Internal Audit Progress Report
North Lanarkshire Council · 8 September 2022
Back to Audit and Scrutiny Panel — 8 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No ☒approval ☐noting Ref KA/ASP/Sept22 Date 08/09/22 Internal Audit progress report From: Ken Adamson, Head of Audit and Risk E-mail: adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to provide an overview of Internal Audit activity and to report the results of Internal Audit outputs finalised since the last update to the Panel in March 2022. While all Internal Audit reports completed in the period provided positive assurance, the report highlights the most significant issues arising from the completed audit work as well as providing updates on other aspects of the work of Internal Audit. Appendix 1 provides a summary of the scope and key findings of each substantive planned audit report and relevant investigative outputs. In line with best professional practice and the Internal Audit Charter and associated reporting protocol, full copies of the relevant audit outputs highlighted in this report are also included in the meeting papers. Recommendations The Panel is invited to: (a) note the findings, conclusions and recommendations of completed Internal Audit reports together with the associated management responses; (b) consider whether there are any issues raised by Internal Audit which the Panel consider are sufficiently significant to require a further report from management to be submitted to a future meeting of the Panel; (c) request that Internal Audit provide a report to future meetings of the Panel reporting progress made by management implementing agreed management actions in relation to all audit recommendations categorised as ‘High’ or ‘Medium’; and (d) otherwise note this report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 The 2021-22 Annual Plan was approved by the Audit and Scrutiny Panel in June 2021. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work are periodically reported to CMT and the Panel. This report fulfils that expectation. 2. Report Audit reviews completed in the period 2.1 Table 1 below provides an overview of completed Internal Audit reports since the last update to the Panel in March. These outputs were included in the 2021-2022 Internal Audit Plan. Work is currently underway on other assignments included in the 2022-23 Plan and this work will be reported to the Panel as it is completed. Table 1: Completed Internal Audit outputs in the period Subject Internal Audit Opinion 1. Enterprise Contract Reasonable assurance (Green-Amber) 2. City Deal Substantial assurance (Green) 3. Clyde Valley Waste Contract Substantial assurance (Green) 4. Business Continuity Planning Reasonable assurance (Green-Amber) 5. Risk Management Reasonable assurance (Green-Amber) 6. Supporting attendance Reasonable assurance (Green-Amber) 7. Investigation: Use of Credit Cards at ‘School A’ Not applicable 2.2 In addition to the above reports, a draft audit output has also been issued to management in respect of performance management. The findings, conclusions and recommendations in this draft report are still being discussed with management. Once finalised, this reports will be submitted to a future meeting of the Panel. 2.3 Appendix 1 provides a summary of those reports forming part of the annual programme of planned assurance work and investigation reports as required by the Internal Audit Charter and associated reporting protocol. 2.4 Appendix 2 contains detailed definitions of the categories used by Internal Audit when making recommendations, providing an audit opinion and on the extent of assurance which is being provided to management and Panel members on those systems or areas of Council operations examined by Internal Audit. The Panel should note that we have reviewed and refreshed our recommendation priority definitions with a move to High, Medium and Low categorisation (previously Red, Amber and Green) and updated the definitions to support the categorisation of audit recommendations. 2.5 This report excludes audit outputs produced for the North Lanarkshire IJB which are reported directly to its senior management team and audit committee.
Page 3
Commentary on completed planned ‘core’ Internal Audit work 2.6 The nature of Internal Audit exercises means that most reviews invariably find some scope for improvement, usually in the form of controls which are weak or only partially effective and, therefore, contain recommendations. I am pleased however, to be able to report that although we have identified a range of improvement actions and made a series of recommendations, all of the reports finalised in this period provided positive assurance. 2.7 Our work on the Enterprise Contract reflected on the current status of the project and considered the adequacy and effectiveness of the management arrangements in place, including the extent to which key elements of good project management, risk management and financial controls are in place. 2.8 We are satisfied that the governance arrangements in place are adequate and appear robust, and that the project is being managed in line with corporate expectations in a manner consistent with good practice. Financial control and risk management appear appropriately embedded in the governance of the project. 2.9 Despite our positive overall assessment of the project’s governance arrangements, it is recognised given the outcome of the ESCP procurement exercise, the scale of the Enterprise Project and the level of uncertainty around the market, that there remains a high level of risk to the successful delivery of the project, primarily due to potential issues around market failure and affordability. The Project Team and Board have recognised that market appetite remains a significant risk and continue to take action to try to mitigate this risk, predominantly through extensive market engagement and research. We also recognise that affordability will also be considered as part of the process of considering market responses to the Council’s proposals. 2.10 Although the outcome of recent market engagement does appear to indicate that the revised delivery model is more commercially attractive to potential bidders than the previous ESCP proposals, it is also recognised that there are limited markets/potential respondents for each of the two main activities for which bids are being sought and that current economic and general market volatility increases the risks of insufficient tender responses and/or tender responses which are not financially attractive. We consider that it is vital therefore that formal contingency plans are developed in response to the potential inability of the Council to be able to progress with part or all of the proposed project. I am pleased to confirm that management has responded positively to the recommendations contained within the report. 2.11 Our work on City Deal reviewed the adequacy and effectiveness of the Council's arrangements in respect of its participation in the Glasgow City Region (GCR) City Deal, including the extent to which the Council is adhering to key elements of the GCR City Deal Assurance framework with a focus on the processes surrounding the preparation and submission of grant claims, reviewing any relevant procurement/tendering arrangements and the appropriateness and effectiveness of the governance arrangements in place as they relate to the Council’s City Deal activities. 2.12 We are satisfied that the Council is complying with the GCR Assurance Framework 2019 and have categorised the audit as offering ‘substantial assurance’ as the control environment appears adequate and to have operated as intended with only a small number of minor discrepancies or areas for improvement identified. I am pleased to confirm that management has responded positively to the recommendations contained within the report. 2.13 Internal Audit is required to return an annual assurance statement to the Head of Audit at Glasgow City Council as the lead auditor for the GCR City Deal. Based on the results of this review and our other knowledge and understanding of the Council’s arrangements, we have returned an assurance statement for City Deal to Glasgow City Council Internal Audit which states that there are no significant matters that require to be raised which could have a material impact on the GCR Annual Assurance Statement for financial year 2021-2022.
Page 4
2.14 The Clyde Valley Waste Contract requires the ‘Lead Authority’s’ internal audit service to provide an annual statement of assurance regarding the project’s governance arrangements relating to payment processes and project monitoring arrangements to ensure these are compliant. The result of this review fulfils that requirement. 2.15 We have categorised the audit as offering ‘substantial assurance’ with a sound system of governance, risk management and internal controls in place which is consistent with the expectations placed upon the ‘Lead Authority’ as outlined in the contract and partnership documentation. We were also pleased to note that the CVWC Management Team (CMT) have discharged their obligations significantly as expected with appropriate arrangements in place for the monitoring of waste processing information, processing payments and monitoring the contractor’s performance. 2.16 Only a small number of issues of non-compliance and/or scope for improvement were identified and based on the results of this review, we have now returned an assurance statement to the Joint Steering Board which states that there are no significant matters that require to be raised which could have a material impact on the delivery of, or compliance with, the Project Agreement for 2021-2022. I am pleased to confirm that management has responded positively to the recommendations contained within the report. 2.17 The purpose of our work on Business Continuity Planning was to provide independent assurance on the extent of compliance across the Council with key corporate expectations. A particular focus was given to assessing the adequacy and effectiveness of the Council’s governance arrangements, policies and procedures in relation to business continuity planning including determining whether the Services have established business continuity plans and the extent to which these plans are being reviewed and tested; and assessing whether, where plans were invoked, these plans worked in line with expectations and any lessons learned were identified and communicated as appropriate. 2.18 We have categorised the results of work undertaken as part of this audit as offering ‘reasonable assurance’ meaning we consider that the Council has established adequate governance arrangements for business continuity planning and can demonstrate a track record of responding effectively to a range of ‘emergencies’. Although we were pleased to note that guidance notes and templates designed to assist Services in the preparation of business continuity (BC) and disaster recovery (DR) plans are in place, we have identified a need for improvements to the current framework for documenting individual Services’ BC/DR arrangements to enhance the quality and completeness of the corresponding plans, as at present there remains considerable variation in the depth and quality of plans being prepared by the Services. 2.19 Other areas for improvement are detailed at section 3 of the report and include that corporate and individual Services’ business continuity and disaster recovery arrangements would benefit from a more robust, formalised review process; and that formal testing of business continuity and/or disaster recovery arrangements needs to be undertaken consistently across the Council in line with corporate expectations. Once again, I am pleased to confirm that management has responded positively to the recommendations contained within the report. 2.20 The purpose of our work on Risk Management was to provide independent assurance that the Council has robust and effective risk management arrangements. The audit included a review of both corporate and Services’ arrangements for ensuring that all significant risks are identified, evaluated and controlled, risk registers have been prepared and are kept up-to-date, and appropriate arrangements are in place to review/monitor and report on risk. It also considered the extent to which management had taken action to address the recommendations contained in the previous Internal Audit report on this topic issued in September 2020.
Page 5
2.21 In line with the Internal Audit Charter and to ensure the independence of the Internal Audit function when reviewing an activity for which the Head of Audit and Risk has line management responsibility, this work was led by the Principal Auditor and planned and conducted without the involvement of the Head of Audit and Risk (who instead assumed the role of client during the audit process). 2.22 Overall, the report categorised the audit as offering ‘reasonable assurance’ meaning that Internal Audit consider that the Council’s risk management arrangements have continued to improve and embed since our last review. We are generally satisfied that these arrangements are being actively supported and promoted by senior management at both corporate and service level, and that risk management contributes towards the achievement of corporate objectives. We are also satisfied that there are adequate procedures in place at both corporate and Service levels for identifying and prioritising risks and identifying appropriate action to mitigate/manage those risks. Although at different stages of maturity, Services continue to improve and enhance their risk management arrangements. 2.23 We identified a number of other areas where we consider further management action is required and these are detailed in section 3 of the report and include the need for replacement and/or new corporate risks to be documented and assessed in line with the agreed timetable and the need to develop and implement a framework for monitoring compliance with the Risk Management Strategy to better facilitate assessment and overview of the adequacy and effectiveness of risk management arrangements within Services. Satisfactory management responses have been received to the issues and recommendations raised in the report. 2.24 Our work on Supporting attendance focused on the adequacy and effectiveness of the Council’s current arrangements for assessing compliance with expected procedures in relation to the management of sickness absence and on the robustness of relevant performance reporting. 2.25 Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council has put in place appropriate management arrangements to support compliance with the Supporting Attendance policy and for managing, monitoring and reporting sickness absences and that generally these arrangements are operating as expected. 2.26 We were pleased to note that the revised policy, supporting toolkits and eLearning module clearly set out the Council’s expected processes and that managers generally appeared aware of, and understood, their roles and responsibilities for complying with the policy. In addition, we were satisfied that there was appropriate support and advice available to managers via the Employee Relations team to manage/monitor individual absences and that absence levels/patterns were being actively monitored and reported to managers via Employee Relations and HR Business Partners. We did, however, identify a small number of areas where we consider that scope for improvement exists. These include that management needs to ensure that the policy is being effectively implemented in line with corporate expectations, that lessons learned/issues raised are acted upon/shared as appropriate and that its impact/effectiveness is regularly reviewed. We also considered that improvements are needed to the consistency and content of performance information presented to senior management and to ensure that process for preparing performance information is fully documented. 2.27 Satisfactory management responses have been received in response to the recommendations contained within the report. 2.28 Finally, one audit investigation report concluded in the period requires to be reported. This report was in respect of further work undertaken on corporate credit card use at School A. The need for this additional work arose during our earlier corporate review of credit and purchase cards on which we reported in late-2021. This highlighted several transactions, mainly relating to subscription services, at School A which we considered may not be in line with the relevant Council policy.
Page 6
2.29 Based on interviews with staff and information and records held within the school, we were unable to determine whether any of the benefits attached to the subscriptions have been utilised for personal use. However, our review has highlighted that the use of the credit card at School A is not adhering to many of the corporate expectations set out in the Policy and accordingly we recommended that Education and Families arrange for the relevant credit card be cancelled with immediate effect; and that a wider review be undertaken of the current use of credit cards within other schools with credit cards to establish whether there remains a valid business need for the remaining schools to continue to hold these cards. I am pleased to report that management have responded positively to the recommendations contained within the report. 2.30 There are no other issues arising from core Internal Audit work which I consider sufficiently significant to highlight to the Panel. Future follow-up reports will provide the Panel with information on the implementation, or otherwise, of all actions proposed by management in response to audit recommendations categorised as ‘High’ or ‘Medium’. 2.31 There are no other matters arising from areas of unplanned or ‘non-core’ work undertaken by Internal Audit in the period that I require to bring to your attention in accordance with the Internal Audit reporting protocol. Other Matters – Internal Audit Performance 2.32 In March 2021, the Panel were presented with a revised performance management framework for Internal Audit that was to be implemented from April 2021 for the 2021-22 audit plan (at Appendix 3). The majority of indicators are reported on an annual basis with data in respect of 2021-22 reported in the 2021-22 Internal Audit annual report (which is a separate agenda item at this meeting). 2.33 There are two indicators however that are subject to quarterly reporting. The first is about the implementation of agreed actions arising from Internal Audit reports by the implementation date. 61% of agreed actions have been implemented by the agreed implementation date in the period April to June 2022. Progress in implementing agreed actions is monitored and reported separately to the Panel each cycle. 2.34 The second performance indicator is about client satisfaction. Appendix 4 provides a summary of the results of four key questions we ask audit clients at the conclusion of each audit assignment. The results presented show generally positive feedback on the work of Internal Audit, with 92% of respondents agreeing that Internal Audit added value by assisting in providing assurance and that reports were relevant and constructive with findings clearly and accurately communicated. 2.35 Where management raise concerns over Internal Audit’s work, these matters are discussed with relevant senior management to fully understand the nature of any concerns and, where it is considered appropriate, to identify areas for improvement. We also seek Services’ views on what they liked or disliked about the audit process and comments received are used to inform future action plans for improving the service provided by Internal Audit. 3. Measures of success 3.1 Internal Audit reports annually on its performance to the Panel and is also subject to review annually by the Council’s appointed external auditors. 4. Supporting documentation Appendix 1 Summary of completed Internal Audit assignments Appendix 2 Audit gradings Appendix 3 Internal Audit performance framework Appendix 4 Internal Audit Client Feedback Results Ken Adamson, Head of Audit and Risk
Page 7
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective responses by management to the weaknesses, control issues and/or areas of improvement identified by Internal Audit will increase the likelihood of the Council achieving its ambitions and plans by more effectively mitigating potential threats to planned outcomes.
Page 8
Appendix 1 Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 1. Enterprise Contract Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 0 Medium 1 Low 0 This audit exercise was a high-level review designed to provide independent assurance that the Enterprise Project is being appropriately progressed and that key risks are being effectively managed. Our review reflected on the current status of the project and considered the adequacy and effectiveness of the management arrangements in place, including the extent to which key elements of good project management, risk management and financial controls are in place. This exercise was not intended to provide assurance or offer an opinion on any specific decisions being made by the Project Board or on the likely operational or financial viability of the project. Based on the results of our work, we have categorised this audit as offering ‘reasonable assurance’. We are satisfied that the governance arrangements in place are adequate and appear robust, and that the project is being managed in line with corporate expectations in a manner consistent with good practice. Financial control and risk management appear appropriately embedded in the governance of the project. We were pleased to note that a Project Brief, which forms the basis for the management, implementation and assessment of the Enterprise Project’s overall success has been prepared and there is a detailed project plan in place with key milestones, which is reviewed and updated on a regular basis to reflect current progress. We were also pleased to note that the Project Board meets regularly, is provided with an update on progress, makes decisions on key elements and appears to be providing effective scrutiny and challenge on the work being undertaken. Despite our positive overall assessment of the project’s governance arrangements, it is recognised given the outcome of the ESCP procurement exercise, scale of the Enterprise Project and uncertainty around the market, that there remains a high level of risk to the successful delivery of the project, primarily due to potential issues around market failure and affordability. The Project Team and Board have recognised that market appetite remains a significant risk and continue to take action to try to mitigate this risk, predominantly through market engagement and research. We also recognise that affordability will also be considered as part of the process of considering market responses to the Council’s proposals. Although the outcome of recent market engagement does appear to indicate that the revised delivery model is more commercially attractive to potential bidders than the previous ESCP proposals, it is also recognised that there are limited markets/potential respondents for each of the two main activities for which bids are being sought and that current general market volatility increases the risks of insufficient tender responses and/or tender responses which are not financially attractive. We consider that it is vital therefore that formal contingency plans are developed in response to the potential inability of the Council to be able to progress with part or all of the proposed project. Satisfactory management responses have been received in response to the recommendations contained within the report.
