Agenda Document Pack - Audit and Scrutiny Panel - 08/05/2025
North Lanarkshire Council · 8 May 2025
Back to Audit and Scrutiny Panel — 8 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
29 April 2025 Members of the Audit and Scrutiny Panel Chief Executive’s Office Rachel Blair Chief Officer (Legal & Democratic) Civic Centre, Windmillhill Street, Motherwell ML1 1AB www.northlanarkshire.gov.uk Notice is given that a Meeting of the Audit and Scrutiny Panel is to be held in the Committee Room 1, Civic Centre, Windmillhill Street, Motherwell, ML1 1AB on Thursday, 08 May 2025 at 14:00 PM which you are requested to attend. The agenda of business is attached. Rachel Blair Chief Officer (Legal & Democratic) Members : Clerk Name: Clare Louise McDonald Clerk Telephone: 07350 435308 Clerk Email: committee@northlan.gov.uk S Watson, P Kelly, C Costello, A Duffy-Lawson, M Hughes, J Hume, D Johnston, J Leckie, M McCulloch, J McLaren, G Robinson. Page 1 of 144
Page 2
Page 2 of 144
Page 3
Agenda 1 Declarations of Interest In Terms of the Ethical Standards In Public Life Etc. (Scotland) Act 2000 Scrutiny Related Items 2 Strategic Performance Framework - Performance Reporting Schedule Quarterly Performance Assurance Review Submit report by the Chief Officer (Strategy and Engagement) setting out the outcome of the latest quarterly performance assurance review, undertaken on performance reports previously submitted to Council Committee's during Cycle 1 of 2025. 5 - 26 Audit Related Items 3 Audit and Risk Related Item - Action Log Submit report by the Chief Officer (Audit and Risk) allowing members to track implementation of outstanding requests and recommendations made by the Panel in respect of audit and risk-related items. 27 - 28 4 Internal Audit - Progress Report Submit report by the Chief Officer (Audit and Risk) providing an overview of Internal Audit activity and audit reports issued since the last update to the Panel in February 2025. 29 - 78 5 Internal Audit Annual Plan 2025-26 Submit report by the Chief Officer (Audit and Risk) seeking approval of the Internal Audit Plan 2025-26. 79 - 86 6 Internal Audit - Follow-up of Implementation of Audit Recommendations Submit report by Chief Officer (Audit and Risk) providing an update to the Panel on the progress made by management in the implementation of Internal and External Audit recommendations. 87 - 110 Page 3 of 144
Page 4
7 Internal Audit Charter Submit report by the Chief Officer (Audit & Risk) seeking approval of the Internal Audit Charter, setting out the purpose, mandate, authority and principal responsibilities of the Council’s Internal Audit function. 111 - 132 8 Risk Management Update Submit report by the Chief Officer (Audit and Risk) providing an update on the Corporate Risk Register developments since the last update to the Panel in February 2025. 133 - 144 Page 4 of 144
Page 5
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref SP/SL Date 08/05/25 Strategic Performance Framework - Performance Reporting Schedule quarterly performance assurance review From Stephen Penman, Chief Officer (Strategy and Engagement) E-mail PenmanSte@northlan.gov.uk Telephone 07725 289 559 Executive Summary The purpose of this report is to bring together a summary of the council’s performance reports in one composite assurance overview to support the Audit and Scrutiny Panel in maintaining strategic oversight and awareness of the council’s performance reporting arrangements in line with the Panel’s remit to provide “independent review of the council’s governance, risk management, performance, and control frameworks”. It also supports the Audit and Scrutiny Panel’s governance and accountability role in terms of ensuring the council can demonstrate Best Value through the existence of robust arrangements for performance reporting and scrutiny. This process monitors reports which have been submitted to council committees (in line with the Strategic Performance Framework - Performance Reporting Schedule) during the previous cycle. This process began in 2023 following the initial annual Performance Reporting Schedule at the Audit and Scrutiny Panel with implementation of a quarterly performance assurance review report thereafter. This report herewith provides the Panel with the outcome from the latest quarterly performance assurance review that has been undertaken on performance reports previously submitted to council committees during cycle 1 of 2025 (in line with the Performance Reporting Schedule for 2024 to 2025 which was at the Panel meeting in February 2024). Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Review the composite overview of performance reporting provided in Appendices 1 and 2 to maintain an awareness of each report within the Performance Reporting Schedule for 2024 to 2025, and (2) Identify whether there are any significant issues arising, from the composite performance overview presented in the attached Appendices, that the Panel considers requires additional scrutiny and a further report to be submitted from the respective Chief Officer to a future meeting of the Panel (following review through the Scrutiny Assessment and Prioritisation Process). Item 2 Page 5 of 144
Page 6
1. Background 1.1 Members of the Audit and Scrutiny Panel will recall the report in February 2024 which contained the Strategic Performance Framework - Performance Reporting Schedule. This set out the reporting, review, and scrutiny arrangements for a range of performance information to be considered at each cycle of committee meetings for 2024 to 2025. 1.2 The Strategic Performance Framework comprises performance measurement at three levels (as per the diagram on the right). This aims to collectively provide an overview of performance to help understand the impact of council activities on improving services and outcomes for the people and communities of North Lanarkshire. The measures in this Framework allow for day-to-day activities, and progress towards achieving the long-term vision set out in The Plan for North Lanarkshire, to be regularly monitored, reported, assessed, and scrutinised. 1.3 The supporting Performance Reporting Schedule forms a key part of the Scrutiny Work Programme that underpins the Best Value governance and accountability theme by ensuring the council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. It also aims to fulfil the Audit and Scrutiny Panel’s remit as per the Scheme of Administration to: • Review and monitor the performance of the council in delivering upon its priorities, outcomes, programme of work and targets in the council plan, specifically performance in improving local services and outcomes and in demonstrating Best Value. • Review performance to assess whether intended policy outcomes have been achieved. 1.4 The Strategic Performance Framework comprises a set of non-negotiable standards which Chief Officers are required to apply in all performance reporting that supports the Framework. These standards aim to ensure that performance reporting is: • Aligned - to The Plan for North Lanarkshire to give stakeholders an insight into the performance of council activities both in the short-term and against the long-term ambitions. • Consistent - to ensure a standard, easily recognisable, and well-established process across each different audience over time. This aims to help build credibility, reliability, and a common understanding. • Transparent - to allow stakeholders to understand what is being measured, what it means, what level of performance has actually been achieved, and what difference this means in reality for the people and communities of North Lanarkshire. • In context - to avoid the So What? question and provide a coherent narrative to ensure fully informed review, reporting, scrutiny, and decision-making processes. • Balanced - to ensure any text adds value and tells a balanced narrative. Performance reports should identify areas requiring improvement as well as areas The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Page 6 of 144
Page 7
of good performance. Narrative should include reasons for performance levels not in line with targets and the remedial action undertaken to address this. 1.5 The Performance Reporting Schedule shows there is a significant volume of performance information timetabled to be reported to various council committees in each cycle of 2024 to 2025. Cycle 1 2025 reports were reviewed by the Business Management Team in April 2025 to ensure the relevant assurances in terms of performance management arrangements that promote effective use of the council’s resources, performance information being scrutinised at a senior management level, and performance monitoring arrangements in place to effectively address areas of underperformance, identify the scope for improvement, and agree remedial action. 1.6 The volume of performance information in the cycle 1 2025 reports has been reviewed and summarised further in Appendices 1 and 2 attached. It should be noted that the performance information within Appendices 1 and 2 has already been reviewed by Service Committees during cycle 1 of 2025. The purpose of the information presented herewith is therefore to provide Audit and Scrutiny Panel members with a composite, but easily digestible, overview for governance and assurance purposes in line with the specific scrutiny and strategic oversight role of the Panel. 1.7 Should the Panel consider there are any significant issues arising from the composite performance overview which require additional scrutiny, these matters will be reviewed through the Scrutiny Assessment and Prioritisation Process (updated and approved by the Panel in September 2022 and further endorsed in September 2023), prior to being added to the Scrutiny Work Programme for a further report to be submitted from the respective Chief Officer to a future meeting of the Panel. 2. Quarterly performance assurance review 2.1 The Strategic Performance Framework - Performance Reporting Schedule sets out several aspects of performance reporting. As part of this, paragraphs 2.2 to 2.6 itemise the performance reports submitted to cycle 1 2025 committees in accordance with the timetable set out in the Schedule. (1) Chief Officer’s individual Performance Review reports at Service Committees in line with the Strategic Performance Framework. (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. (1) Chief Officer’s individual Performance Review reports at Service Committees in line with the Strategic Performance Framework. 2.2 The Strategic Performance Framework comprises a range of performance indicators from each Chief Officer’s portfolio and the latest results in this respect are aligned to the respective ambition statements in The Plan for North Lanarkshire. The two reports previously submitted to the relevant committee in cycle 1 of 2025 are listed in Table 1 below, along with the corresponding hyperlink for ease of access. Table 1 Report title Committee Date Strategic Performance Framework - latest performance results - Legal and Democratic link to report Finance and Resources Committee 26 February 2025 Page 7 of 144
Page 8
Adult social care performance - Quarter 2 (July to September 2024) link to report Adult Care and Social Work Committee 18 February 2025 2.3 Each council report was produced in line with a standard template and (a) provides the reader with the current context within which the service is operating, (b) highlights areas of good performance that can be evidenced in the accompanying data, and (c) provides a summary of areas of performance requiring improvement along with narrative that gives an explanation for the level of performance achieved and summarises the remedial action implemented (or to be implemented) to bring performance back on track. 2.4 A short summary analysis for each of the reports is set out in Appendix 1 against the five non-negotiable standards. (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. 2.5 This aspect relates to service specific reporting which is required to meet business and/or statutory obligations. This is included in the Performance Reporting Schedule to ensure all the council’s performance reporting arrangements are captured in the one place and the Schedule reflects a one council approach to performance reporting. 2.6 The 10 reports previously submitted to the relevant committee in cycle 1 of 2025 are listed in Table 2 below, along with the corresponding hyperlink for ease of access. A short summary for each of these reports is set out in Appendix 2. While this summary is set out against the five non-negotiable standards it recognises there may also be statutory specific approaches or standards which require to be adhered to. Table 2 Report title Committee Date Freedom of Information annual report 2023/24 link to report Finance and Resources Committee 26 February 2025 Senior Information Risk Owner (SIRO) annual assurance and performance report 2024 link to report Finance and Resources Committee 26 February 2025 Public Sector Duties climate change annual report 2023/24 link to report Environment and Climate Change Committee 5 February 2025 North Lanarkshire Community Planning Partnership: annual oversight and outcomes report 2023/24 link to report Communities Committee 3 February 2025 Local Outcome Improvement Plans (LOIP) performance report - April to September 2024 link to report Communities Committee 3 February 2025 Education performance update link to report Education, Children, and Families Committee 25 February 2025 Revenue and Benefits update link to report Finance and Resources Committee 26 February 2025 Financial monitoring report - council summary (revenue) link to report Finance and Resources Committee 26 February 2025 Page 8 of 144
Page 9
Financial monitoring report - council summary (capital) link to report Finance and Resources Committee 26 February 2025 Financial monitoring - savings link to report Finance and Resources Committee 26 February 2025 Next steps 2.7 Assurance reviews will continue to be undertaken and reported to the Audit and Scrutiny Panel on a quarterly basis in order to maintain the measures of success set out in paragraph 3.1. 2.8 The content of the quarterly assurance review reports will be informed by the annual Performance Reporting Schedule for which an updated in respect of 2025/26 reporting is scheduled to be presented to the Audit and Scrutiny Panel meeting in cycle 3 of 2025. 2.9 Reports submitted to the respective committee (in line with the Schedule) will continue to be kept under review by the senior management team of the council so that adherence to the timetable is maintained. This will also seek to ensure the relevant assurances in terms of the efficient and effective operation of the council and that the ongoing delivery of the long-term ambition set out in The Plan for North Lanarkshire is underpinned with good corporate governance. 3. Measures of success 3.1 Measures of success include: • Regular oversight and monitoring of performance across the organisation to gain assurances in terms of governance and accountability. • Regular review and challenge processes to scrutinise the performance of the council to ensure effective use of resources and that resources are directed in accordance with agreed policy and according to priorities, while ensuring sound decision making and clear accountability for the use of resources in achieving improved outcomes for service users and the local community. • Performance monitoring, management, and reporting arrangements that support the demonstration of improved performance in local services and outcomes, and the delivery of Best Value. 4. Supporting documentation Appendix (1) Chief Officer’s individual Performance Review reports at Service Committees in line with the Strategic Performance Framework. Appendix (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. Stephen Penman Chief Officer (Strategy and Engagement) 5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Page 9 of 144
Page 10
Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? The Local Government Act 1992 established the role of the Statutory Direction to direct councils in terms of the “publication of information as to standards of performance”. The Local Government in Scotland Act 2003 introduced the duty of Best Value; this requires that councils “make arrangements to secure continuous improvement in performance”. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Page 10 of 144
Page 11
Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Implementation of the Schedule, which aims to facilitate regular review and scrutiny processes, contributes to the mitigation of the risk on the Corporate Risk Register for governance, leadership, and decision making. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 11 of 144
Page 12
Appendix 1 (1) Chief Officer’s individual Performance Review reports at Service Committees in line with the Strategic Performance Framework. Report title Summary SPF - Latest performance results for Legal and Democratic February 2025 Legal and Democratic has 8 indicators in the Strategic Performance Framework. Significant areas of activity across the service (within each of the areas of service delivery, i.e. democratic and resources, enterprise, and litigation) are carried out in support of other council services and, accordingly, performance targets are often not within the sole gift of Legal and Democratic. The indicators monitored through the Strategic Performance Framework therefore focus on those areas where the service does have control of performance. Performance across all of these areas is monitored, as required, at fortnightly extended management meetings chaired by the Chief Officer. Aligned Priority: • Improve North Lanarkshire’s resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. 25. Ensure intelligent use of data and information to support fully evidence based decision making and future planning. Consistent The pre-defined template was used to ensure a standard, easily recognisable, and well established process across each different audience over time. The use of this template aims to help build credibility, reliability, and a common understanding. Transparent RAG indicators: In context The service restructured in April 2024 reducing the number of sections from four to three - Democratic and Resources, Litigation, and Enterprise. The implementation of the structure is to be finalised, but the service continues to face pressures on account of vacancies as a result of a difficulty in recruiting and retaining some posts. This has resulted in increased pressures on meeting demand, but all possible and practical steps are being taken to address this, including increasing resources and introduction of a case management system. The service has implemented efficiencies in service delivery in Licensing, including streamlining processes and adopting a more digitised strategy. This has improved the customer experience and reduced the time that matters are brought before the Licensing Board and Regulatory Committee for determination. The service is continuing to review and implement efficiencies in Registration both to meet customer demand and in preparation for One Number. Balanced Performance highlights: • The service continues to perform well in the processing of Freedom of Information and Registration which are assessed by national regulators in the terms of quality and accuracy of service reports. These are reported to Committee on an annual basis, and these will continue to be monitored to ensure that each service area achieves the best possible performance outcomes. Page 12 of 144
Page 13
• Given the digitisation of service areas, consideration is being given to key performance indicators for both internal clients and external customers and should meaningful performance information be available, these will be reported in due course. Areas of performance requiring improvement: • The reason for the red status in respect of the increased cost per hour for legal services is due to a combination of increased staffing costs (due to national collective bargaining) together with the associated on-costs and the filling of a number of vacancies leading to an increase in the number of chargeable hours. • With regards to the hours spent providing legal services, this figure was revised following a reduction in sickness absence leading to an increase in the overall staff time recorded. As these are factors outwith the control of the service, consideration will need to be given to an adjustment of the targets so that these are reflective of the actual position going forward. • Performance in the indicator for children’s panel expenses was impacted by a reduction in full-time equivalent staff due to secondment elsewhere and other competing council priorities. This indicator was new for 2023/24 and, as such, the target was set at 100%. Consideration will also be given to an adjustment to this target once trends have been established. Report title Summary Health and Social Care performance update - Quarter 2 (July - September 2024) February 2025 The Chief Officer (Health and Social Care North Lanarkshire) has joint quarterly performance review meetings with the Chief Executives of NHS Lanarkshire and North Lanarkshire Council. These meetings are supported by a Chief Executive’s Performance Framework which comprises a range of performance measures taken from across both the health and social work systems, including relevant targets and trajectories for the measures presented. In each quarter there are areas for improvement identified within the performance framework; these are identified using a RAG rating and those measures that are flagged as Red or Amber are subject to improvement or corrective action. The performance review meetings are used as a means for jointly agreeing these actions. Aligned Priority: • Improve the health and wellbeing of our communities. Ambition statement: 12. Ensure our residents are able to achieve, maintain and recover their independence through appropriate supports at home and in their communities. 13. Improve preventative approaches including self-management and giving people information and choice over supports and services. 14. Ensure the highest standards of public protection. Consistent A pre-defined Health and Social Care Partnership template is in place to ensure a standard, easily recognisable, and well established process for quarterly reporting on areas for improvement. Transparent Based on a traffic-light system there are areas for improvement identified within the performance framework each quarter for those areas that are flagged as Red or Amber. The areas for improvement identified are progressed as a matter of priority, and progress updates are reported at future meetings of the Integrated Joint Board and/or the Integration Joint Board Performance, Finance, and Audit Committee as appropriate. In context • The joint performance review meetings (involving the Chief Officer for the Health and Social Care Partnership, the Chief Executive of NHS Lanarkshire, and the Chief Executive of North Lanarkshire Council) are used as a means for jointly agreeing corrective actions within the current operating environment. • The report describes the progress that has been made in pursuit of the national health and wellbeing outcomes and recognises that this progress has been made against a challenging position of recovery and remobilisation of services following the pandemic, which is reflected in the performance in some of the metrics presented in the report. Balanced The purpose of the report is to provide an update on the areas for improvement what have been identified as part of the quarterly performance review. The quarter 2 report (for July - September 2024) sets out corresponding narrative and corrective actions agreed for the areas identified for improvement; the narrative and corrective actions are summarised below. Page 13 of 144
Page 14
• Reablement and rehabilitation - During 2023/24, the number of people completing the reablement process increased, however in 2024/25 there has been a reversal of this trend. The percentage of new or increased home support packages that are reablement is relatively stable but below the targeted level of 70%. However, the percentage of people with no, or reduced home support at the end of the reablement process has not met the targeted level of performance. Additional data / information on reablement is available from another dataset which shows that throughout 2024/25, the overall number of referrals has decreased, however it should be noted that this decrease follows a notable and significant increase at the start of the financial year. There is no target set for this metric; however it complements the reablement information presented and should be considered in the context of a wider system of reablement, rehabilitation, and home support. • Home assessment team data - Since its inception, the home assessment team has accepted 2,645 referrals, with October 2024 recording a peak of 147 accepted referrals. This marks the tenth month within the past year where accepted referrals exceeded 100, and the ninth consecutive month of such volume. Wishaw and Cumbernauld each contributed 22% of the total referrals over the past year, while Motherwell and Airdrie accounted for 18% and 17% respectively. Bellshill and Coatbridge have shown increases in recent months, now contributing 9% and 12% respectively to the total overall volume of referrals. University Hospital Wishaw has 50% of referrals, University Hospital Monklands in Airdrie at 47%. The majority of referrals (60%) are female, with 40% aged 75-84 years. Only 10% of referrals are for individuals under 65, and none for those under 18. A recent data clean-up has ensured that no unknown ages are recorded. 2% of referrals had no input services, which is a slight decrease; data cleansing is identifying older and those cases where there is incomplete data. The majority of referrals (59%) had 1 or 2 services, while 40% had 3 or more services, an increase from the previously reported 35%. Home support remains the most utilised service (86%), followed by occupational therapy (62%). Physiotherapy services have notably increased from 20% to 27%. Re-admission to hospital at the end of the home assessment team process remains a concern, with 14% of individuals being re-admitted. Upon completion of the home assessment team process, 64% of individuals required no further service, while 36% needed at least one additional service. Of those needing further services, 74% required one service and 26% needed two or more. • Adult social work - In Quarter 2 of 2024/25, North Lanarkshire Social Work services received fewer Adult Support and Protection (ASP) referrals than during the same period last year. However, there was a notable increase in the number of Police adult concern reports when compared with the same quarter in the previous year. The general increase in volume of Police adult concern reports is indicative of the developing role of Police Scotland as a key partner to Social Work services, however it may also represent an unmet need or changing demand within the community. There was significant variation in the monthly referral rates across the six localities. Notably, Cumbernauld saw a 9% increase in referrals from the previous year, while Coatbridge and Bellshill saw significant decreases of 44% and 31%, respectively. Care home referrals dropped significantly, likely due to collaborative efforts with local care homes to reassess reporting thresholds and provide alternative support options. Out of the 743 ASP referrals received, 10% (72) were redirected to other services, while 27% (206) progressed to investigation. 50% (373) were recorded as No Further Action under ASP procedures, although many of these cases still required interventions to promote welfare. The number of ASP investigations carried out this quarter rose significantly to 206, a 76% increase compared to 117 investigations in the same period last year. However, only 6% (13) of these investigations progressed to an initial case conference, a slight decrease from last year's 10%. Page 14 of 144
Page 15
Appendix 2 (2) Chief Officer service specific performance reporting which takes place each year to meet business and/or statutory obligations. Report title Summary Freedom of Information - annual report 2023/24 February 2025 This report provides details of Freedom of Information (FOI) and Environmental Information Regulation (EIR) requests received by the council during 2023/24 as well as information on internal reviews and appeals to the Scottish Information Commissioner. The Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004, provide rights to the public to ask for and be provided with recorded information held by public authorities. The Environmental Information (Scotland) Regulations 2004 sit alongside the Freedom of Information legislation and govern access to environmental information such as planning matters, contaminated land, emissions, etc. Once a Freedom of Information or Environmental Information Regulation request is received the council has, in most cases, 20 working days to provide the information asked for, or explain why it cannot be provided. If the council does not respond, or the requester is unhappy with the response, the requester can ask for an internal review. If the requester is still dissatisfied following the internal review, they can then appeal to the Scottish Information Commissioner. Aligned Priority: • Enhance participation, capacity, and empowerment across our communities. Ambition statement: 20. Improve the involvement of communities in the decisions, and development of services and supports, that affect them. Consistent • The report provides an annual update on the volume of Freedom of Information and Environmental Information Regulation requests the council received each month during 2023/24 and provides comparisons in terms of an increase of decrease in volume over the past 12 years. • As in previous years reports, the volume of requests has been categorised to identify whether these were from members of the public (with no identifiable affiliation to a particular organisation, group, or company), elected representatives (i.e. Elected Members, MPs, MSPs, and parliamentary researchers acting on their behalf), businesses and commercial enterprises, the media, or solicitors acting on behalf of a client. • The volume of requests for an internal review of the original decision is also reported with an indication of the outcome of this review (i.e. whether requests were wholly or partially upheld or deemed compliant) as well as comparisons to previous year. • Information is also provided in terms of requests appealed by the requester to the Scottish Information Commissioner. Transparent • The report advises that 1,780 requests were received in 2023/24 (1,408 were Freedom of Information requests and 372 Environmental Information Regulation requests, this is a 10.5% increase in volume of requests received compared to 2022/23, and a 26% increase from 2021/22. It is noted that this high number of requests is reflected nationally and the Scottish Information Commissioner states in their annual report that 95,361 requests were received by Scottish public authorities in 2023/24 and this is the highest reported yearly total since data collection began. • 39% of requests received in 2023/24 were recorded as being received from public and other (i.e. members of the public with no identifiable affiliation to a particular organisation, group, or company). The next largest category of requests (15%) was those received from elected representatives (i.e. Elected Members, MPs, MSPs, and parliamentary researchers acting on their behalf). 14% of requests were from businesses and commercial enterprises, 14% came from the media, and 7% came from solicitors acting on behalf of a client. • In 2023/24, 24 requests for internal review of the original decision were received. Despite the increase in requests this year, this total is only slightly higher than the 22 requests for review received in 2022/23. The 24 requests received for internal review represents 1.3% of the total number of requests received by the council. This proportion is consistent with that seen last year and is lower than the national figure reported by the Scottish Information Commissioner of 3% of requests resulting in an internal review. • Of the 24 internal reviews, in 21 cases the original decision was either wholly or partially upheld or deemed compliant. In one case the original decision was overturned and received a fresh decision at review. One review was undertaken because there was no response to the original request and one internal review was withdrawn. One request received in 2023/24 was appealed by the requester to the Scottish Information Commissioner. This appeal is still being considered by the Commissioner and the outcome will be reported in next year’s report. Page 15 of 144
Page 16
• Of the 1,780 requests received in 2023/24, 25 were not fully progressed due to factors such as clarification required to progress the request not being received or the requester withdrawing their request. Of the remaining 1,755 requests that were fully progressed, 1,732 (98.7%) were responded to within the statutory 20 working day deadline. This compares with a compliance rate of 98.7% in 2022/23 and 98.5% in 2021/22. • The Scottish Information Commissioner's self-assessment toolkit for public authorities on responding to requests on time considers a response rate to requests of 96-100% as excellent, 85-95% as good, 80-84% as adequate, and less than 80% as unsatisfactory. In context • Following the 2022/23 consultation on access to information rights, the Scottish Government has set out it’s Freedom of Information policy objectives for 2024 to 2026. The objectives are to be taken forward in the following three workstreams: 1. Consideration and use of Scottish Ministers’ powers to extend coverage of the Freedom of Information (Scotland) Act. 2. Updating statutory guidance for Scottish public authorities. 3. Maintaining full Freedom of Information coverage of public sector in Scotland. • Any changes to Freedom of Information legislation, or statutory guidance, resulting from these workstreams will be reported to future meetings of the Finance and Resources Committee. Balanced • Appendices to the report provide the total number of requests received under either the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004 broken down by month. Information is also provided regarding the type of requestor and details of cases submitted for internal review. Report title Summary Senior Information Risk Owner (SIRO) - annual assurance and performance report 2024 February 2025 This report provides an update relating to the responsibilities of the council’s Senior Information Risk Owner (SIRO). A SIRO is a professional role, which has responsibility for implementing and managing information risks within the organisation. This report aims to provide assurances that information risks are being effectively managed to ultimately enable the council to comply with legislative requirements and good practice. It summarises the Data Governance Board’s oversight of information governance arrangements for the period January to December 2024 and provides the SIROs assessment of the council’s existing information governance and data accuracy arrangements. It outlines what is going well, highlights key matters of concern, and details the improvement actions to be progressed during 2025 to strengthen the council’s information governance arrangements. Following on from the change to the reporting cycle implemented during 2023/24, this annual SIRO report relates to the calendar year 2024 in order to provide Elected Members with an up-to-date snapshot of current information governance management arrangements. Aligned Priority: All priorities. Ambition statement: All ambition statements. Consistent • The SIRO role is mandatory for public sector organisations and organisations which are contracted to deliver services under the NHS standard contract. The report sets out the SIRO responsibilities which includes: • Leadership and overall ownership of the council’s corporate governance action plan in terms of acting as corporate champion for information governance. • Acting as Executive Sponsor and advocate for the management of information governance at a senior level. • Providing advice and reports in respect of information incidents and risks, including informing the content of the council’s Annual Governance Statement relating to information risk. • Owning the management of information governance and associated risk assessment processes within the council. • Understanding how the strategic priorities of the council may be impacted by information governance risks, and how these risks need to be managed Page 16 of 144
Page 17
including the adequacy of resources and levels of independent scrutiny. Transparent • The report advises that SIRO responsibilities have been aligned with the Chief Officer (Business and Digital) remit since September 2019, but following consideration of the One Place, One Plan - Governance update report at Policy and Strategy Committee in September 2024, this responsibility will transfer to the Chief Officer (Legal and Democratic Services) during 2025. • Previous SIRO reports have confirmed the council operates effective information governance management arrangements, having undertaken and delivered significant technical and process improvements over recent years. The report also reiterates that the council is committed to effective information governance with sound arrangements for ensuring compliance with legislation and recognised best practice appropriately managed as part of the council’s risk management and corporate governance arrangements. In context • The report complements the Corporate Data Protection Officer’s annual report to the Finance and Resources Committee and sets out any breaches of confidentiality and security considered by the Data Governance Board during the reporting period, alongside assessment of the remedial actions identified. • It includes a focus specifically on ICT security and cyber risks which highlights the scale of the cyber security threat now facing all organisations and details activities undertaken through Business and Digital to mitigate cyber risks and maintain positive information governance assurance. The report also details corporate governance activities (such as training and data quality improvements) being undertaken to enhance and strengthen the council’s approach to managing its information risks and details actions taken to maintain compliance with the Public Records (Scotland) Act 2011. • The report advises that progress against areas of improvement will be managed through Data Governance Board oversight arrangements, who will look to further develop policies, guidance, standards, processes, and approaches (as appropriate) to improve awareness, understanding, and compliance with legislative requirements and good practice. • With a residual risk score of 20 prevalent in respect of the risk for Information Governance and Information Security on the council’s Corporate Risk Register, the report notes that it is essential this subject matter remains as a high priority improvement area for the council. Progress in terms of ongoing monitoring and assurances, as well as implementation of improvements, is therefore managed by the Data Governance Board who will look to further develop policies, guidance, standards, processes, and approaches as appropriate to ensure continuous improvement in all information governance management arrangements. Balanced • The covering report is supported by a very detailed appendix which highlights performance and activity undertaken over the reporting period to ensure personal data is held securely, and information disseminated effectively. Key highlights include information in respect of the following: • The information security and information governance corporate risk which is monitored in accordance with residual risk ratings, with corresponding mitigating actions identified and deployed. • Reported data breaches which are comparable with calendar year 2023, with improvements evident in the number of breaches reported to legal services within the required 72 hours. A higher percentage of breaches met the threshold for reporting to the Information Commissioner’s Office (ICO), but the ICO did not apply any enforcement action or fines in respect of these. • The council continues to follow published National Cyber Security Centre (NCSC) guidance, with several activities undertaken to mitigate against potential cyber security threats, including maintaining compliance with Public Sector Network (PSN) and Payment Card Industry Data Security Standard (PCI DSS) requirements, fully deploying protection, preventative and detective tools, further developing information security standards, and transitioning all critical products to more secure and modern cloud-hosted solutions. • An assessment of the council’s Data Maturity Score during 2024 confirmed that delivery of improvement actions over recent years has resulted in the council’s maturity score improving from +1 (Initial/Basic) to -3 (Developing), an excellent achievement given the benchmark score for similar organisations is 2+ (Basic). • Increased oversight and monitoring of mandatory training activity which has resulted in compliance levels vastly improving; for example, non- compliance as at 7th December for the Data Protection Essentials module ranges from only 2% for Chief Executives to 16% for Adult Health and Social Care. Members should note that non-compliance between 0% and 20% is RAG rated as Green. • Continued delivery of actions agreed with the Keeper of the Records of Scotland in respect of File Plan, Destruction Arrangements, Vital Records, and Audit Trail. • Complementing the Corporate Data Protection Officer’s annual reports to the Finance and Resources Committee, the SIRO report (and its annexes) provide further details regarding data breaches identified during the reporting period, and the guidance and remedial actions applied following their Page 17 of 144
