel note the revised Risk Management Strategy (at Appendix 1), and the continuing role of the Panel in providing elected member oversight of the Council’s risk management arrangements. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work All Programmes of Work Item 11 Page 165 of 238
Page 166
1. Background 1.1 The Council is responsible for the delivery of a wide range of public services and has set out a range of objectives, priorities and ambitions in The Plan for North Lanarkshire and the Programme of Work. The Council operates in an increasingly uncertain and complex environment and faces multiple challenges in delivering against its priorities. Effective risk management arrangements will ensure that the Council is more likely to achieve its goals and planned outcomes. 1.2 A risk can be anything that may impact on what the Council is trying to achieve. Risk management is about having formal arrangements and processes in place to identify what those uncertainties might be, to assess their potential consequences and to decide how best engage with them. 2. Report 2.1 The Risk Management Strategy is intended to ensure that the Council is risk aware, rather than risk averse, and that the management of risk is embedded in the Council’s policies, procedures, culture and practices. It is also designed to ensure that key decisions are taken with an understanding of risks and their effective control. The revised Risk Management Strategy is attached at Appendix 1. 2.2 The Strategy reflects the Council’s continuing risk management maturity by building on the work carried out since the previous version was approved in 2023. It outlines the approach to the identification, assessment and management of risk, and includes guidance for officers on their roles and responsibilities in relation to risk. The review of the Strategy has also been informed by informal benchmarking and consultation with other local authorities through the Association of Local Authority Risk Managers (ALARM) Scotland group, to ensure consistency of approach and to benefit from learning opportunities. 2.3 The revised Strategy includes three key development initiatives which will further strengthen the risk management arrangements. These initiatives will be implemented across the three-year term of the strategy and include: • Ever-Present Risks – it is recognised that there are some corporate risks that tend to be static in terms of assessment and have already implemented controls and actions. We will explore the development of a method of recording and treating these risks which has a focus on developing enhanced assurance in relation to the control environment and for ongoing management awareness and continuous improvement. • Opportunity Management – opportunities are areas of uncertainty that could have a positive impact on the achievement of objectives, and promoting the inclusion of opportunities within risk registers is recognised best practice. When opportunities are formally captured and managed within risk registers, it can support informed decision making on whether, and how, to maximise potential benefits. We will develop our risk register infrastructure to record opportunities alongside risks. • Risk Appetite – during the term of this strategy, we will explore emerging methodologies to further develop our application of risk appetite to enhance our overall risk management arrangements. Page 166 of 238
Page 167
2.4 Risk registers continue to represent a core element of the Council’s risk management processes at both corporate and service levels, and the Strategy includes guidance on how risk registers should be compiled, reviewed and challenged. 2.5 Elected member oversight of the Council’s risk management arrangements is undertaken by the Audit and Scrutiny Panel, who receive details on changes to the Corporate Risk Register, summaries of Service Risk Registers and updates on all relevant risk management developments, including progress with the key development initiatives noted above. 2.6 The Strategy document was approved by the Policy and Strategy Committee in March 2026. 3. Measures of success 3.1 Effective risk management arrangements increase the likelihood of the Council achieving its planned outcomes, priorities and ambitions. Internal Audit provides independent assurance to senior management and the Audit and Scrutiny Panel on the Council’s risk management arrangements. 4. Supporting Documentation Appendix 1 – Risk Management Strategy Francis Scott Chief Officer (Audit and Risk) Page 167 of 238
Page 168
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Page 168 of 238
Page 169
Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements will enable the Council to manage its risks more effectively, increasing the likelihood of the Council achieving its plans and ambitions by minimising or mitigating potential threats to planned outcomes. A robust Risk Management Strategy lays out the framework and underpins all risk management activity across the organisation. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 169 of 238
Page 170
RISK MANAGEMENT STRATEGY AN ENTERPRISE WIDE APPROACH TO RISK MANAGEMENT Page 170 of 238
Page 171
Document Control Title Risk Management Strategy 2026-2029 Owner Francis Scott, Chief Officer (Audit & Risk) Contact ScottFr@northlan.gov.uk Governance Group Risk Management Corporate Working Group / Corporate Management Team Author Donald Stone, Corporate Risk Manager Contact StoneD@northlan.gov.uk Revision History Number Originator Date Review Commenced Revision description / record of change Original strategy Ken Adamson 2012 - 1.0 Ken Adamson 2017 Review 2.0 Lauren Anthony 2019 Planned refresh 3.0 Lauren Anthony December 2022 Planned refresh 4.0 Donald Stone November 2025 Planned refresh Document approvals Number Governance Group Date approval granted Date approval to be requested (If document still draft) Original strategy Policy & Resources Committee September 2012 1.0 Policy & Resources Committee June 2018 2.0 Policy & Strategy Committee March 2020 3.0 Policy & Strategy Committee March 2023 4.0 Policy & Strategy Committee March 2026 Consultation Record (for most recent update) Status of document consulted upon Risk Management Strategy 2026-2029 Stakeholders consulted / date Risk Management Corporate Working Group, November 2025 - February 2026. BMT - February 2026. Strategic Alignment The risk management strategy outlines the council’s approach to the management of risk as part of robust corporate governance arrangements designed to enable and support the delivery of all council ambitions and priorities. Next review date Review date December 2028 Page 171 of 238
Page 172
3 Risk Management Strategy 2026 Contents Page Foreword 04 1 Introduction 05 2 Embedding Risk Management 06 3 Risk Management Application 07 4 Risk Registers 08 5 Risk Management Governance, Leadership and Accountabilities 09 6 The Three Lines Model 14 7 Risk Management Structure 16 8 Risk Management Methodology 17 9 Risk Reporting, Review and Challenge 18 10 Training and Development 20 11 Key Initiatives for Development in 2026-2029 21 12 Risk Management Guidance 22 - 39 Page 172 of 238
Page 173
4 Risk Management Strategy 2026 Foreword The Council is ambitious in its vision for North Lanarkshire. We are equally ambitious in developing our risk management arrangements in line with best practice to ensure they support delivery of our ambition for North Lanarkshire to be the place to Live, Learn, Work, Invest and Visit. The Council operates in a complex environment and faces multiple challenges in delivering against its priorities. Effective and efficient risk management arrangements will enable us to engage with uncertainty in a manner that directly supports delivery. This strategy sets out a clear direction for how we will develop our risk management arrangements to support quality public services and delivery of The Plan for North Lanarkshire. It provides our high level ambitions for enhancing risk management capability, building on our existing framework with three key initiatives. These are, exploring an alternative approach to engaging with “ever-present risks”, expanding our risk registers to record opportunities and developing our practices in relation to risk appetite. By implementing these initiatives and developing the operational guidance that supplements this strategy, we believe that effective risk management will continue to play a significant part in helping the Council deliver our ambitions and making North Lanarkshire the place to Live, Learn, Work, Invest and Visit. Councillor Jim Logue Leader North Lanarkshire Council Des Murray Chief Executive North Lanarkshire Council Page 173 of 238
Page 174
5 Risk Management Strategy 2026 1 Introduction 1.1 The purpose of this Strategy is to set out the Council’s vision for risk management and to provide a framework to ensure that across the organisation, we manage risk in a manner consistent with good practice. The Strategy provides a supporting framework to ensure the key elements of risk management processes are in place, enabling risks to be dealt with and managed at the appropriate level of the organisation. 1.2 This Strategy is designed to provide the information and guidance necessary to assist the organisation in identifying, evaluating, managing, and monitoring risks that might impact on achievement of the Council’s plans, ambitions and objectives and the delivery of quality public services. 1.3 The Strategy has been developed in accordance with the CIPFA/SOLACE local code of corporate governance, “Delivering Good Governance in Local Government” and the Audit Scotland, “Best Value tool kit: Risk Management” which recognises risk management as an integral part of good corporate governance, and in accordance with the International Risk Management Standard ISO31000 (2018) “Risk Management – Guidelines”. 1.4 Risk Management Standard: ISO 31000 describes risk management as ‘the coordinated activities to direct and control an organisation with regard to risk’. It covers the processes involved in identifying, assessing, and prioritising risks, assigning ownership, taking proportionate management action, and monitoring and reviewing progress. 1.5 We will continue to embed risk management in the way we do business, the way we make decisions, and in our relationships with partners and suppliers. 1.6 For the purposes of this Strategy, it is useful to refer to how “risk” is defined in the International Risk Management Standard. ISO 31000 defines risk as “the effect of uncertainty on objectives”. Risk can therefore be characterised as an event or set of events, which should it occur, will have an impact on the achievement of objectives. In other words, risk is “uncertainty that matters”. Risk is measured by the combination of the “likelihood” of the event occurring, and the “impact” on objectives if it does. The impact can be negative or positive. • Risks can either be threats or opportunities. Threats could have a potential negative effect on objectives, while opportunities could have a potential positive effect on objectives. During this strategy period, we are committed to evolving our approach to incorporate the identification and management of opportunities. • An Issue can be described as a live event or one that we know is certain to occur. An issue may have arisen because a risk has not been identified or has been identified but has not been managed effectively, or circumstances have changed to make a risk become an issue. Key Benefits of Effective Risk Management Enables and evidences robust and defensible, best value decision making, demonstrating openness, accountability and good governance. Decision making is risk aware rather than risk averse, enabling acceptance of certain risks to achieve particular goals. Enables better use and prioritisation of Council resources to achieve corporate priorities and enhance service delivery. Reduces adverse events, and enables effective and more proactive management of those that occur, reducing time spent “fire-fighting”. Enables identification and maximisation of opportunities and encourages innovation. Positively contributes to the Council’s reputation as an employer and service provider. Provides protection to all stakeholders. Page 174 of 238
Page 175
6 Risk Management Strategy 2026 2 Embedding Risk Management 2.1 Enterprise Risk Management is a holistic approach which recognises the link between uncertainty at different levels and areas of activity of the organisation, including those arising from relationships and contracts with other parties outwith the Council. This Strategy applies to the management of uncertainty across all areas of activity of the Council and incorporates both a “top down” and “bottom up” approach. 2.2 Embedding risk management within the Council will be achieved through application of the risk management process, and using risk registers as a management tool to record and manage uncertainties that matter. This process will be applied at all levels of the Council and in our dealings with third parties and partners. • Corporate Risks are those which could impact the Council in achieving its Priorities and objectives. These are strategic in nature and require corporate oversight or are cross- cutting across many services. The Corporate Risk Register (CRR) may also include significant Service level risks which have been escalated for attention at a strategic level. • Service/Team Risks are those risks which could impact upon a Service or Team in achieving its objectives. Team risks may be escalated to Service level as determined by application of the Risk Management process, with service risk registers reflecting an amalgamated position of risks from different teams within a service. Service risks which are deemed to be significant may be escalated to the CRR in accordance with the Risk Management process. • At a programme level the Programme Uncertainty Level Status Evaluation (PULSE) process seeks to identify elements of uncertainty in programme delivery, interdependencies between project activities within programmes of work and help to inform strategic decision making. More information on the PULSE process is available in programme governance board documentation and guidance. • The council’s Project Risk Management approach and methodology is designed to identify and manage those risks and issues which could threaten delivery of the project, or compromise cost, quality or timescales. Key responsibilities with regard to risk are specifically laid down in the Project Management framework. Page 175 of 238
Page 176
7 Risk Management Strategy 2026 3 Risk Management Application By applying the Risk Management process we develop a better understanding of uncertainties that matter. This informs our decisions on how best to engage with those uncertainties and enables a culture that is risk aware rather than risk averse. 3.1 Risk Management is a cyclical process and will be applied across the organisation in line with this framework. We operate in an increasingly Volatile, Uncertain, Complex and Ambiguous (VUCA) environment and so exploring uncertainty that could impact on the achievement of objectives is especially important. • When delivering transformational change; • At the beginning of and during the lifecycle of projects; • When entering into partnership working; • During budget setting exercises; • During service review and/or structure changes; • As part of procurement exercises; • Following political change; • As part of strategic and service planning and decision-making processes. • Following a change in the regulatory environment. For example, during the period of this strategy we will need to assess our control environment for Fraud Risk in line with the requirements of the Economic Crime and Corporate Transparency Act 2023 (ECCTA). Risk Management and the Strategic Planning Process 3.2 Our aspiration is for the Council’s risk management processes and activities to further develop the symbiotic relationship with Strategic and Service Planning activities, taking into account ‘The Plan for North Lanarkshire’ and associated Programmes of Work, as well as individual Service Plans. The following outlines how this will be achieved: • The ongoing consideration of horizon scanning activity and materials to identify areas of uncertainty that may affect the delivery of objectives at each level of the organisation. This will be supplemented by an annual exercise incorporating relevant risk survey publications as a means of exploring uncertainty in the external environment facing the Council, as well as consideration of other similar authorities’ corporate risk registers; • At a strategic level, the Corporate Management Team will regularly consider the CRR to ensure coverage and appropriate treatment of key areas of uncertainty; • Regular consideration of any Service risks proposed for escalation to the corporate register and any common themes arising from across service registers; • At service level, service risk register reports should be considered by Service Management Teams quarterly to ensure continued relevance to service activities, and be updated following service planning activity; • Service Register Reviews should also be informed by any changes to the CRR to ensure that any key corporate risks that may impact the service are adequately considered and reflected; • New risks can and should be added at any point where they are identified outwith the formal review process; • This approach ensures that the risk management process is both ‘top down’ and ‘bottom up’ Page 176 of 238
