Internal Audit- Follow-Up of Actions previously agreed by Management in response to Audit Recommendations
North Lanarkshire Council · 8 September 2022
Back to Audit and Scrutiny Panel — 8 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel ☐approval ☒noting Ref KA/LM/ASP/Sep 2022 Date 08/09/22 Internal Audit: Follow up of actions previously agreed by management in response to audit recommendations From Ken Adamson, Head of Audit and Risk Email adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to update the Panel on the results of Internal Audit’s follow-up work reviewing the extent to which management have implemented actions previously committed to in response to previous Internal and External Audit recommendations. Information is contained in respect of the last two years External Audit outputs and those actions agreed in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed in the period up to the end of June 2022. The Panel should note that where actions are not yet ‘complete’ this does not mean that no relevant activity has been undertaken by management and that often the actions taken/progress made to date will have reduced the risk exposure in respect of the weaknesses previously identified even if the action is not yet complete. It should note that, as reported to the Audit and Scrutiny Panel in December 2021, there has been a change to our reporting on follow-up and those recommendations which were previously reported to the Panel as partially implemented will now be monitored against revised target implementation dates agreed with management. 9 of the 14 actions agreed in respect of External Audit outputs have been completed, one has been partially implemented and four are no longer relevant. 10 of the 27 actions agreed in response to relevant Internal Audit recommendations due in the period have been fully completed, 15 have been assessed as partially implemented and two as no longer relevant. Recommendations The Panel is invited to: (1) note the contents of this report; and (2) approve the recommendations made by Internal Audit at Appendix 1 and to consider whether there are any issues arising from this report on which they wish to receive further information from relevant management. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 All Internal and External Audit reports contain management responses to audit recommendations which generally include a commitment to specific actions by a stated date. This report presents an overview of progress by management in addressing all External Audit recommendations made in the last two years and all ‘High’ and ‘Medium’ Internal Audit recommendations which were previously reported as outstanding or where the proposed actions were due to be completed by the end of June 2022. 1.2 The format of this report is designed to allow the Panel to focus on those issues where non-implementation of agreed actions presents the most significant ongoing risk to the Council and to enable the Panel to hold relevant senior management to account. 1.3 As reported to the Audit and Scrutiny Panel in December 2021, Internal Audit recently reviewed our arrangements for following-up audit recommendations. As a result, we amended our processes to include, in certain circumstances, agreeing a revised implementation date and monitoring and reporting against these revised dates where we are provided with a strong rationale for the non-implementation of the audit recommendation by the original agreed date. This avoids repeatedly reporting and focusing on actions which are ‘late’ where there are sound reasons for non- implementation by the originally agreed date. 1.4 This change means that this report presents the assessment of the potential risks arising from those planned actions agreed in response to Internal Audit recommendations due in the period (April to June 2022) which are not yet fully completed. 1.5 The updates from management on progress to date have been verified on a sample basis by Internal Audit as part of the preparation of this report. However, it should be noted that this review has focused on whether planned actions have been completed and has not included detailed substantive testing of whether the implemented actions have been effective in addressing previously identified weaknesses. 2. Report Actions previously agreed by management – Internal Audit recommendations 2.1 Table 1 overleaf shows whether management have implemented those actions previously agreed to in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed by the end of June 2022. Overall, 10 of the agreed actions have been completed, 15 are partially implemented and two are no longer relevant. Table 1 Head of Service Area Complete Partially implemented No longer relevant Total Adult Social Work Services 2 1 0 3 Asset and Procurement 2 1 0 3 Audit and Risk 0 0 1 1 Business and Digital 0 8 0 8 Education (North/South) 1 2 0 3 Education and Families 0 1 0 1 Financial Solutions 2 1 1 4 People & Organisational Development 1 1 0 2 Performance, Planning and Quality Assurance 2 0 0 2 TOTAL 10 15 2 27
Page 3
