Agenda Document Pack - Audit and Scrutiny Panel - 25/06/2026
North Lanarkshire Council · 25 June 2026
Back to Audit and Scrutiny Panel — 25 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
16 June 2026 Members of the Audit and Scrutiny Panel Chief Executive’s Office Rachel Blair Chief Officer (Legal, Democratic and Strategy) Civic Centre, Windmillhill Street, Motherwell ML1 1AB www.northlanarkshire.gov.uk Notice is given that a Meeting of the Audit and Scrutiny Panel is to be held in the Committee Room 1, Civic Centre, Windmillhill Street, Motherwell, ML1 1AB on Thursday, 25 June 2026 at 10:00 AM which you are requested to attend. The agenda of business is attached. Rachel Blair Chief Officer (Legal, Democratic and Strategy) Members : Clerk Name: Karen Swan Clerk Telephone: 07919 730272 Clerk Email: committee@northlan.gov.uk S Watson, P Kelly, C Costello, M Hughes, J Hume, D Johnston, J Leckie, A McCrory, M McCulloch, J McLaren, G Robinson. Page 1 of 20
Page 2
Page 2 of 20
Page 3
Agenda 1 Declarations of Interest In Terms of the Ethical Standards In Public Life Etc. (Scotland) Act 2000 YEAR-END ITEMS 2 Internal Audit Annual Report and Opinion 2025-26 Submit report by the Chief Officer (Audit and Risk) setting out the Internal Audit Annual Report 2025/26 and associated opinion of the Chief Officer. 5 - 20 3 Strategic Governance Framework Submit report by the Chief Officer (Legal, Democratic and Strategy) (copy to follow) 4 Annual Governance Statement Submit report by the Chief Officer (Legal, Democratic and Strategy) (copy to follow) 5 Unaudited Annual Accounts - Year Ending 31 March 2026 Submit report by the Chief Officer (Finance and Technology) (copy to follow) Page 3 of 20
Page 4
Page 4 of 20
Page 5
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/ASP/June2026 Date 25/06/26 Internal Audit Annual Report 2025-26 From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Executive Summary The Global Internal Audit Standards (GIAS) and the Council’s Internal Audit Charter require the Chief Officer (Audit and Risk) to provide the Audit and Scrutiny Panel with an annual summary of the work undertaken by Internal Audit and to provide an independent opinion on the Council’s corporate governance, risk management and internal control arrangements. This report fulfils that requirement for the year 2025-26. The annual opinion is unqualified and states that reasonable assurance can be placed on the Council’s governance, risk management and internal control arrangements. This report has previously been submitted to the Chief Executive, Business Management Team and Corporate Management Team. Recommendations The Panel is invited to note the Internal Audit Annual Report 2025-26 and the associated annual opinion of the Chief Officer (Audit and Risk). The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work All Programmes of Work Item 2 Page 5 of 20
Page 6
1. Background 1.1 Internal Audit is an independent, objective assurance and advisory function designed to add value and improve the Council’s operations. It helps the Council accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of the Council’s risk management, internal control and governance processes. 1.2 Internal Audit’s primary objectives are: • To examine and evaluate internal control systems and governance arrangements within the Council. • To provide assurance to elected members and senior officers on the adequacy and robustness of these systems. • To assist the Audit and Scrutiny Panel (the Panel), elected members and officers of the Council in the effective discharge of their responsibilities. 1.3 Internal Audit aims to provide a high quality and customer focused service which is responsive and flexible, consistent with best professional practice, focuses on areas that matter, uses resources efficiently and effectively, and is seen by stakeholders as adding value and making a vibrant and relevant contribution to the Council. 1.4 The purpose, mandate, authority and responsibilities of the Council’s Internal Audit function are outlined in the Internal Audit Charter, the most recent version of which was approved by the Panel in May 2026. 1.5 Internal Audit reports its outputs regularly throughout the year to the Panel in accordance with the Internal Audit Charter. The Panel also approves Internal Audit’s annual audit plan and monitors the performance of the function. 1.6 Internal Audit activity is planned to enable the Chief Officer (Audit and Risk) to provide an independent annual opinion on the adequacy and effectiveness of internal controls within the authority, including the systems designed to achieve the corporate objectives of the Council and those that manage the material risks faced by the authority. 