Page 177
8 Risk Management Strategy 2026 4 Risk Registers 4.1 Risk Registers are a management tool used to capture and maintain information on key areas of uncertainty that relate to achievement of objectives, in a consistent and comprehensive format. The detail contained in a risk register, including results of analysis and evaluation, will enable Teams, Services and ultimately the Corporate Management Team to compare evaluations, and assess and understand the organisation’s exposure to risk. Registers will be used for the ongoing management of uncertainty including capturing assessment details, relevant controls and actions, and be used to inform decision making. 4.2 Risk registers will be recorded and maintained in the Council’s Risk Management Information System. This system shall be configured to reflect the organisational structure of the Council, its Services and Teams. Visualisation of this information will provide ease of analysis and the production of Risk Management information to aid decision making. The detailed Risk Management guidance which supports this Strategy contains documentation to enable Teams to capture information on uncertainties for this purpose. 4.3 Enterprise Risk Management means that registers are maintained at each level of the organisation, with the flexibility to escalate and de-escalate risks between levels. 4.4 The levels are: Risk Register Levels Corporate Risk Register (CRR) Corporate risks are owned and overseen by the Corporate Management Team, and will be monitored and reviewed by relevant Corporate Working Groups and/or Service Management Teams on behalf of CMT. Progress on the management of these risks will be regularly reported to the Corporate Management Team and the Audit & Scrutiny Panel as required. The Corporate Register will be subject to ongoing review. Service Risk Registers Service Risk registers will be maintained by each Service and will be considered at least once every 3 months to ensure that they continue to reflect the risk profile of the service and that matters are proposed for escalation where appropriate. Service risk registers should be a reflection of Team registers, and include relevant partnership and project risks. Detailed project risks and issues will be recorded within project management documentation. Project Risk Registers Project Risks should be captured and managed within project risk registers (within Project Management documentation - not within the Risk Management Information System. We will explore opportunities for centralising Project Risk Registers during the term of this Strategy) in accordance with the Council’s Project Risk Management process which is embedded within the Council’s approved Project Management Framework. The project risk management process should be followed for all projects, as the risks that can hamper project success or cause adverse impacts on the council, can happen in any project irrespective of the size or spend of the project. Risks relating to the successful implementation of key projects of corporate significance will be considered for inclusion within the CRR. Following project implementation however, there may be residual operational risks which require to be included in the service risk register of the relevant service Page 177 of 238
Page 178
9 Risk Management Strategy 2026 5 Risk Management Governance, Leadership and Accountabilities Everyone in the Council has a role to play in managing risk and should be aware of their responsibilities. The following clearly sets out the roles and responsibilities for all, split by formalised groups and individuals. 5.1 Roles and responsibilities - Groups Policy and Strategy Committee • Approve the Risk Management Strategy and governance framework and ensure that there is an appropriate review cycle for the strategy; • Support management in the use of risk management as an integral part of business practice; • Consider periodic reports from the Audit and Scrutiny Panel on overall performance of the Council’s Risk Management and Governance arrangements. Audit and Scrutiny Panel • Review and provide independent assurance on the adequacy and effectiveness of the Council’s risk management framework; • Monitor the effective development and operation of risk management arrangements in the Council, including monitoring progress in addressing risk related issues reported to the Panel. Corporate Management Team (CMT) Managing the Risk Management Framework: • Provide high level commitment to supporting, promoting and encouraging good risk management practice throughout the organisation, including appropriate training, and developing a culture that seeks to be risk aware; • Ensure that responsibility for risk management is assigned to an appropriate Chief Officer to oversee corporate risk management arrangements on behalf of the Chief Executive; • Ensure that there is adequate risk management resource to support the organisation in delivering effective risk management; • Ensures that key strategic decisions are undertaken with an understanding of the risks and associated controls either already in place or planned; • Receive reports that enable monitoring of delivery of the Risk Management Strategy. Page 178 of 238
Page 179
10 Risk Management Strategy 2026 5.1 Roles and responsibilities - Groups Corporate Management Team (CMT) Managing Risk: Own and oversee the CRR, which captures significant Key Corporate Risks; • Ensure the identification, analysis, evaluation and ongoing management of Corporate Risks and that identification of these risks takes into consideration the changing internal and external context in which the Council operates; • Receive regular reports on how corporate risks are being managed; • Ensure that an appropriate member of the CMT is identified as the owner of corporate risks; • On an ongoing basis, monitor and review the CRR, including progress on planned control actions, and consider reports from the Risk Management Corporate Working Group on risk management matters; • Be proactive in identifying potential new and emerging uncertainty in relation to organisational objectives; • Ensure that lessons are learnt from incidents, inspections, audits and self-assessments, and that these are considered and reflected where appropriate in the Council’s risk registers. Business Management Team (BMT) • To consider risk management outputs going to Committee and/or the Audit and Scrutiny Panel ensuring that adequate assurance exists on the effective operation of the Council’s risk management arrangements. Service Management Teams • To regularly review and monitor service risk registers, ensuring that registers are complete and up to date, that new and emerging risks are identified assessed and managed effectively, and that service risk registers are used to support management discussions and inform decision-making. Specifically, this includes: • Ensuring that risk management is integrated into service management arrangements including planning, performance management, project management and change initiatives; • Actively promoting risk awareness, ensuring that existing and emerging risks are understood and managed effectively within Services; • Ensuring that appropriate Risk Management training is undertaken within each Service area; • Ensuring that there is adequate resource to support risk management within each Service; • Proactively identifying potential new and emerging uncertainty in relation to organisational objectives; • Ensuring that lessons are learnt from incidents, inspections, audits and self-assessments, and that these are considered and reflected where appropriate in risk registers; • Managing risks on a day-to-day basis, using Service and Project risk registers to monitor risks, plan services and support decision making, ensuring appropriate actions are undertaken on a timely basis; • Consider whether any high-level service risks may require escalation to the CRR. Risk Management Corporate Working Group (RMCWG) • Support CMT in the co-ordination of activities and resources across the Council in order to implement the Risk Management Strategy and embed and promote good risk management practice; • Promote the integration of risk management into Service management arrangements including planning, performance management, project management and change initiatives; • On an ongoing basis, identify and review training requirements to ensure good risk management knowledge and awareness across the Council; • Provide a forum for the sharing of good risk management practice, and share information in respect of existing, new and emerging risks; • Provide risk management support and advice across the organisation; • Be the mechanism for movement of risks between Corporate and Service Risk Registers through Service Risk Champions and the Corporate Risk Team. Page 179 of 238
Page 180
11 Risk Management Strategy 2026 5.1 Roles and responsibilities - Groups Service Risk Forums • Support Service Management Teams in the co-ordination of activities and resources across the Service in order to implement the Risk Management Strategy and embed and promote good risk management practice; • Provide regular reports to Service Management Teams on the management of Service risks and more generally on progress in embedding risk management arrangements within Services; • Promote the integration of risk management into Service management arrangements including planning, performance management, project management and change initiatives; • On an ongoing basis, identify and review training requirements to ensure good risk management knowledge and awareness across the Service; • Provide a forum for the sharing of good risk management practice, and share information in respect of existing, new and emerging risks; • Provide risk management support and advice across the Service; • Be the mechanism for movement of risks between Teams/Services and the Corporate Risk Register. Corporate Working Groups • On behalf of CMT, and in conjunction with Risk Leads, key Corporate Working Groups/Management Teams may be tasked with the assessment, monitoring and oversight of those risks on the CRR which link to the work of that group; • Review lessons learnt from any relevant incidents and losses, inspections, audits and self-assessments related to those risks, and reflect and consider the Council’s management arrangements in respect of them. 5.2 Roles and responsibilities - Individuals Elected Members Risk management is an important and integral part of the Council’s governance arrangements and is crucial to the achievement of outcomes. A significant aspect of an Elected Member’s role is in making decisions for the Council and the people of North Lanarkshire. The CIPFA/SOLACE Guidance “Delivering Good Governance in Local Government” makes explicit the decision-making role of Elected Members, and the need to ensure that risk information contributes to the decision making process. Elected Members need to be satisfied, when considering recommendations from officers, that risk has been considered and addressed as part of relevant decision-making activities. Members also need to ensure that the Council’s Risk Management Strategy and policies are suitably aligned with and support the delivery of objectives. In discharging these responsibilities Elected Members will: • Require Officers to develop and implement an effective framework for risk management, and to receive reports on the management of significant risks on a regular basis; • Expect Officers to ensure that committee reports describe significant risks associated with proposals, and detail how these risks will be managed; • Ensure that risk management arrangements are evaluated and monitored on a regular basis. Chief Executive Supported by the Chief Officer (Audit & Risk), the Chief Executive will: • Have overall responsibility for the Council’s Risk Management framework; • Champion risk management at senior level, ensuring that effective arrangements and resources are in place to manage risk; • Be accountable for the management of risk within the Chief Executive’s Service; • Nominate and support a Service Risk Champion, who will co-ordinate risk management activities within the Service; • Promote risk management awareness and practice within their area of responsibility; • Ensure that risk management is integrated into Service planning, performance management and project management arrangements, and is a regular item on the agenda of the Chief Executive’s SMT meetings; • Ensure risks are appropriately managed, monitored, reported, reviewed and escalated where necessary, and that appropriate action to manage risks is undertaken on a timely basis by control and/or action owners. Page 180 of 238
Page 181
12 Risk Management Strategy 2026 5.2 Roles and responsibilities - Individuals Depute Chief Executive • Accountable for the management of risk within the Services which they oversee as part of their role as Depute Chief Executive; • Nominate and support a Service Risk Champion(s), who will co-ordinate risk management activities within their Service(s); • Promote risk management awareness and practice within their area of responsibility; • Ensure that risk management is integrated into Service planning, performance management and project management arrangements, and is a regular item on the agenda of management meetings; • Ensure their risks are appropriately managed, monitored, reported, reviewed and escalated where necessary, and that appropriate action to manage risks is undertaken on a timely basis by control and/or action owners. Chief Officer (Audit & Risk) • Accountable to the Chief Executive, and has delegated responsibility for overseeing the Risk Management framework and the Council’s Risk Management function; • Provide regular reports to BMT/CMT and the Audit & Scrutiny Panel on the management of Corporate Risks and more generally on operational performance and progress in embedding the Council’s risk management arrangements. Corporate Risk Team (Corporate Risk Manager and Corporate Risk Officer) • Co-ordination and continuous development of risk management arrangements across the organisation liaising with CMT and Services on their implementation; • Provide support and guidance to the organisation on the management of risk; • Provide a range of risk management training opportunities to maintain role appropriate knowledge and awareness of risk management across the organisation; • Oversee the development, use and maintenance of the Risk Management Information System to support management of the Council’s risk registers; • Support CMT in the ongoing management of the CRR; • Monitor progress of Services in their implementation of the Risk Management Strategy; • Support the Chief Officer (Audit & Risk) in meeting risk reporting requirements; • Provide project risk management support where required for key projects including facilitation of risk workshops etc. Chief Officers • Accountable for the management of risk within their area of responsibility; • Responsible for identifying and analysing potential compliance risks for their service area including for example, Fraud risks, Health & Safety, Procurement etc; • Nominate and support a Risk Facilitator who will liaise with Service Risk Champions to co-ordinate risk management activity across their Teams; • Ensure that employees are familiar, as appropriate, with the Risk Management Strategy, guidance and controls relevant to their specific duties; • Ensure that training needs are assessed and met in respect of risk management skills. Managers • Promote risk management awareness and practice within their area of responsibility; • Ensure that risk management is integrated into Service planning, performance management and project management arrangements, and is a regular item on the agenda of management meetings; • Ensure their risks are appropriately managed, monitored, reported, reviewed and escalated where necessary, and that appropriate action to manage risks is undertaken on a timely basis by control and/or action owners. Risk Leads/Owners Those who through the risk management process are identified as having ownership of risks; • Responsible for leading on the ongoing management and monitoring of a particular risk assigned to them. Control Owners Those who through the risk management process, are identified as having ownership of either current or planned controls; • Responsible for ensuring that controls are managed and maintained, and that any changes to controls are notified to risk owners so that risks may be reviewed accordingly. Action Owners Those who through the risk management process, are identified as having ownership of those actions deemed necessary to either prevent or mitigate risks; • Responsible for ensuring that risk improvement actions assigned to them are progressed to satisfactory completion.Page 181 of 238
Page 182
