Agenda Document Pack - Audit and Scrutiny Panel - 29/08/2024
North Lanarkshire Council · 29 August 2024
Back to Audit and Scrutiny Panel — 29 August 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
20 August 2024 Members of the Audit and Scrutiny Panel Chief Executive’s Office Archie Aitken Chief Officer (Legal & Democratic) Civic Centre, Windmillhill Street, Motherwell ML1 1AB www.northlanarkshire.gov.uk Notice is given that a Meeting of the Audit and Scrutiny Panel is to be held in the Committee Room 1, Civic Centre, Windmillhill Street, Motherwell, ML1 1AB on Thursday, 29 August 2024 at 14:00 PM which you are requested to attend. The agenda of business is attached. Archie Aitken Chief Officer (Legal & Democratic) Members : Clerk Name: Karen Swan Clerk Telephone: 07919 730 272 Clerk Email: swank@northlan.gov.uk S Watson, B McCulloch, H Brannan-McVey, H Dunbar, T Fisher, M Hughes, J Hume, D Johnston, J Leckie, J McLaren, G Robinson. Page 1 of 126
Page 2
Page 2 of 126
Page 3
Agenda 1 Declarations of Interest In Terms of the Ethical Standards In Public Life Etc. (Scotland) Act 2000 Scrutiny - Related Items 2 Strategic Performance Framework - Performance Reporting Schedule Quarterly Performance Assurance Review Submit report by Chief Officer (Business and Digital) providing the Panel with the outcome of the latest quarterly performance assurance review which was undertaken on performance reports submitted to Council Committees during Cycle 2 of 2024. 5 - 26 3 Best Value Audit Report on Workforce Innovation Submit report by Chief Officer (Business and Digital) (Copy to Follow) Audit - Related Items 4 Audit and risk-related items Action Log Submit report by Acting Chief Officer (Audit & Risk) allowing elected members to track implementation of outstanding requests and recommendations made by the Panel in respect of audit and risk-related items. 27 - 30 5 Internal Audit Progress Report Submit report by Acting Chief Officer (Audit and Risk) providing an overview of the Internal Audit activity and the results of Internal Audit outputs finalised since the last update to the Panel in May 2024. 31 - 72 6 Internal Audit Follow up of Actions previously agreed by Management in Response to Audit Recommendation Submit report by Acting Chief Officer (Audit and Risk) providing an update to the Panel on the results of Internal Audit's follow up work 73 - 96 7 Internal Audit Charter Submit report by Acting Chief Officer (Audit and Risk) seeking approval of the Internal Audit Charter. 97 - 112 Page 3 of 126
Page 4
Risk - Related Items 8 Risk Management Update including Corporate Risk Register CRR 2024-2025 Submit report by Chief Officer (Audit and Risk) providing Members with an update on risk management development with a focus on the the results of the recent annual review of the corporate risk register. 113 - 126 Page 4 of 126
Page 5
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref KH/SL Date 29/08/24 Strategic Performance Framework - Performance Reporting Schedule quarterly performance assurance review From Katrina Hassell, Chief Officer (Business and Digital) E-mail HassellK@northlan.gov.uk Telephone 07903 096 121 Executive Summary The purpose of this report is to bring together a summary of the council’s performance reports in one composite assurance overview to support the Audit and Scrutiny Panel in maintaining strategic oversight and awareness of the council’s performance reporting arrangements in line with the Panel’s remit to provide “independent review of the council’s governance, risk management, performance, and control frameworks”. It also supports the Audit and Scrutiny Panel’s governance and accountability role in terms of ensuring the council can demonstrate Best Value through the existence of robust arrangements for performance reporting and scrutiny. This process monitors reports which have been submitted to council committees (in line with the Strategic Performance Framework - Performance Reporting Schedule) during the previous cycle. This process began following the annual Performance Reporting Schedule for 2023 to 2024 at the Audit and Scrutiny Panel meeting in February 2023 with implementation of a quarterly performance assurance review report thereafter. This report herewith provides the Panel with the outcome from the latest quarterly performance assurance review that has been undertaken on performance reports previously submitted to council committees during cycle 2 of 2024 (in line with the Performance Reporting Schedule for 2024 to 2025 which was at the Panel meeting in February 2024). Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Review the composite overview of performance reporting provided in Appendices 1 and 2 to maintain an awareness of each report within the Performance Reporting Schedule for 2024 to 2025, and (2) Identify whether there are any significant issues arising, from the composite performance overview presented in the attached Appendices, that the Panel considers requires additional scrutiny and a further report to be submitted from the respective Chief Officer to a future meeting of the Panel (following review through the Scrutiny Assessment and Prioritisation Process). Item 2 Page 5 of 126
Page 6
1. Background 1.1 Members of the Audit and Scrutiny Panel will recall the report in February 2024 which contained the Strategic Performance Framework - Performance Reporting Schedule. This set out the reporting, review, and scrutiny arrangements for a range of performance information to be considered at each cycle of committee meetings for 2024 to 2025 and provided an update on the previous Performance Reporting Schedule for 2023 to 2024 which was at the Panel in February 2023. 1.2 The Strategic Performance Framework comprises performance measurement at three levels (as per the diagram on the right). This aims to collectively provide an overview of performance to help understand the impact of council activities on improving services and outcomes for the people and communities of North Lanarkshire. The measures in this Framework allow for day-to-day activities, and progress towards achieving the long-term vision set out in The Plan for North Lanarkshire, to be regularly monitored, reported, assessed, and scrutinised. 1.3 The supporting Performance Reporting Schedule forms a key part of the Scrutiny Work Programme that underpins the Best Value governance and accountability theme by ensuring the council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. It also aims to fulfil the Audit and Scrutiny Panel’s remit as per the Scheme of Administration to: • Review and monitor the performance of the council in delivering upon its priorities, outcomes, programme of work, and targets in the council plan, specifically performance in improving local services and outcomes and in demonstrating Best Value. • Review performance to assess whether intended policy outcomes have been achieved. 1.4 The Strategic Performance Framework comprises a set of non-negotiable standards which Chief Officers are required to apply in all performance reporting that supports the Framework. These standards aim to ensure that performance reporting is: • Aligned - to The Plan for North Lanarkshire to give stakeholders an insight into the performance of council activities both in the short-term and against the long-term ambitions. • Consistent - to ensure a standard, easily recognisable, and well-established process across each different audience over time. This aims to help build credibility, reliability, and a common understanding. • Transparent - to allow stakeholders to understand what is being measured, what it means, what level of performance has actually been achieved, and what difference this means in reality for the people and communities of North Lanarkshire. • In context - to avoid the So What? question and provide a coherent narrative to ensure fully informed review, reporting, scrutiny, and decision making processes. • Balanced - to ensure any text adds value and tells a balanced narrative. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Page 6 of 126
Page 7
Performance reports should identify areas requiring improvement as well as areas of good performance. Narrative should include reasons for performance levels not in line with targets and the remedial action undertaken to address this. 1.5 The Performance Reporting Schedule shows there is a significant volume of performance information timetabled to be reported to various council committees in each cycle of 2024 to 2025. Cycle 2 reports were reviewed by the Business Management Team in July 2024 to ensure the relevant assurances in terms of performance management arrangements that promote effective use of the council’s resources, performance information being scrutinised at a senior management level, and performance monitoring arrangements in place to effectively address areas of underperformance, identify the scope for improvement, and agree remedial action. 1.6 The volume of performance information in the cycle 2 reports has been reviewed and summarised further in Appendices 1 and 2 attached. It should be noted that the performance information within Appendices 1 and 2 has already been reviewed by Service Committees during cycle 2. The purpose of the information presented herewith is therefore to provide Audit and Scrutiny Panel members with a composite, but easily digestible, overview for governance and assurance purposes in line with the specific scrutiny and strategic oversight role of the Panel. 1.7 Should the Panel consider there are any significant issues arising from the composite performance overview which require additional scrutiny, these matters will be reviewed through the Scrutiny Assessment and Prioritisation Process (updated and approved by the Panel in September 2022 and further endorsed in September 2023), prior to being added to the Scrutiny Work Programme for a further report to be submitted from the respective Chief Officer to a future meeting of the Panel. 2. Quarterly performance assurance review 2.1 The Strategic Performance Framework - Performance Reporting Schedule sets out several aspects of performance reporting. As part of this, paragraphs 2.2 to 2.6 itemise the performance reports submitted to cycle 2 committees in accordance with the timetable set out in the Schedule. (1) Chief Officer’s individual Performance Reviews at Service Committees in line with the Strategic Performance Framework. (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. (1) Chief Officer’s individual Performance Reviews at Service Committees in line with the Strategic Performance Framework. 2.2 The Strategic Performance Framework comprises a range of performance indicators from each Chief Officer’s portfolio and the latest results in this respect are aligned to the respective ambition statements in The Plan for North Lanarkshire. The four reports previously submitted to the relevant committee in cycle 2 of 2024 are listed in Table 1 below, along with the corresponding hyperlink for ease of access. Table 1 Report title Committee Date Strategic Performance Framework - latest performance results for Housing Management link to report Housing Committee 8 May 2024 Page 7 of 126
Page 8
Strategic Performance Framework - latest performance results for Housing Property Services link to report Housing Committee 8 May 2024 Strategic Performance Framework - latest performance results for Community Operations link to report Environment and Climate Change Committee 1 May 2024 Health and Social Care North Lanarkshire performance update - Quarter 3 (October to December 2023) link to report IJB Performance, Finance and Audit Committee 22 May 2024 2.3 Each council report was produced in line with a standard template and (a) provides the reader with the current context within which the service is operating, (b) highlights areas of good performance that can be evidenced in the accompanying data, and (c) provides a summary of areas of performance requiring improvement along with narrative that gives an explanation for the level of performance achieved and summarises the remedial action implemented (or to be implemented) to bring performance back on track. 2.4 A short summary analysis for each of the four reports is set out in Appendix 1 against the five non-negotiable standards. (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. 2.5 This aspect relates to service specific reporting which is required to meet business and/or statutory obligations. This is included in the Performance Reporting Schedule to ensure all the council’s performance reporting arrangements are captured in the one place and the Schedule reflects a one council approach to performance reporting. 2.6 The five reports previously submitted to the relevant committee in cycle 2 of 2024 are listed in Table 2 below, along with the corresponding hyperlink for ease of access. A short summary for each of these reports is set out in Appendix 2. While this summary is set out against the five non-negotiable standards it recognises there may also be statutory specific approaches or other standards which also require to be adhered to. Table 2 Report title Committee Date Annual Building Standards performance 2023/24 link to report Submitted to the Scottish Government Published on council website on 16 April 2024 Attainment and improvement update link to report Education, Children, and Families Committee 21 May 2024 Revenue and benefits update link to report Finance and Resources Committee 22 May 2024 Financial monitoring report - council summary (revenue) link to report Finance and Resources Committee 22 May 2024 Financial monitoring report - council summary (capital) link to report Finance and Resources Committee 22 May 2024 Page 8 of 126
Page 9
Next steps 2.7 Assurance reviews will continue to be undertaken and reported to the Audit and Scrutiny Panel on a quarterly basis in order to maintain the measures of success set out in paragraph 3.1. 2.8 The content of these quarterly assurance review reports will be informed by the updated Reporting Schedule for 2024 to 2025 which was at the Audit and Scrutiny Panel meeting in February 2024. This set out the performance and progress monitoring information timetabled to be reported to various council committees in each cycle of 2024 to 2025. 2.9 Reports submitted to the respective committee (in line with the Schedule) will continue to be kept under review by the senior management team of the council so that adherence to the timetable is maintained. This will also seek to ensure the relevant assurances in terms of the efficient and effective operation of the council and that the ongoing delivery of the long-term ambition set out in The Plan for North Lanarkshire is underpinned with corporate governance, risk management, and financial management controls. 3. Measures of success 3.1 Measures of success include: • Regular oversight and monitoring of performance across the organisation to gain assurances in terms of governance and accountability. • Regular review and challenge processes to scrutinise the performance of the council to ensure effective use of resources and that resources are directed in accordance with agreed policy and according to priorities, while ensuring sound decision making and clear accountability for the use of resources in achieving improved outcomes for service users and the local community. • Performance monitoring, management, and reporting arrangements that support the demonstration of improved performance in local services and outcomes, and the delivery of Best Value. 4. Supporting documentation Appendix (1) Chief Officer’s individual Performance Reviews at Service Committees in line with the Strategic Performance Framework. Appendix (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. Katrina Hassell Chief Officer (Business and Digital) 5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Page 9 of 126
Page 10
Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? The Local Government Act 1992 established the role of the Statutory Direction to direct councils in terms of the “publication of information as to standards of performance”. The Local Government in Scotland Act 2003 introduced the duty of Best Value; this requires that councils “make arrangements to secure continuous improvement in performance”. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Page 10 of 126
Page 11
Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Implementation of the Schedule, which aims to facilitate effective review and scrutiny processes, contributes to the mitigation of the risk on the Corporate Risk Register for governance, leadership, and decision making. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 11 of 126
Page 12
Appendix 1 (1) Chief Officer’s individual Performance Reviews at Service Committees in line with the Strategic Performance Framework (SPF). Report title Summary SPF - Latest performance results for Housing Management May 2024 Housing Management have 14 indicators in the Strategic Performance Framework covering all aspects of the council’s social landlord role. As set out in the council’s Local Housing Strategy 2021-26 (approved in November 2021), there are an estimated 157,625 dwellings in North Lanarkshire, with home ownership remaining the predominant tenure and 63% of households owning their own home. The council is the largest local authority landlord in Scotland and almost a third (29.5%) of households rent from a social landlord (23.3% from the council and 6.2% from other social landlords). The Local Housing Strategy 2021-26 recognises that an affordable, warm, and accessible home (that meets individual needs over the course of a person’s life) is the foundation for people to achieve their full potential in all aspects of life, including educational attainment and employment. Housing also plays a crucial role in addressing homelessness, tackling poverty, mitigating the impacts of climate change, improving health and wellbeing, and promoting inclusive growth. Aligned Priority: • Improve economic opportunities and outcomes. Ambition statement: 1. Ensure a housing mix that supports social inclusion and economic growth. Consistent The pre-defined template was used to ensure a standard, easily recognisable, and well established process across each different audience over time. The use of this template aims to help build credibility, reliability, and a common understanding. Transparent RAG indicators: Page 12 of 126
Page 13
In context • Financial pressures continue to be experienced by tenants due to the rise in the cost of living. The rent assistance fund, introduced in February 2023, continues to be used to help council tenants who may be on low incomes or universal credit and who don’t currently qualify for any other UK or Scottish Government financial support, and who are struggling to pay their rent. To date, 1,660 tenants have been assisted with this fund. • As at May 2024, four Scottish councils had recently declared a housing emergency due to the increased pressure on homeless services and temporary accommodation provision. North Lanarkshire is not in the same position at this time, but there has been a marked increase in homeless presentations within the area and a significant increase in the level of new Common Housing Register applications. Nevertheless, the council is still able to meet and discharge its legal obligations in relation to homelessness and the provision of temporary accommodation for those who require it, but this is an area that continues to be closely monitored to assess the levels of homelessness and adjust service provision as required. • In August 2023, a new tenant survey was completed to assess satisfaction with the services that the council provides; this involved surveying tenants from each locality occupying all types of housing stock. The methodology for this went back to the face to face method used prior to the pandemic and the results (reported to committee in November 2023) show a range of positive outcomes when compared with the previous survey carried out in 2021, revealing that the majority of tenants are very or fairly satisfied with the services provided. Balanced Performance highlights: • The percentage of rent lost through properties being empty improved to 0.89% in 2022/23 (from 1% reported in 2021/22) and 2023/24 figures show further improvement to 0.82%, which is below the target expected for the year of 1%. The council’s performance in this area has consistently remained lower than the family group of similar councils (1.3%) and the national average (1.7%) and North Lanarkshire is ranked 4th in this indicator out of the 32 local authorities in Scotland. • Lets to homeless in 2022/23 amounted to 40.5% of all lets made in the year; this is higher than the target of 37% and year to date performance in 2023/24 has reached 42.6%. This higher percentage of lets has increased because of the higher level of homeless presentations being experienced in the past two years. • The level of satisfaction with the quality of temporary or emergency accommodation has remained consistently high over the years, with the latest figures for 2023/24 showing 97.9%, an improvement from 96.3% in 2022/23 and higher than the target of 94% which has been increased to 95% in 2024/25 as a result. The work of the service to continually review the quality of furnishings and fittings in these accommodations, as well as a high level of decoration in each property, is reflected in this consistently high level of performance. • Tenant satisfaction results also show improvements in other areas of the housing service: - The percentage of tenants satisfied with the overall service provided by their landlord has improved to 86.6% in 2023/24 (from 81.2% in 2022/23); this is higher than the national local authority average of 83.2%. - The percentage of tenants satisfied with the quality of their home increased to 87.3% in 2023/24; higher than the national local authority average of 81.8%. - The percentage of tenants satisfied with the opportunities given to them to participate in their landlord’s decision-making processes remains high at 96.8%, higher than the national local authority average of 76.5%. Areas of performance requiring improvement: • The percentage of decisions made within 28 days for all households presenting as homeless is below the target of 95% at 93.5%. The percentage of decisions made within 28 days for households under 25 years old presenting as homeless is below also below the target of 95% at 91%. These figures reflect the transient nature of the client group, where maintaining contact to allow staff to make decisions within timescale can be difficult. The increase in workload due to the increase in homeless presentations is also having an impact. Training and support continue to be delivered to housing advisers and monthly audits are taking place to improve this area of service. Overall, there has been a 16.7% increase in homeless applications year to date. • The average number of days to re let empty properties has increased to 35.1 days in 2023/24, up 2.8 days on the 2022/23 outturn due to a number of factors for which regular liaison between housing management and housing property and the main repair contractor is ongoing with weekly and daily monitoring of vacant properties taking place. Report title Summary SPF - Latest performance Housing Property Services have 12 indicators in the Strategic Performance Framework covering all aspects of the housing property and Page 13 of 126
Page 14
results for Housing Property Services May 2024 maintenance service. As Scotland’s largest local authority landlord, the council provides warm, secure, affordable homes to more than 36,000 households across North Lanarkshire. As set out in the Housing Asset Management Plan (HAMP) 2021-26 (approved in February 2021), improving, maintaining and repairing homes are core asset management activities. Maintenance refers to routine activities to prevent damage and extend the lifespan of property components (like roofs, windows, and doors) and ensure that homes are safe, and repairs are carried out to fix any defects in a property. Improvements are delivered through the investment programme, which generally focuses on replacing old components with new ones - for example, by installing new kitchens and bathrooms. Like all social landlords, the council has legal duties to repair and maintain its homes and meet obligations set out in tenancy agreements and statute. This is reflected in the importance given to maintenance and repair matters in the Annual Return on the Charter (ARC), a yearly exercise co- ordinated by the Scottish Housing Regulator to assess social landlords’ performance. Landlords must report on over 30 separate performance indicators, many of which directly relate to the condition of homes and how they are managed. Aligned Priority: • Improve economic opportunities and outcomes. • Improve North Lanarkshire's resource base. Ambition statement: 1. Ensure a housing mix that supports social inclusion and economic growth. 22. Facilitate a North Lanarkshire wide approach to asset rationalisation, including with communities and partners. Consistent The pre-defined template was used to ensure a standard, easily recognisable, and well established process across each different audience over time. The use of this template aims to help build credibility, reliability, and a common understanding. Transparent RAG indicators: In context • The service continues to deliver and manage its contractors across multiple work disciplines, engaging with multiple stakeholders to discuss any service related matters. Balanced Performance highlights: • The latest repairs timescale for completing emergency repairs within council housing stock for all 3 linked contractors continues to improve, with a 2023/24 year to date average of 2.19 hours, less than the target of 3.75 hours, previous year’s performance (3.31 in 2022/23), and the national local authority Page 14 of 126
Page 15
average of 4.2 hours. • Latest performance for non-emergency council housing stock repairs is 6.4 days, lower than the target of 7 days, previous year’s performance of 6.8 days (for 2022/23), and the national local authority average of 8.7 days. • Corporate property repairs performance continues to improve with the percentage of routine repairs completed within timescale at 98.7% in 2023/24 to date, with an average time to complete routine repairs at 9.4 days (lower than the target of 9.9 days which has subsequently been reduced to 9.5 days for 2024/25). Areas of performance requiring improvement: • The corporate property repairs indicator for the percentage of emergency repairs completed within timescale is 97.5%, this is slightly lower than the 98% target, however it is an increase in the year end outturn for 2022/23 (which was 96.9%). The average time in hours taken to complete emergency repairs is 0.5 hours above the 3.1 hour target. Remedial actions include having weekly meetings with contractors where issues are highlighted at the earliest stage to allow proactive resolution. • A report was reviewed by the Audit and Scrutiny Panel at the meeting in May 2024 which provided a deeper dive into why the performance has dropped for the following performance indicators - % of council dwellings meeting the Scottish Housing Quality Standard (SHQS) and % of council dwellings that meet the Energy Efficiency Standard for Social Housing (EESSH). No subsequent actions for improvement were identified following this review. Report title Summary SPF - Latest performance results for Community Operations May 2024 Community Operations has 38 indicators in the Strategic Performance Framework which assess efficiency and effectiveness in terms of service delivery on a day to day basis. A suite of statutory indicators also enables performance, costs, and satisfaction to be assessed and compared nationally. Following the structural realignments in the One Place One Plan - Governance update report approved at Policy and Strategy Committee in December 2022, a single Community Operations service was created to strengthen the council’s delivery of community operations and put people and communities at the heart of the change that The Plan for North Lanarkshire aims to achieve. This realignment brought a wide range of community facing services in relation to the council’s environmental assets (i.e. Street Cleaning, Grounds Maintenance, Cemetery Services, Roads Maintenance Operations, and Country Parks for the Future) together with regulatory services (i.e. Environmental Health and Trading Standards), and services in respect of Waste Solutions, Fleet Resources, and the Built Environment. Aligned Priority: • Improve the health and wellbeing of our communities. • Enhance participation, capacity, and empowerment across our communities. Ambition statement: 14. Ensure the highest standards of public protection. 16. Transform our natural environment to support wellbeing and inward investment and enhance it for current and future generations. 17. Ensure we keep our environment clean, safe, and attractive. Consistent The pre-defined template was used to ensure a standard, easily recognisable, and well established process across each different audience over time. The use of this template aims to help build credibility, reliability, and a common understanding. Transparent Benchmarking indicators: • Parks and open spaces - cost per 1,000 population • Satisfaction - % of adults satisfied with parks and open spaces • Street cleaning - net cost per 1,000 population • Satisfaction - % of adults satisfied with street cleaning services • Roads - cost of maintenance per kilometre of roads • Road network - % A class roads that should be considered for maintenance treatment • Road network - % B class roads that should be considered for maintenance treatment • Road network - % C class roads that should be considered for maintenance treatment • Road casualties - number of fatal and serious casualties • Road casualties - number of fatal and serious casualties involving children • Environmental health - cost per 1,000 population • Street lamps - energy usage Page 15 of 126
Page 16
• Street cleanliness score - % areas assessed as clean • Satisfaction - % of adults satisfied with refuse collection • Road network - % Unclassified roads that should be considered for maintenance treatment RAG indicators: In context The service’s operating environment has changed significantly in recent years and, as such, the performance should be considered within the context of the following: • The extent to which the service has supported the council in terms of responding to and recovering from the pandemic over the years from 2020, while maintaining service delivery of critical areas of public health and safety in line with legislation, and then resuming business as usual activities at pace which involved dealing with significant volumes in terms of a backlog. • In resuming business as usual activities, many areas of the service have experienced a subsequent increase in the volume of business which has added to the caseloads which require to be dealt with (e.g. in environmental health). • The food law recovery plan and related inspection regime implemented in the aftermath of the pandemic has impacted on food business inspection visits and required changes to processes and ways of working. • A significant rationalisation exercise across the waste service has allowed consolidation of the service within key depot facilities. It is intended that this will result in overall efficiencies for the service with space being freed up for other service areas to consolidate their own facilities and ultimately provide a capital receipt for the council through the sale of any depot deemed surplus to requirements. • There is currently an ongoing review of the overall structure of the Community Operations service to ensure that any opportunities and service efficiencies Page 16 of 126
Page 17
with the recent amalgamation of the two service areas are highlighted and maximised. Balanced Performance highlights: • The council’s performance in respect of A class roads (i.e. major and strategic roads) and B class roads (i.e. roads serving a local purpose and connecting to strategic roads) which are considered to require maintenance treatment continues to remain lower than the averages for Scotland and the family group of similar councils: - Less than a quarter (21.3%) of A class roads in North Lanarkshire are considered to require maintenance treatment compared to the Scottish average (27.4%) and the family group of similar councils (23.6%). - 22.5% of B class roads in North Lanarkshire are considered to require maintenance treatment compared to the Scottish average (31.5%) and the family group of similar councils (24%); this is the eighth lowest in Scotland. • Performance for the council’s refuse service shows a positive picture in the round with refuse disposal costs remaining low, satisfaction levels in terms of the refuse collection service showing improvement, and recycling rates increasing. Recent years have seen an increase in the proportion of household waste that is recycled in North Lanarkshire, with rates reaching 43% in 2022 and 46.6% in 2023. Recycling rates in North Lanarkshire are now higher than the national average (43.3%) and show improvement over the period of The Plan for North Lanarkshire (from a baseline rate of 41.1% in 2016/17). • Refuse collection costs in North Lanarkshire (£88.62) remain lower than the council’s target as well as the national average (£95.28). While satisfaction levels in North Lanarkshire had shown a downward trend up to 2021, this has subsequently seen two consecutive years improvement; this trend is also reflected in the family group average. Areas of performance requiring improvement: • The volume of requests for high priority pest control visits continued to remain high during 2021/22 and 2022/23 prior to the end of the provision of the free rodent control service. Volume levels in 2023/24 to date have subsequently decreased in respect of private homes, for which the pest control service charge was reintroduced, but still remain above previous years’ trends for service requests in respect of council housing stock. • Performance for 2023/24 to date in respect of completion certificates and building warrants remains below target, however both these service areas have experienced a significant improvement over the year. This follows a prolonged period of high demand volumes combined with increased customer expectation around the completion of projects and extent of on-site activities as well as challenges around the recruitment process, long-term absences, support issues, and system outages all contributing to lower than target performance. It is anticipated this level of improved performance will continue, but this will be monitored. • The service’s indicator for the cost of maintenance per kilometre of roads (prepared by the Improvement Service through the Local Government Benchmarking Framework (LGBF)) reported an increase in spend during 2021/22 and 2022/23 that is counter to the long-term downward trend pre- pandemic. This trend is also recognised across Scotland for roads and the national LGBF overview publication reports that it is expected that increased expenditure reflects a resumption in activity that had been deferred during the pandemic. • Overall, the performance results available through the LGBF suite of indicators represents a mixed picture across all councils in Scotland. The national LGBF overview publication recognises general trends across Scotland, for example, in terms of a growing cluster of statutory local government professional roles facing workforce shortages, with complex structural issues within the skills system in Scotland now directly impacting on a range of critical statutory areas, including planning, environmental health, trading standards, and building standards. In addition, in some instances councils have sustained and strengthened improvement trends in a number of policy critical areas. In other areas (particularly those community related services) there has been a decline which has often been caused, or exacerbated, by the pandemic; this includes areas which were previously improving pre-pandemic (such as street cleanliness levels). For North Lanarkshire the street cleanliness score has recently shown improvement, increasing from 86.1% in 2022/23 to 91.2% in 2023/24; this is higher than the family group average for similar councils (90%) and just below the national average (92.1%). Report title Summary Health and Social Care North Lanarkshire performance update - Quarter 3 (October - December 2023) The Chief Officer (Health and Social Care North Lanarkshire) has joint quarterly performance review meetings with the Chief Executives of NHS Lanarkshire and North Lanarkshire Council. These meetings are supported by a Chief Executive’s Performance Framework which comprises a range of performance measures taken from across both the health and social work systems, including relevant targets and trajectories for the measures presented. Page 17 of 126
Page 18