1.7 It should be noted that the presence of an effective Internal Audit function contributes towards, but is not a substitute for, effective control. It is primarily the responsibility of management to establish internal controls so that the Council’s activities are conducted in an efficient and well-ordered manner, to ensure that management policies and directives are adhered to, and that assets and records are safeguarded. 2. Report Internal Audit Team 2.1 The Internal Audit team has an establishment of 8.5 full-time equivalent (FTE) members of staff, comprising a Chief Officer, an Audit Manager, six Auditors and an Audit and Risk Assistant. All members of the team above assistant level hold, or are working towards, a relevant professional qualification. 2.2 The Chief Officer (Audit and Risk) reports directly to the Chief Executive and is a member of the Council’s Corporate Management Team. The role and status of the Chief Officer and the Internal Audit function within the Council is consistent with the requirements of the Global Internal Audit Standards (GIAS) and best practice. Page 6 of 20
Page 7
2.3 The team experienced some staffing changes during 2025-26, which had the overall effect of operating with one vacant auditor post for much of the year. This resulted in some changes to the implementation of the audit plan. 2.4 A performance management framework for Internal Audit is included within the Internal Audit Strategy. Results of the key performance indicators are reported on an annual basis, and Appendix 3 sets out these results for 2025-26. These indicators may be subject to review during 2026-27, with any revised framework being presented to the Panel. Customer satisfaction surveys are issued to service management at the conclusion of each audit, with the results being reported to each meeting of the Panel. During 2025-26, the team continued to receive positive feedback from Services for the work undertaken. 2.5 The team continues to foster effective working relationships with colleagues from other organisations. The Chief Officer (Audit and Risk) is a member of the CIPFA Internal Audit Special Interest Group and the Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG). Additionally, members of the team attend and contribute to SLACIAG’s sub-groups covering computer audit, data analytics and counter fraud. These are valuable forums through which best practice and intelligence is shared, and relevant training provided. 2.6 Joint working is also undertaken with the appointed Chief Internal Auditor for NHS Lanarkshire, for the provision of a joint internal audit service to North Lanarkshire Integrated Joint Board. Internal Audit staff also continue to liaise closely with Audit Scotland, the Council’s appointed external auditors, to facilitate their work and to avoid any potential duplication of effort. Global Internal Audit Standards 2.7 Since their introduction in 2013, the Public Sector Internal Audit Standards (PSIAS) were mandatory for Internal Audit functions. The PSIAS required the Chief Officer (Audit and Risk) to develop and maintain a Quality Assurance and Improvement Programme (QAIP) which included periodic internal assessments, and an independent External Quality Assessment (EQA) to be undertaken at least every five years. 2.8 The most recent independent EQA was undertaken by Stirling Council in 2024 and confirmed that Internal Audit fully conformed with the PSIAS. This was reported to the Panel in May 2024. Both the self-assessment and EQA highlighted some areas for improvement and consideration, and these are highlighted in the QAIP action plan at Appendix 4. 2.9 From April 2025, the PSIAS was replaced by the Global Internal Audit Standards (GIAS), which required a revision to the current internal audit methodology and working practices. A gap analysis exercise was undertaken to determine actions to ensure compliance with the new standards, and we are working towards this in preparation for the next EQA in 2028-29. As part of the QAIP, the GIAS also require ongoing internal review and periodic self-assessment. Internal Audit Activity During 2025-26 2.10 The Internal Audit plan for 2025-26 was approved by the Panel in May 2025. During the year, 21 audit assignments were undertaken from the plan (compared with 17 planned assignments during 2024-25). This resulted in the following assurance opinions. Page 7 of 20
Page 8