13 Risk Management Strategy 2026 5.2 Roles and responsibilities - Individuals Risk Champions Acting as the point of contact for risk management matters within their Service, the Risk Champion will be responsible for providing assurance to the Depute Chief Executive / Chief Executive / Chief Officer on whether risk management arrangements are in place and operating effectively in accordance with the Risk Management Strategy. This will be achieved by: • Participating in the work of the Risk Management Corporate Working Group; • Promoting risk awareness across their Service, including contributing to identification of relevant training needs and monitoring of the completion of the same; • Directing risk management discussions at Management Team meetings, ensuring that “Risk” remains a regular item on the agenda; • Guiding, liaising with and supporting Risk Facilitators in Teams through the Service Risk Forum; • Supporting their Service Management Team in the ongoing development and management of Service Risk Registers; • Escalating risks to the Depute Chief Executive / Chief Executive / Chief Officer where immediate attention is required; • Providing project risk management support where required for key projects including facilitation of risk workshops etc; • Monitoring service compliance with the requirements of the Risk Management Strategy, process and procedures; • Engaging in appropriate risk management training to maintain skills and knowledge. Risk Facilitators Acting as the point of contact for risk matters within their Team, Risk Facilitators will be responsible for providing assurance to their Chief Officer on whether risk management arrangements are in place and operating effectively in accordance with the Risk Management Strategy. This will be achieved by: • Liaising with Risk Champions to maintain a co-ordinated approach including through the service risk forum; • Promoting risk awareness across their service area, including contributing to identification of relevant training needs and monitoring completion of the same; • Supporting their Management Teams in the ongoing development and management of Team Risk Registers; • Directing risk management discussions at meetings, ensuring that “Risk” remains a regular item on the agenda; • Escalating risk issues to the Chief Officer of the Service and Risk Champion where immediate attention is required; • Engaging in appropriate risk management training to maintain skills and knowledge. Project Managers/Project Boards etc Those involved in delivery of projects for the organisation have specific responsibilities for managing risks and issues within the Project Management process, which could threaten delivery of the project, or compromise cost, quality or timescales. Key responsibilities are specifically laid down in the Project Management framework. Internal Audit Provide independent review, and report on adequacy of the Council’s risk management arrangements and the effectiveness of implementation of the Risk Management Strategy at all levels. Insurance & Risk Team • Put in place and maintain appropriate risk financing arrangements to mitigate against unacceptable financial loss from insured risks, in line with the Council’s risk retention appetite; • Handle in-house all liability and property damage claims within parameters agreed with the Council’s insurance/risk partners; • Feedback to Services and the RMCWG statistics and loss information that will enable Services to target areas for improved risk control and loss prevention; • Assist Services on control of insurable risks and the improvement of operational risk controls. Employees • Maintain awareness of the Council’s Risk Management Strategy and processes through completing appropriate mandatory Risk Management training; • Be aware of and contribute to the effective identification and management of risks relevant to their own role and that of their team. Page 182 of 238
Page 183
14 Risk Management Strategy 2026 6 The Three Lines Model The Council operates on the principles of the ‘Three Lines’ model, an internationally recognised framework for managing risk, which provides structure and helps demonstrate key roles and responsibilities within that framework and how these link together to deliver robust risk management. 6.1 Figure 1 below illustrates how responsibility for managing risk gets proportionately less as we move down the three lines, with the most significant level of ownership and responsibility for managing risks resting within the first line at the top of the triangle, front line services. • 1st Line lies with front line/operational management who maintain ownership, responsibility, and accountability for directly identifying, assessing, controlling and mitigating risks. • 2nd Line includes those areas that provide the tools and framework to allow the first line to fulfil its role. Includes areas like the Corporate Risk Team, Legal, Democratic & Strategy, Finance & Technology, Health & Safety etc. Second line functions facilitate and monitor the implementation of effective risk management by the first line, including providing key risk controls, guidance, support, training and advice. • 3rd Line provides independent assurance and includes areas that check activities and arrangements at second and first lines to ensure they are fit for purpose and are being complied with. For example, the Internal Audit function provides assurance to Audit & Scrutiny Panel and senior management about how well the first and second lines are identifying and managing risks, and around implementation and effectiveness of risk controls. Page 183 of 238
Page 184
15 Risk Management Strategy 2026 North Lanarkshire Council’s Three Lines Model Services Operational Procedures, Managing Risk, Control Activity, Projects, Self-Evaluation Oversight/Enabling/Control Functions Corporate Risk Team, Legal, Democratic & Strategy, Finance & Technology, Health & Safety etc (Framework, Guide, Consult, Train, Advise, Support) Assurance Providers Internal Audit (Monitor Compliance, Provide Independent Challenge and Assurance) 3 2 1 3rd Line 2nd Line 1st Line Figure 1 - Three lines model Page 184 of 238
Page 185
16 Risk Management Strategy 2026 7 Risk Management Structure The following diagram shows the structure of risk management activity in North Lanarkshire Council. Primary responsibility for co-ordination of risk management activities lies with the Corporate Risk Team through the Risk Management Corporate Working Group. Service Risk Champions will be responsible for facilitating and supporting the implementation of risk management within their service activities through their Service risk forums, and reporting progress and risk management information to their own Service Management Teams. Corporate Management Team Chief Officer (Audit & Risk) Corporate Risk Team Service risk forums (1/4ly following RMCWG) Service Management Teams Policy and Strategy Committee RMCWG (8 weekly) Service Committees Audit and Scrutiny Panel Risk Champions Operational Management Employees Figure 2 - Risk Management Structure Page 185 of 238
Page 186
17 Risk Management Strategy 2026 8 Risk Management Methodology Scope, Context, Criteria Com m unication and Consultation Risk Evaluation Risk Analysis Risk Identification Risk Assessment Risk Treatment M onitoring and Review Recording and Reporting Figure 3 - Risk Management Process 8.1 Effective Risk Management is about developing the right culture, processes and structures in our organisation and directing them in a co-ordinated way to manage risk, facilitate continuous improvement and enhance service delivery. 8.2 Risk Management is about being proactive in understanding uncertainties that can impact on achievement of our goals. It is a continually evolving process which helps us to learn and build upon good practice, ensuring that we manage uncertainty in a proactive way, contributing to successful delivery of services and Corporate Priorities. 8.3 Embedding Risk Management throughout the organisation will be achieved by the consistent application of the risk management process shown in Figure 3, across all Services and business activities. This will enable the organisation to manage and monitor risks at the most appropriate level, ensuring that the right oversight is in place, and that we respond to risk in a consistent and proportionate manner. 8.4 Risk management should not be done in isolation, but requires to be considered by Services, Teams, Programme and Project Teams as a routine part of Corporate, Service, Operational, Programme and Project planning. This means that assessing risk becomes an integral part of our working practices as well as a feature of how we approach development of new policies or business change initiatives. 8.5 A methodology for managing risk across the organisation has been established and will be consistently applied at all levels. The approach has been developed in accordance with the International Risk Management Standard ISO31000:2018 “Risk Management – Guidelines” as illustrated in Figure 3. Full details of the Risk Management methodology to be followed are contained in the Risk Management guidance that accompanies this strategy. Page 186 of 238
Page 187
18 Risk Management Strategy 2026 9 Risk Reporting, Review & Challenge 9.1 Different levels of the organisation require different information from the Risk Management process. For example, CMT should know about the most significant Corporate Risks facing the Council and how these risks are being managed. Service Management Teams require to be aware of the risks which fall into their area of responsibility which may impact on the services provided by them, and on their ability to achieve their objectives. Teams need to be aware of and take appropriate action on the risks that face the Team. 9.2 Risks identified and their control status should be formally reported to the appropriate level of management and stakeholders on a regular and timely basis to ensure that they receive the appropriate level of management attention. 9.3 To allow for the effective monitoring of risks, a Risk Owner should be identified for each risk. This person is responsible for ensuring that plans are in place for reviewing and reporting progress on the management of that risk and associated actions. The Risk Owner will be a named individual. 9.4 The CRR will be presented to the Audit and Scrutiny Panel on a quarterly basis. This will reflect exceptional changes to the register that occur in the reporting period. For example, new additions, deletion or changes to the assessment. 9.5 Risk Management reports will also be presented to Service Management Teams on a quarterly basis to enable them to monitor and review key service risks, as well as have oversight of service risk management arrangements. 9.6 Oversight of risk registers is an essential part of the risk management process, to ensure that registers reflect the organisation’s risk profile. It will identify any anomalies for example where risk or control review is due. Having the correct oversight and challenge will mean that we maximise the benefit of the risk register as a management tool and have accurate risk management information to inform decision making. 9.7 As part of risk register monitoring, management should consider the effectiveness of risk controls and actions and how these are reflected in risk ratings. Management should also consider any new risks which have emerged and reflect on any risks closed in the reporting period. 9.8 Where a risk is reviewed by the Service and felt to have either corporate relevance or its significance has escalated to be of corporate interest, this should be raised through the Risk Management Corporate Working Group or with the Business Management Team for inclusion as a Corporate Risk. 9.9 The Council’s Internal Audit Team will undertake regular audits of the Council’s risk management arrangements as part of the annual Internal Audit plan. The Council’s external auditors may also periodically review the risk management processes put in place by the Council as part of their review of the Council’s wider corporate governance arrangements. Page 187 of 238
Page 188
19 Risk Management Strategy 2026 Risk Management Monitoring 9.10 Risk Management activity across services will be monitored through the RMCWG in order to provide targeted support to enable services to maximise the benefit of risk management as a management tool. An agreed monitoring approach will be used by the corporate risk team and members of the risk network on a 6 monthly basis to identify areas for improvement. A summary of the results will be utilised to provide high level management information and inform reporting to SMTs, BMT, CMT and Audit & Scrutiny Panel. Risk Tolerance 9.11 North Lanarkshire Council seeks to be risk aware not risk averse, which means that we will accept a tolerable level of risk that provides a balanced organisational risk profile. The expected responses to the varying levels of risk are detailed in the accompanying risk guidance. It is recognised that in certain circumstances there will be certain risks which the council has little direct control or influence or where incidents or errors may occur despite robust controls being in place. In such circumstances the risk management process should ensure appropriate governance and oversight of these risks through frequent monitoring and review of the risk and control arrangements, to provide assurance over the management of these high risks. More detail surrounding risk tolerance and expected responses is contained within the Risk Management Guidance which accompanies this strategy. 9.12 Risk appetite is an expression of how much uncertainty an organisation is willing to invite into its processes in pursuit of objectives. Having an established risk appetite framework can encourage consistency when making risk informed decisions. North Lanarkshire Council will seek to develop its approach to risk appetite throughout the period of this Strategy. Page 188 of 238
Page 189
20 Risk Management Strategy 2026 10 Training and Development 10.1 We need our workforce to have an awareness of Enterprise Risk Management. We will ensure that colleagues with a more detailed role in facilitating the risk management process have the skills and competence appropriate to their role. 10.2 The Risk Management Corporate Working Group will continuously identify and review risk management training needs across the organisation. The Corporate Risk Team will provide training and learning opportunities for Elected Members and Officers, which are appropriate and proportionate to roles and responsibilities. 10.3 Risk Management Training and Awareness materials are referenced within the Risk Management guidance which accompanies this strategy. This may range from those who require a general awareness, to Elected Members and Senior Managers with more strategic decision-making responsibilities, and those employees who have a more specific role in the Risk Management process. Page 189 of 238
Page 190
21 Risk Management Strategy 2026 11 Key Initiatives for Development in 2026-2029 Figure 4 Ever Present Risk 11.1 It is recognised that there are some Corporate Risks that due to their ever present nature, will always command the attention of Senior Management. Where captured on risk registers these ubiquitous risks tend to be static in terms of assessment and have a series of implemented controls; controls which are in the main managed by second line functions and must have cross organisational awareness and adherence in order to remain effective. The key aspects of the control environment of these risks often feature in Internal Audit assignments. Throughout the term of this Strategy, we will explore the development of a method of recording and treating these risks which has a focus on developing enhanced assurance in relation to the control environment of these risks and for ongoing management awareness and continuous improvement. Opportunity Management 11.2 Recognised best practice and publications promote the practice of capturing opportunities within risk registers. Opportunities are areas of uncertainty that could have a positive impact on the achievement of objectives. When opportunities are formally captured and managed within risk registers, it can support informed decision making on whether, and how, to maximise their potential benefits. We will develop our risk register infrastructure to record opportunities alongside risks. Risk Appetite 11.3 In preparing this iteration of our strategy we have recorded explicit reference to the definitions of risk tolerance and risk appetite in line with industry standard. During the term of this strategy we will explore emerging methodologies and develop our application of risk appetite to enhance our overall risk management arrangements. The timelines for delivering these initiatives are illustrated in Figure 4. Page 190 of 238
Page 191