May 2024 Each quarter there are areas for improvement identified within the performance framework; these are identified using a RAG rating and those measures that are flagged as Red or Amber are subject to improvement or corrective action. The performance review meetings are used as a means for jointly agreeing these actions. Aligned Priority: Improve the health and wellbeing of our communities. Ambition statement: 12. Ensure our residents are able to achieve, maintain and recover their independence through appropriate supports at home and in their communities. 13. Improve preventative approaches including self-management and giving people information and choice over supports and services. 14. Ensure the highest standards of public protection. Consistent A pre-defined Health and Social Care Partnership template is in place to ensure a standard, easily recognisable, and well established process for quarterly reporting on areas for improvement. Transparent Based on a traffic-light system there are areas for improvement identified within the performance framework each quarter for those areas that are flagged as Red or Amber. The areas for improvement identified are progressed as a matter of priority, and progress updates are reported at future meetings of the Integrated Joint Board and/or the Integration Joint Board Performance, Finance, and Audit Committee as appropriate. In context • The joint performance review meetings (involving the Chief Officer for the Health and Social Care Partnership, the Chief Executive of NHS Lanarkshire, and the Chief Executive of North Lanarkshire Council) are used as a means for jointly agreeing corrective actions within the current operating environment. • The report describes the progress that has been made in pursuit of the national health and wellbeing outcomes and recognises that this progress has been made against a challenging position of recovery and remobilisation of services following the pandemic, which is reflected in the performance in some of the metrics presented in the report. Balanced The purpose of the report is to provide an update on the areas for improvement what have been identified as part of the quarterly performance review. The quarter 3 report (for October - December 2023) sets out corresponding narrative and corrective actions agreed for the areas identified for improvement; the narrative and corrective actions are summarised below. • Cervical screening - Analysis on uptake for cervical screening shows the rate for North Lanarkshire appears to be stable in the six localities, although none have achieved the recommended target of 80% and the overall trend is for a slow decline in performance. It is important to note that in addition to variation by locality, there can be significant variation by practice(s), with the leadership, direction, and resourcing of the practice(s) likely playing a significant role in their rates for screening. Q3 covers the winter period and traditionally winter pressures have a detrimental impact on screening appointment availability, access and attendance rates. Engagement projects and meetings with health teams and GPs have been put on motion, and a small amount of capacity was released to provide support for GP practices to identify any areas for improvement in their uptake for cervical screening that could assist in achieving the national uptake target of 80%. A questionnaire was developed to establish processes in place for cervical screening and identify further support to improve access to services. • Children immunisations - The metric for 2-year-old immunisations has improved and has remained a green RAG status for two consecutive quarters. In Q3 there has been slight increases in uptake for both the 2-year-old and 5-year-old metrics. Since the last update, the management team have started to develop joint-working initiatives with the council’s education colleagues for both school and nursery age children. This aims to maximise the opportunities for engagement with parents regarding vaccinations, increase and enhance access, and ultimately improve immunisation rates through shared communication and event planning. It is of note that in the wider context for immunisations, there is lower than expected uptake for both the Covid and flu vaccine, and with measles outbreaks currently being experienced anecdotal evidence suggests that public attitudes and behaviours toward vaccinations appear to be changing. As such, changing public attitudes and behaviours may have some bearing on uptake for childhood immunisations. • 6-8 week reviews - These appointments are an important opportunity for parents to speak with a health visitor to discuss their baby's development and progress, as well as their own health and wellbeing. In Q2 continued improvement can be seen in the overall performance for this metric following a range of improvement actions which included deep dives of the historical data to better understand the decline in performance which identified inconsistency in Page 18 of 126
Page 19
operation across GP practices and less effective communication between health visitors and some GP practices, as well as administrative errors characterised by the lack of an applied standardised process for recording, returning, and storing of records. The demand for health visiting services and the impact of the Health and Social Care Staffing Act on capacity increases the need to utilise digital solutions to enhance the efficiency and sustainability of the service - there is a national programme to move to an electronic recording solution, however this is not expected to be delivered until 2025. • Reablement and rehabilitation - During Q3, there were more service users starting the reablement process than in previous quarters in 2023/24 with the service supporting in excess of 500 people; this is the level of service that had been targeted prior to the pandemic and reflects the significant effort and progress in enhancing the reablement service in North Lanarkshire. Since the creation of the home assessment teams in April 2022 there have been 1,658 referrals accepted. Following the establishment of the home assessment teams, there was a natural, gradual build and expansion of the team and this is reflected in the gradual build-up in the volume of referrals. As the teams have become more established, their ability to accept more complex cases and fully support the multi-disciplinary team working that is required has increased and now presents a true home first approach to rehabilitation for the patient. As more complex cases were being accepted in 2023/24, the proportion of people recorded as completing the service with no further service required decreased. In addition, it can be seen from monitoring delayed discharges that the home assessment team approach is improving flow. • CAMHS - While there has been a sustained recovery in performance (in respect of child and adolescent mental health services) since August 2023 further work is required to assure the continuance of positive progress in line with the performance trend. Although embedded as standard practice, the service continues to monitor the impact of the choice and partnership approach (CAPA) and the waiting list initiative (WLI) to ensure that it is addressing ongoing challenges around the target and that appointment capacity is maximised across the whole system. Analysis of the management data is currently underway, specifically around levels of attendance, with a particular focus on rates around the holiday seasons, to see whether any patterns in the data can inform future improvement activity • Adult mental health - For adult mental health services, psychiatry performance continues to be impacted by significant challenges around the recruitment and retention of staff which is a national issue. Currently staff are working in an environment with reduced staff availability but increased demand levels; in Lanarkshire, ADHD cases are considered to be the most significant area of increased demand. The Scottish Government published their Core Mental Health Quality Standards in September 2023 which sets out the vision for Scotland to achieve the best mental health and wellbeing possible; this is built around a clear national framework with themes informed by people with lived experience of using mental health and psychological services. The aforementioned challenges are impacting on the ability to adhere to these standards and a range of actions are ongoing to address operational planning and business continuity for the services, this includes escalation to senior medical management and the NHS Lanarkshire executive, ensuring ongoing management of risk across this area, actions being mitigated in terms of the low staffing levels while still allowing for the cover of core work, and bespoke recruitment and documenting a recruitment and retention strategy. To deal with demand and capacity issues within general adult psychiatry, notably the significant increase in the number of referrals for assessment and treatment of ADHD, it is NHS Lanarkshire’s intention to create an adult neurodevelopmental pathway. In addition, an options appraisal has been commissioned to consider the future models of care in general adult psychiatry and a Programme Board will monitor and co-ordinate all of the relevant improvement work streams within the service. • Medial paediatrics - Waiting times in respect of medical conditions affecting young children, infants, and adolescents have seen considerable improvement since the position at Q1 at the beginning of 2023/24. Performance earlier in the year had been adversely affected by long-term absences and the diversion of staff resource to cover acute care. Through significant efforts, and focus on making best use of available resource, the position has been recovered and the general waiting list has significantly improved. The future service model is being designed to deliver a sustainable medical paediatric consultant workforce that is capable of delivering the core work of a district general attached community paediatric service. Naturally occurring vacancies within the workforce, and a greater understanding of the challenges, have presented an opportunity to consider how to efficiently use the workforce to maximise capacity without compromising quality of care. • Speech and language therapy paediatrics - Speech and language therapy paediatrics continues to face challenges to meet the waiting times target and an improvement plan with several independent workstreams is being implemented to address six key areas, including communication and engagement, waiting list improvement work, accommodation, HR and workforce, administration and digital, and the focus for e-health options. All of the work streams are at different stages of progress, although it should be noted that not all need to proceed in a linear way. However, it is recognised that service improvement activity is the highest priority and first and foremost in this respect is a focus on improving the waiting time position and through work to scope service capacity, a range of specific solutions are in the process of being developed and implemented to support delivery of the future service model. • Dietetics - Following the significant reduction in the level of performance in Q2, a similarly significant improvement has been realised for Q3. The overall long-term trend is for improving performance, however further analysis is required to understand any cause / effect relationship with wider system factors, Page 19 of 126
Page 20
as the service continues to be restricted by an approximate 20% reduction in the available workforce, which is due to both long-term sickness and sustained vacancies. Although recruitment activity continues, as with many services dietetics has difficulty in attracting suitably skilled and experienced staff due to lack of available workforce nationwide. • Adult social work - The number of adult protection support referrals received by localities continues to rise with care homes remaining the primary source of referrals. However, it is important to recognise that the volume of referrals does not automatically equate to the number of adults at risk of harm. Work continues to be undertaken with care homes and relevant stakeholders to promote high-quality adult support protection referrals and defensible decision- making based on a good understanding of risk, harm, and the impact (or lack-of) this has on the adult being referred, and ultimately whether this is the correct referral route to take. As such, caution is always applied when interpreting adult support protection investigation and case conference data. The performance database shows a relatively low conversion rate for both in comparison to information gathered via locality trackers. An ongoing audit is being completed to establish why this is the case and to rectify any issues identified. Police adult concern reports continue to rise and these, combined with adult support protection referrals, generate a significant body of protection work that is undertaken by localities to keep adults in the community safe. The quarterly NHS Lanarkshire public protection newsletter was published in Q3 and is a key tool to help raise awareness with health colleagues, as are briefings sessions for managers and multi-agency bespoke adult support protection training. Appendix 2 (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. Report title Summary Annual Building Standards performance April 2024 The building standards profession in local authorities is responsible for delivering the verification service in Scotland. The purpose of the building standards system is to protect the public interest. The system sets out the essential standards that are required to be met when building work or conversion of a building takes place in order to meet building regulations. The building standards system checks that proposed building work or conversion of a building meets standards; inspections are limited to a minimal necessary to ensure that legislation is not avoided. The control of work on site is not down to the system but is a matter for contracts and arrangements in place between a builder and client. Verifiers, appointed by Scottish Ministers are responsible for the independent checking of applications for building warrants to construct or demolish buildings, to provide services, fittings, or equipment in buildings, or for conversions. The verification report is a strategic planning and management tool that provides information about the council’s building standards service, communicates the vision and strategy, and sets out performance against strategic goals and targets. Building standards verifiers in Scotland are required to use the performance report to manage, monitor, review, and develop strategies for their business, and should focus on the performance framework’s core perspectives and cross-cutting themes. Aligned Priority: Improve the health and wellbeing of our communities. Ambition statement: 14. Ensure the highest standards of public protection. Consistent • The report is produced annually in a consistent format. It includes information on service delivery, the timescales and targets to be met, and performance against these. Verifiers are required to provide returns to Scottish Government on both their performance and workload - the performance data relates to the building standards verification performance framework while the workload data relates to the numbers of building warrant applications, completion certificates, fees, costs, certificates (certification, energy performance, sustainability), and enforcement cases. • The report also provides information regarding the Building Standards Charter which sets out the standards of service that all verifiers should meet. • This gives customers the reassurance that a consistent, high-quality service will be delivered no matter which verifier provides the service. • All building standards annual performance reports are required to be produced using a template provided by the Scottish Government, the contents of the latest report on the council’s website refers to the level of performance achieved in 2023/24 albeit that the national template which was provided for use says 2024/25; this differentiation was highlighted by the service. Page 20 of 126
Page 21
Transparent • The national verification performance framework is based on three core perspectives (professional expertise and technical processes, quality customer experience, and operational and financial efficiency). There are also three cross-cutting themes - public interest, continuous improvement, and partnership working. The annual report is structured around this framework. • 7 performance outcomes are highlighted within the report and 10 performance targets are in place to assess performance and progress against these outcomes. The report has a dedicated section outlining the latest performance data against the targets along with supporting narrative. In context • The report sets out the place-based context within which the building standards service is delivered across North Lanarkshire (i.e. the main employment sectors) as well as the operating context within the council. As part of the Built Environment team in the council, Building Standards helps to support and enable the delivery of local growth, making North Lanarkshire an attractive business location, improving employment opportunities, encouraging strong sustainable communities, and enhancing and protecting the natural and built environment. Balanced • As well as the performance results, the report highlights actions completed within the last year (2023/24) together with a number of continuous improvement actions which will be implemented in the forthcoming year (2024/25); these cover the three core perspectives of professional expertise and technical processes, quality customer experience, and operational and financial efficiency • These actions are aligned to the respective performance outcomes and indicators in order to ensure improvements implemented can be assessed in terms of performance on the ground in the future. • Verifiers are required to provide returns to Scottish Government on their verification performance and workload. The performance data relates to the building standards verification performance framework and the workload data relates to the numbers of building warrant applications, completion certificates, fees, costs, certificates (certification, energy performance; sustainability), and enforcement cases. Data for 2023/24 in this respect is summarised below: - Building warrants and amendments to building warrants: 1,618 applications and 1,280 decisions. - Completion certificates: 2,308 submissions and 2,177 decisions. - Certification: 683 certificates of design submitted and 80 certificates of construction submitted. - Energy Performance Certificates (EPCs): 907 copy certificates received (domestic) and 15 copy certificates received (non-domestic). - Statements of sustainability: 813 copy certificates received (domestic) and 13 copy certificates received (non-domestic). - Enforcement: 10 notices served under sections 25-30, 0 cases referred to procurator fiscal, and 8 cases where local authority has undertaken work. Report title Summary Attainment and improvement update May 2024 Local authorities have a duty to improve standards in education, challenging and supporting educational establishments to ensure continuous improvement. The council’s quality improvement (QI) framework, updated in session 2022/23, empowers school leaders to secure continuous improvement while providing assurance to stakeholders on the quality of education provided for learners. This report outlines a range of key strategies implemented to further support the QI framework and facilitate improvement across North Lanarkshire’s educational establishments. Where applicable, it outlines impact, progress to date, and planned next steps. The report also includes progress associated with the use of the Strategic Equity Fund (SEF). Aligned Priority: Support all children and young people to realise their full potential Ambition statement: 6. Raise attainment and skills for learning, life, and work to enhance opportunities and choices. Consistent • This report follows on from the annual education performance reports to Committee in November 2023 (Scottish Attainment Challenge and Education Standards and Quality) which, respectively, provided an update on progress of the Scottish Attainment Challenge programme within North Lanarkshire and outlined the next steps to build stronger linkages between services to support children and young people, raise attainment, and help close the poverty related attainment gap, and brought together the key highlights in respect of improving life chances for the children, young people, and communities of North Lanarkshire in line with the 6 National Improvement Framework (NIF) drivers and against the council’s improvement priorities to measure how well educational outcomes for children, young people, and their families are being improved. • This report also updates on progress in respect of improving attainment, following the report to Committee in December 2023 which saw the realignment of Page 21 of 126
Page 22
non-education and families related functions to wider service areas to create additional educational capacity within education to further focus upon the key areas of attainment and attendance which are of national and local importance. Transparent By providing an update in terms of the improvements implemented across the educational service in respect of attainment, this report expects that over time these improvements will evidence a number of measures of success (including increased attainment at primary and secondary stages, improved curriculum pathways with a clear focus on skills progression, high quality learning, teaching, and assessment across all establishments, and improved staff skills, confidence, and ability). In context • The report advises of the development of a Raising Attainment Strategy (which is attached as an appendix to the report). While there is a pattern of improving attainment in North Lanarkshire schools, particularly at the primary stages it is recognised that there is scope to further raise attainment and improve outcomes for learners. There is also a need to ensure that the identified gaps in attainment are being better understood and addressed within the wider backdrop across North Lanarkshire, i.e. the cost-of-living crisis, improving attainment and addressing the poverty related attainment gap, improving pupil attendance, and engaging families who have significant health and wellbeing issues. • Within this context, the Raising Attainment Strategy aims to align key strategies and approaches to be implemented to raise attainment and close the poverty related attainment gap. The strategy contains clear measures and outcomes which will be used to evaluate the impact of delivery. • The key facets of the strategy are leadership and management (how good is our leadership and approach to improvement?), learning provision (how good is the quality of care and education we provide?), and successes and achievements (how good are we at improving learning outcomes for all our learners?) Balanced The report provides an update in respect of a wide range of aspects of education, this is summarised below: • Leadership: During 2023/24 establishment leaders were offered the opportunity to engage in professional learning to develop their ability to effectively use self-evaluation to support continuous improvement. Almost all secondary headteachers have now completed this training and a rolling programme for primary headteachers is currently underway. • Curriculum: To date, 77% of primary headteachers and 87% of secondary headteachers have engaged with the curriculum content toolkit (approved in September 2022) which was introduced as a strategic approach to reviewing and refreshing curriculum rationales and pathways. • Review of secondary attainment reviews: Education and families managers are currently leading a review of the approach to secondary attainment reviews to build capacity and ensure that establishments are prepared for internal and external scrutiny by the local authorities Validated Self Evaluation (VSE) process or HMIE inspection. This model is intended to empower headteachers to evaluate progress fully and accurately and to develop their ability to collaborate and engage in robust professional dialogue that supports continuous improvement. • Faculty heads: Central officers have planned and delivered three sets of continuing professional learning sessions for secondary curricular faculty heads during 2023/24 and these sessions are continuing into 2024/25. These sessions have focused on themes for school, improvement, i.e. data analysis, curricular development and learning, and teaching and assessment and have provided a forum for discussion, sharing good practice, providing support, and setting out the challenge in the council’s expectations for excellence. This approach will be further bult on to support improvements at subject level. • Performance information: Recognising the need to use data effectively to inform and underpin strategic improvement work at establishment and service level, work has continued to review and refresh the approach to analysing performance information to maximise its effectiveness. Clear processes are now in place to monitor performance across a range of measures including attainment, attendance, and exclusion. Monthly attendance reports are in place to provide a focus on pupil attendance, and this is resulting in a small but significant improvement in the performance figures - the most recent figures show that attendance for the month of December was significantly higher than the corresponding month last year which is encouraging as December has historically lower attendance rates which usually impacts on the annual figures. As part of the renewed focus on attendance, all schools now have set improvement targets and family engagement support assistants are working across clusters to provide a family support approach to improve outcomes for learners. • Strategic use of resources - empowering clusters: This model is recognised as a key function in ensuring integrated partnership working that is centred around the wellbeing of children, young people, and their families. Key successes in relation to this model show that 1,531 learners were supported through the empowering clusters model between August and December 2023, 956 children, young people, and families were supported by cluster support teachers or cluster inclusion and integration leads across the 23 clusters, and 2,442 sessions were planned for children, young people, or families at additional or intensive level, with an 84% average attendance rate. • Scottish Attainment Challenge: In cognisance of reducing budgets, the core models for 2023/24 and 2024/25 involved prioritising the identification and Page 22 of 126
Page 23
deployment of resources to provide targeted support to schools and clusters to raise attainment and improve pedagogical approaches through continuous lifelong professional learning, coaching, and modelling. • Interim evaluation of the impact of the new Learning Hub operating model learning hub team: The new model now enables the council to provide universal, additional, and intensive support to all establishments in literacy, numeracy and learning, and teaching and assessment approaches alongside support within health and wellbeing. This holistic approach involves the Education Support Officers and Pedagogy team working closely to ensure that consistent messages are delivered around best classroom practice which aims to bring to life highly effective teaching, learning and assessment, and research based pedagogical approaches to literacy and numeracy. In addition, the learning hub team provide annual intensive training to a wide range of new groups of staff. Full details in respect of learning hub activity is available to view in an appendix to the report. • Future plans - literacy: A review by the Robert Owen Centre of the active literacy programme (which focused on reading, spelling, and phonics) concluded that the programme continues to remain an effective theory informed approach. To build on this, further work will be undertaken during 2024/25 to review the council’s approach to extended taught writing which will align with the focus on P4 writing as a core stretch aim. In addition, in cognisance of the increase in expressive language delay in young children, the team are working alongside a range of professionals, including the Robert Owen Centre, psychological service, and speech and language therapists to pilot an expressive language targeted intervention in early years establishments. Training is also being delivered on a range of literacy interventions and assessments in order to empower and upskill school staff and build sustainable approaches; the impact of these approaches and interventions are being monitored to assess improved outcomes for learners. Advice and guidance is also being provided through a newly formed Adjusted Teaching Working Group to strengthen core literacy teaching; this group is looking at common areas of literacy difficulty and current research in this area so that practical advice for teachers can be implemented at class level. The intention is that pupils who are not on track can be targeted with effective in-class pedagogical approaches, hopefully negating the need for ongoing interventions. • Future plans - numeracy: Work is currently underway to develop a North Lanarkshire Dyscalculia Strategy to support children and young people with persistent difficulties in number / maths. This work will include piloting the documentation and resources with identified children, training sessions for staff on how to support children and young people with dyscalculia, and training and upskilling numeracy coaches on a range of research based targeted interventions and approaches. • Learning, teaching, and assessment: Recognising that excellent learning, teaching, and assessment is the most effective mechanism for raising attainment. 831 teachers have received this training in term three of the council’s programme (which was successfully endorsed by Education Scotland). Work is continuing in this respect in partnership with South Lanarkshire Council and West Partnership colleagues in order to further promote and integrate both improving our classrooms and improving our departments programmes. • Science, Technology, Engineering, and Maths (STEM): Science progressive pathways are currently being developed, in consultation with primary and secondary colleagues, to supplement a suite of resources to enhance the learning experience. Workshops have been delivered to support high quality learning and teaching in STEM. Key highlights to date include 160 workshops delivered to 1,543 pupils, 1,693 pupils taking place in the make it happen app design competition, and 465 teachers taking part in continuous lifelong professional learning. This approach will be reviewed further at the end of the academic session. • Curriculum development: An Education Support Officer for curriculum development has been appointed to enhance the wider Learning Hub team. This is specifically aimed at driving forward key aspects of the curriculum (such as expressive arts and health and wellbeing) alongside supporting developments in literacy. Work is underway to design progressive pathways to support teachers to ensure they are building on children and young people’s skills and knowledge. • Pedagogy team: Between August 2023 and March 2024, the team supported 24 schools, working alongside teachers and 74 practitioners, to build capacity and exemplify approaches in literacy, numeracy, learning, teaching, assessment, and STEM within identified establishments. Pre and post engagement assessments are undertaken, and the positive impact of this model is included in an appendix to the report. Report title Summary Revenues and benefits update May 2024 This report provides a regular update on the payment performance for council tax and non-domestic rates, the administration of a range of welfare benefits, and the council tax reduction scheme. It provides an update on performance as at 31st March 2024. Page 23 of 126
Page 24
Aligned Priority: Improve North Lanarkshire's resource base Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions Consistent • Produced quarterly, this report provides Elected Members with detailed in year performance figures which can be compared to the same period in previous years. Transparent • The year to date performance set out in the report covers a wide range of service activities as well as the amount of funding paid out to help households in need in order to provide a safety net for local people on low incomes. • The report also allows for comparisons of performance with the same period in previous years. In context • The council is responsible for the administration and collection of all local taxation in North Lanarkshire in the form of council tax and non-domestic rates. In addition, the council administers a number of benefits for residents of North Lanarkshire including housing benefit, council tax reduction, Scottish welfare fund, discretionary housing payment, free school meals, and clothing grants. • The report includes the latest context within which the service is operating; this is of particular relevance given the aforementioned administration of grants and support payments required for low income households. The report also advises of any new national grants when they are introduced, or will cease, and the qualifying conditions for receipt of such. Balanced The report provides a high-level summary of the highlights which include: • As at 31st March 2024, 94.05% of council tax due for 2023/24 had been collected. This is a reduction of 0.84% for the same period last financial year linked to the cost of living award of £150 received by many households during 2022/23. • Non-domestic rates collection has shown a year-on-year increase from 94.43% for 2022/23 to 94.62% for 2023/24. Rates collection follows the impact of the revaluation at 1st April 2023 which increased the number of accounts under review with the Assessor and delayed payment from many businesses while their reviews conclude. • The service continues to meet statutory timescales for administering benefits applications and changes of circumstance. Performance during 2023/24 was affected by both increasing demand and a number of staff vacancies. To further improve efficiency the service is progressing a number of digital related improvements such as development of the Landlord Portal and robotic process automation for a number of high-volume tasks. The Landlord Portal has recently gone live, and it is anticipated that this action will see an improvement in the handling of correspondence received direct from landlords. • 7,497 applications were received throughout 2023/24 for the council tax reduction scheme, an increase from 6,685 in 2022/23. £26.097m in council tax reduction was awarded for 2023/24 (compared to £24.383m in 2022/23). An increase in notifications for changes in circumstances were processed during 2023/24 (119,698) compared to the previous year (92,711). • During 2023/24, the Scottish welfare fund has seen a significant increase in demand with an increase of 3.3% in crisis applications assessed compared to the previous financial year. Similarly, there has been an increase of 3.9% in the volume of community care grant applications assessed over the same period. Report title Summary Financial monitoring report - council summary (revenue) May 2024 This report presents the council’s revenue monitoring position for the General Fund Account, Housing Revenue Account, and Adult Health and Social Care. (Note, the Revenue Budget for 2024/25 to 2026/27 was approved at the Council meeting in February 2024.) Aligned Priority: Improve North Lanarkshire’s resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. 25. Ensure intelligent use of data and information to support fully evidence-based decision making and future planning. Page 24 of 126
Page 25
Consistent • The report at each financial period end consolidates the budget monitoring position of all council services into one council summary, highlighting and explaining major variances as per the council’s approved Financial Regulations. • The May 2024 report presents the council’s revenue monitoring position for the financial year to 31st March 2024. Transparent • The report highlights and explains major variances as per the council’s approved Financial Regulations. The Financial Regulations require services to remain within their approved budgeting provision, and to report all significant deviations - defined as the higher of £100,000 or 5% - within their budget monitoring reports. In context • All activities undertaken by the council are subject to risk, and in acknowledging the council’s approved Risk Management Strategy, services manage these as part of their overall corporate and service planning processes. The May 2024 report states that the current economic climate and pay and non- pay inflation, continuing at historically high levels, are some of the key factors that have the potential to impact on the council’s ability to provide quality services within approved budget levels. Balanced • Where significant deviations are identified, services must provide explanatory commentary, outline the action required to rectify such deviations and, where relevant, must also highlight the impact this has on other budget headings. This information is captured by Finance and summarised in the overall council report. Report title Summary Financial monitoring report - council summary (capital) May 2024 This report provides an update on the 2023/24 resources and expenditure for the council's Strategic Capital Investment Programme. The report also shows the 2023/24 projected outturn position and the resultant variances. (Note, the Strategic Capital Investment Programme for 2024/25 to 2028/29 was approved by Policy and Strategy Committee in March 2024.) Aligned Priority: Improve North Lanarkshire’s resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. Consistent • The report at each financial period end consolidates the capital monitoring position of all council services into one council summary. • The May 2024 report summarises the overall council Strategic Capital Investment Programme for 2023/24 and the projected outturn to 31st March 2024. Transparent • The report notes that Strategic Capital Investment Programme 2021/22 to 2025/26 was originally approved at Policy and Strategy Committee in March 2021, with an updated programme profile for 2023/24 to 2025/26 approved in March 2023. It represents the total Community Investment Programme incorporating the General Services Capital Programme and HRA Capital Programmes. • The programme was developed in conjunction with services and led by the Strategic Capital Delivery Group (SCDG) using the principles established by the council’s Capital Strategy. In context • The report states that the General Services Capital Programme supported by General Services resources demonstrates to communities that the place making vision for towns remains a priority, and that the council considers the approved 5-year capital investment plan to be a major boost to assist the recovery of the local economy. It is also a clear statement that the council is planning beyond the pandemic to deliver on the long-term needs and aspirations of communities. The programme includes additional investment in Town and Community Hubs, the City Deal programme, and external grant funding. The report also notes that Housing Revenue Account (HRA) resources support several HRA Capital Investment Programmes including mainstream, ambition, new build, and council buy back scheme. Balanced • The report notes the current financial position in respect of the 2023/24 General Services Capital Programme and the Housing Revenue Account. This reflects the approved budget in March 2023 at Policy and Strategy Committee and subsequent decisions made at the Strategic Capital Delivery Group (SCDG) in accordance with the SCDG terms of reference, and where appropriate either by the individual service committees, Finance and Resources Page 25 of 126
