Internal Audit- Follow-Up of Actions previously agreed by Management in response to Audit Recommendations
North Lanarkshire Council · 24 November 2022
Back to Audit and Scrutiny Panel — 24 November 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref KA/LM/ASP/Nov 2022 Date 24/11/22 Internal Audit: Follow up of actions previously agreed by management in response to audit recommendations From Ken Adamson, Head of Audit and Risk Email adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to update the Panel on the results of Internal Audit’s follow-up work reviewing the extent to which management have implemented actions previously committed to in response to previous Internal and External Audit recommendations. Information is contained in respect of the last two years External Audit outputs and those actions agreed in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed in the period up to the end of September 2022. The Panel should note that where actions are not yet ‘complete’ this does not mean that no relevant activity has been undertaken by management and that often the actions taken/progress made to date will have reduced the risk exposure in respect of the weaknesses previously identified even if the action is not yet complete. It should be noted that, as reported to the Panel in December 2021, there has been a change to our reporting on follow-up and those recommendations which were previously reported to the Panel as partially implemented but not yet complete will now be monitored against revised target implementation dates agreed with management. 9 of the 14 actions agreed in respect of External Audit outputs have been completed, one has been partially implemented and four are no longer relevant. 19 of the 24 actions agreed in response to relevant Internal Audit recommendations due in the period have been fully completed and five have been assessed as partially implemented. Recommendations The Panel is invited to: (a) note the contents of this report; (b) note the recommendations made by Internal Audit at Appendix 1; and (c) to consider whether there are any issues arising from this report on which they wish to receive further information from relevant management. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 All Internal and External Audit reports contain management responses to audit recommendations which generally include a commitment to specific actions by a stated date. This report presents an overview of progress by management in addressing all External Audit recommendations made in the last two years and all ‘High’ and ‘Medium’ Internal Audit recommendations which were previously reported as outstanding or where the proposed actions were due to be completed by the end of September 2022. 1.2 The format of this report is designed to allow the Panel to focus on those issues where non-implementation of agreed actions presents the most significant ongoing risk to the Council and to enable the Panel to hold relevant senior management to account. 1.3 As reported to the Audit and Scrutiny Panel in December 2021, Internal Audit recently reviewed our arrangements for following-up audit recommendations. As a result, we have amended our processes to include, in certain circumstances, agreeing a revised implementation date and monitoring and reporting against these revised dates where we are provided with a strong rationale for the non-implementation of the audit recommendation by the originally agreed date. This avoids repeatedly reporting and focusing on actions which are ‘late’ where there are sound reasons for non- implementation by the originally agreed date. 1.4 This report presents the assessment of the potential risks arising from those planned actions agreed in response to Internal Audit recommendations due in the period (July to September 2022) which are not yet fully completed. 1.5 The updates from management on progress to date have been verified on a sample basis by Internal Audit as part of the preparation of this report. However, it should be noted that this review has focused on whether planned actions have been completed and has not included detailed substantive testing of whether the implemented actions have been effective in addressing previously identified weaknesses. 2. Report Actions previously agreed by management – Internal Audit recommendations 2.1 Table 1 below shows whether management have implemented those actions previously agreed to in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed by the end of September 2022. Overall, 19 of the agreed actions have been completed and five have been assessed as partially implemented. Table 1 Head of Service Area Complete Partially implemented No longer relevant Total Asset and Procurement 3 1 0 4 Audit and Risk 0 1 0 1 Business and Digital 4 3 0 7 Education (North/South) 2 0 0 2 Education and Families 3 0 0 3 Financial Solutions 3 0 0 3 People & Organisational Development 2 0 0 2 Performance, Planning and Quality Assurance 1 0 0 1 Planning and Regeneration 1 0 0 1 TOTAL 19 5 0 24
Page 3