Page 9
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 2. City Deal Internal Audit Opinion: Substantial assurance (Green) Audit recommendations: High 0 Medium 0 Low 2 The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council's arrangements in respect of its participation in the Glasgow City Region (GCR) City Deal. This audit assessed the extent to which the Council is adhering to key elements of the GCR City Deal Assurance framework with a focus on the processes surrounding the preparation and submission of grant claims, reviewing any relevant procurement/tendering arrangements and the appropriateness and effectiveness of the governance arrangements in place as they relate to the Council’s City Deal activities. Based on the results of our work, we have concluded that: • we are satisfied that the Council is complying with the GCR Assurance Framework 2019; • the City Deal team has substantively complied with the Council’s General Contract Standing Orders in its procurement/tendering processes for City Deal projects; • the Council has continued to successfully apply expected governance arrangements in relation to the planning, controlling, monitoring and oversight of City Deal projects; and • City Deal grant claims in 2021-22 were properly prepared and submitted in accordance with the terms and conditions under which the grant award was made, the funds have been used for the intended purposes in accordance with the relevant terms and conditions under which the grant is made and the sums claimed are properly due. We have categorised the audit as offering ‘substantial assurance’ as the control environment appears adequate and to have operated as intended with only a small number of minor discrepancies or areas for improvement identified which are outlined in the Action Plan at Section 3 of the report. Internal Audit is required to return an annual assurance statement to Head of Audit at Glasgow City Council as the lead auditor for the GCR City Deal. Based on the results of this review and our other knowledge and understanding of the Council’s arrangements, we have returned an assurance statement for City Deal to Glasgow City Council Internal Audit which states that there are no significant matters that require to be raised which could have a material impact on the GCR Annual Assurance Statement for financial year 2021-2022. Satisfactory management responses have been received in response to the recommendations contained within the report.
Page 10
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 3. Clyde Valley Waste Contract Internal Audit Opinion: Substantial assurance (Green) Audit recommendations: High 0 Medium 1 Low 2 The Clyde Valley Waste Contract (CVWC) is a partnership between North Lanarkshire Council, East Dunbartonshire Council, East Renfrewshire Council, North Ayrshire Council and Renfrewshire Council for the provision of joint residual waste treatment and disposal services. The terms of the partnership are contained in the Inter Authority Agreement (IAA), which sets out the scope of the agreement and key obligations of the ‘Lead Authority’ and partner authorities as members. The IAA requires the ‘Lead Authority’s’ internal audit service to provide an annual statement of assurance regarding the project’s governance arrangements relating to payment processes and project monitoring arrangements to ensure these are compliant with the IAA, the Project Agreement and any other contract documents. The result of this review fulfils that requirement. We reviewed the Council's arrangements for undertaking the role of ‘Lead Authority’ against the criteria outlined in the IAA. We also assessed the Council’s CVWC Management Team (CMT) arrangements for ensuring that payment processes and project monitoring arrangements had operated in accordance with the key aspects outlined in the Authority Requirement. We have categorised the audit as offering ‘Substantial assurance’ with a sound system of governance, risk management and internal controls in place which is consistent with the expectations placed upon the ‘Lead Authority’ as outlined in the IAA. We were also pleased to note that the CVWC Management Team (CMT) have discharged their obligations significantly as expected with appropriate arrangements in place for the monitoring of waste processing information, processing payments and monitoring the contractor’s performance. A small number of issues of non-compliance and/or scope for improvement were identified and these have been outlined in Section 3 of the report. The most significant of these being the need to ensure the Joint Steering Board (JSB) is provided with all necessary and relevant information outlined in the IAA so they can fully and effectively discharge their key responsibilities. Based on the results of this review, we have now returned an assurance statement to the Joint Steering Board which states that there are no significant matters that require to be raised which could have a material impact on the delivery of the Project Agreement or compliance with the IAA for year 2021-2022 (Appendix 2 of the attached report). Satisfactory management responses have been received in response to the recommendations contained within the report.
Page 11
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 4. Business continuity planning Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 1 Medium 2 Low 1 The purpose of this audit was to provide independent assurance on the extent of compliance across the Council with key corporate expectations in respect of business continuity planning. A particular focus was given to assessing the adequacy and effectiveness of the Council’s governance arrangements, policies and procedures in relation to business continuity planning including determining whether the Services have established business continuity plans and the extent to which these plans are being reviewed and tested; and assessing whether, where plans were invoked, these plans worked in line with expectations and any lessons learned were identified and communicated as appropriate. The Council’s resilience and business continuity activities are co-ordinated by the Resilience Development Unit supported by the Corporate Resilience Management Team. The Council has a Corporate Resilience Plan which sets out clear expectations and specific roles and responsibilities for front-line responders when planning and preparing for emergencies. It is the responsibility of each Service area to detail their specific business continuity arrangements which would be enacted to ensure continuity of critical services and mitigate the impact of an emergency or other potential disruptions. These plans are reviewed and updated annually and are thereafter collated to form the Corporate Business Continuity Plan. Both the overall resilience and service business continuity arrangements have had cause to be deployed over the last few years in response to the Covid-19 pandemic and both corporate and service plans have been reviewed and updated accordingly. An audit of the Council’s response to the pandemic was undertaken in February 2021 which concluded that the Council had invoked relevant business continuity arrangements and the Corporate Resilience Plan, which enabled the Council to respond promptly and effectively in meeting their statutory obligations when Covid-19 was declared a global pandemic and continued, as far as possible, to deliver key critical services. We have categorised the results of work undertaken as part of this audit as offering ‘reasonable assurance’ meaning we consider that the Council has established adequate governance arrangements for business continuity planning and can demonstrate a track record of responding effectively to a range of ‘emergencies’. Although we were pleased to note that guidance notes and templates designed to assist Services in the preparation of business continuity (BC) and disaster recovery (DR) plans are in place, we have identified a need for improvement to the current framework for documenting individual Services’ BC/DR arrangements to enhance the quality and completeness of the corresponding plans, as at present there remains considerable variation in the depth and quality of plans being prepared by the Services. Other areas for improvement include: • corporate and individual Services’ business continuity and disaster recovery arrangements would benefit from a robust, formalised review process; and • formal testing of business continuity and/or disaster recovery arrangements needs to be undertaken consistently across the Council in line with corporate expectations. Satisfactory management responses have been received in response to the recommendations contained within the report.
Page 12
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 5. Risk management Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 0 Medium 3 Low 2 The purpose of this audit was to provide independent assurance that the Council has robust and effective risk management arrangements. The audit included a review of both corporate and Services’ arrangements for ensuring that all significant risks are identified, evaluated and controlled, risk registers have been prepared and are kept up-to-date, and appropriate arrangements are in place to review/monitor and report on risk. As part of this audit, we assessed the arrangements against good practice as identified by Audit Scotland in their ‘Best Value toolkit: Risk management’. We also considered the extent to which management had taken action to address the recommendations contained in the previous Internal Audit report on this topic issued in September 2020. The Council operates in a complex environment and faces multiple challenges in delivering against its priorities. Effective risk management arrangements are therefore essential and form a key part of good corporate governance. The Corporate Risk Team and wider risk network continue to develop risk management via activities such as the annual refresh of the Corporate Risk Register (CRR), quarterly reporting on key developments in risk management to the Corporate Management Team (CMT) and Audit and Scrutiny Panel (ASP), active participation in the review of the project management model to ensure appropriate focus and guidance on risk and providing risk support to a number of key projects across the Council. Overall, we have categorised the audit as offering ‘reasonable assurance’ meaning that we consider that the Council’s risk management arrangements have continued to improve and embed since our last review. We are generally satisfied that these arrangements are being actively supported and promoted by senior management at both corporate and Service level, and that risk management contributes towards the achievement of corporate objectives. We are also satisfied that there are adequate procedures in place at both corporate and Service levels for identifying and prioritising risks and identifying appropriate action to mitigate/manage those risks. Although at different stages of maturity, Services continue to improve and enhance their risk management arrangements and as such, there is scope for some further improvement. We have identified a number of areas where we consider further management action is required and these are detailed in section 3 of the report and include: • replacement and/or new risks need to be documented and assessed in line with the agreed timetable; • a framework for monitoring compliance with the Risk Management Strategy needs to be developed and implemented to facilitate assessment and overview of the adequacy and effectiveness of risk management arrangements within Services; and • improvements are required to current arrangements for ensuring that all relevant staff undertake the appropriate mandatory training for risk management Satisfactory management responses have been received in response to the recommendations contained within the report.
Page 13
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 6. Supporting attendance Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 0 Medium 2 Low 2 The purpose of the audit was to provide independent assurance on the adequacy and effectiveness of the Council’s current arrangements for assessing compliance with expected procedures in relation to the management of sickness absence and on the robustness of relevant performance reporting. Work undertaken during the audit included a high-level review of how management seeks to ensure, monitor and assess compliance with key aspects of the policy and whether issues arising from management reviews of compliance have been communicated to relevant management and, where appropriate, translated into specific actions which are then progressed. We also undertook a brief high-level review of the processes for compiling, communicating and monitoring sickness absence data. This included some limited substantive testing and re-performance of reported sickness absence data and consideration of the adequacy of management actions undertaken or planned in response to recent/current sickness absence performance. The Council’s current Supporting Attendance Policy (the Policy), approved by the Finance & Resource Committee in March 2021, sets out the processes expected to be followed in managing sickness absence across the Council. The policy covers all Single Status employees, with a separate policy, which is currently being refreshed, for teaching staff (expected completion date of December 2022). Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council has put in place appropriate management arrangements to support compliance with the Supporting Attendance policy and for managing, monitoring and reporting sickness absences and that generally these arrangements are operating as expected. We were pleased to note that the revised policy, supporting toolkits and eLearning module clearly set out the Council’s expected processes and that managers generally appeared aware of, and understood, their roles and responsibilities for complying with the policy. In addition, we were satisfied that there was appropriate support and advice available to managers via the Employee Relations team to manage/monitor individual absences and that absence levels/patterns were being actively monitored and reported to managers via Employee Relations and HR Business Partners. We have, however, identified a small number of areas where we consider that scope for improvement exists and have made some recommendations for management consideration/action. These are detailed at section 3 of the report and include: • management needs to ensure that the policy is being effectively implemented in line with corporate expectations, that lessons learned/issues raised are acted upon/shared as appropriate and that its impact/effectiveness is regularly reviewed; and • Improvements are needed to the consistency and content of performance information presented to senior management and to ensure that process for preparing performance information is fully documented. Satisfactory management responses have been received in response to the recommendations contained within the report.
Page 14
Internal Audit outputs: Audit opinion and commentary 7. Investigation report – Use of corporate credit card at School A Internal Audit Opinion: Not applicable The purpose of this audit was to undertake a more detailed review of the use of a corporate credit card at School A. The need for this additional work arose during our earlier corporate review of credit and purchase cards on which we reported in late-2021. This highlighted several transactions, mainly relating to subscription services, at School A which we considered may not be in line with the relevant Council policy. Based on interviews with staff and information and records held within the school, we were unable to determine whether any of the benefits attached to the subscriptions have been utilised for personal use. However, our review has highlighted that the use of the credit card at School A is not adhering many of the corporate expectations set out in the relevant corporate policy and accordingly we recommended that Education and Families arrange for the relevant credit card to be cancelled with immediate effect; and that a wider review be undertaken of the current use of credit cards within other schools with credit cards to establish whether there remains a valid business need for the remaining schools to continue to hold these cards. Satisfactory management responses have been received in response to the recommendations contained within the report.
Page 15
Appendix 2 Audit Gradings Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance There are minimal or minor control weaknesses that present low risk to the control environment. The control environment has substantially operated as intended although some minor errors have been detected. Very few or no improvements are needed. Green- Amber Reasonable Assurance There are some control weaknesses that present a low to medium risk to the control environment. The control environment has mainly operated as intended although errors have been detected. Some improvements should be made. Amber- Red Limited Assurance There are significant control weaknesses that present medium to high risk to the control environment. The control environment has not operated as intended. Significant errors have been detected. Substantial improvements should be made. Red No Assurance There are fundamental control weaknesses that present an unacceptable level of risk to the control environment. The control environment has fundamentally broken down and is open to significant error or abuse. Immediate and major changes need to be made. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but it is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 16
Appendix 3: Internal Audit performance framework Category Measure Internal Audit management Reported to Chief Executive and CMT Reported to A&SP (Quarterly) Reported to A&SP (Annual) 1. Delivery of Annual Plan Percentage completion of agreed plan X X X 2. Targeting Percentage of key corporate risks and key financial systems over which assurance provided X X X 3. LGBF - Efficiency Cost of Internal Audit per £ million revenue budget X X 4. LGBF - Efficiency % of productive hours delivered v Plan X X 5. Delivery / recommendations Percentage implementation of agreed actions by implementation date (cumulative year to date) X X X X 6. Delivery / other Number of significant irregularity / fraud investigations X X X 7. Customer satisfaction results Scores from customer satisfaction questionnaires (audit assignments) (cumulative year to date) X X X X 8. Customer satisfaction results Scores from key stakeholders (CMT and A&SP) questionnaires (overall performance of the function) X X X 9. Quality / standards Reliance placed by External Audit on the work of Internal Audit X X X 10. Quality/ standards Quality review outcomes – EQAR or internal self- evaluation X X X 11. Delivery of Annual Report Annual opinion /report prepared by 31 May annually X X X 12. Targeting Approval by CMT and A&SP of strategy and annual plan by 31 May annually X X X Internal management performance indicators 13. Efficiency Actual v planned days on completed assignments X 14. Efficiency Time between completion of fieldwork and draft reports being issued X 15. Efficiency Time between draft reports and final reports being issued X
Page 17
Appendix 4: Internal Audit Client Feedback Results Responses received from 13 clients related to 2021-22 assignments reported to the Panel (note: these covers audit assignments reported in the Internal Audit Progress Reports presented to the December 2021, March 2022 and September 2022 meeting of the Panel) Question Strongly Agree or Agree Neither agree nor disagree Disagree Internal Audit added value to my area by assisting in providing assurance and/or identifying weaknesses and/or improvements in relevant governance/business process and internal controls 92% 8% 0% Internal Audit findings were accurate and clearly communicated 92% 0% 8% The Internal Audit report made relevant, constructive and practical recommendations to help improve operations 92% 8% 0% Internal Audit staff were professional and courteous throughout the audit process 100% 0% 0%
Page 18
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0660.2022.001 Enterprise Project/A - FINDINGS AND REPORT/A06 20220524 Enterprise Project final report .docx 1 INTERNAL AUDIT REPORT ENTERPRISE PROJECT Contents 1. Executive Summary 2. Findings and Recommendations Appendix 1: Audit grading Appendix 2: Good practice toolkit – key questions Issued to: Head of Asset and Procurement Solutions, Commercial Contracts Manager Copied to: Project Development Manager, Deputy Chief Executive and Chief Executive Headlines This audit exercise was a high-level review designed to provide independent assurance that the Enterprise Project is being appropriately progressed and that key risks are being effectively managed. This report is the third in a series of reports, with previous audit reports in relation to the previous Enterprise Strategic Commercial Partnership (ESCP) having been issued in March 2020 and March 2021. The ESCP represented a significant, complex and challenging project in the Council’s programme of work and formed an important part of the Council’s ambitions. It was progressed to the procurement stage, but despite positive pre-procurement market engagement, the advertised opportunity failed to attract sufficient interest to enable the ESCP to proceed and the Project Board decided to discontinue the procurement. The Board recognised, however, that the ambition of the project remained valid and agreed that a revised delivery model should be developed. In September 2021, the Project Board agreed the revised delivery model, renamed the Enterprise Project. The revised model adopts a hybrid approach consisting of a blend of in-house delivery whilst continuing to deliver services through a range of third-party contracts and aims to deliver similar outcomes (over comparable timescales) as the ESCP by creating focused strategic relationships with a small number of private sector providers and developing a more internal ‘intelligent client’ function, building on internal commercial capacity and capability. Policy & Strategy Committee approved this delivery model in December 2021 and preparations are now well underway in advance of the expected procurement exercises in summer 2022. Our review reflected on the current status of the project and considered the adequacy and effectiveness of the management arrangements in place, including the extent to which key elements of good project management, risk management and financial controls are in place. As with previous exercises, we have undertaken an assessment of the current programme governance arrangements against corporate expectations and a good practice checklist prepared from a range of sources including National Audit Office (see Appendix 2). This exercise was not intended to provide assurance or offer an opinion on any specific decisions being made by the Project Board or on the likely operational or financial viability of the project. Based on the results of our work, we have categorised this audit as offering ‘reasonable assurance’. We are satisfied that the governance arrangements in place are adequate and appear robust, and that the project is being managed in line with corporate expectations in a manner consistent with good practice. Financial control and risk management appear appropriately embedded in the governance of the project. We were pleased to note that a Project Brief, which forms the basis for the management, implementation and assessment of the Enterprise Project’s overall success has been prepared and there is a detailed project plan in place with key milestones, which is reviewed and updated on a regular basis to reflect current progress. We were also pleased to note that the Project Board meets regularly, is provided with an update on progress, makes decisions on key elements and appears to be providing effective scrutiny and challenge on the work being undertaken. (continued overleaf) Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0660/2022/001 Date issued 24/05/22 Audit Team Lesley Armstrong and Paula Hendry
Page 19
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0660.2022.001 Enterprise Project/A - FINDINGS AND REPORT/A06 20220524 Enterprise Project final report .docx 2 Headlines (continued) The Preliminary Risk Assessment (PRA) originally prepared for the ESCP has been reviewed and updated for the new Enterprise Project to reflect changes to the risk profile- for the new model, and a project risk register which identifies known and likely/foreseeable risks has been prepared and is regularly reviewed and monitored. Additionally, a newly framed corporate risk has been created to reflect changes in project scope, expected timescales and ambitions the Council now wishes to achieve through this project. Despite our positive overall assessment of the project’s governance arrangements, it is recognised given the outcome of the ESCP procurement exercise, scale of the Enterprise Project and uncertainty around the market, there remains a high level of risk to the successful delivery of the project, primarily due to potential issues around market failure and affordability. The Project Team and Board have recognised that market appetite remains a significant risk and continue to take action to try to mitigate this risk, predominantly through market engagement and research. We also recognise that affordability will also be considered as part of the process of considering market responses to the Council’s proposals. Although the outcome of recent market engagement does appear to indicate that the revised delivery model is more commercially attractive to potential bidders than the previous ESCP proposals, it is also recognised that there are limited markets/potential respondents for each of the two main activities for which bids are being sought and that current general market volatility increases the risks of insufficient tender responses and/or tender responses which are not financial attractive. We consider that it is vital therefore that formal contingency plans are developed in response to the potential inability of the Council to be able to progress with part or all of the proposed project. We noted that the implications of market failure and actions required to take the project forward have been presented to and discussed by the Project Board and that the component parts of an alternative ‘Plan B’ were agreed. Perhaps understandably, however, management focus has remained on the procurement launch and a formal contingency plan has not yet been documented or timescales for preparing such a plan agreed. We have therefore raised a specific recommendation in this regard in section 3 of this report for management consideration.