2.2 Internal Audit has reviewed the management updates and agreed revised implementation dates for all 15 recommendations listed as partially implemented at Table 1 with relevant management. These recommendations will now be monitored in line with the agreed revised date and will be reported back to the Panel in accordance with this revised timescale at which time consideration will be given as to whether previously identified weaknesses have now been addressed. 2.3 Detail in respect of each of these recommendations and the current residual risk assessed by Internal Audit as a result of partial implementation is provided in Appendix 1. In this appendix, we have also made suggestions as to how the Panel may wish to consider these issues. Definitions of the residual risk ratings are provided at Appendix 2. 2.4 The two issues assessed as being no ‘longer relevant’ relate to Risk Management and Debt Management. These are being followed up separately as part of detailed audit work presently being undertaken in these areas and, where appropriate, updated recommendations will be made in the current audit report. Actions previously agreed by management – External Audit recommendations 2.5 Table 2 shows the status of actions agreed by management in response to External Audit reports issued as part of the 2019/20 and 2020/21 audits. Internal Audit has concluded that nine of the 14 agreed actions have been completed, one has been partially implemented and the remaining four actions are no longer relevant. Table 2 Completed Partially implemented Not yet due No longer relevant Total Report Title/Year 2019/20 Interim Audit Report 1 1 0 2 4 Annual Report 2 0 0 1 3 2020/21 Interim Audit Report 3 0 0 1 4 Annual Report 3 0 0 0 3 TOTAL 9 1 0 4 14 2.6 The four External Audit actions assessed as ‘no longer relevant’ relate to issues on which External Audit have made a subsequent recommendation in subsequent audit reports. 3. Measures of success 3.1 Internal Audit report each cycle to the Audit and Scrutiny Panel on the progress made by management in implementing actions previously committed to in response to Internal and External Audit reports. 4. Supporting documents Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Appendix 2 Residual risk rating definition Ken Adamson, Head of Audit and Risk
Page 4
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure by Services to address previously identified issues and/or weaknesses will impact on the effectiveness of the relevant control framework. This, depending on the nature of the issue, will be captured and should be reflected in the relevant Service risk register or the Corporate risk register (as appropriate).
Page 5
Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Asset and Procurement Procurement (November 2021) Risk: If performance measures are not correctly calculated in line with the definition, management and elected members may misinterpret the information presented to them and may not raise appropriate questions. Recommendation: Asset and Procurement Solutions should review the processes in place to ensure that all future performance measures contained within the Annual Procurement Report are accurately and consistently calculated in line with the corresponding definition. Category: Medium Performance indicators have been reviewed and amended. Work is ongoing with the Scottish Government to ensure that relevant content is incorporated into the future Annual Procurement Report. The Annual Procurement Report is currently being finalised prior to it being reported to the Finance and Resource Committee in September 2022. Original timescale: June 2022 Revised timescale: September 2022 The Service has indicated that they consider this recommendation to be largely complete and have committed to finalising the Annual Procurement Report for the next meeting of the Finance and Resource Committee scheduled for September 2022. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date Head of Business and Digital Corporate Governance Principles E, F & G (June 2021) Risk: The operating model may result in Community Boards failing to discharge their roles and responsibilities adequately or effectively which may impact on the achievement of the shared ambition. Recommendation: The Chief Executive should ensure, after allowing a sufficient period of time for the model and individual Boards to become established, that a formal review (or self-assessment) of the effectiveness of the Community Boards should be undertaken. Category: Medium A number of actions have been progressed aimed at assessing ongoing effectiveness of Community Boards. A performance framework for delivery of Local Outcome Improvement Plans has been established and progress will be reported to the Council’s People and Communities Committee and the Strategic Leadership Board of North Lanarkshire Partnership. The performance framework and reporting arrangements will be further developed to ensure that the Council and its partners have confidence that the Community Boards are operating effectively. Original timescale: April 2022 Revised timescale: March 2023 We acknowledge that, to date, there has been some progress made in measuring the effectiveness of the Community Boards. While we appreciate that oversight and governance of the Boards is largely a matter for the Strategic Leadership Board of the North Lanarkshire Partnership, we welcome the further steps being taken to ensure that the Council and its partners can have confidence that these Boards are operating effectively. Given that action is required to further improve the control environment we assess the residual risk as ‘Medium’ and consider it important the agreed extension date of March 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and agree to monitor progress being made as part of the next follow-up report.