Substantial Assurance Reasonable Assurance Limited Assurance No Assurance Other/TBC * 3 13 2 0 3 * The remaining 3 audit reports have not yet been finalised, but the completed fieldwork indicates that they will provide Reasonable Assurance 2.11 One unplanned assurance audit was undertaken during the year on the Clyde Valley Waste Contract, which provided Substantial Assurance. In addition, investigative work was undertaken relating to potentially fraudulent business grant claims – this is discussed in more detail at paragraph 2.23. Appendix 2 provides details of the planned and unplanned work undertaken during 2025-26. 2.12 The GIAS require the audit plan to be subject to ongoing review to ensure it remains relevant and fit for purpose. During the year, some amendments were made to the plan to enable the function to respond flexibly to changing circumstances, and to take account of the effect of auditor vacancies within the team. These changes were approved by the Panel in March 2026, and included: Audit Reason for Change Project Management Partially deferred to 2026-27 due to resources Debt Management Partially deferred to 2026-27 due to resources Traffic Commissioner Report Audit no longer required as the Driver and Vehicle Standards Agency provided assurance that outstanding actions complete Compliance with Grant Conditions Removed due to resources and other unplanned work on business grants Digital NL Process Redesign Removed due to resources and ongoing Council review of the Programme of Work NL Community Planning Partnership Removed due to resources and other planned audit work on the Leadership and Operating Model which included community hubs 2.13 Considering these changes to the audit plan and the additional unplanned work undertaken during the year, it is my view that sufficient coverage has been obtained to inform the annual opinion. 2.14 Internal Audit continues to support Service management to ensure recommendations made within audit reports are implemented as agreed, and an update on all outstanding audit recommendations is presented to each meeting of the Panel. The Internal Audit Annual Reports for 2023-24 and 2024-25 noted a marked improvement in the actions and engagement of management in implementing audit recommendations, and this has continued throughout 2025-26. 2.15 Internal Audit also has responsibility for investigating alleged frauds and irregularities brought to our attention in accordance with the Council’s Corporate Fraud Policy. Where detailed work is carried out, the findings are reported to the Chief Executive and the relevant Chief Officer, with details of the work presented to the Panel, in line with the Internal Audit Charter. Page 8 of 20
Page 9
2.16 In addition to undertaking audit reviews, the Internal Audit team are involved in several other areas which serve to contribute to good governance across the council and enhance the overall control environment. During 2025-26, this included: • Participation in corporate working groups, project boards and Programme of Work thematic boards. • Provision of advice and guidance on systems development and control issues to services and Chief Officers. • Preparation of reports and agendas, and participation at meetings, to enable the Panel to fulfil its role. • Co-ordinating the work of the Council’s involvement with the National Fraud Initiative. • Consideration of reports by Audit Scotland and the Accounts Commission and highlighting key issues. Audit Issues 2025-26 2.17 The nature of audit assignments is such that most Internal Audit reports identify some weaknesses or areas where scope for improvement exists, and during 2025-26, a number of recommendations were made to address such areas identified from the audit work undertaken. However, as noted in paragraph 2.10, the majority of audits undertaken during the year received opinions of either Reasonable or Substantial Assurance, and there are no issues arising from these audits which require to be highlighted in this report. 2.18 The 2023-24 Annual Report discussed reports on the Housing and Corporate Property Maintenance Contract and the whistleblowing allegations received by Audit Scotland, and audit work during 2024-25 concluded that significant progress had been made in implementing the recommendations in both reports, with some aspects being fully implemented. Substantive audit work on the operation of the new contract was included in the Internal Audit Plan for 2025-26 and no significant issues have been identified. 2.19 Two audits during 2025-26 provided Limited Assurance. The first was in relation to unannounced spot check visits at a sample of education establishments – while the audit testing also considered physical security, health and safety, and information security arrangements, the limited assurance opinion was due to control weaknesses in the management of school funds (specifically non-compliance with procedures, and insufficient oversight of the processes by Head teachers and senior school management). 2.20 The control environment around school funds has been subject of repeated audit activity over recent years and was mentioned specifically in the Internal Audit Annual Report for 2024-25. While work is ongoing to address the control weaknesses, the agreed actions from previous audits have not yet been fully implemented, meaning the areas of concern identified have not been addressed. Further work in this area has been included as part of the 2026-27 Internal Audit Plan. 2.21 The second report with Limited Assurance relates to the arrangements for the use of Self-Directed Support (SDS). The audit found significant weaknesses in relation to the application of procedures and retention of key documentation for each of the four care delivery options available to service users, as well as in the consistency of monitoring Direct Payment expenditure. These weaknesses could lead to funds being misused, assessed needs not being met and potential financial loss and reputational damage for the Council (although there was no evidence of misuse of funds from the sample of cases tested). Page 9 of 20