Page 20
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0660.2022.001 Enterprise Project/A - FINDINGS AND REPORT/A06 20220524 Enterprise Project final report .docx 3 1. Executive Summary Objectives This audit exercise was a high-level review designed to provide independent assurance that the Enterprise Project is being appropriately progressed and that key risks are being effectively managed. The work reflected on the current status of the project and considered the adequacy and effectiveness of the management arrangements in place in respect of good project management, risk management and financial controls. These arrangements were assessed against corporate project management expectations and a good practice checklist, prepared by Internal Audit, based on a range of sources including the National Audit Office, HM Treasury and the Cabinet Office infrastructure and Projects Authority. In particular, we considered the following: • Is it clear what the current stage of the project is intended to deliver? Are short-term scope and milestones realistic, understood, clearly articulated and capable of being met? • Are there effective governance structures that provide periodic updates on progress/status and strong and effective oversight, challenge and direction? Does this include appropriate consideration of relevant risks and how key risks are being managed? • Are there appropriate financial controls and budget monitoring in place to ensure expenditure is in line with appropriated budgets and is subject to period review? Work undertaken involved discussions with key project staff and a detailed review of documentation to evidence the operation of relevant key processes and procedures. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 1 0 Key areas requiring management action (High) No areas requiring urgent management action have been identified. Good practice identified We noted the following areas of good practice during the audit: • The Enterprise Project has an appropriate and effective governance structure. There is a Project Board with a written terms of reference which clearly defines the responsibilities of Board members. The Project Board is chaired by the Head of Asset and Procurement Solutions, who is the Senior Responsible Officer (SRO), and membership includes relevant Heads of Service and senior officers, ensuring that it has the authority to make decisions and provide the necessary resources to support the delivery of the Enterprise Project. • The Project Board meets approximately every eight weeks, with additional meetings held should the need arise, and the minutes of these meetings confirm that the Board appears effective in providing oversight, challenge and direction. • A Project Brief has been prepared which defines the scope and requirement of the Enterprise Project and acts as a base document against which the Project Sponsor, SRO and Project Board can assess progress, direct change management and assess ongoing viability. The document also outlines the strategic objectives of the Project, together with its critical success factors. • There is a detailed project plan in place which details the key tasks required to progress the project, together with durations, target completion timescales and percentage completion. The project plan is reviewed on a weekly basis by the Project Team and updated as appropriate. Critical path activities are clearly identified on the project plan and these are a main focus of reporting to the Project Board to ensure that the Board is kept up to date with progress, that the required decisions are made at the right time and to drive the project forward at the correct pace.
Page 21
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0660.2022.001 Enterprise Project/A - FINDINGS AND REPORT/A06 20220524 Enterprise Project final report .docx 4 Good practice identified (continued) • The Preliminary Risk Assessment (PRA) prepared for the ESCP has been reviewed and updated for the Enterprise Project to reflect changes to the risk profile. A risk register, which identifies likely and foreseeable risks, has been prepared to supplement the PRA. The risk register has identified the impact and likelihood of each risk, and confirmed the controls in place, and actions required, to mitigate the risk. • The services of external advisors have been procured to provide relevant specialist advice and expertise (which is not available within the Council) to support the progression and successful implementation of the Enterprise Project. Funding for these external advisors has been secured for the Enterprise Project and the Project Board are provided with a financial update at each Board meeting. Other areas for improvement (Medium) One area for improvement was identified: • Formal contingency plans should be developed in response to the potential inability of the Council to be able to progress with part or all of the proposed project
Page 22
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0660.2022.001 Enterprise Project/A - FINDINGS AND REPORT/A06 20220524 Enterprise Project final report .docx 5 3. Action Plan Enterprise Contract 0660/2022/001 Ref Finding 1 Formal contingency plans should be developed in response to the potential inability of the Council to be able to progress with part or all of the proposed project A key action, undertaken by the Project Team, to mitigate the risk of market failure has been significant market engagement and research. Although this work has indicated that the revised delivery model is more commercially attractive that the previous ESCP, it has also indicated that there are limited markets for each of the two main procurements (corporate and housing property repairs and maintenance and roads maintenance ) to be undertaken in the coming months. Additionally, current market volatility including ongoing supply chain risks and inflationary pressures creates a higher risk that even if sufficient tender responses are received, these may not be financially attractive to the Council. We noted that the implications of market failure and actions required to take the project forward were presented to the Project Board in February 2022 and that the component parts of a ‘Plan B’ were agreed. The Project Team advised that the detailed development of ‘Plan B’ needs to be balanced with the progress of the current project plan and the resource/cost requirements involved and provided an indication of the timescales involved for the further development of the plan. We understand the focus to date has understandably remained on the procurement launch and that a formal contingency plan has not yet been documented or a detailed timeline for this included within the project plan Implication Recommendation Priority Management response Implementation Month/Year Without a robust and realistic contingency plan in place the Council may not be able to ensure continuity of service delivery and achievement of ambitions. The Enterprise Project Board should ensure that the key tasks required to fully document a contingency plan, including key milestones and lead times/critical path, is included in the project plan and thereafter monitor development of the contingency plan to ensure that an alternative ‘Plan B’ is available, and lead times/critical path are clearly understood should the project not be able to be progressed as currently envisaged. Medium Agree Graham Proudfoot, Commercial Contracts Manager The Project Board is aware of the significant risk of a lack of market appetite to participate in the phase 1 public procurement opportunities and the potential consequences of this. This risk has also been discussed separately with the SRO, Project Sponsor and Chief Executive. As noted in the finding above, the high-level actions required to develop and agree a Contingency Plan (the ‘Plan’) providing alternate delivery solutions, was considered and agreed by the Project Board in February 2022. Project resources have necessarily been focused on the work required to ensure the timely launch of the phase 1 procurements, however in parallel the Project Lead is taking advice from the project’s legal advisers which will help to further develop the detail of the Plan. Tasks related to the further development of the Plan have now been incorporated into the Project Plan. The Plan will be sufficiently developed by the end of July 2022 (the SPD submission deadline) at which time the level of market interest will be known. This will, if required, after appropriate engagement with the Project Board, CMT and Elected Members, allow the Plan to be enacted. July 2022
Page 23
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0660.2022.001 Enterprise Project/A - FINDINGS AND REPORT/A06 20220524 Enterprise Project final report .docx 6 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green - Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber - Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 24
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0660.2022.001 Enterprise Project/A - FINDINGS AND REPORT/A06 20220524 Enterprise Project final report .docx 7 Appendix 2 – Good practice toolkit – key questions Strategic Definitions and Preparation of Business Case 1 Has it been clearly documented what the programme/project is intended to achieve/deliver with realistic objectives and an understanding of what success looks like? 2 Has a detailed Project Business Case or equivalent been preapred which outlines the programme/project scope, expected deliverables, costs, affordability, risks, procurement route and high-level project plan? Note – in reviewing the project business case or equivalent consideration should be given to whether it clearly documents and demonstrates that: • the council is clear about the benefits expected and about how they will be achieved. • options have been identified and assessed. • project costs have been built up in a consistent manner, including, where appropriate, specific risks, optimism bias allowances, and realistic inflation costs. • project procurement routes and options have been fully explored and form part of the developed project business case. Governance 3 Has a Project Board or equivalent been established to undertake a high-level monitoring role for the project and ensure that decisions made regarding the project are adequately considered? 4 Does the Project Board or equivalent have clear terms of reference and it is chaired by the SRO and attended by all key people involved in the project? 5 Have clearly defined roles and responsibilities been documented for the SRO, Project Sponsor, Project Manager and Project Team? 6 Is there a distinct project/programme management team with authority and responsibility for delivering the programme? 7 Is the Board meeting regularly? Project Plan 8 Is there a high-level project plan and does it establish project/programme timescales? 9 Is the project plan broken down into manageable workstreams and relevant project milestones which are meaningful to the Project Board to allow accurate and frequent tracking of progress on the project and maximise visibility of inter-dependencies? 10 Does the project plan record and continually update its critical path? 11 Are critical path activities identified and used as a base timeline against which other activities and interdependencies are reported on? 12 As necessary, is analysis undertaken of the effects of any slippage on time, cost, scope or quality? Risk Management 13 Where appropriate was a Preliminary Risk Assessment (PRA) undertaken? 14 Is there clear evidence of appropriate consideration of risks which have the potential to undermine the success of the programme/project? Have these been recorded on a project risk register which includes an assessment of likelihood and impact and are the results used to inform the management of project risks? 15 Is up to date information on key risks regularly presented to the Project Board or equivalent? 16 Has a threshold been agreed at which risks require to be escalated? Are these arrangements working in practice?
Page 25
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0660.2022.001 Enterprise Project/A - FINDINGS AND REPORT/A06 20220524 Enterprise Project final report .docx 8 Procurement 17 Where procurement is required, are procurement activities being undertaken in a manner consistent with corporate expectations (i.e. compliance with CSOs, use of appropriate and legally compliant competitive processes designed to secure achievement of best value etc)? Planning – Benefits Realisation 18 Has a benefits realisation plan been prepared which details identified programme benefits, ways of measuring achievement of those benefits and benefit owners? Has the plan been approved by the Project Board? 19 Has current baseline performance been documented and is there an appropriate plan to establish what information needs to be captured to measure future impacts and/or changes in performance arising from the programme/project? Oversight and Scrutiny – Project Board 20 Are there arrangements in place to allow the SRO and Project Board to regularly monitor delivery of the programme/project against the project plan including costs v budget, achievement of key milestones and performance v timescales? 21 Do progress reports to the SRO/Project Board make appropriate use of expected reporting formats and/or include: • details of progress against pre-defined criteria on cost, time, quality and key project milestones; • reports on individual work packages/workstreams; • resources and funding used to date (including against expectation and progress); • details of any changes to previously approved plans/timelines/milestones; and • confidence in forward plans? 22 Where there are issues which are impacting (or are considered likely to impact) on the successful delivery of a programme/project (on the achievement of planned deliverables/outcomes, or to time, or to budget), have these issues been discussed and remedial actions identified? Are the implementation of these actions and their impact being monitored? 23 Is performance against the benefits realisation plan reviewed to determine whether the programme is on track to deliver intended benefits and outcomes? 24 Is the programme on track to deliver intended benefits? Oversight and Scrutiny – Elected Members 25 Are there regular reports to elected members on the progress of the programme/project? 26 Do reports to elected members provide a realistic overview of the progress of the programme/project to date (including costs v budget, achievement of key milestones and performance v timescales) to enable members to provide effective oversight and scrutiny? 27 Where appropriate, are any key risks or issues impacting (or likely to impact) on successful delivery highlighted and information provided as to what management is doing or plans to do to in response? 28 Where changes have been agreed by the Board to expected milestones/timescales/budgets have any material changes reported to elected members?
Page 26
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0630.2022.002 City Deal/A - Findings and Reports/A06a 20220606 CITY DEAL Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT CITY DEAL Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: City Deal Assurance Statement Issued to: Head of Financial Solutions (point 1) and Head of Planning and Regeneration (point 2) Copied to: City Deal Manager, Business Finance Manager, Deputy Chief Executive and Chief Executive Headlines The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council's arrangements in respect of its participation in the Glasgow City Region (GCR) City Deal. Internal Audit is required to return an annual assurance statement to Head of Audit at Glasgow City Council as the lead auditor for the GCR City Deal and this work will underpin the completion of the statement for 2021-22. This audit assessed the extent to which the Council is adhering to key elements of the GCR City Deal Assurance framework with a focus on the processes surrounding the preparation and submission of grant claims, reviewing any relevant procurement/tendering arrangements and the appropriateness and effectiveness of the governance arrangements in place as they relate to the Council’s City Deal activities. Based on the results of our work, we have concluded that: • we are satisfied that the Council is complying with the GCR Assurance Framework 2019; • the City Deal team has substantively complied with the Council’s General Contract Standing Orders in its procurement/tendering processes for City Deal projects; • the Council has continued to successfully apply expected governance arrangements in relation to the planning, controlling, monitoring and oversight of City Deal projects; and • City Deal grant claims in 2021-22 were properly prepared and submitted in accordance with the terms and conditions under which the grant award was made, the funds have been used for the intended purposes in accordance with the relevant terms and conditions under which the grant is made and the sums claimed are properly due. We have categorised the audit as offering ‘substantial assurance’ as the control environment appears adequate and to have operated as intended with only a small number of minor discrepancies or areas for improvement identified which are outlined in the Action Plan at Section 3. Based on the results of this review and our other knowledge and understanding of the Council’s arrangements, we have returned an assurance statement for City Deal to Glasgow City Council Internal Audit which states that there are no significant matters that require to be raised which could have a material impact on the GCR Annual Assurance Statement for financial year 2021-2022 (Appendix 2). Internal Audit Opinion (see definition at Appendix 1) Substantial assurance Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0630/2022/002 Date issued 06/06/22 Audit Team Elaine MacDonald, Paula Hendry and Hugh Shevlin
Page 27
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0630.2022.002 City Deal/A - Findings and Reports/A06a 20220606 CITY DEAL Final report v1.0 as issued.docx 2 1. Executive Summary Objectives This audit was a short and focused review involving Internal Audit assessing the Council’s arrangements and assessing the extent to which the Council is adhering to key elements of the GCR City Deal Assurance framework with a focus on: (1) the processes surrounding the preparation and submission of grant claims made in 2021-22; (2) the regularity and competency of any significant procurement/tendering arrangements undertaken since April 2021; and (3) whether appropriate governance arrangements are in place and operating in line with expected requirements outlined in the GCR governance/assurance framework. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 0 2 Key areas requiring management action (High) No key areas requiring urgent management action have been identified. Good practice identified We noted the following areas of good practice during the audit: • The Council has substantively complied with its General Contract Standing Orders in its procurement/tendering processes for City Deal projects; • The Council has established a series of governance arrangements in relation to the planning, controlling, monitoring and oversight of projects which is consistent with the requirements set out in the Glasgow City Region Assurance Framework 2019; and • Grant claims for 2020-21 have been properly prepared and submitted in accordance with the terms and conditions under which the grant award is made. Other areas for improvement (Medium) No other areas for improvement were identified.