Page 6
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Business and Digital Digital NL (November 2021) Risk: Inadequate arrangements for identifying, agreeing and realising expected outcomes (including expected financial savings) within timescales may result in consequential impacts on the management of the Council’s finances. Recommendation: Management should continue to review the future deliverability of the revised Digital NL programme to ensure timescales for delivery and expected outcomes are realistic and achievable. This should include consideration of: • further developing/enhancing the RAG status for assessing individual projects/workstreams. In particular consideration should be given to splitting the RAG status to provide separate assessments of achievement of timescales and achievement of projected benefits (including expected savings) to enable the impact of the RAG status on savings to be more clearly documented. • the use of optimism bias to make explicit risk-based adjustments to the projected estimates of projects costs, benefits (including expected savings), and duration; and • the identification and implementation of actions necessary to address the continual movement of projected savings. Category: High A full review of deliverability of the DigitalNL programme, SmartNL and infrastructure business has taken place. The outstanding year 3 development work and the potential Year 4 Roadmap were reviewed in line with shape and size, resource availability, benefits realisation, funding availability and risk. A prioritisation matrix has been developed and an Assessment Board created to ensure all activities are reviewed in line with the newly developed Integrated Programme Plan. The full end to end process was presented to the SRO meeting on 26 May 2022 with approval given at this meeting to further develop the proposals. In recognising the Delivery Board is responsible for governing the DigitalNL programme and its associated outcomes, the final proposals will be presented to the Delivery Board in August 2022 for consideration and approval as appropriate. Original timescale: June 2022 Revised timescale: August 2022 The Service has indicated that they consider these actions to be largely complete. However, while we acknowledge that there has been some progress made in this area, we consider there is still further action which requires to be taken to fully address the identified risks. Given that action is required to further improve the control environment we assess the residual risk as ‘Medium’ and consider it important that the agreed extension dates are achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow-up report. Risk: Benefits and savings may not be being adequately tracked and monitored resulting in the Council being unable to demonstrate the achievement of the objectives of the programme. Recommendation: Management should ensure that: (1) the non-financial benefits tracker is finalised and approved with non-financial benefits thereafter identified, calculated, tracked and monitored for all workstreams; and (2) the review of the suite of documentation cited in the Benefits Management Realisation approach is completed and the process thereafter updated and circulated to all relevant parties. Category: Medium The non-financial benefits tracker has been finalised and the updated Benefits Management Approach revised and updated. However, the non-financial benefits tracker has not yet been populated for all workstreams and work is ongoing in this area. The agenda for SRO/Delivery Board has recently been amended to focus on Benefits Realisation as the first agenda item. Original timescale: April 2022 Revised timescale: September 2022
Page 7
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Business and Digital Digital NL (November 2021) Risk: Without full, clear and timely information, key stakeholders may not be able to effectively monitor performance in respect of the DigitalNL programme and/or progress against expected benefits and planned outcomes or determine whether the programme is achieving its targets, and/or identify and agree timely action to address areas of underperformance and/or make informed decisions about the future direction of the DigitalNL programme. Without clear recording of actions prescribed and identified responsible officers for actions planned in response to highlighted risks, key stakeholders would be unable to monitor the risk to ascertain if it had been addressed/mitigated. Recommendation: Management should ensure that: (1) reports on DigitalNL to the Delivery Board, CMT and Committee are amended to provide a clear and comprehensive assessment of progress/status of both the programme as a whole and of individual workstreams. This should include an assessment of each project/workstreams RAG status; (2) reports submitted to the Board make clear reference to all those significant risks with the potential to impact on the successful delivery of the programme including the relevant mitigating controls; actions planned to further address the relevant risk and identified officers tasked with doing so and that key risks are tracked and monitored at each meeting of the Board; and (3) discussions at the Board in relation to any high/significant programme risks included on the Programme Highlight Report submitted to the Board, including the corresponding prescribed action(s) and identified officers, are clearly documented in the Action Note or Action Summary of that meeting. Category: Medium The Programme Highlight report submitted to the Delivery Board has been reviewed and amended to clearly show the RAG status and the financial and non-financial benefits anticipated for each business change sprint. The reports submitted to the Board make clear reference to significant risks and a link to the Risk Register has been added to the Programme Highlight Report. The Action Summary, introduced in early 2022, allows members of the Delivery Board to focus on agreed actions. Original timescale: June 2022 Revised timescale: September 2022 The Service has indicated that they consider this action to be substantially complete. However, due to the limited number of Delivery Board meetings since the process was amended, we have not yet been able to determine whether adequate detail is provided and/or appropriate discussions held with regards to those risks assessed as ‘high’/red. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date.