Page 26
Committee, or the Policy and Strategy Committee as per the Scheme of Administration. A breakdown of the overall 2023/24 budget by service programme and associated approved budget movements is included in an appendix to the report. • The report recognises that the capital programme continues to face challenges in relation to the wider economic climate linked to availability of materials, contractors and inflationary pressures. Key to RAG status green Performance is on target and/or within acceptable thresholds red Performance does not meet target and is outwith acceptable thresholds blue Performance surpasses the target and exceeds expectations Page 26 of 126
Page 27
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref PH/ASP/ALAugust24 Date 09/05/24 Audit and risk-related items: Action log From: Paula Hendry, Acting Chief Officer (Audit and Risk) Email: hendryp@northlan.gov.uk Telephone: 07471 321768 Executive Summary The purpose of this report is to allow elected members to track implementation of outstanding requests and recommendations made by the Panel in respect of audit and risk-related items. The attached log (at Appendix 1) records those audit and risk-related requests and recommendations made by the Panel and when these were addressed and/or are expected to be addressed. Any actions that have previously been reported as complete and noted by the Panel have been removed from the log. Recommendations The Panel is invited to note the report. Paula Hendry Acting Chief Officer (Audit and Risk) The Plan for North Lanarkshire Priority: All priorities Ambition statement: All ambition statements Programme of Work: Statutory / corporate / service requirement Item 4 Page 27 of 126
Page 28
Appendix 1 Audit and risk related items: Outstanding action log Requests or agreed action Status May 2024 1. The follow-up report detailing progress in implementing agreed audit actions be amended to specifically highlight instances where Service action to address the recommendation was still outstanding, but the original implementation date agreed by management was over a year old. In progress – the audit team are working on developing a reporting format that will facilitate the reporting of audit actions, that have remained outstanding for over a year after the original implementation date agreed by management, to assist the Panel’s consideration of the need for the relevant Chief Officer to submit a report on the matter. February 2024 2. A report be brought back to the Panel post-Summer 2024 in relation to the effectiveness of the Service’s compliance monitoring of the implementation of new processes in respect of school funds management. In progress – work in relation to this issue was included in the 2024-25 Internal Audit Plan. The audit assignment related to this item is currently underway and the results will be reported to the next meeting of the Panel. September 2023 3. Request a further report be brought back by management to a future meeting on progress implementing outstanding actions identified by Internal Audit follow-up work in relation to the implementation of quality assurance processes to monitor compliance with Project Management framework. Partially complete – implementation of this action has been tracked via the Internal Audit reports following up on previously agreed actions. The most recent assessment via this is that the management actions regarding this are now complete. The 2024-25 Internal Audit Annual Plan approved by the Panel in May 2024 includes work to review how the results of management’s quality assurance processes for project management have progressed. The results of this audit work will be reported to the Panel once completed. May 2023 4. Request a report be brought back by management to a future meeting on progress implementing agreed actions in relation to audit recommendations in the Internal Audit report ‘Payments to staff - overtime and travel and subsistence’. Complete – specific audit work reviewing progress made by management, the effectiveness of interim controls put in place as a response to the audit findings and progress in implementing agreed actions is now complete. The results of this audit work are included in the Internal Audit Progress Report which is a separate agenda item at this meeting. Page 28 of 126
Page 29
Appendix 1 Audit and risk related items: Outstanding action log (continued) Requests or agreed action Status May 2023 5. Request a further report be brought back by management to a future meeting on outstanding actions identified by Internal Audit follow-up work in relation to managing strategic change. Partially complete – implementation of this action has been tracked via the Internal Audit reports following up on previously agreed actions. The most recent assessment via this is that the management actions regarding this are now complete. The 2024-25 Internal Audit Annual Plan approved by the Panel in May 2024 includes work to focus on providing assurance on the adequacy and effectiveness of the Council’s recently revised governance arrangements implemented to oversee delivery of the Programme of Work to 2028. The results of this audit work will be reported to the Panel once completed. 6. Request a further report be brought back by management to a future meeting on outstanding actions identified by Internal Audit follow-up work in relation to ‘Employee Service Centre – key controls’. Not yet due – an update report by the Chief Officer (People Resources) on this issue was presented to CMT in May 2024 where it was agreed that a sub- group of relevant Chief Officers would discuss this issue and present their findings to CMT in late 2024. The revised timescales for agreed actions are not yet due and will be reported on, as they fall due, in line with Internal Audit’s arrangements for reporting on follow-up. Page 29 of 126
Page 30
Page 30 of 126
Page 31
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No ☐approval ☒noting Ref PH/ASP/PRAug24 Date 29/08/24 Internal Audit progress report From: Paula Hendry, Acting Chief Officer (Audit and Risk) E-mail: hendryp@northlan.gov.uk Telephone 07471 321768 Executive Summary The purpose of this report is to provide an overview of Internal Audit activity and to report the results of Internal Audit outputs finalised since the last update to the Panel in May 2024. This report highlights the most significant issues arising from these recently completed Internal Audit assignments as well as providing updates on other aspects of the work of Internal Audit. Appendix 1 provides a summary of the scope and key findings of each substantive planned audit report and relevant investigative outputs. Full copies of the relevant audit outputs highlighted in this report are also included in the meeting paper in line with best professional practice and the approved Internal Audit Charter and associated reporting protocol. The 2023-24 Annual Plan was approved by the Audit and Scrutiny Panel in May 2023. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work be periodically reported to CMT and the Panel. This report fulfils that expectation. Recommendations The Panel is invited to: (a) note the findings, conclusions, and recommendations of completed Internal Audit reports together with the associated management responses; (b) consider whether there are any issues raised by Internal Audit which the Panel consider are sufficiently significant to require a further report from management to be submitted to a future meeting of the Panel; (c) request that Internal Audit provide a report to future meetings of the Panel reporting progress made by management implementing agreed management actions in relation to all audit recommendations categorised as ‘High’ or ‘Medium’; and (d) otherwise note this report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 5 Page 31 of 126
Page 32
1. Background 1.1 The 2023-24 Annual Plan was approved by the Audit and Scrutiny Panel in May 2023. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work be periodically reported to CMT and the Panel. This report fulfils that expectation. 2. Report Audit reviews completed in the period 2.1 Table 1 below provides an overview of completed Internal Audit reports since the last update to the Panel in May 2024. These outputs were included in the 2023-2024 Internal Audit Plan. Work is currently underway on other assignments included in the 2024-25 Plan (approved by the Panel in May 2024) and this work will be reported to the Panel as it is completed. Table 1: Completed Internal Audit outputs in the period Subject Internal Audit Opinion 1. ESC – Follow-up duplicate payments (note 1) Limited assurance (Amber-Red) 2. Performance Management Reasonable assurance (Green-Amber) 3. General Ledger Substantial assurance (Green) 4. Corporate Governance Substantial assurance (Green) Note 1: This report has been issued in draft form and is awaiting agreed management responses and proposed actions. It is expected to be finalised and available in time for the Panel meeting. 2.2 Appendix 1 provides a summary of those reports forming part of the annual programme of planned assurance work and investigation reports as required by the Internal Audit Charter and associated reporting protocol. This report excludes audit outputs produced for the North Lanarkshire IJB which are reported directly to its senior management team and audit committee. 2.3 Appendix 2 contains detailed definitions of the categories used by Internal Audit when making recommendations, providing an audit opinion and on the extent of assurance which is being provided to management and Panel members on those systems or areas of Council operations examined by Internal Audit. 2.4 In addition to the above reports, work is currently underway on a range of topics including Social Work quality assurance arrangements, housing asset management plan, council tax refunds, Scottish Welfare Fund and school fund compliance. Once finalised, these reports will be submitted to future meetings of the Panel. Page 32 of 126
Page 33
Commentary on completed planned ‘core’ Internal Audit work 2.5 The nature of Internal Audit exercises means that most audit reviews invariably find some scope for improvement, usually in the form of controls which are weak or only partially effective and, therefore, contain recommendations. 2.6 One of the four reports being reported in the period is assessed as providing only limited assurance, while three of the reports provided more positive levels of assurance. All four reports contain a range of improvement actions and audit recommendations. 2.7 Our work in respect of specific follow-up work on payments to staff - duplicate payments was designed to provide independent assurance on the adequacy and effectiveness of actions taken by management in response to the audit findings and recommendations made in the April 2023 Internal Audit report on ‘Overtime and Travel and Subsistence’. 2.8 Based on the results of our audit work and considering progress made in implementing agreed actions, we have categorised this audit as offering ‘limited assurance’. Whilst we acknowledge that the interim process implemented now prevents duplicate overtime claims from being paid, there is still a high incidence of duplicate claims being submitted by employees and authorised by managers. In addition, we consider that the progress in implementing agreed actions in response to the previous recommendations has been slow and the original timescale of December 2023 proposed by Service management has not been met. 2.9 We recognise that, whilst People Resources are responsible for the preparation of guidance and implementation of payroll processes and the ultimate payment of employees across the Council, Services themselves are responsible for adhering to established rules for payment and ensuring that appropriate checks are undertaken to confirm that all payroll transactions, including the submission and authorisation of overtime claims, are in respect of work undertaken. 2.10 We consider that there is still considerable scope for improvement and we have raised several recommendations for management consideration which are detailed in section 3 of the audit report. These include the need for People Resources to explore, determine and implement more permanent measures to address weaknesses in relation to the submission, authorisation and payment of duplicate overtime claims, a high incidence of duplicate overtime claims continuing to be submitted and authorised demonstrating a lack of improvement in the behaviours of employees and managers and a lack of recovery of overpayments identified during the previous audit. Management has responded positively to the report and satisfactory management responses and commitments to planned actions have been received. 2.11 The report on Performance management was designed to provide assurance on the adequacy and effectiveness of the Council’s performance management and performance reporting arrangements. 2.12 Based on the results of our work, we have categorised this audit as offering ‘reasonable assurance’ as we were pleased to note a significant improvement in the current arrangements for performance management, with regular and meaningful reports and data being submitted to committee in line with the reporting schedule, and the implementation of an assurance review and reporting process. 2.13 We identified a small number of issues arising from our review of a sample of level 2 and 3 performance indicators, including issues with the content and completeness of definition sheets and queries in relation to the calculation of reported performance figures. The Internal Audit Plan for 2024-25 includes an allowance for work on performance management and we intend to focus this work on the specific arrangements in place within individual Services. A small number of recommendations, in relation to the enhancement of current reporting and scrutiny arrangements have been identified and these are detailed in section 3 of the audit report. Management has responded positively to the report and satisfactory management responses and commitments to planned actions have been received. Page 33 of 126
Page 34
2.14 Our work on the General Ledger was designed to provide independent assurance on the adequacy and effectiveness of the Council’s control environment in relation to the general ledger and reliability of accounting data. In particular, the audit considered whether the key controls associated with the Council’s general ledger system were effective in ensuring that the Council has, and can access, reliable financial data. 2.15 We have categorised this audit as offering ‘substantial assurance’ as a generally sound system of governance, risk management and control is in place, with internal controls operating effectively and being consistently applied. We were pleased to note that appropriate access controls and processes are in place to protect the integrity of the system and its data, there was adequate documentation to support the completeness, accuracy and validity of manual adjustments and information from feeders, there was evidence that suspense accounts and bank reconciliations were being reviewed and reconciled on a regular basis, and period end close processes were being carried out in a timely manner. 2.16 Some minor areas for improvement are detailed at section 3 of the report. Management has responded positively to the report and satisfactory management responses and commitments to planned actions have been received. 2.17 Our report on Corporate Governance was to provide assurance on the adequacy and effectiveness of the Council’s arrangements for ensuring that it complies with the CIPFA Delivering Good Governance in Local Government Framework 2016. The audit focussed on the robustness of the self-evaluation arrangements for the Strategic Governance Framework undertaken by management and considered the management arrangements in place for assessing current developments and planned improvement actions. 2.18 Based on the results of our work, together with our wider general knowledge gained from previous Internal Audit reviews undertaken in this and other associated areas, we consider that the Council’s corporate governance arrangements in relation to self- assessment are adequate and operating effectively. We have therefore assessed this audit as providing ‘substantial assurance’. 2.19 In particular, we were pleased to note that robust and appropriate arrangements are in place to undertake an annual self-assessment exercise against the CIPFA framework, including a review and refresh of the Strategic Governance Framework and completion of checklists and certificates of assurance by Chief Officers and ALEO Chief Executive’s. We were also pleased to note that the outcome of this self-assessment exercise, together with the consideration of the outcomes of internal and external audit reviews, reports arising from inspections from external bodies and any improvement actions or future developments, are reported to senior management and the Audit and Scrutiny Panel as part of the Annual Governance Statement. 2.20 Only one minor area for improvement has been identified and this is detailed in section 3 of the report for management consideration. Management has responded positively to the report and satisfactory management responses and commitments to planned actions have been received. Other Matters – Internal Audit Performance 2.21 In March 2021, the Panel were presented with a revised performance management framework for Internal Audit that was to be implemented from April 2021. Most indicators are reported on an annual basis. There are two indicators, however, that are subject to quarterly reporting. 2.22 The first is about the implementation of agreed actions arising from Internal Audit reports by the implementation date. Progress in implementing agreed actions is monitored and reported separately to the Panel each cycle. 54% of agreed actions have been implemented by the agreed implementation date in the period to June 2024 (was 49% in the previous update). Page 34 of 126
Page 35
2.23 The second performance indicator is about client satisfaction and reflects provides the results of four key questions we ask audit clients at the conclusion of each audit assignment. Results presented in the Annual Internal Audit report to the June meeting of the Panel showed generally positive feedback on the work of Internal Audit with most respondents agreeing that Internal Audit added value by assisting in providing assurance, and that reports were relevant and constructive with findings clearly and accurately communicated. As only a small number of responses have been received in this period, this data will be carried forward and reported in more detail in the next update. 2.24 Where management raise concerns over Internal Audit’s work, these matters are discussed with relevant senior management to fully understand the nature of any concerns and, where it is considered appropriate, to identify areas for improvement. We also seek Services’ views on what they liked or disliked about the audit process and comments received are used to inform future action plans for improving the service provided by Internal Audit. 3. Measures of success 3.1 Internal Audit reports annually on its performance to the Panel and is also subject to review annually by the Council’s appointed external auditors. 4. Supporting documentation Appendix 1 Summary of Internal Audit assignments completed in the period Appendix 2 Audit gradings Appendix 3 Internal Audit Performance Framework Paula Hendry, Acting Chief Officer (Audit and Risk) Page 35 of 126
Page 36
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective responses by management to the weaknesses, control issues and/or areas of improvement identified by Internal Audit will increase the likelihood of the Council achieving its ambitions by improving control frameworks and more effectively mitigating potential risks and threats to the achievement of planned outcomes. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 36 of 126
Page 37
Appendix 1 Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 1 ESC Follow-up – overtime duplicate payments Internal Audit Opinion: Limited assurance (Amber-Red) Audit recommendations: High 2 Medium 1 Low 0 The purpose of this audit was to undertake a high-level review to provide independent assurance on the adequacy and effectiveness of actions taken by management in response to the audit findings and recommendations made in the April 2023 Internal Audit report on ‘Overtime and Travel and Subsistence’. This report focuses on the actions taken by People Resources in relation to preventing duplicate overtime payments being processed and paid. Updates for the other recommendations raised in the report are being progressed through the established quarterly Audit and Scrutiny Panel follow up process reporting management progress in implementing agreed actions. Following the control weaknesses identified in our previous audit, People Resources put in place interim arrangements to enable duplicate claims to be identified and deleted prior to pay runs being finalised and payments made to staff. We were pleased to note that these arrangements are working in practice, and we did not identify any instances, where a duplicate claim had been paid, for the sample of payments selected for testing during this follow-up audit review. In their response to the previous audit, management also committed to undertaking work to identify a longer-term solution within the iTrent system to improve the control environment, and a report was submitted to CMT in May 2023 which outlined the potential enhancements which could be made to the system to eradicate duplicate overtime claims. At present, while there have been initial discussions around this, and consideration is currently being given to the introduction of a ‘Paid Time’ module within iTrent, there has been no further formal discussions or full business case prepared in respect of this action. We also noted that there is no formal plan in place which outlines the actions to be taken with associated timescales and responsible officers. In addition, within the above referenced report submitted to CMT, it was agreed that the Employee Service Centre within People Resources would begin the process to recoup the overpayments identified in the previous audit as arising from duplicate claims. Subsequent discussions with ESC management, however, has confirmed that the overpayments arising from the potential duplicate claims have not, as yet, been recovered. Based on the results of our work and considering progress made in implementing agreed actions, we have categorised this audit as providing ‘limited assurance’. Whist we acknowledge that the interim process implemented now prevents duplicate overtime claims from being paid, thereby improving the detective controls in place, there is still a high incidence of duplicate claims being submitted by employees and authorised by managers. In addition, we consider that the progress in implementing agreed actions in response to the previous audit recommendations has been slow and the original timescale of December 2023 proposed by Service management has not been met. We recognise that, whilst People Resources are responsible for the preparation of guidance and implementation of payroll processes and the ultimate payment of employees across the Council, Services themselves are responsible for adhering to established rules for payment and ensuring that appropriate checks are undertaken to confirm that all payroll transactions, including the submission and authorisation of overtime claims, are in respect of work undertaken. Appendix 2 demonstrates recurring non-compliance by employees (submitting) and managers (authorising) duplicate overtime claims, therefore reinforcing the need for robust preventative controls. Page 37 of 126
Page 38
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 1 ESC Follow-up – overtime duplicate payments (continued) We consider that there is still considerable scope for improvement in the control environment and we have raised several recommendations for management consideration. These are detailed at section 3 of the audit report and include: • People Resources needs to explore, determine and implement more permanent measures to address the weaknesses in the control environment in relation to the submission, authorisation and subsequent payment of duplicate overtime claims; • despite measures being put in place, there remains a high incidence of duplicate overtime claims continuing to be submitted and authorised demonstrating a lack of improvement in the behaviours of employees and managers; and • overpayments identified following the initial findings in the previous audit report have not yet been recovered. Satisfactory management responses including agreed proposed actions have been received from management in response to the recommendations contained in the report. Page 38 of 126
Page 39
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 2 Performance management Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 0 Medium 0 Low 2 The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s performance management and performance reporting arrangements. In September 2019, the Council approved a Strategic Performance Framework (SPF) which set out a framework for performance measurement at three levels, allowing for day-to-day activities and progress towards achieving the long-term vision set out in The Plan for North Lanarkshire to be regularly monitored, reported, assessed and scrutinised. The SPF is supported by an annual Performance Reporting Schedule which details the reporting, review and scrutiny arrangements for service and corporate performance information to be considered at committee meetings each year. The 2024-25 reporting schedule was approved by the Audit and Scrutiny Panel (ASP) in February 2024. Additionally, a quarterly performance assurance report is presented to the ASP each cycle to support scrutiny and oversight of performance information and monitor adherence to the reporting schedule. Our last report on performance management in October 2022 was categorised as offering ‘limited assurance’ as, at that time, many aspects of the SPF were not yet fully implemented and further work was required in respect of the corporate arrangements for monitoring and recording key strategic and operational performance measures by Services and the timely and regular reporting of performance to elected members and senior management. Based on the results of our work during this audit, we have categorised this audit as offering ‘Reasonable assurance’. We were pleased to note a significant improvement in the current arrangements for performance management, with regular and meaningful reports and data being submitted to committee in line with the reporting schedule, and the implementation of an assurance review and reporting process. We did, however, identify a small number of issues arising from our review of a sample of level 2 and 3 performance indicators, including issues with the content and completeness of definition sheets and queries in relation to the calculation of reported performance figures. The Internal Audit Annual Plan for 2024-25 includes an allowance for work on performance management and we intend to focus this work on the specific arrangements in place within individual Services. A small number of recommendations, in relation to the enhancement of current reporting and scrutiny arrangements, have been raised and these are detailed in section 3 of the audit report. Satisfactory management responses including agreed proposed actions have been received from management in response to the recommendations contained in the report. Page 39 of 126
Page 40
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 3 General Ledger Internal Audit Opinion: Substantial assurance (Green) Audit recommendations: High 0 Medium 0 Low 2 This was a high-level review designed to provide independent assurance on the adequacy and effectiveness of the Council’s control environment in relation to the general ledger and reliability of accounting data. In particular, the audit considered whether the key controls associated with the Council’s general ledger system were effective in ensuring that the Council has, and can access, reliable financial data. Section 95 of the Local Government (Scotland) Act 1973 requires every local authority to make arrangements for the proper administration of their financial affairs and appoint a Section 95 Officer to be responsible for the administration of those affairs. The Council has appointed the Chief Officer (Finance) as the Section 95 Officer who is supported by a suitably experienced central finance function and good financial management processes. To ensure that public money is safeguarded and properly accounted for, the Council utilises the eFinancials general ledger system, which enables proper recording of financial transactions and supports the preparation of the annual accounts. Based on the results of our audit work, we have categorised this audit as offering ‘substantial assurance’, as a generally sound system of governance, risk management and control is in place, with internal controls operating effectively and being consistently applied. In particular, we noted that: • appropriate access controls and processes were in place to protect the integrity of the system and its data; • there was adequate documentation to support the completeness, accuracy and validity of manual adjustments and information from feeders; • there was evidence that suspense accounts and bank reconciliations were being reviewed and reconciled on a regular basis; and • period end close processes were being carried out in a timely manner. Some minor areas for improvement are detailed at section 3 of the report. Satisfactory management responses including agreed proposed actions have been received from management in response to the recommendations contained in the report. Page 40 of 126
Page 41
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 4 Corporate Governance Internal Audit Opinion: Substantial assurance (Green) Audit recommendations: High 0 Medium 0 Low 1 The purpose of this review was to provide assurance on the adequacy and effectiveness of the Council’s arrangements for ensuring that it complies with the CIPFA Delivering Good Governance in Local Government Framework 2016. The audit focussed on the robustness of the self-evaluation arrangements for the Strategic Governance Framework undertaken by management and considered the management arrangements in place for assessing current developments and planned improvement actions. The CIPFA framework requires that councils test their arrangements against good governance principles annually by reviewing their arrangements, ensuring that their local code is up to date and reporting on compliance. The Council’s local code of governance is set out in the Strategic Governance Framework, which was initially approved in February 2020, and is subsequently refreshed and approved by the Audit and Scrutiny Panel annually. The annual review process and refreshed Strategic Governance Framework is a key piece of evidence used to inform the development of the Annual Governance Statement. Based on the results of our work, together with our wider general knowledge gained from previous Internal Audit reviews undertaken in this and other associated areas, we consider that the Council’s corporate governance arrangements in relation to self-assessment are adequate and operating effectively. We have therefore assessed this audit as providing ‘substantial assurance’. In particular, we were pleased to note that robust and appropriate arrangements are in place to undertake an annual self-assessment exercise against the CIPFA framework, including a review and refresh of the Strategic Governance Framework and completion of checklists and certificates of assurance by Chief Officers and ALEO Chief Executive’s. This self-assessment indicated a high level of compliance with the corporate governance framework and our sample-based audit testing concurred with this. We were also pleased to note that the outcome of this self-assessment exercise, together with the consideration of the outcomes of internal and external audit reviews, reports arising from inspections from external bodies and any improvement actions or future developments, are reported to senior management and the Audit and Scrutiny Panel as part of the Annual Governance Statement. We have identified one minor area for improvement and this is detailed at section 3 of the report for management consideration. Satisfactory management responses including agreed proposed actions have been received from management in response to the recommendations contained in the report. Page 41 of 126
Page 42
Appendix 2 Audit Gradings Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance There are minimal or minor control weaknesses that present low risk to the control environment. The control environment has substantially operated as intended although some minor errors have been detected. Very few or no improvements are needed. Green-Amber Reasonable Assurance There are some control weaknesses that present a low to medium risk to the control environment. The control environment has mainly operated as intended although errors have been detected. Some improvements should be made. Amber-Red Limited Assurance There are significant control weaknesses that present medium to high risk to the control environment. The control environment has not operated as intended. Significant errors have been detected. Substantial improvements should be made. Red No Assurance There are fundamental control weaknesses that present an unacceptable level of risk to the control environment. The control environment has fundamentally broken down and is open to significant error or abuse. Immediate and major changes need to be made. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant, but it is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action were taken. Prompt action is required Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 42 of 126
Page 43
Appendix 3: Internal Audit performance framework Category Measure Internal Audit management Reported to Chief Executive and CMT Reported to A&SP (Quarterly) Reported to A&SP (Annual) 1. Delivery of Annual Plan Percentage completion of agreed plan X X X 2. Targeting Percentage of key corporate risks and key financial systems over which assurance provided X X X 3. LGBF - Efficiency Cost of Internal Audit per £ million revenue budget X X 4. LGBF - Efficiency % of productive hours delivered v Plan X X 5. Delivery / recommendations Percentage implementation of agreed actions by implementation date (cumulative year to date) X X X X 6. Delivery / other Number of significant irregularity / fraud investigations X X X 7. Customer satisfaction results Scores from customer satisfaction questionnaires (audit assignments) (cumulative year to date) X X X X 8. Customer satisfaction results Scores from key stakeholders (CMT and A&SP) questionnaires (overall performance of the function) X X X 9. Quality / standards Reliance placed by External Audit on the work of Internal Audit X X X 10. Quality/ standards Quality review outcomes – EQAR or internal self- evaluation X X X 11. Delivery of Annual Report Annual opinion /report prepared by 31 May annually X X X 12. Targeting Approval by CMT and A&SP of strategy and annual plan by 31 May annually X X X Internal management performance indicators 13. Efficiency Actual v planned days on completed assignments X 14. Efficiency Time between completion of fieldwork and draft reports being issued X 15. Efficiency Time between draft reports and final reports being issued X Page 43 of 126
Page 44