Page 28
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0630.2022.002 City Deal/A - Findings and Reports/A06a 20220606 CITY DEAL Final report v1.0 as issued.docx 3 3. Action Plan CITY DEAL 0630/2022/002 Ref Finding 1 Grant claims appeared accurate, fairly stated and the expenditure incurred met the terms and conditions of the grant offer with only minor discrepancies identified. Although the results of our review of the Council’s grant claim processes was generally satisfactory, we noted that the Glasgow City Region PMO require that all grant claims are submitted to them directly by the relevant authorities S95 officer. During our review we noted that the completed grant claim document for Quarter 1 2021/22 was submitted on behalf of the Head of Financial Solutions (S95 officer) rather than in accordance with City Deal expectations. We also noted that relevant employee costs are capitalised to City Deal one period in arrears. However, some employee costs incurred in Period 2 2021/22 which should have been capitalised to City Deal in period 3, had not been posted until period 4. As a result of this minor timing issue, this expenditure was included in a later grant claim rather than the draw down grant claim for Quarter 1. Implication Recommendation Priority Management response Implementation Month/Year The Council may not be able to adequately demonstrate appropriate authorisation of key aspects of the procurement and/or grant claim processes. Expenditure may not be claimed on a timely basis and/or in accordance with the terms and conditions of the grant award. The Head of Financial Solutions should: (1) ensure that authorisation requirements set out by the GCR PMO are fully adhered to for all future grant claims; and (2) remind relevant City Deal staff of the need to ensure that, as far as possible, expenditure is claimed in the relevant quarter in accordance with the terms and conditions of the grant offer and expected practice. Low Agree Greg Telfer, Business Finance Manager May 2022
Page 29
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0630.2022.002 City Deal/A - Findings and Reports/A06a 20220606 CITY DEAL Final report v1.0 as issued.docx 4 3. Action Plan (continued) CITY DEAL 0630/2022/002 Ref Finding 2 Tendering processes were found to be substantively compliant with the Council’s Contract Standing Orders (CSO’s), with only a small number of minor discrepancies and/or areas for improvement identified. We reviewed a sample of procurement exercises for City Deal and noted: • the General CSO’s (section 18.5) set out the expectation that the secure electronic deposit box for tender documents should be unlocked by two officers. The ITQ Electronic Return Log for the drainage works at Strathclyde Road records that only one individual was present when the tenders were opened; and • the Selection Stage Summary Evaluation Form for the drainage works at Strathclyde Road contract was signed and dated as required by the Enterprise Category Manager, however, there is no record of a second officer undertaking any checks on the summary as required by the template. Implication Recommendation Priority Management response Implementation Month/Year Without fully completed documentation to support the tendering, evaluation and selection processes, the Council may not be able to adequately demonstrate appropriate robustness and transparency in its decision- making processes. The Head of Planning and Regeneration should remind all relevant City Deal staff of the importance of ensuring that all relevant procurement documentation is fully completed and signed in accordance with corporate expectations. Low Agree Lyndsay Noble, City Deal Manager. May 2022
Page 30
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0630.2022.002 City Deal/A - Findings and Reports/A06a 20220606 CITY DEAL Final report v1.0 as issued.docx 5 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 31
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0630.2022.002 City Deal/A - Findings and Reports/A06a 20220606 CITY DEAL Final report v1.0 as issued.docx 6 Appendix 2 Glasgow City Region – City Deal North Lanarkshire Council Assurance Statement 2021-2022 1. Purpose of Statement The purpose of this statement is to provide assurance that sound internal control and governance arrangements exist within North Lanarkshire Council, and that no material issues have been identified which may directly or indirectly have an effect on the delivery of the City Deal programme. Any issues which are identified will be used to inform the Glasgow City Region Annual Assurance Statement for financial year 2021-2022 2. Assurance by Head of Audit and Risk, North Lanarkshire Council North Lanarkshire Council seeks at all times to adhere to the laws and regulations relating directly to the financial statements and the laws, regulations and the local code of governance under which the organisation conducts its business. I confirm that any issues identified which may have a negative impact on the City Deal programme (such as cases of actual or potential non-compliance with relevant laws and regulations, significant failures in the control environment and all known or suspected cases of fraud) have been reported to the Chief Auditor of Glasgow City Council (previously, or as set out below). While I acknowledge that no system of control can ever give an absolute assurance that all transactions are properly processed, all errors have been prevented, and all policies and procedures have been fully implemented throughout the organisation there are no known material issues which have not been considered in the completion of this Assurance Statement. 3. Declaration There are, in my opinion, no significant matters that require to be raised in this statement which would have a material impact on the Glasgow City Region Annual Assurance Statement for financial year 2021-2022. It is my opinion that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s framework of governance, and financial controls in relation to City Deal for the year ended 31 March 2022. Ken Adamson Head of Audit and Risk, North Lanarkshire Council 17 May 2022
Page 32
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0640.2022.001 Clyde Valley Waste contract/A - Findings and Reports/A06a - 20220606 CV WASTE Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT CLYDE VALLEY WASTE CONTRACT Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: Assurance statement 2021-22 Issued to: Head of Regulatory Services and Waste Solutions, Copied to: Contracts Manager, Chief Executive and Deputy Chief Executive Headlines The purpose of this audit is to provide assurance on the adequacy and effectiveness of the Council’s arrangements in respect of its duties as ‘Lead Authority’ for the Clyde Valley Waste Contract. The Clyde Valley Waste Contract (CVWC) is a partnership between North Lanarkshire Council, East Dunbartonshire Council, East Renfrewshire Council, North Ayrshire Council and Renfrewshire Council for the provision of joint residual waste treatment and disposal services. The terms of the partnership are contained in the Inter Authority Agreement (IAA), which sets out the scope of the agreement and key obligations of the ‘Lead Authority’ and partner authorities as members. As ‘Lead Authority’, the Council had responsibility for sourcing and awarding the contract. Viridor was appointed in 2019 and details of the contractual arrangements are set out in a Project Agreement and supporting Authority Requirement agreed between North Lanarkshire Council and Viridor Clyde Valley Limited. The IAA requires the ‘Lead Authority’s’ internal audit service to provide an annual statement of assurance regarding the project’s governance arrangements relating to payment processes and project monitoring arrangements to ensure these are compliant with the IAA, the Project Agreement and any other contract documents. The result of this review fulfils that requirement. We reviewed the Council's arrangements for undertaking the role of ‘Lead Authority’ against the criteria outlined in the IAA. We also assessed the Council’s CVWC Management Team (CMT) arrangements for ensuring that payment processes and project monitoring arrangements had operated in accordance with the key aspects outlined in the Authority Requirement. We have categorised the audit as offering ‘Substantial assurance’ as we consider that on the basis of the current management of the contract to date, a sound system of governance, risk management and control is in place which is consistent with the expectations placed upon the ‘Lead Authority’ as outlined in the IAA. We were also pleased to note that the CVWC Management Team (CMT) have discharged their obligations significantly as expected with appropriate arrangements in place for the monitoring of waste processing information, processing payments and monitoring the contractor’s performance. A small number of issues of non-compliance and/or scope for improvement were identified and these have been outlined in Section 3. The most significant of these being the need to ensure the Joint Steering Board (JSB) is provided with all necessary and relevant information outlined in the IAA so they can fully and effectively discharge their key responsibilities. Based on the results of this review, we intend to return an assurance statement to the Joint Steering Board which states that there are no significant matters that require to be raised which could have a material impact on the delivery of the Project Agreement or compliance with the IAA for year 2021-2022 (Appendix 2). Internal Audit Opinion (see definition at Appendix 1) Substantial assurance (Green) Organisational impact (see definition at Appendix 1) Minor Report status FINAL Audit ref 0640/2022/001 Date issued 06/06/22 Audit Team Elaine MacDonald, Paula Hendry and Jacqueline Struthers
Page 33
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0640.2022.001 Clyde Valley Waste contract/A - Findings and Reports/A06a - 20220606 CV WASTE Final report v1.0 as issued.docx 2 1. Executive Summary Objectives This audit was a short and focused review involving Internal Audit assessing the Councill's arrangements against the requirements and expectations imposed on the Council by the Inter Authority Agreement for the Clyde Valley Waste Contract. The IAA requires the Lead Authority’s internal audit service to provide an annual statement of assurance regarding the project’s governance arrangements relating to payment process and project monitoring arrangements to ensure they have complied with the IAA, the Project Agreement and any other Contract Documents. This review fulfils this requirement with a focus on ensuring each aspect of the Project Tasks (Sch1 of the IAA) attributed to the Lead Authority, Project Director and Contract Manager have been complied with. We also reviewed whether the Lead Authority has in place robust data collection processes from which to gather reliable waste processing information in a timely manner, and whether the Lead Authority regularly monitors Viridor’s arrangements, performance updates, action plans and risk registers to ensure they are being addressed and achieved in a manner consistent with the Project Agreement. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 1 2 Key areas requiring management action (High) No areas requiring urgent management action have been identified. Good practice identified We noted the following areas of good practice during the audit: • The Council has appointed a Project Director, Contract Manager and supporting contract management team with responsibility for monitoring and reviewing performance and delivery; • Terms of Reference outline the role and remit for the Joint Steering Board. The Board meets regularly and is attended by key contract representatives, including a nominated party from each authority. The Contract Manager submits a service report to the Board meetings; • Contractor monthly unitary charge invoices are supported by the contractor’s monthly performance report, spreadsheets of monthly waste activity and weighbridge turnaround times. Costs are promptly and accurately recharged to each authority in line with the contract; • The Contractor produces Monthly, Quarterly and Annual performance reports in the format set out in the Authority requirements document; and • The Contract Management Team undertakes their own monthly site visits to satisfy itself of the adequacy and accuracy of the contractor’s performance monitoring processes. A checklist based upon the KPIs is populated for each visit and retained as evidence. Other areas for improvement (Medium) One area for improvement was identified: • To assist the Joint Steering Board (JSB) to discharge their responsibilities fully and effectively, regular updates on contract risk and revisions to the Contract Management Plan (CMP) need to be periodically presented to them.
Page 34
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0640.2022.001 Clyde Valley Waste contract/A - Findings and Reports/A06a - 20220606 CV WASTE Final report v1.0 as issued.docx 3 3. Action Plan CLYDE VALLEY WASTE CONTRACT 0640/2022/001 Ref Finding 1 For the Joint Steering Board (JSB) to discharge their key responsibilities fully and effectively, regular updates on contract risk and revisions to the Contract Management Plan (CMP) need to be periodically presented to them. A joint steering Board (JSB) has been formed to oversee and monitor the operation and performance of the Project and the management of the project Director and Contract Manager. The IAA requires the Contract Manager to present a draft Contract Management Plan (CMP) to the JSB by 31 October in each contract year and the JSB should approve this plan no later than 31 December in each contract year. The CMP has not been presented to the JSB since 2019. We understand the CMP is currently at its 6th revision The Lead Authority is required to present key information to the JSB at their periodic meetings. Much of this is included in the Contract Manager’s progress report, budget and finance reports and other topical reports as required. We were pleased to note that there is a contract risk register which is regularly reviewed and updated by the CMT and that previously special meetings to discuss risk that have changed have been held with the JSB. However, from our review of recent reports presented and matters minuted as discussed at JSB meetings we noted that no formal update on the consideration and monitoring of contract risk issues has been provided to the JSB. Implication Recommendation Priority Management response Implementation Month/Year If key information is not made available to the JSB in a timely manner it may impact on the ability of the JSB to enable it to review key issues and/or ensure that the project delivers the desired outcomes for the partner authorities. Management should ensure that: (1) The CMP is presented annually to the JSB in accordance with the expectations set out in the IAA; and (2) The JSB establish a formal risk tolerance for risks to be escalated to them and that risk is thereafter reported to the board in accordance with this. We consider that if no risks breach the threshold established, this should also be confirmed to the Board in the Contract Manager’s progress report. Medium Agree Jackie Lyttle, Contract Manager (1) Changes to the CMP will be presented as they are required to the JSB. However, the Contract Manager report will also include a section that states if there has been no change. (2) The risk register will be reported and presented to the JSB at the first JSB of the year (June 2022). The Contract Manager will also recommend to the JBS that if a risk moves to high after it has been mitigated and/or a risk changes more than one scale point, e.g. low to high or very low to medium it will be presented to the Board. June 2022
Page 35
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0640.2022.001 Clyde Valley Waste contract/A - Findings and Reports/A06a - 20220606 CV WASTE Final report v1.0 as issued.docx 4 3. Action Plan (continued) CLYDE VALLEY WASTE CONTRACT 0640/2022/001 Ref Finding 2 Information provided by the contractor needs to address all obligations set out in the Authority Requirements. The Authority Requirement sets out the obligation on the contractor to provide key information to the Lead Authority on a regular basis. We noted that Viridor (the contractor) provide Monthly, Quarterly and Annual Reports to the CMT that significantly address expected issues including identified actions and their outcomes, performance monitoring outcomes, environmental monitoring and complaints. However, we noted some areas where there is scope to enhance current reporting to ensure clear visibility of all relevant aspects of the ‘Authority Requirements’ per the Project Agreement including: • complying with best practice by providing, updating and reissuing the Service Delivery Plans, Operating Manuals, Quality Plans and Health and Safety Plans on a regular basis. During our testing we noted that none of these had been updated since the original tender process in 2019. We understand this was due to Viridor being taken over in July 2021 and changes to working arrangements during the COVID pandemic period; and • quarterly service reports could provide more details on recruitment activity and how the contractor engages with SME development, social enterprise organisations and community education and awareness. Implication Recommendation Priority Management response Implementation Month/Year The Council (as ‘Lead Authority’) may fail to fully discharge its responsibilities to ensure that the Authority Requirements are fully complied with. Management should ensure that sufficient information is provided to the JSB to demonstrate that all relevant aspects of the ‘Authority Requirements’ per the Project Agreement, are being addressed. In particular: (1) confirmation, at regular intervals, that Service Delivery Plans, Operating Manuals, Quality Plans and Health and Safety Plans, have been updated and re-issued; and (2) considering how appropriate details on recruitment activity, engagement and involvement with SME development and social enterprise organisations and community education and awareness activities can be included in the reports presented to the JSB. Low Agree Jackie Lyttle, Contract Manager (1) The contractor is updating the Service Delivery plans, H&S and Quality Plans and they should be complete by end of June 2022. These are reviewed annually as per the contract. The delay for the latest versions has been due to Covid, sale of Viridor and staffing issues at Viridor. The Contract Manager has however stated that if they are not complete by end June/early July at the latest KPI’s will be deducted. The JSB will be updated when they are complete and after the annual review going forward. (2) The Community Benefit information from the annual report will be included in the Contract Manager’s report for the June meeting of the JSB. July 2022
Page 36
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0640.2022.001 Clyde Valley Waste contract/A - Findings and Reports/A06a - 20220606 CV WASTE Final report v1.0 as issued.docx 5 3. Action Plan (continued) CLYDE VALLEY WASTE CONTRACT 0640/2022/001 Ref Finding 3 Monies due to the contractor by the Lead Authority and from partner authorities to the Lead Authority are not always settled in a timely manner and/or in accordance with contractual expectations. There are clear arrangements that set out the payment terms for settlement of monies due to the contractor by the Lead Authority and by partner authorities to the Lead Authorities. These are: • Section 45.4 of the Clyde Valley Residual Waste Project Agreement (with Viridor) requires that the Lead Authority (NLC) shall pay the amount stated in any invoice submitted under Clause 45.2 (Report and Invoice) by the final Business Day of the relevant month or Contract Month (as applicable) in which such invoice is received; and • Section 12.6 of the Inter Authority Agreement states that each Authority shall make arrangements to pay their Payment Proportion to the Lead Authority in cleared funds by the 25th day of the month in which the instruction for payment or invoice is served (the “Due Date”). During our testing we noted that: • of the last twelve monthly invoices from Viridor, three of these had not been settled by the Lead Authority (NLC) within the expected timeframe; and • invoices are raised by North Lanarkshire Council to partner authorities on a monthly basis within 10 days of the date of the Viridor invoice in accordance with the IAA. However, these are often not settled by the partner Council by the 25th of the month in which the invoice was sent. Implication Recommendation Priority Management response Implementation Month/Year There is a risk that late payment penalties are incurred where payments are not settled in accordance with agreed arrangements. Management should ensure that: (1) contractor invoices are settled within the required settlement period; and (2) Partner authorities are reminded of their obligation under the IAA to settle recharged MUC invoices with the Lead Authority within agreed terms. Low Agree Jackie Lyttle, Contract Manager (1) Discussions have been held with NLC creditors team (May 2022) to ensure that invoices are treated as urgent and email header wording to highlight the invoice as such in the emails has been agreed. This has been updated in the CVWMC processes file. (2) Although partner authorities are reminded that payment is due within 25 days, the CMT will issue an email to both technical and finance officers to remind them and the Contract Manager will also include this in the JSB report and remind the Board of the implications for late payment to NLC. June 2022
