Agenda pack
North Lanarkshire Council · 16 February 2023
Back to Audit and Scrutiny Panel — 16 February 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Our Ref: Your Ref: Contact: Tel: Fax: E-Mail: Date: Lesley Dysart dysartl@northlan.gov.uk 7 Feb 2023 Members of the Audit and Scrutiny Panel Chief Executive’s Office Archie Aitken Chief Officer of Legal & Democratic Civic Centre, Windmillhill Street Motherwell ML1 1AB DX 571701, Motherwell 2 www.northlanarkshire.gov.uk Notice is given that a Meeting of the AUDIT AND SCRUTINY PANEL is to be held in Committee Room 1, Civic Centre, Motherwell on Thursday, 16 February 2023 at 2p.m. which you are requested to attend. The agenda of business is attached. Chief Officer of Legal and Democratic Members : Councillors: H Dunbar, T Fisher, J Hume, D Johnston, T Johnston, H Loughran, F McNally, G Robinson, K Stevenson, R Sullivan, and S Watson. Page 1 of 285
Page 2
Page 2 of 285
Page 3
AGENDA (1) Declarations of Interest in terms of the Ethical Standards in Public Life Etc. (Scotland) Act 2000 (2) Remit from the Adult Care and Social Work Committee of 15 November 22 - Quality Assurance Annual Report (page 7 - 28) Submit report by the Head of Planning, Performance & Quality Assurance updating the Panel on the Quality Assurance activity over the annual period from 1 April 2021 to 31 March 2022 (copy herewith) AUDIT RELATED ITEMS (3) Audit and Risk-Related Items: Action Log (page 29 - 32) Submit report by the Chief Officer of Audit and Risk allowing the Panel to track implementation of requests and recommendations made by the Panel in respect of audit and risk-related items in the previous 18 months (copy herewith) (4) Internal Audit Progress Report (page 33 - 96) Submit report by the Chief Officer of Audit and Risk (1) providing an overview of Internal Audit activity, and (2) reporting the results of Internal Audit outputs finalised since the last update to the Panel in November 2022 (copy herewith) (5) Internal Audit: Follow-Up of Actions previously agreed by Management in response to Audit Recommendations (page 97 - 114) Submit report by the Chief Officer of Audit and Risk updating the Panel on the results of Internal Audit's follow-up work reviewing the extent to which Management have implemented actions previously committed to in response to previous Internal and External Audit recommendations (copy herewith) (6) Audit Scotland - Audit Strategy Letter 2022-23 (page 115 - 120) Submit report by the Chief Officer of Audit and Risk providing the Panel with information from Audit Scotland, the Council's appointed external auditors, on the status of their 2022-23 audit planning (copy herewith) (7) Changes to the Code of Practice on Local Authority Accounting 2022/23 (page 121 - 126) Submit report by the Chief Officer of Finance highlighting any significant changes to the Code or guidance in the Technical Bulletins which may impact on the accounting requirements and presentation of the Council's 2022/23 Annual Accounts (copy herewith) RISK MANAGEMENT RELATED ITEMS (8) Risk Management Update (page 127 - 136) Submit report by the Chief Officer of Audit and Risk providing a brief update on key risk management developments since the most recent update report to the Panel in November 2022 (copy herewith) Page 3 of 285
Page 4
2 (9) National Care Service Proposals (page 137 - 146) Submit report by the Chief Social Work Officer (1) focusing on a new risk within the Council's Corporate Risk Register relating to proposals for a National Care Service as set out within the National Care Service (Scotland) Bill introduced to the Scottish Parliament on 21 June 22, and (2) providing an overview of the current risk environment as set out and assessed within the draft Deep Dive document attached at Appendix 1 to the report (copy herewith) SCRUTINY RELATED ITEMS (10) New Approach to Auditing Best Value (page 147 - 156) Submit report by the Chief Officer of Business and Digital providing the Panel with an overview of the new national approach to auditing Best Value, based on information available at the current time (copy herewith) (11) Annual Scrutiny Programme (page 157 - 168) Submit report by the Chief Officer of Business and Digital setting out the annual programme for the scrutiny function of the Audit and Scrutiny Panel (copy herewith) (12) Strategic Performance Framework - Performance Reporting Schedule 2023 to 2024 (page 169 - 184) Submit report by the Chief Officer of Business and Digital (1) updating the Performance Reporting Schedule initially established in 2021, and (2) setting out the service specific, statutory, corporate, and Strategic Performance Framework performance reporting arrangements for 2023 to 2024 (copy herewith) (13) PoW:075.1 - Arm's Length External Organisations: Governance and Risk Management Oversight and Assurance Report 2022/23 (page 185 - 208) Submit report by the Chief Officer of Business and Digital providing the six monthly overview of ALEOs' governance, financial governance, risk management and service delivery arrangement (copy herewith) (14) Cyber Security Assessment - Supplementary Report (page 209 - 220) Submit report by the Chief Officer of Business and Digital (1) supplementing Internal Audit's findings and recommendations - reported separately within the Internal Audit Progress Report - through providing the Panel with additional details of cyber security activities performed by the Council, and (2) providing the Panel with a high-level overview of the Cyber Security Management principles adopted by the Council (copy herewith) (15) Senior Information Risk Owner (SIRO) - Information Governance - Assurance and Performance Report 2021-2022 (page 221 - 248) Submit report by the Chief Officer of Business and Digital providing assurances that information risks are being effectively managed to ultimately enable the Council to comply with legislative requirements and good practice (copy herewith) Page 4 of 285
Page 5
3 Reports called for at the previous Audit and Scrutiny Panel Meeting of 24 November 2022 (16) PO003.2: DigitalNL Quantifying and Reporting on Non-Financial Benefits (page 249 - 264) Submit report by the Chief Officer of Business and Digital (1) focussing on the recommendation made within the most recent internal audit report for DigitalNL completed in November 2021 with regard to the identification, calculation, monitoring and tracking of non- financial benefits, and (2) highlighting a number of next steps to be developed in order to finalise and fully deploy the non-financial benefits element of the Benefits Tracker (copy herewith) (17) Update on the Implementation of the Refreshed Project Management Framework (page 265 - 285) Submit report by the Chief Officer of Business and Digital focussing on two recommendations arising from the governance of capital projects and managing strategic change audits which were considered as “not yet complete”, and in doing so it specifically provides information on reporting to all stakeholders on key projects, and the arrangements for monitoring compliance with the project management framework through a review programme (copy herewith) Page 5 of 285
Page 6
Page 6 of 285
Page 7
North Lanarkshire Council Report Adult Care and Social Work Committee Does this report require to be approved? ☐ Yes ☒ No Ref MD/MW Date 15/11/22 Quality Assurance Annual Report From Morag Dendy, Head of Planning, Performance & Quality Assurance E-mail WilliamsonM@northlan.gov.uk Telephone 01698 332093 1. Background 1.1 This report highlights Quality Assurance activity over the period 1 April 21 to 31 March 22 and covers Contracts & Contract Management, Regulatory Activity, Procurement, Complaints, Duty of Candour, Provider Sustainability and Children & Families. Full detail of these activities is included in Appendix One. Executive Summary The role of Quality Assurance covers a range of functions across social work by facilitating the delivery of high-quality services through effective business planning, maintaining quality standards and quality monitoring information. Our commitment is to provide an annual report on activity carried out in the preceding year. The purpose of this report is to update Committee on our Quality Assurance activity over the annual period of 1 April 21 to 31 March 22. Recommendations It is recommended that the Adult Care and Social Work Committee: 1) note and endorse the contents of the report. 2) Remit the report for information to the Integration Joint Board 3) Remit the report for information to the Audit and Scrutiny Panel 4) Remit the report for information to the Education, Children and Families Committee The Plan for North Lanarkshire Priority Improve North Lanarkshire's resource base Ambition statement (24) Review and design services around people, communities, and shared resources AGENDA ITEM 2 Page 7 of 285
Page 8
2. Report 2.1 Contracts - In partnership with colleagues from Corporate Procurement, the Quality Assurance Team is responsible for procuring and contracting with a wide variety of independent sector organisations who provide services to the most vulnerable people living in our communities. A methodical and systematic approach has been developed resulting in over 90% of services purchased by social work now having an agreement in place ranging from national framework arrangements to individual service agreements. 2.2 Contract Management - A key function of the Quality Assurance Team is to ensure and evidence that effective, rigorous, and consistent contract monitoring processes are in place with organisations from whom social work purchase services. This is to provide good quality and up to date information which will inform practice and strategic decision making in relation to the commissioning, contracting and compliance arrangements in place. 2.2.1 This approach provides evidence that each commissioned service is delivered as specified to the terms and conditions of the contract, relevant quality standards and provides value for money. 2.2.2 The Monitoring Prioritisation Assessment (MPA) is the key component of the CMF. The MPA is the up-to-date position statement on the performance of commissioned contractors. The MPA determines the monitoring status of each commissioned service based on a tier system which consequently determines the frequency of monitoring activity. The tiers range from Tier 1 (green) which relates to satisfactory performance and a monitoring frequency of annually, in most cases, to Tier 4 (red) which indicates significant concerns in relation to service delivery and a monitoring frequency of 1 to 4 weekly. 2.3 Regulatory Activity - During the COVID 19 pandemic, Care Inspection activity was focused around one key quality question “How good is our care and support during the Covid 19 pandemic?”. In late 2021, the focus slightly changed to include the quality question “How well do we support people's wellbeing?”. The inspections were predominately with Care Homes; however, a few Self-Directed Support providers were also inspected generally in response to complaints or increased notification activity to the Care Inspectorate. 2.4 Provider sustainability - Since the start of the pandemic there have been ‘sustainability’ arrangements in place to ensure Social Care services/facilities continued to operate in a financially secure and viable manner including provision of payments when services couldn’t be delivered. The sustainability principles were due to end in June 2021 but further extensions have been applied. There remains a requirement to ensure that Social Care capacity is sustained to achieve positive outcomes for clients, whilst also addressing the overarching need to demonstrate value for money, streamline payment arrangements and demonstrate the approach is fair, equitable and transparent. 2.5 Procurement - A fundamental aspect of the role of Quality Assurance is ensuring that the people North Lanarkshire Council (NLC) arranges support for can be confident that support is provided legally, safely, with their interests at the centre and that ensures Best Value for NLC. A key component of this work is carried out with our colleagues in Corporate Procurement. The collaboration with Corporate Procurement has enabled us to jointly pursue further refinements to commissioning and procurement. Page 8 of 285
Page 9
2.6 Children, Families and Justice - Quality Assurance monitors most Children’s services where a contract status has been secured either on an Individual Placement basis or as part of a Framework Agreement, generally through Scotland Excel. 2.7 Complaints - Quality Assurance retains an overview role in terms of complaints made about NLC Social Work service provision. Regular quarterly reports on complaints activity are reported through our governance structures. 3. Measures of success 3.1 Measures of success are contained within Appendix One of this report. 4. Supporting documentation 4.1 Appendix 1: Quality Assurance Annual Report 2021/22. Morag Dendy Head of Planning, Performance & Quality Assurance Page 9 of 285
Page 10
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? As part of the council’s commitment to Fair Work and social work’s drive to adopt an ethical commissioning approach, Fair Work practices have been embedded in procurement processes to ensure contractors are paying the Scottish Living Wage and are committed to providing community benefits. If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality-and-fairer- scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Financial Solutions? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☒ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People and Organisational Development? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic Solutions? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Conformance with Procurement Reform Scotland Act 2014 and the Procurement (Scotland) Regulations 2016. The Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016 and organisational duty (Duty of Candour) on health, care, and social work services. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Page 10 of 285
Page 11
Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for technology, has an assessment been carried out (or scheduled) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☒ No ☒ If Yes, please provide a brief summary of the impact? Requirement to publish an annual Duty of Candour Report 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Risks are identified and reported on via the relevant risk register. Page 11 of 285
Page 12
2021/22 Quality Assurance Annual Report 2021/22 APPENDIX 1 Page 12 of 285
Page 13
1. Introduction The role of Quality Assurance covers a range of functions across social work by facilitating the delivery of high-quality services through effective business planning, maintaining quality standards and quality monitoring information. The team support the development and/or maintenance of robust practices that assist in achieving better outcomes for those who access services. Our cycle of monitoring and review ensures services meet the strategic aims of both the Council and the Health and Social Care Partnership. Our commitment is to provide an annual report on activity carried out in the preceding year. This report outlines activity over the period 1 April 21 to 31 March 22 and covers Contracts & Contract Management, Regulatory Activity, Procurement, Complaints, Duty of Candour, Provider Sustainability and Children & Families. 2. Contracts In partnership with colleagues from Corporate Procurement, the Quality Assurance Team is responsible for procuring and contracting with a wide variety of independent sector organisations who provide services to the most vulnerable people living in our communities. A methodical and systematic approach has been developed resulting in over 90% of services purchased by social work now having an agreement in place ranging from national framework arrangements to individual service agreements. Tables 1a and 1b below illustrate graphically the extent of the work that has been carried out in engaging with the independent sector in a proportionate and balanced way to ensure service provision has a legal basis, is provided safely and is of a high quality through our contracting arrangements. As of 31 March 22, 93% of all social work spend had the provision of a formal contracting arrangement, the remaining 7% will be reviewed and prioritised in the coming year and contracts agreed as appropriate. Table 1a Page 13 of 285
Page 14
Table 1b 3. Contract Management Framework (CMF) A key function of the Quality Assurance Team is to ensure and evidence that effective, rigorous and consistent contract monitoring processes are in place with organisations from whom social work purchase services. This is to provide good quality and up to date information which will inform practice and strategic decision making in relation to the commissioning, contracting and compliance arrangements in place. This approach provides evidence that each commissioned service is delivered as specified to the terms and conditions of the contract, relevant quality standards and provides value for money. In addition, this approach moves the emphasis of the Quality Assurance Team from a service improvement focus to a contract management arrangement to enhance the principles of consistency, efficiency and effectiveness at the heart of Best Value. The CMF was developed to align with contract development and this process will continue as contracts and procurement exercises change to reflect new models of provision and procurement. It is a whole systems approach which links commissioning, contracting, monitoring, reviewing and re/de- commissioning. The CMF is a redesign of previous and existing monitoring practice in parallel with the development of the Council’s digital systems to securely exchange and make available information to improve decision making at individual, practitioner and strategic level. For individuals using commissioned services it supports them to: • be confident their views are listened to, respected and used to influence service quality. • be confident that their best interests/outcomes are at the heart of the approach • be able to make informed choice Page 14 of 285
Page 15
The Monitoring Prioritisation Assessment (MPA) is the key component of the CMF. The MPA is the up- to-date position statement on the performance of commissioned contractors. The MPA determines the monitoring status of each commissioned service based on a tier system which consequently determines the frequency of monitoring activity. The tiers range from Tier 1 (green) which relates to satisfactory performance and a monitoring frequency of annually, in most cases, to Tier 4 (red) which indicates significant concerns in relation to service delivery and a monitoring frequency of 1 to 4 weekly. The processes of monitoring and the accompanying reporting build a body of real time and accessible information regarding the quality-of-service provision, its performance and outcomes over the life of a contract/framework. Table 2 STATUS INDICATED MONITORING LEVEL Red Significant concerns in relation to service performance, contract compliance. TIER 4 Amber (high) Moderate concerns in relation to service performance, contract compliance TIER 3 Amber (low) Minor concerns identified in relation to service performance and contract compliance TIER 2 Green Service performance, contract compliance and engagement are satisfactory. TIER 1 Each Tier suggests a minimum monitoring frequency (Table 3). The basis of monitoring will be the commitments made by the contractor as part of their contractual agreement with the Council including, but not limited to, Standard Terms and Conditions, Data Protection Terms and Conditions, Special Terms and Conditions, commitments made in relation to Fair Work Practices and Community Benefits and relevant national standards. Table 3 Tier 1 Contract monitoring visit frequency – annually in most cases. Tier 2 Contract monitoring visit frequency – variable, at least bi-annually but no more than quarterly. Tier 3 Contract monitoring visit frequency – variable, at least quarterly but no more than monthly. Tier 4 Contract monitoring visit frequency – 1 to 4 weekly. Page 15 of 285