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 1 INTERNAL AUDIT REPORT PAYROLL: FOLLOW-UP OF OVERTIME DUPLICATE PAYMENTS Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit Grading Appendix 2: Summary of Duplicate Claims Data Issued to: Chief Officer (People Resources) Copied to: Employee Service Centre Manager, Employment and Policy Manager, Chief Executive and Assistant Chief Executive Headlines The purpose of this audit was to undertake a high-level review to provide independent assurance on the adequacy and effectiveness of actions taken by management in response to the audit findings and recommendations made in the April 2023 Internal Audit report on ‘Overtime and Travel and Subsistence’. This report focuses on the actions taken by People Resources in relation to preventing duplicate overtime payments being processed and paid. Updates for the other recommendations raised in the report are being progressed through the established quarterly Audit and Scrutiny Panel follow up process reporting management progress in implementing agreed actions. Following the control weaknesses identified in our previous audit, People Resources put in place interim arrangements from May 2023 to enable duplicate claims to be identified and deleted prior to pay runs being finalised and payments made to staff. We were pleased to note that these arrangements are working in practice, and we did not identify any instances, where a duplicate claim had been paid, for the sample of payments selected for testing during this follow-up audit review. In their response to the previous audit, Management also committed to undertaking work to identify a longer-term solution within the iTrent system to improve the control environment, and a report was submitted to CMT in May 2023 which outlined the potential enhancements which could be made to the system to eradicate duplicate overtime claims. At present, while there have been initial discussions around this, and consideration is currently being given to the introduction of a ‘Paid Time’ module within iTrent, there has been no further formal discussions or full business case prepared in respect of this action. We also noted that there is no formal plan in place which outlines the actions to be taken with associated timescales and responsible officers. In addition, within the above referenced report submitted to CMT, it was agreed that the Employee Service Centre within People Resources would begin the process to recoup the overpayments identified in the previous audit as arising from duplicate claims. Subsequent discussions with ESC management, however, has confirmed that the overpayments arising from the potential duplicate claims have not, as yet, been recovered. Based on the results of our work and considering progress made in implementing agreed actions, we have categorised this audit as providing ‘limited assurance’. Whist we acknowledge that the interim process implemented now prevents duplicate overtime claims from being paid, thereby improving the detective controls in place, there is still a high incidence of duplicate claims being submitted by employees and authorised by managers. In addition, we consider that the progress in implementing agreed actions in response to the previous audit recommendations has been slow and the original timescale of December 2023 proposed by Service management has not been met. (continued overleaf) Internal Audit Opinion (see definition at Appendix 1) Limited Assurance (Amber-Red) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0350/2024/002 Date issued 05/08/2024 Audit Team Lynn McCrum and Paula Hendry Page 44 of 126
Page 45
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 2 Headlines (continued) (Continued from overleaf) We recognise that, whilst People Resources are responsible for the preparation of guidance and implementation of payroll processes and the ultimate payment of employees across the Council, Services themselves are responsible for adhering to established rules for payment and ensuring that appropriate checks are undertaken to confirm that all payroll transactions, including the submission and authorisation of overtime claims, are in respect of work undertaken. Appendix 2 demonstrates recurring non-compliance by employees (submitting) and managers (authorising) duplicate overtime claims, therefore reinforcing the need for robust preventative controls. We consider that there is still considerable scope for improvement in the control environment and we have raise d several recommendations for management consideration. These are detailed at section 3 of the audit report and include: • People Resources needs to explore, determine and implement more permanent measures to address the weaknesses in the control environment in relation to the submission, authorisation and subsequent payment of duplicate overtime claims; • despite measures being put in place, there remains a high incidence of duplicate overtime claims continuing to be submitted and authorised demonstrating a lack of improvement in the behaviours of employees and managers; and • overpayments identified following the initial findings in the previous audit report have not yet been recovered. Page 45 of 126
Page 46
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 3 1. Executive Summary Objectives The purpose of this audit was to undertake a high-level review to provide independent assurance on the adequacy and effectiveness of actions taken by management in response to the audit findings and recommendations made in the April 2023 Internal Audit report on ‘Overtime and Travel and Subsistence’, in relation to preventing duplicate overtime payments being processed and paid. In particular, the work was designed to offer an audit opinion on whether: • the actions taken by management have sufficiently addressed the previously identified control weaknesses to prevent duplicate claims being submitted, authorised and paid; and • overpayments identified by the Service as a result of detailed analysis of duplicate claims paid in the two- year period to February 2023 have been investigated and recovery undertaken. As part of this exercise, a sample of 50 overtime payments made during the period September to December 2023 across all Council service areas was selected and substantive testing carried out to ensure that controls which have been put in place by the Service since the last audit are operating effectively. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 2 1 0 Key areas requiring management action (High) The following key areas requiring urgent management action have been identified: • People Resources needs to explore, determine and implement more permanent measures to address the weaknesses in the control environment in relation to the submission, authorisation and subsequent payment of duplicate overtime claims; and • despite measures being put in place, there remains a high incidence of duplicate overtime claims continuing to be submitted and authorised demonstrating a lack of improvement in the behaviours of employees and managers. Good practice identified We noted the following areas of good practice during the audit: • the Council has documented core conditions of service for all employees which include detailed guidance on eligibility, entitlement and rates of pay in respect of overtime claims. • The Council has well-established rules and guidance which cover both entitlement to, and processing of, overtime claims. These are available to all employees and managers via mySelf and myNL. • There are standard proforma overtime templates held on mySelf which require to be completed when submitting claims for overtime. • All overtime claims are supported by adequate documentation to substantiate the validity of the hours/times worked. • All overtime claims are subject to a separate authorisation process by the employee’s line manager prior to the claim being processed and paid. • The majority of overtime claims are completed by staff, and thereafter authorised by managers, electronically through mySelf. • Interim arrangements have been developed, and are in operation, to identify duplicate overtime claims and take appropriate action to ensure these are not paid. Other areas for improvement (Medium) One other area for improvement was identified: • overpayments identified following the initial findings in the previous audit report have not yet been recovered. Page 46 of 126
Page 47
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 4 3. Action Plan Follow Up of Overtime Duplicate Payments 0350/2024/002 Ref Finding 1 People Resources needs to explore, determine and implement more permanent measures to address the weaknesses in the control environment in relation to the submission, authorisation and subsequent payment of duplicate overtime claims. The current system configuration of iTrent does not prevent an overtime claim for the same period being submitted and/or authorised more than once. Whilst a warning message has been built into iTrent claim forms which highlights the need to check for duplicates, work undertaken during the previous audit in April 2023 identified that this was not sufficient and that duplicate claims could be, and were being, submitted by employees and subsequently authorised by managers. Following the previous audit, an interim process was developed by People Resources to identify and investigate potential duplicate claims, with any duplicate claims thereafter being deleted prior to pay runs being finalised to ensure only bona fide payments are made to employees. We were pleased to note that these arrangements appear to be working well in practice, with action being taken to identify and stop payments being made. However, there has been a high degree of fluctuation in the volume of duplicate claims being submitted and authorised over the last 12 months and the volume of these claims remains excessive (see detail at Appendix 2). As all duplicates identified need to be investigated and manually ‘reversed’ to ensure they are not paid, the interim arrangements/process is very labour-intensive and time critical, both of which have an impact on the Employee Service Centre (ESC) Compliance and Audit Team’s ability to allocate resource to undertake other priorities. We noted that the interim arrangements are predicated on an exception report based on a number of factors to identify potential duplicates (e.g. date, start time, etc). Whilst we consider this to be a comprehensive process which should identify, and thereafter prevent, duplicate claims from being paid, it will not cover all eventualities or scenarios. For example, it will not identify cases where there are two claims for the same day with time periods which overlap but the start time is different. Audit testing of a sample of overtime claims in the period September to December 2023 identified one such case where the employee claimed, and was paid for, overtime for two different positions on the same day but where the times overlapped. People Resources submitted a report to CMT in May 2023 highlighting progress on proposed actions to address the recommendations made in our previous audit report. The CMT report referenced the need for future system developments to identify a longer-term solution within the iTrent system to improve the current control environment and provided narrative in relation to the benefits and indicative costs associated with a proposed solution, the ‘Paid Time’ module on iTrent. Whilst we understand that initial discussions have taken place in respect of this module, until recently there had been very little activity to progress a system solution. The ESC’s Workforce Systems and Analytics Team have now devised a range of scenarios which have been sent to software supplier (MHR) with a request to include these as part of a demonstration of the ‘Paid Time’ module which was delivered in July 2024. We understand that, following this demonstration, People Resources will determine whether this module presents a feasible system solution and, if so, a business case will be developed for consideration by the Chief Officer (People Resources) and thereafter presented to CMT and/or BMT. Implication Recommendation Priority A lack of effective preventative controls increases the risk of duplicate claims being processed at potentially significant cost to the Council as well as staff resources being utilised at the detriment of other priorities/areas. The Chief Officer (People Resources) should ensure that: (1) the system enhancements identified by the Workforce Systems and Analytics Team as offering a more permanent solution to system controls to prevent duplicate overtime claims being submitted, authorised and paid, are fully explored and, if deemed viable, a Business Case is prepared and presented to CMT for approval; (2) if action at 1 above is not progressed, as a matter of priority, a comprehensive review of the interim arrangements is undertaken, to consider the adequacy, efficiency and effectiveness of this approach as a permanent solution. This review should also encompass consideration of any other more effective preventative and/or detective controls to ensure duplicate claims cannot be submitted, authorised and paid; and (3) an action plan is prepared which clearly details the actions required with regards to recommendations (1) and, if applicable, (2) above and the associated timescales and responsible officers which is thereafter tracked and monitored. High Page 47 of 126
Page 48
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 5 3. Action Plan Follow Up of Overtime Duplicate Payments 0350/2024/002 Management response Implementation Month/Year Agree Gillian Quinn, Employee Service Centre Manager (1) The Service are currently engaging with the system provider (MHR) to explore all possibilities to develop a system solution, with the last engagement being during July. Through this, we have established that no firm or easily implemented solution has yet been identified and that we will require bespoke development work for any further progression, which will incur a cost. We, therefore, don’t expect to progress this quickly. A full business case for development, including costs, will be prepared once a viable solution has been agreed. (2) The Service has undertaken significant work to implement manual controls, checks and reporting for all duplicate claims, and a recent review of these arrangements has established that they are working well. Although this solution is resource intensive, we are confident that the interim arrangement is robust, therefore the Service will continue with this until a permanent solution is identified. If no system solution is identified, these arrangements can be made permanent, however, consideration would need to be given to the ongoing resource commitment. We will however review the current reports generated and consider if any further exception reports are required given the anomaly identified in the finding above. (3) An action plan will be prepared setting out all actions required for taking forward a system solution and if necessary, any actions required to address recommendation (2) above, should a system solution not be identified. July 2025 October 2024 December 2024 Page 48 of 126
Page 49
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 6 3. Action Plan (continued) Follow Up of Overtime Duplicate Payments 0350/2024/002 Ref Finding 2 Despite measures being put in place, there remains a high incidence of duplicate overtime claims continuing to be submitted and authorised, demonstrating a lack of improvement in the behaviours of employees and managers. As referenced at finding 1 above, while we were pleased to note that the interim arrangements established by People Resources appear to be working in practice, with action taken to identify and prevent duplicate payments being made, we identified a high degree of fluctuation in the volume of duplicate overtime claims that continue to be submitted by employees and authorised by managers during the period June 2023 to May 2024. We consider the volume of these claims remains excessive (see detail at Appendix 2). Management information providing performance statistics on the level of occurrence of duplicate claims being submitted, and thereafter authorised, is not currently produced and provided to Service management within People Resources or Chief Officers. The Council has clear guidance which sets out the rules for claiming overtime and the expected procedures and documentation which require to be followed/used by both employees and their line manager when submitting and authorising such claims. This guidance is available to all staff, both on mySelf and myNL and reminders regarding expected processes have been issued to all staff via NLC announcements. The deficiencies in the controls surrounding both the calculation and payment of overtime and the high volumes of duplicate claims being submitted and authorised, suggests that there is either a lack of understanding by both employees and managers with regards to the rules around overtime and the completion, submission and authorisation of overtime claims or a deliberate disregard for such rules and delegated authority privileges. People Resources has recently developed Time and Expenses training sessions (from April 2024) which are now being offered to employees and managers who have been identified as submitting or authorising a duplicate claim. A record of all persons invited and whether they have booked and/or attended the training session is retained. As at the time of fieldwork (May 2024), approximately 800 people have been invited to book, with only 121 (15%) having booked in. People Resources expect that these training sessions will help to educate employees and managers, and that this will lead to a decline in the number of duplicate claims being submitted and authorised. An escalation process has recently been introduced to take appropriate action for individual employees where they continually submit duplicate claims. Employees, and the authorising manager, are notified via email each time a duplicate claim has been submitted. The occurrence of such claims is tracked, and where an employee repeatedly submits duplicate claims, this will be escalated to the Employment and Policy Manager for review and investigation in line with the Council’s Disciplinary Policy. Whilst employees have a responsibility to ensure that overtime claims are valid and made only once, the point at which the expected key control to prevent duplicate claims being made occurs is the authorisation of claims by the Manager. It is at this point that there is currently a weakness in the control environment, with data collated demonstrating that there are still high instances of repeated authorisation of duplicate claims by managers (see detail at Appendix 2). Despite this, there is currently no process in place to escalate and take appropriate action to tackle repeated instances of duplicate claims being authorised by Managers. Substantive testing was undertaken to determine the extent to which Services are complying with the Council’s rules and expected practices/procedures in relation to the calculation and payment of overtime. Whilst we are satisfied that there is evidence to substantiate the overtime worked for the sample cases reviewed, we consider that there are still deficiencies in the controls surrounding the completion of overtime claims and the calculation and payment thereof. The main issues identified are as follows: • errors in the calculation/application of overtime rates, night shift allowance and non-core hours; • employees claiming overtime at Additional Basic, which, for higher paid employees, circumvents the rule that overtime be paid at a maximum of Spinal Column Point 35; • overtime claimed by an employee for two different positions but for the same/overlapping time-period; and • a high proportion of claims where we consider that the explanation given for overtime is either not explicit or not reasonable (e.g. ‘overtime’, ‘additional workload’ etc.). Whilst we acknowledge that the authorising officer may have had sufficient knowledge of the overtime worked at the time of authorisation, we consider that it is important that sufficient narrative is included on the claim. These deficiencies provide a further indication of a continued lack of understanding by employees and managers of the rules and procedures which the Council have in place and indicates that previous reminders issued to both employees and managers have not resolved these issues. In addition, it is Internal Audit’s view that in some of these instances, while there is documentation to support the time worked, there appears some dubiety over whether these should be classed as overtime and therefore attracting an additional payment. Page 49 of 126
Page 50
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 7 3. Action Plan (continued) Follow Up of Overtime Duplicate Payments 0350/2024/002 Implication Recommendation Priority Management response Implementation Month/Year Claims may be submitted, authorised and paid that do not accurately reflect the amounts properly due. Ineligible and/or inappropriate claims may be made. The Chief Officer (People Resources) should ensure that: (1) as a priority, a robust mechanism is developed and implemented to identify, and hold to account, any managers who are continually authorising duplicate claims and are therefore failing to properly and effectively discharge the delegated financial authority assigned to them. This should include, but not be limited to, the need for completion of the Time and Expenses training to be made a mandatory requirement for authorising managers; reporting instances of authorising duplicate claims to the relevant Chief Officer and devising a process whereby continual dereliction of duties results in consideration of appropriate formal action; (2) a review is undertaken, after a sufficient period to allow arrangements to become embedded, to determine the adequacy and effectiveness of the processes in place to monitor and address those cases where employees repeatedly submit duplicate overtime claims, with amendments made as necessary; (3) regular reports detailing instances of recurring non- compliance of both submission and authorisation of duplicate claims are introduced and circulated to both People Resources management and relevant Chief Officer; and (4) guidance and training provided to both employees and managers provides clear and explicit instruction on the key expectations regarding the completion and review of overtime claims, including those listed in the finding above. High Agree Gillian Quinn, Employee Service Centre Manager and Linda Cullen, Employment and Policy Manager (1) and (3) Emails are now sent directly to both the manager and employee to notify that a duplicate claim has been submitted, approved and subsequently removed from payment runs. Additionally, regular reports are now being generated at a corporate level and shared with the People Resources management team. The HR team have now drawn up a proposed protocol and communications follow-up with managers who are seen to be repeatedly authorising duplicate claims (including reporting to Chief Officers). A report will be taken to the Business Management Team (BMT) in August 2024 to agree the implementation of this protocol, which may lead to disciplinary action if communications are ignored. The outcome of BMT’s consideration of this report will then be implemented from October 2024 on a pilot basis with full implementation by December 2024. (2) Once the protocol has had time to become embedded, the Service will undertake a review of how the process and resultant actions are working, including whether there has been any reduction in the number of duplicate claims submitted and authorised. (4) Work has already been undertaken to revise manager training and this will be rolled out to existing managers from October 2024 and will become part of the new managers induction programme thereafter. Similar improvements in training for employees is planned to the same timeline. December 2024 March 2025 October 2024 Page 50 of 126
Page 51
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 8 3. Action Plan (continued) Follow Up of Overtime Duplicate Payments 0350/2024/002 Ref Finding 3 Overpayments identified following the initial findings in the previous audit report have not yet been recovered. Following the initial findings in the previous audit, the Workforce Systems and Analytics Team produced a report to identify all potential duplicate claims over the two-year period to February 2023. Initial interrogation of this report by People Resources indicated a total value of overpayments caused by duplicate claims to be in the region of £150,000. In response to the recommendation made in the previous Internal Audit report issued in April 2023, People Resources agreed that they would present a report to CMT to highlight the issues raised by Internal Audit and, as part of this report, would seek a decision from CMT on how the identified overpayments, as referenced above, would be recovered. The Chief Officer (People Resources) presented a report to CMT in May 2023, and within this, it was agreed that the ESC would begin the process to recoup the overpayments. Subsequent discussions with ESC management, however, has confirmed that the overpayments arising from the potential duplicate claims have not, as yet, been recovered. People Resources had determined that further interrogation and investigation was necessary to ascertain if these potential duplicate claims, and the resultant overpayments, were bona fide and/or if they had been identified and recovered via other reviews/work undertaken by the ESC. We understand that work is currently underway to finalise the review of the potential duplicate claims previously identified, with reports thereafter to be issued to HR Business Partners for each service area to further review and discuss the identified overpayments with the affected employees and reporting managers. Once these have been reviewed and agreed, ESC management has indicated that recovery action will be taken either in one instalment (for smaller amounts) or via a repayment scheme (for larger amounts which would bring the employee close to a detrimental hardship situation). We also understand that a management decision has been taken to only pursue recovery of overpayments for current employees and the intention is to write-off overpayments for those no longer employed by the Council. The above highlights that recovery of the overpayments is still very much under consideration and requires further work before recovery can be instigated. While the Service has provided an outline of the proposed process for the recovery of said overpayments, there is no definitive plan detailing the actions required and the associated timescales and responsible officers. We consider that the lack of such a plan will make it difficult for People Resources to track and ensure that adequate progress is being made on a timeous basis. We understand that, once the recovery of the overpayments has started, the intention is that the Chief Officer (People Resources) and the HR Business Partnership Manager will receive progress updates on a fortnightly basis advising them of the amounts recovered and the outstanding balance. Implication Recommendation Priority Management response Implementation Month/Year Failure to progress recovery of overpayments in a timely manner increases the financial risk to the Council of non-payment of these overpayments. The Chief Officer (People Resources) should ensure that: (1) a formal plan, detailing the action required to be taken to agree and recover the previously identified overpayments and the associated timescales and responsible officers, is prepared and progress thereafter monitored; and (2) appropriate and timely action is thereafter taken to recover the overpayments referenced at recommendation (1) above, with regular updates on the status of the recovery of these overpayments provided to Senior Management. Medium Agree Gillian Quinn, Employee Service Centre Manager A summary of the overpayments has now been prepared and this has been split into existing employees and leavers (including casual workers). The Payroll and Pensions Team have completed detailed analysis for 2 Services and will work through the others to provide the same level of detail. With this further analysis, a report will be presented to BMT in August 2024 setting out various factors and scenarios relevant to recovery of these overpayments for consideration and approval. Thereafter the Service will create a formal plan detailing all actions required to implement the BMT decision. These actions will be monitored on an ongoing basis with regular updates to senior management as necessary. December 2024 Page 51 of 126
Page 52
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 9 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green - Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber - Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 52 of 126
Page 53
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 10 Appendix 2 Summary of Duplicate Claims Data Data in relation to duplicate claims submitted and authorised over the period June 2023 to May 2024 was obtained, analysed and is depicted below. 0 10 20 30 40 50 60 70 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 2 4 Duplicate claims Payrun period/week number Payrun 0416 - Duplicate claim data June 2023 to May 2024 Number of duplicate claims Number of employees submitting duplicate claims Number of managers authorising duplicate claims 0 20 40 60 80 100 120 140 160 180 12 16 20 24 28 32 36 40 44 48 52 4 Duplicate claims Payrun period/week number Payrun 0407 - Duplicate claim data June 2023 to May 2024 Number of duplicate claims Number of employees submitting duplicate claims Number of managers authorising duplicate claims Page 53 of 126
Page 54
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2023-24/0350.2024.002 - Follow-up of Overtime Duplicate Payments/A - FINDINGS AND REPORT/A06a 20240805 Duplicate Overtime Payments Final Report v1.0.docx 11 Appendix 2 (continued) Summary of Duplicate Claims Data 0 2 4 6 8 10 12 14 16 18 20 3 4 5 6 7 8 9 10 11 12 1 Duplicate Claims Payrun period/month number Payrun 0410 - Duplicate claim data June 2023 to May 2024 Number of duplicate claims Number of employees submitting duplicate claims Number of managers authorising duplicate claims 0 5 10 15 20 25 30 35 40 45 4 5 6 7 8 9 10 11 12 1 2 Duplicate claims Payrun period/month number Payrun 0411 - Duplicate claim data June 2023 to May 2024 Number of duplicate claims Number of employees submitting duplicate claims Number of managers authorising duplicate claims Page 54 of 126
Page 55
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0900.2024.005 - performance management/a - findings & report/a05a 20240705 performance management - final report as issued.docx 1 INTERNAL AUDIT REPORT PERFORMANCE MANAGEMENT Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: Level 2 and 3 performance indicators reviewed Appendix 3: Extract from NAO: Good Practice Criteria for Performance Management Issued to: Chief Executive (point 1(2) and 1(3)), Depute Chief Executive (point 1(2)) and Chief Officer (Business and Digital) (point 1(1)) Copied to: Business Strategy Manager and Strategy and Performance Manager Headlines The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s performance management and performance reporting arrangements. In September 2019, the Council approved a Strategic Performance Framework (SPF) which set out a framework for performance measurement at three levels, allowing for day-to-day activities and progress towards achieving the long-term vision set out in The Plan for North Lanarkshire to be regularly monitored, reported, assessed and scrutinised. The SPF is supported by an annual Performance Reporting Schedule which details the reporting, review and scrutiny arrangements for service and corporate performance information to be considered at committee meetings each year. The 2024-25 reporting schedule was approved by the Audit and Scrutiny Panel (ASP) in February 2024. Additionally, a quarterly performance assurance report is presented to the ASP each cycle to support scrutiny and oversight of performance information and monitor adherence to the reporting schedule. Our last report on performance management in October 2022 was categorised as offering ‘limited assurance’ as, at that time, many aspects of the SPF were not yet fully implemented and further work was required in respect of the corporate arrangements for monitoring and recording key strategic and operational performance measures by Services and the timely and regular reporting of performance to elected members and senior management. Based on the results of our work during this audit, we have categorised this audit as offering ‘Reasonable assurance’. We were pleased to note a significant improvement in the current arrangements for performance management, with regular and meaningful reports and data being submitted to committee in line with the reporting schedule, and the implementation of an assurance review and reporting process. We did, however, identify a small number of issues arising from our review of a sample of level 2 and 3 performance indicators, including issues with the content and completeness of definition sheets and queries in relation to the calculation of reported performance figures. The Internal Audit Annual Plan for 2024-25 includes an allowance for work on performance management and we intend to focus this work on the specific arrangements in place within individual Services. A small number of recommendations, in relation to the enhancement of current reporting and scrutiny arrangements, have been raised and these are detailed in section 3 of the audit report. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0900/2024/005 Date issued 05/07/2024 Audit Team Jacquie Howden, Lesley Armstrong, Jackie Struthers and Elizabeth Sweeney Page 55 of 126
Page 56
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0900.2024.005 - performance management/a - findings & report/a05a 20240705 performance management - final report as issued.docx 2 1. Executive Summary Objectives The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s performance management and performance reporting arrangements. In particular, the audit considered the following: • whether, for a sample of reported performance indicators, reported data is accurately described, is reporting what it purports to and has been consistently, accurately and robustly calculated; • whether performance data has been reported in line with the approved reporting schedule; and • the degree of interaction that senior management and elected members have had with reported performance data, including conclusions drawn and/or resultant actions. Work undertaken involved discussions with relevant staff and a detailed review of performance reports presented to, and discussed at, committee and senior management meetings. We also undertook substantive testing across Services on a sample of 14 level 2 and 3 performance indicators from the SPF (see Appendix 2 for details of the indicators reviewed), assessing against the National Audit Office’s ‘Performance Management: Good practice criteria and maturity model’, to determine the accuracy of reporting performance data, use of performance information and, where appropriate, compliance with statutory obligations. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 0 2 Key areas requiring management action (High) No key areas requiring urgent management action have been identified. Good practice identified We noted the following areas of good practice during the audit: • The SPF is one of six inter-related corporate frameworks which support the Council’s strategic plan, ‘The Plan for North Lanarkshire’ and associated Programme of Work. The SPF comprises a number of performance indicators across three levels (the North Lanarkshire context, improving outcomes and day-to- day operations), which are aligned with the Council’s priorities, ambition statements and programme of work items, and enable an assessment of the quality, efficiency and effectiveness of the Council’s day-to-day operations. • The SPF is supported by an annual Performance Reporting Schedule which sets out the reporting, review and scrutiny arrangements for a range of services and corporate performance information to be considered at each cycle of committee meetings. • Clear roles and responsibilities for performance management have been formally set out in the revised terms of reference for the Business Management Team (BMT), Corporate Management Team (CMT) and Service Management Teams (SMT). • A quarterly assurance review is undertaken by Business and Digital to monitor reports submitted to council committees, assess the extent to which performance information is being scrutinised at a senior management level, and determine whether performance monitoring arrangements effectively address areas of underperformance and identify scope for improvement and remedial action. The outcome of these assurance reviews are reported to the ASP. • There is a robust process in place for ensuring that all operational performance indicators are reviewed and sense checked for appropriateness/relevancy prior to their inclusion in the SPF. Other areas for improvement (Medium) No other areas for improvement were identified. Page 56 of 126
Page 57