Page 37
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0640.2022.001 Clyde Valley Waste contract/A - Findings and Reports/A06a - 20220606 CV WASTE Final report v1.0 as issued.docx 6 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 38
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0640.2022.001 Clyde Valley Waste contract/A - Findings and Reports/A06a - 20220606 CV WASTE Final report v1.0 as issued.docx 7 Appendix 2 Clyde Valley Waste Contract assurance statement for year ending 31 March 2022 ASSURANCE STATEMENT FOR THE YEAR ENDING 31 MARCH 2022 1. Purpose of Statement The purpose of this statement is to provide assurance that adequate and effective internal control and governance arrangements exist within North Lanarkshire Council in respect of its duties as Lead Authority for the Clyde Valley Waste Contract, and that no material issues have been identified which may directly or indirectly have an effect on the delivery of the contract. 2. Assurance by the Head of Audit and Risk, North Lanarkshire Council North Lanarkshire Council always seeks to adhere to all relevant laws and regulations and the local code of governance under which the organisation conducts its business. While I acknowledge that no system of control can ever give absolute assurance that all transactions are properly processed, all errors have been prevented, and all policies and procedures have been fully implemented throughout the organisation, based on the results of our audit work, I can confirm there are no known material issues which have not been considered in the completion of this Assurance Statement. 3. Declaration There are, in my opinion, no significant matters arising from our audit work that require to be raised with the Joint Steering Board for financial year 2021-2022 and it is my opinion that the Council’s procedures which have been designed to ensure proper governance and financial control in relation to Clyde Valley Waste Contract matters are adequate and consistent with the Inter Authority Agreement, the Project Agreement and other Contract Documents and have operated effectively in the year ending 31 March 2022. Ken Adamson CPFA Head of Audit and Risk North Lanarkshire Council 6 June 2022
Page 39
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 1 INTERNAL AUDIT REPORT BUSINESS CONTINUITY PLANNING Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Head of Regulatory Services and Waste Solutions Copied to: Resilience Development Co-ordinator, Chief Executive and all other members of CMT Headlines The purpose of this audit was to provide independent assurance on the extent of compliance across the Council with key corporate expectations in respect of business continuity planning. A particular focus was given to assessing the adequacy and effectiveness of the Council’s governance arrangements, policies and procedures in relation to business continuity planning including determining whether the Services have established business continuity plans and the extent to which these plans are being reviewed and tested; and assessing whether, where plans were invoked, these plans worked in line with expectations and any lessons learned were identified and communicated as appropriate. The Council’s resilience and business continuity activities are co-ordinated by the Resilience Development Unit supported by the Corporate Resilience Management Team. The Council has a Corporate Resilience Plan which sets out clear expectations and specific roles and responsibilities for front-line responders when planning and preparing for emergencies. It is the responsibility of each service area to detail their specific business continuity arrangements which would be enacted to ensure continuity of critical services and mitigate the impact of an emergency or other potential disruptions. These plans are reviewed and updated annually and are thereafter collated to form the Corporate Business Continuity Plan. Both the overall resilience and service business continuity arrangements have had cause to be deployed over the last few years in response to the Covid-19 pandemic and both corporate and service plans have been reviewed and updated accordingly. An audit of the Council’s response to the pandemic was undertaken in February 2021 which concluded that the Council had invoked relevant business continuity arrangements and the Corporate Resilience Plan, which enabled the Council to respond promptly and effectively in meeting their statutory obligations when Covid-19 was declared a global pandemic and continued, as far as possible, to deliver key critical services. We have categorised the results of work undertaken as part of this audit as offering ‘reasonable assurance’ meaning we consider that the Council has established adequate governance arrangements for business continuity planning and can demonstrate a track record of responding effectively to a range of ‘emergencies’. Although we were pleased to note that guidance notes and templates designed to assist Services in the preparation of business continuity (BC) and disaster recovery (DR) plans are in place, we have identified a need for improvement to the current framework for documenting individual Services’ BC/DR arrangements to enhance the quality and completeness of the corresponding plans, as at present there remains considerable variation in the depth and quality of plans being prepared by the Services. Other areas for improvement are detailed at section 3 of this report and include: • corporate and individual services’ business continuity and disaster recovery arrangements would benefit from a robust, formalised review process; and • formal testing of business continuity and/or disaster recovery arrangements needs to be undertaken consistently across the Council in line with corporate expectations. Internal Audit Opinion (see definition at Appendix 1) Reasonable Assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0900/2022/010 Date issued 20/07/22 Audit Team Lynn McCrum, Paula Hendry and Hugh Shevlin
Page 40
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 2 1. Executive Summary Objectives The purpose of this audit was to provide independent assurance on the extent of compliance across the Council with key corporate expectations in respect of business continuity planning. The key control objectives reviewed and tested during the audit considered whether: • the Council have adequate and effective governance arrangements, policies and procedures in relation to business continuity planning; • there is evidence that Services have established and are regularly reviewing their business continuity plans; • there is evidence that Services are undertaking appropriate testing of business continuity plans; and • where business continuity plans have been required to be actioned, the plans worked in line with expectations and appropriate lessons were identified. Testing was undertaken on both corporate arrangements and a sample of individual service areas’ BC and DR arrangements. The review did not specifically consider the local and/or national response to Covid-19 where local arrangements have already been considered by Internal Audit and/or where the Council will, with local partners, continue to be involved in wider reviews regarding lessons to be learned. In addition, the review did not consider the adequacy and effectiveness of the ICT Disaster Recovery Plan. This will be reviewed and considered as part of an exercise on Cyber Security, which is currently underway. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 1 2 1 Key areas requiring management action (High) The following key area requiring urgent management action has been identified: • Improvements are required to the framework in place for documenting individual Services’ business continuity and disaster recovery arrangements to enhance the quality and completeness of the corresponding plans. Good practice identified We noted the following areas of good practice during the audit: • The Resilience Development Unit, under the strategic direction of the Head of Regulatory Services and Waste Solutions, is responsible for co-ordinating the Council’s business continuity activities. They are supported in this by the Corporate Resilience Management Team. • The Council have produced and issued a Corporate Resilience Plan and a Corporate Business Continuity Plan. The Corporate Resilience Plan is reviewed on a biennial basis and the Corporate Business Continuity Plan reviewed and updated annually. • The Council has established a network of Business Continuity Champions across all areas of the Council to co-ordinate the review and update of Service’s business continuity arrangements. • Heads of Service are required to submit an annual assurance return confirming that they have reviewed their business continuity plans and providing details of which critical activities within their Business Continuity Plans have been subject to testing. • An annual report is submitted to the CMT and elected members providing an update on progress in relation to resilience planning and business continuity.
Page 41
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 3 Other areas for improvement (Medium) Two other areas for improvement were also identified: • Corporate and individual services’ business continuity and disaster recovery arrangements would benefit from a robust, formalised review process; and • Formal testing of business continuity and/or disaster recovery arrangements needs to be undertaken consistently across the Council in line with corporate expectations.
Page 42
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 4 3. Action Plan Business Continuity Planning 0900/2022/010 Ref Finding 1 Improvements are required to the framework in place for documenting individual Services’ business continuity and disaster recovery arrangements to enhance the quality and completeness of the corresponding plans. Individual service areas are responsible for detailing the specific business continuity (BC) and disaster recovery (DR) arrangements which would be enacted, as appropriate, to mitigate the impact of any emergency or disruption and ensure that critical services are maintained in the event of potential incidents occurring which could impact on delivery of their operational activities. Standard business continuity guidance has been devised to outline corporate expectations and enable a more consistent approach towards business continuity planning across all Council services. This guidance includes templates to be completed by individual service areas for inclusion in the Corporate Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP). While the guidance and templates provide an overview for Services to document their BC and DR arrangements, we consider that neither the guidance nor the templates provide sufficient detail around the expected content of the BCP and Annexe A (DRP) documents. In particular there is a lack of detail or guidance around what constitutes a critical activity; how categorisation of timeframes for recovery should be decided on; and how the critical activities/functions and potential hazards or risks should be identified, assessed and reviewed. Further, we consider that the templates in their current format do not appear to provide the most appropriate or effective mechanism for Services to document BC and DR arrangements. From our perspective, a shift from critical activity being the driving force to a focus on what scenarios might impact on the achievement of the Service areas objectives may yield better plans. This shift would allow Services to identify and fully document response plans which clearly detail their key areas of service delivery with corresponding realistic timescale for recovering/reinstating these, considering the precise nature of the potential emergency or disruption, and the actions/procedures necessary to fully ensure continuity of service. We also consider that there appears to be little or no benefit to the collation of individual service submissions into a corporate document as is currently the case. Our review of a small sample of individual service areas’ BCP and DRP (Annexe A) returned similar results to our review of this area in 2018. Audit testing has highlighted that there remains considerable variation in the depth and quality of the content of plans being prepared by the service areas. We noted that: • the BCP/DRPs are predicated on the identification of critical activities within Service areas. We noted many instances where we consider that the documented BC and DR arrangements were not always reflective of all critical activities pertinent to the service area (either inclusion of activities not deemed critical or omission of activities that appear critical in nature); • instances where the ‘critical activity’ column included detail on a scenario which has the potential to impact on service delivery but did not identify the related activity; • many of the Plans do not contain sufficient detail in respect of the methodology and processes which require to be followed to ensure that critical services are maintained or resumed in the event of an emergency incident which could impact on service delivery (including key personnel and resources); • in documenting the response procedures for the activity identified it is not clear that consideration has been given by Services to the necessary actions to ensure that the activity will be maintained or restored in the timescale listed in the BCP (e.g., 0-24 hours, 1-3 days, etc) • BCP/DRPs do not always detail alternative arrangements to be invoked where the critical services are likely to be unavailable for a prolonged period of time. A significant proportion of critical activities are dependent on ICT systems/applications. We noted from a high-level review of Service BCP/DRPs that the detailed responses in these plans do not always appear to take into consideration the recovery timescales stated in the ICT Disaster Recovery Plan for their individual system(s)/application(s). Indeed, there were instances where the individual service areas’ arrangements did not fully detail the ICT system(s)/application(s) which form part of their critical services and therefore no consideration was given, and/or documented, in respect of the alternative arrangements which would need to be invoked should the system/application be unavailable for any prolonged period of time. (Continued over page)
Page 43
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 5 3. Action Plan Business Continuity Planning 0900/2022/010 Implication Recommendation Priority Management response Implementation Month/Year Without, appropriate and detailed guidance, the documented business continuity arrangements may not fully consider the impact of potential emergency situations on all critical services and the necessary steps to minimise disruption to these services. Resulting plans may be incomplete and/or not adequate resulting in services not being capable of being restored in line with Service and/or corporate expectations Management should: (1) undertake a formal review of the current framework, including consideration of the specific issues raised above, to ensure that relevant guidance supports the production of robust and comprehensive Service business continuity plans; and (2) ensure the timely implementation of the results of the above review including establishing clear timescales for how individual service areas should revisit their BCP/DRPs to comply with any revised guidance. High Agree Aileen McMann, Resilience Development Coordinator The proposed implementation dates reflect the extensive nature of the actions required to be taken and the existing timelines in place for the preparation and submission of the individual service areas’ business continuity and disaster recovery arrangements. (1) A formal in-depth review of the current framework for business continuity planning will be undertaken. This review will consider each of the issues raised in the finding and in conjunction with a review of best practice, revised detailed guidance and business continuity plan templates will be devised which will enable service areas to adjust their business continuity arrangements to reflect the new corporate approach. (2) Heads of Service will be asked to undertake a review of their business continuity and disaster recovery arrangements in line with revised guidance and templates. Clear timelines will be established and communicated to Heads of Service ensuring the revised business continuity/disaster recovery plans are submitted to the Resilience Development Unit prior to the end of September 2023. February 2023 September 2023
Page 44
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 6 3. Action Plan (continued) Business Continuity Planning 0900/2022/010 Ref Finding 2 Corporate and individual services’ business continuity and disaster recovery arrangements would benefit from a robust, formalised review process. Similar to our findings on business continuity reported in 2018, we have again found that there is currently a lack of effective oversight, scrutiny and challenge of the Services’ business continuity arrangements. Whilst we acknowledge it is the responsibility of Services to identify critical activities and document corresponding BC/DR arrangements, we noted that there has been no formal review of plans and/or consideration corporately as to whether activities have been categorised into the most appropriate timeframes and nor is there any form of peer review or scrutiny of these plans. There have been a number of structural changes within the Council over the last two years which has resulted in various functions and service areas being reallocated and included within the remit of a different Head of Service. The most recent BCP and DRPs do not fully reflect these structural changes. A review of the documented arrangements for both BC and DR highlighted issues which could have been identified had the plans been subject to review. These include duplication of some service arrangements, omission of some service areas and inclusion of incorrect documentation being collated into the corporate business continuity and disaster recovery plans. Implication Recommendation Priority Management response Implementation Month/Year A lack of, or Inadequate, oversight, scrutiny and challenge of BC and DR plans may impact on the quality and robustness of such plans. Management should introduce a formalised review process which subjects proposed business continuity and disaster recovery plans to effective review and/or challenge. This should include ensuring that these arrangements sufficiently detail the methodology and processes which will enable critical activities to be maintained or resumed in the event of an incident which could impact on service delivery and that all functions/service areas of the Council are included in these plans. Medium Partially Agree Aileen McMann, Resilience Development Coordinator The introduction of additional scrutiny/peer reviews was considered when the initial guidance was introduced and the decision made to wait until this guidance had time to be embedded in the process before considering introducing additional reviews. In light of the findings highlighted both above and in previous audits, it is agreed that additional scrutiny should be introduced to ensure a more consistently robust approach across all service areas. The Resilience Development Unit (RDU) will undertake a sample of random checks on those activities under the 0–24-hour priority timeline across all service areas. However, it will remain the responsibility of the individual service area to assess which activities should be included under which priority timeline. As part of the review highlighted in the response to Action Plan Ref 1(2) above, Heads of Service will be required to review the Plans for their Service to ensure that all individual service areas under their remit are included, the correct documentation has been used and the arrangements sufficiently detail the methodology and processes which will be required to enable critical activities to be maintained or resumed in the event of an incident which could impact on service delivery. On completion of the Plans, the RDU will undertake a review of the arrangements to ensure that these are consistent with corporate expectations although the effectiveness of the proposed responses cannot be assessed by the RDU and this will remain the responsibility of individual Service areas. September 2023
Page 45