22 Risk Management Strategy 2026 12 Risk Management Guidance Page A. Risk Management Methodology and processes 23 - 24 • Establishing the Context • Risk Assessment: • Risk Identification and description • Risk analysis • Risk evaluation • Risk response B. Risk Assessment – Matrix & Descriptors 25 - 28 • Likelihood descriptors • Impact descriptors • Risk Scoring Matrix • Risk Response and Escalation • Monitoring and Review C. Risk Capture and Review Instructions 29 - 33 D. Risk Management Reporting 34 E. Dealing with Risk in Committee Reports 35 - 36 F. Training & Awareness Materials 37 G. Glossary of Risk Management Terms 38 - 39 Page 191 of 238
Page 192
23 Risk Management Strategy 2026 Risk Management Methodology The process adopted by the Council for managing risk is summarised below. Step 1. Establish the Context The first step in the risk management process is to understand and define the planned objectives, outcomes and targets of the Service, Team or Project. This will include scope, stakeholders, the environment in which we operate, and any internal and external factors. This is important since the context from a corporate or strategic perspective may be very different from an operational perspective. Step 2. Risk Assessment This is the process where we identify key risks and consider the likelihood and impact of these on achievement of objectives, outcomes and targets. Risk assessment comprises the following three key elements: • Risk Identification • Risk Analysis • Risk Evaluation Scope, Context, Criteria Communication and Consultation Risk Evaluation Risk Analysis Risk Identification Risk Assessment Risk Treatment M onitoring and Review Recording and Reporting Figure 5 - Risk Management Process Risk Identification This is the systematic use of information from the “Establishing the context” stage to identify and describe risks. When identifying risks, there are 6 risk categories that should be considered: Strategic, Financial, Operational, Human Resources, Legislative & Regulatory and Information Technology. Detailed information on each risk category, including their subcategories, can be found later in this guidance document. The risk identification process should, where possible, involve relevant subject matter experts who have knowledge or experience of the activity or matter under consideration. Risks should be described in three parts, covering: • The risk event i.e. “there is a risk that…………..” • The cause i.e. “due to……..” • The consequence i.e., “which could result in ……” Each risk should be considered in the context of, and aligned to the Council’s corporate priorities, and those activities that contribute to their achievement. To ensure appropriate ownership of risk, each risk should be assigned to a “Risk Owner”. This is the person who, through the risk management process, is identified as being the most appropriate Officer to lead on the management and oversight of a particular risk. Page 192 of 238
Page 193
24 Risk Management Strategy 2026 Risk Analysis This stage determines the significance of a risk and its priority relative to others through risk analysis. We estimate the risk’s likelihood and multiply it by its potential impact using the Council’s Likelihood and Impact Descriptors and Risk Matrix. These tools ensure a consistent approach to risk measurement across the organisation. The combined score produces a risk rating, calculated in two stages: • Inherent risk rating is calculated first and is done as if there were no controls in place to manage the risk. • Existing controls – we then need to consider what controls are already in place to manage the risk. Controls can be policies, procedures, training or other management arrangements designed to manage risk by either reducing the likelihood of the risk occurring, and/or reducing the impact if it does occur. • Residual risk rating is then calculated after consideration of the effectiveness of existing controls. The residual risk rating will then dictate whether further actions are required to reduce the risk further. This analysis of risk produces a risk rating as follows: Risk Ratings Insignificant Low Medium High Very High Risk Evaluation Compares the scores of all of the analysed risks in order to make decisions about their significance in relation to our priorities, objectives, and targets. This produces a “Risk Profile” which enables us to prioritise the risks and decide whether further action is required, with higher rated risks being given more focus. Risk Response/Treatment Involves responding to identified and evaluated risks in a way that is proportionate to the level of risk. This means identifying what, if any, additional actions and controls are required to manage the risk further. Risks may be responded to by means of the 4 “T” s: • Terminate – Avoid or eliminate the risk exposure or activity giving rise to the risk, then it no longer presents a risk to manage. • Treat – implement cost effective actions to modify the risk to a more tolerable level. • Transfer – transfer all or part of the risk to a third party i.e. through contract terms, insurance etc. • Tolerate – an informed decision to accept the likelihood and the impact of a particular risk rather than trying to mitigate it further. This guidance applies to our current process for identifying and managing threats. While threats remain a key focus, it is equally important to consider opportunities when assessing uncertainty and its potential impact on our objectives. During this strategy period, we are committed to enhancing our approach to include the identification and management of opportunities. Additional guidance will be provided as this evolves. If you identify an opportunity and require support, please contact the Corporate Risk Team, who can provide tools and assistance to help you develop and manage opportunity related risks effectively. Page 193 of 238
Page 194
25 Risk Management Strategy 2026 Risk Assessment Likelihood Descriptors Please note that descriptors are intended to be indicative only and may need to be tailored to the individual objective, project or activity under consideration, for example in line with specific professional guidance, national targets or project parameters. These should be agreed with all stakeholders concerned with the risk. Likelihood Descriptors Score Description 5 Almost Certain Event expected to occur (If occurring treat as an issue) Over 90% likelihood of occurrence 4 Likely Event will probably occur 61-90% likelihood of occurrence 3 Possible Event could occur 31-60% likelihood of occurrence 2 Unlikely Event not expected to occur 11-30% likelihood of occurrence 1 Rare Remote chance event could occur in certain circumstances 10% or less likelihood of occurrence Page 194 of 238
Page 195
26 Risk Management Strategy 2026 Impact Descriptors Description of impact Score On Service Delivery Financial On people (including physical and mental wellbeing) On reputation Inspection / Legal / Compliance 5 Catastrophic Catastrophic failure in service quality and key service standards are not met; long term catastrophic interruption to operations; several major partnerships are affected Severe financial loss >£1million Multiple deaths Major permanent incapacity Prolonged National and Local condemnation National media(> 3 days) Rapid intervention and/or prolonged attention from legislative/regulatory body Serious breach including potential prosecution Severely critical report 4 Major Major impact to service delivery; multiple service standards not met; long term disruption to operations; multiple partnerships affected Major financial loss £500,000 - £1m Death Major injuries or long- term incapacity/ disability (loss of limb), requiring medical treatment and/or counselling. Serious negative national or local criticism National media (<3 days) Local media >3 days Medium-term attention from legislative/ regulatory body Breach which could lead to litigation or prohibitions Enforcement Action / Critical report 3 Moderate Significant failure of service quality; major partnership relationships strained; serious disruption to service standards Significant financial loss £250,000 - £500,000 Significant injury requiring medical treatment and/or counselling. Some adverse public / local media attention Local media only <3 days Short term attention from legislative/ regulatory body Breach which could lead to claims or inquiry Challenging recommendations but can be addressed with appropriate action plan. 2 Minor Minor impact on service quality/minor service standards are not met; short term impact Moderate financial loss £50,000 - £250,000 Minor injury or illness, first- aid treatment needed. No staff absence required. Minor adverse local/ public/media attention and complaints Very minor attention from legislative/ regulatory body Legal action is unlikely or only minor claims Minor recommendations made which can be addressed by low level of management action 1 Insignificant No impact on service quality/limited disruption to operations Minimal loss <£50,000 Adverse event leading to minor injury not requiring first aid. No interest to the media, internal only. Public concern restricted to local complaints No external interest None or little risk of legal action Small number of recommendations which focus on minor quality improvement issues. Page 195 of 238
Page 196
27 Risk Management Strategy 2026 Risk Scoring Matrix Risk Scoring Matrix Risk Likelihood Almost Certain 5 5 10 15 20 25 Likely 4 4 8 12 16 20 Possible 3 3 6 9 12 15 Unlikely 2 2 4 6 8 10 Rare 1 1 2 3 4 5 1 Insignificant 2 Minor 3 Moderate 4 Major 5 Catastrophic Risk Impact Risk Rating Insignificant Low Medium High Very High Risk Scoring Matrix Risk Rating Expected Response Escalation Guidance Insignificant 1 - 3 Insignificant risks score from 1-3 on the risk matrix. We can normally accept these. No further actions would normally be expected to prevent or mitigate the risk. No escalation required to service management team or BMT. Low 4 - 8 Low risks score from 4 – 8 on the risk matrix. We can normally accept these. We wouldn’t normally need or expect to do anything further to prevent or mitigate the risk other than to actively monitor existing controls to ensure they continue to be effective. No escalation required to service management team or BMT. Medium 9 - 15 Medium risks score from 9 – 15 on the risk matrix. These can be tolerated if we are confident about the arrangements/controls we have in place to manage them. Any additional control measures identified as necessary should be cost effective in relation to the risk. These risks should be reviewed on a frequent basis by line management and progress should be reported regularly to the Service Management Team 16 - 20 High High risks score from 16 – 20 on the risk matrix. We can tolerate high risks, but we do need to monitor relevant controls carefully. Consideration should be given to any additional control measures which could help prevent or mitigate the risk and reduce the risk score, where such actions would be cost effective. These risks should be reviewed on an ongoing basis by the relevant Service Management Team who may report or escalate to BMT for consideration/inclusion in the CRR. Very High 25 Very High risks score 25 on the risk matrix. These risks should be actively managed to reduce the risk score. Consideration should be given to any additional control measures which could help prevent or mitigate the risk and reduce the risk score, where such actions would be cost effective. These risks should be reviewed on a more regular basis by the relevant Service Management Team who may report or escalate to BMT for consideration/inclusion in the CRR. Page 196 of 238
Page 197
28 Risk Management Strategy 2026 Monitoring and Review Residual Risk Score Risk Rating Review Frequency 25 Very High Monthly 16 – 20 High 3 monthly 9 - 15 Medium 6 monthly 4 - 8 Low 9 monthly 1 - 3 Insignificant Annually Monitoring & Review Once risks have been assessed and rated, they should be on a programme of regular review according to residual risk score as follows, unless circumstances change to suggest the risk should be reviewed sooner: Page 197 of 238
Page 198
29 Risk Management Strategy 2026 Risk Capture Instructions Mandatory fields are marked with an asterix Risk Status* Choose from Draft / Live / Closed Primary Risk Category and Sub Category* (see pages 40-41) Chose most relevant Primary and Sub Category form drop down Risk Title* A short title/description of the risk. Context* Some background information on the risk Risk* Free text to describe what the risk or adverse event is. Wording should be “There is a risk that……“. A risk is something which “could” happen. If it happens or is definitely going to happen it becomes an “issue”. Due to* Free text to describe the potential causes of the risk occurring. Wording should be “due to….” Impact** Free text to describe the potential impact (s) if the risk occurs. Should be worded “which will result in……” Proximity The earliest that this risk could occur: Immediate to one week; One week to one month; One month to six months; Six months to 1 year; One year to five years; Greater than 5 years Risk Owner* The person who has responsibility for co-ordinating the management of the risk. First Assessment Date The First Assessment Date needs to be in the past. The system will calculate when the next assessment date is due by frequency in Assessment Tab. Risk Contact This is a person nominated by the Risk Owner as first point of contact for any query regarding the risk. This person will also receive notifications on the risk, new risk, assessment due or overdue in addition to Risk Owner Corporate Priorities Tick any that are appropriate/most appropriate in relation to the risk. Should have at least one and may have all if considered relevant Assessment Inherent Likelihood* Each risk should be scored in terms of Inherent Likelihood using the matrix below for guidance. Inherent Likelihood score is the evaluation of the likelihood of the risk occurring if there were no controls in place. Enter the score from the drop-down menu. Inherent Impact* Each risk should be scored in term of Inherent Impact using the matrix below for guidance. Inherent Impact score is the evaluation of the potential impact if the risk occurs, if there were no controls were in place. Enter the score from the drop-down menu. Reason for Inherent Risk Likelihood* Free text to describe the rationale for the Inherent Likelihood score. Where possible include any factual information to support this rationale. Reason for Inherent Risk Impact* Free text to describe the rationale for the Inherent Impact score. Where possible include any factual information to support this rationale. Residual Likelihood* Residual Likelihood score is the evaluation of the likelihood of the risk occurring, taking into account the control measures you have identified Residual Impact* Residual Impact score is the evaluation of the potential impact if the risk occurs, taking into account the control measures you have identified Reason for Residual Likelihood* Same rational as per Reason for Inherent Risk Likelihood Reason for Residual Impact* Same rational as per Reason for Inherent Risk Impact Risk capture and assessment instructions The following instructions define the process for recording risk details within the Risk Management Information System. Supplementary tools and templates designed to facilitate risk identification, documentation, and assessment are maintained by the Corporate Risk Management team and made available to the risk network Page 198 of 238
Page 199
30 Risk Management Strategy 2026 Risk Capture Instructions Risk Response Type* Terminate - Stop the activity giving rise to the risk or choose an alternative solution. This response may be chosen where the residual risk is too high, and the preferred option is terminate. Treat - Implement cost effective measures to control a risk to a more acceptable level. Controls will focus on reducing either the likelihood of the risk occurring, and/or the impact of the risk if it does occur. Chose Treat if there are any action plans. Transfer - Transfer all or part of a risk to a third party, usually achieved through contract terms, insurance, or other means. Tolerate - Agree that any further action to treat a risk is not cost effective or proportionate in relation to the current risk and decide to tolerate it as it is. Latest Review Remarks Free text to include a concise summary of any changes that have been made to a risk during a review. Current Key Controls Control Status* Choose from Planned, In Progress, Implemented or Enhancing. Enhancing is where there is already a control and it will be further improved. Control Type* Prevention where reduces likelihood of risk happening or Mitigation which reduces impact should the risk occur. Key Control If considered a most vital control Control Description* Something that reduces the likelihood of the risk occurring and/or mitigate the impacts if it does. Implementation Target Date Date that control was implemented. This is not mandatory Control Owner* In council terms while control owner can be a working group committee etc. for capture in Figtree it must be an individual. If it is a group etc. make reference to that effect in the control description and enter as control owner person considered most suitable to co-ordinate the control. Where possible control owner should be a NLC member of staff though there are certain time when control owner will be part of a key partnership e.g. NHS. Do not enter an elected member as a control owner. Control Progress Remarks For controls that are not yet fully implemented, free text to document progress on a control during a risk review, including details of updates, improvements, and changes made in developing the control. Next Review Date (Implemented Controls) For implemented controls a field that fields allow users to set a date for the control to be next reviewed. Latest Review Remarks (Implemented Controls) For implemented controls, free text to capture brief review notes at each review date. This ensures controls are still relevant and effective as prevention or mitigation measures Actions: Each Action must be linked to a parent control and the control status selected must NOT be’ Implemented’ Actions Action Status* Choose from Raised, Underway or Complete Action Priority* Choose from Low Medium or High Key Action If considered a most vital action Action Description* Details of the action which improve the control Action Owner* Same rational as for control owner Additional Contact This person will receive notifications on a new action, action due or overdue in addition to Action Owner Action Progress Remarks Free text to document progress of an action during a risk review. Page 199 of 238