Page 18
assessment. • ICT security and cyber risks - these highlight the scale of the cyber security threat now facing all organisations and detail activities undertaken through Business and Digital to maintain a positive information governance assurance and mitigate against potential cyber risks. This section confirms that the council was not affected directly by any notable cyber incidents during the reporting period. • Addressing high-risk vulnerabilities in ageing critical systems is considered a key priority for 2025, with this section confirming that actions are identified and largely underway through the approved Digital North Lanarkshire Programme of Work and capital investment programme to address this growing risk. • The report sets out the next steps which includes details in respect of an improvement plan which highlights activities planned for 2025 to strengthen existing arrangements, i.e. raise the profile and prioritisation of Data Protection responsibilities, refresh and strengthen approach to mitigating cyber security risks and vulnerabilities, iterative deployment of the Data Governance Board approved workplan, and enhanced implementation of the council’s strategic approach to data and information management in line with the Programme of Work to 2028. Report title Summary Public Sector Duties climate change annual report 2023/24 February 2025 • The Climate Change (Duties of Public Bodies: Reporting Requirements) (Scotland) Order 2015 introduced a legal obligation for public bodies to report annually detailing their compliance with the duties specified in the Climate Change (Scotland) Act 2009 and its subsequent amendments. The report is produced annually for the most recently completed financial year with a national submission date of 30th November each year. • The report provided the Environment and Climate Change Committee with a summary of the content of the Public Sector report on Compliance with Climate Change Duties submitted on behalf of the council in November 2024 for the 2023/24 reporting year. It also provides an update on progress against carbon budgets set within the council’s Climate Plan ACT2030 and also key points in respect of delivering the Sustainable Futures Programme of Work. Aligned Priority: All priorities. Ambition statement: All ambition statements. Consistent • A standard report template is provided to all local authorities which comprises a number of sections which require information on the organisation’s profile, governance, emissions and projects, adaptation, procurement, and validation as well as a non-mandatory section in relation to wider influence. Within the council, this information is collated annually and verified for submission by the relevant council service. • The report follows on from that at Committee in 2023 which advised that the organisational carbon boundary (a list of the emissions that is reported) would increase. This is in line with the Public Sector Leadership on the Global Climate Emergency 2021 which states “There is now a strong demand among the sector for robust, consistent and comprehensive measurement and reporting of the entire carbon footprint of public bodies to support the accelerated action now needed.” Transparent • The February 2025 report shows a summary of the council’s annual footprint in terms of emissions (tCO2e) from the baseline year (2015/16) to the end of the latest reporting year (2023/24). This includes the annual emissions target set. A list of the council’s consumption and resulting emissions is also contained within an appendix to the report. • For 2023/24 the council’s footprint was reported as 62,124 carbon tonnes equivalent (tCO2e). Measuring the original boundary against the baseline showed that there was a continued decrease in emissions with an overall reduction of 1.4% from the previous year’s report and an overall reduction of 48.5% from the baseline year of 2015/16. • The report also highlights the need to retain the Climate Plan ACT 2030 carbon targets and budgets until the publication of the council’s Net Zero Pathway later this year. • The statutory reporting process is supported by the Sustainable Scotland Network who also analyse the annual submissions from the public sector bodies’ reports and report their overall findings publicly. This includes identifying strengths and weaknesses ( https://sustainablescotlandnetwork.org/reports ). In context The report advises that: Page 18 of 144
Page 19
• In support of the 2019 climate emergency ambition to realise net zero by 2030, the council published its Climate Plan ACT2030 in 2021 which included a series of thematic carbon budgets that were intended to drive down the council’s scope 1 and 2, as well as scope 3 emissions. • Meaningful climate action is underway in key areas within the council’s Sustainable Futures Programme of Work Board which has committed producing a new net zero pathway which will contain costed actions resulting in a realistic timescale and targets. Work on this commenced in August 2024 with a workshop that key officers and chief officers (and the responses to the questions) considered have helped to inform development of the net zero pathway which is being further explored with individual services in terms of their contributions to the action plan. • A draft climate plan template has been developed by Environmental Standards Scotland on behalf of the Scottish Government with the intent that the format can be adopted as local authorities update their climate plans. It is expected that this will be on a voluntary basis initially with an eventual hard stop date. Due to the timing of the council’s next plan i.e. the Net Zero Pathway, officers involved have opted to adopt the template to negate the need for unnecessary rework of what will be a live document. The report also advises that the council has a duty to act in a way that supports the successful delivery of the Scottish National Adaptation Plan 2024-29 and work is already underway to enable North Lanarkshire to become more resilient to climate change (this is known as adaptation) by incorporating adaptation in the Net Zero Pathway as one its key themes which will be supported by direct and facilitating action. It will align with outcomes set within the national plan, i.e. nature connects, communities, public services and infrastructure, economy, business and industry, and international action. Balanced The report highlights some of the council’s climate activity and actions which contribute to reducing North Lanarkshire’s emissions as well as encouraging more sustainable practices within the area, this includes: • The City Deal team (Place) have incorporated carbon management into their large-scale infrastructure projects through project development and in time, project delivery, to take account of the whole life cycle of a project, developing carbon management plans, where appropriate, to manage the impact of both the implementation and end use of the infrastructure. • Procurement - The councils 2023/24 Procurement Strategy includes provision as to how the council will procure the supplies, works, and services required. In line with the legislative framework for sustainable public procurement in Scotland the following sustainable procurement objectives are incorporated: • Internal procurement rules, documents, and toolkits updated to reflect the new legislation. • Embedding the use of sustainability tools within procurement processes (e.g. the sustainability test, the prioritisation tool, and the flexible framework). • Non-domestic energy efficiency project - This incorporates a performance guarantee contract which ensures that savings projected via the delivery of various measures are assured. Due to the scale of the project the current phase has continued over from last year. The project is due to be completed in February 2025 and will see energy conservation measures such as insulation, LED lighting, and solar panels that will deliver a 25% reduction in energy use within targeted buildings and a reduction of 911 tonnes of CO2e in building related emissions. • North Lanarkshire energy advice service - This service is funded by the UK Shared Prosperity Fund and delivered by the Wise Group’s Home Energy Advice Team (HEAT) on behalf of the council. The service is available to vulnerable and/or fuel-poor households across North Lanarkshire that require support to resolve any energy-related issue and struggling to pay their energy bill. Advice and assistance are offered to households such as help reducing energy consumption as well as energy debt advocacy. This service is due to conclude March 2025. • Work has continued and developed with volunteer groups at Greenhead Moss and Palacerigg Country Park, together with 7 Lochs volunteers, in carrying out practical conservation tasks as well as some path and pond construction projects. These volunteers gain huge benefits in terms of mental and physical health from being involved in these projects, often they are individuals who have struggled with their mental health and these opportunities provide a chance to reconnect with society and the environment. • Funding from the Nature Restoration Fund totalling £556k has been used to deliver a number of projects such as the seeding of native wildflower meadows in eight town parks and biodiversity enhancements in four cemeteries. • The New Build team continues to produce quality, energy efficient housing with a record 335 homes delivered meeting minimum EPC B rating and 19 net zero homes delivered. This includes commencement on site of the first housing project in North Lanarkshire to use a ground source heat pump system, zero-emission heating systems installed on several major housing sites, renewable technologies such as PV installed on all council new builds, and a fabric first approach on all council new build properties which includes enhanced insulation, window and doors standard. • Auchinlea Landfill Site - Following a review of Auchinlea Landfill Site a two phase project (surface water management and leachate management) commenced June 2024. Leachate management refers to water, such as rainfall, which has passed through the solid matter and in this case the solid matter is landfill which means that both aspects of the project were crucial to the environmental management of the site. Phase 1 has seen the installation Page 19 of 144
Page 20
of a passive surface water drainage system that has eliminated the need of costly diesel pumps. The council will save over £60,000 per annum as a result of this. The second phase of the project is looking to treat the leachate onsite by creating a lagoon filtration system. Discussions are currently ongoing with SEPA. Should the project attain the necessary approvals, it will enhance the biodiversity of the site, realise an annual saving of £85,000, and eliminate the transporting of leachate off site for treatment. • The council continues to invest in existing housing stock to ensure that not only is the energy efficiency of properties increased, but also that carbon emissions are reduced and contribute towards meeting national net zero targets. Overall, 6,000 energy efficiency measures were installed in local homes in 2023/24, with 462 properties having external wall insulation installed, 600 properties having their windows upgraded to triple-glazed windows, 2,300 homes receiving energy efficient heating, 1,900 homes having solar panels installed, and 689 receiving insulation upgrades. As part of these works, funding was received from the Scottish Government’s Energy Efficient Scotland: Area Based Scheme, to install external wall insulation to flatted blocks in Kilsyth and Langloan. The amount invested in these areas is £3.4m, with £1m being funded by the Scottish Government to assist homeowners with the cost of the works. Report title Summary North Lanarkshire Community Planning Partnership: annual oversight and outcomes report 2023/24 February 2025 • The Community Empowerment (Scotland) Act 2015 introduced a range of new requirements on local authorities and community planning partners to empower and strengthen community involvement in the design, planning, and delivery of local services. • The Act requires all public sector bodies to work together and to engage with local communities on the issues that matter the most to them with the shared aim of improving outcomes in these priorities. There is a particular emphasis on addressing inequalities, poverty, and socio- economic disadvantage in local areas. Community planning partners must also report publicly on their progress including where outcomes have been improved through joint planning, collaboration, and effective partnership working - operationally and strategically. • The annual oversight and outcome report for 2023/24 highlights where community planning in North Lanarkshire is making a positive impact in strengthening partnership working and improving outcomes in line with The Plan for North Lanarkshire’s shared ambitions. Aligned Priority: Enhance participation, capacity, and empowerment across our communities. Ambition statement: 20. Improve the involvement of communities in the decisions, and development of services and supports, that affect them. 24. Review and design services around people, communities, and shared resources. Consistent All Community Planning Partnerships are required to annually review and report on their progress. Transparent • The report demonstrates and provides assurance that the North Lanarkshire Community Planning Partnership is meeting the aforementioned statutory obligations. • A detailed summary, attached as an appendix to the report, illustrates where community planning partners are collaborating and working closely with the community and voluntary sector and local people in the planning, delivery, and resourcing of public services with shared aims to improve outcomes and reduce inequalities. In context • The report advises that an integrated programme of reporting activity supports the North Lanarkshire Community Planning Partnership in monitoring the progress against priorities while fulfilling its statutory reporting obligations. This comprises - consideration of the annual outcomes report by the North Lanarkshire Partnership (NLP) Strategic Leadership Board and the Communities Committee with publication via the council's website and submission and consideration of a composite performance report to the NLP Strategic Leadership Board every six months on partnership activity and progress in taking forward the identified priorities and associated actions across the nine Local Outcome Improvement Plans. • It also notes that similar reports are considered by the Communities Committee with publication via the council's website (see next report on the next page) and that preparation and publication of annual progress reports on delivery of the individual Local Outcome Improvement Plan actions in each area are consideration by the relevant Community Board. In addition, it is noted that annual reporting by statutory partnerships and other partnership working groups on thematic plans are also included, e.g. the Children’s Services Plan and the Tackling Poverty Action Plan. Balanced Key highlights, described more fully in the appendix accompanying the report include the following: Page 20 of 144
Page 21
• Continued and enhanced support from partners to families, households, and communities throughout the ongoing cost of living crisis. • Ongoing commitment from partners to support good mental health, tackling mental health stigma and discrimination. • The continued commitment across all partners to work collectively and differently in supporting care experienced children, young people and their families, reaffirming their commitment to The Promise. Report title Summary Local Outcome Improvement Plans performance report - April to September 2024 February 2025 This report provides a snapshot of progress linked to key priorities for each of the nine Local Outcome Improvement Plans (LOIPs) for the period from 1st April to 30th September 2024. The report also provides an overview of progress with implementation of the Management and Monitoring Framework and work to develop the role of the Local Partnership Teams. Aligned Priority: • Enhance participation, capacity, and empowerment across our communities. Ambition statement: 19. Improve engagement with communities and develop their capacity to help themselves. Consistent • The report advises that the LOIP Management and Monitoring Framework has now been in use since June 2022 as a tool for partners to highlight and report on progress with local action linked to LOIP priorities. The tool also aims to assist with reporting progress and outcomes around LOIP priorities to a range of audiences including the Community Boards, the Communities Committee, the North Lanarkshire Partnership Strategic Leadership Board, and individual partnership agency leadership teams as appropriate. • The Framework is intended to streamline reporting, ensure consistency, and allow partners to focus on critical issues or significant developments. • The success of the Management and Monitoring Framework does not rest with one agency or an individual officer. All Local Partnership Team members share a collective responsibility for ensuring that the Framework is regularly updated and that there is adequate monitoring and scrutiny of progress and performance at each Local Partnership Team meeting. • Local Partnership Teams meet six-weekly with the purpose of ensuring oversight for delivery of LOIP priorities, with priority focused subgroups meeting as locally agreed and required to ensure targeted partnership action. Local Partnership Teams ensure use of the Management and Monitoring Framework and continue to refine the approach to reporting on progress to this Communities Committee, the North Lanarkshire Partnership Strategic Leadership Board, and Community Boards. Transparent • The report advises that the LOIP Management and Monitoring Framework underpins quarterly reporting to individual Community Boards, six monthly reporting to Committee, and statutory annual reporting in line with the Framework for Demonstrating Improved Outcomes for Communities. • The six monthly performance outcomes, attached in appendices to the report, provide a summary of key highlights across the strategic priorities identified in each LOIP. Planned future actions for the forthcoming six months (i.e. October 2024 to March 2025) are also included. In context • The report sets out the context within which the Management and Monitoring Framework was developed, i.e. in support of the North Lanarkshire Partnership Strategic Leadership Board’s Framework for Demonstrating Improved Outcomes for Communities, a LOIP Management and Monitoring Framework was developed and implemented to ensure effective management, oversight, and reporting of progress on LOIP priorities by Community Planning Partners through the Local Partnership Teams. • Local Partnership Teams were established to drive and embed delivery of the LOIPs across the Community Planning Partnership and ensure effective monitoring and management of progress. Balanced • The report is accompanied by nine appendices which set out detailed information for each LOIP in terms of priorities, progress and highlights, and planned actions and developments; this information is based on input from partner organisations. • Work has been undertaken with partners to ensure accountability and ownership for delivery of actions, participation in Local Partnership Teams and use Page 21 of 144
Page 22
of the framework to inform monitoring. Examples include: • Consultation with Local Partnership Team members and a review of the Management and Monitoring Framework to streamline and improve the reporting process for LOIP priority leads. This informed amendments to the system implemented from the reporting cycle from 1st April to 30th September 2024. • Self-assessment, planning and review sessions with each of the four Local Partnership Teams during 2024 to inform and identify development improvement actions for the operation of each individual Team. • This work builds on previous work with Local Partnership Teams since their inception, including online and in person development sessions for Teams collectively, with their own areas and around specific themes. Work continues to be developed within the Local Partnership Team model, and the Framework continues to be improved, reflecting the complexity and some of the challenges associated with partnership working, for example staff turnover, ongoing community voluntary sector engagement, and partnership ownership and accountability. • In relation to Community Board chairs and improvement activity, the report advises that the nine Community Board chairs have been brought together initially as a short-life task group to co-ordinate the approach to reviewing response to the Community Board self-assessment activity that took place in 2023/24. This work included the following: - Analysis of data from the initial survey - a booklet was produced outlining North Lanarkshire wide improvement actions and matters for local consideration. - Arranging localised sessions to consider results for each Board (delivered August /September 2024). - Assisting with organising the Community Board conference planned for spring 2025. - A report for each of the Boards to agree their own improvement actions at their November/December 2025 meetings to conclude the self-evaluation work (other than monitoring of progress). - The Chairs’ continuing to meet to consider matters relevant to all Boards, share good practice, and explore any challenges collectively and also to continue to be involved in the organisation of the planned Community Board conference. Report title Summary Education performance report This report provides an update on North Lanarkshire’s educational performance for 2023/24 across key measures including attainment within the broad general education (from early learning and childcare to end of S3) measured via Achievement of a Level (ACEL) data, attendance and exclusion, and teacher numbers and pupil teacher ratio. The report includes local authority comparison data compiled from national statistics published in December 2024 (https://www.gov.scot/collections/school-education-statistics/#summarystatisticsforschoolsinscotland). The report also provides a summary of HMIe and Care Inspectorate Inspection Outcomes for 2023/24 and, where applicable, outlines impact, progress to date, and planned next steps. Aligned Priority: • Support all children and young people to realise their full potential. Ambition statement: 6. Raise attainment and skills for learning, life, and work to enhance opportunities and choices. Consistent • Local authorities have a duty to improve standards in education, challenging and supporting educational establishments to ensure continuous improvement. • North Lanarkshire’s quality improvement framework, updated in session 2022/23, empowers school leaders to secure continuous improvement while providing assurance to stakeholders on the quality of education provided for learners. Transparent • The report outlines some of the key strategies implemented in 2023/24 to further support the quality improvement framework and facilitate improvement across North Lanarkshire’s educational establishments. The implementation of this framework is managed by Education and Families Managers. In context • The report sets the context in respect of attainment within the broad general education highlighting that Scotland’s curriculum, Curriculum for Excellence (CfE), is divided into two phases - the broad general education (BGE) and the senior phase. • The BGE has five levels (Early, First, Second, Third, and Fourth). It begins in early learning and childcare and continues to the end of S3 (the third year of secondary school). As illustrated in the table below, broadly speaking at the primary stages, progress through a level can take up to three years, although Page 22 of 144
Page 23
the curriculum is designed to allow pupil progress to be accelerated to ensure breadth, depth and challenge, across and within levels. Balanced • The report sets out a wide range of figures that show North Lanarkshire’s performance over time as well as a comparison of this with the national average and family group average of similar councils. Data is shown in relation to the following: - P1, P4, P7 data for literacy and numeracy. - Performance within Curriculum for Excellence organisers - this shows attainment data across the literacy and numeracy organisers which is useful to support the service’s strategic planning in terms of training for staff and deployment of support, for example. - Combined data for literacy and numeracy, highlighting learners’ attainment at Curriculum for Excellence 3rd and 4th level. - Cohort comparison in respect of Achievement of a Level (ACEL) data - comparing 2024 to 2021 data allows performance to be tracked in terms of the progress of the same cohort of pupils who have moved from P1 to P4, P4 to P7, and P7 to S3 over the four year period. - Progress towards closing the poverty related attainment gap over time. - Senior phase post appeal data, pupil numbers, teacher numbers and the pupil teacher ratio, and attendance and exclusions. - HMIe and Care Inspectorate inspection outcomes and the thematic inspection in October 2024. Report title Summary Revenues and benefits update February 2025 This report provides a regular update on the payment performance for council tax and non-domestic rates, the administration of a range of welfare benefits, and the council tax reduction scheme. It provides an update on performance as at 31st December 2024. Aligned Priority: • Improve North Lanarkshire's resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. Consistent • Produced quarterly, this report provides Elected Members with detailed in-year performance figures which can be compared to the same period in previous years. Transparent • The year to date performance set out in the report covers a wide range of service activities as well as the amount of funding paid out to help households in need in order to provide a safety net for local people on low incomes. • The report also allows for comparisons of performance with the same period in previous years. In context • The council is responsible for the administration and collection of all local taxation in North Lanarkshire in the form of council tax and non-domestic rates. In addition, the council administers a number of benefits for residents of North Lanarkshire including housing benefit, council tax reduction, Scottish welfare fund, discretionary housing payment, free school meals, and clothing grants. • The report includes the latest context within which the service is operating; this is of particular relevance given the aforementioned administration of grants and support payments required for low income households. The report also advises of any new national grants when they are introduced, or will cease, and the qualifying conditions for receipt of such. Balanced The report provides a high-level summary of the highlights which include: Page 23 of 144
Page 24
• As at 31st December 2024, 81.74% of council tax due for 2024/25 had been collected. This is a marginal percentage point reduction from the same period last financial year (0.07%). • Non-domestic rates collection at 31st December is 81.0% of the total annual charge. This is an increase of 16.74% from the same period last financial year. • The service continues to meet statutory timescales for administering benefits applications and changes of circumstance. Report title Summary Financial monitoring report - council summary (revenue) February 2025 This report presents the council’s revenue monitoring position for the General Fund Account, Housing Revenue Account, and Adult Health and Social Care. (Note, the Council set its Revenue Budget and Council Tax for 2025/26 and provided a forecast Revenue Budget position for financial years 2026/27 and 2027/28 at the committee meeting in February 2025.) Aligned Priority: • Improve North Lanarkshire’s resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. 25. Ensure intelligent use of data and information to support fully evidence-based decision making and future planning. Consistent • The report at each financial period end consolidates the budget monitoring position of all council services into one council summary, highlighting and explaining major variances as per the council’s approved Financial Regulations. • The February 2025 report presents the council’s revenue monitoring position for the financial year to 31st March 2025 as at the end of period 10 (03/01/25). Transparent • The report highlights and explains major variances as per the council’s approved Financial Regulations. The Financial Regulations require services to remain within their approved budgeting provision, and to report all significant deviations - defined as the higher of £100,000 or 5% - within their budget monitoring reports. In context • All activities undertaken by the council are subject to risk, and in acknowledging the council’s approved Risk Management Strategy, services manage these as part of their overall corporate and service planning processes. The February 2025 report states that the current economic climate and pay and non-pay inflation, continuing at historically high levels, are some of the key factors that have the potential to impact on the council’s ability to provide quality services within approved budget levels. Balanced • Where significant deviations are identified, services must provide explanatory commentary, outline the action required to rectify such deviations and, where relevant, must also highlight the impact this has on other budget headings. This information is captured by Finance and summarised in the overall council report. • A summary by division for the period ending 03/01/25 (P10) is included in an appendix to the report, as is a note of anticipated commitments against earmarked reserves, and availability of general fund balances. Report title Summary Financial monitoring report - council summary (capital) February 2025 This report provides an update on the 2024/25 resources and expenditure for the council's Strategic Capital Investment Programme. The report also shows the 2024/25 projected outturn position and the resultant variances. (Note, the Strategic Capital Investment Programme for 2024/25 to 2028/29 was approved by Policy and Strategy Committee in March 2024 and an annual update was provided in March 2025.) Aligned Priority: • Improve North Lanarkshire’s resource base. Page 24 of 144
Page 25
Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. 25. Ensure intelligent use of data and information to support fully evidence-based decision making and future planning. Consistent • The report at each financial period end consolidates the capital monitoring position of all council services into one council summary. • The February 2025 report summarises the overall council Strategic Capital Investment Programme for 2024/25 in relation to resources and expenditure and the 2024/25 projected outturn position and resultant variances. Transparent • The report notes that Strategic Capital Investment Programme 2024/25 to 2028/29 was approved at Policy and Strategy Committee in March 2024 with an annual update provided in March 2025. It represents the total Community Investment Programme incorporating the General Services Capital Programme and HRA Capital Programmes. • The programme was developed in conjunction with services and led by the Strategic Capital Delivery Group (SCDG) using the principles established by the council’s Capital Strategy. In context • The report states that the General Services Capital Programme supported by General Services resources demonstrates to communities that the place making vision for towns remains a priority, and that the approved 5-year capital investment plan supports delivery of The Plan for North Lanarkshire. • The programme includes additional investment in Town and Community Hubs, the City Deal programme, and external grant funding. In addition, the Housing Revenue Account (HRA) resources support several HRA Capital Investment Programmes including the mainstream programme for investment in the council’s existing estate and delivery of the ambition for additional supply through the new build and council buyback programmes. Balanced • The report notes the current financial position in respect of the 2024/25 General Services Capital Programme and the Housing Revenue Account. This reflects the approved budget and subsequent decisions made at the Strategic Capital Delivery Group (SCDG) in accordance with the SCDG terms of reference, and where appropriate either by the individual service committees, Finance and Resources Committee, or the Policy and Strategy Committee )as per the Scheme of Administration). • A breakdown of the overall 2024/25 budget by service programme and associated approved budget movements is included in an appendix to the report. • In acknowledging the risks, the report recognises that the capital programme continues to face challenges in relation to the wider economic climate, linked to availability of materials, contractors, and inflationary pressures. These are currently being managed by services and Project Boards associated with specific programme delivery and will continue to be monitored throughout the year in accordance with the Strategic Capital Delivery Group (SCDG) Terms of Reference. Report title Summary Financial monitoring - savings February 2025 This report provides an update on the achievement of the three-year financial savings targets and progress. Aligned Priority: • Improve North Lanarkshire's resource base. Ambition statement: 21. Continue to identify and access opportunities to leverage additional resources to support our ambitions. Consistent • This regular report ensures ongoing oversight by Elected Members of the Finance and Resources Committee in terms of the progress in implementing savings. Transparent • This report provides the Committee with an update on the achievement of the three-year financial savings total of £28.778m approved as part of the 2024/25 budget setting process and advises it is projected that 93% of the 2024/25 savings will be delivered within the financial year, with replacement savings identified to fully address the shortfall. In addition, it is currently anticipated that there will be no recurring savings gap arising from the 2024/25 to 2026/27 approved savings. Page 25 of 144
Page 26
In context • The report presents the up-to-date savings position within the context of the overall budget position for the council. Balanced • Each service report sets out the context for savings in that services are required to monitor the delivery of their target savings to ensure they remain within their approved budgets and provide periodic progress updates within individual service revenue monitoring reports, identifying alternative solutions to any in-year shortfall envisaged. In addition, services are required to monitor whether the original approved saving has been implemented and if not, provide an explanation along with alternative action required to ensure the recurring financial saving will be achieved going forward. This information is captured by Finance and summarised in the overall council report. Key to RAG status green Performance is on target and/or within acceptable thresholds red Performance does not meet target and is outwith acceptable thresholds blue Performance surpasses the target and exceeds expectations Page 26 of 144
Page 27
North Lanarkshire Council Report Audit & Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/ASP/ALMay25 Date 08/05/25 Audit and risk related items: Action log From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Telephone 07887 914207 Francis Scott Chief Officer (Audit and Risk) Executive Summary The purpose of this report is to allow elected members to track implementation of outstanding requests and recommendations made by the Panel in respect of audit and risk- related items. The attached log (at Appendix 1) records those audit and risk-related requests and recommendations made by the Panel and when these were addressed and/or are expected to be addressed. Any actions that have previously been reported as complete and noted by the Panel have been removed from the log. Recommendations The Panel is invited to note the report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 3 Page 27 of 144
Page 28
Appendix 1 Audit and Risk related items: Outstanding action log Date Requests or agreed action Status October 2024 1. Request that Internal Audit incorporate a 6 monthly tracking report of progress in implementing actions agreed in response to External Audit recommendations. Complete – the 6-monthly update is incorporated in the Follow-up of Implementation of Audit Recommendations report, included in this agenda pack. September 2023 2. Request a further report be brought back by management to a future meeting on progress implementing outstanding actions identified by Internal Audit follow-up work in relation to the implementation of quality assurance processes to monitor compliance with Project Management framework. Complete – the final audit report for Project Management Quality Assurance Processes is included in this agenda pack. May 2023 3. Request a further report be brought back by management to a future meeting on outstanding actions identified by Internal Audit follow-up work in relation to managing strategic change. In progress – implementation of this action has been tracked though Internal Audit’s follow-up procedures. The most recent assessment is that these management actions are now complete. The 2024-25 Internal Audit Plan includes an audit of the Council’s recently revised governance arrangements for the Programme of Work to 2028. Planning for this audit is now underway, but the detailed work will be carried forward into the 2025-26 annual plan with the results reported to a future meeting of the Panel. 4. Request a further report be brought back by management to a future meeting on outstanding actions identified by Internal Audit follow-up work in relation to Employee Service Centre – key controls. In progress – People Resources has now completed a review of the issues identified and a report has been prepared for presentation to BMT in May. Once approved by BMT, the action will be marked as complete. Further longer-term action is required to address these issues, and this will be managed and monitored through the People Resources service risk register. Page 28 of 144
Page 29
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/ASP/PRMay25 Date 08/05/25 Internal Audit: Progress Report From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Telephone 07787 914207 Executive Summary The purpose of this report is to provide an overview of Internal Audit activity and audit reports issued since the last update to the Panel in February 2025, namely: • Project Management Quality Assurance • Performance Management – Community Operations • Non-Domestic Rates – Reliefs and Refunds • UK Shared Prosperity Fund • Business Continuity Planning • Housing and Corporate Property Maintenance and Improvement Services Contract This report will also advise on the progress with the 2024-25 Internal Audit plan and provide an update on performance management. Recommendations The Panel is invited to: (a) note the content of the Internal Audit reports together with the associated management responses. (b) consider whether there are any issues raised by Internal Audit which the Panel consider are sufficiently significant to require a further report from management to be submitted to a future meeting of the Panel. (c) request that Internal Audit report to future meetings of the Panel on the progress in implementing agreed management actions categorised as ‘High’ or ‘Medium’ priority, and (d) otherwise note this report. Item 4 Page 29 of 144
Page 30