2.2 Internal Audit has reviewed the management updates and agreed revised implementation dates for all five recommendations listed as partially implemented at Table 1 with relevant management. These recommendations will now be monitored in line with the agreed revised date and will be reported back to the Panel in accordance with this revised timescale at which time consideration will be given as to whether previously identified weaknesses have now been addressed. 2.3 Detail in respect of each of these recommendations and the current residual risk assessed by Internal Audit as a result of partial implementation is provided in Appendix 1, in which we have also made suggestions as to how the Panel may wish to consider these issues. Definitions of the residual risk ratings are provided at Appendix 3. 2.4 In response to queries raised at the last meeting of the Panel in September 2022, we have provided detail in respect of each of the recommendations which were reported at that meeting as ‘not yet complete’ and with a September 2022 revised date. This is as detailed in Appendix 2. Actions previously agreed by management – External Audit recommendations 2.5 Table 2 shows the status of actions agreed by management in response to External Audit reports issued as part of the 2019-20 and 2020-21 audits. Internal Audit has concluded that nine of the 14 agreed actions have been completed, one has been partially implemented and the remaining four actions are no longer relevant. Table 2 Completed Partially implemented Not yet due No longer relevant Total Report Title/Year 2019-20 Interim Audit Report 1 1 0 2 4 Annual Report 2 0 0 1 3 2020-21 Interim Audit Report 3 0 0 1 4 Annual Report 3 0 0 0 3 TOTAL 9 1 0 4 14 2.6 The four External Audit actions assessed as ‘no longer relevant’ relate to issues on which External Audit have made a subsequent recommendation in subsequent audit reports. 3. Measures of success 3.1 Internal Audit report each cycle to the Audit and Scrutiny Panel on the progress made by management in implementing actions previously committed to in response to Internal and External Audit reports. 4. Supporting documents Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Appendix 2 Internal Audit recommendations – Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Appendix 3 Residual risk rating definition Ken Adamson, Head of Audit and Risk
Page 4
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure by Services to address previously identified issues and/or weaknesses will impact on the effectiveness of the relevant control framework. This, depending on the nature of the issue, will be captured and should be reflected in the relevant Service risk register or the Corporate risk register (as appropriate).
Page 5
Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Asset and Procurement Enterprise Project (May 2022) Risk: Without a robust and realistic contingency plan in place the Council may not be able to ensure continuity of service delivery and achievement of ambitions. Recommendation: The Enterprise Project Board should ensure that the key tasks required to fully document a contingency plan, including key milestones and lead times/critical path, is included in the project plan and thereafter monitor development of the contingency plan to ensure that an alternative ‘Plan B’ is available, and lead times/critical path are clearly understood should the project not be able to be progressed as currently envisaged. Category: Medium The risk of a lack of market appetite for the procurement opportunities remains key within the Enterprise Project with the Project Board receiving updates on this and other risks at each meeting. This risk, along with a high-level contingency plan, has also been discussed separately with the SRO, Project Sponsor and Chief Executive. The Project Lead has taken advice from the project’s legal advisers and is developing contingency plans and timescales. The outcome of the SPD evaluation will help inform the Council’s decision to proceed with the procurement and/or appraise alternate delivery options (‘Plan B’). This decision will in turn help inform the detailed development of the ‘Plan B’ and if required, allow the ‘Plan B’ to be enacted after appropriate engagement with the CMT and Elected Members. Original timescale: July 2022 Revised timescale: December 2022 We acknowledge that work in this area to develop the ‘Plan B’ has been ongoing and that the delay in implementing this is largely due to ensuring the timely launch of the Phase 1 procurement. Given that further action is required to fully develop the contingency plan/’Plan B’, we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of December 2022 is achieved. We note that an update on the status and future development of the Enterprise Project is due to be presented to the Policy and Strategy Committee in December 2022. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow-up report. Head of Audit and Risk Risk Management (July 2022) Risk: The absence of a fully documented corporate risk register, subject to regular monitoring and challenge may mean that key stakeholders may fail to fully understand the key risks the Council faces and in turn may consequently fail to take appropriate action to mitigate them. Recommendation: The Head of Audit and Risk should ensure that the replacement and/or new corporate risks detailed in the finding are documented, assessed and moved to ‘live’ status with a reasonable timescale. Category: Medium The corporate risks on Supply Chain and the Scottish Child Abuse Inquiry have been developed, agreed and are now ‘live’. The corporate risk in relation to the National Care Service proposals has been documented as much as can be based on current information available. This will continue to be developed as the national policy direction progresses and the current level of uncertainty reduces. The two remaining corporate risks (Educational Outcomes and Target Operating Model) are both in draft format and require further discussion and development with the relevant Risk Leads before being agreed and finalised. Original timescale: September 2022 Revised timescale: December 2022 Whilst we acknowledge that there has been significant action taken to address the recommendations made, it is important the two remaining risks are finalised and moved to ‘live’ status at an early opportunity. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 6