Page 16
For the 2021/22 reporting period, monitoring activity was undertaken on 300+ contractor organisations. Despite a challenging environment in relation to the pandemic response, 72% of contractors had a Tier 1 monitoring status, with Tier 2 at 16%, Tier 3 at 8% and only 3% of contractors at Tier 4 (as of 31 March 22) indicating the value of having close and robust relationships with contractors. Table 4 4. Regulatory Activity During the COVID 19 pandemic, Care Inspection activity was focused around one key quality question “How good is our care and support during the Covid 19 pandemic?”. In late 2021, the focus slightly changed to include the quality question “How well do we support people's wellbeing?”. The inspections were predominately with Care Homes; however, a few Self-Directed Support providers were also inspected generally in response to complaints or increased notification activity to the Care Inspectorate. Care Homes in NL: 22 Care Homes were inspected in relation to 1 or more quality indicators in the year to 31 March 22. Key question 7 – ‘How good is our care and support during the Covid 19 pandemic?’ was applied to all inspections. The remaining care homes will receive a fuller inspection in 2022/23. It is worth noting that 2 care homes were the subject of Large-Scale Investigations, under Adult Support and Protection legislation, with significant support provided by the Care Inspectorate and Senior Council Officers to address and improve quality improvement measures. One of these care homes has subsequently closed with Care Inspection registration being removed. 221 49 22 11 Contractors Tier 1 Tier 2 Tier 3 Tier 4 Page 16 of 285
Page 17
Table 5 Table 5 above illustrates the challenging environment care homes were operating in during the pandemic with 14 of the 22 homes assessed as ‘Adequate’ for the category relating to care and support during the pandemic. Care Homes in Scotland (excluding NL): North Lanarkshire Council currently has people placed within 141 care homes that are located elsewhere in Scotland. North Lanarkshire Council retains care management responsibilities for the people living in out of authority care homes. The host authority where the care home is located is responsible for care home contract monitoring, however, not all 32 local authorities operate in the same way. The Quality Assurance Team receives regular updates from host authority contacts in relation to out of authority care homes. Table 6 Table 6 above illustrates the position noted in North Lanarkshire care home settings is similar to the national picture of a sector struggling to meet the challenges posed by a pandemic. 46 of the 83 care homes inspected were assessed as ‘Adequate’. Page 17 of 285
Page 18
The Quality Assurance Team have worked in close partnership with colleagues from NHS Lanarkshire, the Care Inspectorate and the care homes themselves to support care homes to pursue an improvement agenda. This has included: - • Initially weekly meetings with Care Home Managers to provide a means of communication, to discuss issues arising, for example the developing guidance from the Scottish Government, and to seek solutions to local problems through discussion. The meetings are now monthly. • The Quality Assurance Team administered the Sustainability Payments Scheme for the care home sector (See Section 5). • A series of Collaborative Visits to care homes by Quality Assurance Senior Officers, NHS Lanarkshire Care Home Liaison and Infection, Prevention and Control staff took place to provide support and guidance to care home management and staff. Self-Directed Support (SDS) including Care at Home: Prior to the pandemic, the Care Inspectorate changed their quality inspection themes for registered services. This was fully implemented for Care Homes and some self-directed support contractors. However, 40 of these SDS contractors were still to be inspected using the new themes as of 31 March 22. As previously mentioned, Care Inspection activity has been predominately focused on Care Homes, however, there have been 10 inspections of SDS contractors because of increased notifications to the Care Inspectorate. There are also 10 SDS contractors that were still awaiting an initial inspection as their services have been registered within the past 2 years. Table 7 Table 7 above is primarily based on inspections carried out pre pandemic. However, for the 10 services inspected under the pandemic regime the majority were categorised as ‘Good’ or ‘Very Good’. It is interesting to note, that despite the inspections being because of notification to the Care Inspectorate, 6 out of the 10 inspected were classed as good or very good. Page 18 of 285
Page 19
5. Provider sustainability Since the start of the pandemic there have been ‘sustainability’ arrangements in place to ensure Social Care services/facilities continued to operate in a financially secure and viable manner including provision of payments when services couldn’t be delivered. The sustainability principles were due to end in June 2021 but further extensions have been applied. There remains a requirement to ensure that Social Care capacity is sustained to achieve positive outcomes for clients, whilst also addressing the overarching need to demonstrate value for money, streamline payment arrangements and demonstrate the approach is fair, equitable and transparent. The payments to care homes for underoccupancy have been the biggest proportion of the additional financial support provided through the principles. However, occupancy levels are increasing to pre pandemic levels except for some homes that have been more significantly impacted by outbreaks. For other community-based activity and provision, there has been less of an impact on service delivery, with most providers returning to normal (pre-pandemic) delivery levels. Table 8 6. Procurement A fundamental aspect of the role of Quality Assurance is ensuring that the people North Lanarkshire Council (NLC) arranges support for can be confident that support is provided legally, safely, with their interests at the centre and that ensures Best Value for NLC. A key component of this work is carried out with our colleagues in Corporate Procurement. As mentioned above, in the 2021/22 reporting period, we have managed to expedite a significant number of procurement exercises that have resulted in 93% of the spend on social care services being covered by some form of formal agreement, ranging from large scale contractual frameworks to individual agreements. The collaboration with Corporate Procurement has enabled us to jointly pursue further refinements to commissioning and procurement, none more so than the internal procedure established for the Council’s lower threshold, but regulated, procurement of various Health and Social Care contracts (value range £50-£552k), which in conformance with the Procurement Reform Scotland Act 2014 and the Procurement (Scotland) Regulations 2016, permits the Council to consider and award relevant contracts without the need for competition. This has helped immensely in terms of efficiency at a time when there are significant pressures on our resources. It’s also useful to note that Quality Assurance leads on procurement for all social work services including those focussed on children, families, justice services and adults. Table 9 describes a sample of procurement activity undertaken. PROVIDER SUMMARY NCHC Care Homes Other Total Total Number of Providers 28 45 73 Number in contact for support 26 31 57 Providers Supported to date 26 31 57 Page 19 of 285
Page 20
Table 9 Contract Comments and Benefits Flexible Framework for Self- Directed Support and Care at Home Services + £900M value, 10 years, will result in less frequent re-tenders + follows the ‘Light Touch Regime’ / Regulation 74 of PCSR2015 + Annual entry and exit points for Contractors + Secured an increase in the number of contracted providers, improving the choice and control for supported people Direct Payment Support Service + £400k, 3 years, competitively tendered using new toolkit + Improved specification and implemented tighter controls supported by the new terms and conditions Befriending Services + £360k, 3 years, competitively tendered using new toolkit + Improved specification and tighter controls Advocacy Services + £1.8M, 3 years, competitively tendered using new toolkit + Improved specification and tighter controls Mental Health Services + £3M, 3 years, competitively tendered using new toolkit + Improved specification and tighter controls Provision of Taxi Hire and Private Hire Services to the Council throughout North Lanarkshire + £3.2M, 4 years, competitively tendered using new toolkit + Improved specification and tighter controls Flexible Framework for Non- Traditional Respite + £4M, 10-year agreement, will result in less frequent re- tenders + follows the ‘Light Touch Regime’ / Regulation 74 of PCSR2015 + Covers an existing gap within National ‘Respite’ Frameworks + Annual entry and exit points for Contractors + Secured an increase in the number of contracted providers, improving the choice and control for supported people Fair Work The Scottish Government’s Fair Work First policy initiative focuses on encouraging and supporting employers to create more diverse and inclusive workplaces where workers have security of pay and contract, can develop and utilise their skills and have an effective voice in the workplace. As part of the council’s commitment to Fair Work and social work’s drive to adopt an ethical commissioning approach, Fair Work practices have been embedded in procurement processes to ensure contractors are paying the Scottish Living Wage and are committed to providing community benefits. Potential contractors have committed to provision of community benefits within their tenders, which includes offering employment to people in the local community, youth training and training for people from disadvantaged groups, traineeships and apprenticeships, volunteering opportunities, supporting local supply chain and local community resources. All contractors have indicated they are either already accredited as or are willing to become Scottish Living Wage employers. Work is underway in determining how established contract monitoring processes can incorporate Scottish Living Wage compliance and progress in implementing community benefits commitments. Page 20 of 285
Page 21
7. Children, Families and Justice Quality Assurance monitors most Children’s services where a contract status has been secured either on an Individual Placement basis or as part of a Framework Agreement, generally through Scotland Excel. Quality Assurance has supported Justice Services with Scottish Government funding to secure services to support rehabilitation. Over the reporting period, links have been established with our colleagues in HQ within Education and Families to ensure that we monitor contracts with external service providers and incrementally develop and apply a quality assured approach. Links are well established with Scotland Excel where their Frameworks Agreements have been effective in ensuring optimum service delivery, under difficult financial pressures. Improvements are required to be made in respect of joint working with the council to ensure Children and YP placements are conveyed to the appropriate teams. Quality Assurance will continue to work with each locality to ensure this information is shared. 8. Complaints Quality Assurance retains an overview role in terms of complaints made about NLC Social Work service provision. Regular quarterly reports on complaints activity are reported through our governance structures. The detail below provides an annual summary and analysis of complaints received over the period 2021/22. • Overall, 123 complaints were made in the reporting period, a decrease of 21% from 2020/21. 41% were Children and Families complaints, 59% were Adult Social Work/Community Care complaints. • 76% of Children and Families complaints were handled at Stage 1, 24% at Stage 2. • 21% of Stage 1 complaints failed to meet target timeframes for closure. Average time for closing Stage 1 complaints was 5.3 days. • 17% of Stage 2 complaints failed to meet target timeframe for closure, Stage 2 average was 17.3 days. • 79% of Adult/Community Care complaints were handled at Stage 1, 21% at Stage 2. • 21% of Stage 1 complaints failed to meet target timeframe for closure. Average time for closing Stage 1 complaints was 5.5 days. • 7% of Stage 2 complaints failed to meet target timeframe for closure, Stage 2 average was 15 days. Overall, there was a slight improvement on performance levels from the previous reporting period. The complexity of the issues at hand, new processes, GDPR, staffing, IT systems and very tight time frames for resolution were some of the contributory factors for failure to close all complaints within the stipulated timescale. Table 10 highlights the cause of complaints about NLC Social Work throughout the reporting period. • 30% of all adult service complaints related to quality of the service, a further 27% were in respect to conduct of staff members. Page 21 of 285
Page 22
• 32% of all children, families and justice complaints related to quality of service, whereas 26% were in respect to conduct of staff members. Table 10 A significant number of complaints did not comment on expected learning outcomes and/or service improvements expected, therefore suggesting that there were no further actions to be considered. Comments that we did receive, in relation to learning outcomes, included improved communication, recording and staff training. To ensure compliance, further training related to complaint handling will be rolled out over the coming year. This will promote competency by enabling all staff managing complaints to comply with the process and capture learning and/or service improvement. Within the reporting period, eight social work complaints were sent to the Scottish Public Services Ombudsman for consideration, none of which were upheld. Those that were investigated found that the Council had acted reasonably. Duty of Candour The Organisational Duty of Candour is a statutory duty on Scottish organisations providing health and social care to be open and honest when something goes wrong that is not related to the course of the condition for which the person is receiving care. An annual report capturing Duty of Candour activity is a requirement of the Council. Appendix 1 provides a report for 2021/22. 9. To conclude The Covid pandemic challenged all services both in-house and commissioned to a degree not experienced before. Despite this, the Quality Assurance Team have been part of several developments, which have improved the operation of the social work service and the performance of independent social care contractors including: - • Procurement processes refined • Newsletter established for staff • Senior Officer links to Locality teams • Senior Officer link to Adult Support and Protection activity • Business Continuity • Sustainability payments 16 13 8 6 5 2 22 20 12 9 9 2 0 5 10 15 20 25 Quality of Service Conduct of staff members Dealt unfairly or wrong Didn't provide a service on time Didn't provide a service Unhappy with policy/procedure Complaint Cause Adults CFJ Page 22 of 285
Page 23
• Individual PA process • RaciQ developed for procurement process • Contract Monitoring Framework • Collaborative work with NHS Lanarkshire, Care Inspectorate, Scottish Care • Carer Developments, Partnership Agreement • Complaint sprint • Operational Risk Register • Involvement in LSIs • Council Website • Data Governance, FOIs/SARs and guidance • Development of market facilitation plan Planned developments for 2022/23 include: - • Further development of market facilitation plan • Further development of participation and engagement strategy • Plan for in-house service monitoring • Commercial pipeline refinement • Contract Management Framework development • HSCP website This report has covered Quality Assurance activity undertaken during the period 1 April 21 to 31 March 22. The pandemic has had a significant impact on the sector and over the coming year several developments to support and provide assurance will continue. It is expected that future annual reports will continue to update on Quality Assurance measures implemented across the service. Page 23 of 285
Page 24
Appendix 1 North Lanarkshire Health and Social Care Partnership Duty of Candour Report: 2021/2022 Introduction North Lanarkshire Health and Social Care Partnership recognises that when adverse events occur during the provision of treatment or care, openness and transparency is fundamental. The duty of candour arrangements, which we have implemented reflect the Scottish Government’s commitment to place people at the heart of health and social care services in Scotland. When harm occurs the focus must be on personal contact with those affected; support, and a process of review and action that is meaningful and informed by the principles of learning and continuous improvement. The Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016 was implemented on 1st April 2018 placing an organisational duty (Duty of Candour) on health, care, and social work services to be open and honest with people in their care. The overall purpose of this duty is to ensure organisations are open, honest, and supportive when there is an unexpected or unintended incident resulting in death or harm as defined in the Act. All health and social care services in Scotland have a duty of candour, a legal requirement which means that when things go wrong and mistakes happen, the people affected understand what has happened, receive an apology, and that organisations learn how to improve for the future. A key part of this duty is that Health and Social Care publish an annual report about the duty of candour in our services. This short report describes how the services we commission, and our own services have operated the duty of candour during the time between 1 April 2021 and 31 March 2022. Information about policies and procedures All social care organisations have a Duty of Candour policy. All staff who are employed in the sector should be aware that all instances that necessitate implementation of Duty of Candour must immediately be reported. In such instances, a manager will then take the appropriate action, ensuring relevant bodies [depending on the sector] such as Social Work and Care Inspectorate are notified of the event. Where an incident occurs that triggers the duty of candour, managers have responsibility for ensuring that the duty of candour procedure is followed. Information on Duty of Candour and reportable incidents is described in detail within Appendix 1. 82 commissioned organisations were asked to provide information in relation to Duty of Candour activity in the reporting period. Of the 37 [45%] that responded, there were five reported incidents. All North Lanarkshire Council social work in-house services - home support, integrated day services, locality support services and children services were also asked to provide information. There were no Duty of Candour incidents reported from any of the council provided services. Duty of Candour incidents are an integral part of our contract management quarterly monitoring returns. How many incidents happened to which the duty of candour applies? In the reporting period, five incidents have been reported to which the duty of candour applied, one in relation to maladministration of medication, and four where a person fell and sustained physical harm. All incidents reported were from either care at home support or care home services. No Duty of Candour incidents were reported by North Lanarkshire Council in-house social work services. Page 24 of 285