1. Background 1.1 The 2024-25 Internal Audit Plan was approved by the Audit and Scrutiny Panel in May 2024. The Internal Audit Charter requires that Internal Audit Progress Reports are presented to each meeting of the Panel, providing an update on the progress against the Internal Audit Plan and any other Internal Audit activity. This report fulfils that requirement. 2. Report Audit reviews completed in the period 2.1 The audit reports summarised below were included in the 2024-25 Internal Audit Plan and have been completed since the last meeting of the Panel in February 2025. While the reports noted contain recommendations for improvement, all have been assessed as providing positive levels of assurance. Management have responded positively to these reports and satisfactory responses and commitments to audit recommendations have been received. 2.2 Appendix 1 provides detailed definitions of the priorities assigned to audit recommendations, and the factors considered when determining the level of assurance provided in the audit opinion. Full copies of these audit reports have been included in the meeting paper in line with the approved reporting protocol. Project Management Quality Assurance Internal Audit Opinion Reasonable assurance Recommendations High 0 Medium 1 Low 1 2.3 The purpose of this audit was to determine the progress with the Council’s approach to reviewing Services’ compliance with the Council’s Project Management Framework, and to provide assurance on the adequacy and effectiveness of these arrangements. Based on the results of our audit work, we are satisfied that a quality assurance process, covering the relevant requirements of the Project Management Framework, has been developed and is operating in line with the Council’s expectations. Issues arising from the compliance assessments have been translated into improvement plans for each Chief Officer and an annual report, outlining the findings and outcomes of the compliance review, is submitted to the Audit and Scrutiny Panel. We have identified one area where we consider there is scope for improvement, relating to the need to consolidate all aspects of the quality assurance process into a single formal document. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Page 30 of 144
Page 31
Performance Management – Community Operations Internal Audit Opinion Reasonable assurance Recommendations High 1 Medium 1 Low 0 2.4 An audit of the Council’s strategic performance management arrangements in 2023- 2024 identified that, while arrangements were generally satisfactory, there was a need for future audit work to be focussed on compliance within individual Services. The purpose of this audit was therefore, to provide assurance on the adequacy and effectiveness of the performance management and reporting arrangements within Community Operations. 2.5 Based on the results of our audit work, we are generally satisfied that the Service has identified performance indicators (PIs) which are SMART (specific, measurable, achievable, realistic and timely), all PIs reviewed have an indicator definition sheet and performance is a standing agenda item at Senior Management Team meetings. However, our work identified two areas for improvement relating to: • A need to significantly improve compliance with corporate processes and procedures in relation to the description, calculation and recording of PIs. • Improvements in the arrangements for reporting performance information to senior management and elected members. Non-Domestic Rates – Reliefs and Refunds Internal Audit Opinion Substantial assurance Recommendations High 0 Medium 0 Low 2 2.6 This was a high-level review to provide assurance on the adequacy and effectiveness of the Council’s management arrangements and key controls in relation to reliefs and refunds of Non-Domestic Rates (NDR). Based on the results of our work, we are generally satisfied that the control framework and management arrangements in relation to core NDR processes are adequate and operating effectively, with well established procedures in place to ensure that changes in statutory regulations are promptly and accurately updated in the NDR system. We were pleased to note that reliefs, discounts and refunds were accurately recorded, correctly calculated, appropriately authorised and supported by appropriate documentation, with updated demand notices being issued promptly. UK Shared Prosperity Fund Internal Audit Opinion Substantial assurance Recommendations High 0 Medium 0 Low 1 2.7 This audit focussed on the overall governance arrangements in place to ensure UK SPF projects are being appropriately progressed in line with Council’s UK SPF Assurance Framework and that key risks are being effectively managed. We are satisfied that the control environment for the UKSPF is operating as intended and that the Assurance Framework is generally being adhered to. We were pleased to note that there is effective governance and oversight which is being provided by the Project Board and supporting Project Working Group through regular reporting of progress, risk, finance and outputs and outcomes on individual projects. Additionally, clear deliverables, which align with the UKSPF investment priorities and interventions, have Page 31 of 144
Page 32
been identified for each project with budgets and performance being managed by project officers. Business Continuity Planning Internal Audit Opinion Reasonable assurance Recommendations High 0 Medium 3 Low 1 2.8 This was a high-level review designed to provide assurance on the adequacy and effectiveness of actions taken by management in response to previous audit recommendations in relation to business continuity planning. We were pleased to note that significant work has been undertaken by the Resilience Planning Unit with regards to business continuity planning which has resulted in a marked improvement in documenting business continuity arrangements for individual Services, and we are generally satisfied that the Council has reviewed and strengthened the control environment for documenting, reviewing and testing business continuity arrangements. 2.9 We have identified some areas for improvement, which include: • Processes around critical activities and workarounds for business continuity planning need to be strengthened, with guidance reviewed, updated, and communicated to Services. • There is merit in Service business continuity arrangements being subject to critical appraisal and challenge. • Plans for alignment of business continuity and disaster recovery plans need to be progressed, finalised and implemented. Housing and Corporate Property Maintenance and Improvement Services Contract 2.10 In 2024, two significant audit reports relating to housing repairs were issued, namely “Enterprise Project: Housing and Corporate Procurement” and “Audit Scotland Whistleblowing Allegations – Mears Housing and Property Maintenance Contract”, and both reports contained a number of high priority recommendations. The purpose of this review was to track the progress of the recommendations made in these reports, including the robustness of the action taken. 2.11 Based on the results of our work, we were pleased to note that significant progress has been made in implementing the recommendations contained in both reports, with some aspects (including those relating to the Intelligent Client Function, contract management, performance management and the Mobilisation Plan) where we consider that interim or essential elements have now been fully implemented. However, as the Housing Contract only commenced in July 2024 and is still within the first year of operation, there remains a number of areas where more advanced and fully established arrangements have not yet been finalised and require further development to ensure that they are properly embedded. 2.12 Further audit work on the ongoing operation of the housing contract has been included in the Internal Audit Plan for 2025-26. Page 32 of 144
Page 33
Performance Management 2.13 In line with Internal Audit performance management framework, two performance indicators are subject to quarterly reporting to the Panel. 2.14 The first indicator is the implementation of agreed actions arising from Internal Audit reports by the implementation date. In the period to March 2025, 54% of agreed actions have been implemented by the implementation date (the previous update for the period to December 2024 had a 57% completion rate). 2.15 The second performance indicator measures client satisfaction. The results received in the period continue to show positive feedback on the work of Internal Audit, with 100% of respondents agreeing that Internal Audit added value by assisting in providing assurance, and that reports were relevant and constructive with findings clearly and accurately communicated. Appendix 2 provides a summary of the questions we ask audit clients at the conclusion of each audit. 3. Measures of success 3.1 Internal Audit reports annually on its performance to the Panel and is also subject to review annually by the Council’s appointed external auditors. 4. Supporting documentation Appendix 1 Audit Grading Definitions Appendix 2 Internal Audit Client Feedback Results Francis Scott, Chief Officer (Audit and Risk) Page 33 of 144
Page 34
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ Page 34 of 144
Page 35
If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective responses by management to the weaknesses, control issues and/or areas of improvement identified by Internal Audit will increase the likelihood of the Council achieving its ambitions by improving control frameworks and more effectively mitigating potential risks and threats to the achievement of planned outcomes. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact and the provision that has been made to ensure there has been appropriate consideration of the relevant Articles from the United Nations Convention on the Rights of the Child (UNCRC). If Yes, has a Children’s Rights and Wellbeing Impact Assessment (CRWIA) been carried out? Yes ☐ No ☐ Page 35 of 144
Page 36
Appendix 1 Audit Grading Definitions Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Substantial Assurance There are minimal or minor control weaknesses that present low risk to the control environment. The control environment has substantially operated as intended although some minor errors have been detected. Very few or no improvements are needed. Reasonable Assurance There are some control weaknesses that present a low to medium risk to the control environment. The control environment has mainly operated as intended although errors have been detected. Some improvements should be made. Limited Assurance There are significant control weaknesses that present medium to high risk to the control environment. The control environment has not operated as intended. Significant errors have been detected. Substantial improvements should be made. No Assurance There are fundamental control weaknesses that present an unacceptable level of risk to the control environment. The control environment has fundamentally broken down and is open to significant error or abuse. Immediate and major changes need to be made. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant, but it is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action were taken. Prompt action is required Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 36 of 144
Page 37
Appendix 2 Internal Audit Client Feedback Results Responses received in this period from 13 clients related to assignments reported to the Panel (note these responses primarily relate to audit assignments reported in the Internal Audit Progress Reports presented to the August and October 2024 and February and May 2025 meetings of the Panel). Question Strongly Agree or Agree (%) Neither Agree nor Disagree (%) 1. Internal Audit added value to my area by assisting in providing assurance and/or identifying weaknesses and/or improvements in relevant governance/business process and internal controls 100% 0% 2. Internal Audit findings were accurate and clearly communicated 100% 0% 3. The audit report made relevant, constructive and practical recommendations to help improve operations 100% 0% 4. Internal Audit staff were professional and courteous throughout the audit process 93% 7% Where management raise concerns over Internal Audit’s work, these matters are discussed with relevant senior management to fully understand the nature of any concerns and, where it is considered appropriate, to identify areas for improvement. We also seek Services’ views on what they liked or disliked about the audit process and comments received are used to inform future action plans for improving the service provided by Internal Audit. Page 37 of 144
Page 38
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 1 INTERNAL AUDIT REPORT PROJECT MANAGEMENT QUALITY ASSURANCE Headlines The purpose of this audit was to determine the progress made in developing and implementing the Council’s approach to reviewing Services’ compliance with the Council’s Project Management Framework, and to provide assurance on the adequacy and effectiveness of these arrangements. The refreshed Project Management Framework was launched in December 2022 to ensure that investment is well-directed, delivered to time, cost and quality targets, and provides the expected benefits and improved outcomes locally. Quality assurance arrangements for compliance with the Project Management Framework were approved by the Corporate Management Team (CMT) in October 2023, and an update on the implementation and outputs from the quality assurance process was reported to the Business Management Team (BMT) in March 2024. The quality assurance arrangements are still being developed and a baseline review, in the form of a self-assessment completed by each Project Manager, has been undertaken for all live projects as at September 2023 (with the exception of the new supply programme, housing property and corporate assets/hubs where only a sample were assessed), followed by a quality assurance compliance assessment. The outcome of this assessment and the extent of any further assurance work is determined on an individual project basis. Whilst good progress has been made, there are some aspects of the proposed quality assurance framework which have not yet been fully implemented (e.g. check-in and deep dive reviews) and therefore, still require to be embedded into the process. Based on the results of our audit work, we have categorised this audit as offering reasonable assurance. We are satisfied that a quality assurance process covering the relevant requirements of the Project Management Framework, has been developed and is operating in line with the Council’s expectations. Issues arising from the compliance assessments have been translated into improvement plans for each Chief Officer and an annual report, outlining the findings and outcomes of the compliance review, is submitted to the Audit and Scrutiny Panel. We have, however, identified one area where we consider there is scope for improvement, relating to the need to consolidate all aspects of the quality assurance process into a single formal document. Internal Audit Opinion Reasonable assurance Priority of Recommendations High Medium Low 0 1 1 Organisational Impact Minor Report status FINAL Audit ref 0900/2025/004 Date issued 27/03/25 Audit Team Euan Campbell and Lesley Armstrong Issued To Chief Officer (Strategy and Engagement) Copied To Business Strategy Manager, Strategy and Performance Manager, Chief Executive and Deputy Chief Executive Page 38 of 144
Page 39
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 2 1. Executive Summary Objectives This review sought to answer the following questions: • Has the Council developed a quality assurance process to assess the extent to which Services/projects are complying with the Project Management Framework, and does it cover all relevant aspects of the Framework? • Are these quality assurance arrangements being operated in line with expectations? • Is there clear evidence that Service/project management takes timely and appropriate action where quality assurance arrangements highlight areas of potential concern? • Is there periodic reporting to key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes? This engagement has been conducted in accordance with the Public Sector Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their co-operation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • Quality assurance arrangements for assessing compliance with the Council’s Project Management Framework have been established and approved by the CMT. • A self-assessment questionnaire, which aligns with the lifecycle of a project, is completed by the Project Manager to establish baseline information. There is a requirement to submit mandatory project documentation to demonstrate compliance with the Project Management Framework and support the answers provided in the self-assessment. • The Strategy and Performance team undertake a review on the self-assessment submissions and allocate a status dependent upon the level of compliance with the Project Management Framework. • Areas for improvement have been identified and translated into Chief Officer improvement plans. • An annual report is presented to the Audit and Scrutiny Panel to provide them with the relevant assurances in respect of independent reviews on Services’ compliance with the Project Management Framework. Key areas requiring management action (High Priority) No areas requiring urgent management action were identified. Other areas for improvement (Medium Priority) One other area for improvement was identified: • There is a need to consolidate all aspects of the Council’s quality assurance process for assessing compliance with the Project Management Framework into a single formal document. Page 39 of 144
Page 40
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 3 3. Action Plan Project Management Quality Assurance 0900/2025/004 Ref Finding 1 There is a need to consolidate all aspects of the Council’s quality assurance process for assessing compliance with the Project Management Framework into a single formal document. Reports presented to CMT in October 2023 and BMT in March 2024 provided an overview of the quality assurance arrangements for assessing compliance with the Project Management Framework, including an outline of the four types of reviews that support the process, the self-assessment process to establish the baseline review and coverage of projects within each Service for the initial baseline review. Whilst this provides a good basis for outlining the quality assurance process, we consider that the existing detailed arrangements and expected practices should be consolidated into a single formal document and further expanded to include other areas of the process, including: • Once new projects have been identified by Services and included on project registers, how these will be considered for inclusion in the quality assurance process and the requirement to undertake baseline reviews. • A mechanism to track the ongoing status of projects to facilitate identification of the next quality assurance processes required, as appropriate. • The process for undertaking compliance assessments on baseline reviews, including the criteria used for assessing and allocating a RAG status. • More detailed information on the purpose and content of check-in, deep dive and senior management reviews, how the need for these reviews will be determined and how the rationale for such decisions will be recorded. • The process for identification of potential areas of concern for inclusion in improvement plans and for tracking progress against the actions contained in these plans. • The arrangements for reporting the outcome of the quality assurance process to senior management and elected members. • A description of any lessons learned process established to ensure continuous improvement. Consideration should also be given as to whether, and to what extent, checks will be undertaken on assessing the quality of the documentation provided to support the baseline self-assessment. Implication Recommendation Priority Management response Implementation Date Without clear procedures/ guidance, staff may not be fully aware of expected practices, and the quality assurance process and associated principles may not be applied consistently across Chief Officers’ remits and individual projects. The Chief Officer (Business and Digital) should ensure that the existing detailed quality assurance arrangements and expected practices for assessing compliance with the Project Management Framework are consolidated into a single formal document and expanded to include other areas of the process as outlined in the finding above. Medium Agree Stephen Penman, Chief Officer (Strategy and Engagement) Processes already in place will be consolidated into a single document to further support the council’s approach and rolling review programme to ensuring ongoing oversight, evaluation, and scrutiny in terms of quality assurance in line with the Project Management Framework and in relation to the governance and delivery of council projects on Chief Officer registers. Work is already underway in respect of lessons learned as this approach requires to be wider than the quality assurance arrangements in order to capture lessons learned in respect of delivery of projects in line with each project’s life cycle, as set out in the council’s Project Management Framework. December 2025 April 2026 Page 40 of 144
Page 41
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 4 3. Action Plan (continued) Project Management Quality Assurance 0900/2025/004 Ref Finding 2 The process for monitoring and tracking improvement actions needs to be fully implemented. The findings and issues arising from the baseline reviews of individual projects have been translated into high-level improvement actions, with an improvement plan prepared for each Chief Officer. We were advised by the Strategy and Performance team that these action plans have been established and have either been agreed, or are in the process of being agreed. We understand that the intention is that the Strategy and Performance team will track these improvement plans and discuss progress with Chief Officers on a quarterly basis, updating the status of individual improvement actions as appropriate. From our review of the improvement plans, we were pleased to note that they contained sufficient information to facilitate proper monitoring of the improvement actions, including responsible lead officers, target completion dates, measures of success and outcomes. The plans also include a column for monitoring progress. We consider, however, that the improvement plans could be further enhanced by including a column stating the progress of each action and recording the ‘as at’ status date to clearly indicate when the plan was last updated. Implication Recommendation Priority Management response Implementation Date If improvement plans are not appropriately tracked and monitored, it may be difficult to clearly demonstrate progress and improvement which could have an adverse effect on compliance with the Project Management Framework. The Chief Officer (Business and Digital) should ensure that: • all improvement plans are appropriately and regularly tracked and monitored, in line with the rolling review programme; and • improvement plans are updated to include the ‘as at’ status date to indicate when they were last updated and a column stating the progress of each action. Low Agree Stephen Penman, Chief Officer (Strategy and Engagement) Chief Officer improvement plans have been established and the implementation of these is underway through day-to-day business as usual arrangements that are already in place to maintain, track, and monitor these plans on an ongoing basis. As the review programme for the quality assurance arrangements is a rolling programme, the ensuing improvement plans will remain as live plans that are reviewed and updated on a regular basis. While these plans are already established with improvement actions in the process of being implemented and monitoring underway, the date of December 2025 has been applied to this audit recommendation to allow for an annual check in to ensure the improvement plans and supporting monitoring processes remain fit for purpose. The improvement plans have been updated to include the “as at” status date as well as a “status column” as noted in the recommendation. December 2025 Complete Page 41 of 144
Page 42
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 5 INTERNAL AUDIT REPORT PERFORMANCE MANAGEMENT – COMMUNITY OPERATIONS Headlines The Council’s strategic performance management arrangements were reviewed during 2023-2024, with the audit report concluding that the arrangements were generally satisfactory, with regular and meaningful reports being submitted to Committee in line with the performance reporting schedule. The report recognised, however, a need for future audit work on performance, focussing on the arrangements within individual Services to determine the level of compliance with corporate processes and procedures and understanding of performance requirements. The purpose of this audit was therefore, to provide assurance on the adequacy and effectiveness of the arrangements within one Service, Community Operations, for ensuring compliance with the Council’s performance management and performance reporting processes and procedures. Based on the results of our audit work, we have assessed this audit as offering reasonable assurance. We are generally satisfied that the Service has identified performance indicators (PIs) which are SMART (specific, measurable, achievable, realistic and timely), all PIs reviewed have an indicator definition sheet and performance is a standing item at Senior Management Team (SMT) meetings. We have, however, identified some areas for improvement, which are detailed at Section 3 of this report and include: • There is a need to significantly improve compliance with corporate processes and procedures in relation to the description, calculation and recording of PIs. • Arrangements for reporting performance information to senior management and elected members could be improved. Internal Audit Opinion Reasonable assurance Priority of Recommendations High Medium Low 1 1 0 Organisational Impact Moderate Report status FINAL Audit ref 0800/2025/001 Date issued 31/03/25 Audit Team Jacquie Howden and Lesley Armstrong Issued To Chief Officer (Community Operations) and Service Delivery Manager (Performance and Compliance) Copied To Chief Executive and Deputy Chief Executive Page 42 of 144
Page 43
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 6 1. Executive Summary Objectives This review sought to answer the following questions: • Is reported data accurately described, reporting what it purports to and consistently, accurately and robustly calculated? • Has performance data been accurately and timely reported to senior management and elected members and do reports highlight areas of good performance and/or areas requiring improvement, together with any remedial action required to bring performance back on track? Work undertaken involved discussions with relevant staff as well as substantive testing on a sample of 10 PIs selected from the Strategic Performance Framework (SPF), which fall within the remit of the Chief Officer (Community Operations) (see Appendix 2 for details of the indicators reviewed). This engagement has been conducted in accordance with the Public Sector Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • The Service’s PIs are generally SMART (specific, measurable, achievable, relevant and timely). • In line with corporate processes, all PIs reviewed have a performance definition sheet and nominated Calculating Officer and Verification Officer. • Performance is a standing agenda item at Senior Management Team (SMT) meetings and discussions revolve around indicators with a ‘red’ RAG status (i.e. not meeting targets). Key areas requiring management action (High Priority) One key area requiring urgent management action was identified: • There is a need to significantly improve compliance with corporate processes and procedures in relation to the description, calculation and recording of PIs. Other areas for improvement (Medium Priority) One other area for improvement was identified: • Arrangements for reporting performance information to senior management and elected members could be improved. Page 43 of 144
Page 44
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 7 4. Action Plan Performance Management – Community Operations 0800/2025/001 Ref Finding 1 There is a need to significantly improve compliance with corporate processes and procedures in relation to the description, calculation and recording of PIs. As part of the Council’s corporate performance arrangements, there is a requirement for Services to nominate a Calculating Officer and a Verification Officer for each PI. These officers are responsible for ensuring that all PIs have a fully completed and comprehensive PI definition sheet; are SMART (i.e. specific, measurable, achievable, realistic and timely); have been subject to the year-end verification process; and have been calculated accurately in line with the description and supporting documentation. We selected a sample of 10 PIs for Community Operations (see Appendix 2) and reviewed the indicator definition sheets, source documentation and methodology used to ensure that the reported indicators were accurately described and had been consistently, accurately and robustly calculated. For the sample reviewed, we identified a number of areas where we consider that there is scope for improvement: • Indicator definition sheets not being fully or comprehensively completed in line with the corporate guidelines (with some sections being omitted or not containing sufficiently detailed information), not clearly stating the required information for the indicator (including how the indicator is measured, data sources and worked examples) and/or not being signed as reviewed by the Verification Officer. • A lack of documented procedures detailing how PIs should be calculated and thereafter reported. • Indicators not being consistently and accurately calculated and reported in line with the indicator description, definition sheet and supporting documentation. • Delays in updating the performance spreadsheet to reflect the latest quarterly and/or annual performance figures, with the quarterly figures for some indicators not having been updated for the current year. • Year-end forms not being completed and/or signed by both the Calculating Officer and Verification Officer. • Targets and tolerances not being reviewed on a regular basis, despite the indicators not achieving the related targets for a number of years. • Calculating Officers, who despite having prepared PIs for several years and having access to the corporate year-end guidance, advising that they are unaware of their role and responsibilities. Implication Recommendation Priority Management response Implementation Date A lack of properly detailed guidance for individual PIs could lead to indicators being measured inconsistently each period, making it difficult to determine whether performance has improved or worsened. If Calculating Officers and Verification Officers are not fully aware of their responsibilities, performance information may be of poor quality and/or not prepared or reported on a timely basis. The Chief Officer (Community Operations) should: (1) Undertake a review of all of the Service’s PIs within the SPF to determine whether the corporate processes and procedures are being fully complied with and each indicator is accurately described, consistently and robustly calculated and accurately recorded. In particular, the review should consider the issues identified in the finding above. (2) Ensure that all individuals assigned the role of Calculating Officer or Verification Officer are made aware of their responsibilities in relation to the reporting of PIs, both throughout the year and at the year-end. High Agree Lynn Oneil, Service Delivery Manager (Performance & Compliance) (1) A full review will be undertaken of all the Services PIs to ensure all corporate processes are being fully complied with. (2) All Calculating/ Verification Officers will be provided with a guidance note to reiterate their responsibilities in relation to the reporting of PIs throughout the year and year end. December 2025 July 2025 Page 44 of 144
Page 45
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 8 4. Action Plan (continued) Performance Management – Community Operations 0800/2025/001 Ref Finding 2 Arrangements for reporting performance information to senior management and elected members could be improved. The SPF is supported by an annual Performance Reporting Schedule, which was last approved by the Corporate Management Team (CMT) in February 2024 and sets out the requirement for Chief Officers to report their performance portfolios to the relevant Service Committee on a six-monthly basis (or annually for annual indicators). Despite the PIs for Community Operations being both quarterly and annual, the latest performance report to the Environmental and Climate Committee was in May 2024, which provided an update on the annual position for 2023/24. In line with the reporting schedule, we would have expected a further performance report to have been presented to Committee in cycle 4 of 2024, however, this did not happen. Our review included PIs relating to Active and Creative Communities (ACC), which was previously part of CultureNL but was brought back into the Council in March 2021 as part of Education and Families and thereafter transferred to Community Operations in January 2024. We noted that no reports in relation to performance of ACC have been submitted to Committee since returning to the Council in March 2021. We were advised that the delays in reporting performance to Committee were initially due to the Chief Officer (Education South) planning to make changes to some of the reported PIs and thereafter, due to the sensitivities around Committee reports on the potential closures of facilities and the move of the function to Community Operations. We were advised that Community Operations has now committed to producing performance reports to Committee in line with the reporting schedule and is working with Strategy and Performance to achieve this. From our review of the minutes for the Community Operations Senior Management Team (SMT), we noted that performance is a standing item on the agenda and that PIs which have been allocated a ‘red’ RAG status (i.e. not meeting targets) are routinely discussed. However, given that the performance spreadsheets were not always up to date and there is no separate report prepared which details the latest figures for all PIs for the Service, there is no clear basis for senior management to determine which indicators require to be discussed at these meetings. Discussions, therefore, rely on senior officers highlighting indicators which fall into this category. Implication Recommendation Priority Management response Implementation Date Elected members and senior management may not be made aware of current performance levels and therefore, may be unable to make decisions and/or take appropriate action to address areas of underperformance in a timely manner. The Chief Officer (Community Operations) should ensure that: (1) All PIs included in the SPF are presented to the relevant Service Committees in accordance with the Performance Reporting Schedule. (2) Arrangements are put in place to clearly identify any PIs with a ‘red’ RAG status prior to each SMT meeting to ensure that they are discussed at the meeting. This may involve ensuring that the performance spreadsheet is up to date and issued to all officers prior to the meeting, thus enabling it to be used as the basis for discussion. Medium Agree Lyall Rennie, Chief Officer (Community Operations) (1) The Service will ensure all PIs included in the SPF are presented to the relevant service committee in line with the reporting schedule. (2) The performance spreadsheet will be issued to each of the senior managers prior to SMT meetings to allow time to review and will be used to facilitate discussions on performance at these meetings. July 2025 Page 45 of 144
Page 46
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 9 Appendix 2 – Performance Indicators Reviewed Sample Service Area Indicator 1 Protective Services Pest control requests – high priority - % of visits made within 2 working days 2 Protective Services Trading Standards – number of outcomes which have safeguarded the health and wellbeing of consumers (see note 1) 3 Protective Services Private Sector housing regulation and enforcement - % responses to requests for assistance or advice within 5 working days of receipt 4 Roads and Assets Roads network - % of all roads that should be considered for maintenance treatment 5 Greenspace and Country Parks Country Parks - % operating expenditure met from income 6 Fleet NLC fleet vehicles - % presented for plating/MOT pass first time (new indicator for 2024/25) 7 Active and Creative Communities Library services – number of users as a percentage of the population 8 Active and Creative Communities Museums – number of people engaging in museum learning experiences 9 Active and Creative Communities Community Arts – number of customers engaging in activities 10 Active and Creative Communities Events – number of attendances at council venues Note 1 – this performance indicator is currently being piloted and has therefore not yet been agreed and implemented. Page 46 of 144
Page 47
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 10 INTERNAL AUDIT REPORT NON-DOMESTIC RATES – RELIEFS AND REFUNDS Headlines This was a high-level review to provide assurance on the adequacy and effectiveness of the Council’s management arrangements and key controls in relation to reliefs and refunds of Non-Domestic Rates (NDR). NDR is a tax on the occupation of non-domestic property, lands and heritage entered onto the valuation roll by the local Assessor, who determines the rateable value for each property. The basic rates charge, which is set by the Scottish Government, is calculated by multiplying the rates poundage by the rateable value. Ratepayers can apply for an exemption or relief on their NDR liability and Scottish legislation outlines the requirements for applying these to NDR accounts. Based on the results of our work, we have categorised this audit as offering substantial assurance. We are generally satisfied that the control framework and management arrangements in relation to core NDR processes are adequate and operating effectively, with well established procedures in place to ensure that changes in statutory regulations are promptly and accurately updated in the NDR system. We were pleased to note that reliefs, discounts and refunds were accurately recorded, correctly calculated, appropriately authorised and supported by appropriate documentation, with updated demand notices being issued promptly. Some minor areas for improvement have been identified for management consideration and these are detailed in the action plan at section 3 of this report. Internal Audit Opinion Substantial assurance Priority of Recommendations High Medium Low 0 0 2 Organisational Impact Minor Report status FINAL Audit ref 0200/2025/002 Date issued 31/03/25 Audit Team Elaine MacDonald and Lesley Armstrong Issued To Chief Officer (Finance) and Business Finance Manager (Resources) Copied To Chief Executive and Deputy Chief Executive Page 47 of 144
Page 48
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 11 1. Executive Summary Objectives The audit sought to answer the following questions: • Has there been any legislative changes since the previous audit in 2021-22 and have these been appropriately applied and operating effectively? • Have reliefs/discounts applied to individual accounts been properly assessed, calculated and processed, and has the ratepayer been promptly notified of any changes to liability? • Are there appropriate controls in place to ensure that refunds are correctly calculated, properly recorded, appropriately authorised and only processed on accounts with credit balances? Our review included both compliance testing on key controls and system parameters as well as substantive testing on a sample of reliefs awarded and refunds paid during the period April to October 2024. This engagement has been conducted in accordance with the Public Sector Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • There are well established processes in place for ensuring that changes in statutory requirements are accurately and timely updated in the NDR system. • Access to amend NDR system parameters is appropriately restricted to authorised staff within the Business Development and Performance (BDP) team and the Revenues team. • Reliefs and exemptions are supported by completed applications and evidence of eligibility, where applicable, and are processed in line with legislation/rates set by the Scottish Government. • Second officer checks are undertaken monthly on a random sample of changes made to liability, payment methods and general mail items to ensure that the action taken is appropriate and is supported by sufficient documentary evidence. • The BDP team have a rolling programme for reviewing reliefs and exemptions at least every three years to ensure ratepayers’ continued entitlement to the relief/exemption. Failure to return completed review forms results in prompt cancellation of the relief/exemption. • All ratepayer accounts marked as being due a refund are independently checked to ensure that they are accurate and properly due, prior to being passed to the Creditors team for processing. Details of the refund feeder are notified to the Creditors team by an authorised signatory. Key areas requiring management action (High Priority) No areas requiring urgent management action have been identified. Other areas for improvement (Medium Priority) No other areas for improvement have been identified. Page 48 of 144