Page 10
2.22 Although the issues noted above can be significant to the control environment in the individual system or areas audited, they are not material enough to have a significant impact on my overall opinion on the adequacy of the Council’s control environment. 2.23 One fraud investigation was undertaken during 2025-26. This followed concerns identified by officers in relation to potentially fraudulent applications for business grants by external parties. The investigation report is currently being finalised and will be presented at the next meeting of the Panel in August 2026 for discussion and consideration. Corporate Risk Team 2.24 The Corporate Risk Team has an establishment of 2.5 FTE members of staff, comprising a Corporate Risk Manager, a Corporate Risk Officer and an Audit and Risk Assistant. The Corporate Risk Manager, Corporate Risk Officer and the Chief Officer are members of the Association of Local Authority Risk Managers (ALARM). Members of the Corporate Risk Team also attend the SLACIAG risk management sub-group which, alongside the ALARM membership, provides opportunities for learning and access to sector information materials. 2.25 The Corporate Risk Team is responsible for the co-ordination and continuous development of risk management arrangements across the Council, and maintenance of the Corporate Risk Register. The team also provides support and guidance to all services on the management of risk, including formal training opportunities and the provision of risk workshops. Progress on the work of the team is reported quarterly to the Panel. 2.26 The Risk Management Corporate Working Group (RMCWG) supports Council services and the Corporate Management Team to implement the Risk Management Strategy and embed and promote good risk management practice. There were seven meetings of the RMCWG during the reporting period – these were chaired by the Corporate Risk Manager and were consistently well attended with high levels of engagement from across services. 2.27 During 2025-26, some of the key outcomes from the work of the Corporate Risk Team included: • A refresh of the Council’s Risk Management Strategy for the three-year period to 2029, incorporating high-level deliverables for the Corporate Risk Team. The strategy document was approved by Policy and Strategy Committee in March 2026. • Collaborating with service risk champions to identify and capture improvement actions using the Risk Management Monitoring Tool. The exercise was undertaken twice during 2025-26 and reviewed through the RMCWG. • Development of resources to support services in identifying matters to be captured in corporate and service risk registers through horizon scanning. This also included high-level comparison of external horizon scanning publications and survey results with existing risk registers. • Provision and facilitation of risk management training for officers and members. During 2025-26 this comprised improving the content of the mandatory e-learning module, coordinating external accredited training courses for service risk champions and facilitators, delivering CPD sessions for legal officers and provision of ad-hoc training on the risk management system. • Liaison with the application supplier to refine the risk management system to capture additional details, adjust reporting formats and introduce new functionality. Page 10 of 20
Page 11
Internal Audit Opinion 2025-26 2.28 The opinion is presented to members of the Audit and Scrutiny Panel, the Chief Executive and the other members of the Council’s Corporate Management Team and is intended to provide independent and objective assurance as to the adequacy and effectiveness of governance, internal control and risk management arrangements within the Council. Annual Opinion Reasonable Assurance There is generally an overall sound system of governance, risk management and internal control in place. While some issues, non-compliance or scope for improvement were identified, individually these do not significantly impair the Council’s system of internal control. 