Page 25
Details of incidents where Duty of Candour applied Nature of incident: Incorrect medication was administered to a service user, resulting in admission to Accident and Emergency. No permanent harm occurred. All procedures set down in Duty of Candour policy were followed – incident was fully investigated and reported. Procedures and training have been revised as a result. Nature of incident: Person fell and fractured hip – Duty of Candour criteria – The structure of someone’s body changes because of harm. All procedures set down in Duty of Candour policy were followed – incident was fully investigated and reported. A Duty of Candour meeting was called, the person’s family were invited, but did not wish to attend meeting. Nature of incident: Person fell and fractured hip (R) – Duty of Candour criteria – The structure of someone’s body changes because of harm. All procedures set down in Duty of Candour policy were followed – incident was fully investigated and reported. A Duty of Candour meeting was called, the person’s family were invited, but did not wish to attend meeting. Nature of incident: Person fell and fractured hip (L) – Duty of Candour criteria – The structure of someone’s body changes because of harm. All procedures set down in Duty of Candour policy were followed – incident was fully investigated and reported. A Duty of Candour meeting was called, the person’s family were invited, but did not wish to attend meeting. Nature of incident: Person fell – sustained a laceration to the head – Duty of Candour criteria – The structure of someone’s body changes because of harm. All procedures set down in Duty of Candour policy were followed – incident was fully investigated and reported. A Duty of Candour meeting was called, the person’s family were invited, but did not wish to attend meeting. Conclusion There were no Duty of Candour incidents from in-house social work services within the reporting period and only five from care home and care at home services, none of which had lasting consequences for the person to whom the duty applied. Appropriate actions were taken, lessons were learned, procedures and training were revised, and where applicable, families were informed, and were invited to meet to discuss in more detail. If in the future, if any incidents occur that invoke Duty of Candour proceedings, there will be a review process to identify any lessons learned and the result of any such review will be shared with the relevant person/persons. This approach will minimise the impact on the organisation and the vulnerable people we strive to support. Page 25 of 285
Page 26
Appendix A – Definition of Harm and appropriate level of response Grading of Harm Definition of Harm Level of Response No harm, incident prevented Any service user safety incident that had the potential to cause harm but was prevented. These incidents are outside of the scope of the duty of candour. Social work professionals may however feel it is appropriate to inform the person involved if it is in their best interest. No harm, incident not prevented Any service user safety incident that occurred but no harm was caused to the person involved. These incidents are outside of the scope of the duty of candour policy. Being open in a discussion between staff involved and the service user and their family is usually undertaken locally. Low Harm Any service user safety incident that led to the extra observation or minor treatment such as first aid or additional medication for the person involved. These incidents are outside of the scope of the duty of candour policy. Being open in a discussion between staff involved and the service user and their family is usually undertaken locally. Moderate Harm A level of harm that is not permanent but has led to a moderate increase in treatment or prolonged psychological harm of more than 28 days. For example, a return to theatre, an unplanned readmission to hospital, unexpected admission to critical care, a prolonged hospital stay or additional out service user visits. Duty of candour is a statutory requirement. Notification should be given to the person affected or their representative in person including an explanation of the incident, the process for investigation and an apology. This will be followed up in writing and on conclusion of the investigation the findings and outcome will be available to the service user of their representative. Serious Harm Any service user safety incident that has resulted in permanent harm that is directly related to the incident and not the natural course of an illness or the underlying condition of the person affected. Examples of severe harm are permanent lessening of bodily functions, sensory, motor, physiological or intellectual function, removal of the wrong organ or limb or brain damage. Duty of candour is a statutory requirement – see above. Death Any service user safety incident that directly resulted in the death of a person and is not related to their illness or underlying condition. Duty of candour is a statutory requirement – see above. Page 26 of 285
Page 27
Appendix B Organisations who provided a response: Aspire Invercare Love Crossreach Keane Premier Support Services Beechwood Care Home Support for Ordinary Living Quarriers PHEW Care One Professional Leonard Cheshire HK Care Angels Key Housing Local Lanarkshire Care Partners in Play All New Beginnings Lanarkshire Association for Mental Health Thera Care Wheatley Care The Richmond Fellowship Scotland HRM Potential Living Capability Scotland Cornerstone Care Solutions Lanarkshire Care Partners Inclusion Scotland C-Change Scottish Autism Cera Care Turning Point Scotland Potential Living Enable Scotland Enhance Supported Living Services Lochside Manor Deanston Care Home Page 27 of 285
Page 28
Page 28 of 285
Page 29
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref KA/ASP/Feb23 Date 16/02/23 Audit and risk-related items: Action log From: Ken Adamson, Chief Officer - Audit and Risk Email: adamsonk@northlan.gov.uk Telephone: 07939 280602 Executive Summary The purpose of this report is to allow elected members to track implementation of requests and recommendations made by the Panel in respect of audit and risk-related items in the previous 18 months. The attached log (at Appendix 1) records those audit and risk-related requests and recommendations made by the Panel and when these were addressed and/or are expected to be addressed. Recommendations The Panel is invited to note the report. The Plan for North Lanarkshire: Priority: All priorities Ambition statement All ambition statements Ken Adamson, Chief Officer - Audit and Risk AGENDA ITEM 3 Page 29 of 285
Page 30
Appendix 1 Audit and risk related items: Action log Meeting Requests or agreed action Status November 2022 A further report be brought back by management to a future meeting on progress made implementing agreed actions in relation to audit recommendations in the Internal Audit report on Sundry Debtors/Debt management. Outstanding - Given the timescale for completion of the agreed action is April 2023, a report providing an update will be submitted to the Panel in Cycle 2 (meeting on 18/5/23). November 2022 A further report be brought back by management to a future meeting on progress implementing agreed actions in relation to audit recommendations in the Internal Audit report on Equalities. Outstanding - Given the wide range of timescales for completion of the agreed actions, the Chief Officer - Audit and Risk has agreed with the Service that a report will be submitted to the Panel in Cycle 3 (meeting on 8/9/23). This is based, amongst other factors, on the planned dates for the establishment of the Delivery Board, the publication of the Mainstreaming Report and the review of the EQIA process. November 2022 During consideration of the Internal Audit follow-up report at the recent meeting of the Audit and Scrutiny Panel, the Panel requested that further update reports be provided by management to the Panel’s next meeting on progress made by management on the following matters highlighted by Internal Audit in Appendix 1 of the Follow-up report (1) Digital NL (quantifying and reporting on non-financial benefits). (2) Managing Strategic Change (reporting on key projects), and (3) Governance of Capital Projects (arrangements for monitoring compliance with project management framework). The Panel also requested that, where such reports were submitted to meetings of the Panel, an appropriate Senior Officer be in attendance. Complete – Reports in relation to these items are included on the agenda for this meeting of the Panel, with the relevant Chief Officer (Chief Officer – Business and Digital) in attendance. September 2022 Internal Audit to provide specific assurance that management actions proposed in response to Business Continuity Planning are progressed in line with agreed timescales. Partially complete - timescales for agreed actions are not yet due and will be reported on, as they fall due, in line with Internal Audit’s arrangements for reporting on follow-up. September 2022 Updates on the management of key corporate risks to be provided to the Panel in accordance with agreed timetable included at Appendix 3 of Risk Management update report. Partially complete – two of the three planned reports (Supply chain and Governance, leadership and decision-making) are included in the papers for the November meeting. Work on the third planned report (Resources aligned with future target operating model) is underway but not yet complete and will be reported at a later date. June 2022 Internal Audit to provide an update on whether management actions proposed in response to Internal Audit investigation into overtime issues within Waste and Fleet have been implemented and adequately addressed the weaknesses/identified areas for improvement. Outstanding – necessary work is currently underway and will be reported on as soon as possible after completion. This is currently expected to be in Cycle 2 (i.e. May meeting of the Panel) Page 30 of 285
Page 31
Appendix 1 Audit and risk related items: Action log (continued) Meeting Requests or agreed action Status June 2022 Internal Audit follow-up reports to seek to provide greater clarity on extent of progress on actions where due timescales are around date of report preparation and/or around or immediately prior to Panel meetings Complete - the approach to preparing and finalising relevant reports has been amended to ensure that appropriate current information is available and presented to the Panel wherever possible. Standing item Implementation by management of actions agreed in response to External Audit's recommendations (Annual Report) be monitored through reports from Internal Audit. Complete – This is addressed through the Follow-up of Internal and External Audit recommendations report included as a separate agenda item for this meeting. Internal Audit provide a report to future meetings of the Panel on progress made in implementing agreed management actions in relation to all Internal Audit recommendations categorised as “red” or “amber”. Complete – This is addressed through the Follow-up of Internal and External Audit recommendations report included as a separate agenda item for this meeting. Page 31 of 285
Page 32
Page 32 of 285
Page 33
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No ☐approval ☒noting Ref KA/ASP/Feb23 Date 16/02/23 Internal Audit progress report From: Ken Adamson, Chief Officer - Audit and Risk E-mail: adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to provide an overview of Internal Audit activity and to report the results of Internal Audit outputs finalised since the last update to the Panel in November 2022. This report highlights the most significant issues arising from these recently completed Internal Audit assignments as well as providing updates on other aspects of the work of Internal Audit. Appendix 1 provides a summary of the scope and key findings of each substantive planned audit report and relevant investigative outputs. Full copies of the relevant audit outputs highlighted in this report are also included in the meeting papers In line with best professional practice and the approved Internal Audit Charter and associated reporting protocol. The 2022-23 Annual Plan was approved by the Audit and Scrutiny Panel in September 2022. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work be periodically reported to CMT and the Panel. This report fulfils that expectation. Recommendations The Panel is invited to: (a) note the findings, conclusions and recommendations of completed Internal Audit reports together with the associated management responses; (b) consider whether there are any issues raised by Internal Audit which the Panel consider are sufficiently significant to require a further report from management to be submitted to a future meeting of the Panel; (c) request that Internal Audit provide a report to future meetings of the Panel reporting progress made by management implementing agreed management actions in relation to all audit recommendations categorised as ‘High’ or ‘Medium’; and (d) otherwise note this report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements AGENDA ITEM 4 Page 33 of 285
Page 34
1. Background 1.1 The 2022-23 Annual Plan was approved by the Audit and Scrutiny Panel in September 2022. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work be periodically reported to CMT and the Panel. This report fulfils that expectation. 2. Report Audit reviews completed in the period 2.1 Table 1 below provides an overview of completed Internal Audit reports since the last update to the Panel in November. Work is currently underway on other assignments included in the 2022-23 Plan and this work will be reported to the Panel as it is completed. Table 1: Completed Internal Audit outputs in the period Subject Internal Audit Opinion 1. Education quality assurance arrangements Reasonable assurance (Green-Amber) 2. Income and cash collection (leisure sites) Reasonable assurance (Green-Amber) 3. Controls – Use of Supply teachers Limited assurance (Amber-Red) 4. Creditors Reasonable assurance (Green-Amber) 5. Cyber-security Reasonable assurance (Green-Amber) 6. Investigation – Primary School A (Note 1) Not applicable Note 1: A summary of the key findings of this investigation is included in this report in line with the Internal Audit Reporting Protocol, but in view of ongoing police involvement, a copy of the full audit report is not included in the papers for this meeting. 2.2 Appendix 1 provides a summary of those reports forming part of the annual programme of planned assurance work and investigation reports as required by the Internal Audit Charter and associated reporting protocol. This report excludes audit outputs produced for the North Lanarkshire IJB which are reported directly to its senior management team and audit committee. 2.3 Appendix 2 contains detailed definitions of the categories used by Internal Audit when making recommendations, providing an audit opinion and on the extent of assurance which is being provided to management and Panel members on those systems or areas of Council operations examined by Internal Audit. 2.4 In addition to the above reports, work is currently underway on a range of topics including Contract management, Housing allocations, Single-tender response contract awards, Social Work quality assurance arrangements and the Council’s Corporate Governance arrangements. Once finalised, these reports will be submitted to a future meeting of the Panel. Page 34 of 285
Page 35
Commentary on completed planned ‘core’ Internal Audit work 2.5 The nature of Internal Audit exercises means that most audit reviews invariably find some scope for improvement, usually in the form of controls which are weak or only partially effective and, therefore, contain recommendations. 2.6 One of the five substantive non-investigation reports being reported in the period is assessed as providing only limited assurance, while four of the reports provided more positive levels of assurance. All five reports contain a range of improvement actions and made a series of recommendations. 2.7 Our work on Education quality assurance arrangements focused on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of primary and secondary education. Our work during the audit included benchmarking the Council’s quality assurance and continuous improvement arrangements against good practice extracted from a range of statutory and other relevant guidance. 2.8 The Covid-19 pandemic has significantly impacted on education provision over the last few years and presented unprecedented challenges to the Service. Consequentially, many aspects of the expected quality assurance framework did not operate as intended during this period. Quality assurance activity during this period focused on vulnerable children, digital provision and the alternative certification model required in lieu of SQA examinations. During 2021-22, the Service undertook a review of its quality assurance processes to refine and refresh the model with the aim of producing an ambitious, effective and sustainable model of school improvement underpinned by rigorous self- evaluation and robust processes and procedures. 2.9 Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council’s quality assurance arrangements are broadly consistent with Education Scotland’s expectations and the National improvement Framework and are designed to deliver continuous improvement. Reports have been produced for key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes. 2.10 Whilst we were pleased to note that progress was being made to roll out the recently refreshed approach across all schools in the current session 2022-23, progress to date has been slower than expected and the Service needs to accelerate implementation to ensure adequate coverage/implementation of expected arrangements across all the Council’s 142 mainstream schools. A small number of recommendations were contained within the audit report. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.11 Our report on Income and cash collection: Leisure sites is the second of two reports focused on the adequacy and effectiveness of the Council’s management arrangements and key controls in relation to income and cash collection activities. A report on First Stop Shops/cash offices was reported to the Panel in November 2022. This report relates to arrangements in respect of the Council’s leisure sites. 2.12 The review focused on whether cash/income received was properly recorded in the Council’s financial systems and regularly reconciled to amounts recorded within the cash receipting system. We also assessed whether cash/income is held securely and banked timeously and whether there are appropriate security arrangements in place to prevent/discourage thefts and to address the safety and security of staff. 2.13 Based on the results of our work, we are satisfied that cash/income received by the Council at the selected leisure sites is being properly recorded in the Council’s financial systems and is being reconciled to amounts recorded within the cash receipting system. We are also generally satisfied that all cash/income is held securely and banked timeously and that there are appropriate security arrangements in place. Page 35 of 285