Page 200
31 Risk Management Strategy 2026 Risk Categories Primary Risk Category Sub Risk Category Definition Strategic Managing Strategic Change Inability of the Council to implement change and reform while still delivering its corporate objectives Digital and IT Strategy Technology is inadequate to support future council initiatives Governance Leadership and Decision Making Ineffective leadership in agreeing a shared ambition and strategy for North Lanarkshire. Lack of clarity in defining responsibilities and appropriate governance across the complex roles for all Elected Members and senior staff. Health and Social Care Integration IJB is ineffective with knock on impact on the Council SW or that NLC cannot provide adequate support for IJB priorities Financial Policies and Controls Inadequate financial control over council activities including partnership arrangements Financial Sustainability Lack of funding to manage council activities in current and future years. Capital and revenue grant funded programmes Inability of NLC to deliver on a major capital or revenue programme/project where there is potential for grant clawback. Operational Procurement Risk Failures in the procurement process designed for the purchase and ongoing management of goods, services, and works. Engagement and Consultation with Communities, Partners and Stakeholders That communities, partners and stakeholders are not engaged in the shaping and delivery of services and that NLC does not optimise the benefits from implementation of the Community Empowerment (Scotland) Act 2015 ALEO Risk ALEOs fail to deliver Council services, expectations or requirements Project Risk Risk arising from inadequate project management. Risk Management Risks arising from inadequate Risk Management Serious Organised Crime, Fraud and Corruption Fraud against the council, employees, members, key partners or stakeholders. Relationships with inappropriate bodies, groups of people/individuals. Corrupt practices across range of NLC Stakeholders. Terrorism NLC fails to plan, prepare and protect its employees, elected members, the public and our communities. NLC fails to provide a co-ordinated approach and contribution to the Counter Terrorism initiatives led by Police Scotland. Communications Non-compliance with Communications Strategy and Policies across the council. Communications are ineffective, do not reach or are not received from relevant parties Human Resources Human Resources Lack of suitable numbers of appropriately skilled staff. Non-compliance with employment legislation and regulation. Legislative and Regulatory Non-compliance existing and new Legislation and Regulation Non-compliance with Legislation, Regulation and government policies. Health and Safety Failure to comply with the Health & Safety at Work etc Act 1974 and associated legislation protecting the health, safety and welfare of our employees and anyone else who can be affected by our activities. Resilience Planning Inadequate response and participation in a Civil Contingency event Business Continuity Planning Service delivery or business operations are interrupted Information Security and Information Governance Information is not managed securely or that information governance is ineffective. External Inspections External Inspections adverse findings including Best Value. Public Protection Non-compliance with legal obligations/failure to provide adequate Public Protection arrangements Climate Change (mitigation, adaptation and sustainability) Failure to develop and implement measures to create and contribute to having a sustainable environment across North Lanarkshire. This includes all activities in addition to those covered by specific climate change legislation. Tackling Poverty Poverty issues impacting on the lives and outcomes for people who live in North Lanarkshire. Information Technology ICT Operational Capability IT solutions do not support the Council Catastrophic Event Natural / Manmade Disaster Risks arising from a significant prolonged catastrophic event that impacts citizens, staff and service delivery.Page 200 of 238
Page 201
32 Risk Management Strategy 2026 Risk Review Instructions Why To ensure that we have thoroughly assessed and understand the risks which have been identified as significant enough to merit inclusion on the Risk Register, and to gain assurance on how well or otherwise each risk is being managed. Regular reviews of each risk will allow management to understand progress with key actions, any change in risk ratings and the reasons why. Reviews will also assist in understanding how the risk could impact the achievement of objectives and provide managers with relevant risk information to aid informed decision making. It is also an opportunity to challenge whether the risk remains valid or whether it may be a candidate for closing. Who Critical to the process is ensuring that there is appropriate variety and breadth of stakeholder/subject matter expert input to develop information for each risk. This ensures that a balanced, robust and well-informed view of the risk and its assessment is obtained, and ensures a common understanding of the risk and associated controls and actions amongst staff. Risk reviews should be undertaken as part of team meetings (either scheduled or specially called for this purpose) or as part of working group meetings. If this is not possible or appropriate, the review may be conducted remotely gathering input from relevant stakeholders/subject matter experts who are best placed to inform the update to the risk information. When Residual Risk Score Risk Rating Review Frequency 25 Very High Monthly 16 – 20 High 3 monthly 9 - 15 Medium 6 monthly 4 - 8 Low 9 monthly 1 - 3 Insignificant Annually Step 1 Review risk context and wording Take the opportunity to consider whether the risk itself is still valid, or whether there has been any change in context of the risk or whether the risk requires to be reframed/reworded to be more relevant. For example has the risk changed as the result of a change in how the service is delivered, or as a result of a change in the external environment in which we operate. Step 2 Review Current Key Management Controls Current risk management controls are those which are designed to mitigate the risk by either reducing the likelihood of occurrence or mitigating the impact of the risk if it does occur. These should be controls that you know are already in place and are working effectively. Whilst difficult to judge with precision, key controls are those which are significant enough to mitigate the risk from its inherent level to its current residual level. By reviewing what is already in place for the risk, you are seeking to confirm: • Whether the detailed controls are still in place and have the same ownership, confirm with the control owner; • If they are still in place, can we regard them as still being effective in reducing likelihood or impact; • If any controls have been removed, this should be detailed and reflected within the risk score and rationale. • Consider whether there are any controls which you know to be in place which are not currently detailed; Page 201 of 238
Page 202
33 Risk Management Strategy 2026 Risk Review Instructions Step 3 Review Planned Management actions If the residual risk score is too high and deemed unacceptable, it is necessary to agree the appropriate risk response. If it is agreed that the best response is to treat the risk further, then this section is used to record planned management actions. These are the future actions deemed necessary to bring the risk down from its current “Residual” rating. If an action is not likely to contribute to having this effect, then it may not be necessary to include it so that attention can be focussed on the most important controls. Avoid recording an action that is deemed to be “ongoing” since this is most likely just the same as maintenance of an existing control. Actions should have a target date for completion. If the list of actions will not in themselves bring the risk down to an acceptable level, then this should be identified, with a clear statement of what future work will be done to identify actions required. Conversely, if there are no actions which will reduce the risk further, this should be noted with explanation. If it has been decided to tolerate the risk at its current residual rating and take no further action, this must also be documented with accompanying rationale. By reviewing planned management actions you are seeking to confirm: • Which planned actions have been completed; • If yes, whether any of these actions now constitutes a new management control which improves the control framework for the risk; • If yes, the new control should be added to the controls information in Figtree and assigned a control owner; • If no, record how completion of the action has enhanced or affected an existing control. • If there are any new actions required, and whether any existing actions require to have new target dates. • Ensure the action owner is the correct person and that they have a clear understanding of what their action is and timescales. • Actions should always be linked to a parent control. • Consider whether there are any actions that are no longer relevant and should be removed. (Notify corporate risk team for deletion on Figtree) Step 4 Risk Assessment stage In the context of changes made in previous steps, review the overall position to • Evaluate whether the current inherent risk score remains valid or requires adjustment, considering that internal or external changes may influence the risk’s context and its inherent rating. • Assess whether the current residual risk score remains accurate or requires adjustment, noting that the risk score could move either up or down depending on the impact of the risk review. • Ensure “Rationale” is updated to reflect why particular risk scores have been chosen. • Take time to make sure everything looks correct: • Is there anything that is not as expected e.g. a residual Risk Rating greater than Inherent Risk Rating • Is review frequency aligned to the risk rating in accordance with strategy as noted above. Step 5 Review the remaining sections of the risk information for completeness, ensuring they are complete, relevant and current, noting any reasons for blank sections. Pay particular attention to any changes in “Risk Context”, relevant to this risk. Bear in mind any potential impact on likelihood and impact scores. Page 202 of 238
Page 203
34 Risk Management Strategy 2026 Risk Management Reporting Report title Purpose of report Report prepared by Frequency of report Reported to Policy & Strategy Committee Business / Corporate Management Team Audit & Scrutiny Panel Service Senior Management Teams Service Committees Risk Management - Corporate Progress report Review and monitoring report to provide updates on key corporate risk management developments, summary of CRR and any key changes to that during the period arising from Horizon Scanning activity. * Every second report will include a summary of the risk profile across Service Risk Registers Corporate Risk Team Quarterly (BMT prior to ASP) Risk Management – Service Progress report Review and monitoring of service risk management implementation and summary of service risk register together with key changes in the period. * (Including reflection of changes to CRR that occur in the reporting period) Service Risk Champion liaising with Service risk forum Quarterly Risk Management year- end report To report on key activities and achievements in relation to delivery of the Risk Management Strategy. * Included in the Chief Officer Audit & Risk Annual Report. Corporate Risk Team Annual Review of the Risk Management Strategy To seek approval for updates made to the Strategy Corporate Risk Team Triennially following each review of the Strategy Throughout this strategy period, we are committed to enhancing our reporting arrangements by incorporating visualisations and graphics. These improvements aim to better meet the needs of report users, support dynamic risk analysis and informed decision making. Page 203 of 238
Page 204
35 Risk Management Strategy 2026 Guidance for dealing with risk in Committee reports How is Risk Management incorporated into the Council’s decision-making process? The principles of risk management relating to decision-making are the same as for any other risk management process. The table below outlines the process. 1. Identify any risks associated with the decision and the implementation of the decision. 2. Assess the impact of the risk and the likelihood of it occurring. 3. Prioritise and include commentary on any significant risks/risks with significant potential impacts in the report. 4. Manage – produce a SMART action plan setting out how the Council intends to minimise the impact or reduce the likelihood of each of the significant risks identified. 5. Review risks with key subject matter experts and relevant statutory officers and amend the risk assessment accordingly. 6. Agree risk assessment with decision-maker clarifying any risks in the risk assessment in order to allow the decision to be made. 7. Update any Service or project risk registers following the decision. Committee report templates include a section ‘Risk Impacts’. The section requires the author to record significant risks identified after carrying out a risk assessment. The risk assessment must record the risks related to the proposed recommendations(s) (including the risks of implementation) and the risks of not taking the recommended action. What is the purpose of the risk assessment? The risk assessment: • Demonstrates that all significant risks related to the decision have been considered; • Provides evidence that the decision-maker has been provided with sufficient information about risks in terms of likelihood and impact; and • Explains how risks will be managed. What will the risk assessment record? The risk assessment should record: • Risks that may arise if the decision is not taken; • Risks that may arise if the decision is taken; and • Action that will be taken to manage each risk documented if the decision is taken. Who needs to be involved in compiling the risk assessment? The report author will take the lead in compiling the risk assessment using a standard template available via the intranet. Involvement will vary significantly depending on the subject matter and the nature of the decision being sought but may include Subject matter experts, the relevant Chief Officer, the Chief Executive, the Council’s S95 officer and the Monitoring Officer. The report author in consultation with the appropriate Chief Officer should review the report and the risk assessment prior to the report being issued. Page 204 of 238
Page 205
36 Risk Management Strategy 2026 Do all risks in relation to a proposal have to be recorded in a risk assessment? No. The risks assessment process should be proportionate to the decision being made. The report author and others involved should consider the impact of any associated risk(s) when deciding whether a risk assessment is required or not. It is the responsibility of the report author to ensure that the risk assessment is sufficient for its purpose. If the impacts of identified risks are low or negligible then it is reasonable that the risks are not formally recorded. What should I put in the risk management section of the committee report template? Key risks surrounding a decision and how these are or will be managed should always be highlighted in the narrative of the report. The audience should receive assurance that the author has carried out a proportionate risk assessment related to the issue and recommendations, in compliance with the council’s decision-making risk management guidance. In offering this assurance the report author is confirming that: 1. Risk assessment documentation relating to the decision has been completed and reviewed by relevant senior management; 2. All significant risks relating to the decision and how these will be managed are highlighted in the report; and 3. Risks relating to the decision have, as appropriate, been included in Service or Project risk registers and will be managed and subject to monitoring and review in accordance with the council’s risk management strategy Will the risk assessment be accessible to the public? The risk assessment will not be published with the Committee papers (although the Committee report will confirm that a risk assessment exists to support the decision sought in the report). However, risk assessments will be subject to the normal rules of disclosure under the Freedom of Information Act 2000 and other relevant legislation. Page 205 of 238