Page 49
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 12 5. Action Plan Non-Domestic Rates – Reliefs and Refunds 0200/2025/002 Ref Finding 1 Arrangements for second officer checks should be reviewed to enhance their effectiveness. Monthly second officer checks are undertaken on a random sample of 40 items of correspondence selected from Workflow to ensure that action taken is appropriate and supported by sufficient documentary evidence. Details of the account reference, processing officer, date processed and type of correspondence, together with the outcome of the checks, any errors and the action taken are recorded on the NDR Audit spreadsheet. Our review of this spreadsheet confirmed that it is generally fully completed and indicates a high level of processing accuracy, with errors only occasionally identified. However, we noted a small number of areas for improvement as follows: • Second officer checks are undertaken by a single officer, however, despite this officer undertaking some processing activities, no independent checks are undertaken on their work. • There were some instances where the ‘action taken’ narrative did not always provide sufficient information on the issue arising, action taken and/or whether the issue had been resolved. Implication Recommendation Priority Management response Implementation Date Reliefs/exemptions may be applied to ratepayers’ accounts at the incorrect rate, for the incorrect period or in error, which could result in the charge due for payment being incorrectly calculated. The Chief Officer (Finance) should consider: (1) Whether independent checks should be undertaken on a sample of activities processed by the officer who generally undertakes second officer checks and thereafter, build such checks into the checking process. (2) Reviewing and updating the spreadsheet for recording second officer checks to provide more detailed information on issues arising, action taken and whether the issue identified has been resolved. Low Agree Paula Hendry, Business Finance Manager (Resources, Revenues and Benefits) (1) The officer assigned to undertake second officer checks works part-time and predominantly undertakes this task across the various Revenues workstreams rather than a processing one. However, as there are occasions when this officer may be involved in processing, a report from Workflow will be run each quarter to determine the level of processing activity and if sufficient activity is recorded, a Team Leader will undertake a 10% random sample check. Details of checks and outcome will be recorded on a spreadsheet. (2) The spreadsheet for recording second officer checks has been reviewed and updated to include additional columns to more clearly record the issue arising, action taken and outcome. June 2025 March 2025 Page 49 of 144
Page 50
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 13 3. Action Plan (continued) Non-Domestic Rates – Reliefs and Refunds 0200/2025/002 Ref Finding 2 A small number of issues and/or areas for improvement in respect of reviews of reliefs/exemptions and refunds were identified. The Service processes applications for reliefs and exemptions to ratepayers’ accounts in line with legislation and is responsible for undertaking reviews of these reliefs and exemptions to ensure that they remain valid. The BDP team are responsible for initiating reviews of reliefs/exemptions and has a rolling programme in place to ensure that these reviews are undertaken periodically, and that where no response is received, first reminders are issued four weeks after the review form and cancellation reminders are issued after a further four weeks. From our review of a sample of reliefs and exemptions, we noted that reminders are not always issued timeously in line with the timetable, with some reminders not being issued until between 31 and 54 days after the initial review form/first reminder. We also noted that ratepayers in receipt of only mandatory charity relief were not included in the most recent review of mandatory relief. We were advised that this was an oversight as the review for mandatory and discretionary relief had been undertaken as a single exercise and ratepayers with only mandatory relief had been omitted. The Service has confirmed that this only included four NDR accounts and that review forms have now been issued to the appropriate ratepayers. The Service also issues refunds on ratepayers’ accounts where there is a credit balance. All refunds are paid through the Creditors system (efinancials) and therefore require to be allocated to a creditors’ reference to enable payment. Our review of a sample of refunds identified one refund (£116.65) where, despite receiving a written instruction from the company acting on behalf of the ratepayer, providing the bank details to which the refund should be paid, the payment was made by cheque and allocated to the incorrect creditors reference. Although the cheque was made in the name of the ratepayer, it was sent to the wrong address, which was for a previous rates agent. We were informed by the Revenues team that this was an error on their part and that the cheque was not cashed and is in the process of being cancelled, with a new refund being raised. Implication Recommendation Priority Management response Implementation Date Reliefs/exemptions may continue to be applied to ratepayers’ accounts when they are no longer entitled, which could result in the charge due for payment being incorrectly calculated. Refunds may be paid to the wrong ratepayer and it may be difficult to recoup any such monies paid in error. The Chief Officer (Finance) should: (1) Review the process and rolling programme for undertaking reviews of reliefs/exemptions to: • determine whether the current period for issuing reminders is appropriate and thereafter, ensure that reminders are issued timeously, in line with the review programme; and • ensure that all ratepayers’ accounts in receipt of a relief/ exemption are subject to a review on a periodic basis. (2) Remind staff within the Revenues team of the importance of ensuring that, prior to processing refunds, the correct creditors reference and bank account details, in line with the ratepayer’s request, are selected for payment. Low Agree Paula Hendry, Business Finance Manager (Resources, Revenues and Benefits) (1) The Revenues and BDP Teams have undertaken a review of the process and rolling programme for undertaking reviews and concluded that the current period for issuing reminders will remain at 4 weeks. Staff have been reminded of the importance of adhering to the timetable. To ensure all relevant accounts are subject to review, the process has been amended to incorporate a check, by the Team Leader, that all scheduled reviews have been issued. (2) Staff have been reminded of the importance of ensuring the correct creditor reference and refund method is selected when requesting a refund. April 2025 Page 50 of 144
Page 51
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 14 INTERNAL AUDIT REPORT UK SHARED PROSPERITY FUND (UKSPF) Headlines The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s governance arrangements for the UKSPF to ensure that projects funded by the UKSPF are being appropriately progressed, that key risks are being effectively managed and that key elements of the Council’s UKSPF Assurance Framework are being adhered to. The UKSPF is funded by the UK Government and provided £2.6billion of capital and revenue funding across the UK for local investment from April 2022 to March 2025. As part of this funding, the eight Member Authorities of the Glasgow City Region (GCR) City Deal received a combined allocation of £73.9m, with around £13.9m allocated to North Lanarkshire Council. Funding has been continued into a fourth year to March 2026, and from this North Lanarkshire Council received an additional £6million. Lead authorities were required to develop an Investment Plan setting out how they intended to use the funding over the three-year period and the Council’s investment priorities, interventions, outputs and outcomes were submitted as part of the GCR Investment Plan. As GCR have overall responsibility for the programme, they developed an agreement for each of the member authorities setting out the terms of the funding arrangement and including an assurance framework for managing and delivering the Investment Plan. Based on the results of our work, we have categorised this audit as offering substantial assurance. We are satisfied that the control environment for the UKSPF is operating as intended and that the Assurance Framework is generally being adhered to. We were pleased to note that there is effective governance and oversight which is being provided by the Project Board and supporting Project Working Group through regular reporting of progress, risk, finance and outputs and outcomes on individual projects. Additionally, clear deliverables, which align with the UKSPF investment priorities and interventions, have been identified for each project with budgets and performance being managed by project officers. Some minor areas for improvement have been identified for management consideration and these are outlined in the action plan at Section 3. Internal Audit Opinion Substantial assurance Priority of Recommendations High Medium Low 0 0 1 Organisational Impact Minor Report status FINAL Audit ref 0750/2025/002 Date issued 24/04/25 Audit Team Elaine MacDonald and Lesley Armstrong Issued To Chief Officer (Place) and Enterprise Manager Copied To Chief Executive, Deputy Chief Executive and Enterprise Development Manager Page 51 of 144
Page 52
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 15 1. Executive Summary Objectives The audit sought to answer the following questions: • Are there effective governance structures that provide periodic updates on progress/status and strong and effective oversight, challenge and direction? Does this include appropriate consideration of relevant risks and how key risks are being managed? • Is it clear what the current stage of the programme is intended to deliver? Are short-term scope and milestones realistic, understood, clearly articulated and capable of being met? • Are there appropriate financial controls in place to ensure decisions made are in line with approved budgets? Work undertaken involved obtaining evidence of key processes and procedures and interviewing relevant staff, as well as an assessment of the governance arrangements against corporate expectations and a good practice checklist prepared by Internal Audit based on a range of sources including the National Audit Office, HM Treasury and the Cabinet Office Infrastructure and Projects Authority. The audit did not consider how the Council manages expenditure against UKSPF projects or how this is reclaimed from GCR as the Lead Authority. Internal Audit is required to submit an Annual Assurance Statement to Glasgow City Council as the lead auditor of the GCR City Deal. This audit of the UKSPF will support completion of this statement. This engagement has been conducted in accordance with the Public Sector Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • The Council has established robust governance arrangements, in the form of a Project Board and Project Working Group, for planning, delivering, controlling, monitoring and reporting on the Council’s overarching UKSPF programme and the individual projects that contribute to this. These arrangements are generally consistent with the requirements set out by the Council’s UKSPF Assurance Framework. • A Position Risk Assessment and Risk and Issues Log have been developed for the UKSPF programme, and these documents are updated on an ongoing basis and presented to the Project Board at least twice a year. • Each project is supported by a documented Project Proposal that aligns the expected benefits of the project with both the UK Government’s intervention themes, outputs and outcomes and the Council’s Ambition Statements. • A Project Workbook, consistent with the format required by the GCR, is maintained for each individual project, which tracks progress on delivery timescales, financial profile and outputs and outcomes, and provides evidence that amounts claimed are accurate, properly due and agree to the Council’s financial ledger and/or back up records. Key areas requiring management action (High Priority) No areas requiring urgent management action have been identified. Other areas for improvement (Medium Priority) No other areas for improvement have been identified. Page 52 of 144
Page 53
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 16 6. Action Plan UK SHARED PROSPERITY FUND (UKSPF) 0750/2025/002 Ref Finding 1 There is scope to enhance the arrangements for the management and oversight of the UKSPF. Whilst the Council’s arrangements are largely in line with the expectations and requirements of the Council’s UKSPF Assurance Framework, we identified a small number of areas where we consider there is scope for improvement as follows: • There is a lack of appropriate reporting on risk within Committee reports, including any issues and challenges encountered within individual projects and details of projects which are at risk of not achieving full budget spend within the required timescales. • The Council’s UKSPF Assurance Framework states that ‘The Board will consider all change requests and has delegated authority to approve financial changes both within and between interventions, and where changes are less than 30% between investment priorities’. From our review of a sample of individual projects, we noted that a decision was taken, at project level, to reallocate underspent funds of £53,000 between two projects within the same investment priority (S36 to S38) without Board approval. Implication Recommendation Priority Management response Implementation Date Those with responsibility for governance of the UKSPF may not have sufficient information on progress/activity and risk, resulting in a failure to provide effective oversight and/or identify and take remedial or corrective actions as required. The Chief Officer of Place should: (1) Review the progress reports to Committee and consider whether there is scope to provide more detailed information on the issues and challenges facing individual projects and the risk of not achieving full budget spend within the required timescales. (2) Ensure that all decisions to make financial changes within and between interventions and priorities are reported to, and approved by, the Project Board in line with the Council’s UKSPF Assurance Framework and that these decisions are appropriately recorded in the minutes. Low Agree Yvonne Weir, Enterprise Manager (1) Future committee reports will provide more detail on individual projects, where required and relevant, and will highlight the risks of not achieving full budget spend within required timescales. (2) Steps will be taken to ensure that all future financial changes are approved by the Project Board in line with the Council’s UKSPF Assurance Framework and documented accordingly. June 2025 and ongoing thereafter Page 53 of 144
Page 54
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 17 INTERNAL AUDIT REPORT BUSINESS CONTINUITY PLANNING Headlines In July 2022, we reported the results of work undertaken to provide independent assurance on the extent of compliance across the Council with key corporate expectations in respect of business continuity planning. This audit concluded that, while the Council had established adequate governance arrangements for business continuity planning, including guidance notes and templates designed to assist Services in the preparation of their business continuity plans, there was a need for improvement to the framework for documenting and formally reviewing individual Service business continuity arrangements to enhance the quality and completeness of the corresponding plans. The purpose of this audit was therefore, to provide assurance on the adequacy and effectiveness of actions taken by management in relation to the previous audit findings and recommendations made in relation to business continuity planning. Based on the results of our work, we have categorised this audit as offering reasonable assurance. We were pleased to note that significant work has been undertaken by the Resilience Planning Unit with regards to business continuity planning which has resulted in a marked improvement in documenting business continuity arrangements for individual Services. We are generally satisfied that the Council has reviewed and strengthened the control environment for documenting, reviewing and testing business continuity arrangements, however, we have identified some areas for improvement, which are detailed at Section 3 of this report and include: • Processes around critical activities and workarounds for business continuity planning need to be strengthened, with associated guidance reviewed, updated, and effectively communicated to Services. • There is merit in Service business continuity arrangements being subject to critical appraisal and challenge. • Proposed plans to better align business continuity and disaster recovery need to be progressed, finalised and thereafter implemented. It should be noted that whilst the Resilience Planning Unit are responsible for providing guidance and assistance to Services with regards to documenting, reviewing and testing their business continuity arrangements, it is the responsibility of individual Services to implement these arrangements. Internal Audit Opinion Reasonable assurance Priority of Recommendations High Medium Low 0 3 1 Organisational Impact Minor Report status FINAL Audit ref 0900/2025/007 Date issued 25/04/2025 Audit Team Lynn McCrum and Lesley Armstrong Issued To Depute Chief Executive and Resilience Planning Manager Copied To Chief Executive and Resilience Planning Officer Page 54 of 144
Page 55
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 18 1. Executive Summary Objectives The audit sought to answer the following questions: • Does the Council have adequate and effective governance arrangements, policies and procedures in relation to business continuity planning? • Is there evidence that Services have established, and are regularly reviewing, their business continuity plans? • Is there evidence that Services are undertaking appropriate, regular and timely testing of business continuity plans? • Where business continuity plans have been required to be actioned, did plans work in line with expectations and were appropriate lessons identified, logged and monitored? Work undertaken included reviewing and testing business continuity arrangements at both a Corporate and Service level but did not extend to the Council’s Corporate Resilience Plan or Disaster Recovery arrangements. Business and Digital Solutions are currently responsible for Disaster Recovery Planning, with support from the Resilience Planning Unit. This engagement has been conducted in accordance with the Public Sector Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Good practice identified We noted the following areas of good practice during the audit: • The Resilience Planning Unit is responsible for day-to-day management and monitoring of the Council’s overall resilience and is supported by the Corporate Resilience Management Team. • The Council have a Corporate Business Continuity Plan and separate Business Continuity Plans for each of the 22 individual Service areas. • A suite of documentation has been designed to aid Service personnel when reviewing, updating, testing and invoking the Corporate and Service Business Continuity Plans. • A network of Business Continuity Champions has been established to co-ordinate the testing, review and update of business continuity arrangements in each Service. Key areas requiring management action (High Priority) No areas requiring urgent management action have been identified. Other areas for improvement (Medium Priority) A number of other areas for improvement were identified: • Processes around critical activities and workarounds for business continuity planning need to be strengthened, with associated guidance reviewed, updated, and effectively communicated to Services. • There is merit in Service business continuity arrangements being subject to critical appraisal and challenge. • Proposed plans to better align business continuity and disaster recovery need to be progressed, finalised and thereafter implemented. Page 55 of 144
Page 56
7. Action Plan Business Continuity Planning 0900/2025/007 Ref Finding 1 Processes around critical activities and workarounds for business continuity planning need to be strengthened, with associated guidance reviewed, updated and effectively communicated to Services. We were pleased to note that significant progress has been made in improving the Council’s business continuity framework since the previous audit. To support the ongoing development of this framework and associated Business Continuity Plans, guidance notes and templates (e.g. Scenario Planning Template; Testing Discussion Template; Service Business Continuity Planning Review Guide; Log Sheet Template and Invocation Record) have been developed and made available to Services outlining the governance arrangements and process for invoking and standing down Business Continuity Plans in the event of an incident, to notify them of nominated Business Continuity Champions and to assist them in reviewing, testing and invoking their Business Continuity Plans. From our review of the arrangements, guidance and associated documentation, we consider that these adequately cover the basic elements of the business continuity planning processes. We do, however, consider that there is scope for the guidance to be improved, and for the arrangements for individual Services to be further strengthened, to facilitate more clear and concise Service Business Continuity Plans which are fully reflective of the Services’ critical activities and workarounds to support resilience and/or recovery, in the event of an incident affecting either one, several or all Services. We recognise that most of these areas for improvement have been the subject of discussions and emails both individually with the Resilience Planning Unit and collectively as part of the Business Continuity Champions Group meetings and details of these are documented at Appendix 2. We were informed by the Resilience Planning Unit that, as part of the annual review of business continuity planning arrangements, Services have been advised to expand their workarounds, however, due to the timing of the audit, we were unable to assess these revised arrangements as the annual review was still in progress. Implication Recommendation Priority Management response Implementation Date If guidance and processes related to critical activities and workarounds are insufficient, Business Continuity Plans may not fully align with the necessary methodology and procedures required during an incident, potentially leading to prolonged disruption critical services. Furthermore, without clearly documented procedures, Services may lack awareness of expected practices and required documentation, resulting in inconsistent application across individual Services. The Depute Chief Executive should review the business continuity framework, including guidance and processes, and ensure that the arrangements, guidance and associated templates for business continuity planning are expanded to take cognisance of, and clearly detail, each of the points outlined at Appendix 2. Any revised guidance should be disseminated to individual Services. Medium Agree Naomi Kane, Resilience Planning Officer Service plans have been reviewed since this audit took place therefore, some changes have already been implemented (i.e. development of service workarounds and guidance support). The 2025 Business Continuity guidance now incorporates new guidance to further support the Business Continuity framework. The Resilience Planning Unit will work to encourage services to continuously develop their workarounds. This will include adding in workarounds for people and IT dependencies. The responsibility for the development of Business Continuity arrangements (including workarounds) lies with the Services to update and review. Further responses to the detailed areas for improvement are documented at Appendix 2. Note: The implementation date reflects the date of the next scheduled review and update of Services’ Business Continuity Plans. May 2026 Page 56 of 144
Page 57
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 20 5. Action Plan (continued) Business Continuity Planning 0900/2025/007 Ref Finding 2 There is merit in Service business continuity arrangements being subject to critical appraisal and challenge. The Resilience Planning Unit has been integral in the development of Service business continuity arrangements/plans, however, while they can advise and guide Services, the plans and the content within them are Service led. This is primarily due to the Resilience Planning Unit having limited detailed knowledge of the different aspects of individual Services and the associated critical activities and processes/workarounds to support resilience and/or recovery of these critical services. Given that Service Business Continuity Plans have now been in place for a full year and are currently in the process of being reviewed, we consider that they would benefit from being critically appraised and challenged by an independent officer to ensure that they clearly detail the methodology and workarounds which will enable critical activities to be maintained or promptly resumed in the event of an incident occurring which could impact on the delivery of service. Implication Recommendation Priority Management response Implementation Date Without adequate scrutiny and challenge, Services Business Continuity Plans may not contain adequate arrangements to enable the continued delivery of critical services in the event of an incident. The Depute Chief Executive should ensure that the content of Service business continuity arrangements/plans are subject to scrutiny and challenge to ensure these arrangements/plans are adequate, comprehensive and accurately reflect the Service’s arrangements, including critical activities and processes/workarounds to support resilience and/or recovery. Medium Agree Andrew McPherson, Depute Chief Executive Service plans are subject to scrutiny by Plan Reviewers and Plan Advisors. However, overall authorisation that information is accurate and up to date lies with the Plan Authoriser (Chief Officer). Going forward, the Depute Chief Executive will ensure that Chief Officers are aware of this responsibility. June 2025 Page 57 of 144
Page 58
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 21 3. Action Plan (continued) Business Continuity Planning 0900/2025/007 Ref Finding 3 Proposed plans to better align business continuity and disaster recovery need to be progressed, finalised and implemented. Service Business Continuity Plans contain the standard wording ‘it should be noted that Services can utilise their Service Disaster Recovery Plan in the event of any IT incident’. From our review of a sample of Service Business Continuity Plans, we noted that some of these referenced the Disaster Recovery Plan as a workaround for loss of IT systems but contained no link to this document. Corporate responsibility for Disaster Recovery Planning within the Council lies with the Information Security and Risk Team and the Council’s ICT Disaster Recovery arrangements comprise IT application/system Disaster Recovery Plans and a separate ICT Major Incident Plan, which focuses on the ICT response elements of a major systems breach. The ICT Disaster Recovery Plans provide detail on the recovery of IT systems which are Council-owned but do not record interim arrangements or workarounds for individual Services should these systems be out of commission for a prolonged period of time. Historically, Service Business Continuity Plans included recovery times based on the expectations of the Service rather than reflecting those included in ICT Disaster Recovery Plan and as such, there may be disparity between recovery timescales documented in the Business Continuity Plans and those stated in the ICT Disaster Recovery Plans. The Information Security and Risk Team are currently analysing and comparing Service expectations per their Business Continuity Plans with Disaster Recovery Plans. This is still a work-in-progress. Additionally, plans to ensure alignment/cohesion of Service Business Continuity Plans with ICT Disaster Recovery Plans are currently being developed, however, these are still in their infancy. This has been the subject of a number of presentations to Senior Management and includes plans for the procurement of corporate wide software for Business Continuity, ICT Disaster Recovery, Incident Management and potentially Risk Management. We consider that building a better relationship between business continuity management and ICT Disaster Recovery, and co-ordinating these using a single tool, presents an opportunity to make the management of these arrangements both more effective and efficient. Implication Recommendation Priority A disparity between recovery times documented in Service Business Continuity Plans and ICT Disaster Recovery Plans may result in Services not being fully prepared for the impact caused by a loss of key IT systems and the processes/workarounds which need to be adopted to minimise disruption to critical services. The Depute Chief Executive should liaise with both the Resilience Planning Unit and Information Security and Risk Team to ensure that: (1) The current exercise to analyse and compare Service expectations as detailed in their Business Continuity Plan with Disaster Recovery Plans is progressed and concluded, with action thereafter taken to ensure that planned recovery times in relation to ICT disaster recovery are properly reflected in Service Business Continuity Plans. (2) Proposed plans for better alignment/cohesion of Service business continuity arrangements with ICT disaster recovery arrangements are further developed and implemented. This should include ensuring that an action plan is prepared which sufficiently details actions to be undertaken, responsible officers and associated timescales to enable progress to be tracked on an ongoing basis. Medium Page 58 of 144
Page 59
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 22 3. Action Plan (continued) Business Continuity Planning 0900/2025/007 Management response Implementation Date Agree (1) Rob Leitch, Information Risk Manager The Information Risk Manager is currently analysing the Recovery Time Objectives for ICT systems identified as supporting critical Council functions within the Services’ Business Continuity Plans with that recorded in the ICT Disaster Recovery Plans. This is a manual process which is time consuming. Business Continuity Champions have been asked to consider Business Continuity and Disaster Recovery timing when reviewing planning arrangements. Going forward, there will be consideration of combining the Business Continuity and Disaster Recovery champion role to ensure consistency. (2) Naomi Kane, Resilience Planning Officer and Rob Leitch, Information Risk Manager The Business Continuity and Disaster Recovery arrangements must be aligned. Further work will be scheduled after the Resilience Planning Unit and IT have met to discuss an action plan. This has been delayed due to the Council restructure. Disaster Recovery arrangements must be progressed in order for this action to be completed. Consideration of a software to assist the alignment of the Business Continuity/Disaster Recovery process is ongoing and may be implemented in due course. Note: The implementation date reflects the time period for procurement and implementation of a software system for Business Continuity/Disaster Recovery. April 2026 April 2027 Page 59 of 144
Page 60
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 23 3. Action Plan (continued) Business Continuity Planning 0900/2025/007 Ref Finding 4 There is a need to obtain annual assurance on compliance with business continuity practices and report the outcome to Committee. The year-end Chief Officer Assurance Checklist and Certificate has been updated to incorporate new questions in relation to Business Continuity Planning. At the time of testing, the document relating to 2024-25 had not yet been issued to Chief Officers for completion, therefore, we were unable to verify the responses and/or quality of information provided to support those responses. We were advised that once the returns have been made by the Chief Officers, these will be collated by the Strategy and Performance Team and thereafter, an extract of all responses to business continuity questions will be shared with the Resilience Planning Unit for review, alongside the information gathered from Services on the testing of business continuity arrangements. It is intended that the outcome of this review will form the basis of the annual report, scheduled to be submitted to the Environment and Climate Committee in September 2025, to provide assurance that expected practices are being applied appropriately and consistently across all Services and that the Council is complying with its statutory obligations in relation to the Civil Contingencies Act 2004. Implication Recommendation Priority Management response Implementation Date There is a risk that the Council may not be complying with its statutory obligations in relation to business continuity planning. The Depute Chief Executive should ensure that, as intended: (1) Appropriate review and consideration are given to both the responses received from Chief Officers in respect of business continuity and the information provided directly by Services in relation to the testing of their business continuity arrangements. (2) A report is thereafter prepared and submitted to the Environment and Climate Committee providing assurance on the extent to which expected practices are being applied appropriately and consistently across all areas of the Council and that the Council is complying with its statutory obligations. Low Agree Andrew McPherson, Depute Chief Executive (1) The responses to business continuity questions included in the Chief Officers annual assurance returns issued by the Strategy and Performance Team will be reviewed by the Resilience Planning Unit to ensure compliance has been met. (2) A report was submitted to the Environment and Climate Change Committee in 2024, and another report will be prepared and submitted in 2025. September 2025 Page 60 of 144
Page 61
Appendix 2 – Identified areas for improvement in business continuity framework Ref Area for improvement Management comments 1 For each critical activity identified in their Business Continuity Plan, Services are required to document the number of staff required, expected timescales for recovery and associated IT applications, however, there is currently no requirement to record workarounds in relation to actual incidents affecting the availability of staff or IT systems which the Service depends upon. Agree This will be implemented in the next review (scheduled April 2026). The 2025 guidance document review has already incorporated consideration of IT and People workarounds. This will be raised at the next Business Continuity Champions meeting. 2 We consider that Service Business Continuity Plans are not always fully reflective of the workarounds required to ensure continuation of critical activities in the event of an incident occurring, including links to documentation/processes and details of how alternative arrangements should be carried out or alternative suppliers should be contacted. This is particularly important in relation to manual workarounds for key IT systems. Agree Development of workarounds is the responsibility of the Service. Going forward, Chief Officers are required to review the plan and ensure accurate information is held/accessible. The Resilience Planning Unit will continue to encourage and support this. 3 There is no clear definition, including examples, of what constitutes a critical activity and/or potential hazard and how these should be identified. Additionally, the guidance does not distinguish between a critical activity and a scenario. Agree No clear examples included, however, Resilience Planning cannot provide a clear example of a critical activity as this differs per Service. The 2025 guidance now differentiates between the meaning of a scenario and critical activity. 4 The guidance does not outline how to identify/document the workarounds required to maintain critical services in the event of an incident. Partially Agree There is an area to document workarounds in each plan. Agree that there is no reference to the definition of a workaround in the guidance. The 2025 guidance review now includes this. 5 Whilst the Testing Discussion Template includes sections for documenting lessons identified, next steps and any additional comments, it does not specifically require improvement actions arising from lessons identified to be recorded, monitored and tracked. Agree Reviewed 2025 guidance and a link to the action tracker template to address this can now be found in the Testing Discussion Template document. 6 There is no reference of the need to identify, record and monitor lessons learned and corresponding actions where a Business Continuity Plan has been invoked. Agree An action tracker template has been created (link to this template can be found in the reviewed 2025 guidance and also in the Testing Discussion Template document). 7 Details of the expectations regarding ‘loggists’ (including numbers per individual Service area and their roles and responsibilities) and completion of the Log Sheet are not stated. Agree Whilst we agree, there is no requirement on the Services to have ‘loggists’; as this is best practice. All members of staff should know to log any actions/decisions during an incident. The Resilience Planning Unit have aided by providing ‘loggist’ training. Services can note who has attended this training and details will also be recorded in LearnNL. Page 61 of 144
Page 62
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 25 Ref Area for improvement Management comments 8 The list of Business Continuity Champions contained in the Guidance Note requires to be updated to accurately reflect the current officers within this role. Consideration should be given as to whether this should be a standalone document, with a link included in the guidance notes. Agree Business Continuity Champions are now noted in a separate document. This will be saved on Resilience Direct, and the reviewed guidance contains a link to this. 9 The governance arrangements, as stated in the Guidance Notes do not reflect that assurance is now sought from individual Services as part of the Chief Officer Assurance Checklist and Certificate issued annually by the Strategy and Performance Team. Agree This has been incorporated into the 2025 guidance document review. Page 62 of 144
Page 63
INTERNAL AUDIT REPORT HOUSING AND CORPORATE MAINTENANCE AND IMPROVEMENT SERVICES CONTRACT Headlines The purpose of this review was to provide assurance on the adequacy and effectiveness of the Council’s contract management arrangements for the mobilisation and implementation of the Housing and Corporate Maintenance and Improvement Services Contract (hereafter referred to as the ‘Housing Contract’). The review focussed on tracking the progress made in implementing the management actions, including the robustness of the action taken and the extent to which this fulfils the recommendations, detailed in the two recent reports in this area – Enterprise Project: Housing and Corporate Procurement (issued in February 2024) and Audit Scotland Whistleblowing Allegations (issued in April 2024). Based on the results of our work, we were pleased to note that significant progress has been made in implementing the recommendations contained in both reports, with some aspects, including those relating to the Intelligent Client Function, contract management, performance management and the Mobilisation Plan, where we consider that interim or essential elements have now been fully implemented. However, as the Housing Contract only commenced in July 2024 and is still within the first year of operation, there remains a number of areas where more advanced and fully established arrangements have not yet been finalised and require further development to ensure that they are properly embedded. Progress made to date in relation to each of the recommendations included in the previous reports are detailed at Appendix 1 (Enterprise Project) and Appendix 2 (Whistleblowing Allegations). Additionally, details of all recommendations which have not yet been fully implemented are included at Appendix 3, along with details of the issues which we consider remain outstanding and require further action. Report status FINAL Audit ref 0800/2025/001 Date issued 25/04/25 Audit Team Susan Whyte and Lesley Armstrong Issued To Chief Officer (Assets and Procurement) and Chief Officer (Housing) Copied To Repairs and Maintenance Manager (Housing), Repairs and Maintenance Manager (Corporate) and Contract Performance and Assurance Manager Chief Executive and Deputy Chief Executive Page 63 of 144
Page 64