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0900.2024.005 - performance management/a - findings & report/a05a 20240705 performance management - final report as issued.docx 3 3. Action Plan Performance Management 0900/2024/005 Ref Finding 1 Reporting and scrutiny arrangements could be further enhanced to assist continuous improvement. Internal Audit undertook a review of reports submitted to, and minutes arising from, recent committee and senior management meetings to determine the content and frequency of performance data being reported to elected members and senior managers and the level of discussion and scrutiny arising from such reports, together with any resultant actions. Chief Officers are required to produce six-monthly reports on performance to Service committees, using a standard template to ensure consistency across Services. These reports provide data on the performance indicators relevant to the Chief Officer, highlighting areas of good performance and providing a summary of areas requiring improvement, together with details of the remedial action required to bring performance back on track. A report to the Audit and Scrutiny Panel (ASP) in February this year, in relation to performance reporting and progress monitoring for The Plan for North Lanarkshire, identified a continuous improvement action in relation to performance reports to ensure that the implementation and monitoring of improvement actions and subsequent performance levels is captured to clearly demonstrate continuous improvement in line with the requirements of Best Value. We were advised by Business and Digital that the template for the performance report is in the process of being updated to better reflect this intention. The February ASP report also noted that the extent of the action undertaken by both elected members and senior management when reviewing and scrutinising performance information has been varied. The report re-iterated the roles and responsibilities of each stakeholder and advised that this information would be specifically referenced in future performance reports to service committees. Review of available documentation during this audit concurred with the issues raised in the above report, and as such it is Internal Audit’s view that consideration should be given as to whether any additional actions could be taken to enhance engagement from elected members in relation to scrutiny of performance information. For example, obtaining a sense of the level of engagement by elected members from Chief Officers or extending elements of scrutiny training to elected members outwith the ASP. All levels of senior management (Corporate Management Team (CMT), Business Management Team (BMT) and Senior Management Team (SMT)) have a responsibility for performance monitoring, albeit to varying degrees. From our review of recent minutes of these meetings, we noted that performance is generally discussed at meetings of CMT and BMT on a regular basis, however, discussions at SMT appear to vary between Services. The terms of reference for SMT state their responsibilities in relation to performance as ‘To scrutinise performance and progress in order to keep under review the Programme of Work and supporting strategies, policies, plans and delivery arrangements in so far as it is relevant to the service/service grouping and to undertake oversight and monitoring of operational performance’. Given this responsibility in relation to performance, we consider that, in order to facilitate appropriate scrutiny, Chief Officer performance reports should be discussed at the relevant SMT in advance of being submitted to committee and the details of any actions arising from such discussion should be appropriately captured in the minutes and/or action notes. Implication Recommendation Priority The Council’s performance management culture may not be effective in driving self-evaluation and improvement. Performance related issues may not be appropriately monitored and/or actioned. (1) The Chief Officer (Business and Digital) should ensure that, as planned, the performance reporting template for Committee is reviewed and updated, to ensure that the implementation and monitoring of improvement actions, and subsequent performance levels, to clearly demonstrate continuous improvement are included. (2) The Chief Executive and Deputy Chief Executive, as chairs of SMTs, should: • remind members of each SMT of their role and responsibilities in relation performance as detailed in the SMT terms of reference; and • ensure that appropriate consideration of performance reports is undertaken prior to being presented to committee, with any actions arising from such discussions appropriately captured in the minutes/action notes. (3) The Chief Executive, in his role as chair of the BMT, should ensure that a review of elected member engagement with the reported performance information is undertaken by BMT to identify whether there are any specific actions that could be taken to enhance, and appropriately document, the level of engagement and scrutiny by elected members. Low Page 57 of 126
Page 58
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0900.2024.005 - performance management/a - findings & report/a05a 20240705 performance management - final report as issued.docx 4 3. Action Plan (continued) Performance Management 0900/2024/005 Management response Implementation Month/Year Agree Katrina Hassell Chief Officer (Business and Digital) (1) Standardised report (and accompanying guidance) for Chief Officer Strategic Performance Framework reports to committee has been updated, as planned, to ensure that Chief Officers include information in relation to the implementation and monitoring of improvement actions, and subsequent performance levels, to demonstrate continuous improvement. The report template also contains a hyperlink to the Improvement Service’s online dashboard for Local Government Benchmarking Framework indicators so readers can view comparable information, where available. The report template also reiterates the role of a committee in respect of scrutinising performance. Updated template will be in operation for cycle 3 2024 reporting onwards. Agree Des Murray and Andrew McPherson Chief Executive and Depute Chief Executive (2) Respective SMT members (at scheduled SMT meetings) will be reminded that terms of reference include a requirement to scrutinise relevant performance, with future SMT agendas developed to facilitate inclusion of relevant performance reports prior to them being submitted to committees for consideration. Agree Des Murray Chief Executive (3) Engagement will take place with business managers / committee Conveners to discuss and agree ways in which to enhance elected members’ engagement and scrutiny of performance information. Complete - June 2024 August 2024. September 2024. Page 58 of 126
Page 59
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0900.2024.005 - performance management/a - findings & report/a05a 20240705 performance management - final report as issued.docx 5 3. Action Plan (continued) Performance Management 0900/2024/005 Ref Finding 2 Processes for monitoring and reporting performance indicators are generally robust, however, some areas for improvement in the implementation of these processes by Services have been identified. As part of the Council’s corporate performance arrangements, there is a requirement for Services to nominate a Calculating and Verification Officer for each performance indicator. Additionally, all performance indicators are required to have a performance indicator definition sheet, prepared by the relevant Service, which provides a definition of the process and information required to calculate the final indicator results, a worked example showing how the indicator will be calculated, the frequency of the calculation, the source data and details of the Calculating Officer and Verification Officer. The Business and Digital team has prepared and issued guidance for Services in respect of both of these requirements. We selected a sample of 14 level 2 (improving outcomes) and level 3 (day-to-day operations) performance indicators across all Services and reviewed the indicator definition sheets, source documentation and methodology used to ensure that reported indicators were accurately described and had been consistently, accurately and robustly calculated. For the sample of indicators reviewed, we were generally satisfied that indicator definition sheets had been prepared and named calculating and verification officers had been identified. However, we identified a number of areas where there is scope for improvement, including: • definition sheets which were not fully completed, did not adequately state what is being measured or how the indicator will be calculated, or did not include a worked example; • definition sheets which had not been signed and/or dated by the calculating and verification officer; • some calculating and verification officers advised that they had not been made aware of their role and responsibilities in relation to performance information; • indicators not being consistently and accurately calculated in line with the description and supporting documentation; • documentation to support the calculation of the indicator not being retained; • a lack of written guidance/procedures for calculating the indicator; and • year-end forms which had not been completed, had not been signed/dated or, in one case, had been signed against both designations by a single officer. We consider that the framework for ensuring that the performance indicators contained in the SPF are calculated, verified, monitored and reported is robust and that it is the responsibility of Chief Officers to ensure that the Services for which they are responsible comply with these arrangements. Therefore, future audits on performance information will focus on the arrangements in place within individual Services, including an in-depth assessment of the implementation of the corporate performance arrangements and the robustness of performance information produced. Implication Recommendation Priority If performance indicator definition sheets are not fully and accurately completed, it will be difficult to determine what an indicator is measuring and ensure that it is calculated in a consistent manner each period. If officers involved in the calculation and verification process are not fully aware of their responsibilities, performance information may be of poor quality and/or not prepared on a timely basis. No recommendation has been raised in relation to this finding as Business and Digital recently issued an email to all Calculating and Verification Officers outlining their roles and responsibilities and providing guidance in relation to submitting and verifying 2023-24 year-end data. This email requires officers to confirm whether they understand their role and have received the appropriate level of support. As stated in the finding above, future audits on performance information will focus on the arrangements within individual Services, which should enable Internal Audit to determine the level of compliance with processes and procedures and understanding of performance. Low Page 59 of 126
Page 60
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0900.2024.005 - performance management/a - findings & report/a05a 20240705 performance management - final report as issued.docx 6 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green - Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber - Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 60 of 126
Page 61
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0900.2024.005 - performance management/a - findings & report/a05a 20240705 performance management - final report as issued.docx 7 Appendix 2 – Level 2 and 3 Performance Indicators Reviewed Sample Service Indicator 1 Housing Management Housing services - % tenants satisfied with the standard of their home when moving in 2 Housing Property services Energy efficiency - % of council dwellings that meet the Energy Efficiency Standard for Social Housing (EESSH) standard 3 Finance Non domestic rates - % collected in the year 4 Finance Benefits administration – average days to process new claims 5 Business and Digital Service desk - % of all severity Level 3 incidents resolved within target 6 Education Parent satisfaction - % parents agree or strongly agree that overall they are satisfied with the school 7 Education HMIE inspection reports, early years - % of positive reports 8 Assets & Procurement Procurement contracts - % qualifying contracts > £1m containing a community benefit requirement 9 Education - ACC Museums learning experience – number of people engaging in museum learning experiences 10 Children, Families, Justice & Integrated practice - CLD Adult learning - % adults aged 16 and over participating in community learning and development programmes from the 20% most deprived areas 11 Community Operations Pest control requests, high priority - % visits made within 2 working days 12 Community Operations Refuse collection complaints, all categories – number of complaints per 1000 household visits 13 Place Business growth – number of new businesses supported 14 Place New build affordable homes - number delivered in NL council and social registered landlords Page 61 of 126
Page 62
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0900.2024.005 - performance management/a - findings & report/a05a 20240705 performance management - final report as issued.docx 8 Appendix 3 – National Audit Office: Good Practice Criteria for Performance Measurement Activity Good Practice Criteria Reporting Performance Information Data quality The measure has a clear, unambiguous definition so that data will be collected consistently, and is easy to understand and use. The performance indicators and supporting information are well documented, to allow for validation. There are systems of control to check that data is accurate, reliable and robust Baselines are set for measuring performance against indicators. Measures are capable of comparison with either past periods or similar programmes elsewhere. Data is produced frequently enough to track progress and quickly enough for the data to still be useful. Management decides on the appropriate balance between timely and accurate data, where these may conflict. The performance measurement framework draws appropriately on different data sources, including external sources where cost-effective. Performance information collected is relevant and proportionate to the purposes of the framework. Reporting in context The organisation articulates success criteria for performance measures, with a stated rationale and clear process for selecting those criteria. Performance against indicators should be benchmarked against, for example, similar organisations or functions. Presenting with analysis and insight The organisation makes sufficient allowance (time and resources) for analysing and interpreting data. The information being collected (and presented) should be appropriate to, and useful for, (each of) the stakeholders who are likely to use it. The organisation has clear and structured rationale and processes for deciding what information to report internally, and what to report publicly. Performance information is presented in a way that is accessible and draws attention to the most important issues. Presentation includes structured analysis of performance information and includes insights into the factors influencing performance, and what the organisation is able to influence. Using Performance Information Linking performance and financial information The performance measurement framework links performance and financial information (for example through Activity-Based Costing). Management uses linkages between performance and financial information to assess value for money. Guiding decision- making The board is committed to performance measurement and has a clear approach to use of the performance measurement framework. The board reviews the performance measurement system periodically to satisfy itself that the board's needs are met and that its benefits exceed the costs. Performance measurement framework outputs feed into objectives and business planning. The framework helps to promote good governance and scrutiny of performance by non-executives and others. There should be processes to check for unintended outcomes (for example matters falling outside of established indicators). Page 62 of 126
Page 63
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0200.2024.004 - general ledger/a - findings and reports/a06a 20240711 general ledger final report as issued v1.0.docx INTERNAL AUDIT REPORT GENERAL LEDGER Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officer (Finance) and Business Finance Manager Copied to: Chief Executive and Deputy Chief Executive Headlines This was a high-level review designed to provide independent assurance on the adequacy and effectiveness of the Council’s control environment in relation to the general ledger and reliability of accounting data. In particular, the audit considered whether the key controls associated with the Council’s general ledger system were effective in ensuring that the Council has, and can access, reliable financial data. Section 95 of the Local Government (Scotland) Act 1973 requires every local authority to make arrangements for the proper administration of their financial affairs and appoint a Section 95 Officer to be responsible for the administration of those affairs. The Council has appointed the Chief Officer (Finance) as the Section 95 Officer who is supported by a suitably experienced central finance function and good financial management processes. To ensure that public money is safeguarded and properly accounted for, the Council utilises the eFinancials general ledger system, which enables proper recording of financial transactions and supports the preparation of the annual accounts. Based on the results of our audit work, we have categorised this audit as offering ‘substantial assurance’, as a generally sound system of governance, risk management and control is in place, with internal controls operating effectively and being consistently applied. In particular, we noted that: • appropriate access controls and processes were in place to protect the integrity of the system and its data; • there was adequate documentation to support the completeness, accuracy and validity of manual adjustments and information from feeders; • there was evidence that suspense accounts and bank reconciliations were being reviewed and reconciled on a regular basis; and • period end close processes were being carried out in a timely manner. We have identified some minor areas for improvement and these are detailed at section 3 of the report for management consideration. Internal Audit Opinion (see definition at Appendix 1) Substantial Assurance (Green) Organisational impact (see definition at Appendix 1) Minor Report status FINAL Audit ref 0200/2024/004 Date issued 12/07/2024 Audit Team Elaine MacDonald, Jacquie Howden and Paula Hendry Page 63 of 126
Page 64
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0200.2024.004 - general ledger/a - findings and reports/a06a 20240711 general ledger final report as issued v1.0.docx 1. Executive Summary Objectives This was a high-level review designed to provide assurance on the adequacy and effectiveness of the Council’s control environment in relation to the general ledger and reliability of accounting data. In particular, the audit considered whether the key controls associated with the Council’s general ledger system were effective in ensuring that the Council has, and can access, reliable financial data. The review focussed on the following: (1) Is all data held within the general ledger secure and is access properly controlled and restricted to only authorised officers? (2) Is the system adequately protected against loss or damage of data, with regular back-ups taken which are periodically reviewed to ensure that they could be used, if necessary? (3) Are journal entries and any other manual adjustments complete, valid and supported by adequate supporting documentary evidence, and appropriately authorised in accordance with approved procedures? (4) Is information interfaced from key feeder systems (such as Payroll, Creditors, Council Tax, Housing rents etc.) checked to ensure the completeness and accuracy of the relevant process, and are such checks performed regularly and accurately and subject to management checks/verification? (5) Are suspense accounts regularly reviewed and updated/action taken as appropriate in accordance with expected procedures, with any large or long-standing outstanding items sitting in suspense accounts being monitored, understood and/or subject to regular/appropriate management attention and action? (6) Is the completeness and accuracy of bank and other key reconciliation processes reviewed and confirmed by management in a regular and timely manner? (7) Are period-end closedown procedures performed in a timely basis and/or in line with an agreed timetable and are there appropriate management checks on the completeness and accuracy of the closedown process? This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 0 2 Key areas requiring management action (High) No areas requiring urgent management action were identified. Good practice identified We noted the following areas of good practice during the audit: • access to the general ledger system is controlled via user access levels, which can only be created by the Systems Admin Team on receipt of a formal User Registration/Delete User form, and the use of individual passwords. User access is maintained up to date, with ongoing reviews of leavers and an annual review of all live system users; • there are adequate controls in place to protect the integrity of the system data, including daily back up procedures, controls over who can make changes to the system data, period and year-end close down procedures, and formal Business Continuity and Data Recovery Plans; • journal entries and other manual adjustments (including IDTs) are generally complete, valid and supported by adequate documentary evidence and appropriately authorised in accordance with approved procedures, including appropriate segregation between individuals raising and authorising journals; • procedures for the regular review and actioning of suspense account balances are in place; and • bank reconciliations are prepared, where appropriate, on a timely basis each period. Other areas for improvement (Medium) No other areas for improvement were identified. Page 64 of 126
Page 65
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0200.2024.004 - general ledger/a - findings and reports/a06a 20240711 general ledger final report as issued v1.0.docx 3. Action Plan General Ledger 0200/2024/004 Ref Finding 1 There is scope to further strengthen some of the processes around journals, manual adjustments and suspense accounts. From our testing, we are generally satisfied that the general ledger control environment is robust, however, we identified a small number of areas where we consider that there is scope to further enhance the processes in place, as follows: • the narrative for some journals is generic and lacks specific details and/or reference to the original charge being adjusted and it is considered that more specific and detailed narrative would enhance the traceability and understanding of the purpose of each journal; • a significant proportion of Inter Departmental Transfers (IDTs), which are typically small value and repetitive in nature, are being approved by the default ‘auto process’ arrangement after 14 days rather than by service management. The Systems Admin Team advised that they are currently considering a proposal to cease use of the IDT functionality and we consider this review should be concluded timeously; • our review of the ‘postable’ suspense accounts report identified that many of the accounts contained zero balances, with no recent postings, and we consider that these accounts should be reviewed to determine whether they should remain ‘postable’, given that they are no longer active; and • we identified a small number of suspense accounts which contained government grants for use on specific projects and consider that, given this method of recording, there is a risk that these funds may not be properly accounted for in the annual accounts. We understand that there are plans in place to address this from 2024-25 onwards. Implication Recommendation Priority Management response Implementation Month/Year The ledger may not reflect an up to date or accurate financial situation or provide adequate explanation of the legitimacy of transactions posted into ledger accounts. Processes in place may be inefficient if they are considered outdated, ineffective and/or not regularly reviewed and amended for continued relevance. The Council may not be accounting for government funds in accordance with expected accounting practices. The Chief Officer (Finance) should: (1) remind services of the need to ensure all journals contain sufficient and appropriately detailed narrative, to clearly state the purpose of the journal; (2) undertake a review of IDTs to determine whether they continue to be the most appropriate method for internal recharges, and if not, identify and implement an alternative method; (3) regularly review zero balance suspense accounts to identify those which are no longer actively used, and consider setting them to ‘unpostable’ to prevent incorrect use; and (4) ensure that ringfenced funds contained in suspense accounts are properly accounted for as Ear Marked Reserves, in line with expected accounting practices. Low Agree Kathleen Shearer Business Finance Manager (1) Services will be reminded of the importance of having sufficient and appropriately detailed narrative stating the purpose of journals. (2) A review of IDTs will be carried out to determine whether they continue to be the most appropriate method for internal recharges, and if not, an alternative method will be identified and implemented. (3) Service Finance teams have been asked to review suspense accounts with zero balances and make ‘unpostable’ as appropriate, with a number of zero balance suspense accounts already made ‘unpostable’ within eFinancials. A process will also be introduced to periodically identify suspense accounts which are no longer actively used, and consider if should be ‘unpostable’, to prevent incorrect use. (4) Service Finance Teams will be reminded of the correct accounting treatment for grant funding, and asked to review all suspense accounts and to periodically confirm compliance with such as part of the suspense review process July 2024 October 2024 August 2024 July 2024 Page 65 of 126
Page 66
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0200.2024.004 - general ledger/a - findings and reports/a06a 20240711 general ledger final report as issued v1.0.docx 3. Action Plan (continued) General Ledger 0200/2024/004 Ref Finding 2 Bank account reconciliation documentation was not always dated and signed as reviewed/authorised. From our review of the bank account reconciliations, we are generally satisfied that reconciliations are being undertaken on a regular and timely basis and that there is appropriate evidence in place to support the process for preparing and authorising each reconciliation. However, we noted that the reconciliation documentation for periods 9 to 11 for the School Meals and Creditors bank accounts were not dated and had not been signed by the relevant reviewing/authorising officer. Implication Recommendation Priority Management response Implementation Month/Year Without appropriately completed documentation, there would be no evidence to support that reconciliations were undertaken on a timely basis and/or prepared and reviewed by the relevant officers The Chief Officer (Finance) should remind staff that bank reconciliation documentation should be appropriately dated and signed by the relevant officers preparing/reviewing the reconciliation. Low Agree Kathleen Shearer Business Finance Manager All staff have been reminded that bank reconciliation documentation should be appropriately dated and signed by the relevant officers preparing/ reviewing the reconciliation. July 2024 Page 66 of 126
Page 67
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2023-24/0200.2024.004 - general ledger/a - findings and reports/a06a 20240711 general ledger final report as issued v1.0.docx Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green - Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber - Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 67 of 126
Page 68
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2024-25/0900.2025.003 - Corporate Governance 2023-24/A - Findings and Reports/A06a 20240729 Corporate Governance final report v1.0.docx 1 INTERNAL AUDIT REPORT CORPORATE GOVERNANCE 2023-24 Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: Good Governance Principles Issued to: Chief Officer (Business and Digital) and Strategy and Performance Manager Copied to: Business Strategy Manager, Chief Executive and Depute Chief Executive Headlines The purpose of this review was to provide assurance on the adequacy and effectiveness of the Council’s arrangements for ensuring that it complies with the CIPFA Delivering Good Governance in Local Government Framework 2016. Details of the good governance principles are contained at Appendix 2. The audit focussed on the robustness of the self-evaluation arrangements for the Strategic Governance Framework undertaken by management and considered the management arrangements in place for assessing current developments and planned improvement actions. The CIPFA framework requires that councils test their arrangements against good governance principles annually by reviewing their arrangements, ensuring that their local code is up to date and reporting on compliance. The Council’s local code of governance is set out in the Strategic Governance Framework, which was initially approved in February 2020, and is subsequently refreshed and approved by the Audit and Scrutiny Panel annually. The annual review process and refreshed Strategic Governance Framework is a key piece of evidence used to inform the development of the Annual Governance Statement. Based on the results of our work, together with our wider general knowledge gained from previous Internal Audit reviews undertaken in this and other associated areas, we consider that the Council’s corporate governance arrangements in relation to self-assessment are adequate and operating effectively. We have therefore assessed this audit as providing ‘substantial assurance’. In particular, we were pleased to note that robust and appropriate arrangements are in place to undertake an annual self-assessment exercise against the CIPFA framework, including a review and refresh of the Strategic Governance Framework and completion of checklists and certificates of assurance by Chief Officers and ALEO Chief Executive’s. This self-assessment indicated a high level of compliance with the corporate governance framework and our sample-based audit testing concurred with this. We were also pleased to note that the outcome of this self-assessment exercise, together with the consideration of the outcomes of internal and external audit reviews, reports arising from inspections from external bodies and any improvement actions or future developments, are reported to senior management and the Audit and Scrutiny Panel as part of the Annual Governance Statement. We have identified one minor area for improvement and this is detailed at section 3 of the report for management consideration. Internal Audit Opinion (see definition at Appendix 1) Substantial assurance (Green) Organisational impact (see definition at Appendix 1) Minor Report status FINAL Audit ref 0900/2025/003 Date issued 29/07/24 Audit Team Elaine MacDonald and Lesley Armstrong Page 68 of 126
Page 69
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2024-25/0900.2025.003 - Corporate Governance 2023-24/A - Findings and Reports/A06a 20240729 Corporate Governance final report v1.0.docx 2 1. Executive Summary Objectives The purpose of this review was to provide assurance on the adequacy and effectiveness of the Council’s arrangements for ensuring that it complies with the CIPFA Delivering Good Governance in Local Government Framework 2016. The audit focussed on the robustness of the self-evaluation arrangements for the Strategic Governance Framework undertaken by management and considered the management arrangements in place for assessing current developments and planned improvement actions. The audit was designed to offer an audit opinion on the following: • Does the Council have appropriate and robust arrangements in place to periodically self-assess compliance with Principles of the Delivering Good Governance Framework? • Does this include arrangements to agree and progress any improvement actions identified? This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 0 1 Key areas requiring management action (High) No areas requiring urgent management action have been identified. Good practice identified We noted the following areas of good practice during the audit: • The Council has established a Strategic Governance Framework which demonstrates its commitment to good governance. This framework is reviewed and refreshed annually to ensure that it remains consistent with the principles of the Delivering Good Governance Framework. • Chief Officers are required to complete checklists and Certificates of Assurance on annual basis to confirm compliance with corporate governance arrangements and financial controls, highlighting any areas of concern. • Reports on the Strategic Governance Framework annual review and Annual Governance Statement are produced and presented to senior management and the Audit and Scrutiny Panel. Other areas for improvement (Medium) No other areas for improvement were identified. Page 69 of 126
Page 70
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2024-25/0900.2025.003 - Corporate Governance 2023-24/A - Findings and Reports/A06a 20240729 Corporate Governance final report v1.0.docx 3 3. Action Plan Corporate Governance 2023-24 0900/2025/003 Ref Finding 1 A minor improvement action has been identified in relation to the completion of the annual assurance certificates and checklists. Chief Officers and Chief Executives of ALEOs are required to complete an annual assurance checklist and certificate which is used as evidence to inform the production of the Annual Governance Statement. Our work during this audit included a review of the checklists and certificates completed by each Chief Officer/Chief Executive. We were pleased to note that the checklists and certificates were generally completed to a high standard, with all questions posed responded to and any required additional information being recorded. Despite Business and Digital reviewing completed checklists and requesting Chief Officers/Chief Executives of ALEOs to update any omissions, we noted that a small number of certificates of assurance had not been fully completed as they did not clearly indicate whether there were any matters which required to be raised (statement 3) and/or had not been signed/ dated by the chief officer/chief executive. Implication Recommendation Priority Management response Implementation Month/Year Chief officers may fail to highlight matters for consideration when preparing the Annual Governance Statement and these may subsequently be omitted from the statement. Chief officers may fail to take ownership for completion of the assurance certificate and checklists. The Chief Officer (Business and Digital) should ensure that details of any omissions by Chief Officers and/or Chief Executives of ALEOs in completing the annual assurance certificate and checklist are reported to BMT. Thereafter BMT should take appropriate action to ensure that the final versions of the annual assurance certificates and checklists have been fully completed, signed and dated. Low Agree Katrina Hassell, Chief Officer (Business and Digital) This action will be incorporated into the 2024/25 year end corporate governance assurance checklist and certificate process when it is next undertaken in May 2025 to further support the BMT in carrying out their strategic oversight and assurance role. May 2025 Page 70 of 126
Page 71
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2024-25/0900.2025.003 - Corporate Governance 2023-24/A - Findings and Reports/A06a 20240729 Corporate Governance final report v1.0.docx 4 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green - Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber - Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 71 of 126
Page 72
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2024-25/0900.2025.003 - Corporate Governance 2023-24/A - Findings and Reports/A06a 20240729 Corporate Governance final report v1.0.docx 5 Appendix 2 – Good Governance Principles The core principles and sub principles of good governance set out in the 2016 CIPFA/Solace ‘Delivering good governance in Local Government Framework (‘the framework’) are taken from the International Framework: Good Governance in the Public Sector (IFAC/CIPFA 2014) and interpreted for a local government context. It is the responsibility of each local authority to: • set out its commitment to the principles of good governance included in the framework; • determine its own governance structure or local code by these principles; and • ensure that it operates effectively in practice. Core and Sub Principles A: Behaving with integrity, demonstrating strong commitment to ethical values, and respecting the rule of law A1 Behaving with integrity A2 Demonstrating strong commitment to ethical values A3 Respecting the rule of law B: Ensuring openness and comprehensive stakeholder engagement B1 Openness B2 Engaging comprehensively with institutional stakeholders B3 Engaging stakeholders effectively, including individual citizens and service users C: Defining outcomes in terms of sustainable economic, social and environmental benefits C1 Defining Outcomes C2 Sustainable economic, social and environmental benefits D: Determining the interventions necessary to optimise the achievement of the intended outcomes D1 Determining intervention D2 Planning interventions D3 Optimising achievement of intended outcomes E: Developing the entity’s capacity, including the capability of its leadership and the individuals within it E1 Developing the entity’s capacity E2 Developing the capability of the entity’s leadership and other individuals F: Managing risk and performance through robust internal controls and strong public financial management F1 Managing risk F2 Managing performance F3 Robust internal control F4 Managing data F5 Strong public financial management G: Implementing good practices in transparency, reporting, and audit to deliver effective accountability G1 Implementing good practice in transparency G2 Implementing good practices in reporting G3 Assurance and effective accountability Page 72 of 126
Page 73