Page 206
37 Risk Management Strategy 2026 Training and Awareness Training and awareness materials will be developed to support colleagues in their role within the framework. All employees and elected members are required to complete the Introduction to Risk Management E-learning mandatory training module. Risk Champions and Risk Facilitators will have the opportunity to complete accredited Enterprise Risk Management training as part of their responsibilities. Targeted training material will be developed to support colleagues in their specific role within the risk management framework. Awareness materials will be made available to colleagues through the most appropriate channels. Page 206 of 238
Page 207
38 Risk Management Strategy 2026 Glossary of Risk Management Terms Glossary of Risk Management Terms Context Context means the external and internal parameters that organisations must consider when they manage risk. External context includes external stakeholders, local, national, and international environment, as well as any external factors that influence objectives. It includes social, cultural, political, legal, regulatory, technological, economic, natural, and competitive environment. Internal context includes internal stakeholders, approach to governance, contractual relationships, capabilities, culture, and standards. Corporate Governance The framework of accountability to users, stakeholders, and the wider community, within which organisations take decisions and lead and control their functions to achieve their objectives Ever Present Risk Risks that are ubiquitous in nature, are ever present within an organisation and will always command the attention of senior management Exposure The susceptibility to loss. Impact Effect or consequences of a risk. Examples of a range of impacts can be found in the Impact Matrix. Inherent Risk The exposure arising from a specific risk if no controls were in place to manage it. Likelihood The chance that something might happen. Likelihood can be defined, determined, or measured objectively or subjectively and can be expressed either qualitatively or quantitatively. Mitigating Action Any action that seeks to reduce the likelihood or impact of a risk event to an acceptable level. Monitoring To supervise, check and critically observe on an ongoing basis. Monitoring will help determine the current status and assess whether or not required or expected performance levels are being achieved. Operational Risk Risks associated with the day-to-day issues facing the organisation in its service delivery, i.e., human error, system failures, inadequate procedures, and controls. Opportunity Risk An uncertain event, which should it occur, could have a potential positive effect on objectives Probability Extent to which a risk event is likely to occur. A measure (expressed as a percentage) of likelihood. Residual Risk The level of risk remaining taking risk control measures into account. Risk An adverse event or set of events, which should it occur, will have an impact on the achievement of objectives. Risk is measured by the combination of the “likelihood” of the event occurring, and the “impact” on our objectives if it does. Risk Analysis The use of information to work out how often risk events might occur and the magnitude of their consequences. Risk Tolerance The Council’s attitude towards risk taking, which in turn dictates the amount of risk it considers tolerable or acceptable. Risk Appetite An expression of how much uncertainty the Council is willing to invite into its processes in pursuit of objectives. Risk Assessment The overall process of risk identification, risk analysis and risk evaluation. Risk Categories Risks are categorised into different types. The Council’s categories are Strategic, Financial, Operational, Legislative & Regulatory, Human Resources and Information Natural/Manmade Disaster Risk Control A control is any measure or action that modifies, Controls include any policy, procedure, practice, process, technology, technique, method, or device that modifies or regulates risk. Risk treatments become controls or modify existing controls once they are implemented. Risk Evaluation The process of comparing the net effect of the scores of the analysed risks to make decisions about their significance in relation to our priorities, objectives and targets. Risk Financing The provision of funds to meet the cost of implementing risk treatments, including, but not limited to, insurance. Page 207 of 238
Page 208
39 Risk Management Strategy 2026 Glossary of Risk Management Terms Risk Identification The process by which risk events, which could affect the organisation’s objectives, are identified, described, and recorded. Risk Management The co-ordinated activities to direct and control an organisation with regard to risk. It covers the processes involved in identifying, assessing, and prioritising risks, assigning ownership, taking actions to prevent or mitigate them, and monitoring and reviewing progress. Risk Management Policy Statement A high-level statement showing how Risk Management will be handled throughout the Council. Risk Management Strategy Describes the goals of applying Risk Management to the activity, a description of the process that will be adopted, the roles and responsibilities, risk thresholds, the timing of Risk Management interventions, the deliverables, the tools, and techniques that will be used and the reporting requirements. It also describes how the process will be co-ordinated with other management activities. Risk Matrix A model that visually displays the relationship between the likelihood and impact of specific risks. Visually it is a 5x5 box that plots likelihood and impact as Insignificant, Low, Medium, or High. Risk Owner A risk owner is a person or entity that has been given the authority to manage a particular risk and is accountable for doing so. Risk Prioritisation The process of ranking risks into a logical order by establishing how significant they are in terms of likelihood and impact (NB Impact is given priority over probability when prioritising risks). Risk Profile The overall picture of the Council’s, Services, or Team’s risks including the number of risks and their scores. Risk Register A formal listing of identified risks, together with the results of the risk analysis and risk evaluation procedures, as well as details of any risk responses. Helps decision makers prioritise resources to minimise risk to best effect and provide assurances that progress is being made. Risk Response Selection and implementation of appropriate options to further minimise the likelihood or impact of an identified risk. Strategic Risk Risk concerned with where the Council wants to go, how it plans to get there and how it can ensure survival. Terminate Avoid or eliminate the risk exposure or activity giving rise to the risk so that it no longer presents a risk to manage. Threat Risk An uncertain event, which should it occur, could have a potential negative effect on objectives Tolerate An informed decision to accept the likelihood and the impact of a particular risk rather than trying to mitigate it further. This is usually because there are certain benefits to be gained, or the cost and effort of implementing further control measures is disproportionate to the risk. Transfer An informed decision to transfer all or part of the risk to another party i.e., through contract terms, insurance etc. Treat Implement cost effective actions to modify the risk to a more tolerable level. Uncertainty A condition where the outcome can only be estimated. Page 208 of 238
Page 209
CC_2025_00305 Produced by NORTH LANARKSHIRE COUNCIL Donald Stone Corporate Risk Manager Chief Executives Office Civic Centre, Windmillhill Street Motherwell ML1 1AB e. StoneD@northlan.gov.uk NORTHLANARKSHIRE.GOV.UKPage 209 of 238
Page 210
Page 210 of 238
Page 211
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/CFP/ASP/May26 Date 14/05/26 Corporate Fraud Policy From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Executive Summary The Council’s Counter Fraud Policy details the Council’s approach to the prevention, detection and investigation of fraud across all Council service areas. This version of the Policy was approved by the Policy and Strategy Committee in March 2026. The Policy has been recently reviewed to ensure the document remains consistent with good practice and continues to reflect the Council’s attitude, approach and response to fraud. The content of the revised Policy remains broadly similar to the previous version. One key addition to the Policy is a section to highlight the requirements of the Economic Crime and Corporate Transparency Act 2023, which introduced a corporate offence of the failure to prevent fraud. The title of the document has also been changed, from the Counter Fraud Policy to the Corporate Fraud Policy. Recommendation It is recommended that the Audit and Scrutiny Panel: 1. Note the key changes to the Policy and the implications of the new legislation; and 2. Note the approved Corporate Fraud Policy (at Appendix 1). The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work All Programmes of Work Item 12 Page 211 of 238
Page 212
1. Background 1.1 North Lanarkshire Council has a zero-tolerance approach to fraud. The Corporate Fraud Policy details the Council’s approach to the prevention, detection and investigation of fraud across all Council service areas and outlines the responsibilities of all officers and members in relation to fraud. 2. Report 2.1 The Council’s previous Counter Fraud Policy was approved by the Policy and Strategy Committee in September 2023. A scheduled review of this policy was recently undertaken to ensure that it remained relevant and up to date, consistent with good practice and continues to reflect the Council’s attitude and response to fraud. 2.2 While some amendments have been made to the format and structure of the Policy, the content remains broadly similar to the version approved in 2023. 2.3 The main change to the Policy is the inclusion of a section detailing the key elements of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), including: • The introduction of the offence of the failure to prevent fraud. This offence allows large organisations to be held accountable for fraudulent acts committed by employees, agents, subsidiaries or other associated persons. Organisations found guilty of this offence may be subject to unlimited financial penalties on conviction. • A corporate defence for organisations that they will not be held liable for this offence if they can demonstrate that they had reasonable procedures in place to prevent fraud. To rely on this defence, an organisation must ensure its specific risk profile, determined through fraud risk assessments, is reflected in its control framework. • UK Government guidance outlining the key principles organisations should follow when establishing a fraud prevention framework as part of the corporate defence. 2.4 As part of the review, and to better align with the changes made, the title of the document has also been changed from the Counter Fraud Policy to the Corporate Fraud Policy. 2.5 The revised Corporate Fraud Policy was approved by Policy and Strategy Committee in March 2026. Following this approval, the Chief Officer (Audit and Risk) and the Chief Officer (Legal and Democratic) will undertake an exercise to ensure that the key components of the Policy and the requirements of the new legislation are communicated to all relevant officers for awareness and understanding. 3. Measures of success 3.1 Up to date policies and associated processes will contribute towards having effective corporate fraud arrangements which are an important part of the framework designed to help prevent and detect fraud and to deal with it effectively when it occurs. Page 212 of 238
Page 213
4. Supporting Documentation Appendix 1 – Corporate Fraud Policy Francis Scott Chief Officer (Audit and Risk) 5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☒ No ☐ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Sections relating to investigations and the relationship between this policy and other relevant HR policies has been discussed with HR. 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Sections relating to investigations and the relationship between this policy and other relevant policies and statutes have been discussed with Legal Services. 5.5 Data protection impact Page 213 of 238
Page 214
Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? New legislation introduces corporate offence of failure to prevent fraud, for which large organisations such as the Council can be liable for unlimited financial penalties. The defence against this is having reasonable procedures in place to prevent fraud, including an assessment of fraud risk in the organisation. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 214 of 238
Page 215
If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 215 of 238
Page 216
CORPORATE FRAUD POLICY Page 216 of 238
Page 217
2 Document control Title Corporate Fraud Policy Owner Francis Scott, Chief Officer (Audit and Risk) Contact scottfr@northlan.gov.uk Governance Group Policy and Strategy Committee Author Francis Scott, Chief Officer (Audit and Risk) Contact scottfr@northlan.gov.uk Revision History Number Originator Date Review Commenced Revision description/record of change 1.0 Ken Adamson June 2023 Update and refresh of full policy 2.0 Francis Scott December 2025 Update and refresh of full policy Document Approvals Number Governance Group Date approval granted Date approval to be requested (if document still draft) 1.0 Policy and Strategy 28/09/23 2.0 Policy and Strategy 19/03/26 Consultation Record (for most recent update) Status of document consulted upon N/A Stakeholders consulted/date N/A Strategic Alignment The Corporate Fraud Policy highlights the Council’s zero tolerance approach to fraud and outlines how fraud risks will be managed across the organisation and how suspected or identified fraud will be managed as part of robust corporate governance arrangements designed to enable and support the delivery of all Council ambitions and priorities. Next review date Review Date December 2027 (for approval at Policy and Strategy Committee in March 2028). Page 217 of 238
Page 218
3 CONTENTS 1 Introduction 4 2 Zero-Tolerance Approach 4 3 Offence of Failure to Prevent Fraud 5 4 Responsibility for Managing Fraud Risk 5 5 Fraud Reporting 7 6 Investigation Process 9 7 Investigation Outcomes 10 8 Media Contact 10 9 Joint Working 11 10 Fraud Training and Awareness 11 11 Conclusion 11 Appendix A – Definitions of Fraud 12 Appendix B – Examples of Fraud Risks for Council Services 13 Appendix C – List of Related Documents 14 Page 218 of 238
Page 219
4 1. INTRODUCTION 1.1 The Corporate Fraud Policy outlines the Council’s commitment to preventing, detecting and investigating fraudulent activities across all the Council’s service areas, ensuring ethical conduct and compliance with legislation. 1.2 Fraud is defined as the deliberate use of deception or dishonesty to disadvantage or cause loss to another person or party. Fraud includes a wide variety of dishonest behaviour such as theft, false accounting, embezzlement, forgery, bribery, corruption, deception, false representation, concealment of material facts and other intentional acts designed to deceive others for personal gain. Fraud can occur within the Council or can be perpetrated against the Council by outside parties. 1.3 The scope of this policy extends to all employees, elected members, service users, contractors, agencies and suppliers and other partner organisations, including the voluntary sector. 2. ZERO-TOLERANCE APPROACH 2.1 North Lanarkshire Council has a zero-tolerance approach to fraud. 2.2 The Council expects its staff to act honestly, with integrity and to safeguard public resources for which they are responsible. The Council aims to conduct its business in an honest and ethical manner and is committed to acting professionally, fairly and with integrity in all its dealings and relationships wherever it operates. 2.3 Any instances of fraud will be investigated thoroughly, and employees found to have been involved in fraudulent activity will be subject to disciplinary action, including termination of employment and other relevant legal consequences. The Council will seek to recover any loss suffered because of fraud. 2.4 The Council is committed to ensuring that opportunities for fraud are minimised and will actively co-operate and share information with other local authorities and public sector bodies to assist in the prevention, detection and investigation of fraud. Page 219 of 238