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 27 1. Background 1.1 In December 2021, approval was given by the Council to proceed with the procurement in relation to the provision of housing and corporate maintenance and improvement services. The procurement exercise commenced in June 2022, however, despite comprehensive and positive pre-procurement market engagement, only one bidder (Mears Limited) requested to participate. Following confirmation that the bidder satisfied the required selection criteria, in December 2022, the Policy and Strategy Committee approved that the exercise should progress to the formal tender stage, with Mears Limited as the sole bidder. The Council took steps to ensure that the proposals continued to represent value for money and, in August 2023, concluded that the current procurement exercise remained appropriate. The Council approved the award of the Housing and Corporate Maintenance Contract to Mears Limited in May 2024, with the contract commencing in July 2024. 1.2 Internal Audit undertook various exercises throughout the duration of the Enterprise Project, providing assurance around the adequacy and effectiveness of the Council’s governance arrangements, that the project had been managed in accordance with corporate expectations and good practice, and that management’s assessment of best value, as a result of a single bidder scenario, provided a reasonable basis to inform and support decision making. 1.3 In December 2023, Audit Scotland received allegations from a whistleblower relating to Mears LLP and these were passed to Internal Audit for investigation. The outcome of this investigation and the report on the latest exercise of the Enterprise Project were reported to the Audit and Scrutiny Panel in May 2024. 1.4 The purpose of this review was to track the progress of the management actions, including the robustness of the action taken and the extent to which this fulfils the recommendations, for both reports outlined in 1.2 and 1.3 above. 2. Work undertaken by Internal Audit 2.1 Work undertaken included discussions with appropriate officers within the relevant Services and reviewing evidence, to determine whether the actions taken to date are sufficiently robust to alleviate the risks and fulfil the recommendations made in both reports. 3. Current status of previous recommendations 3.1 A total of 10 recommendations were made across the two audit reports (Enterprise Project and Audit Scotland Whistleblowing Allegations), however, given that many of the recommendations related to the contract management arrangements for the new Housing Contract which only commenced in July 2024, these were split into 19 implementation phases. 3.2 The table below summarises the progress of the recommendations contained in each report, split by implementation phase. Overall, eight of the agreed actions have been fully implemented, nine substantially implemented and one partially implemented. Additionally, one action is no longer achievable, although alternative arrangements are currently being progressed to satisfy the recommendation. Report Fully Implemented Substantially Implemented Partially Implemented No Longer Relevant Enterprise Project Report 4 4 0 0 Audit Scotland Whistleblowing Allegations 4 5 1 1 Total 8 9 1 1 3.3 Further details of the progress of the individual recommendations and management actions is contained at Appendix 1 and Appendix 2, together with details of each implementation stage, the planned implementation date and the implementation status as at March 2025. Page 64 of 144
Page 65
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 28 APPENDIX 1 – Enterprise Project: Housing and Corporate Procurement Details from original recommendation Internal Audit comment Recommendation 1: The Depute Chief Executive should ensure that, as a matter of urgency, work is undertaken to develop and thereafter formally document the ‘Intelligent Client’ function. This should comprise the oversight and assurance role within the Council to manage the relationship with the successful bidder and be responsible for monitoring performance to ensure that the required outcomes and standards of performance are achieved with clear roles and responsibilities for all levels involved. Management response: As a priority, management will undertake work to develop and implement the ‘Intelligent Client’ function aligned with the provisions of the contract and the audit recommendation. It should be noted that this is a significant piece of work, which will require input from a number of Chief Officers and other professional supports, which given the short contract mobilisation period, through necessity will extend beyond the service commencement date. The Enterprise Project Team will provide support to the development and implementation of the ‘Intelligent Client’ function. Progress to date: An Intelligent Client Function, which provides an oversight and assurance role for the Housing Contract, has been developed and comprises five governance groups, each with distinct roles and responsibilities, and a centralised Contract Performance and Assurance team which is responsible for overseeing the Housing Contract and supporting the Intelligent Client structure. These arrangements are documented within the contract. Performance management is included in the roles and responsibilities for both the Service Management Group (Level 3) and the Contract Delivery Management Group (Level 4), and these groups now meet in line with the timeframes set out in the contract documentation. The Enterprise Project team was responsible, on an interim basis, for providing contract management support, however, a centralised Contract Performance and Assurance team has now been established and oversees the Housing Contract while supporting the Intelligent Client structure. There has been a smooth transition of oversight responsibilities between these teams. Completion stage Planned implementation date Implementation status as at March 2025 The essential elements for effective performance management July 2024 Fully Implemented More advanced approaches developed and introduced, as a priority, on a phased basis thereafter September 2024 Fully Implemented Page 65 of 144
Page 66
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 29 Details from original recommendation Internal Audit comment Recommendation 2: The Depute Chief Executive should ensure that appropriate and robust contract management arrangements, proportionate to the size and scale of this contract and reflecting good practice, are developed, formally documented, and clearly communicated to the team appointed to manage this contract. Management response: Appropriate and robust contract management arrangements, proportionate to the size and scale of this contract and reflecting good practice, will be developed, formally documented, and clearly communicated to the team appointed to manage this contract, aligned with the expectations set out in the audit recommendation. Update reports provided to the Enterprise and Communities management team every 6 months reporting progress on the implementation of the agreed actions. It should be noted that this is a significant piece of work, which will require input from a number of Chief Officers and other professional supports, which given the short contract mobilisation period, through necessity will extend beyond the service commencement date. The Enterprise Project Team will provide support to the development and implementation of the ‘Intelligent Client’ function. Progress to date: A Contract Management Toolkit, which sets out the different aspects of the contract management arrangements and provides links to relevant documents and registers to facilitate ongoing monitoring and ensure consistency of recording, has been developed and generally follows good practice requirements. Training and awareness sessions have been held with relevant officers to raise awareness of the expected contract management arrangements for the Housing Contract. Aspects still outstanding: We are satisfied that good progress has been made towards implementing the requirements of this recommendation, however, comprehensive and detailed financial management arrangements have not yet been finalised to enable the financial performance of the Housing Contract to be effectively and robustly tracked and managed. Completion stage Planned implementation date Implementation status as at March 2025 The essential elements for effective contract management July 2024 Fully Implemented More advanced approaches developed and introduced, aligned with contract commitments, on a phased basis. July 2025 (Not Yet Due) Substantially implemented (see Appendix 3) Page 66 of 144
Page 67
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 30 Details from original recommendation Internal Audit comment Recommendation 3: The Depute Chief Executive should ensure that the identified contract mobilisation tasks are completed in an appropriate and timely manner. Management response: As acknowledged in the audit report, a mobilisation group and plan is in place and being progressed with the Chief Officer (Housing Management) overseeing delivery of the plan. The Chief Officer (Housing Management) will ensure that the tasks contained in the mobilisation plan are implemented in accordance with the agreed timescales and report progress on a regular basis to Enterprise Project Board. Some mobilisation tasks are required in advance of commencement of contracted service delivery date, others on a phased basis thereafter aligned with contractual provisions. Progress to date: A Mobilisation Programme, detailing all required mobilisation tasks together with timescales and lead officers, was created and is regularly monitored and updated to confirm progress to date. Aspects still outstanding: From our review of the Mobilisation Programme, we confirmed that the majority of the recorded tasks have now been completed, however, one task remains outstanding. Arrangements are in place to ensure updates on this remaining task are reported to the governance groups and we were advised that the outstanding issues are expected to be resolved shortly. Completion stage Planned implementation date Implementation status as at March 2025 Completion of the essential mobilisation tasks to support commencement of contracted service delivery July 2024 Fully Implemented Remaining mobilisation tasks aligned with contract provisions December 2024 Substantially implemented (see Appendix 3) Page 67 of 144
Page 68
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 31 Details from original recommendation Internal Audit comment Recommendation 4: The Depute Chief Executive should ensure that a Benefits Realisation Plan is prepared to record, calculate, and monitor the social value aspects of the Enterprise Project, with regular and timely reporting to key stakeholders. Management response: The Enterprise Project Team shall: • Develop a template Benefits Realisation Plan which will make provision for frequency of measurement, recording mechanisms, monitoring arrangements, related roles and responsibilities of the contract management team and other Council teams. • Provide documentation on all benefits committed to by the Contractor and the timescale for delivery of the benefits to the team appointed to manage the contract (see management response to audit recommendation 1). • Communicate to the team appointed to manage the contract, how the contract management arrangements for benefits realisation (including corrective action) in the new contract should operate. The team appointed to manage the contract (see management response to audit recommendation 1) shall manage the delivery of the Benefits Realisation Plan and report on the contractor’s performance against the plan. The information shall be prepared in advance of the first Contract Service Management Group meeting which shall be held quarterly with the first meeting 3 months after Service Commencement. Progress to date: A Benefits Realisation Plan, which reflects the social value commitments included within the Housing Contract, has been developed and, although still in the early stages of development, appropriate arrangements are in place for recording, reporting and monitoring the social value aspects of the Housing Contract. Social value is a standing agenda item, and is therefore discussed on a regular basis, at the Service Management Group and Contract Delivery Management Group. Additionally, benefit owners have been identified and are responsible for individual social value commitments and there is a dedicated Social Value Governance group which specifically discusses and considers the social value aspects contained within the contract documentation. Aspects still outstanding: We are satisfied that good progress has been made towards implementing this recommendation. Details of progress against social value commitments, set out in the contract documentation, will be included in the annual report and will be presented to elected members, however, as this is not due until July 2025, arrangements for reporting to all key stakeholders are not yet fully established. Completion stage Planned implementation date Implementation status as at March 2025 All aspects due to completion September 2024 Substantially Implemented (see Appendix 3) Page 68 of 144
Page 69
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 32 Details from original recommendation Internal Audit comment Recommendation 5: The Depute Chief Executive should ensure that a procurement engagement and assessment process for the non-exclusive element of the Enterprise Contract (Core Projects) is developed, fully documented, and clearly communicated to, and properly implemented by, the team appointed to manage the contract. Management response: The team appointed to manage the contract (see management response to audit recommendation 1) will ensure that a procurement engagement and assessment process for the non-exclusive element of the Housing and Corporate Contract (Core Projects) is developed, fully documented, clearly communicated, and properly implemented. The Enterprise Project Team will provide support to the development and implementation of the engagement process. Progress to date: Section B, clauses 8.3 and 8.4 of the contract documentation state that Mears Limited will be provided with the first opportunity to submit proposals for the delivery of individual core projects as described in the Annual Service Delivery Plan (ASDP) and that for such projects, Mears Limited is obligated to submit a project response. However, clause 8.5 states that the decision to award each project is at the Council’s discretion. An ASDP for 2025/26 has been developed, in conjunction and agreement with Mears Limited, which records details of the anticipated core projects for the year which Mears Limited will be obliged to provide responses to as part of the Housing Contract. An engagement process has been established for Mears Limited to bid on core projects which includes a register of all core projects, standard expression of interest forms and a standard file structure, to be used for each core project, for retaining relevant documentation such as standard forms, correspondence issued to Mears Limited, responses received and award decisions. Aspects still outstanding: From our review of a sample of core projects awarded to date, we noted a lack of consistency in the documentation retained and occasions where the documentation held did not adequately support the decisions made. We were advised, however, that arrangements to actively monitor and review the core project award process, to gain assurance that expected processes and procedures are being followed consistently, are currently being developed. Completion stage Planned implementation date Implementation status as at March 2025 All aspects due to completion December 2024 Substantially Implemented (see Appendix 3) Page 69 of 144
Page 70
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 33 APPENDIX 2 – Audit Scotland Whistleblowing Allegations Details from original recommendation Internal Audit comment Recommendation 1: The Depute Chief Executive should ensure that, if a contract award is made to Mears for the Housing and Corporate Property Maintenance element of the Enterprise project, robust arrangements are put in place which provide regular ongoing assurance to the Council that the identified issue of completion dates for repair jobs being retrospectively changed by Mears staff has ceased and does not re-occur. Management response: At the time of this response, the Service has received confirmation from Mears that action has already been taken to ensure no re-occurrence of completion dates for repair jobs being retrospectively changed in the future. Management will undertake work to develop and implement arrangements to provide regular ongoing assurance to the Council that the identified issue of completion dates for repair jobs being retrospectively changed by Mears staff has ceased and does not re-occur. Furthermore, incorporated in the proposed contract are measures that provide the basis for improved contract management (including, among others, an expanded suite of KPIs/SPIs, multi-layered governance structure, financial deductions model, benefits plan and annual performance report). The Service will liaise with Internal Audit with a view to implementing an independent verification of the arrangements, with frequencies to be agreed with Internal Audit. This piece of work will be developed alongside the development of the new suite of monitoring reports and will include assurance that retrospective date changes cannot occur in the future. The service will require input from a number of Chief Officers, Internal Audit and other professional supports, which given the short contract mobilisation period, through necessity will extend beyond the service commencement date. Appendix 3 contains additional contextual information from both Service management and Mears LLP in relation to the operational environment and challenges encountered. Progress to date: Due to operational requirements, completion dates for repair jobs can still be retrospectively changed on the MCM system, used by Mears Limited, however, access to amend completion dates has been restricted to eight senior managers. Reports detailing all changes to completion dates are produced and provided to the Council on a weekly basis and these are reviewed by the Business Development and Support team and followed up with Mears Limited as required. We reviewed a report detailing completion date changes from the beginning of the Housing Contract and did not identify any significant issues or concerns. Until recently, there was an issue within the MCM system whereby the reports detailing changes to completion dates were picking up changes made by non-authorised users where jobs were being closed in error (e.g. when another trade was required to do additional work). Mears Limited have, however, now resolved this issue and the most recent report provided to the Council only included a very small number of date changes and all of these had been processed by one of the authorised users. Completion stage Planned implementation date Implementation status as at March 2025 Cessation of retrospective changing of completion dates July 2024 No longer achievable (alternative arrangements developed) Interim arrangements August 2024 Fully Implemented Fully established arrangements December 2024 Fully Implemented Page 70 of 144
Page 71
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 34 Details from original recommendation Internal Audit comment Recommendation 2: The Depute Chief Executive should ensure that, as a matter of urgency, a comprehensive review of the performance management framework at operational level for the Housing and Corporate Property Maintenance contract is undertaken with the aim of establishing a more holistic approach to assessing and reporting performance to allow more effective monitoring of delivery of the contract. This should incorporate monitoring and reporting on performance against key targets but also on wider operational aspects of repairs and maintenance work, including but not limited to, information on work in progress, out of response jobs, cancellations, no access, post-inspections and tenant satisfaction/feedback. Management response: Whilst the Service acknowledges Internal Audit’s opinion that management focus on performance is ‘too narrow’ and a ‘more holistic approach’ should be taken, the Service believes strongly that considerable effort has been made to identify any performance challenges outwith the reported KPIs. This includes weekly meetings about work in progress and out-of-response repairs. These improvements are evident in extremely high levels of tenant satisfaction, repairs reported by tenants as being ‘right first time’, and small numbers of complaints. All of this would suggest that, whilst a percentage of overall repairs have been subject to completion date alteration, in overall terms the Service and the contract have performed well. Incorporated in the proposed contract are measures that provide the basis for improved contract management (including, among others, an expanded suite of KPIs/SPIs, multilayered governance structure, financial deductions model, benefits plan and annual performance report). However, Management will undertake a comprehensive review of the performance management framework at operational level for the Housing and Corporate Property Maintenance contract, which will deliver a more holistic approach to assessing and reporting performance to enable more effective monitoring of delivery of the contract. The Service will also liaise with Internal Audit with a view to implementing an independent verification of the arrangements. This piece of work will be developed alongside the development of the new suite of monitoring reports. The service will require input from a number of Chief Officers, Internal Audit and other professional supports, which given the short contract mobilisation period, through necessity will extend beyond the service commencement date. Progress to date: A performance management framework has been established and is recorded within the contract documentation for the Housing Contract which includes a suite of Key Performance Indicators (KPIs) and Strategic Performance Indicators (SPIs). KPIs have been established to enable operational performance, in respect of both Housing and Corporate repairs, and also wider performance including health and safety, customer satisfaction and value for money, to be calculated, reported and monitored. The SPIs detailed in the contract documentation include consideration of performance in relation to social impact, climate, community participation and contract resilience. We consider that significant progress has been made in relation to this recommendation with the development of a comprehensive performance management framework and establishment of arrangements for monitoring performance on a regular basis both at an operational level (through calculation and review of KPI data) and at a strategic level (through the governance groups which have been established to monitor and review performance and to manage the Housing Contract). Aspects still outstanding: However, given the early stages of the Housing Contract, some aspects require to be more fully developed and embedded: (1) A performance dashboard has been developed for reporting performance in relation to KPIs, however, arrangements for populating and checking the information recorded, need to be further developed to enable performance to be effectively and accurately recorded, reviewed and monitored. (2) Arrangements for monitoring and reporting on performance in relation to core projects have not yet been finalised. (3) As the first year of the Housing Contract is not yet complete, an annual report has not yet been produced therefore, we were unable to confirm the robustness of the arrangements for reporting performance against the SPIs recorded in the contract documentation to key stakeholders. Completion stage Planned implementation date Implementation status as at March 2025 Interim arrangements September 2024 Substantially Implemented (see Appendix 3) Fully established arrangements July 2025 (Not Yet Due) Partially Implemented (see Appendix 3) Page 71 of 144
Page 72
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 35 Details from original recommendation Internal Audit comment Recommendation 3: The Depute Chief Executive should ensure that all performance measures which are monitored and/or reported should have detailed definitions sheets prepared setting out the information sources, how the measures are calculated, their relevant components parts and any exclusions. These arrangements should also include retention of key supporting documentation and appropriate quality assurance/verification processes. Management response: Management will ensure that all performance measures which are monitored and/or reported have detailed definitions sheets prepared setting out the information sources, how the measures are calculated, their relevant components parts and any exclusions. These arrangements will also include retention of key supporting documentation and appropriate quality assurance/verification processes. This piece of work will be developed alongside the development of the new suite of monitoring reports. Progress to date: A Performance Handbook is currently being finalised, which includes definition sheets for each of the KPIs which are required as part of the contract documentation, and key documentation supporting the calculation of each of the KPIs is retained. We also noted that arrangements have been established for regular ongoing quality assurance and verification, on a sample basis, of the data recorded on HSMS which is used to calculate the KPIs. Monthly meetings are held with Mears Limited to review samples of completed jobs and obtain explanations for any unusual activity and these are followed up by quarterly meetings to ensure issues arising are discussed and resolved. Aspects still outstanding: A small number of areas were identified where we consider there is scope for further improvement: (1) Definition sheets are in place for the KPIs which are reported as part of the Council’s Strategic Performance Framework (SPF). These sheets are reviewed annually however, have not yet been fully updated to reflect any relevant changes arising from the performance information contained within the new Housing Contract, including revised job types and priority codes. (2) We understand that the quarterly operational meetings with Mears Limited are not minuted, therefore it may be difficult to ensure any actions agreed are subsequently followed up and satisfactorily resolved. Completion stage Planned implementation date Implementation status as at March 2025 All existing performance measures August 2024 Substantially Implemented (see Appendix 3) Other performance measures July 2025 (Not Yet Due) Substantially Implemented (see Appendix 3) Page 72 of 144
Page 73
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 36 Details from original recommendation Internal Audit comment Recommendation 4: The Depute Chief Executive should ensure that, for any new repairs and maintenance contract where the contractor is responsible for measuring and reporting performance achieved to the Council, appropriate arrangements are established to enable the Council to verify that reported performance is consistent with expectations and represents an accurate reflection of the service provided. Management response: Management will ensure that, for any new repairs and maintenance contract where the contractor is responsible for measuring and reporting performance achieved to the Council, appropriate arrangements are established to enable the Council to verify that reported performance is consistent with expectations and represents an accurate reflection of the service provided e.g. KPI’s, customer satisfaction, right first time and work in progress. This piece of work will be developed alongside the development of the new suite of monitoring reports, which given the short contract mobilisation period, through necessity will extend beyond the service commencement date. Progress to date: Mears Limited are responsible for measuring and reporting KPIs relating to health and safety, some aspects of customer satisfaction and value for money. Supporting documentation is not provided by Mears Limited detailing how these KPIs are calculated, therefore the Council are not able to, and do not, verify the accuracy of these indicators. We understand that these indicators do not directly impact on performance of individual repair jobs, therefore there is no requirement for the Council to independently verify the reported figures. KPIs on individual repair jobs are calculated by the Council using information recorded on the HSMS system. Although this information is imported from the Mears Limited MCM repairs system, monitoring arrangements are in place to regularly review the data contained in HSMS. The Business Development and Support team select a sample of repair jobs where attendance/completion dates recorded on HSMS appear unusual or unrealistic, for investigation and detailed review, in conjunction with Mears Limited, to identify any issues arising. Findings from these meetings are provided to, and reviewed by, the Repairs and Maintenance Managers. A spreadsheet which maps the number of repair jobs completed each month and subsequent months is now prepared to enable comparison and easy identification of any additional repairs recorded as completed in subsequent months. These spreadsheets are also sent to senior officers within Housing and Corporate Repairs for further review. Completion stage Planned implementation date Implementation status as at March 2025 Interim arrangements September 2024 Fully Implemented Fully established arrangements July 2025 (Not Yet Due) Fully Implemented Page 73 of 144
Page 74
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 37 Details from original recommendation Internal Audit comment Recommendation 5: The Depute Chief Executive should ensure that the range of issues detailed at 4.4.12 and 4.4.13, which suggests scope for improvements in operational efficiency, are considered by management with a view to identifying and agreeing any appropriate actions arising. An action plan should be developed which captures all required actions, timescales for completion and responsible officers. Thereafter, this should be tracked and monitored with reporting of progress at appropriate intervals to key stakeholders. Management response: Management are aware of the issues raised in 4.4.12 and will ensure they are rectified in the new contract; the original works agreement doesn’t appear to have provided a clear definition of what was expected and will be resolved in any future contract. Management are also aware of the range of operational issues at 4.4.13, which suggest scope for improvement, and these will be considered by management, with a view to identifying and agreeing appropriate actions. An action plan will be developed, which captures all required actions, timescales for completion and responsible officers. It will be monitored and reported at appropriate intervals to management and key stakeholders, as necessary, and will continue to be monitored throughout the duration of the contract. This piece of work will be developed alongside the development of the new suite of monitoring reports, which given the short contract mobilisation period, through necessity will extend beyond the service commencement date. Progress to date: We were advised by the Repairs and Maintenance Managers that the findings included within the previous audit report were considered and incorporated into the contract arrangements. From our review of the issues detailed at 4.4.12 and 4.4.13 in the original report, we were able to confirm that all had been considered, with appropriate action taken for 10 of these. For the remaining two issues appropriate action has been taken to progress these, however, full implementation relies on IT system changes. Aspects still outstanding: Two of the issues detailed at 4.4.13 in the original report have not yet been fully addressed however appropriate action is being taken to progress these as follows: (1) There are limitations within the planning and scheduling system (Field Services). This is being considered as part of the build for the replacement of HSMS. (2) Confusion over the application of no default requests (NDRs), with decisions being applied inconsistently across business areas. A request has been submitted to IT to have six drop down reasons added to HSMS, and Housing are currently awaiting a decision on the outcome. Completion stage Planned implementation date Implementation status as at March 2025 Identification of improvement actions and creation of an action plan September 2024 Substantially Implemented (see Appendix 3) Implementation of improvement actions contained in the action plan July 2025 (Not Yet Due) Substantially Implemented (see Appendix 3) Page 74 of 144
Page 75
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 38 APPENDIX 3 – Aspects still outstanding from original reports Recommendation Original timescale Aspects identified as outstanding Management response Enterprise Project: Housing and Corporate Procurement Recommendation 2 The Depute Chief Executive should ensure that appropriate and robust contract management arrangements, proportionate to the size and scale of this contract and reflecting good practice, are developed, formally documented, and clearly communicated to the team appointed to manage this contract. July 2025 (More advanced approaches developed) We are satisfied that good progress has been made towards implementing the requirements of this recommendation, however, comprehensive and detailed financial management arrangements have not yet been finalised to enable the financial performance of the Housing Contract to be effectively and robustly tracked and managed. Responsible Officer: Ross Dunn, Contract Performance and Assurance Manager Revised Timescale: July 2025 (No revision to original timescale) Recommendation 3 The Depute Chief Executive should ensure that the identified contract mobilisation tasks are completed in an appropriate and timely manner. December 2024 (Remaining mobilisation tasks) From our review of the Mobilisation Programme, we confirmed that the majority of the recorded tasks have now been completed, however, one task remains outstanding. Arrangements are in place to ensure updates on this remaining task are reported to the governance groups and we were advised that the outstanding issues are expected to be resolved shortly. Responsible Officer: Ross Dunn, Contract Performance and Assurance Manager Revised Timescale: May 2025 Recommendation 4 The Depute Chief Executive should ensure that a Benefits Realisation Plan is prepared to record, calculate, and monitor the social value aspects of the Enterprise Project, with regular and timely reporting to key stakeholders. September 2024 We are satisfied that good progress has been made towards implementing this recommendation. Details of progress against social value commitments, set out in the contract documentation, will be included in the annual report and will be presented to elected members however this is not due until July 2025 and therefore arrangements for reporting to all key stakeholders is not yet fully established. Responsible Officer: Ross Dunn, Contract Performance and Assurance Manager Revised Timescale: July 2025 Recommendation 5 The Depute Chief Executive should ensure that a procurement engagement and assessment process for the non-exclusive element of the Enterprise Contract (Core Projects) is developed, fully documented, and clearly communicated to, and properly implemented by, the team appointed to manage the contract. December 2024 From our review of a sample of core projects awarded to date, we noted a lack of consistency in the documentation retained and occasions where the documentation held did not adequately support the decisions made. Arrangements to actively monitor and review the core project award process, to gain assurance that expected processes and procedures are being followed consistently, are currently being developed. These arrangements should be progressed and implemented promptly. Responsible Officer: Ross Dunn, Contract Performance and Assurance Manager Revised Timescale: May 2025 Page 75 of 144
Page 76
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 39 Recommendation Original timescale Aspects identified as outstanding Management response Audit Scotland Whistleblowing Allegations Recommendation 2 The Depute Chief Executive should ensure that, as a matter of urgency, a comprehensive review of the performance management framework at operational level for the Housing and Corporate Property Maintenance contract is undertaken with the aim of establishing a more holistic approach to assessing and reporting performance to allow more effective monitoring of delivery of the contract. This should incorporate monitoring and reporting on performance against key targets but also on wider operational aspects of repairs and maintenance work, including but not limited to, information on work in progress, out of response jobs, cancellations, no access, post- inspections and tenant satisfaction/feedback. September 2024 (Interim arrangements) July 2025 (Fully established arrangements) Given the early stages of the Housing Contract, some aspects of the performance management framework require to be more fully developed and embedded: (1) A performance dashboard has been developed for reporting performance in relation to KPIs, however, arrangements for populating and checking the information recorded, need to be further developed to enable performance to be effectively and accurately recorded, reviewed and monitored. (2) Arrangements for monitoring and reporting on performance in relation to core projects have not yet been finalised. (3) As the first year of the Housing Contract is not yet complete, an annual report has not yet been produced therefore, we were unable to confirm the robustness of the arrangements for reporting performance against the SPIs recorded in the contract documentation to key stakeholders. Responsible Officer: (1) Michelle Hendry, Repairs and Maintenance Manager and Kevin Doohan, Corporate Repairs and Maintenance Manager (2) Ross Dunn, Contract Performance and Assurance Manager (3) Ross Dunn, Contract Performance and Assurance Manager Revised Timescales: (1) July 2025 (with ongoing review) (2) July 2025 (3) July 2025 Recommendation 3 The Depute Chief Executive should ensure that all performance measures which are monitored and/or reported should have detailed definitions sheets prepared setting out the information sources, how the measures are calculated, their relevant components parts and any exclusions. These arrangements should also include retention of key supporting documentation and appropriate quality assurance/verification processes. August 2024 (All existing performance measures) July 2025 (Other performance measures) A number of areas were identified where we consider there is scope for further improvement: (1) Definition sheets are in place for the KPIs which are reported as part of the Council’s Strategic Performance Framework (SPF). These sheets are reviewed annually however, have not yet been fully updated to reflect any relevant changes arising from the performance information contained within the new Housing Contract, including revised job types and priority codes. (2) We understand that the quarterly operational meetings with Mears Limited are not minuted therefore, it may be difficult to ensure any actions agreed are subsequently followed up and satisfactorily resolved. Responsible Officer: (1) Tracey Harper, Performance and Improvement Manager (2) Michelle Hendry, Repairs and Maintenance Manager and Kevin Doohan, Corporate Repairs and Maintenance Manager Revised Timescales: (1) July 2025 (2) May 2025 Page 76 of 144
Page 77
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/General/Final Report for ASP/May Panel/May ASP Final Audit Reports.docx 40 Recommendation Original timescale Aspects identified as outstanding Management response Recommendation 5 The Depute Chief Executive should ensure that all performance measures which are monitored and/or reported should have detailed definitions sheets prepared setting out the information sources, how the measures are calculated, their relevant components parts and any exclusions. These arrangements should also include retention of key supporting documentation and appropriate quality assurance/verification processes. September 2024 (Identification of improvement actions and creation of an action plan) July 2025 (Implementation of improvement actions) Two of the issues detailed at 4.4.13 in the original report have not yet been fully addressed however appropriate action is being taken to progress these as follows: (1) There are limitations within the planning and scheduling system (Field Services). This is being considered as part of the build for the replacement of HSMS. (2) Confusion over the application of no default requests (NDRs), with decisions being applied inconsistently across business areas. A request has been submitted to IT to have six drop down reasons added to HSMS, and Housing are currently awaiting a decision on the outcome. (1) and (2) Responsible Officer: Michelle Hendry, Repairs and Maintenance Manager and Kevin Doohan, Corporate Repairs and Maintenance Manager Revised Timescales: October 2025 Page 77 of 144