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Business and Digital Digital NL (November 2021) Risk: Benefits and savings may not be being adequately tracked and monitored resulting in the Council being unable to demonstrate the achievement of the objectives of the programme. Recommendation: Management should ensure that: (1) the non-financial benefits tracker is finalised and approved with non-financial benefits thereafter identified, calculated, tracked and monitored for all workstreams; and (2) the review of the suite of documentation cited in the Benefits Management Realisation approach is completed and the process thereafter updated and circulated to all relevant parties. Category: Medium The updated Benefits Management approach has been revised, updated and circulated to all relevant parties. The non-financial benefits tracker templates for each of the sprints (both completed and those in progress) have been created but have not yet been populated with the expected non-financial benefits and how these will be measured and quantified. The focus to date has been on the financial benefits. 1:1 meetings require to be held with the Business Change Analysts to determine what, if any, non-financial benefits are/were expected and how these will thereafter be measured. The non-financial benefits tracker templates will thereafter be populated with this information. For those sprints which have already been completed, the templates will be updated retrospectively. Going forward, the expectation is that the templates will be updated in line with progression of the sprint. Original timescale: April 2022 Revised timescale: September 2022 Further revised timescale: March 2023 Whilst we acknowledge that the updated Benefits Management Approach would enable both financial and non-financial benefits to be identified, monitored and tracked, it is important that the non-financial benefits are identified, measured and quantified retrospectively for completed sprints and going forward identified and captured in a timely and consistent manner for those sprints not yet underway/at an early stage. Given the limited progress of identifying and quantifying non-financial benefits to date we have assessed the residual risk as ‘High’ and consider it important that the revised timescale is adhered to and would suggest that the Panel may wish to consider requesting an update on this issue from relevant senior management at the next meeting of the Panel.
Page 7
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Business and Digital Managing Strategic Change (June 2021) Risk: Key stakeholders may not be adequately informed of progress in the Council’s key corporate projects and may not be able to undertake effective oversight and/or ensure that timely remedial action, necessary to ensure that projects are delivered successfully, has been progressed by relevant management. Recommendation: Management should progress the previously identified action of establishing a reporting mechanism which better facilitates regular and ongoing oversight by key stakeholders of the progress of key projects against plan, including management of key risks, progress against timelines, cost against budget, achievement or otherwise of key milestones and expected outcomes or benefits realisation. We suggest that this could include introducing a standard reporting template and adopting a traffic light system to report progress against key criteria, project milestones and overall deliverability against expected time, cost and any other intended outcomes. Category: Medium Following review and refresh of the project management framework, the updated framework includes a section on reporting to the programme/project boards on the progress of specific programmes and projects. This references that good practice recommends that these reports assign a RAG status based on assessment criteria for three of the key dimensions within which the project requires to be delivered (i.e. cost, time and quality). Original timescale: September 2021 Revised timescale: September 2022 Further revised timescale: Still to be determined by management The Service consider this action to be complete as the updated project management framework includes detail around reporting to project/programme boards. However, we note that this does not reference the arrangements in place for reporting to key stakeholders (for example: CMT and/or Committee) to facilitate regular and ongoing oversight of identified key projects across the Council. We have assessed the residual risk as ‘High’ as the recommendation has not yet been fully addressed by management who have provided no clear indication as to how or when oversight of progress of key projects across the Council against plan, including management of key risks, progress against timelines, cost against budget, achievement or otherwise of key milestones and expected outcomes or benefits realisation will be reported to key stakeholders. We consider it important in allowing effective oversight and scrutiny that management identify and commit to a clear timescale for implementing this recommendation and would suggest that the Panel may wish to consider requesting an update on this issue from relevant senior management at the next meeting of the Panel.