Page 36
2.14 We have categorised this audit as offering ‘reasonable assurance’. While we consider that the control environment is generally adequate, we identified a degree of inconsistency and some areas of non-compliance and/or weaknesses identified which require to be addressed and our recommendations are detailed at Section 3 of the audit report. The most significant of these issues is that current guidance/procedures are now significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.15 The purpose of our work on Controls – Use of supply teachers was to provide assurance on the adequacy and effectiveness of the Council’s key controls and management arrangements associated with ensuring that teaching supply staff are recruited and employed in a manner consistent with the Council’s legal obligations, the approved Devolved School Management scheme and the Council’s Financial Regulations and corporate budget monitoring and control arrangements. 2.16 Local authorities are expected to devolve appropriate resources to individual schools and as such, the Council has developed and implemented staffing models for school sectors, with Headteachers expected to design and deliver the most appropriate and efficient use of staff. The use of short and long-term supply staff is a long-standing practice, with schools using supply teachers to fill both day-to-day gaps (e.g., to cover illness and training courses) and longer-term vacancies (e.g., to cover maternity and long-term sickness). Permanent and long-term supply resource requirements are managed at school level by the HR Business Partner (HRBP) team within People Resources. The placement and management of short-term supply teachers is undertaken largely by Headteachers. 2.17 Based on the results of our work, we are satisfied that supply staff are being recruited and paid in accordance with legislation, SNCT guidelines and corporate expectations. The removal of SEEMIS has, however, significantly impacted upon many of the key processes used for managing and monitoring the use of supply teachers, from both a staffing and financial perspective. This along with arrangements which have been in place for some time and which have become ‘custom and practice’ around the use of supply staff has led to some gaps or weaknesses in aspects of the control framework, which we consider are not always adequately addressed by the alternative arrangements put in place. As such, we have identified weaknesses in several areas of the control environment including non-compliance with SNCT guidelines in relation to issuing contracts/letters of engagement for supply engagements exceeding two days, inadequacies in the monitoring and oversight of the use of short-term supply teachers and issues in relation to financial monitoring within schools. As a result, we have categorised this audit as offering only ‘Limited assurance’. 2.18 We consider that there is significant scope for improvement in the management arrangements surrounding the Council’s use of short and long-term supply teachers and we have raised several issues and made recommendations for management consideration. These are detailed in section 3 of the audit report and include a lack of clearly documented guidance and appropriate processes around the management of short-term supply teachers. We also commented that processes for monitoring the use and payment of supply teachers need strengthened and reported that several errors and duplicate entries were identified in payments made to short-term supply teachers. We also commented on the need to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements. Satisfactory responses have been received from management in response to the audit findings and recommendations. Page 36 of 285
Page 37
2.19 Our work on Creditors was designed to provide independent assurance on the adequacy and effectiveness of key controls in relation to the authorisation and payment of creditors by the Council. This includes arrangements for ensuring that payments are only made in respect of amounts properly due in respect of goods and services which have been ordered and received, that payments have been properly authorised and that where amounts are paid these are correctly calculated and recorded. 2.20 We have categorised this audit as offering ‘reasonable assurance’ as we have concluded that there is a generally sound control environment in place although some relatively minor issues, non-compliance or scope for improvement have been identified. We were pleased to note that the revised invoice certification and submission process introduced in July 2021 continues to be applied accurately across the Council. Services are sending invoices to creditors for processing with procedures ensuring all invoices are properly authorised prior to payment in accordance with expected arrangements. We also found that appropriate supporting documentation was generally being held in respect of payments; and that transactions were being properly and accurately recorded in the Council’s general ledger. 2.21 Although the results of our audit were generally positive, we have identified a small number of instances of non-compliance with expected arrangements and/or where scope for improvement in the control environment has been identified. Most significantly, although a compensating control has been established to address the previously identified control weakness that arose when the interface between PECOS and eFinancials (which provided an automated process to match invoices to orders) was removed, this was intended to be a short-term requirement until the link could be re- established. For several reasons this link is still not in place. Work is underway, however, via the Purchase to Pay (P2P) digital workstream to address this issue and we consider that this work, to enhance the control environment for processing and paying invoices, needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.22 Our work on Cyber Security was designed to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber-security threats and/or attacks. In particular, the audit focused on whether the arrangements and controls in place are in accordance with relevant external standards and/or where not, that there are clear, risk-based and realistic plans to address any areas of weakness or non-compliance and that these are being satisfactorily progressed. 2.23 Cyber security is the activity required to protect an organisation’s data, devices, networks and software from unintended or unauthorised access, change or destruction via the internet or other communications systems or technologies. Cyber incidents pose an increasing threat to public bodies’ management of their information with hacking, ransomware, cyber-fraud and accidental losses all evident across the public and private and sectors. In recent years, there has been an increasing prevalence of targeted ransomware, including those which can cause serious disruption to an organisation, and which can result in significant additional costs and reputational harm. 2.24 This audit was undertaken in collaboration with Business and Digital staff from the Information Risk and Security Team using a good practice checklist which was developed from a variety of resources including relevant guidance from the National Audit Office (NAO), the National Cyber Security Centre (NCSC) and from learning material for public bodies circulated by the Scottish Government following the widely reported 2020 SEPA ransomware attack. Page 37 of 285
Page 38
2.25 The Council continues to be committed to ensuring it has robust and effective information governance arrangements and has recognised the threats posed from cyber-security risks. While the Council has elected for practical reasons not to seek Cyber Essentials accreditation, we noted that it that it seeks to guard against common cyber-security threats and/or attacks through a range of cyber-security arrangements, controls and activities including PSN compliance and regular threat assessments including penetration testing. 2.26 We have categorised this audit as offering ‘reasonable assurance’. We consider that the Council’s arrangements appear largely commensurate with good practice and that these arrangements are subject to regular review and, based on most recent review/assessments, appear to be operating effectively. We were pleased to note that significant additional resources have been devoted to these activities in recent years and that a range of further planed actions to improve the control environment have been identified. We have identified a small number of areas for improvement. The most significant of these issues is that the current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales to provide a clearer mechanism for identifying and monitoring planned cyber-security activities. Satisfactory responses have been received from management in response to the audit findings and recommendations. Commentary on completed unplanned ‘non-core’ Internal Audit work 2.27 There is one fraud/irregularity investigation report arising from areas of unplanned or ‘non-core’ work undertaken by Internal Audit in the period that I require to bring to your attention in accordance with the Internal Audit reporting protocol. This relates to our investigation in respect of Primary School A which was undertaken in response to concerns raised by the Service with regards to missing school fund monies at the school. 2.28 Audit work identified that there were significant control weaknesses relating to cash handling within the school that we concluded were almost certainly exploited by a member of staff, who has subsequently resigned. Whilst our investigation was unable to prove, beyond all reasonable doubt, that the employee in question misappropriated school fund monies, it was our opinion, on the balance of probability and based on the reasons set out in the report, that they had stolen the money. Following approval by the Chief Executive, this matter has now been referred by Internal Audit to the Police. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.29 A further complicating factor in this case, is that the employee suspected of theft who resigned during the audit investigation, also resigned in similar circumstances during an audit investigation into a similar matter back in 2015 (although at that time no Police referral was made). Significantly, despite Internal Audit recommending at that time that this be flagged in case the individual sought re-employment with the Council at a later date, this does not appear to have occurred. Discussions are ongoing with relevant management about actions requiring to be implemented to prevent this, and any similar scenarios, from happening again in future. 2.30 There are no other issues arising from core Internal Audit work which I consider sufficiently significant to highlight to the Panel. Future follow-up reports will provide the Panel with information on the implementation, or otherwise, of all actions proposed by management in response to audit recommendations categorised as ‘High’ or ‘Medium’. Page 38 of 285
Page 39
Other Matters – Internal Audit Performance 2.31 In March 2021, the Panel were presented with a revised performance management framework for Internal Audit that was to be implemented from April 2021. Most indicators are reported on an annual basis. There are two indicators however that are subject to quarterly reporting. The first is about the implementation of agreed actions arising from Internal Audit reports by the implementation date. 57% of agreed actions have been implemented by the agreed implementation date in the period to December 2022. Progress in implementing agreed actions is monitored and reported separately to the Panel each cycle. 2.32 The second performance indicator is about client satisfaction. Appendix 4 provides a summary of the results of four key questions we ask audit clients at the conclusion of each audit assignment. The results presented continues to show positive feedback on the work of Internal Audit, with 100% of respondents in the period agreeing that Internal Audit added value by assisting in providing assurance, and that reports were relevant and constructive with findings clearly and accurately communicated. 2.33 Where management raise concerns over Internal Audit’s work, these matters are discussed with relevant senior management to fully understand the nature of any concerns and, where it is considered appropriate, to identify areas for improvement. We also seek Services’ views on what they liked or disliked about the audit process and comments received are used to inform future action plans for improving the service provided by Internal Audit. 3. Measures of success 3.1 Internal Audit reports annually on its performance to the Panel and is also subject to review annually by the Council’s appointed external auditors. 4. Supporting documentation Appendix 1 Summary of Internal Audit assignments completed in the period Appendix 2 Audit gradings Appendix 3 Internal Audit performance framework Appendix 4 Internal Audit Client Feedback Results Ken Adamson, Chief Officer - Audit and Risk Page 39 of 285
Page 40
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective responses by management to the weaknesses, control issues and/or areas of improvement identified by Internal Audit will increase the likelihood of the Council achieving its ambitions by improving control frameworks and more effectively mitigating potential risks and threats to the achievement of planned outcomes. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ Page 40 of 285
Page 41
Appendix 1 Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 1. Education quality assurance arrangements Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 1 Medium 2 Low 1 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of primary and secondary education. Our work during the audit included benchmarking the Council’s quality assurance and continuous improvement arrangements against good practice extracted from a range of statutory and other relevant guidance including the Scottish Government’s ‘National Improvement Framework,’ the ‘How Good is our School’ (HGIOS) self- evaluation toolkit, the ‘Standards in Scotland’s Schools Act 2000’, and relevant guidance from Education Scotland’s guidance on ‘Delivering Excellence and Equity: Advice on school improvement planning. The Covid-19 pandemic has significantly impacted on education provision over the last few years and presented unprecedented challenges to the Service. Consequentially, many aspects of the expected quality assurance framework did not operate as intended during this period. Quality assurance activity during this period focused on vulnerable children, digital provision and the alternative certification model required in lieu of SQA examinations. During 2021-22, the Service undertook a review of the quality assurance processes to refine and refresh the model with the aim of producing an ambitious, effective and sustainable model of school improvement underpinned by rigorous self-evaluation and robust processes and procedures. Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council’s quality assurance arrangements are broadly consistent with Education Scotland’s expectations and the National improvement Framework and are designed to deliver continuous improvement. Reports have been produced for key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes. Whilst we were pleased to note that progress was being made to roll out the recently refreshed approach across all schools in the current session 2022-23, progress to date has been slower than expected and the Service needs to accelerate implementation to ensure adequate coverage/implementation of expected arrangements across all the Council’s 142 mainstream schools. Recommendations for management consideration/action are detailed at Section 3 of the report and include: • The refreshed quality assurance framework needs to be fully implemented across all the Council’s primary and secondary schools. • Processes for preparing and reviewing annual school improvement plans (SIP) and reports (SIR) need to be undertaken and concluded in a timely manner; and • Key improvement actions included in the Service Improvement Plan which are expected to deliver educational benefits for pupils are currently not always set out using SMART principles. Satisfactory responses have been received from management in response to the audit findings and recommendations. Page 41 of 285
Page 42
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 2. Income and cash collection (leisure sites) Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 1 Medium 1 Low 3 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s management arrangements and key controls in relation to income and cash collection activities. The review focused on whether cash/income received by the Council was properly recorded in the Council’s financial systems and is regularly reconciled to amounts recorded within the cash receipting system. We also assessed whether cash/income is held securely and banked timeously and whether there are appropriate security arrangements in place to prevent/discourage thefts and to address the safety and security of staff. The review comprises two separate exercises. A report on First Stop Shops/cash offices was issued in October 2021. This report relates to the second exercise undertaken which considered arrangements in respect of the Council’s leisure sites. Leisure sites were previously part of Culture and Leisure NL (CLNL), a former Council ALEO. The delivery of culture, sport and leisure services was insourced to the Council with effect from 1 April 2020. Management responsibility for the staffing and operation of Active NL, the gym and leisure facilities provided by Active and Creative Communities, lies with Education and Families, with the responsibility for banking reconciliations and posting to the financial ledger lying with Financial Solutions. Our work involved visiting two different leisure sites and North Lanarkshire Leisure (NLL) HQ (as it is still named) where we undertook a range of checks on different aspects of cash collection activity with the aim of providing assurance to management on the adequacy and effectiveness of the control environment including compliance with expected controls and procedures. Testing was also undertaken to assess the adequacy and effectiveness of controls exercised by the Controls and Reconciliations Team who are responsible for reviewing/monitoring cash collection activity and the reconciliation of monies collected/banked/recorded. Based on the results of our work, we are satisfied that cash/income received by the Council at the selected leisure sites is being properly recorded in the Council’s financial systems and is being reconciled to amounts recorded within the cash receipting system. We are also generally satisfied that all cash/income is held securely and banked timeously and that there are appropriate security arrangements in place. We have categorised this audit as offering ‘reasonable assurance’. While we consider that the control environment is generally adequate, we identified was a high degree of inconsistency and some areas of non-compliance and/or weaknesses identified which require to be addressed and our recommendations are detailed at Section 3 of the audit report. The most significant of these issues is that current guidance/procedures are now significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. Satisfactory responses have been received from management in respect of the audit findings and recommendations. Page 42 of 285