Page 220
5 3. OFFENCE OF FAILURE TO PREVENT FRAUD 3.1 The Economic Crime and Corporate Transparency Act 2023 (ECCTA) introduced the new offence of the failure to prevent fraud. This objective of this provision is to make it easier to hold large organisations (such as the Council) accountable for fraudulent acts committed by employees, agents, subsidiaries or other associated persons. Organisations found guilty of this offence may be subject to unlimited financial penalties on conviction. 3.2 ECCTA provides a defence for organisations that they will not be held liable for the “failure to prevent fraud” offence if it can demonstrate that, at the time the fraud was committed, it had reasonable procedures in place to prevent fraud. To rely on this defence, organisations must implement procedures that reflect their specific risk profile, determined through risk assessment – the Council should assess the likelihood of frauds being committed and based on those findings, review and revise their existing controls. 3.3 The UK Government has issued guidance outlining six key principles that organisations should follow when establishing a fraud prevention framework: • Top Level Commitment – senior management must actively demonstrate a clear commitment to the prevention of fraud. • Risk Assessment – organisations should evaluate the nature and extent of their exposure to fraud risk, ensuring these assessments are documented and reviewed. • Fraud Prevention Procedures – based on identified risks, organisations should implement proportionate, risk-based procedures as part of a comprehensive fraud prevention strategy. • Due Diligence – organisations must carry out appropriate, risk-based due diligence to identify and mitigate potential fraud risks. • Effective Communication – fraud prevention procedures must be clearly communicated and embedded across the organisation, with strong emphasis on training and ongoing education. • Monitoring and Review – organisations should continuously monitor the effectiveness of their procedures and make improvements where necessary to ensure they remain fit for purpose. 4. RESPONSIBILITY FOR MANAGING FRAUD RISK 4.1 Managers, staff and elected members must always be alert to the risk of fraud. The prevention, detection and reporting of fraud are the responsibility of all members, officers and employees of the Council. 4.2 The Chief Executive has overall responsibility for the operations and activities of the Council. This includes overall responsibility to ensure that the Council’s management arrangements in respect of fraud are adequate and effective and that any lessons to be learned corporately from any fraud occurrences arising are appropriately Page 220 of 238
Page 221
6 addressed. 4.3 The Deputy Chief Executive and all Chief Officers are expected to display high personal standards of conduct in accordance with the Chief Officers’ Code of Conduct and are responsible for establishing and maintaining a sound system of internal control within their areas of responsibility which supports the achievement of Council policies, aims and objectives. The system of internal control is designed to respond to and manage the wide range of risks which the Council faces, including minimising the scope for fraud. Chief Officers should ensure that their employees are made aware that they should report any matter arising which involves, or is thought to involve, a fraud or irregularity. 4.4 The Chief Officer (Finance and Technology) has a duty, in accordance with Section 95 of The Local Government (Scotland) Act 1973, to make proper provision for the administration of the Council’s financial affairs. Proper administration includes ensuring that an adequate system of financial control exists and operates effectively throughout the Council. 4.5 The Chief Officer (Audit and Risk) is responsible for: • Reviewing and reporting on the Council’s control environment for the prevention of fraud. • Establishing and maintaining an effective corporate fraud policy, commensurate to the level of fraud risk identified, including establishing appropriate mechanisms for staff to report suspected fraud risk issues. • Disseminating the Council’s Corporate Fraud Policy to all staff to ensure that they are aware of their responsibilities in relation to preventing and combating fraud. • Ensuring that vigorous, prompt and proportionate investigations are carried out where fraud occurs or is suspected, and reporting to the Service, Chief Executive and Audit and Scrutiny Panel on the outcome of these investigations. • Co-ordinating assurances about the effectiveness of anti-fraud arrangements to support the Statement of Internal Financial Control and the Council’s Annual Governance Statement. • Notifying the Council’s External Auditors regarding all frauds over £5,000. • Liaising on fraud matters with other relevant stakeholders, including the Audit and Scrutiny Panel and the Risk Management Corporate Working Group. 4.6 All Chief Officers and managers are responsible for: • In line with the Council’s Risk Management Strategy, identifying and analysing potential fraud risks for their service area. • Designing and implementing an adequate system of internal control to mitigate these risks and ensuring that that these controls are operating effectively and are being complied with. • Ensuring that any fraud or suspected fraud or irregularity is reported promptly. 4.7 All employees and elected members are responsible for: Page 221 of 238
Page 222
7 • Complying with relevant codes of conduct, council policies and procedures, including declaring and registering relevant conflicts of interest and offers of gifts or hospitality. • Ensuring that the Council's procedures and management arrangements designed to mitigate fraud and corruption risks facing the Council operate effectively. • Reporting any suspicion of fraud or irregularity promptly. 4.8 The Audit and Risk team is responsible for: • Assisting in the prevention and detection of fraud by examining and evaluating the adequacy and effectiveness of controls in line with the annual Internal Audit Plan and in accordance with the Global Internal Audit Standards (GIAS). • Ensuring management has considered and identified the possibility of fraud as a business risk and has included any such fraud risks in their risk register. 5. FRAUD REPORTING EMPLOYEES 5.1 The Council accepts that, to enable the process for reporting concerns of serious wrongdoing within the Council to have credibility, employees must have the confidence that any matter highlighted will be treated confidentially and handled with discretion and tact. 5.2 In the first instance, employees should report any issue or suspicion of fraud or irregularity at the earliest possible stage, to their Line Manager or Chief Officer. If they do not feel that this is appropriate, they may contact the Chief Officer (Audit and Risk) or email the Internal Audit mailbox internalaudit@northlan.gov.uk. Anonymous reports will be accepted and followed up by Internal Audit where possible, however, this should be avoided as it could hinder the investigation if further information is required. 5.3 An employee wishing to raise any matter on a confidential basis may do so using the Council’s whistleblowing arrangements, which are part of the Public Interest Disclosures Policy. This Policy is consistent with the Public Interest Disclosure Act 1998, with respect to the disclosure of information by employees, and all matters highlighted under these arrangements will be dealt with in confidence and in strict accordance with the terms of the policy. This statute protects the legitimate personal interests of staff irrespective of how an allegation is highlighted. The Policy is located at Whistleblowing Procedure. 5.4 Individuals who refuse to accept an offer or bribe and wish to raise concerns or report another’s wrongdoing are sometimes worried out possible repercussions. The Council aims to encourage openness and will aim to support anyone who raises genuine concerns in good faith under the Public Interest Disclosures policy. Whilst reports of suspected or actual fraud will be dealt with sensitively, it may not always be possible to deal with fraud allegations on a confidential basis, however, the Council Page 222 of 238
Page 223
8 will, wherever possible, observe the wishes of an employee raising concerns who does not wish their identity to be disclosed. 5.5 The Council is committed to ensuring that no-one suffers any detrimental treatment by refusing to take part in bribery or corruption or reporting suspicion of fraud. Detrimental treatment includes dismissal, disciplinary action, threats or other unfavourable treatment connected with raising a concern. If someone believes that they have suffered such treatment, they should inform the officer who received the original report immediately. If the matter is not remedied, this should be raised formally using the Dignity at Work Policy. ELECTED MEMBERS, THIRD PARTIES AND MEMBERS OF THE PUBLIC 5.6 The Council is committed to dealing with any allegation of fraud brought to its attention by Elected Members, third parties (e.g. contractors, suppliers, organisations) and members of the public. Elected Members should report any concerns of fraud directly to the Chief Officer (Audit and Risk). Third parties and members of the public can contact the Chief Officer (Audit and Risk) or email internalaudit@northlan.gov.uk. BENEFIT FRAUD 5.7 The Department for Work and Pensions (DWP) Single Fraud Investigation Service (SFIS) are responsible for investigating Housing Benefit Fraud. All matters relating to the allegation of fraud in respect of Housing Benefit should be reported directly to the DWP via the online referral form, which can be found here. Further information on reporting fraud relating to benefits administered by Social Security Scotland can be found here. 5.8 Fraud referrals from Council staff should initially be made to the Council’s Appeals and Adjudication team where the report will be added to the SFIS referral form and passed for investigation. PROCEDURES FOR CHIEF OFFICERS AND MANAGERS NOTIFIED OF FRAUD 5.9 Managers and Chief Officers notified of instances of fraud or irregularity must immediately notify the Chief Officer (Audit and Risk). 5.10 On being informed by an employee of a fraud, it is important that the manager receiving the information deals with it appropriately. In particular, the manager should: • Deal with the employee giving the information in a way that shows that their concerns are being taken seriously. • Not belittle or dismiss the information. • Respect, as far as possible, the confidentiality of the employee. • Attempt to identify where any evidence may be but should not attempt to obtain it, or question anybody. • Pass the information to the Chief Officer (Audit and Risk). 5.11 Line managers should not conduct their own investigations before informing the Chief Page 223 of 238
Page 224
9 Officer (Audit and Risk) as this may compromise any later investigation, invalidate evidence and consequently enable someone who has committed fraud to avoid punishment. 5.12 Circumstances may require the temporary relocation or suspension of an employee. Such decisions rest with the appropriate Chief Officer and must be in accordance with relevant Council policies including the Discipline Policy. It is recommended that HR advice is sought before a member of staff is suspended. In circumstances where an employee is suspended, they should be escorted from the premises immediately, only being allowed to remove personal belongings under supervision. All IT devices held by the employee should be retrieved and the employee’s access to the Council’s network should be suspended. The Chief Officer (Audit and Risk) must be advised of any such action taken by the Chief Officer as soon as possible. 6. INVESTIGATION PROCESS 6.1 The Chief Officer (Audit and Risk) is responsible for determining what course of action should be taken when notified of allegations or concerns of possible fraud. The audit approach to the investigation of a potential fraud is likely to vary depending on the nature and complexity of the fraud, the number and seniority of employees involved and the nature of the Service in which the suspected fraud has occurred. All investigations will be undertaken in a manner that ensures confidentiality and fairness, and where possible the anonymity of those reporting the fraud will be respected. 6.2 Internal Audit’s role in relation to fraud is to act as an independent investigator to establish whether there is any substance to allegations made. This role includes establishing the facts as far as possible, quantifying any loss, identifying any control weaknesses or failures, recommending improvements to address control weaknesses, providing a written factual report on the fraud to the relevant Chief Officer and attending any subsequent disciplinary proceedings, where appropriate, in the role of witness. 6.3 The Council’s Financial Regulations and Internal Audit Charter give Internal Audit staff unrestricted access to all Council records and authority to enter all Council premises or land at all reasonable times. Internal Audit staff can also require and expect to receive any explanations from Council staff as considered necessary to fulfil their role and responsibilities. 6.4 As part of any fraud investigation, Internal Audit will be required to interview Council employees. This may take the form of a general fact-finding interview, or the employee may be called to an investigative interview to answer questions specifically in relation to the alleged or suspected fraudulent activity. In the latter case, the employee will be notified in advance of their right to Trade Union or other representation at the interview. In either type of interview, the employee will be advised of the reasons for the interview and, where appropriate, cautioned by Internal Audit staff, thus ensuring any statement taken and subsequently used as evidence in disciplinary proceedings or in court, will not be rejected as inadmissible. Page 224 of 238
Page 225
10 6.5 Two officers will always be present when conducting any such interviews, one asking questions and one taking notes. 6.6 On completion of an investigation, a written report will be prepared by the Chief Officer (Audit and Risk) and sent to the relevant Chief Officer detailing the findings of the investigation. The report may include recommendations to improve controls, to mitigate the threat of similar frauds re-occurring in the future. Details of this report will also be presented to the Audit and Scrutiny Panel. 6.7 If the value of the fraud is greater than £5,000, the Chief Officer (Audit and Risk) is required to report the details to the Council’s External Auditor. 7. INVESTIGATION OUTCOMES 7.1 Fraud is a serious offence against the Council, and several outcomes are possible from the investigation processes. 7.2 Employees found to have been involved in fraudulent activity will be subject to disciplinary action in line with the Council’s Discipline Policy. Internal Audit staff involved in the investigation, will attend any subsequent disciplinary hearing as a witness, if requested. Where the disciplinary process concludes that the employee’s actions are deemed to be gross misconduct, the employee can be summarily dismissed with no entitlement to notice. 7.3 If there is evidence to support involvement in an alleged criminal offence, the Chief Officer (Audit and Risk) will make the decision to refer the case to Police Scotland. Any such decision requires to be approved by the Chief Executive. Where the incident involves a break-in, Services are authorised to contact the Police immediately. 7.4 The Council will seek to recover any financial loss it has suffered through fraudulent or corrupt activity, through means such as salary recovery, court compensation or by pursuing civil action. Any party or person committing fraudulent activity or behaviour against the Council may be subject to relevant measures as available to the Council and other relevant agencies under the law. These may include warnings, recovery of losses through legal action, fines, interest charges and custodial sentences. 8. MEDIA CONTACT 8.1 The Senior Strategic Communications Manager has been designated by the Chief Executive as the appropriate officer to manage all contact with the media to ensure that the release of information is properly co-ordinated. 8.2 No statements relating to actual or alleged fraud, or any ongoing or complete investigations should made to the press or on social media by any member of staff unless through the Senior Strategic Communications Manager, who will liaise with the Chief Executive, Deputy Chief Executive and the Chief Officer (Audit and Risk). Page 225 of 238
Page 226