Page 8
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Head of Service Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Head of Business and Digital Governance of Capital Projects (December 2019) Risk: If Services are aware of the projects which will be reviewed, they are more likely to follow the guidance for those projects and the results of any such reviews may not provide a true representation of the extent of compliance with expected arrangements, including use of the relevant guidance and control template documents. Recommendation: Management should review the ‘project management model review programme’, particularly in relation to: • expanding the sample of projects being reviewed to incorporate some capital and non-capital projects that Services have not received advance notification; and • reviewing and updating the checklist to include consideration of the adequacy and effectiveness of the completed control document templates, determination of whether established processes have been documented and confirmation that key stakeholders have been adequately updated on the progress of the project, in line with the suggested improvements at Appendix 3. Category: Medium A review programme cannot be established until the Project Registers have been received from Heads of Service. This review programme will cover both capital and non-capital projects. An e-mail was sent to all Heads of Service on 11th October 2022 asking that they submit their Project Registers by the 1st November 2022. Project Register maintenance and monitoring will be revisited in line with the future development and implementation of a centralised project management IT system. As reported to CMT on 27/09/22, the review and refresh of the project management framework identified the need for a more consistent approach across the Council with regards to the extent and effectiveness of the programme and project board. It is considered that this approach will also support further improvements in the development of the project management framework review programme and ensure that it provides a meaningful accurate and representative assessment of the extent of compliance with the fundamentals and mandatory tasks within the framework. Original timescale: June 2020 Revised timescale: September 2022 Further revised timescale: Still to be determined by management Although the Service have provided some detail around the planned approach and review programme for the project management framework which will assess compliance with this, they have provided limited detail to confirm how and when this will be implemented. Given that further action is required to progress arrangements for monitoring compliance with the refreshed project management framework, we have assessed the residual risk as ‘Medium’ and consider it appropriate that more detailed plans and timescales are identified by management at an early stage. We would suggest that the Panel may wish to consider agreeing to note the progress made and request that management provide an update including revised implementation dates at the next meeting of the Panel.
Page 9
Appendix 2 (continued) Internal Audit recommendations - Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Head of Service Report Details Details from original recommendation Position per previous management update Internal Audit comment per previous update Position as at October 2022 Head of Business and Digital Governance of Capital Projects (December 2019) Housing Investment Programme (October 2020) Managing Strategic Change (June 2021) The three audit reports listed each raised issues regarding the Council’s project management model. In summary the risks and recommendations arising comprised the following: Risk: The Council’s project management arrangements may not reflect good practice which may lead to projects being managed and documented on an inconsistent basis. Key stakeholders may not be adequately informed of progress in the Council’s key corporate projects and may not be able to undertake effective oversight and/or ensure that timely remedial action, necessary to ensure that projects are delivered successfully, has been progressed by relevant management. Recommendation: Management should: • review and update, as appropriate, the project management model to ensure that it is sufficiently prescriptive to enable officers to identify the circumstances of when, and to what extent, it should be followed. • review and amend the project management documentation to ensure that it requires the title of the project to be recorded and includes version control to clearly detail when it was prepared and last updated. • review the ‘project management model review programme’ particularly in relation to: expanding the sample of projects being reviewed to incorporate some capital and non-capital