Page 43
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 3. Controls – Use of Supply teachers Internal Audit Opinion: Limited assurance (Amber-Red) Audit recommendations: High 2 Medium 2 Low 0 The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s key controls and management arrangements associated with ensuring that teaching supply staff are recruited and employed in a manner consistent with the Council’s legal obligations, the approved Devolved School Management scheme and the Council’s Financial Regulations and corporate budget monitoring and control arrangements. For staffing matters, the Council is required to adhere to the Scottish Negotiating Committee for Teachers (SNCT) and Local Negotiating Committee for Teachers (LNCT) Agreements which outline the legal obligations for the recruitment, employment and payment of teachers. Local authorities are expected to devolve appropriate resources to individual schools and as such, the Council has developed and implemented staffing models for school sectors, with Headteachers expected to design and deliver the most appropriate and efficient use of staff. The use of short and long-term supply staff is a long-standing practice, with schools using supply teachers to fill day-to-day vacancies (e.g., to cover illness and training courses) and longer-term vacancies (e.g., to cover maternity and long-term sickness). Permanent and long- term supply resource requirements are managed at school level by the HR Business Partner (HRBP) team within People Resources. The placement and management of short-term supply teachers is undertaken largely by Headteachers, with only limited input from the HRBP team. Based on the results of our work, we are satisfied that supply staff are being recruited and paid in accordance with legislation, SNCT guidelines and corporate expectations. The removal of SEEMIS has, however, significantly impacted upon many of the key processes used for managing and monitoring the use of supply teachers, from both a staffing and financial perspective. This along with arrangements which have been in place for some time and which have become ‘custom and practice’ around the use of supply staff has led to some gaps or weaknesses in aspects of the control framework, which we consider are not always adequately addressed by the alternative arrangements put in place. As such, we have identified weaknesses in several areas of the control environment including non-compliance with SNCT guidelines in relation to issuing contracts/letters of engagement for supply engagements exceeding two days, inadequacies in the monitoring and oversight of the use of short-term supply teachers and issues in relation to financial monitoring within schools. As a result, we have categorised this audit as offering only ‘Limited assurance’. We consider that there is significant scope for improvement in the management arrangements surrounding the Council’s use of short and long-term supply teachers and we have raised several issues and made recommendations for management consideration. These are detailed in section 3 of the audit report and include: • There is a lack of clearly documented guidance and appropriate processes around the management of short-term supply teachers; • Processes for monitoring the use and payment of supply teachers need strengthened; • Several errors and duplicate entries were identified in payments made to short-term supply teachers; and • There is a need to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements Satisfactory responses have been received from management in response to the audit findings and recommendations. Page 43 of 285
Page 44
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 4. Creditors Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 0 Medium 2 Low 0 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of key controls in relation to the authorisation and payment of creditors by the Council. This includes arrangements for ensuring that payments are only made in respect of amounts properly due in respect of goods and services which have been ordered and received, that payments have been properly authorised and that where amounts are paid these are correctly calculated and recorded. Based on the results of our audit work, we have categorised this audit as offering ‘reasonable assurance’ as we have concluded that there is a generally sound control environment in place although some relatively minor issues, non-compliance or scope for improvement have been identified. We were pleased to note that the revised invoice certification and submission process introduced in July 2021 continues to be applied accurately across the Council. Services are sending invoices to creditors for processing with procedures ensuring all invoices are properly authorised prior to payment in accordance with expected arrangements. We also found that appropriate supporting documentation was generally being held in respect of payments; and that transactions were being properly and accurately recorded in the Council’s general ledger. Although the results of our audit were generally positive, we have identified a small number of instances of non-compliance with expected arrangements and/or where scope for improvement in the control environment has been identified. Most significantly, although a compensating control has been established to address the previously identified control weakness that arose when the interface between PECOS and eFinancials (which provided an automated process to match invoices to orders) was removed, this was intended to be a short-term requirement until the link could be re-established. For several reasons this link is still not in place. Work is underway, however, via the Purchase to Pay (P2P) digital workstream to address this issue and we consider that this work, to enhance the control environment for processing and paying invoices, needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to. It is important, therefore, that Services make maximum use PECOS for ordering and invoice processing, wherever possible, as this will enable the Council to make more effective use of resources, help improve invoice processing times and ensure a more robust and consistent approach to ordering and invoice processing activity across the Council. Recommendations are included at Section 3 of the report. Satisfactory responses have been received from management in response to the audit findings and recommendations. Page 44 of 285
Page 45
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 5. Cyber Security Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 1 Medium 1 Low 0 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber-security threats and/or attacks. In particular, the audit focused on whether the arrangements and controls in place are in accordance with relevant external standards and/or where not, that there are clear, risk-based and realistic plans to address any areas of weakness or non-compliance and that these are being satisfactorily progressed. Cyber security is the activity required to protect an organisation’s data, devices, networks and software from unintended or unauthorised access, change or destruction via the internet or other communications systems or technologies. Cyber incidents pose an increasing threat to public bodies’ management of their information with hacking, ransomware, cyber-fraud and accidental losses all evident across the public and private and sectors. In recent years, there has been an increasing prevalence of targeted ransomware, including those which can cause serious disruption to an organisation, and which can result in significant additional costs and reputational harm. This audit was undertaken in collaboration with Business and Digital staff from the Information Risk and Security Team using a good practice checklist which was developed from a variety of resources including relevant guidance from the National Audit Office (NAO), the National Cyber Security Centre (NCSC) and from learning material for public bodies circulated by the Scottish Government following the widely reported 2020 ransomware attack experienced by the Scottish Environment Protection Agency (SEPA). The Council continues to be committed to ensuring it has robust and effective information governance arrangements and has recognised the threats posed from cyber-security risks. While the Council has elected for practical reasons not to seek Cyber Essentials accreditation, we noted that it that it seeks to guard against common cyber-security threats and/or attacks through a range of cyber-security arrangements, controls and activities including PSN compliance and regular threat assessments including penetration testing. We have categorised this audit as offering ‘reasonable assurance’. We consider that the Council’s arrangements appear largely commensurate with good practice and that these arrangements are subject to regular review and, based on most recent review/assessments, appear to be operating effectively. We were pleased to note that significant additional resources have been devoted to these activities in recent years and that a range of further planed actions to improve the control environment have been identified. We have identified a small number of areas for improvement and our recommendations are detailed at Section 3 of this report. The most significant of these issues is that the current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales to provide a clearer mechanism for identifying and monitoring planned cyber- security activities Satisfactory responses have been received from management in response to the audit findings and recommendations. Page 45 of 285
Page 46
Appendix 2 Audit Gradings Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance There are minimal or minor control weaknesses that present low risk to the control environment. The control environment has substantially operated as intended although some minor errors have been detected. Very few or no improvements are needed. Green-Amber Reasonable Assurance There are some control weaknesses that present a low to medium risk to the control environment. The control environment has mainly operated as intended although errors have been detected. Some improvements should be made. Amber-Red Limited Assurance There are significant control weaknesses that present medium to high risk to the control environment. The control environment has not operated as intended. Significant errors have been detected. Substantial improvements should be made. Red No Assurance There are fundamental control weaknesses that present an unacceptable level of risk to the control environment. The control environment has fundamentally broken down and is open to significant error or abuse. Immediate and major changes need to be made. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but it is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 46 of 285
Page 47
Appendix 3: Internal Audit performance framework Category Measure Internal Audit management Reported to Chief Executive and CMT Reported to A&SP (Quarterly) Reported to A&SP (Annual) 1. Delivery of Annual Plan Percentage completion of agreed plan X X X 2. Targeting Percentage of key corporate risks and key financial systems over which assurance provided X X X 3. LGBF - Efficiency Cost of Internal Audit per £ million revenue budget X X 4. LGBF - Efficiency % of productive hours delivered v Plan X X 5. Delivery / recommendations Percentage implementation of agreed actions by implementation date (cumulative year to date) X X X X 6. Delivery / other Number of significant irregularity / fraud investigations X X X 7. Customer satisfaction results Scores from customer satisfaction questionnaires (audit assignments) (cumulative year to date) X X X X 8. Customer satisfaction results Scores from key stakeholders (CMT and A&SP) questionnaires (overall performance of the function) X X X 9. Quality / standards Reliance placed by External Audit on the work of Internal Audit X X X 10. Quality/ standards Quality review outcomes – EQAR or internal self- evaluation X X X 11. Delivery of Annual Report Annual opinion /report prepared by 31 May annually X X X 12. Targeting Approval by CMT and A&SP of strategy and annual plan by 31 May annually X X X Internal management performance indicators 13. Efficiency Actual v planned days on completed assignments X 14. Efficiency Time between completion of fieldwork and draft reports being issued X 15. Efficiency Time between draft reports and final reports being issued X Page 47 of 285
Page 48
Appendix 4: Internal Audit Client Feedback Results Responses received in this period from four clients related to 2022-23 assignments reported to the Panel (note these responses relate to audit assignments reported in the Internal Audit Progress Reports presented to the November 2022 meeting of the Panel) Question Strongly Agree or Agree Neither agree nor disagree Disagree Internal Audit added value to my area by assisting in providing assurance and/or identifying weaknesses and/or improvements in relevant governance/business process and internal controls 100% 0% 0% Internal Audit findings were accurate and clearly communicated 100% 0% 0% The Internal Audit report made relevant, constructive and practical recommendations to help improve operations 100% 0% 0% Internal Audit staff were professional and courteous throughout the audit process 100% 0% 0% Page 48 of 285
Page 49
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT EDUCATION: QUALITY ASSURANCE ARRANGEMENTS Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officers Education (North and South) and Deputy Chief Executive Copied to: Education and Families Manager and (once finalised) Chief Executive Headlines This audit was designed to provide independent assurance on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of primary and secondary education. Local authorities have a duty to improve standards in education, challenging and supporting educational establishments to ensure continuous improvement. North Lanarkshire’s quality improvement framework is based upon the European Framework for Quality Management (EFQM) approach. It aims to empower school leaders to secure continuous improvement while providing assurance to stakeholders on the quality of education provided for learners. Our work during the audit included benchmarking the Council’s quality assurance and continuous improvement arrangements against good practice extracted from a range of statutory and other relevant guidance including the Scottish Government’s ‘National Improvement Framework,’ the ‘How Good is our School’ (HGIOS) self- evaluation toolkit, the ‘Standards in Scotland’s Schools Act 2000’, and relevant guidance from Education Scotland’s guidance on ‘Delivering Excellence and Equity: Advice on school improvement planning. The Covid-19 pandemic has significantly impacted on education provision over the last few years and presented unprecedented challenges to the Service. Consequentially, many aspects of the expected quality assurance framework did not operate as intended during this period. Quality assurance activity during this period focused on vulnerable children, digital provision and the alternative certification model required in lieu of SQA examinations. During 2021-22, the Service undertook a review of the quality assurance processes to refine and refresh the model with the aim of producing an ambitious, effective and sustainable model of school improvement underpinned by rigorous self-evaluation and robust processes and procedures. Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council’s quality assurance arrangements are broadly consistent with Education Scotland’s expectations and the National improvement Framework and are designed to deliver continuous improvement. Reports have been produced for key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes. Whilst we are pleased to note that progress is being made to roll out the refreshed approach across all schools in the current session 2022/23, progress to date has been slower than expected and the Service needs to accelerate implementation to ensure adequate coverage/implementation of expected arrangements across all the Council’s 142 mainstream schools. Recommendations for management consideration/action are detailed at Section 3 of the report and include: • The refreshed quality assurance framework needs to be fully implemented across all the Council’s primary and secondary schools. • Processes for preparing and reviewing annual school improvement plans (SIP) and reports (SIR) need to be undertaken and concluded in a timely manner; and • Key improvement actions included in the Service Improvement Plan which are expected to deliver educational benefits for pupils are currently not always set out using SMART principles. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green - Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0450/2023/002 Date issued 20/01/23 Audit Team Elaine MacDonald and Paula Hendry Page 49 of 285
Page 50
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 2 1. Executive Summary Objectives The purpose of this audit is to provide independent assurance on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of primary and secondary education. The work will be designed to offer an audit opinion on the following: • Are the Council’s quality assurance arrangements consistent with Education Scotland’s expectations and/or the requirements of the National Improvement Framework and are they designed to deliver continuous improvement? • Have quality assurance arrangements been operated in line with the Council’s own expectations? • Is there periodic reporting to key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes? The quality assurance arrangements surrounding schools are monitored by the Service’s Education and Family Managers (EFM). Our work during this audit involved discussions with the EFM with oversight of the quality assurance process and review of the updated/proposed approach and monitoring of SIPs and SIRS. As HMIE visits and VSE visits had been suspended during Covid we were unable to review the Council’s arrangements for recording or monitoring improvement actions arising from any such activity. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 1 2 1 Key areas requiring management action (High) One area requiring urgent management attention was identified: • The refreshed quality assurance framework needs to be fully implemented across all the Council’s primary and secondary schools. Good practice identified We noted the following areas of good practice during the audit: • The Council devotes significant resources to quality assurance and continuous improvement designed to support schools and to ensure high quality educational provision is delivered in line with national requirements and the Service’s expectations set out in Programme of Work P034.1 Improving Outcomes; • A Quality Improvement Framework has been produced by the Service; • Education and Families Managers are responsible for oversight of specific groupings of schools. This requires close working relationships with relevant Head Teachers to challenge, support, track and monitor performance and improvement and to gain good knowledge and understanding of the different circumstances of individual schools; • The Service has prepared guidance and proforma templates, in accordance with Education Scotland’s guidance, for the completion of annual School Improvement Reports (SIR) and School Improvement Plans (SIP) to facilitate the planning and monitoring of performance management and quality improvement within schools in a consistent manner; • The Service has introduced several initiatives with supporting guidance in response to its responsibilities under the Education for Scotland (2000) Standards in Schools Act to improve standards in schools; • An annual calendar of quality improvement activity is in place; and • An annual Standards and Quality Report is produced and presented to Committee outlining the Council’s educational performance against key NIF quality indicators, key activity in the period and next steps. Page 50 of 285