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 7 3. Action Plan (continued) Business Continuity Planning 0900/2022/010 Ref Finding 3 Formal testing of business continuity and/or disaster recovery arrangements needs to be undertaken consistently across the Council in line with corporate expectations. Annual Assurance Returns are required to be completed by each of Head of Service and submitted to the Resilience Development Unit. The purpose of these returns is to demonstrate that each service area has reviewed their BCP to take account of any change in circumstance to their business activity and also to provide examples of which business areas have had their BCP subject to testing. We understand that the content of the Annual Assurance Returns submitted is not currently reviewed by the Resilience Development Unit. The Business Continuity guidance states that an integral part of any Business Continuity arrangement is to ensure that elements of the plan are regularly tested and reviewed and as a minimum it is recommended that at least one area of each service area’s plan is tested through a table-top exercise on an annual basis. In the last two years the Covid pandemic was viewed as a live testing and training exercise in terms of both overall resilience and business continuity arrangements and thus the Resilience Development Unit deemed that there was no requirement for arrangements to be tested by individual services. It should be noted, however, that there were some service areas where testing was carried out and this has been detailed on their Annual Assurance Return. Implication Recommendation Priority Management response Implementation Month/Year The absence of regular testing of planned business continuity and disaster recovery arrangements may lead to an increased risk that these arrangements are ineffective and/or inadequate in the event of an emergency. Management should ensure that: (1) a formal programme of future planned tests is prepared and implemented across all Services to ensure appropriate testing of all business continuity and disaster recovery arrangements. Testing should be risk-based, proportionate and include table-top exercises, structured walkthroughs and disaster simulation testing as appropriate; (2) testing and review templates, as referenced in the guidance, are completed by all service areas recording details of all such testing undertaken including: the outcomes of testing; lessons learned and improvement actions identified; (3) once completed, testing and review templates referenced at (2) above are reviewed by the Resilience Development Unit for each service area and lessons learned collated into a document for sharing across Services; and (4) Annual Assurance Returns are reviewed and a summary thereafter prepared, detailing testing undertaken in the year and the subsequent outcomes of such testing, for inclusion in the annual report on resilience planning submitted to CMT and elected members. Medium Agree Aileen McMann, Resilience Development Coordinator and Andrew McPherson, Head of Regulatory Services and Waste Solutions Implementation of the recommendations from this audit will place additional asks on the Resilience Development Unit. Although this will enhance the overall approach to business continuity across the Council, it must also be recognised that this team is one of the least resilient services within the Council with a staffing compliment of 1.5FTE. To address this and provide capacity to both introduce and fulfil the additional points raised in the audit recommendation, the Head of Regulatory Services and Waste Solutions will pursue an increase in resource within the Unit to 2FTE. (1) Heads of Service will be asked to undertake this task as part of the review highlighted in the response to Action Plan Ref 1(2) above; (2) As per point (1) above; (3) Included within the revised guidance under ‘Testing and Review’ will be a requirement for all Heads of Service to return all testing and review templates along with their annual assurance return to the Resilience Development Unit. This in turn will be reviewed and collated by the Unit and where common improvements have been identified which can be replicated generically across all/ most service areas this will be circulated across all service areas. (4) Annual Assurance Returns will be reviewed and a and a summary thereafter prepared, detailing testing undertaken in the year and the subsequent outcomes of such testing, for inclusion in the annual report on resilience planning submitted to the Environment and Place Committee. August 2022 March 2023 September 2023 September 2023 September 2023
Page 46
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 8 3. Action Plan (continued) Business Continuity Planning 0900/2022/010 Ref Finding 4 The role and remit of the ‘Business Continuity Champions’ should be formalised and documented. The Resilience Development Unit is responsible for co-ordinating the Council’s resilience activities and is supported by the Corporate Resilience Management Team, a corporate group comprising representatives from individual Services or crucial parts of Services from across the Council. Individual Services are responsible for documenting their BC and DR arrangements to ensure that critical services are maintained in the event of potential incidents occurring which could impact on the delivery of their operational activities. They are supported in this role by Business Continuity Champions. However, while anecdotal evidence suggests that the Business Continuity Champions are clear on their roles and responsibilities, there is no clearly defined documented remit in this respect. The Business Continuity Champions generally hold senior positions within the Council and as such they are limited in the time which they can commit to this role. At present, our review highlighted that in general terms the Business Continuity Champions act as a conduit between Services and the Resilience Development Unit for submission of BCP/DRPs rather than having an active or direct involvement in the completion and/or review of these plans. Implication Recommendation Priority Management response Implementation Month/Year If the role of the Business Continuity Champions is not clearly documented, there may not be appropriate support, oversight, scrutiny and challenge of the individual service areas’ business continuity and disaster recovery arrangements. Management should ensure that the role and responsibilities of Business Continuity Champions are reviewed and documented to provide greater clarity of corporate expectations of what such individuals are expected to do in relation to business continuity. Low Agree Aileen McMann, Resilience Development Coordinator Roles and responsibilities will be formalised and included within the revised guidance document. November 2022
Page 47
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2021-22/0900.2022.010 Business Continuity Planning/A - FINDINGS AND REPORT/A09A 20220720 Business Continuity Planning Final Report v1.0 as issued .docx 9 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 48
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 1 INTERNAL AUDIT REPORT RISK MANAGEMENT Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Head of Audit and Risk and Corporate Risk Manager Copied to: Deputy Chief Executive and Chief Executive Headlines The purpose of this audit was to provide independent assurance that the Council has robust and effective risk management arrangements. The audit included a review of both corporate and Services’ arrangements for ensuring that all significant risks are identified, evaluated and controlled, risk registers have been prepared and are kept up-to-date, and appropriate arrangements are in place to review/monitor and report on risk. As part of this audit, we assessed the arrangements against good practice as identified by Audit Scotland in their ‘Best Value toolkit: Risk management’. We also considered the extent to which management had taken action to address the recommendations contained in the previous Internal Audit report on this topic issued in September 2020. The Council operates in a complex environment and faces multiple challenges in delivering against its priorities. Effective risk management arrangements are therefore essential and form a key part of good corporate governance. The Corporate Risk Team and wider risk network continue to develop risk management via activities such as the annual refresh of the Corporate Risk Register (CRR), quarterly reporting on key developments in risk management to the Corporate Management Team (CMT) and Audit and Scrutiny Panel (ASP), active participation in the review of the project management model to ensure appropriate focus and guidance on risk and providing risk support to a number of key projects across the Council. Overall, we have categorised the audit as offering ‘reasonable assurance’ meaning that we consider that the Council’s risk management arrangements have continued to improve and embed since our last review. We are generally satisfied that these arrangements are being actively supported and promoted by senior management at both corporate and service level, and that risk management contributes towards the achievement of corporate objectives. We are also satisfied that there are adequate procedures in place at both corporate and service levels for identifying and prioritising risks and identifying appropriate action to mitigate/manage those risks. Although at different stages of maturity, Services continue to improve and enhance their risk management arrangements and as such, there is scope for some further improvement. We have identified a number of areas where we consider further management action is required and these are detailed in section 3 of this report and include: • replacement and/or new risks need to be documented and assessed in line with the agreed timetable; • a framework for monitoring compliance with the Risk Management Strategy needs to be developed and implemented to facilitate assessment and overview of the adequacy and effectiveness of risk management arrangements within Services; and • improvements are required to current arrangements for ensuring that all relevant staff undertake the appropriate mandatory training for risk management. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0900/2022/011 Date issued 21/07/22 Audit Team Jacquie Howden and Paula Hendry
Page 49
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 2 1. Executive Summary Objectives The purpose of this audit was to provide independent assurance that the Council has robust and effective risk management arrangements. The work undertaken was designed to offer an audit opinion on the following: • Risk management is actively supported and promoted by senior officers/elected members and contributes towards the achievement of corporate objectives; • There is a systematic approach to identify and prioritise risks (corporate and Service level) and match them with appropriate responses; and • Risks, and the action taken to mitigate them, are regularly monitored. The audit was not intended to provide assurance on the adequacy or otherwise of the identification of, or management’s responses to, specific individual risks. In accordance with the Council’s Internal Audit Charter, this assignment was led by the Principal Auditor and the Head of Audit and Risk (who also leads on corporate risk management) was not involved in the design of the audit methodology, the conduct or review of the audit fieldwork or the preparation of the draft report. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 3 2 Key areas requiring management action (High) No key areas requiring urgent management action has been identified. Good practice identified We noted the following areas of good practice during the audit: • The Council’s Risk Management Strategy 2020-2022 was approved by the Policy and Strategy (P&S) Committee in March 2020 and clearly sets out the roles and responsibilities for staff, senior management and elected members in respect of risk management, as well as the roles of the P&S Committee and ASP in providing oversight of the risk management arrangements. • The Strategy has been developed in accordance with the CIPFA/SOLACE local code of corporate governance ‘Delivering Good Governance in Local Government’ and the Audit Scotland ‘Best Value toolkit: Risk Management’, which recognises risk management as an integral part of good corporate governance, and in accordance with the International Risk Management Standard ISO31000:2018 ’Risk Management – Guidelines’. • The Strategy and associated guidance also clearly set out the corporate methodology for identifying, prioritising, managing and reporting risks. Training on this methodology is included in a mandatory eLearning risk management training module, which all staff are required to undertake every two years, with further training provided by the Corporate Risk Team as required. • The Risk Management Corporate Working Group (RMCWG) is responsible for supporting the Corporate Management Team (CMT) in implementing the strategy and promoting good risk management practice across the council, including the promotion of risk management within Service planning, performance management, programme management and change initiatives processes. The RMCWG is chaired by the Head of Audit and Risk and includes representation from the Corporate Risk Team and designated Risk Champions from each Service. • The Council has a risk management information system (Figtree) which is used to record all corporate and Service risk registers and allows for a standardised approach to identifying, managing and reviewing risks across the Council against the standard risk categories and with consideration to the corporate and Service objectives and priorities.
Page 50
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 3 Good practice identified (continued) • Risk registers have been prepared for all Services on Figtree and require to be reviewed regularly in accordance with the frequencies determined by the individual risk’s residual risk rating (as detailed in the Strategy). All corporate risks are assigned to a named member of CMT and are reviewed on a quarterly basis by the CMT, with service and project risk registers reviewed quarterly, six-monthly or annually as required. The Figtree system automatically prompts the risk/action owner when the risk is due for review. • Quarterly risk management update reports are presented to the ASP setting out the key risk activity over the previous period. In addition, deep dive reviews are regularly reported to the Panel in respect of individual/new corporate risks. Risks are also routinely reported at CMT level for corporate risks. • Six monthly monitoring reports are presented to the ASP in respect of governance and risk management arrangements for the Council’s Arms-length external organisations (ALEOs) and external partnerships which include the key risks for each organisation. Risks around ALEOs and partnerships are included in the Business Solutions service risk register. Other areas for improvement (Medium) A small number of other areas for improvement were also identified: • Replacement and/or new risks need to be documented and assessed in line with the agreed timetable; • A framework for monitoring compliance with the Risk Management Strategy needs to be developed and implemented to facilitate assessment and overview of the adequacy and effectiveness of risk management arrangements within Services; and • Improvements are required to current arrangements for ensuring that all relevant staff undertake the appropriate mandatory training for risk management.
Page 51
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 4 3. Action Plan Risk Management 0900/2022/011 Ref Finding 1 Replacement and/or new risks need to be documented and assessed within a reasonable timescale. Our last review of risk management in 2020 identified three risks from the Corporate Risk Register (CRR) that were under development and needed to be completed and moved to ‘live’ status. Whilst management committed to action to ensure this, two of these risks (asset rationalisation and Health and Social Care Integration(HSCI) / Integrated Joint Board (IJB)) have not yet been moved to ‘live status’. We noted, however, that the changing operational landscape has presented challenges in agreeing how these risks should be framed. These outstanding risks have now been replaced with the scope of the asset rationalisation risk being widened to better reflect how this, and other key programme of work items, align and link together to reflect the strategic risk around the implementation of the target operating model and associated resources and the HSCI/IJB risk being replaced by a new National Care Service (NCS) risk. The CRR is reviewed annually to ensure completeness and alignment to the Council’s strategic objectives. The outcome of the most recent refresh was presented to CMT in June 2022 and we noted that two new risks (education attainment and supply chain) as well as the previous corporate risk relating to the Scottish Child Abuse Inquiry risk have been assessed as meriting inclusion in the CRR. This means that overall there are now four corporate risks that need to be documented, assessed and moved to ‘live’ status and a fifth that is now under ownership of CMT rather than the individual Service. We also noted that the report to CMT reminded the corporate risk leads of the need to ensure that the Corporate Risk Team is contacted when reminders are received for the review of corporate risks thus ensuring review frequencies are maintained and avoiding the risk becoming out of date. A proposed timetable for reviewing/reporting corporate risks to CMT including expected dates for presenting the risks above that are under development has been approved by CMT. We consider it vital that these corporate risks are formally documented, assessed and moved to ‘live’ status in accordance with his timetable to enable the council to appropriately monitor, review and where appropriate, take action to mitigate them. Implication Recommendation Priority Management response Implementation Month/Year The absence of a fully documented corporate risk register, subject to regular monitoring and challenge may mean that key stakeholders may fail to fully understand the key risks the Council faces and in turn may consequently fail to take appropriate action to mitigate them. The Head of Audit and Risk should ensure that the replacement and/or new corporate risks detailed above are documented, assessed and moved to ‘live’ status within a reasonable timescale. Medium Agree Ken Adamson, Head of Audit and Risk Corporate risk management staff will liaise and work with the relevant Chief Officers designated as Risk Leads for each of the replacement or new corporate risks to ensure that these are documented, assessed and moved to ‘live’ status as soon as practical and subsequently reported to CMT and ASP in accordance with the timetable approved by CMT. Although the initial risks relating to NCS will be documented in line with the proposed timetable, it should be noted that the development of the NCS risk will be an ongoing issue, with the risk continuing to evolve as the relevant legislation passes through the Scottish Parliament and the detailed nature of the NCS proposals, the expectations and responsibilities placed upon local authorities and the likely impacts become clearer and more easily understood. September 2022
Page 52
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 5 3. Action Plan Risk Management 0900/2022/011 Ref Finding 2 A framework for monitoring compliance with the Risk Management Strategy needs to be developed and implemented to facilitate assessment and overview of the adequacy and effectiveness of risk management arrangements within Services. Work undertaken during this audit to review current risk management arrangements within Services and consider the extent to which management action has been taken to address previous audit recommendations demonstrates continued development and embedding of risk management across the Council. We were pleased to note that all Services have now input their risk registers into the Figtree system and that guidance on the use of Figtree and the review process was issued to all Risk Champions in October 2020. We noted that the Risk Champions also provide regular updates on the completeness of their Service’s risk registers at the Risk Management Corporate Working Group (RMCWG) meetings and that, in general, appropriate arrangements for reporting risk issues across the Council were in place. Our review has, however, identified the following: • although progress has been made, there is still scope to further develop the risk registers for Education and Families and Adult Health and Social Care (AHSC), where high-level service risks and only some operational level risks have currently been included. We understand that this is due in part to ongoing service re-structures and lack of clarity over the future structures and governance arrangements within these Services and that the Corporate Risk Team is continuing to work closely with them to further develop their risk registers; • there is scope to improve the completeness of the fields within the Figtree system for individual risks – particularly in relation to the completeness of risk context and proximity fields and linking risks to the key corporate priorities; • from a brief high-level review of service risk registers in Figtree, we noted that there are still a high number of instances where risks have not been reviewed in accordance with the expected timescales. From discussions with the Risk Champions, we understand that, whilst Figtree automatically prompts the risk/action owner that a review is required, a number of review dates have been missed due to the competing workloads of the relevant officers; • there is a need to further develop the processes for monitoring each service’s overall risk profile. We understand that some Services have begun considering this through a review of the reporting processes; • there is scope for Services to consider how best to identify and record ‘near misses’ within their risk registers and ensure that the appropriate action can be taken forward. Some Services were able to evidence risks having been reviewed to take account of such instances, whilst the arrangements for other Services are not yet sufficiently advanced to give this aspect appropriate consideration; • whilst risk is discussed at several forums at Service level, we noted that it is not a standing agenda item at all Services’ Senior Management Team (SMT) meetings. In addition, our testing highlighted that not all of the Council’s Risk Champions are members of the SMT (in accordance with good practice), indicating that risk management may not currently be getting the necessary level of exposure at these meetings. There is also scope to improve the current arrangements for providing regular risk monitoring/update information to senior management, which detail the risks identified, their risk ratings and any action taken. Whilst one Service routinely used risk register reports for this purpose, other Services indicated that there were no formal/regular reporting mechanisms currently in place; and • we reviewed a sample of committee reports and noted that, whilst narrative had been included within the risk impact section for all reports in accordance with expected procedures, there is scope to improve the quality and quantity of the detail provided to members to ensure that the risks is clearly detailed and more easily understood. We were pleased to note that the Corporate Risk Team have recognised the need for improved monitoring of performance and compliance against key expectations contained within the Risk Management Strategy. Within their risk actions/priorities, the Corporate Risk Team has identified a need to prepare a compliance strategy which will allow Services to self-evaluate against the corporate expectations. This would also provide useful information for the Corporate Risk Team to monitor and direct resources to better embed risk management across the organisation by identifying areas of good practice as well as areas for improvement. We understand that as part of this process, the Corporate Risk Team is liaising with other councils to identify the approaches they have to measuring compliance and performance and will seek to develop relevant key performance indicators for monitoring and reporting purposes. We were also pleased to note that some progress has been made by the Corporate Risk Team regarding the development of guidance on monitoring/reporting risk management issues and that initial sessions have been held with the individual Risk Champions and Risk Facilitators with a view to establishing service-based risk forums which the Corporate Risk Team will lead/participate in until they are well established. The expected approach for this is being informed by discussions with the risk network and the resulting arrangements are expected to assist in establishing consistency of reporting to SMT’s across the Council. (continued overleaf)