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref PH/LM/ASP/August 2024 Date 29/08/24 Internal Audit: Follow up of actions previously agreed by management in response to audit recommendations From Paula Hendry, Acting Chief Officer (Audit and Risk) E-mail hendryp@northlan.gov.uk Telephone 07471 321768 Executive Summary The purpose of this report is to update the Panel on the results of Internal Audit’s follow-up work, reviewing the extent to which management have implemented actions previously committed to in response to External Audit recommendations made in the last two years, and ‘High’ and ‘Medium’ Internal Audit recommendations which were previously reported as outstanding or due to be completed in the period April to the end of June 2024. The Panel should note that where actions are not yet ‘complete’, this does not mean that no relevant activity has been undertaken by management and that the actions taken/progress made to date will often have reduced the risk exposure in respect of the weaknesses previously identified even if the action is not yet complete. Those recommendations which were previously reported to the Panel as ‘partially implemented’ are now monitored against revised target implementation dates agreed with management and previously reported to the Panel. In this cycle, seven of the 11 actions agreed in respect of External Audit outputs have been completed, two are partially implemented, one is not yet due, and one is no longer relevant. Of the 37 actions, agreed in response to relevant Internal Audit recommendations, due in the period, 18 have been fully completed, 17 have been assessed as partially implemented and two are no longer relevant. However, it should be noted that 89% of all relevant audit recommendations made since April 2021, where the original agreed implementation date was either due or had passed, have been implemented by Services, meaning that only 11% of these audit recommendations remain outstanding. Recommendations The Panel is invited to: (1) note the contents of this report; (2) note the recommendations made by Internal Audit at Appendix 1; and (3) consider whether there are any issues arising from this report on which they wish to receive further information from relevant management. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work All Programmes of Work Item 6 Page 73 of 126
Page 74
1. Background 1.1 Internal and External Audit reports contain management responses to audit recommendations which generally include a commitment to specific actions by a stated date. This report presents an overview of progress by management in addressing all External Audit recommendations made in the last two years, and all ‘High’ and ‘Medium’ Internal Audit recommendations which were previously reported as outstanding or where the proposed actions were due to be completed in the period April to the end of June 2024. 1.2 The format of this report is designed to allow the Panel to focus on those issues where non-implementation of agreed actions presents the most significant ongoing risk to the Council and to enable the Panel to hold relevant senior management to account. 1.3 Internal Audit’s arrangements for following-up audit recommendations include, in certain circumstances, agreeing a revised implementation date and monitoring and reporting against these revised dates where we are provided with a strong rationale for the non-implementation of the audit recommendation by the originally agreed date. This avoids repeatedly reporting and focusing on actions which are ‘late’ where there are sound reasons for non-implementation by the originally agreed date. 1.4 This report presents the assessment of the potential risks arising from those planned actions, agreed in response to Internal Audit recommendations, due in the period (April to June 2024) which are not yet fully completed. 1.5 The updates from management on progress to date have been verified on a sample basis by Internal Audit as part of the preparation of this report. However, it should be noted that this review has focused on whether planned actions have been completed and has not included detailed substantive testing of whether the implemented actions have been effective in addressing previously identified weaknesses. 2. Report Actions previously agreed by management – Internal Audit recommendations 2.1 Table 1 below shows whether management have implemented those actions previously agreed to in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed in the period April to the end of June 2024. Overall, 18 of the agreed actions have been completed, 17 have been assessed as partially implemented and two have been assessed as no longer relevant. Table 1 Complete Partially implemented No longer relevant Total Chief Officer Area Asset and Procurement 3 3 0 6 Audit and Risk 2 2 0 4 Business and Digital 1 0 0 1 Community Operations 0 2 0 2 Education 5 7 0 12 Finance 1 0 0 1 Housing Management 1 1 0 2 People Resources 2 2 1 5 Place 1 0 1 2 Social Work 2 0 0 2 TOTAL 18 17 2 37 Page 74 of 126
Page 75
2.2 Internal Audit has reviewed the management updates and agreed, with relevant management, revised implementation dates for all 17 recommendations listed as partially implemented at Table 1. These recommendations will now be monitored in line with the agreed revised date and will be reported back to the Panel in accordance with this revised timescale, at which time consideration will be given as to whether previously identified weaknesses have now been addressed. 2.3 Detail in respect of each of these recommendations and the current residual risk assessed by Internal Audit because of partial implementation is provided in Appendix 1, in which we have also made suggestions as to how the Panel may wish to consider these issues. Definitions of the residual risk ratings are provided at Appendix 2. 2.4 Both actions assessed as ‘no longer relevant’ relate to recommendations which have been superseded by new recommendations raised following recent audit assignments. One of these relates to issues in respect of Payroll and the other relates to the interface between PECOS and eFinancials. These new recommendations will be followed up in line with the normal protocols. Outstanding Internal Audit Recommendations 2.5 The Panel will recall that concerns were previously raised about the level of recommendations which remain outstanding, and the relatively low percentage of agreed actions implemented by the agreed implementation date. As a result, discussions were held with the Corporate Management Team and since then, we are pleased to note that there continues to be a marked improvement in the Service’s co-operation for the updates requested, the quality of narrative provided for these updates and the number of recommendations which have been actioned by the agreed implementation date. 2.6 At our first reporting of the overall position in November 2023, 75% of relevant audit recommendations made since April 2021, where the original agreed implementation date was either due or had passed, had been implemented by Services. The current position as at this cycle (August 2024), is that 89% of all relevant audit recommendations made since April 2021, where the original agreed implementation date was either due or had passed, have been implemented by Services, meaning that the percentage overall of all audit recommendations made since April 2021 which remain outstanding has decreased to 11%. 2.7 Recognising the Panel’s request for this report to specifically highlight instances where Service action to address the recommendation was still outstanding but the original implementation date agreed by management was over a year old, the audit team is working to develop an amended reporting format that will facilitate this. Actions previously agreed by management – External Audit recommendations 2.8 Table 2, on the next page, shows the status of actions agreed by management in response to External Audit reports issued as part of the 2021-22 and 2022-23 audits. 2.9 Internal Audit has concluded that seven of the agreed actions have been completed, two have been partially implemented, one is not yet due, and the remaining action is no longer relevant. Page 75 of 126
Page 76
Table 2 Completed Partially implemented Not yet due No longer relevant Total Report Title/Year 2021-22 Annual Report 2021/22 4 0 0 1 5 2022-23 Annual Report 1 2 0 0 3 Best Value Thematic Report 2 0 1 0 3 TOTAL 7 2 1 1 11 2.10 The External Audit action assessed as ‘no longer relevant’ relates to an issue on which External Audit have made a similar recommendation in a subsequent audit report. 3. Measures of success 3.1 Internal Audit report each cycle to the Audit and Scrutiny Panel on the progress made by management in implementing actions previously committed to in response to Internal and External Audit reports. 4. Supporting documentation Appendix 1 Internal Audit recommendations: Management actions assessed as ‘not yet complete’ in this cycle Appendix 2 Residual risk rating definition Paula Hendry, Acting Chief Officer (Audit and Risk) Page 76 of 126
Page 77
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure by Services to address previously identified issues and/or weaknesses will impact on the effectiveness of the relevant control framework. This, depending on the nature of the issue, will be captured and should be reflected in the relevant service risk register or the corporate risk register (as appropriate). 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 77 of 126
Page 78
Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Asset and Procurement) Contract Management (April 2023) Risk: Without robust overarching review/monitoring arrangements, management would not be able to determine whether effective Contract & Supplier Management (C&SM) activities were being undertaken in accordance with corporate expectations. C&SM performance issues may not be appropriately managed and lessons learned/ good practice may not be adequately shared across the Council. Recommendation: The Chief Officer (Asset and Procurement) should: (a) review and determine a proportionate risk-based approach for the Council to gain assurance on the extent of compliance across Services with key corporate expectations in relation to contract and supplier management. This might include requiring Chief Officers to attest that the arrangements within their Service areas comply with the guiding principles within the C&SM guidance (where alternative Service specific arrangements are in place), an annual confirmation by Chief Officers that C&SM activity within their Services is operating as intended and periodic compliance checks on a sample of contracts to verify that expected processes are being properly adhered to; and (b) consider the adequacy of the current arrangements for reviewing/updating the contract management information within the contract register database and determine how this might be used to facilitate effective C&SM monitoring and oversight as per recommendation (a) above. Category: High A process is now in place for a risk-based approach which will enable the Council to gain assurance on the extent of compliance across Services with key corporate expectations in relation to Contract and Supplier Management. A poll has recently been issued to Chief Officers to seek their assurance over contract awards made for their Service Areas during Financial Year 2023/24. A similar poll is being conducted with Contract Managers and the responses for both are expected by the end of August 2024. The scope captures 107 Agreements with a combined value of up to £139m and it engages 14 Chief Officers and 76 Contract Managers. A sample of 5% of the contracts will be reviewed by the Corporate Procurement Team to determine if the expected Contract and Supplier Management (from pre- tender Contract Strategy) has been undertaken since the contract award and the results will be recorded. Going forward the Corporate Procurement Team will liaise with the Strategy and Performance Manager with a view to utilising the existing Annual Governance Checklist issued to Chief Officers to obtain confirmation of compliance by including questions around Contract and Supplier Management activity within their Service. The Procurement Register can be amended to include the Compliance and Supplier Management assurance and compliance checks. Further analysis and improved reporting would be best suited to a bespoke platform which will be explored during 2024/25 in consultation with the Corporate Procurement Working Group (CPWG). Original timescale: December 2023 Revised timescale: June 2024 Further revised timescale: December 2024 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to mitigate the risks. We further acknowledge that the delay in implementation is largely due to competing priorities and the secondment of members of the Corporate Procurement Team to other projects. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of December 2024 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 78 of 126
Page 79
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Asset and Procurement) Contract Management (April 2023) Risk: Inexperienced officers may be identified as Contract Owners which may prevent the contracts from being managed effectively. Staff may not be aware of the Council’s Contract & Supplier Management (C&SM) guidance and/or corporate expectations on Contract owners for undertaking C&SM. Without the appropriate training, officers would not be able to sufficiently undertake their duties for C&SM. Recommendation: The Chief Officer (Asset and Procurement) should ensure that: (1) all Chief Officers are reminded of the need to nominate appropriately skilled/experienced officers as contract owners and ensure that such staff are made aware as soon as possible of the C&SM guidance and the responsibilities and corporate expectations placed on them when undertaking such a role; (2) the eLearning modules and associated training continue to be developed in accordance with the expected timescales and consideration is given to the need for specific mandatory training on the corporate C&SM guidance for those nominated as Contract Owners; and (3) the C&SM guidance is subject to periodic review to ensure that it continues to be adequate and reflects current corporate expectations in relation to C&SM activity across the Council. Category: Medium The Corporate Procurement Team submitted a report on Contracts, Owners and Expected Contract Management to the Corporate Procurement Working Group (CPWG) meeting in July 2024 to keep them informed of developments. The identification of awareness and training needs specific to procurement associated roles are being explored and training options were shared with the CPWG at their meeting in July 2024. Paid options are available immediately, however if these are deemed to be cost-prohibitive there will be a need to develop and deliver in-house training which will mean there will be a longer lead-in time. The Contract and Supplier Management guidance is currently under review and the CPWG are being kept informed of progress made and are consulted as necessary. Original timescale: December 2023 Revised timescale: June 2024 Further revised timescale: March 2025 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to mitigate the risks. We further acknowledge that the delay in implementation is largely due to competing priorities and the secondment of members of the Corporate Procurement Team to other projects. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of March 2025 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 79 of 126
Page 80
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Asset and Procurement) Procurement – Achieving Best Value (June 2023) Risk: Without formal documented analysis, key stakeholders may have no basis to make decisions and/or identify any areas for concern and/or requiring management attention. A lack of documentation to support reported performance measures could result in figures being calculated inconsistently which could result in difficulty comparing performance over different years and/or inaccurate reporting and/or interpretation of results. Recommendation: The Chief Officer (Asset and Procurement) should consider and identify a condensed suite of indicators which would allow for the measurement, analysis and reporting of all procurement activity notified to the CPT including relevant indicators to capture procurement exercises which did/did not involve competition and ensure that this is subject to regular review to identify any trends and/or potential issues within particular sectors and/or goods/services, investigate the reasons for these and take appropriate action to resolve. Category: Medium The CPWG have agreed that the Contract Award Reporting Template, used for Committee Reports since Cycle 3 2023, be used for all procurements going forward. This will provide a better assurance for Chief Officers in procuring service areas, especially when the procurement is non-regulated and/or within their approval limit. An update to the General Contract Standing Orders is scheduled to be undertaken in 2024/25. Original timescale: April 2024 Revised timescale: March 2025 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to mitigate the risks. We further acknowledge that the delay in implementation is largely due to competing priorities and the secondment of members of the Corporate Procurement Team to other projects. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of March 2025 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 80 of 126
Page 81
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Audit and Risk) Review of the Council’s Counter Fraud Arrangements (August 2023) Risk: The Council may not be able to fully demonstrate compliance with good practice on counter fraud arrangements. The absence of proactive fraud investigation work could significantly impact the Council’s ability to promptly identify, prevent and/or respond to fraud and irregularity and could lead to significant financial loss for the Council. Recommendation: The Chief Officer (Audit and Risk) should: (1) review and consider the benefits of identifying and undertaking more proactive work in relation to fraud and irregularity by assessing the level of fraud risk and identifying service areas where proactive fraud work could potentially lead to financial savings for the Council; (2) consider whether there is a need for a dedicated, appropriately qualified and experienced staff resource to undertake such work. This may include discussions with other Councils who already have such a resource to identify potential areas of work and the cost and benefits involved; and (3) prepare an annual counter fraud plan which outlines the fraud work to be undertaken throughout the year and an annual counter fraud report which details the success and outcomes of the Counter Fraud Policy, including the levels of fraud reported, fraud work undertaken, analysis of statistics in relation to fraud activity and outcomes, publication of successful outcomes and future plans for undertaking fraud work. Category: Medium There has been no specific action taken to date with regards this recommendation other than the initial communication in October 2023 when the new Counter Fraud Policy was discussed at OMT, CMT and RMCWG highlighting the changes to the Policy and raising awareness of fraud risks. The 2024/25 Annual Audit Plan has a specific time allocation for counter fraud activities, and this will be utilised to research and determine an approach to take to CMT on the recommendations made. Original timescale: April 2024 Revised timescale: March 2025 We acknowledge that the delay in implementation of these actions is largely due to absence of the Chief Officer (Audit and Risk). We note the actions proposed to mitigate the risks identified and consider the revised timescale to be reasonable. We have assessed the residual risk for this recommendation as ‘Medium’ and consider it important that the agreed extension date of March 2025 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 81 of 126
Page 82
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Audit and Risk) Review of the Council’s Counter Fraud Arrangements (August 2023) Risk: Staff and Elected Members may not be aware of the Council’s approach to fraud and their responsibilities in relation to the prevention, detection and reporting of fraud. Recommendation: The Chief Officer (Audit and Risk) should identify and implement appropriate and effective methods for communicating and raising awareness of fraud risks and responsibilities for preventing, detecting and reporting fraud. This should include: • promoting the Counter Fraud Policy by making it available on relevant platforms (such as InsideNL, MYNL and the Council’s website) and through regular awareness raising activities (such as NLC announcements or inclusion in staff newsletters); and • creating a form for reporting fraud, both internally and externally, to incorporate all the required information and enable prompt notification to Internal Audit. Category: Medium The Counter Fraud Policy is available on InsideNL and the Council’s website. Work is underway to devise a reporting form for employees, and on the Council website for the public, to enable suspected frauds and irregularities to be reported. It has also been determined that an NLC all user announcement would be best placed post the summer holiday period to target the biggest audience and thus have more impact. Original timescale: October 2023 Revised timescale: April 2024 Further revised timescale: September 2024 We acknowledge that the delay in full implementation of these actions is largely due to absence of the Chief Officer (Audit and Risk). We note the action taken to date to address the recommendation and that proposed to mitigate the risks identified and consider the revised timescale to be reasonable. We have assessed the residual risk for this recommendation as ‘Low’ and consider it important that the agreed timescale for implementation is adhered to. Accordingly, we suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 82 of 126
Page 83
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Community Operations) Follow-up of Investigation of Staffing Issues within Waste and Fleet Resources (July 2023) Risk: Recruitment processes maty not be compliant with corporate expectations. Staff may be recruited in posts which they are not suitably qualified for which could affect Service operations and could have an adverse effect on the Council. Recommendation: The Chief Officer (Community Operations) should: (1) in consultation with the Talent and Organisational Development Team, prepare and issue formal guidance on essential qualification requirements, which indicates the types of qualifications that meet these requirements, and which advises that where there is dubiety over specific qualifications, advice should be sought from the Talent and Organisational Development Team prior to confirming the list of interviewees; (2) in consultation with People Resources ensure that specific and targeted recruitment training is devised for this Service area which includes specific reference to essential qualification requirements and the formal documentation prepared above; and (3) undertake checks on a sample of recruitments to ensure that the Council’s policies and expectations have been adhered to and that the successful candidate holds the essential qualifications for the post, prior to the contract being issued. Category: High There is now agreement corporate wide to build flexibility into the recruitment process particularly for roles that are difficult to recruit. This follows a number of unsuccessful recruitment campaigns which service management have raised with People Resources. Work is being progressed to devise an appropriate framework that will ensure Job Evaluation requirements are maintained and not devalued and undermined. Refresher recruitment training has now been completed within Community Operations SMT. Training material is being updated to ensure clarity for all Managers regarding the requirement to ensure only applicants who meet all the required Essential Specifications, including qualifications, are taken forward to interview. Checks on a sample of recruitments are now underway to ensure the above points are being complied with. Original timescale: December 2023 Revised timescale: June 2024 Further revised timescale: September 2024 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to fully mitigate the risks. We further acknowledge that the delay in implementation is largely due to competing priorities and the summer holiday period. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of September 2024 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 83 of 126
Page 84
Appendix 1 (continued) Internal Audit recommendations – Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Community Operations) Follow-up of Investigation of Staffing Issues within Waste and Fleet Resources (July 2023) Risk: A lack of documentation to clearly support the reasons for staff undertaking higher duties, claims for higher duties payments may be authorised inappropriately and staff could receive payments which they are not entitled to, and this could lead to increased costs for the Council. Failure to apply conditions of service appropriately could lead to inconsistency of employee payments across both the Service and the Council. If errors are not stopped immediately when they are first identified, any overpayments arising from the error could continue to increase and the likelihood of recovery could be reduced. Delays in employees agreeing and signing repayment schedules for overpayments could lead to a delay in recovery and increase the risk of the overpayment not being recovered if the employee were to leave the Council’s employment. Recommendation: (1) ensure that HR Business Partners, prior to authorising and passing higher duties claims for payment, properly scrutinise and understand the appropriateness of such claims, confirm that claims have been agreed and authorised by the Chief Officer or senior management and ensure that documentation accurately reflects the reason for such payments; (2) review, and take appropriate action, to resolve the issues and errors in contractual and non-contractual payments identified by Internal Audit and outlined in the document which has been provided under separate cover; (3) identify other employees who may be affected by the issues identified in the finding above, with a view to review and taking appropriate action to resolve any subsequent issues/errors identified; and (4) ensure that where overpayments arise from these reviews, prompt action is taken to ensure that appropriate repayment schedules, with reasonable terms, are promptly agreed with relevant employees and that recovery commences as soon as possible. Category: Medium Requests for higher duties claims are now authorised by the Business Manager, Chief Officer and HR Business Partner to ensure all such claims have been properly scrutinised and appropriately authorised prior to being authorised and passed for payment. The issues and errors in contractual and non-contractual payments previously identified by Internal Audit have now been reviewed and action taken to recover the resultant overpayments. Work is, however, ongoing to identify and remedy any contractual and non-contractual over/under payments for all employees within Waste and Fleet. Original timescale: September 2023 Revised timescale: June 2024 Further revised timescale: September 2024 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to fully mitigate the risks. We further acknowledge that the delay in implementation is largely due to competing priorities and the summer holiday period. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of September 2024 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 84 of 126
Page 85
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Education and Families) School Excursions (October 2023) Risk: Inadequate oversight/monitoring by Education and Families HQ of school trips/ excursions and compliance with expected arrangements may result in areas of non- compliance arising leading to issues not being identified which could consequently impact on the safety of children and on the wider reputation of both the school and the Council. Policies, procedures and associated practice may be inadequate, resulting in a failure to effectively plan and manage trips which has the potential to compromise the safety of children and staff, and negatively impact on the wider reputation of both the school and the Council. Recommendation: The Chief Officers of Education and Families (North and South) should ensure that: (1) a comprehensive formal review of both the Council’s Educational Excursions and Outdoor Activities Policy and the Risk Assessment Guidance on Educational Excursions and Outdoor Activities is undertaken to revisit and refresh all aspects of these documents with a view to improving the robustness of the Council’s arrangements associated with school trips and excursions. This should take account of, but not limited to, the information contained in Appendix 2 and the need for roles and responsibilities of all relevant parties, including those within other Council services to be clearly documented in the revised guidance; (2) any revised arrangements are fully communicated to all Council Services with a role in the process; and (3) they explore how best to gather/record details of all school trips and excursions and thereafter monitor compliance with the Council’s expected arrangements associated with such trips and excursions. Category: High A Task and Finish Group has been established to review the trips and excursions policy. An initial meeting was held to discuss the scope of the review, the purpose of the group and the barriers to implementing the policy and possible solutions. A follow-up meeting took place prior to the Easter break and this including a deep dive on the following topics within the Policy: Roles and Responsibilities; Approval Process and Risk Assessment Process. There has been some offline activity by the Group to review the current D3 Management Circular and provide feedback on what works and areas for improvement. In addition, a benchmarking exercise was undertaken with other local authorities and the 'Going out There' Framework, which is the Scottish framework for Safe Practice in Off-Site Visits. A meeting was held with the company that operate EVOLVE, which is a tool for planning, approval and management of educational excursions and is promoted as part of the framework. This involved an overview of the different modules that EVOLVE can offer. Post the Summer break, a revised policy will be drafted and sent to the Task and Finish Group for comment. In the meantime, Heads of Establishment have been reminded of the need to comply with the Council’s existing guidance when organising school trips and excursions. Once the revised policy has been drafted and approved, the Service will develop a compliance framework. Original timescale: June 2024 Revised timescale: March 2025 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to fully mitigate the risks. We further acknowledge that the delay in implementation is largely due to the complex operating environment across the Service and the need for significant improvements to be made to the existing arrangements. We have assessed the residual risk for this recommendation as ‘High’. Whilst we appreciate the complexities surrounding this area, we consider it vital that to address the risk identified in the original audit, the agreed extension date of March 2025 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and Internal Audit will monitor progress on this on a quarterly basis and incorporate a relevant update within this report, to ensure that progress continues to be made and the risk mitigated. Page 85 of 126
Page 86
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Education and Families) School Excursions (October 2023) Risk: Not using a travel company/tour operator to book a trip/excursion could potentially lead to financial loss or impact on the safety of the participants should arrangements fail or not go according to plan. Increased risk of loss, theft or misappropriation of monies where any level of cash is held. Recommendation: The Chief Officers of Education and Families (North and South) should: (1) as part of the formal review referenced at Action Plan point 1 above, ensure that this includes the creation of a dedicated section within the policy and/or associated procedures which outlines clear expectations around the financial aspects associated with the organisation and execution of trips. This should include, but not be limited to: • a clear and detailed protocol for booking trips where a travel company/tour operator is not going to be used ensuring arrangements minimise the risks associated with such payments and ensure that the use of personal credit cards to book trips is prohibited; • consideration to promoting iPay Impact as the primary means for collecting monies in schools thus reducing cash payments and the subsequent flow of physical cash in the school; • determining the additional checks/monitoring that need to be carried out at establishment level to ensure all monies due are received and duly banked in line with Council policy; and • clear guidance on the levels of physical cash that can/should be taken on a trip/excursion, the required records to be completed and documentary evidence required/expected to support any such spend. Category: Medium Work is currently ongoing to formally review the Council’s guidance on school trips and excursions. This review will include ensuring that clear guidance and instruction is provided to establishments to make them aware of the areas of financial compliance which they must adhere to when arranging and undertaking school trips and/or excursions. In doing so, the Service will engage with colleagues in Finance to ensure that all of the issues identified in the audit report are addressed appropriately. This work will not only tie into development of the School Excursions Policy but also the planned annual review of the refreshed Establishment Fund Procedures. Original timescale: June 2024 Revised timescale: March 2025 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to fully mitigate the risks. We further acknowledge that the delay in implementation is largely due to the complex operating environment and the need for significant improvements to be made to the existing arrangements. We have assessed the residual risk for this recommendation as ‘High’. Whilst we appreciate the complexities surrounding this area, we consider it vital that to address the risk identified in the original audit, the agreed extension date of March 2025 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and Internal Audit will monitor progress on this on a quarterly basis and incorporate a relevant update within this report, to ensure that progress continues to be made and the risk mitigated. Page 86 of 126
Page 87
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Education and Families) School E – School Fund and General Issues (January 2024) Risk: The absence of adequate oversight/ monitoring by Education and Families HQ of school’s compliance with the Council’s Educational Establishment Fund Financial Procedures may result in areas of non-compliance arising which could lead to weaknesses and consequently result in an increased risk of theft or misappropriation of funds. Recommendation: The Chief Officer of Education and Families should: (1) ensure that the Annual Income and Expenditure Statement contained within the school fund guidance is amended, to include the requirement to record the cash in hand and bank account balance at the year-end (which supports the surplus/deficit for the year and resultant carry forward balance) and ensure that a further instruction is issued to the Heads of Establishment requesting that they also provide a copy of the bank reconciliation at the year-end together with a copy of the corresponding bank statement; (2) ensure that an action plan is prepared setting out what actions the Service plans to undertake to review returned submissions from Heads of Establishment demonstrating compliance with the revised school fund guidance, and that planned actions are subsequently implemented; and (3) liaise with the Chief Officer (Finance) to determine whether and how resources within Finance might be utilised to assist the Service to improve their management and oversight of school funds. Category: High The Annual Income and Expenditure Statement contained within the Establishment Fund Procedures Manual will be amended for returns required for session 2023/24 onwards to record the cash in hand and bank account balance at the year-end. This will also be updated in the Establishment Fund Procedures Manual and will reflect the need for the Head of Establishment to submit both the bank reconciliation at the year end and the corresponding bank statement to Education Central Support as part of their year- end submission. A clear instruction with regards to this will also be issued to the Heads of Establishment at the start of the new session (August 2024) to ensure that they are fully aware of the need to do so. An Establishment Fund compliance framework has been developed and implemented. An action plan will be prepared clearly demonstrating the actions proposed to be taken to review returned documentation from Heads of Establishment for the year-end 2023/24 to ensure compliance with the revised school fund guidance. Discussions have been held between Education & Families and Finance with a view to identify options for support, e.g. training, resource input. These discussions will continue in order that resources/training requirements can be identified and implemented as appropriate. Original timescale: June 2024 Revised timescale: December 2024 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to fully mitigate the risks. We further acknowledge that the delay in implementation is largely due to the complex operating environment and the need for significant improvements to be made to the existing arrangements. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. Whilst we appreciate the complexities surrounding this area, we consider it important that the agreed extension date of December 2024 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Specific audit work, as per the approved Internal Audit Plan 2024-25 is currently underway to review the Service’s arrangements for monitoring compliance with their revised arrangements. The results of this exercise are expected to be reported to the November meeting of the Panel. Page 87 of 126
Page 88