projects that Services have not received advance notification of; and reviewing and updating the checklist giving due consideration to the suggested improvements made by Internal Audit. • progress the previously identified action of establishing a reporting mechanism which better facilitates regular and ongoing oversight by key stakeholders of the progress of key projects against plan, including management of key risks, progress against timelines, cost against budget, achievement or otherwise of key milestones and expected outcomes or benefits realisation. We suggest that this could include introducing a standard reporting template and adopting a traffic light system to report progress against key criteria, project milestones and overall deliverability against expected time, cost and any other intended outcomes. Category: Medium The planned review process and subsequent refresh of the council’s Project Management Model took place from February to June 2022. A Review Team comprising representatives from all Services, including audit and risk, took part in the evaluation and review process. The refreshed Project Management Framework was circulated to the Review Team for their final input in June 2022. Insufficient feedback was received from the majority of service representatives on the Review Team which led to a delay in the finalisation of the refreshed Project Management Framework. Further work is being undertaken on a 1:1 basis to ensure Services are fully engaged with, and involved in, the final development stages of the refreshed Project Management Framework. Following this, the Project Management Framework will be finalised and submitted to CMT for approval. Revised timescale: April 2022 Further revised timescale: September 2022 The Service has indicated that these actions are largely complete and that the delay in implementation is largely due to insufficient feedback from service representatives which the Service are currently taking steps to address. Given the extensive delay in implementation of these recommendations, we assess the residual risk as ‘High’ and would suggest that the Panel may wish to consider noting the progress made to date and the revised timescale but also to request an update on this issue from relevant senior management at the next meeting of the Panel if the action is not fully implemented at that time. The actions in respect of the review and update of the project management model and the project management documentation have now been fully implemented. The refreshed project management model was presented to CMT, OMT and ODA in September/October 2022. An update in terms of the next steps is documented in the Strategic Frameworks Annual Position Statement which is included the pack for this meeting of the Panel. The actions in respect of amendments to the ‘project management model review programme’ and establishing a reporting mechanism which better facilitates regular and ongoing oversight by key stakeholders of the progress of key projects against the plan are partially implemented. See Appendix 1 for further detail on the current position.
Page 10
Appendix 2 (continued) Internal Audit recommendations - Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Head of Service Report Details Details from original recommendation Position per previous management update Internal Audit comment per previous update Position as at October 2022 Head of Business and Digital Digital NL (November 2021) Risk: Benefits and savings may not be being adequately tracked and monitored resulting in the Council being unable to demonstrate the achievement of the objectives of the programme. Recommendation: Management should ensure that: (1) the non-financial benefits tracker is finalised and approved with non-financial benefits thereafter identified, calculated, tracked and monitored for all workstreams; and (2) the review of the suite of documentation cited in the Benefits Management Realisation approach is completed and the process thereafter updated and circulated to all relevant parties. Category: Medium The non-financial benefits tracker has been finalised and the updated Benefits Management Approach revised and updated. However, the non-financial benefits tracker has not yet been populated for all workstreams and work is ongoing in this area. The agenda for SRO/Delivery Board has recently been amended to focus on Benefits Realisation as the first agenda item. Revised timescale: September 2022 The Service has indicated that they consider these actions to be largely complete. However, while we acknowledge that there has been some progress made in this area, we consider there is still further action which requires to be taken to fully address the identified risks. This action thus remains partially implemented. See Appendix 1 for further detail on current position.