Page 51
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 3 Other areas for improvement (Medium) Areas for improvement was also identified: • Processes for preparing and reviewing annual school improvement plans (SIP) and reports (SIR) need to be undertaken and concluded in a timely manner; and • Key improvement actions included in the Service Improvement Plan which are expected to deliver educational benefits for pupils are currently not always set out using SMART principles. Page 51 of 285
Page 52
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 4 3. Action Plan EDUCATION: QUALITY ASSURANCE ARRANGEMENTS 0450/2023/001 Ref Finding 1 The refreshed quality assurance framework needs to be fully implemented across all the Council’s primary and secondary schools. During 2021-22 a review of the quality assurance processes for education was undertaken to refine and refresh the Council’s arrangements with the aim of producing an ambitious, effective and sustainable model of school improvement underpinned by rigorous self-evaluation and robust processes and procedures. Our review of this framework confirmed that in principle the arrangements are consistent with Education Scotland’s expectations and with the National Improvement Framework. An integral part of the assurance framework is the Validated Self Assessments (VSE) process which provide a means to review performance and to review, support and challenge existing arrangements within schools to identify and facilitate continuous improvement. The VSE protocol was evaluated and updated as part of the refresh and has been communicated to all Head Teachers. This has included the training of 32 education professionals as VSE Champions to facilitate the undertaking of VSE. In collaboration with individual Head Teachers a process has also recently been completed to allocate both a RAG (Red, Amber, Green) and VSE status to each school which identifies current performance and the level of support the Service considers the school requires. We understand that the Service intends to use this to inform the calendar of VSE visits to be undertaken in this school session. At the time of writing, no VSE visits yet have been undertaken in the current session at any school. HMIe visits recommenced in September 2022, and we understand that several schools for whom internal scrutiny, via a VSE visit was to be undertaken have been visited by HMIe inspectors. The Service intends to place reliance on any such external reviews and will replace any such schools in the VSE calendar of planned visits. The Service has indicated that a calendar of VSE visits for the remained of the year will be prepared and will commence in January 2023 which will enable the updated VSE approach to be piloted to enable evaluation of the impact of the new approach. We also noted that the refreshed approach planned for 2022-23 included the introduction of Attainment Trios which would have consisted of a group of Head Teachers coming together three times a year as a group of ‘critical friends’ to provide support and challenge and develop their ability to collaborate and engage in robust professional dialogue that supports continuous improvement. We noted however, that these have not progressed and in mid-November a proposal to revise this element to Self-Evaluation for Improvement Discussion (SID) Groups was presented to, and approved by, the Services Senior Leadership Team. We understand there is an intention to finalise these groups in January 2023 at which time the new process is expected to be introduced across all primary and secondary schools. Implication Recommendation Priority Management response Implementation Month/Year The service may fail to adequately review school performance and/or improvement progress in a timely and ongoing manner, resulting in a failure to identify and then progress appropriate actions to secure improvement. Education and Families should ensure that: (1) the refreshed quality assurance framework is fully implemented in a timely manner across all primary and secondary schools. (2) regular monitoring is undertaken to ensure that all planned quality assurance activities are undertaken in a timely manner consistent with an updated quality improvement framework calendar; and (3) a formal review of the adequacy and effectiveness of recently revised/updated processes (particularly VSE and SIDS) is undertaken, after a sufficient period, to assess how well they are operating, identifying and taking any necessary adjustments and/or improvement actions as appropriate. High Agree Michelle O’Halleron, Education and Families Manager (1) The implementation of the framework is now underway with the rollout continuing this school term. The responsible officer will link with all EFMs to support and ensure the ongoing implementation of the framework in a timely manner. (2) Regular monitoring will be undertaken to ensure activities within the framework are being undertaken in line with expected timescales. Progress will be reported at appropriate intervals to Education and Families SLT. (3) For a review of the adequacy and effectiveness of the refreshed framework to be meaningful, it needs sufficient time for activities to embed. Therefore a detailed review of the revised framework will be undertaken after it has been operational for a full school year, with this taking place in June 2024. During this period however, an interim review to identify any necessary initial adjustments and/or improvement actions will take place in June 2023 and January 2024. The Chief Officer of Education (South) will have strategic oversight to ensure effective implementation of delegated actions, by responsible officers, as outlined above. June 2023 June 2023 and termly thereafter June 2024 Page 52 of 285
Page 53
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 5 3. Action Plan (continued) EDUCATION: QUALITY ASSURANCE ARRANGEMENTS 0450/2023/001 Ref Finding 2 Processes for preparing and reviewing annual school improvement plans (SIP) and reports (SIR) need to be undertaken and concluded in a timely manner. Head Teachers are required to produce an annual School Improvement Plan (SIP) setting out the school's intended outcomes and improvement activity for the coming session and follow this up towards the end of the school session with an annual School Improvement Report (SIR) in which they outline progress towards achieving the outcomes set out in the plan. All SIPs and SIRs are submitted for review to the respective Education and Families Manager (EFM) and feedback on their content and quality is provided to Head Teachers. We noted that the normal deadline for submission of the SIP was extended from June to August this year for a number of reasons including other priorities, the updates to the quality assurance framework and the intended format of the plans. However, despite this extension we noted that many schools had failed to submit their SIPs and SIRs per the calendar of key dates. Our review of the process for review of SIPs and SIRs identified the following: • Each EFM populates a spreadsheet to track their respective schools SIR reviews. We noted these spreadsheets did not record the dates of receipt, review and feedback to Head Teachers for action to ensure this was timely. We also noted that they were not populated in a consistent manner by EFMs and contained a lack of detail of the issues raised and/or expected corrective actions; and • EFMs also populate a similar spreadsheet for their review of schools SIPs. We noted this spreadsheet did not provide for capturing details of how well the key aspects of the SIPs have been populated, i.e., vision and values and details of engagement, or the date review issues were fed back to Head Teachers for action and showed limited evaluative commentary recorded and, in some instances, no key discussion issues with the school were noted. The Service advised in November 2022 that all SIRs for session 2021/22 and SIPs for session 2022/23 had been reviewed and feedback provide to schools by the relevant EFM. Implication Recommendation Priority Management response Implementation Month/Year The Service may find it difficult to demonstrate or evidence that appropriate and timely support and challenge has been provided to schools in the preparation and finalisation of their SIPs and SIRs. Education and Families should: (1) remind all Head Teachers and EFMs of the importance of ensuring that SIPs and SIRs are prepared in accordance with expected timelines and ensure that any overdue SIPs or SIRs are pursued as a matter of urgency; and (2) remind EFMs of the need to populate their review spreadsheets for SIRs and SIPs to fully evidence their oversight/scrutiny activity including recording key details such as dates of receipt and review, key qualitative comments and issues arising, and key feedback provided to Head Teachers to address. Medium Agree Michelle O’Halleron, Education and Families Manager (1) A protocol will be established for EFMs to implement should Head Teachers fail to submit their updates in line with agreed timescales. This protocol will include the need to highlight non-submission to EFM with strategic remit for improvement, to provide another layer of scrutiny, to ensure the documentation is submitted. Michelle O’Halleron and Jill Woodward, Education and Families Managers (2) The EFM team will utilise Microsoft teams to create a form to be issued to all Head Teachers to complete when submitting SIP/SIR. This will reduce the need for re-keying information making the review process more efficient therefore allowing EFMs to concentrate on recording key qualitative information and action points. The form will automatically record submission dates and provide for the recording of other key review dates. This will support a consistent approach across the EFM team. The Chief Officer of Education (South) will have strategic oversight to ensure effective implementation of delegated actions, by responsible officers, as outlined above. April 2023 May 2023 Page 53 of 285
Page 54
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 6 3. Action Plan (continued) EDUCATION: QUALITY ASSURANCE ARRANGEMENTS 0450/2023/001 Ref Finding 3 Key improvement actions included in the Service Improvement Plan which are expected to deliver educational benefits for pupils are currently not always set out using SMART principles. The Service Improvement Plan is produced annually and monitored and reviewed on a periodic basis. Improvement actions are aligned under themes set out in NIF priorities and drivers, as well as the Council’s own PoW categories of Curriculum rebuild, Support for children and families, Pathways development, Health and Wellbeing and Learning for sustainability. The format of the plan provides for information on key actions, measures of success, responsible officer and progress to towards completion. A high-level review by Internal Audit of the 2022-23 Service Improvement Plan led us to conclude that there is scope to improve the content of the Plan by ensuring each improvement action is expressed in a manner that is consistent with SMART principles. Most specifically, in terms of ensuring that expected improvements are quantified in a measurable manner. Implication Recommendation Priority Management response Implementation Month/Year The service may fail to demonstrate that it has addressed and achieved adequate improvement in education performance. Management should ensure that actions included in the annual Service Improvement Plan are, wherever possible, framed in line with SMART principles (Specific, measurable, achievable, relevant and timely), and that the nature/extent of expected improvements is set out, including how this will be measured. Medium Agree Michelle O’Halleron, Education and Families Manager Following a review of current priorities, and our evaluation process to identify new priorities, the responsible officer will work with relevant service managers (aligned to new priorities) to ensure improvement priorities are framed in line with SMART principles. These priorities will be submitted to various committees for endorsement, prior to final submission. The Chief Officer of Education (South) will have strategic oversight to ensure effective implementation of delegated actions, by responsible officers, as outlined above. September 2023 Page 54 of 285
Page 55
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 7 3. Action Plan (continued) EDUCATION: QUALITY ASSURANCE ARRANGEMENTS 0450/2023/001 Ref Finding 4 There is need to review how information is reported annually to key stakeholders in respect of performance and quality assurance arrangements. Education authorities are required under the terms of the Standards in Scotland’s Schools, etc Act 2000 to produce and annually publish a standards and quality report detailing how the service, its schools and services have sought and achieved improvements in provision. Whilst we recognise the Council’s standards and quality report which is submitted to committee needs to fully reflect relevant legislative requirements, we noted that it is a lengthy report providing lots of, often detailed, information to the reader using language and terminology that is not always readily conducive to wider engagement by stakeholders. We were pleased to note that a summary providing an overview of the Service’s progress in achieving agreed priorities was provided as an appendix to the report in 2022 but consider that the lay reader may find it difficult to distinguish key messages, achievements to date against key ambitions and continuing areas of focus/challenge and that a more user-friendly summary would be beneficial. Implication Recommendation Priority Management response Implementation Month/Year Without regular, accurate and timely reporting on monitoring activity, senior management and/or elected members may not be aware of the extent of compliance with, or the effectiveness of, the Council’s quality assurance/monitoring arrangements. The Service should review the structure and content of information currently provided annually to Committee and other key stakeholders in respect of quality assurance arrangements and schools’ performance to assess whether this could be reported in a way which better enables key stakeholders to understand and exercise effective scrutiny and oversight/challenge of performance. Low Agree Janie O’Neill, Chief Officer for Education (South) and Michelle O’Halleron, Education and Families Manager Moving forward, clearer identification of Improvement Priorities (as outlined at 3 above) will support a clearer focus for the Service to frame the annual report. The main body of the report should align with the identified priorities and key statutory reporting duties e.g. attainment information, and all other areas of Service improvement work could be included in additional documentation (appendices). The Service will also seek to monitor and review reporting timeframes, to ensure our processes align with any national changes and recommendations. The introduction of a mid-term progress update will be considered as a means of tracking progress and reducing the volume of information contained in the final Standards and Quality Report. November 2023 Page 55 of 285
Page 56
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 8 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 56 of 285
Page 57
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 1 INTERNAL AUDIT REPORT INCOME AND CASH COLLECTION – LEISURE SITES Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officer - Education and Families (South) Copied to: Active and Creative Communities Manager, Chief Executive and Deputy Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s management arrangements and key controls in relation to income and cash collection activities. The review focused on whether cash/income received by the Council is properly recorded in the Council’s financial systems and is regularly reconciled to amounts recorded within the cash receipting system. We also assessed whether cash/income is held securely and banked timeously and whether there are appropriate security arrangements in place to prevent/discourage thefts and to address the safety and security of staff. The review comprises two separate exercises. A report on First Stop Shops/cash offices was issued in October 2021. This report relates to the second exercise undertaken which considered the Council’s leisure sites. Leisure sites were previously part of Culture and Leisure NL (CLNL), a former Council ALEO. The delivery of culture, sport and leisure services was insourced to the Council with effect from 1 April 2020. Management responsibility for the staffing and operation of Active NL, the gym and leisure facilities provided by Active and Creative Communities, lies with Education and Families, with the responsibility for banking reconciliations and posting to the financial ledger lying with Financial Solutions. Our work involved visiting two different leisure sites and North Lanarkshire Leisure (NLL) HQ (as it is still named) where we undertook a range of checks on different aspects of cash collection activity with the aim of providing assurance to management on the adequacy and effectiveness of the control environment including compliance with expected controls and procedures. Testing was also undertaken to assess the adequacy and effectiveness of controls exercised by the Controls and Reconciliations Team who are responsible for reviewing/monitoring cash collection activity and the reconciliation of monies collected/banked/recorded. Based on the results of our work, we are satisfied that cash/income received by the Council at the selected leisure sites is being properly recorded in the Council’s financial systems and is being reconciled to amounts recorded within the cash receipting system. We are also generally satisfied that all cash/income is held securely and banked timeously and that there are appropriate security arrangements in place. We have categorised this audit as offering ‘reasonable assurance’. We consider that while the control environment is generally adequate, we identified was a high degree of inconsistency and some areas of non-compliance and/or weaknesses identified which require to be addressed and our recommendations are detailed at Section 3 of this report. The most significant of these issues is that current guidance/procedures are now significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Minor Report status FINAL Audit ref 0900/2023/007 Date issued 10/01/2023 Audit Team Lynn McCrum, Paula Hendry, Hugh Shevlin and Elizabeth Sweeney Page 57 of 285
Page 58