11 9. JOINT WORKING 9.1 The Council participates in the National Fraud Initiative, a comprehensive data matching exercise between public bodies to highlight potential frauds and errors. Internal Audit plan and co-ordinate the submission of data and investigation of matches identified. 9.2 The Council is an active member of the National Anti-Fraud Network (NAFN) and the Scottish Local Authority Investigator’s Group (SLAIG) and liaises closely with other public sector bodies and fraud professionals to raise awareness of the risk of fraud and share information, knowledge and good practice regarding common fraud risks. 9.3 The Council, where appropriate, provides information to other public bodies which has been requested under Schedule 2 part 1(2) of the Data Protection Act 2018 to assist in the prevention and detection of crime. The Chief Officer (Legal, Democratic and Strategy) co-ordinates this process and maintains a log of all requests received, together with appropriate documentation. 10. FRAUD TRAINING AND AWARENESS 10.1 Training on Fraud Awareness in Local Government is available to all staff as an e- Learning module. The content of this training has been updated to reflect the requirements of ECCTA. 10.2 Internal Audit will undertake exercises to raise fraud awareness amongst Council employees on a periodic basis, including the communication of the Corporate Fraud Policy. 11. CONCLUSION 11.1 The Council recognises the importance of making best use of public resources and of demonstrating high standards of corporate governance. The Council takes a zero- tolerance approach to fraud, and all cases of actual and suspected fraud will be vigorously and promptly investigated, with appropriate action taken. 11.2 The policy will be scheduled for review every two years and may be updated within this timescale to reflect any required amendments or changes to legislation. Page 226 of 238
Page 227
12 APPENDIX A – DEFINITIONS OF FRAUD Bribery A bribe is an offer, promise, gift or receipt of a financial or other advantage, designed to induce another person to act improperly in the performance of their functions, to reward them for acting improperly or where the recipient would act improperly by accepting. A person acts improperly where they act illegally, unethically, contrary to an expectation of good faith or impartiality, or where they abuse a position of trust. The improper acts may be in relation to any business or professional activities, public functions, acts in the course of employment, or other activities by, or on behalf of, any organisation of any kind. Corruption Corruption is the abuse of entrusted power or position for personal gain. Money Laundering Money laundering is the process by which criminally obtained money or other criminal property is exchanged for ‘clean’ money or other assets with no obvious link to their criminal origins. The aim of this activity is to legitimise the possession of such monies through circulation, and this effectively leads to ‘clean’ funds being received in exchange. Insider Threat Insider threat is a perceived threat to an organisation that comes from people within the organisation who have inside information concerning the organisation’s security practices, data and computer systems. The threat may involve fraud, theft of confidential or commercially valuable information, theft of intellectual property or sabotage of computer systems. Serious Organised Crime Serious organised crime (SOC) refers to criminal activity that is planned, co-ordinated and committed by individuals or groups. The motivation for these crimes is often financial gain. Examples of SOC include money laundering, fraud, bribery and corruption, cyber- crime, illegal firearms, illegal drugs, child sexual exploitation, modern slavery and human trafficking. Tax Evasion The Criminal Finances Act 2017 created two new corporate criminal offences in relation to the failure to prevent facilitation of UK and of foreign tax evasion. Tax evasion is defined as the deliberate and dishonest evasion of tax or knowingly taking steps to facilitate another person to evade tax. The Council would be guilty of an offence if a person commits a UK tax evasion facilitation offence when acting in the capacity of a person associated with the Council. Page 227 of 238
Page 228
13 APPENDIX B – EXAMPLES OF FRAUD RISKS FOR COUNCIL SERVICES Payroll False employees; fraudulent overtime claims or expenses Employees Misappropriation of money, equipment, expenses; time recording irregularities; undeclared conflicts of interest Tenancy Fraudulent applications for housing/successions of tenancy; subletting of properties Benefits Fraudulent applications; failure to declare sources of income or capital; failure to declare changes of circumstances (DWP responsible for benefit fraud) Council tax Fraudulent applications for discounts and exemptions or council tax support Business rates Fraudulent applications for exemptions and reliefs; unlisted properties Procurement Tendering issues including conflicts of interest, collusion, disclosure of sensitive information; attempting to influence Council processes and/or decision-making Payment of creditors False invoices, inappropriate changes of bank details; double invoicing Social care fraud Overstatement of needs through false declaration; multiple claims across authorities; third party financial abuse by carer, family or organisations; posthumous continuation of claims; including personal budgets Schools Theft of monies Identity fraud False identity/fictitious persons applying for services/ payments Blue badges Use of counterfeit/altered badges; use when disabled person is not in the vehicle; use of deceased person’s badge; corporate badges being misused by employees Grants Fraudulent claims; work not carried out; funds diverted; ineligibility not declared Cyber crime A range of fraud types resulting in diversion of funds, creation of false applications for services and payments Insurance Fraud False claims, including slips and trips Concessionary travel Use of concession by ineligible person Immigration False entitlement to services and payments, sham marriages Tax evasion Failing to identify workers/contractors that should be paid via payroll (IR35), failure to deduct income tax at the correct rate, Construction Industry Scheme – suppliers submitting artificially low labour breakdown on their invoices to avoid tax being deducted on labour element Page 228 of 238
Page 229
14 APPENDIX C – LIST OF RELATED DOCUMENTS The following list of documents includes other existing policies, procedures and guidance notes which touch upon issues which are of relevance, or are closely related, to fraud matters. The list is not exhaustive and will be subject to periodic update without requiring a formal review of this policy. • Scheme of Delegation • Contract Standing Orders • Financial Regulations • Public Interest Disclosures Policy (Whistleblowing) • Discipline Policy • Chief Officers’ Code of Conduct • Employees’ Code of Conduct • Acceptable Use of ICT Policy • Information Security Policy • Policy and Procedure on Directed Surveillance, Use of Covert Human Intelligence Sources and Obtaining Communications Data • Procurement Journey Route maps and tender toolkit Page 229 of 238
Page 230
Page 230 of 238
Page 231
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/ASP/NFI Date 14/05/26 National Fraud Initiative - Update From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Executive Summary The purpose of this report is to inform the Panel of the progress made to date by the Council in response to the 2024 National Fraud Initiative (NFI) data matching exercise. This exercise is now complete, and preparations are underway for NFI 2026, therefore this report confirms the final outcome of the NFI 2024 exercise. The NFI in Scotland is a counter-fraud data matching exercise led by Audit Scotland and overseen by the Public Sector Fraud Authority for the UK as a whole. The exercise is undertaken every two years and is recognised as an important tool in preventing and detecting fraud. It involves comparing data sets from a range of public bodies to identify inconsistencies and anomalies which may be indicative of possible fraud or error. This information enables public bodies to follow-up matches on a targeted and prioritised basis to establish if fraud has occurred and to take appropriate action. Recommendations It is recommended that the Panel note the contents of the report and the progress made to date. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work All Programmes of Work Item 13 Page 231 of 238
Page 232
1. Background 1.1 The NFI is a UK-wide exercise which assists public bodies in detecting possible fraud and error. It is led by Audit Scotland under statutory powers added to the Finance and Accountability (Scotland) Act 2000 by section 97 of the Criminal Justice and Licensing (Scotland) Act 2010. 1.2 The NFI uses data matching to compare a range of information held by public bodies to identify potential inconsistencies or circumstances that could indicate fraud or error. This information enables public bodies to follow-up these matches on a targeted and prioritised basis to establish if fraud has occurred and to take appropriate action. A match does not automatically mean that there is fraud or error, and therefore the Council is not expected to review or follow up every match. The outcomes from any investigations are recorded on the secure NFI web application. 1.3 Data in relation to payroll, housing (current tenants and waiting lists), Council Tax Reduction scheme, blue badge parking permits, taxi licenses, business rates, creditor payments and other relevant creditor standing data was uploaded to the secure NFI database in October 2024. Further data in relation to residents in private residential care homes and clients in receipt of personal budgets was uploaded to the NFI database in November 2025. Data matching for these datasets identified a total of 17,452 matches. 1.4 Additionally, Council Tax single person discount (SPD) and electoral register data was uploaded separately to the NFI database in December 2024, resulting in 21,351 matches. An external third party has been commissioned to review these matches. 2. Report 2.1 Audit Scotland has indicated that they do not expect every match or report to be reviewed and advise bodies to prioritise matches. As such, they have categorised the individual reports based on the assessed quality of match (high, medium, address or information only) with ‘high’ reports often being matched on National Insurance Number. Additionally, all matches contained in reports have been allocated a ‘risk scoring’ based on a combination of the likelihood or fraud occurring and the number of times an individual appears across the NFI data. 2.2 Given the high volume of matches received, there are limitations to the number of matches that can be reviewed within the resources available. Services are responsible for determining a method of prioritising their matches for investigation, ensuring timely action and update of the NFI database. This is generally done by considering the risk scoring allocated on the NFI database. Page 232 of 238
Page 233
2.3 As of 22 April 2026, 11,380 (65%) of matches have been reviewed, resulting in 639 errors and 1 fraud, with £72,992 savings identified. A summary of the results by report type is detailed in the table below. Report Type Matches Processed In progress Fraud Error Value (£) Housing Benefit 184 143 4 0 0 0 Council Tax Reduction 1,271 371 8 0 23 15,927 Payroll 119 111 7 0 0 0 Blue Badges 1,125 796 0 0 598 0 Creditors 6,948 6,948 0 0 14 44,507 Procurement 54 53 1 0 0 0 Housing Tenants 1,280 1,196 46 0 0 0 Housing Waiting List 1,913 1,530 42 0 0 0 Business Rates 62 62 0 1 4 12,558 Personal Budgets 13 13 0 0 0 0 Private Residential Care Homes 117 117 0 0 0 0 HMRC 4,366 40 0 0 0 0 Total 17,452 11,380 108 1 639 72,992 2.4 Matches relating to housing benefit and Council Tax Reduction were reviewed and investigated by the Appeals and Adjudications team within Finance and Technology. Review of these matches is complete. 2.5 Internal Audit assessed payroll matches where North Lanarkshire Council employees are also employed by other public sector organisations. These matches are generally innocent, although public bodies have previously identified some matches to be indicative of ‘ghost’ employees with individuals holding multiple employments whilst on sick leave with one of the bodies. Internal Audit is awaiting confirmation of work patterns and sickness from other bodies in relation to five matches, but no issues have been identified to date. 2.6 Internal Audit also assessed matches where Council employees received creditor payments for goods or services provided. Review of these matches is complete, but we are currently investigating a small number of matches. 2.7 The review of matches relating to active blue badges to deceased persons is complete and has resulted in 598 badges being cancelled. 2.8 Creditors matches (relating to potential duplicate payments and creditors references) account for 40% of the total matches received. An initial review by Internal Audit identified that many of these matches contain false positives, as some suppliers can Page 233 of 238
Page 234
have regular monthly charges using the same account reference as the invoice number. The review of these matches was therefore prioritised to focus on those where the potential for duplicate payments is greatest, and the invoice value is most significant, and this is now complete. A small number of duplicate payments were identified, and these have been passed to Finance and Technology to instigate repayment. 2.9 Matches relating to procurement involve a comparison of North Lanarkshire Council employees to Companies House information and creditor payments to identify any potential undeclared conflicts of interest. Internal Audit has reviewed these matches and identified two matches which are being investigated further. 2.10 Review of housing tenant and waiting list matches has significantly progressed with 88% of the matches having been reviewed, and 88 matches identified for further checking by localities. These matches are being progressed by the Service. 2.11 Business rates matches were received in April 2025. Review of these matches is complete, with 1 fraud and 4 errors identified. For these matches, the small business bonus relief has been removed, with the ratepayer being issued with a revised bill reflecting the updated liability. 2.12 Data relating to residents of private residential care homes and clients in receipt of personal budgets was matched to deceased persons records to determine whether Council payments had promptly ceased, and Social Work records had been properly updated to reflect the client’s death. Review of these matches is complete and no issues were identified. 2.13 HMRC data matched to housing tenants, Council Tax Reduction and Council Tax SPD data to identify potential fraud in relation to undeclared ownership, earnings and capital, and household composition, generated 11,195 matches. A review of these matches during NFI 2022 identified that the HMRC data provided had not been matched on a unique identifier (such as National Insurance number) but was generally matched on name and address. As a result, many matches related to different individuals, previous residents or individuals who had never resided in the property. These issues were also identified by other local authorities. Internal Audit reviewed a small sample of the matches received as part of this NFI exercise and identified the same issues as those encountered in the previous exercise. Given the poor quality and reliability of the matches, no further work was undertaken. 2.14 The NFI has a mandatory requirement to submit Council Tax SPD records for matching against electoral data. In line with the previous NFI exercise, the Council has commissioned an external third party to undertake the review work and this is expected to conclude shortly. Once the data has been fully analysed and validated, the outcome will be reported to the Finance and Resources Committee, with a further update provided to the Panel. 2.15 The SPD matches also included 1,152 matches to deceased persons. Review of these matches is now complete and no issues were identified. Page 234 of 238
Page 235
3. Measures of success 3.1 Successful participation in NFI 2024 will result in error, fraud and potential savings identified and positive assessment by the Council’s external auditor of the Council’s approach. Francis Scott Chief Officer (Audit and Risk) Page 235 of 238
Page 236
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Future data matching arrangements will be reviewed to ensure the Council remains legally compliant with recent legislative changes. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☒ No ☐ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☒ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ Page 236 of 238
Page 237
If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure to participate in the NFI could result in non-compliance with legislation, criticism from external audit and create additional potential for fraudulent activity not being identified at an early stage. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 237 of 238
Page 238
Page 238 of 238