2.29 My formal Internal Audit Opinion on the soundness of the Council’s internal control systems for 2025-26 is presented at Appendix 1. Acknowledgements 2.30 I would like to take this opportunity to express my thanks to all staff in the Audit and Risk team for their hard work and commitment throughout the past year. I would also like to thank all Council staff who have assisted Internal Audit during our work throughout 2025-26, and the Chief Officers and elected members for the consideration and due regard given to our work. 3. Measures of success 3.1 Internal Audit reports annually on its performance to the Panel and is also subject to review annually by the Council’s appointed external auditors. 4. Supporting documentation Appendix 1 Internal Audit Opinion 2025-26 Appendix 2 Audit Work Undertaken 2025-26 Appendix 3 Internal Audit Performance Appendix 4 Quality Assurance Improvement Programme (QAIP) Action Plan Francis Scott Chief Officer (Audit and Risk) Page 11 of 20
Page 12
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Page 12 of 20
Page 13
Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure to operate an effective Internal Audit function, consistent with the Global Internal Audit Standards (GIAS) could impair the Council’s compliance with its Code of Corporate Governance. Risks to the effective operation of the Internal Audit service (including failure to comply with GIAS) and how these are mitigated are documented in the Service’s risk register which is subject to regular review by the Audit and Risk management team. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 13 of 20
Page 14
APPENDIX 1 – Internal Audit Opinion 2025-26 To the members of North Lanarkshire Council’s Audit and Scrutiny Panel, the Chief Executive and Corporate Management Team As Chief Officer (Audit and Risk) of North Lanarkshire Council, I am pleased to present my annual statement on the adequacy and effectiveness of the Council’s framework of governance, risk management and internal control for the year ended 31 March 2026. Respective responsibilities of management and internal auditors in relation to governance, risk management and internal control It is the responsibility of the Council’s senior management to establish appropriate and sound systems of governance, risk management and internal control and to monitor the continuing effectiveness of those systems. It is the responsibility of the Chief Officer (Audit and Risk) to provide an independent annual opinion on the adequacy and effectiveness of the Council’s framework of governance, risk management and internal control. The Council’s framework of governance, risk management and internal controls The main objectives of the Council’s framework of governance, risk management and internal controls are to ensure that resources are directed in accordance with agreed plans, policies and priorities and to ensure that there is sound decision-making and clear accountability for the use of those resources to achieve the desired outcomes for service users and communities. This includes ensuring that appropriate internal controls and risk management arrangements are in place to effectively manage issues which might impact on the delivery of Council services, the achievement of corporate and service objectives, ambitions and priorities and public confidence in the Council. The Council also requires effective internal controls and risk management arrangements to safeguard its employees, to protect its assets, to maintain effective stewardship of public funds, to ensure good corporate governance, to ensure compliance with statutory requirements and to ensure it continues to deliver best value. The work of Internal Audit Internal Audit is an independent, objective and risk-based assurance function designed to add value and to improve the Council’s operations. It enhances the Council’s achievement of its objectives, decision making and oversight by bringing a systematic approach to evaluate and improve the effectiveness of the Council’s risk management, control and governance processes and by providing an independent and objective opinion on the Council’s internal control environment. In doing so, Internal Audit contributes to the Council’s reputation and credibility with its stakeholders and its ability to serve the public interest. Internal Audit operated throughout 2025-26 in accordance with the Global Internal Audit Standards (GIAS). As part of the Internal Audit Quality Assurance and Improvement Programme, I have assessed the extent to which current internal audit activity, policies and procedures conform to expected requirements. The results show that Internal Audit continues to substantively comply with the GIAS. Internal Audit undertakes an annual programme of work formally approved by the Audit and Scrutiny Panel. The audit plan is risk-based and is revised on an ongoing basis to reflect my assessment of the evolving risks and operational changes within the Council. All Internal Audit reports identifying system weaknesses or non-compliance with expected controls are brought to the attention of management and include appropriate recommendations and agreed action plans. It is management’s responsibility to ensure that proper consideration Page 14 of 20