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 2 1. Executive Summary Objectives The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s management arrangements and key controls for income and cash collection activities. The key control objectives reviewed and tested during the audit considered: • Whether all cash/income received by the Council is properly recorded in the Council’s financial systems and regularly reconciled to amounts recorded within the cash receipting system and other accounting systems as required by relevant Service guidance; • Whether all cash/income is held securely and banked timeously; and • Whether appropriate security arrangements are in place within the cash collection facilities to prevent/discourage thefts and to address the safety and security of staff. Substantive testing was conducted at two leisure sites (Broadwood and Ravenscraig) and NLL HQ using a standard audit programme based on the current income and finance practices being operated by the leisure sites. We also reviewed the adequacy of arrangements for the monitoring and reconciliation of income collected undertaken by the Controls and Reconciliations team. This exercise focused on leisure sites. A separate exercise was also carried out at three First Stop Shops/cash offices and was the subject of a separate report issued in October 2022 to relevant Service management. This assignment has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 1 1 3 Key areas requiring management action (High) The following key areas requiring urgent management action have been identified: • Current guidance/procedures are significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. Good practice identified We noted the following areas of good practice during the audit: • Income and Finance Procedures are in operation for gym and leisure facilities provided by the Council. • Income received is reconciled to transactions processed through the MRM system. • Reconciliations between the financial ledger and bank statements, which are appropriately documented and balanced, are carried out promptly after the end of each financial period by staff independent of the cash collection process. Other areas for improvement (Medium) An area for improvement were also identified as follows: • MRM user access controls/arrangements are currently inadequate and need improved. Page 58 of 285
Page 59
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 3 3. Action Plan Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 1 Current guidance/procedures are significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. An ‘NLL Income and Finance Procedures’ manual has previously been prepared and is in operation for North Lanarkshire Council’s gym and leisure facilities which now come under the auspices of Active NL. However, this has not been reviewed or updated for several years and does not reflect the current operating environment either in terms of gym and leisure activities now being insourced to the Council or the move to a less cash-orientated business through changes in society. In addition, there were no records retained to evidence that staff have received training on expected processes and procedures relating to income/cash-handling. We reviewed current practices in place within the selected leisure sites against the procedures the Service expects their sites to adhere to and noted that there were a number of areas of non-compliance. The most significant of these included: • staff unable to locate relevant documentation at the time of Internal Audit fieldwork (including paperwork completed, individual debit/credit card receipts and X reading receipts etc.); • relevant documentation not always being fully completed, completed accurately and/or signed by appropriate staff; • standard documentation as referenced in the procedures is not always being used (this includes safe contents sheet; safe contents monitoring sheet; safe check book/sheet) and where alternative documentation was being completed this did not always contain all expected information; • instances where cash is being counted by only one person (albeit checks are later carried out by the Team Leader); • refunds can be processed by anyone with access to the MRM system and there is generally no documentation to support refunds, or monitoring thereof; • overages and shortages are not being recorded consistently; • X and Z readings are not being carried out for each Chip and Pin machine at the end of each shift (Ravenscraig); • security uplift receipts are not always being attached to the record of banking/uplifts; and • delays in paperwork from leisure sites being received by Controls and Reconciliations Team. Although the control environment appears generally adequate, the non-compliance issues noted above as well as the adequacy of current guidance and lack of review since insourcing indicate the need for a review of both current and expected practice. Furthermore, we identified that there was generally no evidence of there being proper management oversight of the handling and processing of income at leisure sites. As a minimum, we would have expected there to have been management checks undertaken to ensure that appropriate documentation was fully and accurately completed; explanations were obtained for any discrepancies and/or refunds and that these were thereafter monitored. It should be noted that while we did identify issues as detailed above, we found no evidence of irregularities or misappropriation of funds. Implication Recommendation Priority Management response Implementation Month/Year Procedures may be inadequate resulting in processes being undertaken unnecessarily. Procedures and/or arrangements may not be operating as expected and/or may not be being applied consistently across all leisure sites with an increased risk that income collected may not be fully recorded and/or properly accounted for. Service management should ensure that a comprehensive review of all aspects of the control framework for income/cash- handling at leisure sites is undertaken with a view to ensuring that up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. These should reflect the current operating environment and include consideration of each of the issues identified above. Once finalised, revised guidance should be circulated to all staff and training delivered as appropriate. High Agree Heather Liddle, Active & Creative Communities Manager We will review and re-issue Income and Finance Procedures manual and staff training on all aspects of procedures including completion of relevant paperwork will be undertaken. April 2023 Page 59 of 285
Page 60
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 4 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 2 MRM user access controls/arrangements are currently inadequate and need improved. The MRM system is used to record transactions (including payments and refunds) both within the leisure centre and those made online/telephone. Each activity and product have an individual MRM product code on the system and corresponding price. Staff within the leisure sites and NLL HQ processing such transactions have access to the system via a log-in and password. These logins are generally unique to the person authorised to use the system. The only exception to this is within the Cafés, where there is a generic log-in and password to record transactions going through the till. The ‘NLL Income and Finance Procedures’ outline that this is to enable transactions to be completed by several members of staff working at the same point of sale. While we appreciate that historically, for the Café, there has been a generic log-in and password, in order to comply with best practice, reduce the risk of non-repudiation and being able to hold persons to account in the event of an error, fraud or theft, every member of staff with access to the system should have an individual log-in and password. We obtained a list of persons with access to the MRM system from NLL HQ and noted that this list was out of date and included persons who were no longer employed by the Council. There were also a number of staff with access to the system at both Broadwood and Ravenscraig Leisure sites who did not appear on this list and/or location differed. A general review of this list also identified that whilst it provides details of the users and their access level, it does not always provide details of their location. Furthermore, a review of the access levels detailed on this list highlighted numerous persons where the access level attributed to them does not appear appropriate to their role. The Manager at Broadwood Leisure Centre was unclear as to whether access to the MRM system would be deactivated by IT as part of the leaving process. These issues indicate a lack of appropriate and regular oversight and review of user access rights to the MRM system. Implication Recommendation Priority Management response Implementation Month/Year Without a formal process for reviewing and updating details held with regards to system access, these details held may not be up to date and/or staff who may have inappropriate access to the system and information within it. Service management should ensure that: (1) a full and comprehensive review of system users on the MRM system is undertaken, including access levels, to ensure that the access attributed to users is appropriate to their role and, that at a minimum, an annual review of users and their access is thereafter undertaken to ensure this remains appropriate and accurate/up to date; (2) consideration is given as to whether it would be practical to issue Café staff with individual log-in’s and passwords; and (3) line managers are reminded that when a system user leaves the Council or moves position their system access is deactivated and/or revised as appropriate for their new role promptly. Medium Agree Heather Liddle, Active & Creative Communities Manager We will undertake the following: • review all MRM system users including location, access levels and remove any leavers. Procedure will be developed for the ongoing update of user accounts when someone leaves the organisation or changes roles; and • we have considered the reasoning for login process for café staff and alternatives have been investigated. This has been reviewed at length with Business Solutions and another solution is not possible – current arrangement will remain in place. April 2023 Page 60 of 285
Page 61
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 5 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 3 Some aspects of the security arrangements within leisure sites require to be re-enforced and/or enhanced. We reviewed the security arrangements in place within the selected leisure sites and while we are satisfied that generally these arrangements are adequate, we identified a number of areas where these security arrangements could be improved. The most significant of these include: • access to the reception areas at both Broadwood and Ravenscraig Leisure Centres is not always restricted to authorised personnel; • there is no record maintained of the Duty Manager at Ravenscraig Leisure Centre being informed of missed scheduled banking uplifts; • Ravenscraig Leisure Centre had run out of banking bags which resulted in the security firm being unable to proceed with one of the scheduled uplifts; • the Insurance section do not hold up to date information regarding the safe or value of insurance cover at either Broadwood or Ravenscraig Leisure Centres; and • the key, which operates the café till drawer in the event of the computer system being down, was not working at both Broadwood and Ravenscraig Leisure Centres. Implication Recommendation Priority Management response Implementation Month/Year If security arrangements are not adhered to there is an increased risk of theft and/or misappropriation of funds and/or risks to the safety and security of staff. Where the Insurance section are not fully informed of the safe details and values of cash transactions, the level of insurance cover held may no longer be appropriate. Service management should ensure that: (1) staff are reminded of expected procedures with regards to security/controlled access for areas where monies are held and counted; (2) staff are reminded of the importance of ensuring that where an uplift does not take place as scheduled, this is recorded and the Duty Manager promptly notified of this including the reason(s) why; and (3) each of the leisure sites provide the Insurance section with details of the safe(s) at the site and the values of daily cash transactions and to enable them to determine the level of cover required. Low Agree Heather Liddle, Active & Creative Communities Manager We will undertake the following: • Staff training on security/access control for relevant areas and uplift procedures including process in the event of a missed submission; • All till drawers to be made functional and keys available and correctly held; and • Information to be supplied to the insurance section on details of all safes and values of daily cash held so that sufficient cover can be arranged. April 2023 Page 61 of 285
Page 62
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 6 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 4 The MRM system does not always update to reflect debit and credit card payments and/or refunds processed. The ‘NLL Income and Finance Procedures’ reference an issue which occasionally occurs when processing debit and credit card payments or refunds. This issue means that while payments have been taken/refunds made they may not be updated on the MRM system. When processing the payment/refund, if this error occurs a message is displayed to alert the member of staff to this error. For NLL HQ, checks are undertaken to ensure that the totals on the daily receipt vouchers agree with the totals from each member of staffs’ merchant receipts for that day. Where there are differences, work is carried out to identify where these lie and to which activity/service they should be allocated in the ledger. The daily receipt voucher is thereafter updated to reflect the correct amount. However, no formal record is maintained where differences are identified and changes made. For the leisure sites, each site should advise their Duty Manager where there is a difference and manually correct the paperwork prior to it being forwarded to Controls & Reconciliations. However, this is not always being done and our fieldwork highlighted instances where the paperwork had not been corrected prior to being forwarded to Controls & Reconciliations. Where paperwork is not updated in respect of these errors, the monies banked cannot be reconciled to that which should be uploaded to the ledger from the receipt voucher. Controls & Reconciliations advised that there are often differences between the daily receipt vouchers received from the leisure sites and the monies banked which leads to delays in posting to the ledger. They notify the relevant leisure site and ask that they investigate this and resubmit adjusted paperwork. We were advised that one potential solution to this issue may be to seek to transfer business from the current card payment merchant (Worldpay) to another. We noted, however that no formal decision has been made on how best to address this long-standing issue. Implication Recommendation Priority Management response Implementation Month/Year There is an increased risk that any issues, errors or discrepancies arising would not be identified and corrected in a timely manner leading to a delay in posting the transactions to the financial ledger and an inability or delay in undertaking bank reconciliations. Service management should: (1) remind staff if the need to ensure that appropriate records are retained by leisure sites (including NLL HQ) which clearly show any such instances where debit and credit card payments/refunds have been made but are not reflected on the MRM system; and (2) consider whether a more permanent and practical resolution to this issue can be identified and progressed to address this long-standing issue. Low Agree Heather Liddle, Active & Creative Communities Manager We will undertake the following: • introduce a recording process for transactions which fail to process via MRM accurately and ensure these records are retained; and • investigate alternative solutions to reduce chances of payments failures leading to discrepancies and thereafter take action as appropriate. April 2023 Page 62 of 285
Page 63
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 7 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 5 Some other areas for improvement were noted that need to be considered and addressed. During our review, we identified several other areas which require attention as follows: • there was some disparity in the information held by Treasury Management in respects of floats and imprest and that provided by the Duty Manager at both Broadwood and Ravenscraig Leisure Centres. Treasury Management records showed an imprest of £200 for each of Broadwood and Ravenscraig. At each site, the Duty Manager confirmed there was no imprest held. Treasury Management confirmed that the monies had been held in imprest bank accounts for the centres which not been used at either site and have now closed these accounts; • the cash float held at Broadwood Leisure Centre differed by £400 between the records held by Treasury Management and those held by the Leisure Centre. Following investigation by Internal Audit, Treasury Management advised that the £400 had been returned when the Finance section at NLL HQ (Broadwood) moved to the Council but had not been ledgered correctly. Treasury Management have committed to updating the financial records accordingly. Similarly, the cash float held at Ravenscraig Leisure Centre differed by £100 between the records held by Treasury Management and those held by the Leisure Centre as the cash float for catering is not recorded in Treasury Management’s records; • during our cash counts at both Broadwood and Ravenscraig Leisure sites we noted a number of small differences. Most significantly, on the day of Internal Audit’s cash count, the change float at Ravenscraig Leisure Centre was £26.40 less than expected and records held did not reflect this difference. The safe content sheet is ticked as checked each day but, when asked, the Team Leader confirmed he had not actually counted the cash; • customers can sign up and pay for a membership which entitles them to access and use the leisure facilities in the centres operated by the Council throughout North Lanarkshire. There are a number of discounts to which a customer may be entitled and proof of entitlement should be obtained prior to the discount being awarded. We reviewed a sample of five recent memberships and were unable to verify if discounts were appropriately checked as evidence of such is not retained or noted with the system simply being updated to read ‘proof shown’. In addition, from our small sample, we identified an instance where a member was paying a discounted membership rate for a number of months despite no qualifying evidence having been presented or viewed. We understand that this was followed up by NLL HQ and as no evidence was subsequently received the member has been charged the full adult membership rate from October 2022; and • when a customer takes out a membership, they receive a fob which they use to access the leisure facilities and on presentation of their fob, their photo appears on a small screen at reception which allows staff to ensure that it is the member who is accessing the leisure activity. The checking by staff of memberships and their validity is a key control which at busy times may be problematic and more difficult to do. Implication Recommendation Priority Without proper checks and balances, differences in the imprest or cash floats held may go unaccounted for. Without appropriate processes and checks being undertaken, there is an increased risk that persons could receive a discount to which they are not entitled and/or persons could access leisure facilities without having made appropriate payment both of which would result in a loss of income to the Council. Service management should ensure that: (1) leisure site management should ensure that details held by Treasury Management in respect of imprests and floats held is accurate and reflects what is actually held at each site; (2) leisure site management are reminded of the requirement to count and check cash floats each day to ensure these are as expected, with any discrepancies investigated and appropriate documentation completed and signed as evidence of such; (3) staff are reminded of the importance of ensuring that entitlement to discounts is obtained and fully recorded on the system prior to the discount being awarded; and (4) remind staff of the need to ensure that those accessing the facility using fobs are checked to ensure they are the correct owner of the fob and that their membership is current. Low Page 63 of 285