Page 11
Appendix 2 Internal Audit recommendations - Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Head of Service Report Details Details from original recommendation Position per previous management update Internal Audit comment per previous update Position as at October 2022 Head of Asset and Procurement Procurement (November 2021) Risk: If performance measures are not correctly calculated in line with the definition, management and elected members may misinterpret the information presented to them and may not raise appropriate questions. Recommendation: Asset and Procurement Solutions should review the processes in place to ensure that all future performance measures contained within the Annual Procurement Report are accurately and consistently calculated in line with the corresponding definition. Category: Medium Performance indicators have been reviewed and amended. Work is ongoing with the Scottish Government to ensure that relevant content is incorporated into the future Annual Procurement Report. The Annual Procurement Report is currently being finalised prior to it being reported to the Finance and Resource Committee in September 2022. Revised Timescale: September 2022 The Service has indicated that they consider this recommendation to be largely complete and have committed to finalising the Annual Procurement Report for the next meeting of the Finance and Resource Committee scheduled for September 2022. This action has now been fully implemented. The Annual Procurement Report 2021-22 has been finalised and was presented to the Finance and Resources Committee in September 2022. Head of Business and Digital Digital NL (November 2021) Risk: Inadequate arrangements for identifying, agreeing and realising expected outcomes (including expected financial savings) within timescales may result in consequential impacts on the management of the Council’s finances. Recommendation: Management should continue to review the future deliverability of the revised Digital NL programme to ensure timescales for delivery and expected outcomes are realistic and achievable. This should include consideration of: • further developing/enhancing the RAG status for assessing individual projects/workstreams. In particular consideration should be given to splitting the RAG status to provide separate assessments of achievement of timescales and achievement of projected benefits (including expected savings) to enable the impact of the RAG status on savings to be more clearly documented. • the use of optimism bias to make explicit risk-based adjustments to the projected estimates of projects costs, benefits (including expected savings), and duration; and • the identification and implementation of actions necessary to address the continual movement of projected savings. Category: High A full review of deliverability of the DigitalNL programme, SmartNL and infrastructure business has taken place. The outstanding year 3 development work and the potential Year 4 Roadmap were reviewed in line with shape and size, resource availability, benefits realisation, funding availability and risk. A prioritisation matrix has been developed and an Assessment Board created to ensure all activities are reviewed in line with the newly developed Integrated Programme Plan. The full end to end process was presented to the SRO meeting on 26 May 2022 with approval given at this meeting to further develop the proposals. In recognising the Delivery Board is responsible for governing the DigitalNL programme and its associated outcomes, the final proposals will be presented to the Delivery Board in August 2022 for consideration and approval as appropriate. Revised timescale: August 2022 The Service has indicated that they consider these actions to be largely complete. However, while we acknowledge that there has been some progress made in this area, we consider there is still further action which requires to be taken to fully address the identified risks. This action has now been fully implemented. A report was presented to the Policy and Strategy Committee in September 2022 outlining the progress to date and the Roadmap for Year 4 and beyond.
Page 12
Appendix 2 (continued) Internal Audit recommendations - Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Head of Service Report Details Details from original recommendation Position per previous management update Internal Audit comment per previous update Position as at October 2022 Head of Business and Digital Digital NL (November 2021) Risk: Without full, clear and timely information, key stakeholders may not be able to effectively monitor performance in respect of the DigitalNL programme and/or progress against expected benefits and planned outcomes or determine whether the programme is achieving its targets, and/or identify and agree timely action to address areas of underperformance and/or make informed decisions about the future direction of the DigitalNL programme. Without clear recording of actions prescribed and identified responsible officers for actions planned in response to highlighted risks, key stakeholders would be unable to monitor the risk to ascertain if it had been addressed/mitigated. Recommendation: Management should ensure that: (1) reports on DigitalNL to the Delivery Board, CMT and Committee are amended to provide a clear and comprehensive assessment of progress/status of both the programme as a whole and of individual workstreams. This should include an assessment of each project/workstreams RAG status; (2) reports submitted to the Board make clear reference to all those significant risks with the potential to impact on the successful delivery of the programme including the relevant mitigating controls; actions planned to further address the relevant risk and identified officers tasked with doing so and that key risks are tracked and monitored at each meeting of the Board; and (3) discussions at the Board in relation to any high/significant programme risks included on the Programme Highlight Report submitted to the Board, including the corresponding prescribed action(s) and identified officers, are clearly documented in the Action Note or Action Summary of that meeting. Category: Medium The Programme Highlight report submitted to the Delivery Board has been reviewed and amended to clearly show the RAG status and the financial and non-financial benefits anticipated for each business change sprint. The reports submitted to the Board make clear reference to significant risks and a link to the Risk Register has been added to the Programme Highlight Report. The Action Summary, introduced in early 2022, allows members of the Delivery Board to focus on agreed actions. Revised timescale: September 2022 The Service has indicated that they consider this action to be substantially complete. However, due to the limited number of Delivery Board meetings since the process was amended, we have not yet been able to determine whether adequate detail is provided and/or appropriate discussions held with regards to those risks assessed as ‘high’/red. This action has now been fully implemented. A report was presented to the Delivery Board at the end of August referencing proposed changes to the Programme Highlight Report which will further enhance the reporting process. A revised report incorporating these changes was presented to the Board on 27 October 2022.