Page 15
is given to Internal Audit reports, and that appropriate action is taken on audit recommendations. Internal Audit is required to ensure that appropriate arrangements are made to determine whether action has been taken on Internal Audit recommendations or, where appropriate, that management has understood and assumed the risk of not acting. Significant matters (including non-compliance with audit recommendations) arising from internal audit work are reported regularly to the Chief Executive, to the Corporate Management Team and to the Audit and Scrutiny Panel. Basis of Opinion My evaluation of the control environment is informed by several sources: • The audit work undertaken by Internal Audit during the year to 31 March 2026. • The assessment of risk completed during the preparation of the 2025-26 and 2026-27 Internal Audit plans. • My wider knowledge of the Council’s corporate governance, risk management and performance management arrangements. • Assurances of the general control environment within individual Services in 2025-26 provided by Chief Officers. • Reports issued by the Council’s external auditors during 2025-26, together with reports from other external review and inspection bodies. Opinion It is my opinion that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s framework of governance, risk management and internal control for the year ended 31 March 2026. Francis Scott Chief Officer (Audit and Risk) North Lanarkshire Council May 2026 Page 15 of 20
Page 16
APPENDIX 2 – Audit Work Undertaken 2025-26 Audit Status Recommendation Priority Assurance Opinion Reported to Audit & Scrutiny Panel High Medium Low Planned 1. Risk Management Complete 0 3 2 Reasonable March 2026 2. Roads Contract Complete 0 1 2 Reasonable May 2026 3. Strategic Governance Arrangements Complete 0 1 0 Substantial August 2025 4. Information Governance Complete 0 1 0 Reasonable November 2025 5. Financial Sustainability Complete 0 0 1 Substantial March 2026 6. Housing Repairs Contract Ongoing Expected August 2026 7. External Legal Fees Ongoing Expected August 2026 8. Self-Directed Support Complete 1 3 1 Limited May 2026 9. Sundry Debtors Complete 0 0 3 Substantial March 2026 10. Contract Management Complete 0 4 0 Reasonable May 2026 11. Education Establishment Visits Complete 1 1 2 Limited May 2026 12. Community Asset Transfers Complete 0 3 1 Reasonable November 2025 13. Procurement – Compliance Complete 0 1 1 Reasonable May 2026 14. Procurement – Non-Contract Spend Complete 0 3 1 Reasonable August 2025 15. Protecting Vulnerable Groups (PVG) Complete 1 2 1 Reasonable March 2026 16. Attendance Management Complete 0 0 2 Reasonable November 2025 17. Payroll Leavers Process Complete 0 3 2 Reasonable November 2025 18. Fleet Services Complete 2 3 0 Reasonable November 2025 19. Homelessness Complete 0 3 1 Reasonable March 2026 20. Leadership and Operating Model Ongoing Expected August 2026 21. Anti-Fraud Arrangements Complete 0 2 0 Reasonable March 2026 Page 16 of 20
Page 17
Audit Status Recommendation Priority Assurance Opinion Reported to Audit & Scrutiny Panel High Medium Low Unplanned Work 22. Clyde Valley Waste Contract Complete 0 0 1 Substantial May 2026 23. Business Grants Ongoing Expected August 2026 Assurance Opinion Definitions Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Page 17 of 20
Page 18
APPENDIX 3 – Internal Audit Performance Category Measure 2025-26 Performance 2024-25 Performance 1. Delivery of Annual Plan Percentage completion of agreed plan 80.6% 87.9% 2. Targeting Percentage of key corporate risks and key financial systems over which assurance provided (note 100% coverage planned over a 3-year rolling period) Corporate risks – 36% audited in 2025-26 Financial systems – 17% audited in 2025-26 Corporate risks – 27% audited in 2024-25 Financial systems – 42% audited in 2024-25 3. Efficiency Cost of Internal Audit per £ million revenue budget To be confirmed To be confirmed 4. Efficiency % of productive hours delivered v Plan 85.9% 89.8% 5. Delivery / recommendations Percentage implementation of agreed actions by implementation date (cumulative year to date) 79% 54% 6. Delivery / other Number of significant irregularity / fraud investigations 1 1 7. Quality / standards Quality review outcomes – EQA or internal self- evaluation 2024 EQA ‘Fully Conforming’ with PSIAS 2024 EQA ‘Fully Conforming’ with PSIAS 8. Delivery of Annual Report Annual opinion /report prepared by 31 May annually Annual opinion/report signed 28/05/26 Annual opinion/report signed 27/05/25 9. Targeting Approval by CMT and A&SP of strategy and annual plan by 31 May annually Annual plan endorsed by CMT 01/05/26 Annual Plan approved by A&SP 14/05/26 Annual plan endorsed by CMT 28/04/25 Annual Plan approved by A&SP 08/05/25 Page 18 of 20