Page 8
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Business and Digital Governance of Capital Projects (December 2019) Housing Investment Programme (October 2020) Managing Strategic Change (June 2021) The three audit reports listed each raised issues regarding the Council’s project management model. In summary the risks and recommendations arising comprised the following: Risk: The Council’s project management arrangements may not reflect good practice which may lead to projects being managed and documented on an inconsistent basis. Key stakeholders may not be adequately informed of progress in the Council’s key corporate projects and may not be able to undertake effective oversight and/or ensure that timely remedial action, necessary to ensure that projects are delivered successfully, has been progressed by relevant management. Recommendation: Management should: • review and update, as appropriate, the project management model to ensure that it is sufficiently prescriptive to enable officers to identify the circumstances of when, and to what extent, it should be followed. • review and amend the project management documentation to ensure that it requires the title of the project to be recorded and includes version control to clearly detail when it was prepared and last updated. • review the ‘project management model review programme’ particularly in relation to: expanding the sample of projects being reviewed to incorporate some capital and non-capital projects that Services have not received advance notification of; and reviewing and updating the checklist giving due consideration to the suggested improvements made by Internal Audit. • progress the previously identified action of establishing a reporting mechanism which better facilitates regular and ongoing oversight by key stakeholders of the progress of key projects against plan, including management of key risks, progress against timelines, cost against budget, achievement or otherwise of key milestones and expected outcomes or benefits realisation. We suggest that this could include introducing a standard reporting template and adopting a traffic light system to report progress against key criteria, project milestones and overall deliverability against expected time, cost and any other intended outcomes. Category: Medium The planned review process and subsequent refresh of the council’s Project Management Model took place from February to June 2022. A Review Team comprising representatives from all Services, including audit and risk, took part in the evaluation and review process. The refreshed Project Management Framework was circulated to the Review Team for their final input in June 2022. Insufficient feedback was received from the majority of service representatives on the Review Team which led to a delay in the finalisation of the refreshed Project Management Framework. Further work is being undertaken on a 1:1 basis to ensure Services are fully engaged with, and involved in, the final development stages of the refreshed Project Management Framework. Following this, the Project Management Framework will be finalised and submitted to CMT for approval. Original timescale: June 2020 or September 2021 Revised timescale: April 2022 Further revised timescale: September 2022 The Service has indicated that these actions are largely complete and that the delay in implementation is largely due to insufficient feedback from service representatives which the Service are currently taking steps to address. Given the extensive delay in implementation of these recommendations, we assess the residual risk as ‘High’ and would suggest that the Panel may wish to consider noting the progress made to date and the revised timescale but also to request an update on this issue from relevant senior management at the next meeting of the Panel if the action is not fully implemented at that time.