Page 53
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 6 3. Action Plan Risk Management 0900/2022/011 Implication Recommendation Priority Management response Implementation Month/Year Management may lack assurance on the extent to which key expectations/requirements contained the strategy are being complied with. Without formal processes in place for reporting risk issues, management may not be able to take appropriate or timely action to address these risks. The Head of Audit and Risk should ensure that: (1) work continues to develop a framework, including suitable KPIs, to appropriately monitor compliance with key aspects of the Risk Management Strategy, with areas for improvement being captured and thereafter tracked and monitored; and (2) clear expectations regarding consideration, monitoring and reporting of risk are incorporated into the revised Risk Management Strategy so that Services can incorporate this into their individual governance arrangements. Medium Agree Ken Adamson. Head of Audit and Risk (1) Arrangements for assessing and reporting compliance with key expectations will be developed and included as part of the revised Risk Management Strategy due to be submitted for approval by Committee in line with corporately agreed timelines. (2) Arrangements for ensuring that appropriate consideration of risks is incorporated into individual Service governance arrangements will also be included as part of the revised Risk Management Strategy due to be submitted for approval by Committee in line with corporately agreed timelines. December 2022 December 2022
Page 54
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 7 3. Action Plan Risk Management 0900/2022/011 Ref Finding 3 Improvements are required to current arrangements for ensuring that all relevant staff undertake the appropriate mandatory training for risk management. The Council has two online eLearning modules in relation to risk management – ‘Introduction to Risk Management’, which is mandatory for all employees and ‘Advanced Risk management’, which requires to be completed by the members of the ASP, Risk Champions and Risk Facilitators, 3rd/4th tier managers and all supervisors/team leaders. The mandatory eLearning course requires to be completed every two years and the employee and their line manager are automatically notified by email one month before the two- year period is due to expire. Line managers are able to monitor progress/completion by everyone in their team through the Teams dashboard within LearnNL and monitor overall uptake of the training. From discussions with the Risk Champions, we noted that staff were generally encouraged to complete the risk management training, but that service managers were not always being proactive in monitoring the uptake of the training modules. There is also no formal monitoring of the completion of the modules by the Corporate Risk Team or the RMCWG for individual Services and/or the council as a whole. We understand that the Corporate Risk Team is looking to develop a methodology for monitoring uptake of the training courses as part of their planned monitoring compliance framework. We noted that the training matrix set out in the Risk Management Strategy includes the requirement for Risk Champions and Risk Facilitators to undertake a one-day training in addition to the mandatory courses detailed above. We understand that this one-day course was undertaken some time ago before some of the current Risk Champions were in place and is no longer available. However, all Risk Champions have attended a reduced session on risk management and the Corporate Risk Team works closely with all Services to ensure they are aware of their roles and responsibilities. The Corporate Risk Team is currently developing a risk network training course which will aim to bring all Risk Champions and Risk Facilitators together twice a year. Implication Recommendation Priority Management response Implementation Month/Year Without appropriate training, staff may not be aware of their roles in respect of risk management. The Head of Audit and Risk should: (1) remind Services of the need to complete and monitor uptake of the mandatory risk management training by staff; (2) determine how best to capture/monitor the uptake of mandatory training module for each Service and the Council as a whole in accordance with expected timescales, ensuring that this is regularly monitored, and action taken as appropriate on any issues arising, by the Corporate Risk Team and RMCWG; and (3) ensure the risk network training is finalised and implemented within a reasonable timescale. Medium Agree Ken Adamson, Head of Audit and Risk (1) Services will be reminded of the need to ensure that all staff undertake the relevant training appropriate to their role. (2) Consideration will be given as to the most effective and efficient way to gather and report data in relation to the completion of mandatory and other training. (3) Risk network training will be finalised in due course. July 2022 October 2022 October 2022
Page 55
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 8 3. Action Plan Risk Management 0900/2022/011 Ref Finding 4 There is scope to improve the corporate risk management strategy to better reflect good practice. The Council’s current Risk Management Strategy (2020-2022) was approved by the Policy and Strategy Committee in March 2020 and provides an enterprise risk management approach which recognises the link between risks at different levels and areas of activity within the Council, together with those risks arising from relationships and contracts with other parties outwith the Council. The strategy was due to be reviewed in December 2021, but due to absences within the Corporate Risk Team, this has now been extended to December 2022. From a review of the Strategy and discussions with the Risk Champions, we are satisfied that it generally reflects good practice expectations, clearly setting out the roles and responsibilities of staff, senior management and elected members in respect of risk management and the corporate methodology for identifying, scoring/prioritising, managing and reporting risks. We consider, however, that there is scope for improvement to better reflect good practice as it does not currently provide clear guidance on risk appetite, tolerance levels and/or consideration of opportunities as well as threats to the Council. We understand from the Corporate Risk Manager that this was a conscious decision and will be reviewed in due course as service risk arrangements mature and the Risk Champions are more established in their roles. Implication Recommendation Priority Management response Implementation Month/Year The Council’s risk management strategy may not fully reflect good practice. The Head of Audit and Risk should ensure that as part of the next review of the Risk Management Strategy, further consideration is given as to whether it is appropriate to include risk appetite, expected tolerance levels and opportunities in the Strategy. Low Agree Ken Adamson, Head of Audit and Risk Consideration will be given, as part of the planned update to the current Risk Management Strategy, to the inclusion of clearer guidance on adopting risk appetites, expected tolerance levels and capturing opportunities. December 2022
Page 56
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 9 3. Action Plan Risk Management 0900/2022/011 Ref Finding 5 A replacement Risk Champion for Education and Families should be identified to ensure a smooth transition. Risk Champions and Risk Facilitators are in place across all Service areas. We noted, however, that due to a Service restructure, the current Risk Champion for Education and Families will be moving to Business and Digital Service area and as such will no longer be undertaking the champion role for this area. We understand that an officer has been identified to temporarily undertake this role but that the Service have still to agree the permanent replacement. Implication Recommendation Priority Management response Implementation Month/Year Without suitably experienced Risk Champion covering all Services, there may be an absence of appropriate monitoring, support and the ability to provide assurance that risk management arrangements are operating effectively. The Head of Audit and Risk, in conjunction with Education and Families management, should ensure that an appropriate replacement officer is formally assigned to the role of Risk Champion for Education and Families, with the relevant officer provided with appropriate training to facilitate undertaking the role effectively. Low Agree Ken Adamson, Head of Audit and Risk Audit and Risk will liaise closely with Education and Families senior management to ensure that an appropriate replacement officer is formally assigned to the role of Risk Champion for Education and Families and that the identified officer is provided with relevant training to enable him/her to undertake that role effectively. August 2022
Page 57
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0900.2022.011 risk management/a. findings and report/a06b 20220721 risk management final report v1.0 as issued .docx 10 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green - Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber - Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 58
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 1 INTERNAL AUDIT REPORT SUPPORTING ATTENDANCE Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Head of People and Organisational Development and Senior Employee Relations Adviser Copied to: Chief Executive and Deputy Chief Executive Headlines The purpose of the audit was to provide independent assurance on the adequacy and effectiveness of the Council’s current arrangements for assessing compliance with expected procedures in relation to the management of sickness absence and on the robustness of relevant performance reporting. Sickness absence and its effective management is, and has been for a considerable time, a high-profile issue. Over the last five years the Council has had persistently high levels of sickness absence, with a concerning growth in the level of long-term absences often related to stress and other mental health issues. The public health emergency associated with the Covid pandemic has created additional challenges in managing attendance, with significant numbers of staff and managers working remotely; increased challenges generally around employees’ health and wellbeing; and significant pressures placed on a number of groups of front-line workers. Whilst short-term absences have fallen across all Services since lockdown in March 2020, the level of long-term absences remains significant, although it is noted that that data for 2021-22 shows a 4.4% improvement in mental health related absence from the previous year. The Council’s current Supporting Attendance Policy (the Policy), approved by the Finance & Resource Committee in March 2021, sets out the processes expected to be followed in managing sickness absence across the Council. The policy covers all Single Status employees, with a separate policy, which is currently being refreshed, for teaching staff (expected completion date of December 2022). Work undertaken during the audit included a high-level review of how management seeks to ensure, monitor and assess compliance with key aspects of the policy and whether issues arising from management reviews of compliance have been communicated to relevant management and, where appropriate, translated into specific actions. We also undertook a brief high-level review of the processes for compiling, communicating and monitoring sickness absence data. This included some limited substantive testing and re-performance of reported sickness absence data and consideration of the adequacy of management actions undertaken or planned in response to recent/current sickness absence performance. Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council has put in place appropriate management arrangements to support compliance with the Supporting Attendance policy and for managing, monitoring and reporting sickness absences and that generally these arrangements are operating as expected. We were pleased to note that the revised policy, supporting toolkits and eLearning module clearly set out the Council’s expected processes and that managers generally appeared aware of, and understood, their roles and responsibilities for complying with the policy. In addition, we were satisfied that there was appropriate support and advice available to managers via the Employee Relations team to manage/monitor individual absences and that absence levels/patterns were being actively monitored and reported to managers via Employee Relations and HR Business Partners. We have, however, identified a small number of areas where we consider that scope for improvement exists and have made some recommendations for management consideration/action. These are detailed at section 3 of the report and include: • management needs to ensure that the policy is being effectively implemented in line with corporate expectations, that lessons learned/issues raised are acted upon/shared as appropriate and that its impact/effectiveness is regularly reviewed; and • Improvements are needed to the consistency and content of performance information presented to senior management and to ensure that process for preparing performance information is fully documented. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0320/2022/002 Date issued 22/08/22 Audit Team Jacquie Howden, Paula Hendry and Jackie Struthers
Page 59
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 2 1. Executive Summary Objectives The purpose of the audit was to provide independent assurance on the adequacy and effectiveness of the Council’s current arrangements to assess compliance with expected procedures in relation to the management of sickness absence and the robustness of relevant performance reporting. In particular, the audit was designed to provide independent assurance on the following issues: • Has the Council put in place appropriate management arrangements to support the delivery of effective compliance with the Supporting Attendance Policy (which was approved by the Finance and Resources Committee in March 2021) and are these arrangements operating satisfactorily? and • Has the Council established formal procedures for managing absences and monitoring, and reporting robust performance data relating to sickness absence and is appropriate management action taken where performance is below target and/or need and scope for improvement is identified? Our review of the robustness of absence performance indicators was limited to a high-level review of the process for this and some limited substantive testing and re-performance of reported sickness absence data. We did not undertake any specific checks on the accuracy of the underlying information held within the iTrent system itself as part of our audit. The audit was not intended to offer detailed comment on the content or effectiveness of the Supporting Attendance Policy or to review/offer assurance on how individual absence cases have been managed and/or whether the processes followed for individual cases were consistent with the policy. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 2 2 Key areas requiring management action (High) There were no areas identified which required urgent management action. Good practice identified We noted the following areas of good practice during the audit: • The Council has an approved corporate Supporting Attendance Policy, which was developed following a significant programme of review of current best working practices in respect of sickness absence and in full partnership with management and the Trade Unions. The focus of the revised policy is on maintaining low levels of short-term absences and on reducing the currently high levels of long-term absences through early support and intervention. The policy clearly sets out the roles and responsibilities of all parties in respect of the expected processes for supporting attendance across the Council. • The Policy is aligned to other corporate policies and frameworks including Smarter Working, Special leave, Workforce for the Future Strategy 2020-2023 and the revised Mental Health and Wellbeing strategy, which are currently being progressed through the programme of work item P064.2 - Employee engagement and wellbeing. • A series of toolkits has been developed to accompany the Policy and to provide additional support and guidance to managers on supporting attendance. These cover a range of topics including the newly introduced early support procedures, guidance on the new short and long- term sickness absence stages, conducting return to work discussions and absence support meetings and on using the occupational health service referral process. • An eLearning module on the Policy and associated toolkits has been developed to facilitate managers in applying the processes within the revised policy and training records are maintained of all managers who have undertaken the training. In addition, there are a range of masterclass eLearning modules for managers dealing with particular areas such as stress risk assessment and mental health.
Page 60
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 3 Good practice identified (continued) • There are also various supports and resources available on MyNL, LearnNL and Workwell relating to absence topics, and all managers have access to the support and advice of the Employee Relations team. • Supporting attendance is a standing agenda item at Service Management Meetings and individual service leadership team meetings. • Dedicated Employee Relations Advisors (ERAs) have been assigned to each service to ensure that absence levels are being appropriately monitored on a monthly basis; to identify and discuss any underlying issues with the Employee Relations (ER) team; and to provide ongoing support and/or guidance to service managers as required. Formal arrangements are in place, with the HR Business Partners attending SMT meetings to discuss the services’ overall absence data and ERAs attending monthly attendance meetings with the individual service managers to assist in actively managing individual absence cases. • Performance data for sickness absence in respect of Teaching and Single Status staff is submitted to the Improvement Service (IS) as part of the Local Government Benchmarking Framework (LGBF). Other areas for improvement (Medium) A number of other areas for improvement were identified: • Management needs to ensure that the policy is being effectively implemented in line with corporate expectations, that lessons learned/issues raised are acted upon/share as appropriate and that its impact/effectiveness is regularly reviewed; and • Improvements are needed to the consistency and content of performance information presented to senior management and to ensure that process for preparing performance information is fully documented.