Page 19
APPENDIX 4 – Quality Assurance Improvement Programme (QAIP) Action Plan No. Source Recommendation Management Response Responsible Officer and Target Date Status 1 Self- assessment Annual audit plan conforms with all aspects detailed in PSIAS and expectation is that all assignments will be completed in the year, however individual audits are not formally prioritised in the plan. N/A Chief Officer (Audit and Risk) March 2025 Complete – working version of Internal Audit plan for 2025-26 has prioritised audits. 2 Self- assessment Include explicit reference to QAIP and monitoring progress of agreed actions. N/A Chief Officer (Audit and Risk) May 2024 Complete – Included in Internal Audit Annual report for 2023-24 and 2024-25 3 Self- assessment and EQA The PRD process should be re-introduced for all members of the Internal Audit team, to ensure that all Internal Audit staff are able to discuss and subsequently access appropriate training and development activities. Revised and refreshed Corporate PRD process launched in May 2023. Now that the re-structure of the Audit team is complete and recruitment for new posts is underway the PRD process, incorporating a formal assessment against the skills and competency framework, will be taken forward. Audit Manager August 2024 December 2025 April 2026 Complete – PRD conversations reinstated from April 2026 for all staff. Additionally, Chief Officer undertakes 6-monthly 121 meetings with all staff. 4 Self- assessment and EQA Review current best practice in relation to assurance mapping and how other public bodies use this to inform the Internal Audit planning process, to ensure effective co- ordination of activities with other assurance providers. The Chief Officer (Audit and Risk) will progress work on developing an approach to assurance mapping in a way that allows this to inform the 2025/26 Internal Audit Plan. Chief Officer (Audit and Risk) Audit Manager December 2024 August 2025 Complete – work undertaken as part of the approved 2025/26 audit plan. Other providers of assurance also key point of discussion with Chief Officers in preparation of the 2025/26 audit plan Page 19 of 20
Page 20
No. Source Recommendation Management Response Responsible Officer and Target Date Status 5 EQA As risk management and, in particular, counter fraud arrangements continue to mature, the Chief Officer (Audit and Risk), should seek independent, external assurance on the adequacy of these arrangements. In doing so, however, a pragmatic and cost-effective approach must be taken. One possibility may be peer review by another Local Authority, similar to this Internal Audit external quality assessment process. The Chief Officer (Audit and Risk) will ensure that due consideration is given to the need for independent external assurance on the adequacy of risk management and counter fraud arrangements. This will be undertaken on an annual basis as part of the annual planning and reporting process. Chief Officer (Audit and Risk) April 2025 April 2026 Complete – audit work in these areas in 2025-26 audit plan was undertaken by the Audit Manager, independently of the Chief Officer. The provision of an independent external review will be considered for future years. 6 EQA The Chief Officer (Audit and Risk) and the Audit Manager should consider the proportionality of the current review process, particularly at the working paper stage, to establish whether there may be scope for further streamlining and improving the audit process while maintaining appropriate oversight in relation to quality control. The recently implemented change to the Audit team structure will naturally result in a change to the current review process. After allowing for the new structure to embed, the Audit Manager will consider the proportionality of the review process ensuring that any amendments still facilitate the ability to properly supervise all engagement to ensure that objectives are achieved, and quality is assured. Audit Manager March 2025 May 2026 Revised Date – review of audit methodology ongoing looking at all aspects of process to modernise work of the audit team, identify improvement areas and scope for streamlining. 7 Self- assessment Preparation of a gap analysis, comparing the requirements of the PSIAS with the new Global Internal Audit Standards (GIAS) and identifying actions to ensure conformance. N/A Audit Manager December 2025 August 2026 Revised Date – gap analysis is complete, work now progressing on ensuring Internal Audit conforms with GIAS, with full self-assessment to be carried out during 2026- 27. Page 20 of 20