Page 9
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Education (North/South) Follow Up: Scottish Attainment Challenge & Pupil Equity Fund (August 2021) Risk: Without short, medium and long-term targets against which performance can be monitored, there is a risk that effective oversight of the SAC and PEF programmes may be impaired. Without an effective performance management framework, management would not be able to measure whether the SAC and PEF programmes were being delivered and/or may not be able to take appropriate action to address areas of ‘under-performance’. Recommendation: Management should: (1) identify and set realistic short, medium and long- term targets for the SAC and PEF programmes and consider the current and future planned actions which will be taken to deliver against the identified objectives and measures of success (2) ensure that appropriate and realistic SMART performance measures are used wherever possible in the annual SAC Plan, subsequent progress reports to committee and within the individual establishments’ SIPs and SIRS to ensure that progress of key all actions and interventions can be appropriately tracked; and (3) set out clearly defined baselines against which the activities or interventions will be assessed for their contribution to closing the poverty-related attainment gap and ensure that the reports at both authority and individual establishment level clearly set out to key stakeholders the progress made against the identified targets/milestones together with any significant challenges in achieving these targets. Category: Medium Previous targets have been set by the Scottish Government but from 2022, targets in relation to progress in attainment are being set in collaboration and discussion with local authorities and both the SAC and PEF Team are engaging in discussions to agree on aspirational yet achievable targets and align the plans for the year ahead. Further development sessions for Headteachers and senior managers have taken place to assist with the development of clear rationales; help with the identification of outcomes and measures and provide both a local and national context to their approach. Whilst improvements in planning at school level have been noted the SAC and PEF Team consider there is still work to be done in encouraging greater detail in school improvement plans. The Improvement and Equity Lead continues to support and challenge establishments in both their SAC and PEF submissions through scrutiny of plans and encouraging all schools to ensure that, wherever possible, data should form the basis of all submissions of progress in the bi-annual checkpoints. Original timescale: December 2021 Revised timescale: June 2022 Further revised timescale: September 2022 Whilst we acknowledge that there has been some action taken to address the recommendations made, we consider that there is still further action required to fully mitigate the identified risks. Given that action is required to further improve the control environment we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of September 2022 is achieved. We would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow-up report.
Page 10
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Education (North/South) Follow Up: Scottish Attainment Challenge & Pupil Equity Fund (August 2021) Risk: Services may not be procured in accordance with the Framework. Without formal documentation, schools may not be able to evidence why a particular procurement method and/or supplier was selected and/or be able to demonstrate best value when procuring services Recommendation: Management should: (1) remind/encourage all schools to use the Procurement framework as far as possible and of the requirements of the Framework (including the use of approved suppliers wherever possible) and the importance of completing the RFP documentation for each procurement exercise; (2) periodically report to senior management on the use of, and expenditure incurred via, the Framework against the total spend allocation; and (3) ensure that they periodically review non-Framework expenditure items to obtain sufficient assurance that procurement activity funded via SAC/PEF is being undertaken in accordance with corporate expectations and can demonstrate best value. Category: Medium Headteachers are reminded on an ongoing basis of the requirements of the Procurement Framework. A review of Framework and non-Framework expenditure for session 2021-22 has been undertaken with subsequent findings to be reported to the Programme Board and Services Senior Leadership Team in August 2022. Original timescale: December 2021 Revised timescale: June 2022 Further revised timescale: September 2022 Whilst we acknowledge that there has been some action taken to address the recommendations made, we consider that there is still further action required to fully mitigate the identified risks. Given that action is required to further improve the control environment we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of September 2022 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow-up report. Head of Education and Families Public Protection (September 2021) Risk: If areas for improvement are not adequately identified, quantified, addressed and regularly monitored and reviewed the Council may fail to effectively deliver its public protection responsibilities. Recommendation: Management should ensure that consideration is given to preparing and thereafter tracking and monitoring an action plan for the NLCOPPG. Category: Medium The NLCOPPG have delegated responsibility for taking forward improvement actions arising from the self- evaluation to the Lead Officers Public Protection Group. Action areas have been agreed and the action plan and progress report will be presented to the NLCOPPG at its next meeting in October 2022. Original timescale: November 2021 Revised timescale: May 2022 Further revised timescale: October 2022 The Service has indicated that the majority of the recommendations have been addressed. The outstanding actions relate to reports being presented to future meetings of the NLCOPPG. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date.