Page 78
Page 78 of 144
Page 79
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref FS/ASP/May25 Date 08/05/25 Internal Audit Annual Plan 2025-26 From: Francis Scott, Chief Officer (Audit and Risk) E-mail: scottfr@northlan.gov.uk Telephone 07787 914207 Executive Summary The purpose of this report is to present the proposed Internal Audit Plan 2025-26 to members of the Audit and Scrutiny Panel for their consideration and approval. The report sets out the background and context within which the internal audit planning process is undertaken and provides a high-level overview of how it is proposed Internal Audit resources will be allocated in 2025-26. The Plan follows a well-established planning methodology which is designed to ensure internal audit coverage of key corporate risks, priorities and projects, governance arrangements and financial systems. Recommendations The Panel is invited to: (1) Note the approach adopted to produce the 2025-26 Internal Audit Plan. (2) Approve the proposed Internal Audit Plan for 2025-26 (at Appendix 1). 1. Background 1.1 The Global Internal Audit Standards in the UK Public Sector (GIAS (UK Public Sector)) require the Chief Officer (Audit and Risk) to submit an annual Internal Audit Plan to the Audit and Scrutiny Panel for consideration and approval. This report outlines the proposed Internal Audit Plan for North Lanarkshire Council for 2025-26. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 5 Page 79 of 144
Page 80
2. Report 2.1 Internal Audit is an assurance function whose work is designed to evaluate and improve the effectiveness of the Council’s risk management, control, and governance processes, with the aim of providing an independent and objective opinion on the control environment within the Council. The annual Internal Audit Plan is designed to assist the Chief Officer (Audit and Risk) in formulating that opinion. 2.2 From the 1 April 2025, Internal Audit work will be undertaken in accordance with the GIAS (UK Public Sector) which includes 15 principles that Internal Audit functions must follow, covering a range of areas including ethics, professionalism, governance, management and the performance of Internal Audit services. Conformance against these standards is self-assessed on an annual basis, with an independent external quality assessment being undertaken every five years. The first external assessment of the Internal Audit function under the GIAS (UK Public Sector) is scheduled for 2029. 2.3 The purpose, mandate, authority and principal responsibilities of the Council’s Internal Audit function are set out in the Internal Audit Charter, which is approved by the Panel, the Chief Executive and the Chief Officer (Finance and Technology), as the Council’s Section 95 Officer. 2.4 Internal Audit aims to provide a high quality and customer-focused service, which is responsive and flexible, consistent with best professional practice, focuses on areas that matter, uses resources efficiently and effectively and is seen by stakeholders as adding value, providing valuable insights and making a positive contribution to the Council’s activities. 2.5 Although Internal Audit is a service within the Council, it is operationally independent which provides a core basis for its work. Internal Audit’s ongoing independence and objectivity also forms an important element in ensuring that it can effectively meet stakeholders’ needs and expectations. The post of Chief Officer (Audit and Risk) has sufficient status within the organisation, being a member of both the Business Management and Corporate Management Teams and reporting directly to the Chief Executive, to ensure the continuing independence of the Internal Audit service and its ability to act in accordance with best professional practice free from undue interference by management and/or senior elected members The Wider Audit Environment 2.6 The Council’s strategic plan, The Plan for North Lanarkshire, and its associated Programme of Work to 2028, sets out the Council’s strategic ambitions and the key activities designed to deliver them, for the Council to address the challenges facing the people and communities of North Lanarkshire. 2.7 The Council continues to seek to achieve its ambitions against a backdrop of significant financial pressures, increasing demands for many key services and ever-changing expectations about how services will be delivered. The Council also needs to respond to the impacts on it and its communities of a range of Scottish and UK Government policies. There also continue to be significant changes in governance structures and processes across the Council. Finally, external events, including the ongoing cost-of- living crisis and the subdued performance of the UK and Scottish economies as well as posing immediate challenges to which the Council is responding, also create considerable additional longer-term risks and uncertainties. Planning Considerations 2.8 In developing the Internal Audit Plan, a wide range of factors were considered including the relative scale, significance and complexity of systems, previous experience of the relevant control environments, the potential financial, operational and reputational Page 80 of 144
Page 81
consequences of any significant failures in relevant internal controls and the possible impact of any failures on the achievement of the Council’s objectives, priorities and ambitions. 2.9 The Chief Officer (Audit and Risk) also held discussions with the Chief Officers responsible for each Council Service, to understand the challenges and risks faced in delivering their services, recent or proposed changes to the operating environment and any areas across the Council where they felt additional assurance would be required. Although senior management were consulted in the development of the plan, the Chief Officer (Audit and Risk) is solely responsible for determining the content of the Internal Audit Plan. 2.10 The Plan takes account of the key risks identified by senior management for inclusion on the Corporate Risk Register, and consideration is also taken of assurance available from other sources (such as external regulators and selected high-quality relevant internal sources). 2.11 Internal Audit will continue to work closely with Audit Scotland, the Council’s appointed external auditors, to ensure that all audit activities are properly coordinated to minimise any duplication of work. Resources 2.12 In 2025-26, approximately 1,130 audit days will be available to undertake the work included in the Internal Audit Plan. This allocation is based on a funded budget of 6.5 FTE members of Internal Audit staff and is broadly consistent with the total audit days in the prior year. 2.13 I am satisfied that the resources available are adequate for the Internal Audit team to carry out its role effectively. Should there be a change to these resources during the year which will impact the completion of the plan, this will be discussed initially with the Convener and, if necessary, highlighted at the next Panel meeting. Internal Audit Reporting 2.14 The Internal Audit Plan shows the outputs which members and Chief Officers can expect from Internal Audit during 2025-26. Each Internal Audit report will be issued to the relevant Chief Officer and copied to the Chief Executive and Depute Chief Executive, highlighting any control weaknesses together with recommendations for improvement. Reports on the work of Internal Audit will also be presented regularly during the year to the Council’s Business and Corporate Management Teams. 2.15 Internal Audit will report progress against the plan during 2025-26 to the Audit and Scrutiny Panel. Progress reports will include high-level summary of all audit outputs in the plan, with full copies of all reports being made available to the Panel. Where the Chief Officer (Audit and Risk) considers there are significant matters arising from an audit report, these will be brought to the Panel’s attention in appropriate detail. 2.16 The main output of Internal Audit in 2025-26 will be the Internal Audit Annual Report prepared by the Chief Officer (Audit and Risk), which will include an opinion on the adequacy and effectiveness of the Council’s control environment. This report is used to inform the Council’s Annual Governance Statement which is incorporated into the Council’s financial statements. The Internal Audit Annual Report and opinion in relation to 2025-26 will presented to the Panel in June 2026. Categories of Work in the 2025-26 Internal Audit Plan 2.17 The proposed Internal Audit Plan for 2025-26 is detailed at Appendix 1, with reference to entries on the Corporate Risk Register where appropriate. There are three major categories of work within the Annual Plan. These include: Page 81 of 144
Page 82
• Key Strategic/Corporate Risks – including work on financial sustainability, strategic governance arrangements, project management, the recently awarded contracts for housing repairs and roads, information governance and risk management. • Financial Management and Key Financial Systems – including work on debtors, debt recovery, and self-directed support. • Service/Operational/Programmes of Work – including procurement and contract management, fleet, homelessness, attendance management, community asset transfers and community planning. 2.18 The Internal Audit team will continue to support services to ensure management implement the recommendations arising from audit reports. Quarterly updates on management’s progress in implementing High and Medium priority recommendations will be provided to the Panel. 2.19 The Internal Audit team will also continue to contribute to a wide range of corporate working groups and Project Boards and be available to provide ad hoc advice and guidance to Council services and officers. The team will also provide an internal audit service to the North Lanarkshire Health and Social Care Integrated Joint Board. 2.20 The GIAS (UK Public Sector) requires that the Internal Audit Plan be kept under review to reflect any changing priorities and emerging risks relating to the Council’s business, operations, programmes, systems, and controls. We will therefore ensure the Plan remains relevant and reflects any changes to the inherent risks in the Council. The Audit and Scrutiny Panel will be advised of any material changes to the Internal Audit Plan during the year. 3. Measures of success 3.1 Provision of independent assurance in accordance with the GIAS (UK Public Sector). 3.2 Completion of the planned audit work within 2025-26, in order to provide an annual opinion on the Council’s control environment. 3.3 Positive assessment of the work of Internal Audit by key stakeholders including senior management and members of the Audit and Scrutiny Panel. 4. Supporting Documents Appendix 1 Proposed Internal Audit Plan 2025-26 Francis Scott Chief Officer (Audit and Risk) Page 82 of 144
Page 83
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi- Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ Internal Audit forms part of the control framework for the management of several corporate risks relating to corporate governance issues and these are documented in the relevant corporate risk ‘deep dive’ documents which are subject to periodic review by management. Operational risks for the Service itself are documented in the Service’s risk register and are regularly reviewed by the Chief Officer (Audit and Risk) and the service management team. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ Page 83 of 144
Page 84
5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 84 of 144
Page 85
APPENDIX 1 – Internal Audit Plan 2025-26 AUDIT CATEGORY AUDIT SERVICE AREA INDICATIVE DAYS LINK TO CORPORATE RISK REGISTER Key Strategic/ Corporate Risks Risk Management (24/25) Chief Executive 30 Governance, Leadership and Decision Making Roads Contract (24/25) Community Operations 30 Enterprise Contract Mobilisation Strategic Governance Arrangements (24/25) Corporate Review 30 Governance, Leadership and Decision Making Information Governance (24/25) Finance & Technology 20 Information Security and Governance Financial Sustainability Finance & Technology 30 Financial Sustainability Housing Repairs Contract Housing Management 30 Enterprise Contract Mobilisation Project Management Assets & Procurement 30 Governance, Leadership and Decision Making Financial Management & Key Financial Systems External Legal Fees Legal & Democratic 25 n/a Self-Directed Support Adult Social Work 30 Home Support Service Delivery/Sustainability Debtors Finance & Technology 25 n/a Debt Recovery Finance & Technology 25 n/a Service/Operational/ Programmes of Work Contract Management Compliance Framework (24/25) Assets & Procurement 20 Procurement Risk Education Establishment Visits Education 25 Health and Safety Community Asset Transfers Assets & Procurement 20 Governance, Leadership and Decision Making Procurement - Compliance Corporate Review 20 Procurement Risk Procurement - Non-Contract Spend Corporate Review 20 Procurement Risk PVG Arrangements Education 20 Health and Safety Attendance Management People Resources 25 Human Resources - Workforce Planning Leavers Process People Resources 20 Human Resources - Workforce Planning Fleet Services Community Operations 30 n/a Traffic Commissioner Report Community Operations 20 n/a Compliance with Grant Conditions Place 15 n/a Homelessness Housing Management 30 n/a Page 85 of 144
Page 86
APPENDIX 1 – Internal Audit Plan 2025-26 AUDIT CATEGORY AUDIT SERVICE AREA INDICATIVE DAYS LINK TO CORPORATE RISK REGISTER Digital NL Process Redesign Strategy and Engagement 25 Governance, Leadership and Decision Making Community Hub Operating Model Strategy and Engagement 30 Governance, Leadership and Decision Making NL Community Planning Partnership Strategy and Engagement 30 Governance, Leadership and Decision Making Contribution to Good Governance Assurance Mapping (24/25) Corporate Review 20 Governance, Leadership and Decision Making Participation in Corporate Working Groups Corporate Review 30 Governance, Leadership and Decision Making Ad hoc advice to services Corporate Review 30 Governance, Leadership and Decision Making Fraud & Irregularity Review of Anti-Fraud Arrangements (24/25) Corporate Review 20 Serious Organised Crime, Fraud and Corruption National Fraud Initiative n/a 30 Serious Organised Crime, Fraud and Corruption Allowance for fraud/irregularity investigations n/a 65 Serious Organised Crime, Fraud and Corruption Audit Committee/ External Audit Facilitating work of Audit & Scrutiny Panel n/a 30 Governance, Leadership and Decision Making Follow-up of IA and EA recommendations n/a 50 n/a Follow-up - Audit Scotland/Accounts Commission National Reports n/a 10 n/a Liaison with External Audit n/a 5 n/a Provision of IA Services to Third Parties North Lanarkshire Integrated Joint Board (IJB) n/a 30 n/a Other GIAS (UK Public Sector) – implementation and self-assessment n/a 30 Governance, Leadership and Decision Making Flexible Capacity n/a 75 n/a Contingency n/a 50 n/a TOTAL INDICATIVE AUDIT DAYS 1,130 Page 86 of 144
Page 87
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/LM/ASP/May 2025 Date 08/05/25 Internal Audit: Follow-up of implementation of audit recommendations From Francis Scott, Chief Officer (Audit and Risk) E-mail ScottFr@northlan.gov.uk Telephone 07887 914207 Executive Summary The purpose of this report is to update the Panel on the progress made by management in the implementation of Internal and External Audit recommendations. In the period to 31 March 2025, of the 32 High and Medium priority recommendations that were due, 15 have been fully implemented and three have been deemed as no longer relevant. Of the 14 recommendations that remain outstanding, five have an implementation date which is more than 12 months overdue. Since April 2021, 94% of all relevant audit recommendations have been satisfactorily implemented by Services, meaning that only 6% of these audit recommendations remain outstanding. In respect of recommendations from External Audit reports, four of the 14 agreed actions have been completed, two are partially implemented and eight are not yet due. Recommendations The Panel is invited to: (a) Note the contents of this report. (b) Consider whether there are any issues arising from this report on which they wish to receive further information from relevant management. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work All Programmes of Work Item 6 Page 87 of 144
Page 88
1. Background 1.1 This report presents an overview of the progress of all High and Medium priority Internal Audit recommendations in the period to 31 March 2025. 1.2 This report also provides an update on progress made in addressing recommendations arising from External Audit reports issued as part of the 2022-23 and 2023-24 audits. 1.3 The updates from management on progress to date have been verified on a sample basis by Internal Audit as part of the preparation of this report. However, it should be noted that this review has focused on whether planned actions have been completed and has not included detailed substantive testing of whether the implemented actions have been effective in addressing previously identified weaknesses. 2. Report Internal Audit recommendations 2.1 Table 1 below summarises the progress of all High and Medium priority recommendations which were due to be completed in the period to 31 March 2025. Overall, 15 of the agreed actions have been completed, three have been deemed as no longer relevant and 14 remain outstanding. Table 1 Completed No Longer Relevant Outstanding Total Chief Officer Area Asset and Procurement 2 0 0 2 Audit and Risk 0 1 0 1 Community Operations 1 0 0 1 Education and Families 5 0 9 14 Finance 4 0 0 4 People Resources 3 2 4 9 Place 0 0 1 1 TOTAL 15 3 14 32 2.2 At the Panel meeting in October 2024, members requested that this report should clearly identify recommendations which were previously reported as partially implemented but have now been assessed as fully complete. Since the last Panel meeting in February, there have been six such actions and detail in respect of these is included at Appendix 1 (referenced 1.1–1.6). 2.3 The three recommendations assessed as no longer relevant relate to the following audits: • Review of the Council’s Counter Fraud Arrangements. • ESC: Testing of Selected Key Controls. • Use of Teaching Supply Staff. For each of these recommendations, the appropriate Chief Officer has advised that they accept the risk and have transferred the action onto the Service Risk Register, where it will thereafter be tracked and monitored. Internal Audit have confirmed that these are now included on the Services’ Risk Registers. Details of these recommendations are referenced 1.7–1.9 in Appendix 1. Page 88 of 144
Page 89
2.4 For the 14 outstanding recommendations, revised implementation dates have been agreed. Appendix 2 provides detail of these recommendations with an update on progress provided by service management. 2.5 Appendix 2 also references instances where the original implementation date of a recommendation was more than 12 months overdue. In this period there are five such actions, referenced 2.1–2.5 in the appendix. Relevant Chief Officers have been invited to attend the Panel meeting to provide explanations. 2.6 As at 31 March 2025, 94% of all relevant audit recommendations, where the original agreed implementation date was either due or had passed, have been fully implemented by Services, meaning that the percentage overall of all audit recommendations made since April 2021, which remain outstanding, is 6%. This highlights an improvement since the last period when 92% were complete and 8% were outstanding. External Audit recommendations 2.7 Table 2 shows the status of actions agreed by management in response to External Audit reports issued as part of the 2022-23 and 2023-24 audits. As at 31 March 2025, four of these recommendations are complete, two are partially implemented and eight are not yet due. Table 2 Completed Partially implemented Not yet due Total Report Title 2022-23 Annual Report 2021/22 1 2 0 3 Best Value Thematic Report 3 0 0 3 2023-24 Annual Report 0 0 5 5 Best Value Thematic Report 0 0 3 3 TOTAL 4 2 8 14 2.8 A six-monthly tracking report of progress in implementing these recommendations is included at Appendix 3. 3. Measures of success 3.1 Internal Audit reports each cycle to the Audit and Scrutiny Panel on the progress made by management in implementing actions in response to Internal and External Audit reports. Page 89 of 144
Page 90
4. Supporting documentation Appendix 1 Internal Audit recommendations previously reported as outstanding, now complete Appendix 2 Outstanding Internal Audit recommendations Appendix 3 External Audit recommendations Francis Scott, Chief Officer (Audit and Risk) Page 90 of 144
Page 91
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure by Services to address previously identified issues and/or weaknesses will impact on the effectiveness of the relevant control framework. This, depending on the nature of the issue, will be captured and should be reflected in the relevant service risk register or the corporate risk register (as appropriate). 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 91 of 144
Page 92
APPENDIX 1 – Internal Audit recommendations previously reported as outstanding, now complete Ref. Report Details Recommendation Original & revised due dates 1.1 Chief Officer (Asset and Procurement) Contract Management (April 2023) The Chief Officer (Asset and Procurement) should ensure that: (1) all Chief Officers are reminded of the need to nominate appropriately skilled/experienced officers as contract owners and ensure that such staff are made aware as soon as possible of the C&SM guidance and the responsibilities and corporate expectations placed on them when undertaking such a role. (2) the eLearning modules and associated training continue to be developed in accordance with the expected timescales and consideration is given to the need for specific mandatory training on the corporate C&SM guidance for those nominated as Contract Owners; and (3) the C&SM guidance is subject to periodic review to ensure that it continues to be adequate and reflects current corporate expectations in relation to C&SM activity across the Council. Priority: Medium December 2023 June 2024 March 2025 1.2 Chief Officer (Asset and Procurement) Procurement – Achieving Best Value (June 2023) The Chief Officer (Asset and Procurement) should consider and identify a condensed suite of indicators which would allow for the measurement, analysis and reporting of all procurement activity notified to the CPT including relevant indicators to capture procurement exercises which did/did not involve competition and ensure that this is subject to regular review to identify any trends and/or potential issues within particular sectors and/or goods/services, investigate the reasons for these and take appropriate action to resolve. Priority: Medium April 2024 March 2025 1.3 Chief Officer (People Resources) Corporate Governance Principles C & D (May 2023) The Chief Officer (People Resources) should ensure that appropriate arrangements are put in place to allow for key HR related documents referenced in the finding above to be reviewed/refreshed and communicated to staff and that these are monitored to ensure revised timescales are achieved. Priority: Medium September 2023 December 2023 March 2024 September 2024 March 2025 1.4 Chief Officer (People Resources) Payments to Staff Additional Non-Standard Payments (October 2023) (1) The Chief Officer (Education – South), in conjunction with the Chief Officer (People Resources) should undertake a review to identify staff who regularly receive casual worker payments to ensure that they have an appropriate casual worker post set up on iTrent and a current Casual Worker Agreement in place. Where no post and/or agreement exists, appropriate action should be taken to correct this. (2) The Chief Officer (People Resources) should: • Consider whether the review recommended at (1) above needs to be extended to other Service areas, facilitating this as appropriate. • Consider whether an exception report can be devised to capture instances where casual worker payments are being made to staff without a casual worker post set up in iTrent and/or a Casual Worker Agreement in place to enable monitoring, identification and prompt action to correct this; and • Remind casual workers, and managers authorising claims, of the requirement to ensure that casual worker payments are only allocated to their casual worker post. Priority: Medium January 2024 July 2024 March 2025 Page 92 of 144
Page 93
Ref. Report Details Recommendation Original & revised due dates 1.5 Chief Officer (People Resources) Payroll: Follow- up of Overtime Duplicate Payments (August 2024) The Chief Officer (People Resources) should ensure that: (1) As a priority, a robust mechanism is developed and implemented to identify, and hold to account, any managers who are continually authorising duplicate claims and are therefore failing to properly and effectively discharge the delegated financial authority assigned to them. This should include, but not be limited to, the need for completion of the Time and Expenses training to be made a mandatory requirement for authorising managers; reporting instances of authorising duplicate claims to the relevant Chief Officer and devising a process whereby continual dereliction of duties results in consideration of appropriate formal action; and (2) Regular reports detailing instances of recurring non-compliance of both submission and authorisation of duplicate claims are introduced and circulated to both People Resources management and relevant Chief Officer Priority: High December 2024 April 2025 1.6 Chief Officer (People Resources) Payroll: Follow- up of Overtime Duplicate Payments (August 2024) The Chief Officer (People Resources) should ensure that guidance and training provided to both employees and managers provides clear and explicit instruction on the key expectations regarding the completion and review of overtime claims, including those listed in the finding above. Priority: High October 2024 February 2025 1.7 Chief Officer (Audit and Risk) Review of the Council’s Counter Fraud Arrangements (August 2023) The Chief Officer (Audit and Risk) should: (1) Review and consider the benefits of identifying and undertaking more proactive work in relation to fraud and irregularity by assessing the level of fraud risk and identifying service areas where proactive fraud work could potentially lead to financial savings for the Council. (2) Consider whether there is a need for a dedicated, appropriately qualified and experienced staff resource to undertake such work. This may include discussions with other Councils who already have such a resource to identify potential areas of work, and the cost and benefits involved. (3) Prepare an annual counter fraud plan which outlines the fraud work to be undertaken throughout the year and an annual counter fraud report which details the success and outcomes of the Counter Fraud Policy, including the levels of fraud reported, fraud work undertaken, analysis of statistics in relation to fraud activity and outcomes, publication of successful outcomes and future plans for undertaking fraud work. Priority: Medium This recommendation has been closed without being fully implemented. The Chief Officer responsible has advised they have accepted this risk, which will be tracked and monitored through service risk register. April 2024 March 2025 Page 93 of 144
Page 94
Ref. Report Details Recommendation Original & revised due dates 1.8 Chief Officer (People Resources) ESC: Testing of Selected Key Controls (March 2022) The Head of People and Organisational Development should ensure that HR Business Partners, in conjunction with service management, review how non-core hours have been calculated for all relevant employees in receipt of a standing non-core hours payment each pay period to ensure that these are accurate and consistent with the employee's work pattern/rota and Schedule A. Priority: Medium This recommendation has been closed without being fully implemented. The Chief Officer responsible has advised they have accepted this risk, which will be tracked and monitored through service risk register. December 2022 March 2023 December 2024 March 2025 1.9 Chief Officer (People Resources) Supply Teachers (January 2023) People Resources, in conjunction with Education and Families, should: (1) Prepare and issue documented guidance providing clear definitions of short and long-term supply teachers and outlining the responsibilities and required actions of Headteachers in relation to supply teachers. (2) Finalise and implement the proposed processes for the management of short-term supply teachers as highlighted in the finding (i.e. notification of engagements and the Supply Register) and ensure that a formal review of the adequacy and effectiveness of these processes is undertaken, after a sufficient period of time, to assess how well they are operating, identifying and taking any necessary improvement actions as appropriate. Priority: High This recommendation has been closed without being fully implemented. The Chief Officer responsible has advised they have accepted this risk, which will be tracked and monitored through service risk register. August 2023 June 2024 February 2025 Page 94 of 144
Page 95
APPENDIX 2 – Outstanding Internal Audit recommendations Ref. Report Details Recommendation Original & revised timescales Management update 2.1 Chief Officer (Community Operations) Chief Officer (People Resources) Follow-up of Investigation of Staffing Issues within Waste and Fleet Resources (July 2023) (1) ensure that HR Business Partners, prior to authorising and passing higher duties claims for payment, properly scrutinise and understand the appropriateness of such claims, confirm that claims have been agreed and authorised by the Chief Officer or senior management and ensure that documentation accurately reflects the reason for such payments. (2) review, and take appropriate action, to resolve the issues and errors in contractual and non-contractual payments identified by Internal Audit and outlined in the document which has been provided under separate cover. (3) identify other employees who may be affected by the issues identified in the finding above, with a view to review and taking appropriate action to resolve any subsequent issues/errors identified; and (4) ensure that where overpayments arise from these reviews, prompt action is taken to ensure that appropriate repayment schedules, with reasonable terms, are promptly agreed with relevant employees and that recovery commences as soon as possible. Priority: High September 2023 December 2023 June 2024 September 2024 November 2024 February 2025 May 2025 (>12 months overdue) Requests for higher duties claims are authorised by the Business Manager, Chief Officer and HR Business Partner to ensure all such claims have been properly scrutinised and appropriately authorised. A review of the contractual and non-contractual payments has been completed, and appropriate action is being and/or will be taken to resolve the issues and errors in these payments as identified both by Internal Audit and during the aforementioned review. Work has been concluded in this area to ensure that anyone who has not been paid correctly has now been paid correctly. Any underpayments identified will be calculated and paid to the affected employees. A report is being submitted to the next meeting of the BMT in May 2025 seeking approval to stop recovery of the overpayments identified. Page 95 of 144
Page 96
Ref. Report Details Recommendation Original & revised timescales Management update 2.2 Chief Officer (People Resources) Payments to Staff (Regularity): Additional Non- Standard Payments (October 2023) The Chief Officer (People Resources) should undertake a review of current element codes to: (1) determine the need for each code based on the Council’s terms and conditions, removing any which are unnecessary and provide a clear explanation of each code remaining to ensure that staff and managers understand the purpose of each code; and (2) restrict the codes available to individual employees so that they are only able to select codes which are relevant to their post. Priority: Medium January 2024 December 2024 April 2025 May 2025 (>12 months overdue) A report has been created which identifies three batches of payroll elements: (a) Elements which migrated from Cyborg to iTrent and are on ‘pick lists’ but have never been used. These can be deleted from the system. (b) Elements that have been previously used against employee records but have not been used in over three years. While these cannot be deleted, due to historic data being attached to them, they can be hidden from the ‘pick list’ and added back if they are ever needed in the future. (c) Elements that are currently in use. An exercise will be undertaken to review and rename these and make the element descriptors clearer, so that people will have more clarity on which element to select and claim for. The Systems and Analytics Manager will also look to change the claim form role profile for Education and Families. If they have their own claim form, and elements on this form, this will significantly reduce the number of elements on the ‘pick list’ that other Services can see. Work will be allocated to the Systems and Analytics Team to carry out the above. Thereafter, communications and engagement will be needed to share the newly named element codes. 2.3 Chief Officer (Education and Families) School G – Potential Irregularity (March 2024) Education and Families should ensure that the Head Teacher of School G liaises with the Treasury Management section with a view to arranging for the school fund bank account currently being used to be closed and the monies transferred to the NLC school fund bank account held for School G. Priority: High March 2024 October 2024 March 2025 May 2025 (>12 months overdue) The Head Teacher has met with colleagues from Treasury Management, and they have provided advice and guidance on how to close the associated bank account. The Head Teacher has advised that the majority of funds have been transferred to the NLC school fund bank account held but there remains some cheques which have not yet been cashed. Once received, the March 2025 bank statement will be reviewed to determine if the cheques are cashed and identify any resultant action that needs to be taken to close the account. Page 96 of 144
Page 97
Ref. Report Details Recommendation Original & revised timescales Management update 2.4 Chief Officer (Education and Families) School Excursions (October 2023) The Chief Officers of Education and Families (North and South) should ensure that: (1) A comprehensive formal review of both the Council’s Educational Excursions and Outdoor Activities Policy and the Risk Assessment Guidance on Educational Excursions and Outdoor Activities is undertaken to revisit and refresh all aspects of these documents with a view to improving the robustness of the Council’s arrangements associated with school trips and excursions. This should take account of, but not limited to, the information contained in Appendix 2 and the need for roles and responsibilities of all relevant parties, including those within other Council services to be clearly documented in the revised guidance. (2) Any revised arrangements are fully communicated to all Council Services with a role in the process. (3) They explore how best to gather/record details of all school trips and excursions and thereafter monitor compliance with the Council’s expected arrangements associated with such trips and excursions. Category: High April 2024 March 2025 September 2025 (>12 months overdue) The Service has critically reviewed the key areas of work in conjunction with available staff resources. At this time the following operational activity is being prioritised by the Service through to June 2025: (a) Preparation of a new DSM scheme (b) Preparation of an ASN business case (c) Development of resilience, business continuity and risk management plans (d) Transfer of school transport activity to Community Operations In light of the above, the review of the School Excursions Policy will begin during Summer 2025 with engagement with the Head Teachers on the draft revised Policy commencing in August 2025. In the interim, best practice advice will continue to be given to schools based on the existing policy. Page 97 of 144
Page 98
Ref. Report Details Recommendation Original & revised timescales Management update 2.5 Chief Officer (Education and Families) School Excursions (October 2023) The Chief Officers of Education and Families (North and South) should: (1) as part of the formal review referenced at Action Plan point 1 above, ensure that this includes the creation of a dedicated section within the policy and/or associated procedures which outlines clear expectations around the financial aspects associated with the organisation and execution of trips. This should include, but not be limited to: (a) A clear and detailed protocol for booking trips where a travel company/tour operator is not going to be used ensuring arrangements minimise the risks associated with such payments and ensure that the use of personal credit cards to book trips is prohibited. (b) Consideration to promoting iPay Impact as the primary means for collecting monies in schools thus reducing cash payments and the subsequent flow of physical cash in the school. (c) Determining the additional checks/monitoring that need to be carried out at establishment level to ensure all monies due are received and duly banked in line with Council policy. (d) clear guidance on the levels of physical cash that can/should be taken on a trip/excursion, the required records to be completed and documentary evidence required/expected to support any such spend. Category: High April 2024 March 2025 September 2025 (>12 months overdue) The Service has critically reviewed the key areas of work in conjunction with available staff resources. At this time the following operational activity is being prioritised by the Service through to June 2025: (a) Preparation of a new DSM scheme (b) Preparation of an ASN business case (c) Development of resilience, business continuity and risk management plans (d) Transfer of school transport activity to Community Operations In light of the above, the review of the School Excursions Policy will begin during Summer 2025 with engagement with the Head Teachers on the draft revised Policy commencing in August 2025. In the interim, best practice advice will continue to be given to schools based on the existing policy. Page 98 of 144
Page 99
Ref. Report Details Recommendation Original & revised timescales Management update 2.6 Chief Officer (Education and Families) School E – School Fund and General Issues (January 2024) The Chief Officer of Education and Families (North) should: (1) ensure current signatories in place for all school funds are reviewed to determine whether these are appropriate, agree with the list of signatories held by the Treasury Management section and ensure that any resultant necessary changes are actioned promptly (2) collate a list of the safe/other secure facility held at each educational establishment and thereafter pass the details to the Insurance section enabling them to determine and advise of the level of insurance cover provided for each establishment; and (3) review which schools have charitable status activities; whether this is still required and, if so, that they have been made aware of the expected governance arrangements (rules, regulations and processes etc.) to be followed to comply with statutory/OSCR expectations. Priority: Medium June 2024 December 2024 March 2025 May 2025 At a briefing session in March 2025, Head Teachers were advised of the information which they were required to submit. A pro-forma was prepared and issued to the Head Teachers with a return date of 31 March 2025. A summary report on the returns will be taken to the Service SMT meeting on 30 April 2024. Detail from the returns should enable each of the recommendations to be actioned and it is anticipated that all parts of the recommendation will be implemented by the revised implementation date (May 2025). 2.7 Chief Officer (Place) Creditors (April 2024) The Chief Officer (Place) should ensure that, as a matter of urgency, the solution for an interface between PECOS and eFinancials is finalised and implemented. This should include ensuring that user acceptance testing is satisfactorily completed, and that staff involved in raising and approving and matching PECOS orders/invoices are provided with appropriate training prior to implementation. Priority: High September 2024 November 2024 February 2025 May 2025 A training module has been developed and delivered to staff involved in raising, approving and matching PECOS orders and invoices. The interface between PECOs and eFinancials has been fully acceptance tested and signed off, and the interface went live on 14 April 2025. However, a minor technical issue has been identified which is affecting the processing of invoices and thus the end-to-end process is not currently fully operational. The contractor is working on fixing the issue which is expected to be imminent. In the meantime, Creditors staff have invoked their business continuity arrangements and have temporarily adopted a manual process. 2.8 Chief Officer (Education and Families) Compliance with Establishment Fund Arrangements (October 2024) The Chief Officers (Education and Families - North and South) should determine, and formally document, the frequency and content (i.e. level of returns submitted by establishments and results of compliance checks undertaken including issues identified, proposed actions and progress to address issues) of information which requires to be provided to Service management with regards the establishment fund Compliance Framework. Priority: Medium December 2024 March 2025 May 2025 A report was prepared and submitted to SMT in March 2025. This highlighted the level of annual Compliance Checklist returns submitted by establishments for the year 2023-24 and the work to date in reviewing Establishment Fund practices. Action will now be taken to review and update the Establishment Fund Compliance Framework and formally document arrangements for reporting to SMT on compliance, in line with the audit recommendation and agreed management response. Page 99 of 144