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Education and Families) School E – School Fund and General Issues (January 2024) Risk: The absence of a cash book and compliance with financial management procedures may lead to an increased risk of loss, theft or misappropriation of monies where any level of cash is held. The lack of management oversight and checks on financial activity within the school fund may mean that any such loss, theft or misappropriation of monies may remain undetected. Recommendation: The Chief Officer of Education and Families (North) should as a matter of urgency, ensure that immediate action is taken to improve the control environment surrounding the arrangements for recording of income and expenditure and handling of cash for the school fund at School E. This should include ensuring that the Educational Establishment Fund Financial Procedures are fully adhered to, with specific reference to ensuring that the points detailed in the finding are addressed. Category: High The Service has engaged with the Head of Establishment to ensure full compliance with the Council’s Educational Establishment Fund Procedures. The school have submitted their Compliance Checklist and Annual Statement for 2022-23 and this has been reviewed by the Service. Further checks will be undertaken as part of the 2023-24 submission to ensure ongoing compliance. Original timescale: June 2024 Revised timescale: December 2024 We acknowledge the action that has been taken to date to address the recommendations made and the planned actions proposed to fully mitigate the risks. We further acknowledge that the delay in full implementation is largely due to competing priorities and the school holiday period. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of December 2024 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 88 of 126
Page 89
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Education and Families) School E – School Fund and General Issues (January 2024) Risk: Inefficiently managed bank signatories may result in fraudulent activity and/or delays in transactions being processed. If the schools are unaware of the safe limits, then the balance of cash held may be in excess of these limits and would not be covered by the Council’s insurance policies. If schools which have charitable status are not complying with the requirements of OSCR this could create additional reputational risks. Recommendation: The Chief Officer of Education and Families (North) should: (1) ensure current signatories in place for all school funds are reviewed to determine whether these are appropriate, agree with the list of signatories held by the Treasury Management section and ensure that any resultant necessary changes are actioned promptly (2) collate a list of the safe/other secure facility held at each educational establishment and thereafter pass the details to the Insurance section enabling them to determine and advise of the level of insurance cover provided for each establishment; and (3) review which schools have charitable status activities; whether this is still required and, if so, that they have been made aware of the expected governance arrangements (rules, regulations and processes etc.) to be followed to comply with statutory/OSCR expectations. Category: Medium There has been no action taken to date with regards to the points made in this recommendation. Action will be undertaken in line with the management response provided in the original audit report. This will include the following actions: Service management will issue correspondence to the Heads of Establishment instructing them to undertake a review of the current signatories to their bank account to determine whether these are appropriate and up-to-date and to thereafter liaise with Treasury Management to address any issues identified and ensure that these are accurately reflected on the list held by Treasury Management. Service management will thereafter follow-up to ensure any identified issues have been appropriately actioned as part of compliance checks to be established. Service management will undertake an exercise to establish what safe/other secure facility provision is in place at each establishment and thereafter prepare a list of said provision and forward this to the Insurance section to enable them to determine and advise of the level of insurance cover to be provided for each establishment. Service Management will provide any schools currently holding charitable status with the necessary advice and guidance to ensure that they are fully aware of, and are complying, with expected governance arrangements in line with statutory and/or OSCR expectations. Original timescale: June 2024 Revised timescale: December 2024 Whilst there has been no activity to date in this area, we note the planned future actions proposed by the Service and acknowledge that the delay in full implementation is largely due to competing priorities and the availability of resources. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of December 2024 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 89 of 126
Page 90
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Education and Families) School F (March 2024) Recommendation: Education and Families should liaise with both the Head Teacher of School F and colleagues in Finance to determine what, if any, further steps can be taken with the Royal Bank of Scotland to resolve the issue of the discrepancy in the monies lodged in the school fund bank account, in doing so, consideration should be given as to whether all avenues have been exhausted and, if so, whether the monies should be written off as a loss in the cash book for the school fund. Category: High The Head Teacher has requested that the bank conduct a further investigation into the missing monies. On conclusion of this investigation, action will be taken as necessary by the Head Teacher to fully reflect the outcome in the school fund cash book. The Education and Families Manager will follow up on this action at the first meeting with the Head Teacher in the new school session. Original timescale: March 2024 Revised timescale October 2024: We acknowledge that the delay in full implementation of the action is due to ongoing dialogue between the Head Teacher and the Royal Bank of Scotland. We note the actions proposed to mitigate the risks identified and consider the revised timescale to be reasonable. We have assessed the residual risk for this recommendation as ‘Low’ and consider it important that the agreed timescale for implementation is adhered to. Accordingly, we suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. School G (March 2024) Recommendation: Education and Families should ensure that the Head Teacher of School G liaises with the Treasury Management section with a view to arranging for the school fund bank account currently being used to be closed and the monies transferred to the NLC school fund bank account held for School G. Category: High Initial contact has been made between the Head Teacher and Treasury Management. However, the school fund bank account currently being used has not yet been to be closed and the monies transferred to the NLC school fund bank account held for the school. The Education and Families Manager will follow up on this action at the start of the new school session. Original timescale: March 2024 Revised timescale: October 2024 We acknowledge the action that has been taken to date and the planned actions proposed to fully mitigate the risks. We further acknowledge that the delay in full implementation is largely due to the school holiday period. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of October 2024 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel. Page 90 of 126
Page 91
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Housing Management) Housing Allocations (August 2023) Risk: The Council may fail to award housing based upon need if all applications are not accurately assessed and recorded. If information is not input and checked for accuracy it may result in an applicant not being correctly assessed which could result in them being omitted from consideration of an offer of housing or unfairly disadvantage other applicants. Recommendation: The Chief Officer (Housing Management) should: (1) determine and introduce appropriate exception reports to identify and monitor instances of the same officer inputting and checking an application to ensure this key control is not diminished and appropriate action can be taken if the incidence of the same person inputting and checking increases; (2) re-enforce to all locality staff involved in inputting and checking applications of the need to ensure that forms of identification accepted with an application comply with the documentation criteria specified in the procedures manual; and (3) given the issue identified regarding the completion by applicants of question 2c and the award of overoccupancy points depending on this, consider how this issue can be monitored to ensure incorrect points do not continue to be awarded. This might include consideration of appropriate exception reports and awareness raising with locality staff. Category: Medium Parts 2 and 3 of the recommendation are complete. An e-mail was issued to locality management in October 2023. The purpose of this e-mail was to re-enforce both the importance of ensuring acceptable ID, which complies with the guidance, is accepted and the requirement for Housing Advisors to review the points awarded, paying particular attention to question 2c and the family composition. With regards to point 1, a scoping exercise was carried out to review the possibility of developing an exceptions report in respect of the same officer inputting and checking an application. However, it was determined an IT reporting solution could not be developed for the current system. To mitigate the risk, a monthly 10% manual audit of all applications input will be undertaken to review input and check officer details. Original timescale: October 2023 Revised timescale: April 2024 Further revised timescale: September 2024 We acknowledge that this action is largely complete and that the delay in full implementation of the action is due to IT issues. We note that to fully address the recommendation, the Service have explored alternative means to mitigate the risks identified and we consider both the proposed actions and the revised timescale to be reasonable. We have assessed the residual risk for this recommendation as ‘Low’ and consider it important that the agreed timescale for implementation is adhered to. Accordingly, we suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 91 of 126
Page 92
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (People Resources) Controls – Use of Teaching Supply Staff (January 2023) Risk: A lack of appropriate guidance in relation to supply teachers could lead to confusion over definitions, uncertainty around the expectations and responsibilities of Headteachers and the HRBP team not being made aware of all short-term supply teachers undertaking long- term engagements which could further lead to supply teachers not being provided with appropriate contracts of employment and the Council not complying with SNCT guidelines. If a supply register detailing short-term supply teacher availability is not maintained and provided to Headteachers, they may have difficulty identifying an appropriate resource to undertake their supply needs which could lead to Headteachers not notifying the HRBP team where a resource is found or an increased risk of teachers being employed who have not been subjected to the Council’s recruitment process and pre- employment verification checks. Recommendation: People Resources, in conjunction with Education and Families, should (1) prepare and issue documented guidance providing clear definitions of short and long-term supply teachers and outlining the responsibilities and required actions of Headteachers in relation to supply teachers; and (2) finalise and implement the proposed processes for the management of short-term supply teachers as highlighted in the finding (i.e. notification of engagements and the Supply Register) and ensure that a formal review of the adequacy and effectiveness of these processes is undertaken, after a sufficient period of time, to assess how well they are operating, identifying and taking any necessary improvement actions as appropriate. Category: High Guidance has been formally implemented in June 2024 and discussed in great detail with Head Teachers during the recent Head Teacher engagement session. Guidance also details a step-by-step process in terms of Head Teachers filling short and long-term cover requirements. The new system will specifically rely on the use of a MS Teams Forms process requiring Head Teachers to notify the HR Business Partner Team of their specific workforce demand. This new process also involves distribution of monthly updated supply teacher lists. All supply teachers who are currently on the list are issued a communication to confirm their availability the following month, thus providing Head Teachers access to up-to-date staff who have been sense checked by the HR Business Partner Team. The mySelf function of iTrent is at the final stages of development to address issues over 1) multiple payments and 2) the framework that will ensure that supply teachers receive a contract and details of any assignments undertaken that are two days or more at the end of each term. Supply teachers will receive a letter confirming their acceptance onto the supply list and then if they are offered a contract of between 2 days and 4 weeks will be issued with an initial contract that will cover any short-term supply periods in the academic year. At the end of each term, a list of assignments (short-term) will be issued to the individual employees. Once the above process has had time to embed, a review of the arrangements will be undertaken to determine their adequacy and effectiveness. Original timescale: August 2023 Revised timescale: June 2024 Further revised timescale: February 2025 We acknowledge that that there has been significant work undertaken in this area. As these arrangements have only recently been approved and implemented, they have not yet been reviewed to determine their adequacy and effectiveness. Once this has been undertaken, the action will be signed off as fully implemented and we thus consider the revised timescale for completion to be reasonable. We have assessed the residual risk for this recommendation as ‘Low’ and consider it important that the agreed timescale for implementation is adhered to. Accordingly, we suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 92 of 126
Page 93
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (People Resources) Review of the Council’s Counter Fraud Arrangements (August 2023) Risk: Staff and Elected Members may not be aware of the Councils approach to fraud and their responsibilities in relation to the prevention, detection and reporting of fraud. Recommendation: The Chief Officer (People Resources) should • review and update the online induction and fraud awareness modules to include relevant content in relation to the identification of fraud risks, the Council’s response to fraud through its policies and processes and raising awareness of the Council’s Counter Fraud Policy; and • ensure that the links to other policies contained with the Employee Code of Conduct are active. Category: Medium The Employee Code of Conduct now makes reference to the Counter Fraud Policy and includes updated links to other relevant policies. The online induction has been updated and now provides a summary of North Lanarkshire’s approach to fraud, bribery and corruption in addition to a link to the Council’s Counter Fraud Policy. The ‘Fraud Awareness to Local Government’ e-learning module will be reviewed and updated to reflect the points raised in the finding and recommendation. Original timescale: December 2023 Revised timescale: April 2024 Further revised timescale: December 2024 While we acknowledge that significant action has been taken to date to address the recommendation with the employee code of conduct and induction information being updated to specifically reference counter fraud, we note that the ‘Fraud Awareness to Local Government’ e-learning module still reflects fraud in general terms and is not specific to North Lanarkshire Council. In addition, there is currently no reference to the Council’s policies and processes or indeed the Counter Fraud Policy. We acknowledge that the Service have committed to review the content of this module and update it accordingly. We have assessed the residual risk for this recommendation as ‘Low’ and consider it important that the agreed timescale for implementation is adhered to. Accordingly, we suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 93 of 126
Page 94
Appendix 2 Residual risk rating definition Internal Audit assessment of residual risk from non-implementation High Non-implementation of actions has the potential to significantly undermine the relevant control environment. Medium Non-implementation of actions has the potential to impact upon the achievement of the control environment. Low Other issues which require management attention but which pose less significant or less immediate impacts to the control environment. Page 94 of 126
Page 95
Page 95 of 126
Page 96
Page 96 of 126
Page 97
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref PH/ASP/Charter 2024 Date 29/08/24 Internal Audit Charter From Paula Hendry, Acting Chief Officer (Audit and Risk) E-mail hendryp@northlan.gov.uk Telephone 07471 321768 Executive Summary The Internal Audit Charter (Charter) is an important document which sets out the purpose, authority and principal responsibilities of the Council’s Internal Audit section. The purpose of this report is to seek approval for the attached Internal Audit Charter (at Appendix 1) which has recently been reviewed and revised, in line with best practice, to ensure that it remains up to date, reflects the Council’s current arrangements and expectations, and is consistent with the requirements of the Public Sector internal Audit Standards (PSIAS) and the associated Local Government Application Note (LGAN). There are no material changes to the proposed Charter or the purpose, authority and principal responsibilities of the Council’s Internal Audit section from that approved by the Panel in 2021. However, the format of the Charter has been updated to reflect the Council’s standard template, job titles have been amended to reflect the current structure and some minor amendments have been made to the narrative. In line with good practice, the proposed revised Charter, which is intended to come into effect from 1 September 2024, has been agreed with the Chief Executive and the Chief Officer (Finance) (as the Council’s s95 officer). The revised Charter has also been presented to the Business Management Team and to fulfil the Panel’s own terms of reference the revised charter is submitted for consideration and approval by the Panel. Recommendations The Panel is invited to approve the revised Internal Audit Charter at Appendix 1. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 7 Page 97 of 126
Page 98
1. Background 1.1 The Internal Audit Charter (Charter) is a formal document that defines Internal Audit’s purpose, authority and responsibility. It establishes Internal Audit’s position within the Council, including detailing the nature of the Chief Officer’s (Audit and Risk) functional reporting relationship with senior management and the Panel; authorising access to records, personnel and physical properties relative to the performance of audit engagements; and defining the scope of Internal Audit activities. Although the Charter is discussed and agreed with senior management (including the Chief Executive), final approval resides with the Panel. 1.2 PSIAS requires that the ‘chief internal audit executive periodically reviews the internal audit charter’ to determine whether the Charter needs to be updated to address the requirements in the PSIAS and present it to senior management and the Panel for approval. 1.3 The current Internal Audit Charter was approved by the Panel in September 2021. This report outlines the outcome of the most recent review and update of the Charter. 2. Report 2.1 The current Internal Audit Charter, approved in September 2021, has now been reviewed against the PSIAS requirements and the LGAN and a revised Charter is provided at Appendix 1. 2.2 There are no material changes from the previously approved Charter and the fundamental purpose, authority and responsibility of Internal Audit remains unchanged. The format of the Charter has been updated to reflect the Council’s standard template, job titles have updated to reflect the current structure and some minor changes have been made to expand the narrative to more fully explain the requirements of PSIAS where necessary. The expectations placed upon Internal Audit will continue to be about delivering a high quality and effective Internal Audit service consistent with recognised professional standards. 2.3 In line with good practice, the proposed revised Charter, which is intended to come into effect from 1 September 2024, has been agreed with the Chief Executive and the Chief Officer (Finance) (as the Council’s s95 officer). 2.4 The Global Internal Audit Standards (GIAS), which underpin the UK PSIAS, were recently reviewed with the updated standards released in January 2024, for implementation by January 2025. The UK Public Sector Internal Auditing Standards Advisory Board has committed to undertaking a review of the new standards, with a view to identifying and producing any sector specific interpretations or other material, to ensure that they are suitable for use by UK public sector organisations. It is anticipated that the new material will be available for implementation on 1 April 2025 to align with the requirements for annual opinions and other relevant aspects of UK public sector governance. Once the updated guidance is available, a further review of the Charter will be undertaken to ensure continued alignment to, and compliance with, the updated standards. 3. Measures of success 3.1 The Council is required to ensure that it has an effective internal audit function consistent with PSIAS. The Council’s appointed external auditors regularly review and report on the Council’s Internal Audit function to establish whether they can place reliance on its work and as part of their wider work of the Council’s corporate governance framework. Page 98 of 126
Page 99
3.2 In addition, PSIAS requires an external quality assurance review of the Internal Audit function to be undertaken at least every five years. The last review was undertaken in April 2024 and concluded that the Internal Audit team fully conforms with the Standards. 4. Supporting documentation 4.1 Appendix 1 – Updated Internal Audit Charter Paula Hendry Acting Chief Officer (Audit and Risk) Page 99 of 126
Page 100
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☐ No ☒ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? . 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 100 of 126
Page 101
INTERNAL AUDIT CHARTER Page 101 of 126
Page 102
Document control Title Internal Audit Charter Owner Paula Hendry, Acting Chief Officer (Audit and Risk) Contact hendryp@northlan.gov.uk Governance Group Audit and Scrutiny Panel Author Paula Hendry, Acting Chief Officer (Audit and Risk) Contact hendryp@northlan.gov.uk Revision History Number Originator Date Review Commenced Revision description/record of change 1.0 Ken Adamson August 2021 Review and update to confirm consistent with PSIAS which had been updated 2.0 Paula Hendry July 2024 Update and refresh of document Document Approvals Number Governance Group Date approval granted Date approval to be requested (if document still draft) 1.0 Audit and Scrutiny Panel February 2018 2.0 Audit and Scrutiny Panel 22/09/21 3.0 Audit and Scrutiny Panel 29/08/24 Consultation Record (for most recent update) Status of document consulted upon N/A Stakeholders consulted/date N/A Strategic Alignment The Internal Audit Charter is a formal document that defines Internal Audit’s purpose, authority and responsibility and establishes Internal Audit’s position within the Council. Next review date Review Date April 2025, then biennial thereafter Page 102 of 126
Page 103
CONTENTS 1 Purpose 4 2 Introduction 4 3 Authority 5 4 Professionalism 5 5 Organisation 6 6 Independence and objectivity 6 7 Responsibility 7 8 Internal Audit Plan 8 9 Consultancy Work 8 10 Reporting and Monitoring 8 – 9 11 The Role of Internal Audit in respect of fraud-related work 10 12 Approvals 10 Appendix 1 – Internal Audit Reporting Protocols 11 – 12 Page 103 of 126
Page 104
1. PURPOSE 1.1 The purpose of this charter is to define what Internal Audit is and to explain its purpose, authority and responsibilities. 2. DEFINITION OF INTERNAL AUDIT 2.1 The Local Authority Accounts (Scotland) Regulations 2014 require the Council to operate a professional and objective internal auditing service in accordance with recognised standards and practices. In this regard, the Council recognises the mandatory nature of the Public Sector Internal Audit Standards (PSIAS) and the associated CIPFA Local Government Application Note (LGAN) and the need to ensure compliance with the PSIAS and LGAN. 2.2 The mission of Internal Audit is to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. 2.3 Internal Audit is an independent, objective assurance and consulting activity designed to add value and improve the Council’s operations. It helps the Council accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of the Council’s risk management, internal control and governance processes. 2.4 In accordance with PSIAS, consulting services is defined as advisory and client related service activities, the nature and scope of which are agreed with the client and are intended to add value and improve an organisation’s governance, risk management and control processs without the internal auditor assuming management responsibility. Examples include counsel, advice, faciliation and training. 2.5 For the purposes of implementing the PSIAS and LGAN, which make widespread use of the terms ‘chief audit executive’, ‘board’ and ‘senior management’, the Council defines the ‘chief audit executive’ as the Chief Officer (Audit and Risk), the ‘board’ as the Audit and Scrutiny Panel and ‘senior management’ as the Corporate Management Team. The Audit and Scrutiny Panel’s terms of reference, which reflect the Panel’s responsibilities for the ‘audit committee’ role, were most recently approved by the Council in December 2023. 2.6 It is primarily the responsibility of line management to establish internal control and Internal Audit should not be viewed as a substitute for effective control. Internal Audit activity is planned to provide assurance to senior management and elected members on the Council’s control environment and to enable an annual opinion to be given by the Chief Officer (Audit and Risk) on the adequacy and effectiveness of internal controls within the authority. Page 104 of 126
Page 105
3. AUTHORITY 3.1 Internal Audit is established by the Council and governed by the Council’s policies, procedures, rules and regulations. These include the Council’s Financial Regulations and other policies including the Council’s Counter Fraud Policy. 3.2 Internal Audit staff have unrestricted access to all Council records and can require and receive any explanations from Council staff as considered necessary to allow Internal Audit to fulfill its role and responsibilities. Internal Audit staff also have authority to enter Council premises or land at all reasonable times. 3.3 Where internal audit work is undertaken for parties external to the Council, such as the North Lanarkshire Health and Social Care Integration Joint Board, the nature of services to be provided will be detailed in a Service Level Agreement. 4. PROFESSIONALISM 4.1 Internal Audit staff will at all times conduct themselves with proficiency and due professional care and in accordance with the relevant Code of Ethics and standards laid down by the PSIAS and LGAN and other relevant professional guidance. 4.2 The Code of Ethics sets out the expectations governing the behaviour of individuals and organisations in the conduct of internal auditing, in line with the four principles of: • Integrity – Internal Audit staff will perform their work with honesty, diligence, and responsibility, observe the law, and make any disclosures required by law. • Objectivity – Internal Audit staff will exhibit the highest levels of professional objectivity in undertaking their work and always make balanced assessments avoiding any influence from their own interests or from others • Confidentiality – Internal Audit staff will respect the value and ownership of the information they recevie and will not disclose any information without appropriate authority unless there is a legal or professional obligation to do so. • Competency – Internal Audit staff will apply the knowledge, skills and experience needed to perform internal audit services in accordance with the International Standards for the Professional Practice of Internal Auditing. 4.3 Internal Audit staff will complete an annual declaration to confirm adherence to the standards. 4.4 Internal Audit staff will also adhere to the Standards of Public Life’s ‘Seven Principles of Public Life’, all relevant Council policies and procedures, including the Employee Code of Conduct, and the relevant requirements of their professional body. Page 105 of 126
Page 106
5. ORGANISATION 5.1 Internal Audit is located within the Chief Executive’s Office and the Chief Officer (Audit and Risk) reports directly to the Chief Executive in accordance with the Council’s Financial Regulations. 5.2 The Chief Officer (Audit and Risk) has unrestricted access to the Chief Executive (as head of paid service), the Chief Officer (Finance) as the Council’s Section 95 Officer, the Chief Officer (Legal and Democratic) as the Monitoring officer, Convenor of the Audit and Scrutiny Panel and the Council’s appointed external auditor. 6. INDEPENDENCE AND OBJECTIVITY 6.1 One of the main determinants of the effectiveness of Internal Audit is that it is seen to be independent, therefore to ensure this, Internal Audit will operate within a framework that allows unrestricted access to senior management and provides for segregation from operational management and/or operational responsibilities. 6.2 Internal Audit has no direct operational responsibility or authority over any of the activities audited and will not implement internal controls, develop procedures, install systems, prepare records or engage in any other activity that may impair its ability to be objective. However, where the Chief Officer (Audit and Risk) has roles or responsibilities that fall outside of internal auditing, safeguards will be put in place to limit impairments to independence or objectivity. 6.3 The Chief Officer (Audit and Risk) has line management responsibility for the Council’s Corporate Risk Management Team, as well as responsibility for counter fraud arrangements. To safeguard and limit any impairments of objectivity or independence, the Chief Officer (Audit and Risk) will take no part in the planning, design, conduct or reporting of any Internal Audit work examining the Council’s risk management or counter fraud arrangements. All such work will be led by the Audit Manager who will be expected to manage the entire audit process, including the review, issue and finalisation of any audit reports following discussion with management. 6.4 Internal Audit will remain free from interference by any element of the Council, including matters of audit selection, scope, procedures, frequency, timing or report content to enable the maintenance of a necessary independent and objective approach. 6.5 Internal Audit staff will exhibit the highest level of professional objectivity in gathering, evaluating and communicating information about the activity or process being examined. 6.6 Where consulting-type services and/or non-audit activities are undertaken, the Chief Officer (Audit and Risk) will ensure that appropriate arrangements are put in place to avoid any actual or perceived conflicts of interest. 6.7 The Chief Officer (Audit and Risk) will report to the Audit and Scrutiny Panel, at least annually, on the organisational independence of the internal audit function. Page 106 of 126
Page 107
7. RESPONSIBILITY 7.1 Internal Audit’s primary objectives are to: • provide a high quality and effective audit service which complies with professional best practice and that meets the needs of the Council; and • assist the Audit and Scrutiny Panel to effectively discharge its role and responsibilities in relation to its audit committee role. 7.2 The scope of internal auditing encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the Council’s risk management, control and governance processes. This includes: • evaluating the reliability and integrity of information and the means used to identify, measure, classify and report such information; • evaluating the systems established to ensure compliance with those policies, plans, procedures, laws and regulations which could have a significant impact on the Council; • evaluating the Council’s arrangements for safeguarding its assets and interests from losses of all kinds, including those arising from fraud, irregularity or corruption; • evaluating the effectiveness and efficiency with which Council resources are employed; • monitoring and evaluating corporate governance processes; • monitoring and evaluating the Council’s risk management arrangements; • evaluating operations and programmes to ascertain whether results and outcomes are consistent with established objectives and goals and whether operations or programmes are being carried out as planned; • liaising effectively with the Council’s external auditors to ensure appropriate co-ordination of work so that assurance from both internal and external sources is provided cost effectively; and • reporting significant risk exposures and control issues, including fraud risks, governance issues, and other matters required or requested by the Audit and Scrutiny Panel. 7.3 The Chief Officer (Audit and Risk) will seek to co-ordinate Internal Audit’s plans and activities and foster good relationships with management, other internal audit sections, External Audit, inspection bodies and other review agencies to ensure the most effective audit coverage is achieved and duplication of effort is minimised. Page 107 of 126
Page 108
8. INTERNAL AUDIT PLAN 8.1 At least annually, the Chief Officer (Audit and Risk) will submit to senior management and the Audit and Scrutiny Panel an internal audit plan for review and approval. The internal audit plan will consist of a work programme and resource requirements for the year. The Chief Officer (Audit and Risk) will, if necessary, communicate the impact of any resource limitations to the Audit and Scrutiny Panel. 8.2 The internal audit plan will be developed using a risk-based methodology, including input from senior management, designed to make best use of the Internal Audit resources. Although the Chief Officer (Audit and Risk) will consult with relevant stakeholders prior to presenting the plan for approval by the Audit and Scrutiny Panel, responsibility for the preparation and execution of the audit plan, and subsequent Internal Audit activities, rests solely with the Chief Officer (Audit and Risk). 9. CONSULTANCY WORK 9.1 The internal audit plan contains a resource for providing consultancy and advice to Services, including promoting and sharing good practice relating to internal control and governance in collaboration with Services. 9.2 Where significant work of this type is to be undertaken, approval will normally be sought from the Audit and Scrutiny Panel (or the Convener where no meeting of the Panel is scheduled) before the engagement is accepted. 9.3 Acceptance of any assignment will depend on available resources, the nature of the assignment and any potential impact on future indepdendent assurances. 9.4 Internal Audit’s role in a consultancy assignment is to advise and support sernior management, who will retain the ultimate responsibility for decisions taken within the area under review. 10. REPORTING AND MONITORING 10.1 Internal Audit reporting arrangements are designed to be open and transparent and to enable the Audit and Scrutiny Panel to effectively discharge its role. A detailed reporting protocol in respect of Internal Audit work can be found at Appendix 1. 10.2 A written report will be prepared and issued by the Chief Officer (Audit and Risk) following the conclusion of each substantive core internal audit assignment and will be distributed to relevant Chief Officers. The findings from Internal Audit outputs will also be periodically reported to the Business Management Team, Corporate Management Team and the Audit and Scrutiny Panel. 10.3 At the end of each audit assignment, a draft report will be prepared and issued to the relevant Chief Officer containing the findings of the audit work, an overall audit opinion and an action plan with recommendations. Page 108 of 126
Page 109