Page 11
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Education and Families Tackling Poverty (November 2021) Risk: If the process to create a consolidated action plan is not properly documented, the LCPAR action plan may not be appropriately aligned with the strategy action plan which may result in key actions potentially being missed in error. Feedback from external reviews may not be incorporated into the LCPAR resulting in a failure to address or progress relevant actions or activities. Recommendation: Management should ensure that: (1) all relevant key actions from the strategy are, where appropriate, incorporated within the LCPAR action plan and/or that where actions are removed/not included there is appropriate documentary evidence maintained to support the rationale for their removal; and (2) all outstanding recommendations and actions arising from the NL Fairness Commission and Scottish Government reviews are, where appropriate, incorporated into the LCPAR. Category: Medium Following the production of the Best Start, Bright Futures Child Poverty Delivery Plan 2022-2026, the LCPAR will be incorporated within the production of a new Tackling Poverty Strategy 2023-2026 which will allow for forward planning whilst meeting the requirements of the Scottish Government. This document will include all of the outstanding recommendations and actions from the North Lanarkshire Fairness Commission and Scottish Government reviews. The Local Child Poverty Action Report will be prepared and submitted to the Policy and Strategy Committee in September 2022. Original timescale: June 2022 Revised timescale: September 2022 The delay in implementing this action is due to a number of factors, including the Council elections, however a firm commitment has been given by the Service to submit the LCPAR to Committee in September 2022. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date.
Page 12
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Financial Solutions Use of Corporate Credit Cards and Purchase Cards (November 2021) Risk: Without a clear statement of expected procedures and oversight arrangements, there is an increased risk of inadequate control over the administration of purchase cards and expenditure incurred which may be inappropriate and/or not appropriately monitored. Recommendation: The Head of Financial Solutions should, in conjunction with Facility Support Services, undertake a formal review of the purchase card scheme, to ensure that an appropriate and effective control environment is established and thereafter implemented. The review should include, but not be limited to, considering the issues identified in the finding. Category: High The review of the purchase card scheme is currently underway. Delays in implementation are due to staff changes, shortages and a prioritisation of financial year end activities. Original timescale: April 2022 Revised timescale: September 2022 Although the review of the purchase card scheme is not yet complete, we acknowledge that the delay in implementing this is due to a number of factors, including changes in staff. A firm commitment has been given by the Service to complete the review by the proposed revised timescale. Given that action is required to further improve the control environment we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of September 2022 is achieved. We consider it important, that the revised timescale is achieved and would suggest that the Panel may wish to consider agreeing to monitor progress as part of future follow-up reports. Head of People and Organisational Development Corporate Governance Principles A & B (February 2022) Risk: Without effective workforce planning there is a risk the Council may not have in place (or identified the actions it needs to progress to ensure it has in place) the staff and skills it needs to enable it to deliver services and achieve planned outcomes Recommendation: The Head of People and Organisational Development should ensure that the service workforce plans are completed and reported in accordance with the revised timescales to inform future workforce planning activity. Category: Medium Workforce Plans have been completed for each service and were presented to CMT April 2022. A summary report will be submitted to the Policy and Strategy Committee in September 2022. Thereafter refreshed streamlined plans and associated action plans will be submitted to CMT December 2022 Original timescale: June 2022 Revised timescale: December 2022 The Service has indicated that the recommendation has largely been addressed. The outstanding actions relate to refreshed streamlined plans and associated action plans being presented to CMT. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date.
Page 13
Appendix 2 Residual Risk Rating definition Internal Audit Assessment of Residual Risk from non-implementation High Non-implementation of actions has the potential to significantly undermine the relevant control environment. Medium Non-implementation of actions has the potential to impact upon the achievement of the control environment. Low Other issues which require management attention but which pose less significant or less immediate impacts to the control environment.