Page 61
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 4 3. Action Plan Supporting Attendance 0320/2022/002 Ref Finding 1 Management needs to ensure that the policy is being effectively implemented in line with corporate expectations, that lessons learned/issues raised are acted upon/shared as appropriate and that its impact/effectiveness is regularly reviewed. We reviewed the level of support and advice provided to senior management by the Employee Relations (ER) team in respect of managing sickness absence and were pleased to note that there were adequate and generally effective processes in place at service/operational level to ensure that individual absences are appropriately and actively monitored/managed. We were also pleased to note that the ER team had undertaken several targeted service reviews in recent years around sickness absence – most recently in September 2021 for long term absences within the Adult Health and Social Care (AHSC) and, in November 2021, for long term absences within Education & Families (School Estates). However, there was no evidence of the recent reviews for AHSC and Education & Families having been discussed at the relevant SMT and/or CMT and/or any specific actions having been documented to address any of the issues arising/lessons learned from the reviews. We also noted that requests for specific reviews or issues arising can originate from many different sources but that at present there is no overarching corporate action plan to assess, identify and thereafter monitor continuous improvement activity in relation to sickness absence. The Council’s expected year-end outturn position for 2021/22 for sickness absence is 10.08 FTE average days lost per employee (against a target of 9.86 FTE average days lost per employee). In comparison to 2020/21, which reported 7.89 FTE average days lost per employee, this shows a marked deterioration. However, last year was not a typical year for sickness absence levels (with significant COVID related absences and large numbers of employees shielding and/or working from home) and is not considered to provide a reliable benchmark (2019/20 data is suggested to provide a more meaningful comparison). The reported FTE average days lost per employee for 2019/20 was 10.55. Current year outturn is below this. The Supporting Attendance Policy sets out that the effectiveness of the Policy will be monitored through regular reporting of relevant sickness absence information to CMT and Elected Members. Although we recognise that the impacts of the covid pandemic were still present during the first year of implementation of the revised Supporting Attendance Policy, we consider it important that a formal assessment of the effectiveness of the Policy is undertaken at an appropriate stage. We also noted that the ER team does not currently undertake periodic compliance reviews at corporate level to determine whether services are complying with the Supporting Attendance Policy and/or whether absences have been actively monitored/managed in accordance with the expected stages and/or timescales. Implication Recommendation Priority Management response Implementation Month/Year Without a formal review of the Policy it would be difficult to determine if the new policy is effective. Without a formal action plan, it would be difficult to monitor and track identified improvement actions and the progress and resultant impact of those actions. Management may not be able to take appropriate action to address issues identified. Management may lack assurance on the extent to which key expectations/requirements contained the policy are being complied with. People and Organisation Development should: (1) undertake a formal review of the effectiveness and impact of the new Supporting Attendance Policy; (2) capture any agreed improvement actions for sickness absence in a corporate action plan, progress against which is then tracked and monitored; and (3) undertake periodic compliance reviews on a sample of services and/or service areas and/or individual absence cases to determine the extent to which the revised Supporting Attendance policy is being implemented across the Council in line with corporate expectations. Medium Agree Fiona Whittaker, Head of People & Organisational Development (1) As part of the rollout of the Supporting Attendance Policy it was agreed that a review meeting would take place with the Trades Unions to gather feedback on the policy and discuss any issues/concerns that have arisen during the first year of implementation. Those meetings have now taken place and the ER ream are now considering whether there needs to be any changes made to the policy and/or associated procedures. Following the first year of operation of the policy, feedback will also be sought from a selection of managers and ER will then consider whether there needs to be any changes made to the policy and/or associated procedures and seek approval for these as necessary. As the policy has only been in place for a year and is still in effect bedding-in we will undertake a fuller review in a further 12 months. (2) An action plan will be developed and thereafter tracked and monitored. (3) The format and frequency of compliance reviews will be considered and incorporated into the action plan at 2 above. December 2022 December 2023 December 2022 December 2022
Page 62
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 5 3. Action Plan (continued) Supporting Attendance 0320/2022/002 Ref Finding 2 Improvements are needed to the consistency and content of performance information presented to senior management and to ensure that process for preparing performance information is fully documented. We reviewed the arrangements for reporting performance information to senior management and noted that there had been no quarterly performance reports presented to the Corporate Management Team (CMT) since September 2021 (for the quarter to June 2021). We understand that a decision was made at that time for performance information to instead be reported at service management team (SMT) level. We obtained and reviewed the SMT minutes of meeting for the last three months for three services at random (Education and Families, Chief Executives Office and Enterprise and Communities), however, and noted that the equivalent performance data (including actual v targets) was not always being routinely reported at the individual SMT meetings. We understand, however that quarterly reporting to CMT on absence data will resume for 2022-23. In addition, we noted that there was often insufficient detail within the available minutes to allow us to determine whether all key issues arising from the absence reports were being reported and/or whether the actions which should be taken to address these issues were being discussed/monitored. In particular, there was no evidence of those sections with the highest levels of absence having been highlighted to either the Chief Executives or Enterprise and Communities SMT for further discussion/investigation or of the trends in respect of long-term and short-term absences. We were satisfied, however, that there was appropriate detail provided to Education & Families SMT members to allow for further investigation of individual cases/sections as appropriate. Sickness absence performance information is generated by the Workforce Systems and Analytics team within the ESC via iTrent reporting functionality and passed to the ER team for further analysis and reporting. This information is used for a variety of purposes including the quarterly performance information previously reported to CMT (and now due to be reported to SMTs on a monthly basis), the annual JCC performance information and the LGBF annual sickness absence return. We noted that for the sickness absence performance information there were no formal documentation and/or proforma definition sheets in place formally recording the processes and underlying data sources to be used in generating the relevant performance data. The current corporate expectation is that all performance indicators are required to have a performance information definition sheet which provides a definition of the process and information required to calculate the final indicator results, a worked example showing how the indicator will be calculated, the frequency of the calculation, the data source and details of the Calculating Officer and Verification Officer. In recent audit work on the strategic performance framework, we noted that a definition sheet was generally not prepared for the LGBF indicators as the Improvement Service has prepared definitions. However, we consider that a definition sheet should be prepared for these indicators as it will provide further information to staff on corporate expectations re the calculation methodology to be used, details of data sources, etc. Implication Recommendation Priority There would be no record of the key absence issues and/ or any proposed actions to be taken to address these issues having been discussed. Management may not be able to take appropriate action to address key issues. Without formal documented processes outlining how performance information should be prepared, staff may not be aware of how to calculate the performance measures which may result in inaccurate performance data being reported to key stakeholders. People and Organisation Development should ensure that: (1) monthly performance information on sickness absence is reported as standard across all Services at SMT meetings, any key issues in relation to absences are discussed with senior management at these meetings and that appropriate documentation is maintained to support the effective monitoring of any management actions identified and/or taken to address these issues; and (2) the processes for preparing/calculating sickness absence performance information for LGBF, SMT and JCC are formally documented, with proforma definition sheets clearly setting out the definition of the performance measure and the methodology for its calculation in accordance with the Council’s performance management arrangements. Medium
Page 63
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 6 3. Action Plan (continued) Supporting Attendance 0320/2022/002 Management response Implementation Month/Year Agree (1) Fiona Whittaker, Head of People & Organisational Development The ER team currently provide monthly absence performance reports to HRBP teams to cascade to their SMT’s. These are high level reports (service information rather than division) but should still be discussed at SMT meetings. The HRBP teams should provide more detailed information on areas of concern for discussion at these meetings. In addition, the ER attend monthly absence meetings with Heads of Service/Senior Managers across the services to discuss cases. The HRPB and ER teams will undertake a review of current arrangements including areas of responsibility and an action plan will be developed to implement and thereafter monitor any management actions identified. The outcome of this will be cascaded to CMT to ensure all Services are aware of expectations. (2) William Cunningham, Workforce Systems and Analytics Manager The Workforce Systems & Analytics team will undertake a review of all reporting documentation to ensure that it meets organisational requirements. Part of this work will be the creation of a reporting library, which will hold proforma definition sheets that provide a detailed breakdown of the various reporting elements (requirements, data, selection criteria, calculations, publications, frequency, etc), with these being reviewed on an annual basis. December 2022 April 2023
Page 64
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 7 3. Action Plan (continued) Supporting Attendance 0320/2022/002 Ref Finding 3 Although generally satisfactory, there is a need to improve some aspects of current arrangements for managing/monitoring sickness absence. From our audit testing, we were satisfied that there are appropriate arrangements in place for managing/monitoring individual absences, with Absence Management and Absence Trigger reports routinely circulated to managers and reviewed in conjunction with the designated ERAs each month. In addition, we noted that the ER team undertakes periodic spot checks on the accuracy/completeness of the information contained in the iTrent system. We understand from our discussions with the ERO, however, that there are some ongoing issues regarding the accuracy of the information in the iTrent system, particularly in respect of absences not being promptly closed off following an employee’s return to work affecting the accuracy of the performance information. We did not undertake any specific checks on the accuracy of the information within the iTrent system itself as part of our audit, but we were satisfied that this message is being regularly/routinely raised with managers as part of the monthly absence meetings with the ERAs. We noted, however, that the iTrent system is not a case management system and does not, therefore, automatically prompt managers as to when action is required to be taken to address absences. At present, there is also no report which can be produced from the system to highlight whether managers are acting in accordance with the expected timescales once the thresholds for triggers have been met. Through discussions with the Senior Employee Relations Advisor, we understand that management is aware of this and is actively looking to develop and/or procure a new case management system which will allow individual absence cases to be more easily and effectively monitored/managed. Implication Recommendation Priority Management response Implementation Month/Year Without accurate and up to date information, management may not be aware of the true levels of absences and may not take the appropriate remedial action. Without timely notification of triggers/absence stages prompt and appropriate action to address staff absence may not be taken. People and Organisation Development should: (1) ensure that the ERAs continue to regularly/routinely raise with managers the need to ensure complete and accurate information in relation to staff absences is recorded in the iTrent system (including closing off all absences promptly after the employee returns to work); and (2) continue to explore whether/how automatic and timely notification to managers of triggers/key absence could be developed to better support prompt and timely action by managers where required by the policy and facilitate more effective management/monitoring of sickness absence. Low Agree (1) Linda Cullen, Acting Employee Relations Manager A new report has now been developed that shows the key absence stages for the Supporting Attendance Policy with absences that have occurred and where dates for meetings should be visible. At present this is just being issued to the ERAs for review and follow up with managers. Going forward, this will be issued direct to managers and they will be expected to undertake their responsibility regarding recording of key absence dates on iTrent. ER will then undertake spot checks on this. (2) William Cunningham, Workforce Systems and Analytics Manager and Linda Cullen, Acting Employee Relations Manager Although there are workflows that can be switched on in iTrent to notify a manager on various aspects of managing attendance (e.g. hitting a trigger) we have ascertained that these do not facilitate improvements in the management/monitoring of absence. However, improvements are being made to the case management system that links to iTrent. Lack of functionality in its current format means the case management system is not being used for sickness absence but Midland HR (iTrent software provider) continues to develop the functionality of this system. An update is due in the coming month, and we will continue to monitor enhanced functionality provided by this and subsequent updates with a view to using the case management system for absence and rolling it out to Managers. This will be kept under review and is dependent on Midland HR’s development of the software. January 2023 March 2023
Page 65
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 8 3. Action Plan (continued) Supporting Attendance 0320/2022/002 Ref Finding 4 There is scope to improve current arrangements for ensuring that all relevant managers undertake appropriate training for managing staff absences. We were pleased to note that there are various training materials available to managers on MyNL, Learn NL and Workwell relating to absence topics, and all managers have access to the support and advice provided by the Employee Relations Team in respect of managing individual absence cases. In addition, we were pleased to note that an eLearning module has been developed to support managers on the implementation of the revised Supporting Attendance policy and the processes detailed in the policy and associated toolkits. There are also a range of masterclass eLearning modules for managers dealing with particular areas such as stress risk assessment and mental health and wellbeing. We reviewed the eLearning Supporting Attendance module and were satisfied that it clearly and accurately reflects the requirements of the revised Supporting Attendance policy and related processes. We selected a sample of line managers from across the services who had undertaken the training module and were pleased to note that in general they found it useful in effectively managing/monitoring staff absences. We also selected a sample of managers from across the services who had not yet undertaken the training module, however, and noted that this was generally due to being unaware of the training available or not having sufficient time to undertake the training to date. The eLearning training module is not currently mandatory, with managers currently required to self-identify their training requirements. We understand, however, that the ER Team is currently considering ensuring that the training is included in the Leadership Development process for all new managers. Employee Relations management obtain reports on a regular basis from Learn NL as to who has completed this training (masterclass and/or e-learning module) and uptake by Managers is shared with the HRBP and ER teams to enable targeting of areas targeted where there is a low uptake compared to sickness absence levels. We consider it important that the need for this training to be designated as mandatory should be kept under review. Implication Recommendation Priority Management response Implementation Month/Year Without formal arrangements for identifying and training managers, some managers may not be aware of their need to undertake the training; managers may not be aware of their roles and responsibilities for managing/ monitoring absences and/or managers who have not undertaken relevant training may go undetected. People and Organisation Development should review the current training expectations for managers around sickness absence, including formalising what training, if any, requires to be made mandatory for all managers with responsibility for managing staff absence. Low Agree Linda Cullen, Acting Employee Relations Manager The ER team has considered whether this training should be made mandatory and has determined it is not necessary at this time. Communication has and continues to be issued through various sources (CMT, SMTs, Managers Bulletins, HRBP teams, Service Absence meetings) reinforcing that all managers with responsibility for supporting attendance are expected and encouraged to undertake the training. The need for this training to be mandatory will be kept under review and will be informed by the ongoing monitoring of uptake levels of training courses. Ongoing
Page 66
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2021-22/0320.2022.002 management of sickness absence/a - findings and reporting/a07a 20220822 managing attendance final report v1.0.docx 9 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 67
INTERNAL AUDIT REPORT USE OF CORPORATE CREDIT CARD WITHIN SCHOOL A Headlines As part of the 2021-22 annual audit plan, we undertook a review to assess the adequacy and effectiveness of key controls relating to the Council’s use of corporate credit cards which included substantive testing on a sample of transactions across all relevant Services. The Council currently has 28 corporate credit cards across all Services. We noted that of the 178 education establishments within the Council, six have corporate credit cards registered to Head Teachers. Our sample selected included the credit card registered to School A. While the credit card is registered to the Head Teacher of School A, purchases and subscriptions using the credit card are generally made by other personnel within the school (i.e. Senior Clerical Assistant, Principal Teacher and Depute Head Teacher) who all have access to the card. This is in direct contravention of the Corporate Credit Card Policy (the Policy) which clearly states only the registered card holder should use the card. The Policy sets out corporate expectations on the acceptable use of a Council credit card and clearly states that the card should only be used when the Council’s established ordering processes cannot be used. Although the Policy does state that online purchases and downloads which cannot be made using normal procurement procedures are acceptable, this should be the exception rather than the norm. We noted however that the credit card expenditure at School A included a high incidence of transactions using online retailers such as Amazon and we consider that many of these items could have been procured via normal purchasing channels. Our review highlighted several transactions for this card which we consider may not be in line with the Policy. These included monthly subscriptions for Amazon Prime, Apple Music and Spotify. We consider that there are additional risks attached to such subscriptions and as a result of our audit work in this area, Financial Solutions updated the Policy in March 2022 to provide clearer examples of the type of transactions which would constitute unacceptable use of a credit card. This includes purchases from online retailers and services such as Amazon, eBay and PayPal and subscriptions to Amazon Prime, Spotify and Apple Music. A more detailed review of the expenditure incurred on the card registered to the Head Teacher of School A highlighted multiple subscriptions for the same online platforms. Specifically, in the period January 2019 to October 2021, there were 21 occasions where there were two separate monthly subscriptions charged for Amazon Prime and 27 occasions where there were two separate monthly subscriptions charged for Apple Music. Neither the Head Teacher nor the Senior Clerical Assistant could provide explanations as to why there were two subscriptions running simultaneously for Amazon Prime other than that one of the accounts had been set up in error and neither the Head Teacher nor the Senior Clerical Assistant appeared to have the necessary log-in details to enable them to access the account and to cancel the subscription which appeared to have been set-up some time ago. We reviewed the credit card statements and order history of the other Amazon account (for which the log-in details are known) for the period January 2020 to March 2022 and noted that there appeared to be no transactions/purchases for Amazon made using the account attached to the original Amazon Prime subscription. It should be noted, however, that this account must have been accessed by someone in March 2021 to enable the expired credit card details to be updated so that the subscription remained live and then for the subsequent cancellation of this Amazon Prime subscription prior to the September 2021 charge. We noted that this cancellation coincided with the start of our previous audit work in this area. With regards to the subscriptions for Apple Music, we were advised that these had been set up as the school uses music to signify the start of lessons etc. The second subscription was cancelled in October 2021.
Page 68
Headlines (continued) Based on information and records held within the school, we were unable to determine whether any of the benefits attached to the subscriptions have been utilised for personal use. However, our review has highlighted that the use of the credit card at School A is not adhering many of the corporate expectations set out in the Policy and accordingly we recommend that Education and Families should: (1) arrange for the credit card registered to the Head Teacher of School A to be cancelled with immediate effect; and (2) review the current use of credit cards within other schools with credit cards to establish whether there remains a valid business need for the remaining schools to continue to hold these cards. Education and Families have subsequently agreed to: (1) cancel the credit card registered to the Head Teacher of School A no later than close of business on 15 August 2022; and (2) undertake a review of the use of credit cards within other schools across the estate to establish whether there is a valid business need for these schools to hold the cards. This review will be concluded by 31 August 2022. Report status FINAL Audit ref 0900/2022/006 Date issued 14/06/2022 Audit Team Lynn McCrum, Paula Hendry and Hugh Shevlin Issued To Depute Chief Executive, Heads of Education and Families, Head of Financial Solutions