10. REPORTING AND MONITORING (CONTINUED) 10.4 While committed to openness and transparency, different considerations sometimes need to be applied when considering how to report the results of Internal Audit investigative work in relation to suspected fraud, corruption, thefts and other irregularities and this is reflected in the reporting protocol at Appendix 1. This protocol is designed to reflect the balance to enable the Audit and Scrutiny Panel to be suitably informed to effectively discharge its role with potential sensitivities around data protection issues, the risk that disclosure could sometimes potentially prejudice existing controls and security arrangements and the need to avoid prejudicing any ongoing Police involvement and/or disciplinary processes. There is also a recognition of the need to reflect materiality in reporting the results of such work by considering the nature and significance of the issues reviewed. 10.5 An exit meeting will be offered to the relevant Chief Officer(s), prior to completion of the management response, to discuss findings and agree their factual accuracy, raise awareness of the recommendations and the weaknesses identified and facilitate the completion of the management response section. 10.6 Management will be expected to provide a response to each internal audit report within three weeks, which will normally include the corrective action taken, or to be taken, in response to the specific findings and recommendations, the name of the responsible officer, a timetable for anticipated completion of each action and an explanation where any corrective action will not be implemented. 10.7 Internal Audit will also undertake and report on appropriate follow-up work designed to provide the Audit and Scrutiny Panel with assurance on whether management has implemented, within agreed timescales, planned actions designed to address previous significant audit findings. The Audit and Scrutiny Panel may formally ask Service management to explain non-implementation. 10.8 The Chief Officer (Audit and Risk) will periodically report to senior management and the Audit and Scrutiny Panel on the internal audit function’s purpose, authority and responsibility as well as performance relative to its plan. 10.9 Reporting will also include significant risk exposures and control issues, including fraud risks, governance issues and other matters needed or requested by senior management and the Audit and Scrutiny Panel. 10.10 In addition, the Chief Officer (Audit and Risk) will inform senior management and the Audit and Scrutiny Panel on the internal audit function’s quality assurance and continuous improvement programme, including results of ongoing internal self-assessments and external assessments conducted at least every five years. Page 109 of 126
Page 110
11. THE ROLE OF INTERNAL AUDIT IN RESPECT OF FRAUD-RELATED WORK 11.1 Responsibility for the prevention and detection of fraud lies primarliy with senior management across the Council. Internal Audit will assist management in the discharge of this responsibility. 11.2 Audit procedures alone, even when performed with due professional care, cannot guarantee that fraud or corruption will be detected. Internal Audit staff will, however, exercise an approprite level of professional scepticism during audit fieldwork and be alert to risks and exposures that could allow fraud or corruption. 11.3 The Council has a zero-tolerance attitude and will not accept any level of fraud, bribery or corruption. The Council’s Counter Fraud Policy sets out clear procedures for the reporting and investigation of actual or suspected fraud. 11.4 Managers, staff and elected members must always be alert to the risk of fraud, theft, bribery and corruption. In the first instance, staff should report fraud/suspicion of fraud to their Line Manager or Chief Officer, who should inform the Council’s Internal Audit Section. 11.5 Any instances of fraud/suspected fraud will be investigated thoroughly and dealt with appropriately. Vigorous and prompt investigation will be undertaken by Internal Audit where actual or suspected fraud is discovered or reported. 12. APPROVALS Approved by the Audit and Scrutiny Panel Date: Approved by the Chief Executive Date: 07/08/2024 Approved by the Chief Officer (Finance) (Section 95 Officer) Date: 08/08/2024 Approved by the Acting Chief Officer (Audit and Risk) Date: 01/08/2024 Page 110 of 126
Page 111
Appendix 1 – Internal Audit Reporting Protocol 1.1 This protocol explains how the work of Internal Audit will be reported to management and to the Audit and Scrutiny Panel (acting as the Council’s audit committee). 1.2 The Public Sector Internal Audit Standards (PSIAS) contain several expectations and requirements in relation to Internal Audit reporting. Internal auditors must communicate the results of engagements and the communications should include the engagement’s scope, objectives and results. The PSIAS make it clear that communications must be accurate, objective, concise and constructive, complete and timely and that the results must be communicated to appropriate parties, (who are to be determined by the chief audit executive), who can ensure the results are given due consideration. 1.3 Currently, all Internal Audit reports are issued to relevant senior management as soon as possible after reports are finalised and this practice will continue. A summary of the key findings and recommendations of all Internal Audit reports is also prepared by the Chief Officer (Audit and Risk) and submitted periodically to the Council’s Corporate Management Team and this practice will continue. 1.4 Taking the PSIAS requirements into account, Internal Audit will adopt the following principles when reporting the results of its work to the Audit and Scrutiny Panel. Internal Audit reporting to the Audit and Scrutiny Panel: key principles Internal Audit is committed to openness and transparency and the need for timely reporting of the results of Internal Audit’s work to enable the Audit and Scrutiny Panel (‘the Panel’) to effectively discharge its role. Decisions about what and how to report in relation to the results of Internal Audit work will be made by the Chief Officer (Audit and Risk) in line with the core principles contained within the PSAIS, including those relating to independence and objectivity. The Chief Officer (Audit and Risk) will, where appropriate, seek advice from the Council’s Monitoring Officer and the Chief Executive. There is a presumption that key findings in relation to all Internal Audit outputs will be reported to the Panel at the earliest opportunity after reports are finalised. There is a presumption that full copies of all planned Internal Audit outputs and all unplanned outputs with significant audit findings will be made publicly available and reported to the Panel at the earliest opportunity after reports are finalised unless there are good reasons not to. This includes reports relating to investigations and any ad hoc or other unplanned outputs. Where full copies of Internal Audit reports are not made publicly available in line with these principles, the Chief Officer (Audit and Risk) will clearly explain the rationale for this to the Panel. Where this occurs, consideration will also be given to ensuring the maximum possible timely disclosure subject to the circumstances of each case. Options which will be considered include redacting parts of the audit report where necessary and/or taking individual reports in private as an excluded agenda item. Page 111 of 126
Page 112
Appendix 1 – Internal Audit Reporting Protocol (continued) 1.5 The following tables outline the detailed approach that will normally be adopted by the Chief Officer (Audit and Risk) when determining how to report the results of different types of Internal Audit’s work. Assignments included in the approved Internal Audit Plan Reporting to the Audit and Scrutiny Panel A summary of the audit grading, key findings and recommendations of all such reports issued since the last update will be incorporated into regular progress reports on Internal Audit matters prepared by the Chief Officer (Audit and Risk) which are submitted to each normal business meeting of the Panel. Full copies of all such reports will be made publicly available and reported to the Panel subject to any redactions considered necessary by the Chief Officer (Audit and Risk) following consultation with the Council’s Monitoring Officer. It is expected that any such redactions will be kept to the minimum considered essential and the rationale for any such redactions will be clearly communicated to the Panel. Assignments not included in the approved Internal Audit Annual Plan including investigations and other ad hoc and/or unplanned work Significant findings in relation to all Internal Audit outputs relating to assignments not included in the approved Internal Audit Annual Plan issued since the last update will be incorporated into regular progress reports on Internal Audit matters prepared by the Chief Officer (Audit and Risk) which are submitted to each normal business meeting of the Panel unless there are good reasons not to. Significant findings are defined as those where reports have identified losses greater than £5000 and/or reports have identified significant weaknesses in internal controls and/or governance arrangements. Other reports will be referenced at the discretion of the Chief Officer (Audit and Risk) dependent on his assessment of the significance and relevance of the issues raised to the effective discharge of the Panel’s remit. Full copies of all such reports with significant findings will normally be made publicly available and reported to the Panel at the next meeting unless the Chief Officer (Audit and Risk) following consultation with the Council’s Monitoring Officer determines that there are good reasons not to. Where full copies of reports are not made available consideration will be given as to how best to permit timely disclosure to the Panel. Options which will be considered at this stage include redacting any relevant parts of the audit report where necessary and/or taking individual reports in private as an excluded agenda item. Page 112 of 126
Page 113
North Lanarkshire Council Report Corporate Management Team Does this report require to be approved? ☒ Yes ☐ No Ref PH/ASP/RM update August2024 Date 29/08/24 Risk Management Update (including Corporate Risk Register (CRR) 2024-2025) From Paula Hendry, Acting Chief Officer (Audit and Risk) E-mail hendryp@northlan.gov.uk Telephone 07471 321768 Executive Summary This report provides members with an update on key risk management developments with a particular focus on the results of the recent annual review of the corporate risk register. The Corporate Risk Register (CRR) is formally reviewed annually to ensure completeness and continuing alignment with the Council’s strategic objectives, The Plan for North Lanarkshire and the associated Programme of Work. This report seeks to provide the Panel with an overview of the outcomes of the review process and to present the revised Corporate Risk Register for 2024-25. As part of the review process, the Corporate Risk Team has refreshed the horizon scanning document (Appendix 2) to support consideration of key areas of uncertainty which could impact on the delivery of Council objectives and services to the public. In addition, the Corporate Risk Team has, via the Risk Management Corporate Working Group (RMCWG), engaged with Services to consider whether any risks within service-level risk registers merit escalation to the CRR and undertook informal benchmarking with a sample of other local authorities’ corporate risk registers to inform the process. As Members are aware, all corporate risks identified and agreed as meriting inclusion in the CRR are subject to regular monitoring and review by relevant senior management, with any developments relating to the risk register periodically reported to both CMT and the Audit and Scrutiny Panel in line with their respective governance roles. Overall, although there are some changes in individual scores, the revised Corporate Risk Register for 2024-25 is broadly similar to the previous year. The Panel is invited to note the key changes, namely the inclusion of a new risk ‘Inability to manage RAAC issue across NLC’ and the removal of two risks - ‘Target Operating Model’ and ‘Supply Chain’. In addition, it has been agreed that two current risks will be reframed (‘Managing Strategic Change’ and ‘Enterprise Project’). Recommendations The Panel is asked to consider the contents of the report and to: (1) note the agreed corporate risk register for 2024/25 at Appendix 1 which incorporates the changes outlined in Section 2 of the report ; and (2) note the information contained within the report in respect of risk management arrangements within Services (including the summary of those risks with the highest residual risk scores). Item 8 Page 113 of 126
Page 114
1. Background 1.1 The Risk Management Strategy requires that the Corporate Risk Register (CRR) is subject to an annual review exercise. This report seeks to provide the Panel with an overview of the process undertaken to discharge the annual CRR review requirement for the 2024-25 year and the resulting CMT decisions on changes to the register. 1.2 The purpose of the annual review of the CRR is to ensure completeness and continuing alignment with the Council’s strategic objectives, The Plan for North Lanarkshire and the associated Programme of Work. 1.3 On behalf of CMT, the Corporate Risk Team led on this year’s review. This involved discussion with members of the RMCWG, to consider potential issues arising from individual Service risk registers. Informal external benchmarking with corporate risk registers of other councils has also been carried out. 1.4 As the landscape within which the Council operates and provides services continues to evolve so must the CRR in order that it keeps pace with and accurately reflects, the ongoing challenges the Council faces. To facilitate this process, the Corporate Risk Team has undertaken a ‘horizon scanning’ exercise and prepared a summary (Appendices 2 and 3) to support CMT’s consideration/discussions on the proposed risk register. In addition to the horizon scanning activity, analysis of some of the existing corporate risks has resulted in proposals for changes to ensure that the register reflects future uncertainties. 1.5 This report summarises the outcomes of the CRR review process and allows the Panel to note the Corporate Risk Register for 2024-25 at Appendix 1. 2. Report Corporate Risk Register Review Process 2.1 The current CRR approved for 2023-24 contained 28 risks. Risks contained within the register have been subject to ongoing monitoring and review throughout the year, with regular risk reporting to CMT and Audit and Scrutiny Panel on the overall risk register and changes arising throughout the year. 2.2 As stated in the Corporate Risk Management Strategy, the definition of a corporate risk is ‘risks which can impact the Council in achieving its priorities and stated objectives or which are more strategic in nature and require corporate oversight. For example, such risks may have the potential to impact many Services, and/or can impact significantly on the Council in terms of financial costs and reputational damage. The Corporate Risk Register will reflect an amalgamated position of Service-level risks and may also include significant Service-level risks which have been escalated for attention at a strategic level.’ 2.3 A number of methods have been used and information sources reviewed to stimulate a thorough approach to the CRR review process including: • review of the Programme of Work to 2028, considering how and whether risks in relation to key planned Programme of Work activities are adequately reflected within corporate, service and/or project risk registers; The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Page 114 of 126
Page 115
• Services were asked to highlight any key risks within Service risk registers that they considered may merit consideration for inclusion in the CRR going forward; • informal comparisons/benchmarking was undertaken with other local authorities’ corporate risk registers, to help inform the review process and to identify any relevant areas which may have been overlooked; and • annual horizon scanning exercise to support CMT consideration on new and emerging risks. A copy of the horizon scanning document is available at Appendix 2. This year’s horizon scanning activity was informed, in the most part, by Aon’s Global Risk Management Survey results (published in late 2023) and the World Economic Forum publication “Global Risks Report 2024”. The RMCWG has discussed and considered a summary of both documents. 2.4 The RMCWG has horizon scanning as a standing agenda item at each of its meetings. This allows for ongoing monitoring of emerging risks within service areas and regular consideration of the need for additional entries on any of our risk register levels. This is supplemented by an annual horizon scanning exercise undertaken by the Corporate Risk Team. 2.5 Our analysis of the results from public sector respondents recorded in the Aon publication provided assurance that the top 10 future risks are captured (in some form) in our risk register infrastructure. 2.6 An informal review of a sample of corporate risk registers for other local authorities was also undertaken. Whilst there were a number of varying entries captured on counterpart risk registers, our review has confirmed that the content of the Council’s CRR remains valid and comprehensive, and broadly consistent with other council’s risk registers with no obvious omissions. 2.7 The CRR should be reflective of what the Council is seeking to achieve at a strategic level with risks relating to key projects or programmes captured. The governance arrangements in respect of the recently refreshed Programme of Work to 2028 have evolved over the last 12 months and the Corporate Risk Team has developed risk management arrangements within this, which are currently being rolled out across all Strategic Boards and will be supported by the Corporate Risk Team to ensure proper consideration is given to risk management. Review of Current Corporate Risk Register Entries 2.8 Most of the existing risks contained within the 2023-24 CRR remain relevant and are included in the approved 2024-25 version. 2.9 Approved changes from the review process are detailed in the table below. Decision Rationale Reframe the Managing Strategic Change risk (RIS0000021) into a new risk relating to ‘Inability to deliver approved programmes of work’. This will consider governance arrangements, operating framework, organisational capability, capacity and consistency of approach within and across the differing programmes of work. • There has been substantial focus on developing strategic oversight in this area with the governance arrangements for the Programme of Work to 2028 now established and moved to operational phase. • These new arrangements are still at an early stage of implementation, so a reshaping of the corporate risk will ensure that implementation is best fit for purpose and flexible enough to meet ever changing challenges which affect the organisation. Page 115 of 126
Page 116
Decision Rationale Reframe ‘Enterprise Project’ to focus on the current phase and rename ‘Enterprise Contract (Mobilisation)’. • Context of the original entry related largely to the uncertainty around the procurement process and the award of contracts. • Uncertainty has now shifted to mobilisation of the contract, governance and supplier performance management arrangements through establishing the intelligent client model. Closure of ‘target operating model’ (RIS0000405) risk • It is considered that it would be more appropriate to remove this risk from the CRR, recognising that appropriate management and oversight of associated relevant risks in this area is achieved through the governance and project management arrangements that apply under the ‘One Service’ Strategic Programme of Work Board. Closure of ‘Supply Chain’ risk (RIS0000460) • Originally captured to recognise the uncertainty and potential volatility in the global supply chain arising from inflation and scarcity of components driven by the fallout of macroeconomic events (e.g. Brexit, Covid-19 Pandemic and geo-political events), which in turn created local budgetary pressures and uncertainty for service delivery. The challenges in product availability and increased costs have been incorporated into procurement and budgetary practices. • Since the risk was captured, overlaps have developed with both the financial sustainability risk and procurement risk. • New or discrete supply chain pressures can be appropriately reflected in Service risk registers as they emerge and be escalated to the CRR as need dictates. Proposed New Risks for inclusion on the Corporate Risk Register 2.10 New Corporate Register risks are considered as part of normal business. As such, one new risk is included in the 2024-25 register. 2.11 Members will be aware of the ongoing challenges in respect of the known and potential presence of reinforced autoclaved aerated concrete (RAAC) in the Council’s property estate. Whilst the matter, where appropriate, is being addressed on Service risk registers, the senior officer working group established for RAAC has determined that although robust corporate oversight arrangements have been established, the residual uncertainly around potentially significant impacts merits escalation to the CRR. This group, chaired by the Depute Chief Executive, has completed a deep dive risk assessment which has resulted in a residual score of 15 – MEDIUM. A number of planned actions are in place which, as they are progressed, are expected to help to reduce the risk rating. Page 116 of 126
Page 117
Corporate Risk Register 2024-25 2.12 A revised CRR is included at appendix 1. It should be noted therefore, that starting with 28 risks on the CRR for 2023-24, and the agreed removal of two risks, reframing of two risks and addition of one new risk means that the net overall effect is that the proposed risk register for 2024-25 has 27 risks. Currently, 25 of these are ‘Live’ and fully documented and two are now ‘Draft’ owing to them requiring to be reframed. Developments relating to Corporate Risks since the last update 2.13 Initial scoping work is underway to reshape the Managing Strategic Change risk to ensure increased focus on delivery of the Programme of Work. Significant progress has been made in reframing the Enterprise Contract risk to recognise the shift to contract mobilisation and the risk assessment process will be completed shortly. The outcomes of both reframing exercises will be reported to a future meeting of the Panel. 2.14 There is only one risk which has changed scoring since the previous report to the Panel. The residual risk assessment of the Procurement risk has increased to reflect the need for continuous improvement (identified through for example internal audit and PCIP assessment) and recognises that some controls are not yet fully implemented. The Corporate Procurement Working Group (CPWG) has oversight of progress of the actions identified to implement the controls. Service risk registers – risks with highest residual scores 2.15 Our service risk register infrastructure is maintained through the support of Service Risk Champions and Risk Facilitators. Their time and hard work are invaluable to the effective implementation of the Council’s Risk Management Strategy and their contributions are greatly appreciated. 2.16 Service Risk Forums convene regularly and reports on risk register developments are provided to Service Management Teams (SMT’s) to enable them to discharge their responsibilities for monitoring and reviewing service risks/registers as noted within SMT Terms of Reference. 2.17 Through the RMCWG, consideration was given to whether there were any matters from Service level registers that merit escalation to the corporate register. At this time, no such risks have been identified as meriting escalation. 2.18 The table below provides a summary of the latest risk profile across our Service risk registers. Appendix 4 includes a summary of risk register entries, with the highest residual scores across these registers. Insignificant Low Medium High Very high Total Chief Executive’s Service 39 53 39 6 0 137 Education & Families 6 17 22 1 0 46 Adult Health & Social Care 0 7 13 1 0 21 Enterprise & Communities 35 134 93 14 0 276 Page 117 of 126
Page 118
Other Risk Management Developments 2.19 Members will recall from the previous report the Corporate Risk Team have been actively supporting the Programme of Work Thematic Boards with the development of an appropriate risk assessment methodology. This initiative is now at an advanced stage with the introduction of the Programme Uncertainty Level Status Evaluation (PULSE) to support Senior Responsible Officers (SROs) and Programme Boards as a check and challenge on their level of confidence in relation to high level risk themes. The Corporate Risk Team will continue to support the Boards in implementing this new approach. 2.20 Members will also recall that a formal approach to compliance with the Risk Management Strategy has been approved by the Council’s Business Management Team (BMT). At the last Panel this was set out as a key priority for the Corporate Risk Team now that the vacant Risk Manager post has been filled. The RMCWG has progressed with an initial cycle of the compliance assessment process with initial feedback on the process, outcomes and next steps scheduled to be considered at the next RMCWG session. This will include consideration of onward reporting to management and to the Panel and we expect to include the results of this compliance work in future update reports. Next Steps 2.21 The Corporate Risk Team, recognising the need for continuous improvement, will undertake a review of the current approach to updating and reporting on Corporate Risk Management matters to Audit and Scrutiny Panel to facilitate the discharge of it’s pertinent Terms of Reference. 3. Measures of success 3.1 The Corporate Risk Team will continue to report quarterly to CMT and the Audit and Scrutiny Panel providing an overview of key developments in risk management and updating on progress in respect of planned improvements to the Council’s risk management arrangements. 3.2 The adequacy and effectiveness of the Council’s risk management arrangements will be independently and regularly reviewed by Internal Audit, who will report directly on the results of that work to the Audit and Scrutiny Panel. 3.3 Effective risk management arrangements assist the Council in achieving planned outcomes and/or help the Council mitigate the impacts of adverse events. 4. Supporting documentation Appendix 1: Proposed Corporate Risk Register 2024-25 Appendix 2: Horizon Scanning 2024 Appendix 3: Comparison of top Public Sector risks per AON publication to NLC corporate risk register Appendix 4: Highest scoring Service risk register entries Paula Hendry, Acting Chief Officer (Audit and Risk) Page 118 of 126
Page 119
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements will enable the Council to manage its risks more effectively, increasing the likelihood of the Council achieving its plans and ambitions by minimising or mitigating potential threats to planned outcomes. A robust risk management strategy lays out the framework and underpins all risk management activity across the organisation. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☒ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 119 of 126
Page 120
Appendix 1 Proposed Corporate Risk Register 2024-25 CORPORATE RISKS (Operational) Likelihood Impact Rating Evaluation Change 1. Impact of proposal to create a National Care Service 5 5 25 Very High No 2. Home support service delivery/sustainability 5 5 25 Very High No 3. Information security and governance 5 4 20 High No 4. ICT operational capability 5 4 20 High No 5. Human resources (workforce planning) 4 4 16 High No 6. Public protection 4 4 16 High No 7. Procurement risk 4 4 16 High Was 12 8. Early learning childcare workforce 4 4 16 High No 9. Governance, leadership and decision- making 4 4 16 High No 10. Health and Safety 5 3 15 Medium No 11. RAAC (NEW) 3 5 15 Medium New 12. Business continuity planning 5 3 15 Medium No 13. Terrorism 3 5 15 Medium No 14. Home to school transport delivery/sustainability 3 4 12 Medium No 15. Resilience planning 2 5 10 Medium No 16. Serious organised crime, fraud and corruption 3 3 9 Medium No 17. Impact of changes to SFRS operating arrangements 2 4 8 Low No 18. Enterprise Contract (Mobilisation) (REFRAME) TBC TBC TBC TBC N/A CORPORATE RISKS (Strategic) Likelihood Impact Rating Evaluation Change 19. Tackling poverty 5 4 20 High No 20. Power resilience (Black Start) 4 5 20 High No 21. Climate change 5 4 20 High No 22. Digital adoption 5 4 20 High No 23. Financial sustainability 3 5 15 Medium No 24. Digital and IT strategy 4 3 12 Medium No 25. Engagement and consultation 3 3 9 Medium No 26. Improving educational outcomes 3 3 9 Medium No 27. Delivery of approved programme of work (REFRAME from Managing Strategic Change) TBC TBC TBC TBC n/a RISKS REMOVED FROM THE CORPORATE RISK REGISTER Change Page 120 of 126
Page 121
Supply chain risk 4 4 16 High n/a Target Operating Model TBC TBC TBC TBC n/a RISKS TO BE REFRAMED Change Enterprise Project 3 4 12 Medium n/a Managing strategic change 3 4 12 Medium n/a Page 121 of 126
Page 122
Appendix 2 Horizon Scanning 2024 (Source: Aon Global Risk Management Survey) Risk Ranking Public Sector UK Aggregate Global (All) Risk Area Future Current Future Current Future Current Cyber Attack or Data Breach 1 1 1 1 1 1 Failure to Attract or Retain Top Talent 2 3 5 2 4 4 Economic Slowdown or Slow Recovery 3 5 2 3 2 3 Regulatory or Legislative Changes 4 4 8 7 5 5 Cash Flow or Liquidity Risk 5 6 9 8 10 - Damage to Brand or Reputation 6 2 - 4 - 8 Capital Availability 7 - - - - - Failure to Innovate or Meet Customer Needs 8 10 6 5 9 9 Workforce Shortage 9 - - 8 - Artificial Intelligence (AI) 10 - 3 - - - Property Damage - 7 - - - - Business Interruption - 8 - 6 6 2 Political Risk - 9 - - - - Supply Chain or Distribution Failure - - - 9 - 6 Climate Change - - 4 10 - - Geopolitical Volatility - - 7 - - - Environmental Social Governance (ESG) and Corporate Social Responsibility - - 10 - - - Commodity Price Risk or Scarcity of Materials - - - - 3 - Increasing Competition - - - - 7 - Page 122 of 126
Page 123
Appendix 3 Comparison of top Public Sector risks per AON publication to NLC corporate risk register Risk Area Risk Context NLC Corporate Risk Register Reference Cyber Attack or Data Breach • Cyber threats and ransomware attacks have increased in frequency, sophistication and severity over the past four years with impacts on operations, finance and public confidence. • Following a peak in 2021 there was a decline in ransomware attacks in 2022, this trend reversed in the first half of 2023 signalling a requirement for continued focus on relevant controls for cyber risk resilience. • Response and recovery from cyber events has become increasingly complex with regulatory bodies / partner agencies introducing more stringent cyber security requirements. Captured within CRR RIS0000019 “Information Security and Information Governance” and also the impact of RIS0000702 “Digital Adoption”. Failure to Attract or Retain Top Talent • Inability to attract talent can limit the ability of organisations to excel • Without a steady infusion of talent, organisations may develop skills gaps in key areas • Resource gaps introduce additional pressures on remaining staff and can lead to burnout disengagement and retention issues • Emerging trends impacting the talent market o Pay and inflation - global inflation has driven demands for higher pay o Employee experience – the pandemic has influenced how workers in some roles perceive the workplace following the experience of working from home for many spurring a desire for increased flexibility • Catering for the needs and preferences of a multigenerational workforce could be a competitive advantage in the talent market Captured in CRR, RIS000003 “Human Resources”. Economic Slowdown or Slow Recovery • Long standing trend of slowdowns occurring once every decade. • Increasing levels of economic uncertainty present challenges in understanding how these will impact on demand for and delivery of services. Reflected in CRR with relevant controls identified in RIS0000002 “Financial Sustainability” and RIS0000009 “Procurement” entries. Page 123 of 126
Page 124
Appendix 3 Comparison of top Public Sector risks per AON publication to NLC corporate risk register (continued) Risk Area Risk Context NLC Corporate Risk Register Reference Regulatory or Legislative Changes • Changes to existing laws or New laws and regulations can impact all or some operating environments and how services are delivered. • These may create the need for change in working practices and / or require investment in new assets, technology or more staff. Reflected as need dictates on CRR for example; RIS0000257 “Climate Change (mitigation, adaptation & sustainability)” and RIS0000004 “Health & Safety”. Cash Flow or Liquidity Risk • Uncertainty around funding settlements is an ever present feature across the public sector. • Failing to implement effective financial planning and financial control processes can seriously impact on the ability to deliver services. • This was illustrated by the experiences of Birmingham City Council and Woking Borough Council in 2023. Reflected in RIS0000002 “Financial Sustainability”. Damage to Brand or Reputation • Compromised brand or reputation impacts on public / stakeholder confidence and can distract management focus from service delivery. • External influence and reporting on routine matters (e.g. social media and 24 hour news) can rapidly alter public / stakeholder perception. • Navigating the dynamic regulatory landscape (e.g. Data, environment, equalities, transparency and ethics) is key in managing exposure in this area. As an impact category within NLC risk assessment matrices, the impact on “Reputation” is an active consideration when scoring risks. Capital Availability • Aligned to Cash Flow and Liquidity above and availability and accessibility of funds. Reflected in RIS0000002 “Financial Sustainability”. Failure to Innovate or Meet Customer Needs • Public Sector context in this area pertains largely to public confidence in the quality of services now and in the future. • Failing to adapt to trends and innovate to improve service, will attract adverse publicity and criticism from commentators. Captured in RIS0000253 “Engagement and consultation with communities, partners and stakeholders on the shaping and delivery of services” and RIS 0000702 “Digital Adoption”. Page 124 of 126
Page 125
Appendix 3 Comparison of top Public Sector risks per AON publication to NLC corporate risk register (continued) Risk Area Risk Context NLC Corporate Risk Register Reference Workforce Shortage • Linked to the Failure to Attract Talent theme above, the Public Sector view of Workforce Shortage as a top 10 future risk aligned with 6 other sectors. • This emphasises the importance of workforce planning processes as a key control. Captured generally within CRR entry, RIS000003 “Human Resources” and more specifically within RIS0000729 “Early Learning Workforce Change”. Artificial Intelligence (AI) • AI is recognised as one of the future risks in the Public Sector. • Exploiting AI may be an effective preventative or mitigating control in relation to some of the other risks identified in the survey. • Conversely there is significant uncertainty around emerging cyber security, regulatory and legal framework requirements for the use of AI. Referenced within RIS0000019 “Information Security and Information Governance”. Property Damage • Public sector organisations cited property damage as an area of concern. • Increasing frequency of natural weather events increase the risk exposure of public sector organisations with large commercial property, education or housing stock portfolios Mitigation included in the controls of RIS0000015 “Business Continuity Planning”. Business Interruption • Business Interruption (BI) costs arise due to the loss of income or the increased cost of providing services following a loss, for example following loss of access to property of following a cyber attack. • BI exposures are increasing in frequency and complexity. • Latent exposures for example where building construction included RAAC could also impact on the ability to deliver services. Mitigation included in the controls of RIS0000015 “Business Continuity Planning”. Political Risk • Political risk, ranking at number 9 in the current list in the public sector, falls out of the future risk list. • Participants are clearly concerned that the effects of geopolitical volatility will increase the risk to their organizations. • National election activity around the world in the immediate term brings with it increased uncertainty. Political implications recognised in the context, causes and consequences of several corporate risks. Page 125 of 126
Page 126
Appendix 4 Highest Scoring Service Risk Register Entries Risk Number Title Residual Risk Service Score RIA0000372 Inadequate staffing levels or expertise to provide advice and support to the council, its ALEOs and elected members. 20 Chief Executive's RIA0000212 Child Abuse Legislation 20 Chief Executive's RIA0000039 Organisational capacity and retention of staff 20 Chief Executive's RIS0000011 Risk Management 16 Chief Executive's RIA0000020 Failure to implement business change / service redesign thus impacting on stated benefits realisation 16 Chief Executive's RIS0000532 PCI Compliance (HUB) 16 Chief Executive's RIS0000671 Advocacy and Representation for Residents 16 Education & Families RIA0000223 Service failure due to loss in IT capability 20 Enterprise and Communities RIS0000711 Reinforced Autoclaved Aerated Concrete (RAAC) 20 Enterprise and Communities RIS0000709 Impact of staffing issues on service provision 16 Enterprise and Communities RIS0000712 Decomissioning of B Drive following Data Migration to Teams 16 Enterprise and Communities RIS0000395 Inability to provide a service due to staffing/ training/ absence etc. 16 Enterprise and Communities RIS0000744 Decommissioning of B:Drive and subsequent loss of reliant databases and data 16 Enterprise and Communities RIA0000012 HSMS Maintenance & Development 16 Enterprise and Communities RIS0000315 Management of Service Users Recorded under MAPPA within the Community (Outed Cases) 16 Enterprise and Communities RIA0000068 Delivery of Property Services 16 Enterprise and Communities RIA0000089 Cost of Living Crisis, Welfare System & Energy Costs 16 Enterprise and Communities RIS0000612 General Workforce within Housing 16 Enterprise and Communities RIA0000109 Failure of key unsupported business systems 16 Enterprise and Communities RIS0000617 General Workforce 16 Enterprise and Communities RIS0000576 Microsoft Teams Migration 16 Enterprise and Communities RIA0000449 Information and Data Protection - non-compliance with policy and legislation 20 Adult Health & Social Care Page 126 of 126