Page 13
Appendix 2 (continued) Internal Audit recommendations - Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Head of Service Report Details Details from original recommendation Position per previous management update Internal Audit comment per previous update Position as at October 2022 Head of Education (North/South) Follow Up: Scottish Attainment Challenge & Pupil Equity Fund (August 2021) Risk: Without short, medium and long-term targets against which performance can be monitored, there is a risk that effective oversight of the SAC and PEF programmes may be impaired. Without an effective performance management framework, management would not be able to measure whether the SAC and PEF programmes were being delivered and/or may not be able to take appropriate action to address areas of ‘under- performance’. Recommendation: Management should: (1) identify and set realistic short, medium and long-term targets for the SAC and PEF programmes and consider the current and future planned actions which will be taken to deliver against the identified objectives and measures of success (2) ensure that appropriate and realistic SMART performance measures are used wherever possible in the annual SAC Plan, subsequent progress reports to committee and within the individual establishments’ SIPs and SIRS to ensure that progress of key all actions and interventions can be appropriately tracked; and (3) set out clearly defined baselines against which the activities or interventions will be assessed for their contribution to closing the poverty-related attainment gap and ensure that the reports at both authority and individual establishment level clearly set out to key stakeholders the progress made against the identified targets/milestones together with any significant challenges in achieving these targets. Category: Medium Previous targets have been set by the Scottish Government but from 2022, targets in relation to progress in attainment are being set in collaboration and discussion with local authorities and both the SAC and PEF Team are engaging in discussions to agree on aspirational yet achievable targets and align the plans for the year ahead. Further development sessions for Headteachers and senior managers have taken place to assist with the development of clear rationales; help with the identification of outcomes and measures and provide both a local and national context to their approach. Whilst improvements in planning at school level have been noted the SAC and PEF Team consider there is still work to be done in encouraging greater detail in school improvement plans. The Improvement and Equity Lead continues to support and challenge establishments in both their SAC and PEF submissions through scrutiny of plans and encouraging all schools to ensure that, wherever possible, data should form the basis of all submissions of progress in the bi- annual checkpoints. Revised timescale: June 2022 Further revised timescale: September 2022 Whilst we acknowledge that there has been some action taken to address the recommendations made, we consider that there is still further action required to fully mitigate the identified risks. This action has now been fully implemented. A review of the documentation provided demonstrated that the Head Teachers are now identifying, planning and setting out outcomes for their SAC and PEF programmes. There are two bi-annual reporting ‘checkpoints’ as part of the annual improvement cycle for all establishments. Schools/establishments are now using a variety of data when setting targets and both the reports to Committee and individual schools’ School Improvement Plans now include detail on performance measures and progress being made. An update on progress of SAC and PEF was presented to CMT in October 2022 and will be presented to the November meeting of the Education, Children and Families Committee.
Page 14
Appendix 2 (continued) Internal Audit recommendations - Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Head of Service Report Details Details from original recommendation Position per previous management update Internal Audit comment per previous update Position as at October 2022 Head of Education (North/South) Follow Up: Scottish Attainment Challenge & Pupil Equity Fund (August 2021) Risk: Services may not be procured in accordance with the Framework. Without formal documentation, schools may not be able to evidence why a particular procurement method and/or supplier was selected and/or be able to demonstrate best value when procuring services Recommendation: Management should: (1) remind/encourage all schools to use the Procurement framework as far as possible and of the requirements of the Framework (including the use of approved suppliers wherever possible) and the importance of completing the RFP documentation for each procurement exercise; (2) periodically report to senior management on the use of, and expenditure incurred via, the Framework against the total spend allocation; and (3) ensure that they periodically review non-Framework expenditure items to obtain sufficient assurance that procurement activity funded via SAC/PEF is being undertaken in accordance with corporate expectations and can demonstrate best value. Category: Medium Headteachers are reminded on an ongoing basis of the requirements of the Procurement Framework. A review of Framework and non-Framework expenditure for session 2021-22 has been undertaken with subsequent findings to be reported to the Programme Board and Services Senior Leadership Team in August 2022. Revised timescale: June 2022 Further revised timescale: September 2022 Whilst we acknowledge that there has been some action taken to address the recommendations made, we consider that there is still further action required to fully mitigate the identified risks. This action has now been fully implemented. A review of Framework and non- framework expenditure has been reported to both the Programme Board and the Senior Leadership Team. This was presented to the Senior Leadership Team at the end of August 2022 and thereafter shared with the Programme Board at the October meeting.