Page 100
Ref. Report Details Recommendation Original & revised timescales Management update 2.9 Chief Officer (Education and Families) Compliance with Establishment Fund Arrangements (October 2024) The Chief Officers (Education and Families – North and South) should ensure that action is taken to further develop each of the five components within the Compliance Framework for the Service to ensure compliance on the operation and management of Establishment Funds across educational establishments. This should include, but is not limited to, specific detail and/or guidance regarding the following: (1) who will monitor submission of returns by Heads of Establishment and recording and tracking of this. (2) the initial checks required to be undertaken on these submissions, by whom and the recording of the outcome. (3) determination of a proportionate risk-based programme which clearly documents how the Service will identify and thereafter undertake targeted sample checks at establishments to verify compliance with the Educational Establishment Fund Procedures; and (4) the protocol for action to be taken on those establishments who have either not returned the required documentation (either in full or in part) or where issues/areas of non-compliance have been identified with the documentation submitted. Priority: High December 2024 March 2025 May 2025 A report was prepared and submitted to SMT in March 2025. This highlighted the level of annual Compliance Checklist returns submitted by establishments for the year 2023-24 and the work to date in reviewing Establishment Fund practices. Action will now be taken to review and develop/update the Establishment Fund Compliance Framework in line with the audit recommendation and agreed management response. 2.10 Chief Officer (Education and Families) School H – School Funds (December 2024) Education and Families should ensure that, as a matter of urgency, liaise with the Bank of Scotland to establish the current balance and a list of any transactions from February 2020 to date for both the Primary School and Nursery accounts. Once established, arrangements should be made for any balance remaining to be transferred to the current bank account for the school and nursery and these ‘old’ accounts closed. Priority: High December 2024 May 2025 Discussions are currently ongoing with the Bank of Scotland to identify a process which will allow the school to access funds held as the authorised signatories held by the bank are no longer in post in the school. 2.11 Chief Officer (People Resources) Payroll: Follow-up of Overtime Duplicate Payments (August 2024) The Chief Officer (People Resources) should ensure that: (1) A formal plan, detailing the action required to be taken to agree and recover the previously identified overpayments and the associated timescales and responsible officers, is prepared and progress thereafter monitored; and (2) Appropriate and timely action is thereafter taken to recover the overpayments referenced at recommendation (1) above, with regular updates on the status of the recovery of these overpayments provided to Senior Management. Priority: Medium December 2024 March 2025 May 2025 When work commenced in this area in January, calculations undertaken uncovered some discrepancies which required to be investigated and considered. The payroll team have reported that the work is extremely time consuming and cannot be accommodated during the normal working day due to the complex nature of these overpayments. A report is being submitted to the next meeting of the BMT in May 2025 seeking approval to stop recovery of the overpayments identified. Page 100 of 144
Page 101
Ref. Report Details Recommendation Original & revised timescales Management update 2.12 Chief Officer (Education and Families) Devolved School Management (January 2025) The Chief Officer (Education South) should continue to develop and update the contract register to ensure that this provides a comprehensive list of all contracted suppliers which are permitted for use by the Service. Priority: High January 2025 May 2025 The contract register will be further developed and updated in line with the audit recommendation thus ensuring that it provides a comprehensive list of all contracted suppliers permitted for use by the Service. 2.13 Chief Officer (Education and Families) Devolved School Management (January 2025) The Chief Officer (Education South) should ensure that spend analysis reports are produced and reviewed on a regular basis to enable identification of procurement opportunities. This should include an analysis and identification of instances where aggregated spend across the Service with individual suppliers exceeds procurement thresholds detailed in the GCSOs to ensure appropriate action is taken promptly. Priority: High February 2025 May 2025 Purchasing/procurement update reports are submitted on a monthly cycle to Service SMT/Resources meetings. However, while these reports include the procurement spend information referenced, there is still further work required to be undertaken to fully implement the recommendation. 2.14 Chief Officer (People Resources) Payroll: Follow-up of Overtime Duplicate Payments (August 2024) The Chief Officer (People Resources) should ensure that a review is undertaken, after a sufficient period to allow arrangements to become embedded, to determine the adequacy and effectiveness of the processes in place to monitor and address those cases where employees repeatedly submit duplicate claims, with amendments made as necessary. Priority: High March 2025 December 2025 There is now a Duplicate Claims Protocol in place which clearly outlines the process that will be followed for both employees who submit duplicate claims and managers who authorise them. Once this protocol has had time to embed, it will be reviewed and assessed to determine the adequacy and effectiveness of the processes put in place. Page 101 of 144
Page 102
APPENDIX 3 – External Audit recommendations Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 2022/23 – Annual Report 3.1 Land and Buildings Valuations The Council should continue to consider its approach to the valuation of land and buildings going forward and continue to ensure this is appropriate to assess whether asset values have moved materially in year and as at 31 March. The Council should work with its valuers to ensure valuations are in accordance with accounting code requirements. Appropriate scrutiny of the valuation work completed should be undertaken to ensure these are consistent with the Council’s records. The Council will continue to review its revaluation policy in line with code requirements and in conjunction with the professional valuers. This will take cognisance of the recommended actions from the Audit Scotland round table discussion including that ‘where the valuation exercise is carried out in- year but earlier than 31 March for reasons of expediency, any material changes in value in the interim should be adjusted for’. The Council will give full consideration to the practicalities of undertaking valuations at 31 March to ensure this will not impact the annual statutory requirement to submit the unaudited accounts by 30 June. The Council will also continue to assess whether there is a material difference between the carrying value in the fixed asset register and current value, and ensure the accounts are code compliant. Chief Officer (Finance) Chief Officer (Asset and Procurement) June 2024 June 2025 Partially implemented Asset and Procurement - In conjunction with Finance, we continue to review the valuation date for our property assets. Arrangements are in place to meet the code requirements at this time. Finance - In collaboration with the Council valuers, for 2023/24 (and also for 2024/25) it was agreed that moving the valuation date to 31 January was realistic and achievable. This will be kept under continual review taking into consideration the practicalities and impacts of moving to a 31 March valuation date on the process of production of the unaudited accounts. Any material changes in value between 1 February and 31 March will be assessed and adjusted for, as appropriate. In addition, a policy has been agreed to ensure a representative sample of 20% across all asset categories are valued, to ensure that all asset classes are revalued every year to help ensure the carrying amount of each class is not materially different from current value at the year-end. A revised process has also been established to assess whether the values of all other land and buildings assets, regardless of whether or not they were subject to valuation during the year, have materially changed, to ensure that the balance sheet shows a fair representation of the position as at 31 March. As valuations include estimations e.g. market values and rebuild costs, it has been determined by the Council’s valuers that valuations may be subject to a margin of error. Therefore, subject to that margin of error estimated, asset valuations undertaken will be reviewed to determine whether there is a material change in the carrying values for any asset class. If so, additional valuations will be requested and if material will be incorporated into the audited accounts. This process will continue to be reviewed. Page 102 of 144
Page 103
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 3.2 Capital Processes The Council should review a number of its capital processes to ensure the value of assets is correctly held in the accounts, including: •The Council should review the revaluations provided by its valuers to ensure all assets have been included. • The Council should review its capital impairment process to ensure it is robust enough to identify potential indicators of impairment across all assets. • The Council should also consider how assets are held on its fixed asset register to ensure compliance with the componentisation requirements of the Code. The Council will: • review the revaluation practices to ensure all relevant assets are incorporated • review the process of identifying impairments to ensure all assets are considered • review and consider how assets are held on its fixed asset register to ensure full compliance with the componentisation aspects of the code Chief Officer (Finance) Chief Officer (Asset and Procurement) June 2024 June 2025 Partially implemented. Asset and Procurement In conjunction with Finance: • Complete - the fixed asset register has been reviewed to ensure it reflects all property assets. • Complete - any impairments are considered as part of the valuations process. • In progress – consideration of componentisation is part of the valuation exercise and remains under review. Finance • Complete - reviews are undertaken of Fixed Asset Register (FAR) when selecting the representative sample of 20% across all asset categories to ensure that all assets that required to be incorporated (e.g. last valuation was 5 years ago etc) are included in the valuation programme. • Complete - a revised process has been established. A list of all assets within the FAR is provided to Chief Officers as part of the year-end exercise to ensure full consideration of assets within service. • In Progress - the Council continues to assess compliance with the code in respect of componentisation, in line with previous practice. This will remain under continual review and if deemed necessary to record individual components of more material assets, this will be discussed and agreed internally and with external audit. This is a more complex method of recording and would make valuation more complex too. This would also potentially require a significant increase in work across Finance, Assets & Procurement and the Council valuers, should it be deemed necessary, and would take time to implement. This is being reviewed by the relevant parties to determine the practicalities, implications, resource requirements and timescales to implement such changes if required. Page 103 of 144
Page 104
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 3.3 Significant Trading Operation The Council should review the trading operation to examine the cost effectiveness of the service provided to ensure that it continues to represent best value for the Council. As currently presented the Trading Account shows a rolling three-year deficit. However, this performance incorporates non-cash adjustments for Employee Benefits. Following the same accounting treatment as Council, these costs would be reversed back out resulting in a cumulative three-year surplus being reported, demonstrating continued value for money in the operation of the Council's Trading Account. The Council will seek to amend the presentation of the Trading Account note for the 2023/24 annual accounts to reflect the cash and non-cash elements of Trading Account operations. Chief Officer (Finance) June 2024 Complete. Reported to Panel in August 2024. 2022/23 – Best Value Thematic Report 3.4 Involvement of Members in Strategic Planning The Council should look to improve its existing processes for engaging elected members on the overall strategic planning process. As part of its scheduled annual review, we will refresh the narrative presently contained within the Strategic Policy Framework in respect of elected members’ strategic planning role and will thereafter emphasise through the CMT and Community Co-ordinator role the importance of engaging elected members on the strategic elements of the integrated Programme of Work Delivery Plan. Elected member role in strategic planning to also be clearly documented in the developing Programme of Work Governance Framework. Chief Officer (Business and Digital) September 2024 Complete. Reported to Panel in November 2024. 3.5 Engagement with Communities The Council should consider how it measures the level of engagement with communities and equalities groups. This will be aligned with actions arising from new communication strategy to be considered by council in March 2024. The strategy will also define what is meant by seldom-heard communities and groups. Chief Officer (Strategic Communication and Engagement) March 2024 Complete. Reported to Panel in August 2024. Page 104 of 144
Page 105
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 3.6 Elected Members Training and Development Programme The Council should work with members to understand the reasons for the poor attendance to ensure its training and development programme is fit for purpose. The number of attendees at development sessions has been low, however there has been a slight increase in numbers attending recent events. The Talent and Organisational Development Team will continue to communicate regularly with Political Group Business Managers to encourage discussions around training, low attendance and engagement to be included on business meeting agendas. A survey will be sent to all Elected Members to help identify any restrictions and reason for low attendance. Development of the Elected Members area on LearnNL will continue, with all development session recordings and presentation slides being uploaded for members to access at any time. A monthly communication is sent to all Elected Members with direct links to new recorded sessions. Chief Officer (People Resources) November 2023 Complete. Reported to Panel in February 2024. 2023/24 – Annual Report 3.7 Replacement of Assets Management should establish a process to ensure assets replaced are appropriately removed from the asset register and accounted for as a disposal appropriately. In the absence of componentisation, it is unclear as to how we can put in place a process to remove the value of elements of assets which have been replaced. However, we will commit to a review of expectations around componentisation with a view to future discussions with External Audit. Chief Officer (Finance) June 2025 Not yet due. Position as at March 2025. The wider requirements of possible implementation of componentisation requirements is being reviewed by Finance, Asset and Procurement and the Council’s valuers. In the interim, the annual capitalisation process has been amended to request services to identify where capital works involve the replacement of major components to enable appropriate removal/disposal of replaced components where possible. Page 105 of 144
Page 106
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 3.8 Statutory Override The Council should proactively work with CIPFA and the wider local government sector to arrive at appropriate solution for the implementation of accounting for infrastructure assets. The Council will work with CIPFA and the wider Local Government sector as appropriate to inform a decision on the accounting treatment for infrastructure assets. Chief Officer (Finance) Ongoing Ongoing. CIPFA/LASAAC issued a consultation for the 2025/26 accounting code which includes the proposal to extending the statutory override within the UK. The formal notification that this override has been agreed and extended is still to be confirmed with a revised statutory prescription via a SG Finance Circular announcement. 3.9 Reinforced Autoclave Aerated Concrete (RAAC) For those properties where RAAC was confirmed, the Council should determine a more accurate measure of the level, of impairment in line with the requirement of accounting standards. Further engagement with the Council’s valuers is required to determine an appropriate methodology, subject to full investigation being carried out to determine the extent of costs/remedial works required. Chief Officer (Finance) Chief Officer (Asset and Procurement) June 2025 Not yet due. Position as at March 2025: Asset and Procurement - In conjunction with Finance, the valuation team are provided with indicative costs to repair RAAC to allow them to consider the financial impact of RAAC which is reflected in the asset valuation. Finance – For the 24/25 valuation programme, all Council assets affected by RAAC are being formally revalued, to incorporate all current information and decisions of planned actions including remediation, demolition etc and the estimated costs of such works. Page 106 of 144
Page 107
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 3.10 Continuity and Security of IT Operations The Council should ensure that there is appropriate oversight of its continuity and security of IT operations and ensure the necessary assurances are obtained for externally hosted systems. Services will continue to own and manage their Business Continuity arrangements – with support and guidance from the Resilience Planning Team. Business Continuity testing framework has been implemented. It is recommended that Services test their plans annually and a corporate test will be arranged every 3 years. Oversight of IT security and IT Disaster Recovery will continue to be managed through established corporate working groups and Service Management Teams. Development of assurances on externally hosted systems will be monitored through the established arrangements of the Digital North Lanarkshire Programme of Work. Depute Chief Executive Chief Officer (Business & Digital) November 2026 April 2025 Not yet due. Position as at March 2025: Depute Chief Executive – Fully implemented Services will continue to own and manage their individual Business Continuity arrangements – with support and guidance from the Resilience Planning Team. Plans are scheduled to be reviewed annually, or when a significant change to the service occurs. Business Continuity testing framework has been implemented and testing must be undertaken annually. Since 2024, Business Continuity and Disaster Recovery arrangements have been separated to show separate planning and recovery arrangements; however, themes will show for services in the planning arrangements for both. To support this, a new joint Champion Group for DR/BC Champions is being created. The Corporate Business Continuity Plan has been tested twice since 2024, the most recent test including a cyber security incident. Going forward corporate testing will occur every 3 years with the next test scheduled for 2027/28. Business and Digital Officers with responsibility for IT Disaster Recovery planning have recently attended all Service Management Team to raise awareness of improvement activities both undertaken and planned. Assurances in respect of externally hosted systems are progressing through the Performance Optimisation sub- group of the Digital North Lanarkshire Programme of Work Board as planned. To date, the Board have reviewed a draft supplier assessment framework, confirming such will shape and compliment changes underway to the Corporate Procurement Supplier Framework, to ultimately deliver against this audit recommendation and planned improvement area. Page 107 of 144
Page 108
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 3.11 Public Performance Reporting The Council should improve its public performance reporting to provide its citizens and communities with a clear summary of performance. Following various programme of work reports to each committee cycle throughout the year, regular news articles and updates on delivery and performance are reported through the council’s website. With the Programme of Work to 2028 and its associated governance arrangements well established, work will be undertaken during 2025/26 to formally review and redevelop public performance reporting arrangements. Chief Officer (Business and Digital) Chief Officer (Strategic Communication and Engagement) March 2026 Not yet due. Position as at March 2025. Work will be undertaken during 2025/26 to formally review and develop public performance reporting arrangements. 2023/24 – Best Value Thematic Report 3.12 Acting on Staff Engagement Feedback As the council develops its staff engagement approach, it should ensure that as well as providing information to staff on council decisions, it also incorporates the views of staff and trade unions to support transparent decision making, and evidence how it is acting on findings from the Summer 2024 Roadshow sessions. There are several strands of work underway which will allow the council to progress this recommendation, including a refreshed staff survey and a review of trade union consultation arrangements. These will be taken forward along with the feedback from our 2024 Roadshow sessions to deliver an improved engagement approach. Chief Officer (People Resources) December 2025 Not yet due. Position as at March 2025: The revised staff survey has been out to consultation with various stakeholders (services, managers and trade unions) and has been revised based on feedback received. We are now working with Business and Digital to create the survey on a platform which can be accessed by all staff groups. It is expected the survey will be launched in May and open for responses until June. If required, this will be extended. the information from the survey will be collated and the results reported to CMT. 3.13 Hybrid Working Policy The council should continue to monitor the impact of its hybrid working approach. It should continually assess the impact of increasing the number of office days, in terms of performance, staff wellbeing, and recruitment and retention. The council will continue to monitor the impact of its permanent Hybrid Working Scheme, through both manager and staff surveys, and in terms of performance, recruitment and retention in hybrid roles. Chief Officer (People Resources) January 2026 Not yet due. Position as at March 2025: A revised hybrid working survey will be issued to Hybrid working. Page 108 of 144
Page 109
Ref Recommendation Agreed Management Action Responsible Officer Due Date Update 3.14 Temporary Workforce The council should include data reporting on its temporary workforce as part of published workforce data, and once available it should include data on agency workers. Work is underway to implement a more centralised approach to reporting on and managing temporary workforce resources, including agency workers. This work will be fully progressed to improve future reporting. Chief Officer (People Resources) December 2025 Not yet due. Position as at March 2025: A small working group will be formed to determine solutions for storing and reporting on Agency Staff data. Focus will include determining where is best to store data without linking to PAYE, testing the agreed system, determining legacy data, migrating data into iTrent, designing a formatted report, determining the appropriate audience, determining who enters and maintains the agency data and providing training materials, guidance and business processes to follow. Page 109 of 144
Page 110
Page 110 of 144
Page 111
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref FS/ASP/Charter2025 Date 08/05/25 Internal Audit Charter From Francis Scott, Chief Officer (Audit and Risk) E-mail scottfr@northlan.gov.uk Telephone 07787 914207 1. Background 1.1 The Internal Audit Charter is a formal document that defines Internal Audit’s purpose, mandate, authority and responsibility. It establishes Internal Audit’s position within the Council, including detailing the nature of the Chief Officer’s (Audit and Risk) functional reporting relationship with senior management and the Panel, authorising access to records, personnel and physical properties relative to the performance of audit engagements, and defining the scope of Internal Audit activities. 1.2 The most recent version of the Internal Audit Charter was approved by the Panel in August 2024. This report outlines the outcome of the most recent review and update of the Charter following a change in internal audit standards. Executive Summary The purpose of this report is to seek approval for the Internal Audit Charter, which sets out the purpose, mandate, authority and principal responsibilities of the Council’s Internal Audit function. To ensure conformance with the recently introduced Global Internal Audit Standards (GIAS), the content of the Internal Audit Charter approved by the Panel in August 2024 has been significantly revised and updated, including a new Internal Audit Mandate section which is a requirement of the GIAS. The content of the revised Internal Audit Charter has been agreed with the Chief Executive and the Chief Officer (Finance and Technology) (as the Council’s Section 95 officer). In line with the GIAS, the Internal Audit Charter will be revised and updated annually and submitted to the Panel for consideration and approval. Recommendations The Panel is invited to approve the revised Internal Audit Charter at Appendix 1. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 7 Page 111 of 144
Page 112
2. Report 2.1 From 1 April 2025, Internal Audit teams across the UK are working to new mandatory professional standards, replacing the previous Public Sector Internal Audit Standards (PSIAS). These standards will be a combination of: • The Global Internal Audit Standards (GIAS). • The Application Note “Global Internal Audit Standards in the UK Public Sector”. • For Local Authorities, the Code of Practice on the Governance of Internal Audit. Together, these standards are referred to as the GIAS (UK Public Sector). 2.2 Although the GIAS are now effective, Internal Audit teams are not expected to demonstrate full compliance immediately but must work in accordance with the new standards to build up their conformance. Internal Audit is currently undertaking a gap analysis comparing the requirements of the previous PSIAS to the new GIAS. This exercise will identify actions required to achieve compliance with the GIAS, and progress will be presented to future meetings of the Panel. 2.3 The introduction of the new standards is a significant change to the work of Internal Audit, and as a result, the previous version of the Internal Audit Charter required to be reviewed and updated. A further requirement of the GIAS (UK Public Sector) is the inclusion of a specific Internal Audit Mandate setting out the authority, roles and responsibilities of Internal Audit. 2.4 The revised Internal Audit Charter document is included at Appendix 1, and it is a requirement that it is approved annually by the Panel. The content of the Internal Audit Charter has been agreed with the Chief Executive and the Chief Officer (Finance and Technology), as the Council’s Section 95 officer. 3. Measures of success 3.1 The Council is required to ensure that it has an effective internal audit function which conforms with the GIAS. Conformance is self-assessed on an annual basis, with an independent external quality assessment being undertaken at least every five years. 4. Supporting documentation 4.1 Appendix 1 – Internal Audit Charter Francis Scott Chief Officer (Audit and Risk) Page 112 of 144
Page 113
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☐ No ☒ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? . 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 113 of 144
Page 114
INTERNAL AUDIT CHARTER Page 114 of 144
Page 115
Document control Title Internal Audit Charter Owner Francis Scott, Chief Officer (Audit and Risk) Contact scottfr@northlan.gov.uk Governance Group Audit and Scrutiny Panel Author Francis Scott, Chief Officer (Audit and Risk) Contact scottfr@northlan.gov.uk Revision History Number Originator Date Review Commenced Revision description/record of change 1.0 Ken Adamson August 2021 Review and update to confirm consistent with PSIAS which had been updated 2.0 Paula Hendry July 2024 Update and refresh of document 3.0 Francis Scott March 2025 Updated to reflect the requirements of the Global Internal Audit Standards (UK Public Sector) Document Approvals Number Governance Group Date approval granted Date approval to be requested (if document still draft) 1.0 Audit and Scrutiny Panel February 2018 2.0 Audit and Scrutiny Panel September 2021 3.0 Audit and Scrutiny Panel August 2024 4.0 Audit and Scrutiny Panel May 2025 Consultation Record (for most recent update) Status of document consulted upon N/A Stakeholders consulted/date N/A Strategic Alignment The Internal Audit Charter is a formal document that defines Internal Audit’s purpose, mandate, authority and responsibility and establishes Internal Audit’s position within the Council. Next review date Review Date March 2026, then annually thereafter Page 115 of 144
Page 116
CONTENTS 1 Introduction 4 2 Purpose of Internal Audit 4 3 Internal Audit Mandate 5 4 Definitions 5 5 Independence, Positioning and Reporting Relationships 6 6 Internal Audit Authority and Oversight 7 7 Internal Audit Objectives and Responsibilities 8 8 Management Responsibilities 12 9 Scope and Types of Internal Audit Services 12 10 Internal Audit Plan 13 11 Resourcing 14 12 Prevention and Detection of Fraud and Corruption 15 13 Follow-up of Audit Recommendations 15 14 Quality Assurance and Improvement Programme 16 15 Annual Reporting and Overall Opinion 16 16 Communication and Reporting 17 17 Approval and Changes to the Internal Audit Mandate and Charter 18 18 Approvals 18 Page 116 of 144
Page 117
1. INTRODUCTION 1.1 The Local Authority Accounts (Scotland) Regulations 2014 require the Council to operate a professional and objective internal auditing service in accordance with recognised standards and practices. 1.2 The Global Internal Audit Standard (GIAS) came into effect in January 2025 and together with the Application Note: GIAS in the UK Public Sector, provides the framework for the practice of internal auditing in the UK Public Sector. For UK Local Authorities, the CIPFA Code of Practice on the Governance of Internal Audit in Local Government also provides guidance on the interpretation of the essential conditions of the GIAS. 1.3 The GIAS require the Chief Audit Executive (CAE) to implement and maintain an Internal Audit Charter, which sets out the Purpose of Internal Audit, the Internal Audit Mandate, and the position and scope of Internal Audit in the Council. The Internal Audit Charter is reviewed and approved annually by the Corporate Management Team and the Audit and Scrutiny Panel. 2. PURPOSE OF INTERNAL AUDIT 2.1 In line with the GIAS, the purpose of Internal Audit is to strengthen the Council’s ability to create, protect and sustain value by providing the Council and management with independent, risk-based and objective assurance, advice, insight and foresight. 2.2 Internal Audit enhances the Council’s successful achievement of its objectives, its decision making and oversight, and the governance, risk management and control processes. In doing so, Internal Audit contributes to the Council’s reputation and credibility with its stakeholder and its ability to serve the public interest. 2.3 The Council’s Internal Audit function is most effective when: • It is performed by competent professionals in conformance with the GIAS (UK Public Sector). • It is independently positioned with direct accountability to the Audit and Scrutiny Panel. • Internal Auditors are free from undue influence and committed to making objective assessments. 2.4 Internal Audit assurance is provided by delivering an annual programme of audit work that independently and objectively assesses the design and effectiveness of the controls established to manage the Council’s most significant risks. The scope of Internal Audit covers all Council activities. 2.5 The CAE will report annually to the Audit and Scrutiny Panel and the Corporate Management Team on the function’s conformance with the GIAS (UK Public Sector), which will be assessed through a Quality Assurance and Improvement Programme (QAIP). 2.6 In addition to their primary role, the CAE will also support the Council’s Chief Executive, the Section 95 Officer and the statutory Monitoring Officer in undertaking Page 117 of 144
Page 118
their duties. The CAE will also advise on the control implications of system or process changes, assist management in their duties to prevent and detect fraud and corruption, and aim to add value to the Council in all its undertakings. 3. INTERNAL AUDIT MANDATE 3.1 The authority for Internal Audit is derived from the Local Authority Accounts (Scotland) Regulations 2014. This mandate sets out the authority, roles and responsibilities, and empowers Internal Audit to provide the Audit and Scrutiny Panel and senior management with independent, risk-based, and objective assurance, advice, insight and foresight. 3.2 Internal Audit’s authority is created by its direct reporting relationship to the Audit and Scrutiny Panel. Such authority allows for unrestricted access to the Audit and Scrutiny Panel, and authorises Internal Audit to: • Have full and unrestricted access to all functions, data, records, information, physical property, and personnel pertinent to carrying out Internal Audit responsibilities. • Allocate resources, set frequencies, select subjects, determine scopes of work, apply techniques and issue communications to accomplish Internal Audit’s objectives. • Obtain assistance from the necessary personnel of the Council, and services from within or outside the Council to complete Internal Audit services. 3.3 Internal Auditors are accountable for confidentiality and safeguarding records and information. The GIAS set out the duty on Internal Auditors to be faithful custodians of the information they gather, sharing only in limited, defined and controlled ways, and describes the need for awareness of responsibilities in protecting information and demonstrating respect for the confidentiality, privacy and ownership of information. 3.4 In line with GIAS (UK Public Sector), Internal Auditors must also be aware of circumstances under which sharing or publication of information will be required. They must be aware of their Council’s policies and procedures for routine publication of certain information and where there are statutory obligations to share or publish information (for example, Freedom of Information requests). 4. DEFINITIONS 4.1 The following definitions have been adopted as set out in the GIAS 2024 Glossary: • Internal Audit – an independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation establish its objectives by bringing a systematic approach to evaluate and improve the effectiveness of risk management, control and governance processes. • Assurance Services – services through which Internal Auditors perform objective Page 118 of 144
Page 119
assessments to provide assurance. The nature and scope of assurance services are determined by Internal Audit. • Advisory Services – Services through which Internal Auditors provide advice to an organisation’s stakeholders without providing assurance or taking on management responsibilities. The nature and scope of advisory services are subject to agreement with relevant stakeholders. • Independence – Freedom from conditions that threaten the ability of the Internal Audit activity to carry out Internal Audit responsibilities in an unbiased manner. 4.2 In addition, key roles within the Council are fulfilled as follows: • Chief Audit Executive (CAE) is fulfilled by the Chief Officer (Audit and Risk). • Chief Financial Officer (CFO), is the designated statutory Section 95 Officer and is fulfilled by the Chief Officer (Finance and Technology). • Senior Management, is fulfilled by the Council’s Chief Executive, the Corporate Management Team (CMT) (for all-service approval) and the Business Management Team (BMT) (in relation to oversight, monitoring and implementation of outcomes of the annual plan). • The role of the Board, is undertaken by the Audit and Scrutiny Panel. 5. INDEPENDENCE, POSITION AND REPORTING RELATIONSHIPS 5.1 The GIAS state that the CAE should be positioned at a level in the Council that enables Internal Audit services and responsibilities to be performed without interference from management, thereby establishing the independence of the Internal Audit function. 5.2 As CAE, the Chief Officer (Audit and Risk) reports functionally to the Audit and Scrutiny Panel, administratively to the Chief Executive and is a member of the Corporate Management Team. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit and Scrutiny Panel, when necessary, without interference, and supports the Internal Auditors’ ability to maintain objectivity. 5.3 The CAE is required to confirm to the Audit and Scrutiny Panel, at least annually, the organisational independence of Internal Audit. If the governance structure does not support organisational independence, the CAE must document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. The CAE must disclose to the Audit and Scrutiny Panel any interference Internal Auditors encounter related to the scope, performance or communication of Internal Audit work and results. The disclosure will include communicating the implications of such interference on Internal Audit’s effectiveness and ability to fulfil its mandate. 5.4 To ensure that Internal Audit independence and objectivity is maintained for assurance services, Internal Audit will remain free from interference from anyone within the Council in relation to audit selection, scope, procedures, frequency, timing and report content. Page 119 of 144
Page 120
5.5 Where Internal Audit also has responsibility for non-audit activities, the GIAS require that appropriate arrangements are established to avoid conflicts of interest. The CAE has operational responsibility for the Council’s Risk Management team, and suitable mitigations are in place to ensure the independence and robustness of future audits of risk management. This involves the Audit Manager (who has no responsibility for risk management) managing the whole audit process without input from the CAE, with the CAE solely being the audit client. 5.6 Additionally, Internal Audit will not be permitted to audit any activities for which they have previously been responsible within a period of one year and will not engage in any other activity that may impair judgement or independence. 5.7 For advisory (including critical friend services), the Internal Audit role will be specifically restricted to providing guidance, views and opinions. To comply with independence requirements, Internal Audit will not be involved in any aspects of operational decisions subsequently taken by management. 6. INTERNAL AUDIT AUTHORITY AND OVERSIGHT 6.1 To establish, maintain and ensure that the Council’s Internal Audit function has sufficient authority to fulfil its duties, the Audit and Scrutiny Panel will approve: • The Internal Audit Charter, which includes the Internal Audit Mandate and scope and types of Internal Audit Services. • The risk-based annual Internal Audit plan. 6.2 The Internal Audit Charter will be updated on an annual basis to consider changes affecting the Council, such as changes in the type, severity and interdependencies of risk. Following this, the Internal Audit Charter will be submitted to the Audit and Scrutiny Panel for review and approval. 6.3 Additionally, the Audit and Scrutiny Panel will: • Consider with the CAE and senior management, the appropriate authority, role, responsibilities, scope and services (assurance and/or advisory) of the Internal Audit function. • Ensure the CAE has unrestricted access to, and communicates and interacts directly with, the Audit and Scrutiny Panel, including in private meetings without senior management present. • Consider, with the CAE and senior management, any other topics that should be included in the Internal Audit Charter. • Participate in discussions with the CAE and senior management about the ‘essential conditions’ described in the GIAS which establish the foundation that enables an effective Internal Audit function. • Review the Internal Audit function’s budget and other resources. • Provide input to senior management on the appointment and removal of the CAE, ensuring adequate competencies and qualifications, and conformance with the GIAS (UK Public Sector). Page 120 of 144
Page 121
• Review and provide input to senior management on the CAE’s performance. • Receive communications from the CAE about the Internal Audit function, including its performance relative to its plan. • Ensure that a Quality Assurance and Improvement Programme (QAIP) has been established and review the results annually. • Make appropriate inquiries of senior management and the CAE to determine whether scope or resource limitations are appropriate. 6.4 The Audit and Scrutiny Panel, CAE and senior management will ensure that Internal Audit at all times: • Has unrestricted access to all Council records, cash, property, assets and people, where necessary on demand and without prior notice. • Can obtain explanations as is required to satisfy the probity of any matter under consideration. • Can require the production of any records and other such property as is deemed necessary. 6.5 All senior officers must report to the CAE at the earliest opportunity all actual or perceived losses (cash, stock, equipment or data), all suspected or actual instances of theft, embezzlement, fraud, corruption or any other impropriety. Page 121 of 144
Page 122
7. INTERNAL AUDIT OBJECTIVES AND RESPONSIBILITIES 7.1 Ethics and Professionalism The CAE will ensure that Internal Auditors: • Conform with the GIAS (UK Public Sector) including the principles of Ethics and Professionalism – integrity, objectivity, competency, due professional care, confidentiality and the Seven Principles of Public Life. • Understand, respect, meet and contribute to the legitimate and ethical expectations of the Council, and can recognise conduct that is contrary to those expectations. • Encourage and promote an ethics-based culture in the Council. • Report organisational behaviour that is inconsistent with the Council’s ethical expectations, as described in applicable policies and procedures. 7.2 Objectivity The CAE will ensure that the Internal Audit function remains free from all conditions that threaten the ability of Internal Auditors to carry out their responsibilities in an unbiased manner, including matters of engagement, selection, scope, procedures, frequency, timing and communication. If the CAE determines that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties. Internal Auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality and do not subordinate their judgement on audit matters to others, either in fact or appearance. Internal Auditors have no direct operational responsibility or authority over any of the activities they review. Accordingly, Internal Auditors will not implement internal controls, develop procedures, install systems or engage in other activities that may impair their judgement, including: • Assessing specific operations for which they had responsibility in the previous year. • Performing operational duties for the Council or its affiliates. • Initiating or approving transactions external to the Internal Audit function. • Directing the activities of any employee that is not employed by the Internal Audit function, except to the extent that such employees have been appropriately assigned to Internal Audit teams or to assist Internal Auditors. Internal Auditors will: • Disclose impairments of independence or objectivity, in fact or appearance, to the CAE as soon as possible. • Exhibit professional objectivity in gathering, evaluating and communicating information. • Make balanced assessments of all available and relevant facts and circumstances. Page 122 of 144
Page 123
• Take necessary precautions to avoid conflicts of interest, bias and undue influence. The CAE will disclose impairments of independence or objectivity to the Audit and Scrutiny Panel at least annually. 7.3 Managing the Internal Audit Function The CAE has the responsibility to: • At least annually, develop a risk-based Internal Audit plan that considers the input of the Audit and Scrutiny Panel and senior management. • Discuss the plan with the Audit and Scrutiny Panel and senior management and submit the plan to the Audit and Scrutiny Panel for review and approval. • Communicate the impact of resource limitations on the Internal Audit plan to the Audit and Scrutiny Panel and senior management. • Review and adjust the Internal Audit plan as necessary in response to changes in the Council’s business, risks, operations, programmes, systems and controls. • Communicate with the Audit and Scrutiny Panel and senior management if there are significant interim changes to the plan. • Ensure Internal Audit engagements are performed, documented and communicated in accordance with the GIAS. • Follow up on audit findings to confirm the implementation of significant recommendations or action plans and communicate the results of Internal Audit services to the Audit and Scutiny Panel and senior management. • Ensure that the Internal Audit function collectively possesses or obtains the knowledge, skills and other competencies and qualifications needed to meet the requirements of the GIAS and fulfil the Internal Audit mandate. • Identify and consider trends and emerging issues that could impact the Council and communicate these to the Audit and Scrutiny Panel and senior management as appropriate. • Consider emerging trends and successful practices in internal auditing. • Establish and ensure adherence to methodologies designed to guide the Internal Audit function. • Ensure adherence to the Council’s relevant policies and procedures unless such policies and procedures conflict with the Internal Audit Charter or GIAS. Any such conflicts will be resolved or documented and communicated to the Audit and Scrutiny Panel and senior management. • Coordinate activities and consider relying upon the work of other internal and external providers of assurance and advisory services. If the CAE cannot achieve an appropriate level of coordination, the issue must be communicated to senior management and if necessary, escalated to the Audit and Scrutiny Panel. 7.4 Communication with the Audit and Scrutiny Panel and Senior Management The CAE will report to the Audit and Scrutiny Panel and senior management on: Page 123 of 144
Page 124
• The Internal Audit function’s mandate. • The Internal Audit plan and performance. • Internal Audit resources. • Significant revisions to the Internal Audit plan and resources. • Potential impairments to independence, including relevant disclosures as applicable. • Results from the QAIP, which include the Internal Audit function’s conformance with the GIAS (UK Public Sector) and action plans to address the Internal Audit function’s deficiencies and opportunities for improvement. • Significant risk exposures and control issues, including fraud risks, governance issues and other areas of focus for the Audit and Scrutiny Panel that could interfere with the achievement of the Council’s strategic objectives. • Outcomes of assurance and advisory services. • Management’s responses to risk that the Internal Audit function determines may be unacceptable, or acceptance of a risk that is beyond the Council’s risk appetite. Page 124 of 144
Page 125
8. MANAGEMENT RESPONSIBILITIES 8.1 Management will cooperate with Internal Audit on audits and provide access to records, systems and personnel as required within a reasonable timeframe following the request. 8.2 Assurance engagements will be subject to a written terms of reference and report. Advisory and agile engagements will be agreed in writing (for example, via email or written terms of reference) and a relevant output agreed (for example, full report, summary findings, focussed feedback or an action plan). 8.3 Draft reports will be shared with management for agreement as to the factual accuracy of draft findings raised and understanding of Internal Audit recommendations designed to address the control weaknesses identified. The opportunity to have a clearance meeting to discuss the findings will be offered to management when issuing the draft report. 8.4 It is management’s responsibility to agree to either: • Accept and fully implement all Internal Audit recommendations. • Address the risks identified by adopting an alternative approach to that recommended by Internal Audit. • Accept the risk associated with not implementing Internal Audit recommendations with supporting rationale. 8.5 When a draft report is delivered, management are required to agree to the recommendations in the action plan, including specifying officer responsibility and anticipated dates for implementation of the recommendations. Internal Audit will consider the timeliness of implementation dates according to the associated risk level identified. 8.6 Management is responsible for ensuring that the agreed management actions are implemented in full and effectively sustained. 8.7 The GIAS require the CAE to report to both senior management and the Audit and Scrutiny Panel, details of management’s response to risk that (based on the CAE’s judgement) may be unacceptable to the Council. Consequently, any Internal Audit findings where management has accepted the risk will be highlighted in the Internal Audit reports. 9. SCOPE AND TYPES OF INTERNAL AUDIT SERVICES 9.1 The scope of Internal Audit services covers the entire breadth of the Council’s services, and includes all functions, activities, assets, data, projects and personnel. 9.2 The scope of Internal Audit activities also encompasses, but is not limited to, objective examinations of evidence to provide independent assurance and advisory services to the Audit and Scrutiny Panel and management on the adequacy and effectiveness of governance, risk management and control processes for the Council. 9.3 The nature and scope of any advisory services will be agreed with the party requesting Page 125 of 144
Page 126
the service, provided that the Internal Audit function does not assume management responsibility. Opportunities for improving the efficiency of governance, risk management and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management. 9.4 Internal Audit engagements may include evaluating whether: • Risks relating to the achievement of the Council’s strategic objectives are appropriately identified and managed. • The actions of Council officers, Chief Officers, management, employees and contractors (or other relevant parties) comply with the Council’s policies and procedures, and applicable laws, regulations and governance standards. • The results of operations, projects and programmes are consistent with established goals and objectives. • Operations, projects and programmes are being carried out effectively, efficiently, ethically and equitably. • Established processes and systems enable compliance with the policies, procedures, laws and regulations that could significantly impact the Council. • Fraud risks are being managed effectively. • The integrity of information and the means used to identify, measure, analyse, classify and report such information is reliable. • Resources and assets are acquired economically, used efficiently and sustainably, and protected adequately. 10. INTERNAL AUDIT PLAN 10.1 The CAE will submit an annual Internal Audit Plan to the Audit and Scrutiny Panel for review and approval, which is designed to support the provision of an evidence based annual opinion. The Plan will be developed using a risk-based methodology. The CAE will seek input from a range of key stakeholders including Elected Members, the Chief Executive, senior management and the Corporate Risk Management function. 10.2 The nature of evolving risks makes it likely that the audit assignments included in the Internal Audit Plan may be subject to change. Consequently, the Internal Audit Plan will be subject to regular review by the CAE and any proposed changes to the approved plan (due to emerging risks, suspected fraudulent activity, or other issues or factors that result in changes to the planned Internal Audit activities) will be approved by both senior management and the Audit and Scrutiny Panel. 10.3 The GIAS (UK Public Sector) requires the CAE to coordinate with internal and external assurance providers to consider relying on their work and minimise duplication of effort. 10.4 The GIAS (UK Public Sector) recognises that there are various relevant outside assurance providers whose authority flows from separate legal or regulatory sources beyond the control or influence by the CAE, and they may not have any ability to access the work of those assurance providers or gain insight into the scope and timing Page 126 of 144
Page 127
of their work. Under these circumstances, the CAE must consider whether it is possible or practical to coordinate. 10.5 Where adopted, a consistent process for the basis of reliance should be established as, where reliance is placed on the work of others, the CAE remains accountable and responsible for ensuring that there is adequate support for conclusion and opinions reached where reliance has been placed on work performed by other assurance providers. 10.6 Therefore, when dealing with an external party, Internal Audit will clearly define the respective roles, responsibilities and other expectations (including restrictions on distribution of results of the engagement and access to engagement records). 10.7 Internal Audit also reserves the right to raise findings on areas that have not been specifically included in the Internal Audit Plan where significant or systematic control gaps are evident. 11. RESOURCING 11.1 The GIAS (UK Public Sector) requires the CAE to effectively deploy and manage financial, human and technological resources to implement the Internal Audit Strategy and achieve the Internal Audit Plan and Mandate. The Application Note: GIAS in the UK Public Sector notes that funding processes for Internal Audit functions in the public sector vary and may prevent the CAE from being able to seek or obtain additional funding due to other funding priorities within the Council. This may impact the way in which the CAE uses resources. In line with the GIAS (UK Public Sector) the basis for conformance is: • Where there are constraints on resources, the CAE must develop a resource strategy which suggests practical approaches for consideration by the Audit and Scrutiny Panel. • The CAE must inform the Audit and Scrutiny Panel of the impact of insufficient resources and any options available to mitigate that impact. • Where there are no constraints, the CAE must set out what alternative approaches apply to the Internal Audit service and then seek to manage financial, human and IT resources within those constraints. 11.2 The CAE must inform the Audit and Scrutiny Panel of any resource management arrangements at the Council that may put at risk the ability of the Internal Audit function to fulfil its mandate. 11.3 The Council’s Internal Audit Plan will include the budgeted resource requirements needed to deliver the proposed audit engagements. It will also include a contingency to address unplanned work. Should circumstances arise during the year that suggest that available resource levels appear to be falling below the level required to deliver the Internal Audit Plan, the CAE will communicate the impact of resource limitations to senior management and the Audit and Scrutiny Panel. Page 127 of 144
Page 128
12. PREVENTION AND DETECTION OF FRAUD AND CORRUPTION 12.1 Council management is responsible for the prevention and detection of fraud or corruption. Internal Audit will assist management in the discharge of this responsibility. Audit procedures alone, even when performed with due professional care, cannot guarantee that fraud or corruption will be detected. Internal Audit will however exercise an appropriate level of professional scepticism during audit work and be alert to risks and exposure that could allow the opportunity for fraud or corruption to occur. 12.2 Managers, staff and elected members must always be alert to the risk of fraud, theft, bribery and corruption. Discovery of any suspected or actual fraud or irregularity that affects the Council should be reported immediately to the CAE and information on suspected or actual fraud may inform the annual audit opinion and the risk-based Internal Audit Plan. The CAE may then direct Internal Audit resources to investigate, or assist management investigations, into suspected or actual cases. 12.3 The Council has a zero-tolerance attitude and will not accept any level of fraud, bribery or corruption. The Council’s Counter Fraud Policy sets out clear procedures for the reporting and investigation of actual or suspected fraud. 13. FOLLOW-UP OF AUDIT RECOMMENDATIONS 13.1 Management is responsible for implementing audit recommendations with agreed timescales. Management should inform Internal Audit of the progress of implementation and providing appropriate evidence to support closure of each recommendation. Internal Audit will review the evidence provided, and where necessary may undertake proportionate reperformance testing to confirm that the recommendations have been effectively implemented and sustained. 13.2 Internal Audit will report on the progress made by management in the implementation of recommendations to each regular meeting of the Audit and Scrutiny Panel. 13.3 Following initial agreement to implement a recommendation, management may subsequently inform Internal Audit that the action cannot be implemented as agreed and decide to accept the risk associated with the original audit finding. Management should inform Internal Audit of the justification for this decision and detail any mitigating actions and residual risks and monitor the ongoing risk through the appropriate risk management process (for example, corporate or service risk registers). Internal Audit will note the recommendation as ‘Closed – Management Accepts Risk’, and all risk acceptances will be reported to the Audit and Scrutiny Panel. Page 128 of 144
Page 129
14. QUALITY ASSURANCE AND IMPROVEMENT PROGRAMME (QAIP) 14.1 The CAE is responsible for ensuring the quality of audit work and that the Internal Audit function is continuously seeking improvement. The GIAS (UK Public Sector) defines quality as a combined measure of conformance with the GIAS and achievement of the Internal Audit function’s performance objectives. 14.2 The CAE will develop, implement and maintain a Quality Assurance and Performance Programme (QAIP) that covers all aspects of the Internal Audit function. The QAIP will include external and internal assessments of Internal Audit’s conformance with the GIAS (UK Public Sector), as well as performance measurement to assess Internal Audit’s progress towards achievement of its objectives and promotion of continuous improvement. If applicable, the assessment must include plans to address the function’s deficiencies and opportunities for improvement. 14.3 The CAE will report annually to the Audit and Scrutiny Panel and senior management on progress with the QAIP, including the results of internal assessments (ongoing monitoring and periodic self-assessments) and external assessments. 14.4 External assessments will be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the Council, whose qualifications must meet the requirements set out in the GIAS (UK Public Sector). The Council’s next external assessment is due to take place in late 2028. 14.5 Compliance with the CIPFA Code of Practice on the Governance of Internal Audit in Local Government must also be reflected in internal and external quality assessments. 15. ANNUAL REPORTING AND OVERALL OPINION 15.1 In line with the GIAS (UK Public Sector) the CAE must, at least annually: • Conclude on the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control (the Annual Internal Audit Opinion). • Include a statement on conformance with the GIAS (UK Public Sector) and the results of the QAIP. 15.2 The Internal Audit Annual Report and Opinion for the Council is based on the outcomes of the audits included in the Internal Audit Plan, progress in addressing any prior year significant issues, progress with the implementation of agreed audit actions by management, the result of any other Internal Audit activities that have identified control gaps exposing the Council to risk, and the professional judgement of the CAE. Page 129 of 144
Page 130
16. COMMUNICATION AND REPORTING 16.1 The CAE will report regularly to the Audit and Scrutiny Panel on the progress with, and the results of the work of Internal Audit, enabling review and scrutiny of the following areas as required by GIAS. REPORT FREQUENCY Internal Audit Charter Annually Internal Audit Strategy Annually Annual Internal Audit Plan Annually Internal Audit Progress Reports (including planned audits, other Internal Audit activity and recommendation follow-up reports) Each meeting of Audit and Scrutiny Panel Proposed material changes to the Annual Internal Audit Plan At least six-monthly Internal Audit Annual Report and Opinion, including: • Effectiveness of the governance, risk management and control framework. • Internal Audit independence. • Conformance with the GIAS (UK Public Sector) including ethics and professionalism requirements. Annually Internal Quality Assessments (including results of assessments, progress of collective action points and compliance with the CIPFA Code of Practice for the Governance of Internal Audit in the UK) Annually External Quality Assessments At least every five years 16.2 Progress against the work in the Internal Audit Plan, and the outputs of this work will also be reported to appropriate meetings of the BMT and CMT. Page 130 of 144
Page 131
17. APPROVAL AND CHANGES TO THE INTERNAL AUDIT MANDATE AND CHARTER 17.1 The Internal Audit Charter is subject to approval by the Chief Executive, Section 95 Officer and Audit and Scrutiny Panel on an annual basis. Approval is evidenced through the CMT and Audit and Scrutiny Panel meeting papers and minutes, and the approval in Section 18 below. 17.2 Circumstances may justify a discussion between the CAE, the Audit and Scrutiny Panel and senior management on the Internal Audit Mandate or other aspects of the Internal Audit Charter. Such circumstances may include but are not limited to: • A significant change in the GIAS. • A significant reorganisation within the Council. • Significant changes in the CAE, the Audit and Scrutiny Panel and/or senior management. • Significant changes to the Council’s strategies, objectives, risk profile or the environment in which the Council operates. • New laws or regulations that may affect the nature and/or scope of Internal Audit services. 18 APPROVALS Approved by the Audit and Scrutiny Panel Date: Approved by the Chief Executive Date: 2 April 2025 Approved by the Chief Officer (Finance & Technology) (Section 95 Officer) Date: 2 April 2025 Approved by the Chief Officer (Audit and Risk) Date: 31 March 2025 Page 131 of 144
Page 132
Page 132 of 144
Page 133
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref FS/ASP/RMMay25 Date 08/05/25 Risk Management Update From Francis Scott, Chief Officer (Audit and Risk) E-mail ScottFr@northlan.gov.uk Telephone 07887 914207 Executive Summary This report seeks to support the Audit and Scrutiny Panel in the discharge of the aspect of its remit of monitoring the effective development and operation of risk management in the Council. The report provides commentary of Corporate Risk Register (CRR) developments since the last update in February. The report also includes a high-level overview of Horizon Scanning activity, the product of which will be used to inform deliberation on entries on CRR and Service Risk Registers (SRR). The report concludes with a summary of the key considerations of the Risk Management Corporate Working Group (RMCWG) within the reporting period. Recommendations The Panel is asked to consider the contents of the report and note: (a) the information provided on developments on the CRR for 2024-25 as detailed in sections 2.1 – 2.4 and Appendix 1. (b) The Horizon Scanning information detailed in sections 2.5 – 2.7 and Appendix 2. (c) The summary of the key discussion points of the RMCWG captured from section 2.8. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Programme of Work Statutory / corporate / service requirement Item 8 Page 133 of 144
Page 134
1. Background 1.1 The Audit and Scrutiny Panel terms of reference include the remit to monitor the effective development and operation of risk management in the Council. This report supports the Panel in discharging that aspect of its remit by providing an overview of how certain requirements of the Risk Management Strategy have been delivered during the reporting period. 2. Report Corporate Risk Register 2024-25 2.1 Risks on the CRR are subject to ongoing monitoring and review, with higher scoring risks being subject to more frequent review. Management considers factors such as changes in the operating environment, the effectiveness of existing controls, the development of additional controls and progress of agreed actions to determine whether it would be appropriate to adjust the risk assessment in line with the Risk Management Strategy. 2.2 The CRR is updated to reflect any changes arising from these reviews, and an updated version is included at Appendix 1. There have been no additions to the CRR, and no risks have been deferred to a Service Risk Register since the last update. Key developments relating to Corporate Risks since the last update 2.3 Improving Educational Outcomes 2.3.1 This entry on the CRR captures the uncertainty in around the effectiveness of the strategies and approaches in place to address the poverty related attainment gap. The latest management review of the risk recorded increases in residual likelihood and impact resulting in an increase in residual risk rating from medium (9) to high (16). 2.3.2 The increase in likelihood reflects the emerging challenges linked to the reduced levels of funding from Scottish Government, such as Pupil Equity Fund (PEF) and Strategic Equity Fund (SEF). A reduction in funding may mean that some of the identified controls in place will be difficult to maintain at the current level. Furthermore, the Service will need to begin to create an exit strategy as no information has been provided from the Scottish Government about any future funding after the end of Scottish Attainment Challenge (SAC) funding in session 2025-26. 2.3.3 There is great uncertainty about the level of funding that will be available after March 2026. Any reduction to current funding levels will undoubtedly have a negative impact. Although NLCs current funding allocation is confirmed until the end of March 2026, Scottish Government approval is required for PEF and SEF allocations to be used until the end of the academic session (August 2026). As a result of this uncertainty, the Residual Likelihood Assessment has increased from 3 to 4. This assessment will be reviewed once Scottish Government provides further information about future funding allocations. The current uncertainty impacts on our baseline measure and possible improvement trajectory. 2.3.4 The residual impact score has also increased from 3 to 4. Analysis of trends show that while there have been improvements in attainment within the primary sector, at Page 134 of 144
Page 135
secondary level overall attainment and the gap remains challenging with data showing that attainment dipped across several key measures in the last session. Without continued funding, it will be difficult to provide targeted support to establishments to raise attainment, particularly at the senior phase. This issue has been escalated and discussed at Education and Families Committee. The Scottish Government will issue the next trend analysis in September 2025, which will cover school leavers during the year August 2024 to June 2025. At this point, it will be clearer whether the attainment dip within session 2024, is a one-year anomaly or early indications of a developing trend. 2.4 Enterprise Contract (Mobilisation) 2.4.1 This entry captures uncertainty pertaining to the ongoing contract management of the Enterprise Contract so that added value is delivered from the approach. Following representations form colleagues in Community Operations, the descriptive aspect of the risk has been amplified to include supplier failure as a potential cause of the risk materialising. An additional control has been recorded regarding contingency arrangements to minimise service disruption should that occur. This change did not result in any changes to risk scoring. Horizon Scanning 2.5 The Corporate Risk Team undertake an annual Horizon Scanning exercise to inform deliberations on matters for inclusion on the CRR and SRRs. The main source of information used in this year’s exercise in the World Economic Forum’s “Global Risks Report 2025”. The report is underpinned by the Global Risks Perception Survey (GRPS) which captures views on the risk landscape from a range of stakeholders. Our analysis narrows in on the responses from government stakeholders with a focus on the risks perceived as having at the most impact over the short term (2 years) and over the long term (10 years). 2.6 Based on the information in the report, Appendix 2 presents the top 10 risks as perceived by government respondents in the short and long term. These are listed alongside the aggregate results from all stakeholder groups for comparative purposes. This information will be shared with colleagues internally and will inform our next review of the CRR. 2.7 Informal comparisons with the top-level risk registers of a sample of other Local Authorities has also been undertaken. Information on this comparison will be part of the suite of information made available to inform risk and risk register reviews. Other Risk Management Developments 2.8 The RMCWG co-ordinates activities and resources in order to implement the Risk Management Strategy and promote good risk management practice throughout the Council. There was one session of the RMCWG since the last report to Panel, with the key discussion points noted below: Horizon Scanning 2G Network Switch Off • Potential risk of service disruption as a result of the switch off of the 2G network. Consideration given to how to make services aware so that supplier engagement can take place. Training • External Training for Risk Champions delivered in February. Page 135 of 144
Page 136
• Positive mandatory internal training completion rates reported. 3. Measures of success 3.1 The Corporate Risk Team will continue to report quarterly to CMT and the Audit and Scrutiny Panel, providing an overview of key developments in risk management and updating on progress in respect of planned improvements to the Council’s risk management arrangements. 3.2 The adequacy and effectiveness of the Council’s risk management arrangements will be subject to independent review by Internal Audit, who will report directly on the results of that work to the Audit and Scrutiny Panel. 3.3 Effective risk management arrangements assist the Council in achieving planned outcomes and/or help the Council mitigate the impacts of adverse events. 4. Supporting documentation Appendix 1: Corporate Risk Register 2024-25 Appendix 2: Horizon Scanning (WEF Global Risks Survey 2025 Summary) Francis Scott, Chief Officer (Audit and Risk) Page 136 of 144
Page 137
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements will enable the Council to manage its risks more effectively, increasing the likelihood of the Council achieving its plans and ambitions by minimising or mitigating potential threats to planned outcomes. A robust risk management strategy lays out the framework and underpins all risk management activity across the organisation. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☒ No ☒ 5.11 Children’s rights and wellbeing impact Does the report contain any information regarding any council activity, service delivery, policy, or plan that has an impact on children and young people up to the age of 18, or on a specific group of these? Yes ☐ No ☒ Page 137 of 144
Page 138
Appendix 1 Corporate Risk Register 2024-25 CORPORATE RISKS (Operational) Likelihood Impact Rating Evaluation Change 1. Home support service delivery/ sustainability 5 5 25 Very High No 2. Information security and governance 5 4 20 High No 3. ICT operational capability 5 4 20 High No 4. Enterprise Contract (Mobilisation) 4 5 20 High No 5. Human resources (workforce planning) 4 4 16 High No 6. Public protection 4 4 16 High No 7. Procurement risk 4 4 16 High No 8. Governance, leadership and decision- making 4 4 16 High No 9. Health and Safety 5 3 15 Medium No 10. RAAC 3 5 15 Medium No 11. Business continuity planning 5 3 15 Medium No 12. Terrorism 3 5 15 Medium No 13. Home to school transport delivery/ sustainability 3 4 12 Medium No 14. Resilience planning 2 5 10 Medium No 15. Serious organised crime, fraud and corruption 3 3 9 Medium No CORPORATE RISKS (Strategic) Likelihood Impact Rating Evaluation Change 16. Tackling poverty 5 4 20 High No 17. Power resilience (Black Start) 4 5 20 High No 18. Climate change 5 4 20 High No 19. Digital adoption 5 4 20 High No 20. Improving educational outcomes 4 4 16 High Was 9 21. Financial sustainability 3 5 15 Medium No 22. Digital and IT strategy 4 3 12 Medium No 23. Engagement and consultation 3 3 9 Medium No 24. Delivery of approved programme of work 2 4 8 Low No Page 138 of 144
Page 139
Appendix 2 Horizon Scanning Summary (Source: World Economic Forum. Global Risks Report 2025) Numbers represent stakeholder ranking of likely impact (severity) of risks in the relevant timeframe (1 = most severe) Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) Misinformation and disinformation Persistent false information (deliberate or otherwise) widely spread through media networks, shifting public opinion in a significant way towards distrust in facts and authority. Includes, but is not limited to: false, imposter, manipulated and fabricated content. 1 5 1 5 Extreme weather events (floods, heatwaves, etc) Loss of human life, damage to ecosystems, destruction of property and/or financial loss due to extreme weather events. Includes, but is not limited to: land-based (e.g. wildfires), water- based (e.g. floods), and atmospheric and temperature-related (e.g. heat-waves) events, including those exacerbated by climate change. 2 1 2 1 Pollution (air, soil, water, etc) Introduction of harmful materials into the air, water and soil stemming from human activity, resulting in impacts to and loss of human life, financial loss and/or damage to ecosystems. Includes, but is not limited to: household and industrial activities; environmental accidents, such as oil spills; and radioactive contamination. 3 9 6 10 Page 139 of 144
Page 140
Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) State-based armed conflict (proxy, civil wars, coups, terrorism, etc) Bilateral or multilateral use of force between states and/or between a state and non-state actor(s), often with ideological, political or religious goals, manifesting as war and/or organized, sustained violence. Includes, but is not limited to: hot wars, proxy wars, civil wars, guerilla warfare, terrorism, genocide and assassinations. 4 3 Societal polarization Present or perceived ideological and cultural divisions within and across communities leading to declining social stability, gridlocks in decision-making, economic disruption and increased political polarization. 5 4 8 Cyber espionage & warfare Use of cyber weapons and tools by state and non-state actors to gain control over a digital presence, cause operational disruption, and/or compromise or damage an entity’s technological and information networks and infrastructure. Includes: defensive and offensive cyber operations that occur during or trigger armed conflict, and cyberattacks that steal classified, sensitive data or intellectual property to gain an advantage. 6 7 5 9 7 Page 140 of 144
Page 141
Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) Debt (public, corporate, household) Corporate, household, or public finances struggle to service debt accumulation, resulting in mass bankruptcies or insolvencies, liquidity crises or defaults and sovereign debt crises. Crime and illicit economic activity (incl. cyber) Global proliferation of organized crime or the illicit activities of businesses and individuals that undermine economic advancement and growth, facilitated on both a borderless and digital basis. Includes, but is not limited to: illicit financial flows (e.g. tax evasion, sanctions evasion and money laundering), illicit trade and trafficking (e.g. counterfeiting, human trafficking, wildlife trade and weapons), and cybercrime (including ransomware, data theft and online fraud) 8 Geoeconomic confrontation (sanctions, tariffs, investment screening) Deployment of economic levers by global or regional powers to reshape economic interactions between nations, restricting goods, knowledge, services or technology with the intent of building self- sufficiency, constraining geopolitical rivals and/or consolidating spheres of influence. Includes, but is not limited to: currency measures, investment controls, sanctions, state aid and subsidies, and trade controls. 9 9 Page 141 of 144
Page 142
Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) Inequality (wealth, income) Present or perceived substantive disparities in the distribution of assets, wealth or income within or between countries, resulting in material differences in related economic outcomes. Includes, but is not limited to: growing or persistent poverty and economic polarization. 10 4 7 7 Critical change to Earth systems Long-term, potentially irreversible and self-perpetuating changes to critical planetary systems, as a result of breaching a critical climatic or ecological threshold or ‘tipping point’, at a regional or global level. Includes, but is not limited to: sea level rise from collapsing ice sheets, carbon release from thawing permafrost, and disruption of ocean or atmospheric currents. 2 3 Biodiversity loss and ecosystem collapse Severe consequences for the environment, humankind and economic activity due to destruction of natural capital stemming from species extinction or reduction, spanning both terrestrial and marine ecosystems. 3 2 Page 142 of 144
Page 143
Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) Natural resource shortages (food, water) Supply shortages of food or water for human, industry or ecosystem use, manifesting as food and water insecurity at a local, regional or global level, stemming from, but not limited to: human overexploitation and mismanagement of critical natural resources, climate change (including drought and desertification), and/or a lack of suitable infrastructure. 6 4 Adverse outcomes of AI technologies Intended or unintended negative consequences of advances in AI and related technological capabilities (including Generative AI) on individuals, businesses, ecosystems and/or economies. 8 6 Concentration of strategic resources (and technologies) Concentration of strategically important resources (minerals, materials, technologies) among a small number of individuals, businesses or states that can control access and dictate discretionary pricing. 10 Page 143 of 144
Page 144
Government All Risk Short term (2 Years) Long term (10 years) Short term (2 Years) Long term (10 years) Involuntary migration or displacement Forced movement or displacement across or within borders, stemming from, but not limited to: persistent discrimination and persecution; lack of economic advancement opportunities; human-made disasters; natural disasters and extreme weather events, including the impacts of climate change; and internal or interstate conflict. 8 Erosion of human rights and/or civic freedoms Loss of protections for rights inherent to all human beings, regardless of individual status, and/or the freedoms that underpin civic space. Includes, but is not limited to the right to: life and liberty; work and education; freedom of expression; peaceful assembly; non-discrimination based on gender, race, ethnicity and other characteristics; and privacy. 10 Page 144 of 144