Page 15
Appendix 2 (continued) Internal Audit recommendations - Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Head of Service Report Details Details from original recommendation Position per previous management update Internal Audit comment per previous update Position as at October 2022 Head of Education and Families Tackling Poverty (November 2021) Risk: If the process to create a consolidated action plan is not properly documented, the LCPAR action plan may not be appropriately aligned with the strategy action plan which may result in key actions potentially being missed in error. Feedback from external reviews may not be incorporated into the LCPAR resulting in a failure to address or progress relevant actions or activities. Recommendation: Management should ensure that: (1) all relevant key actions from the strategy are, where appropriate, incorporated within the LCPAR action plan and/or that where actions are removed/not included there is appropriate documentary evidence maintained to support the rationale for their removal; and (2) all outstanding recommendations and actions arising from the NL Fairness Commission and Scottish Government reviews are, where appropriate, incorporated into the LCPAR. Category: Medium Following the production of the Best Start, Bright Futures Child Poverty Delivery Plan 2022-2026, the LCPAR will be incorporated within the production of a new Tackling Poverty Strategy 2023-2026 which will allow for forward planning whilst meeting the requirements of the Scottish Government. This document will include all of the outstanding recommendations and actions from the North Lanarkshire Fairness Commission and Scottish Government reviews. The Local Child Poverty Action Report will be prepared and submitted to the Policy and Strategy Committee in September 2022. Revised timescale: September 2022 The delay in implementing this action is due to a number of factors, including the Council elections, however a firm commitment has been given by the Service to submit the LCPAR to Committee in September 2022. This action has now been fully implemented. The Local Child Poverty Action Report was prepared and submitted to the Policy and Strategy Committee in September 2022.
Page 16
Appendix 2 (continued) Internal Audit recommendations - Management actions with revised timescale of September 2022 per ASP meeting on 8/9/22 Head of Service Report Details Details from original recommendation Position per previous management update Internal Audit comment per previous update Internal Audit comment Head of Financial Solutions Use of Corporate Credit Cards and Purchase Cards (November 2021) Risk: Without a clear statement of expected procedures and oversight arrangements, there is an increased risk of inadequate control over the administration of purchase cards and expenditure incurred which may be inappropriate and/or not appropriately monitored. Recommendation: The Head of Financial Solutions should, in conjunction with Facility Support Services, undertake a formal review of the purchase card scheme, to ensure that an appropriate and effective control environment is established and thereafter implemented. The review should include, but not be limited to, considering the issues identified in the finding. Category: High The review of the purchase card scheme is currently underway. Delays in implementation are due to staff changes, shortages and a prioritisation of financial year end activities. Revised timescale: September 2022 Although the review of the purchase card scheme is not yet complete, we acknowledge that the delay in implementing this is due to a number of factors, including changes in staff. A firm commitment has been given by the Service to complete the review by the proposed revised timescale. This recommendation has been fully implemented. The review has now been completed and the Policy reviewed and re- issued to the relevant managers along with detailed instruction on the responsibility of card holders. A briefing note providing details of the Financial Solutions review and resultant recommendations and was issued to the Head of Financial Solutions in September 2022. Steps have been taken to implement the recommendations made in this briefing note.
Page 17
Appendix 3 Residual Risk Rating definition Internal Audit Assessment of Residual Risk from non-implementation High Non-implementation of actions has the potential to significantly undermine the relevant control environment. Medium Non-implementation of actions has the potential to impact upon the achievement of the control environment. Low Other issues which require management attention but which pose less significant or less immediate impacts to the control environment.