Page 64
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 8 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Management response Implementation Month/Year Agree Heather Liddle, Active & Creative Communities Manager We will undertake the following: • update details of floats held with Treasury Management; • ensure staff are aware of the need to check and verify cash floats every day, with any discrepancies highlighted and investigated as appropriate and appropriate documentation completed and signed as evidence of such; • ensure staff are aware of the importance of ensuring that entitlement to discounts is properly checked and recorded on the system prior to the discount being awarded. We will also ensure that the process for obtaining proof and updating records as necessary is being followed; and • ensure entry control procedures are followed and member pictures are held and updated and that staff are thereafter checking that the correct person is using fobs to gain entry in all cases. April 2023 Page 64 of 285
Page 65
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 9 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 65 of 285
Page 66
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT CONTROLS – USE OF TEACHING SUPPLY STAFF Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: Supply Teacher Definitions Issued to: Chief Officer of People Resources, Chief Officer of Finance, Chief Officers of Education (North and South) Copied to: HR Business Partnership Manager, Business Finance Manager, Chief Executive and Deputy Chief Executive Headlines The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s key controls and management arrangements associated with ensuring that teaching supply staff are recruited and employed in a manner consistent with the Council’s legal obligations, the approved Devolved School Management scheme and the Council’s Financial Regulations and corporate budget monitoring and control arrangements. For staffing matters, the Council is required to adhere to the Scottish Negotiating Committee for Teachers (SNCT) and Local Negotiating Committee for Teachers (LNCT) Agreements which outline the legal obligations for the recruitment, employment and payment of teachers. Local authorities are expected to devolve appropriate resources to individual schools and as such, the Council has developed and implemented staffing models for school sectors, with Headteachers expected to design and deliver the most appropriate and efficient use of staff. The use of short and long-term supply staff is a long-standing practice, with schools using supply teachers to fill day-to-day vacancies (e.g., to cover illness and training courses) and longer-term vacancies (e.g., to cover maternity and long-term sickness). The identification of resource requirements within schools and the placement of permanent pool, core supply and long-term supply staff are managed by the HR Business Partner (HRBP) team within People Resources. The placement and management of short-term supply teachers is the responsibility of the Education and Families Service and is undertaken by Headteachers. Based on the results of our work, we are satisfied that supply staff are being recruited and paid in accordance with legislation, SNCT guidelines and corporate expectations. The SEEMIS organisation’s decision to retire some aspects of the SEEMIS system in July 2021 has, however, significantly impacted upon many of the key processes used for managing and monitoring the use of supply teachers, from both a staffing and financial perspective. This along with arrangements which have been in place for some time and which have become ‘custom and practice’ around the use of supply staff has led to some gaps or weaknesses in aspects of the control framework, which we consider are not always adequately addressed by the alternative arrangements put in place. As such, we have identified weaknesses in several areas of the control environment including non-compliance with SNCT guidelines in relation to issuing contracts/letters of engagement for supply engagements exceeding two days, inadequacies in the oversight of the use of short-term supply teachers and issues in relation to financial monitoring within schools. As a result, we have categorised this audit as offering only ‘Limited assurance’. We consider that there is significant scope for improvement in the management arrangements surrounding the Council’s use of short and long-term supply teachers and we have raised several issues and made recommendations for management consideration. These are detailed in section 3 of the audit report and include: • There is a lack of clearly documented guidance and appropriate processes around the management of short- term supply teachers; • Processes for the oversight of the use and payment of supply teachers need strengthened; • Several errors and duplicate entries were identified in payments made to short-term supply teachers; and • There is a need to continue to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements. Internal Audit Opinion (see definition at Appendix 1) Limited assurance Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0450/2023/001 Date issued 25/01/23 Audit Team Lesley Armstrong and Paula Hendry Page 66 of 285
Page 67
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 2 1. Executive Summary Objectives This audit exercise was designed to provide assurance on the adequacy and effectiveness of the Council’s key controls and management arrangements associated with ensuring that teaching supply staff are recruited and employed in a manner consistent with the Council’s legal obligations, the approved Devolved School Management scheme and the Council’s Financial Regulations and corporate budget monitoring and control arrangements. The work was designed to offer an opinion on the following: (1) Are supply staff being recruited, employed and paid in accordance with key legal obligations and corporate expectations? (2) Is there appropriate and effective monitoring and oversight of how schools utilise supply staff to ensure that any risks arising from the use of such staff are appropriately managed? Work undertaken during the audit included discussions with the HRBP Team and with Financial Solutions staff to obtain an overview of the guidance and processes in place for employing, paying and monitoring the use of supply teachers; discussions with the Headteachers at six schools (3 primary and 3 secondary) to ascertain how arrangements surrounding the use of supply teachers operates in practice in schools; and consideration of iTrent and analysis of various iTrent reports to confirm whether key controls were operating effectively. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 2 2 0 Key areas requiring management action (High) The following key areas requiring urgent management action have been identified: • There is a lack of clearly documented guidance and appropriate processes around the management of short- term supply teachers; and • Processes for the oversight of the use and payment of supply teachers need strengthened. Good practice identified We noted the following areas of good practice during the audit: • Supply teachers are recruited/appointed in line with the Council’s recruitment procedures. All supply teachers are required to have completed satisfactory pre-employment verification checks, including confirmation of GTC registration and PVG prior to commencing their employment. • Short-term supply teachers claim payment for work undertaken via the Myself module of iTrent and claims need to be authorised by an authorising officer prior to being processed for payment. • The HRBP team undertake a staffing exercise, commencing in February each year, to confirm school rolls and identify any staffing requirements for the following school year, thereby informing the recruitment process and allocation of staffing to individual schools. Other areas for improvement (Medium) A number of other areas for improvement were also identified: • Several errors and duplicate entries were identified in payments made to short-term supply teachers; and • There is a need to continue to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements. Page 67 of 285
Page 68
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 3 3. Action Plan Controls – Use of Teaching Supply Staff 0450/2023/001 Ref Finding 1 There is a lack of clearly documented guidance and weaknesses in some important aspects of the current processes around the use of short-term supply teachers. The SNCT handbook outlines the legal obligations for the recruitment, employment and payment of teachers. It defines short-term supply teachers as teachers engaged on a daily basis, where a single engagement does not exceed two days and states that fixed term temporary contracts should be issued for engagements which extend beyond this period. The Council’s Local Agreement in relation to the Code of Practice on the Use of Temporary Contracts (LNCT Agreement) concurs with the SNCT guidance, however, in practice since 1996, the Council in agreement with Trade Unions categorises short-term supply as engagements not extending beyond 20 working days, upon which there is an obligation for Headteachers to notify the HRBP team of the cover requirement (or earlier if the requirement is expected to exceed 20 days). The HRBP has no involvement in the placement or management of short-term supply teachers (as this is the responsibility of Headteachers), however, they actively facilitate and administer the identification of resource requirements within schools and the placement of all permanent pool, core supply and long-term supply (see Appendix 2 for definitions) resource requirements and ‘normal’ staffing at a school level, maintaining a cover spreadsheet for each sector area (secondary, primary and additional supported needs (ASN)) to record and monitor all long-term supply cover requirements within individual schools and the teachers who have been allocated to meet each requirement. The HRBP team consider that Headteachers should be fully aware of the expectations for short-term supply teachers as this forms part of regular discussions between both parties. The team meets with individual Headteachers in February each year to discuss and identify all permanent and long-term temporary teachers in post, short-term supply teachers being utilised by the school and any anticipated vacancies, with a view to planning the projected workforce for the forthcoming academic year. This is followed-up with a further re-evaluation and adjustment of the projected workplans in September after the new academic year has commenced and discussions throughout the year as required. Additionally, the HRBP team attend Headteacher engagement sessions, held by Education and Families Senior Leadership Team, during which they present an HRBP update with information relevant to staffing in schools. Despite this, we consider that there is a lack of formally documented guidance which clearly distinguishes between short and long-term supply teachers and the respective roles and responsibilities of both Headteachers and People Resources in relation to these staff. This lack of documentation was confirmed through discussions with Headteachers at a sample of schools, and these discussions further highlighted that there is uncertainty over the definitions of short and long-term supply teachers, and at which point the HRBP team should be notified. Consequently, our review of the use of supply teachers within the small random sample of schools visited identified a number of short-term supply teachers working regular hours/days over long periods of time (and more than 20 working days) who had not been notified to the HRBP team and were therefore, not included on the relevant cover spreadsheet, not being monitored by the HRBP team and had not been issued with an appropriate contract to reflect the long-term engagement. As short-term supply with the Council is classed as engagements not exceeding 20 working days and this is not monitored by the HRBP team, temporary contracts are currently not issued for engagements exceeding two days, in line with the SNCT guidelines, where the HRBP team have not been notified of the engagement. We noted that new contract templates have been prepared for each type of supply teacher and that a process has recently been devised by People Resources for Headteachers to promptly notify the HRBP team/Employee Service Centre (ESC) of supply cover engagements extending beyond two days to enable a contract to be issued and iTrent to be updated as appropriate. This process has not yet been finalised or implemented. Relevant teams within People Resources have also held initial discussions regarding a process for monitoring these arrangements once implemented, however, this is currently still under discussion and has not yet been confirmed/agreed as People Resources consider that a significant amount of additional resource is required to fulfil this function. As part of support offered to schools in early 2020 to assist with the short-term demand that occurred at the start of the Covid 19 pandemic, the HRBP team issued a detailed list of all staff members categorised as “Supply Teacher” to all schools. Since that point in 2020 when the list was issued to HTs, and as a direct consequence of the increased number of long-term COVID19 absences and cover demands, we understand that this list was generally exhausted from a central perspective by the HRBP Team with teachers who were available for supply being utilised for long term cover automatically. Following the retirement of certain elements of the SEEMIS system in July 2021, the HRBP team has created a Supply Register using information extracted from iTrent, which details all teachers recorded in a supply role (short or long-term). Review of this Register identified a number of teachers who are recorded on iTrent but are not included on the Register (12 primary and 16 secondary) and further teachers included on the Register who are not recorded on iTrent (4 primary and 4 secondary). The current version of this register has not yet been with Headteachers, who often rely on utilising supply teachers that they know, have previously used or have been advised of by other Headteachers or the HRBP team. Additionally, the Register does not confirm the current availability of supply teachers. We understand that the HRBP team are currently devising a process for obtaining confirmation of supply teachers’ availability to work and recording this on the Supply Register, and plan to share the Register with Headteachers to provide up-to-date information on the availability of supply teachers. This process has not yet been finalised and implemented. (Continued over page) Page 68 of 285
Page 69
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 4 3. Action Plan Controls – Use of Teaching Supply Staff 0450/2023/001 Implication Recommendation Priority Management response Implementation Month/Year A lack of appropriate guidance in relation to supply teachers could lead to confusion over definitions, uncertainty around the expectations and responsibilities of Headteachers and the HRBP team not being made aware of all short-term supply teachers undertaking long-term engagements which could further lead to supply teachers not being provided with appropriate contracts of employment and the Council not complying with SNCT guidelines. If a supply register detailing short- term supply teacher availability is not maintained and provided to Headteachers, they may have difficulty identifying an appropriate resource to undertake their supply needs which could lead to Headteachers not notifying the HRBP team where a resource is found or an increased risk of teachers being employed who have not been subjected to the Council’s recruitment process and pre- employment verification checks. People Resources, in conjunction with Education and Families, should: (1) prepare and issue documented guidance providing clear definitions of short and long-term supply teachers and outlining the responsibilities and required actions of Headteachers in relation to supply teachers; and (2) finalise and implement the proposed processes for the management of short-term supply teachers as highlighted in the finding (i.e. notification of engagements and the Supply Register) and ensure that a formal review of the adequacy and effectiveness of these processes is undertaken, after a sufficient period of time, to assess how well they are operating, identifying and taking any necessary improvement actions as appropriate. High Agree (1) Fiona Whittaker, Chief Officer of People Resources The workforce planning guidance discussed and shared with Headteachers during management briefing sessions and the twice-yearly individual workforce planning meetings will be formally documented and issued via email to Headteachers and Education and Families service and publicised through the Council MyNL platform alongside the other relevant People Resources workforce information for future ease of reference. (2) Fiona Whittaker Chief Officer of People Resources & Gerard McLaughlin, Chief Officer of Education (North) An automated systems process is at a development stage within the Council’s iTrent system, that will automatically generate and issue employment contracts to short-term supply Teachers, when the Headteacher authorises their salary payment through the iTrent system. It is anticipated that when this process is implemented a report will be generated and issued to Headteachers (monthly in line with Payroll) which will facilitate better checking and monitoring of the use of short-term supply Teachers. This together with action (1) above will assist with ensuring that Headteachers notify the HRBP team as required when the use of individual Teachers goes beyond 20 days. Monitoring of the use of short-term supply teachers will be undertaken by Headteachers in conjunction with the Education and Families service and relevant support services (People Resources and Financial Solutions) as required. Once in place for a reasonable period, a review of the adequacy and effectiveness of the revised arrangements noted above will be undertaken with any amendments required identified. February 2023 August 2023 January 2024 Page 69 of 285
Page 70
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 5 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Ref Finding 2 Processes for the oversight of the use and payment of supply teachers need strengthened. There is currently no oversight of short-term supply teachers within the Council and there does not appear to be any proactive checks undertaken on the information contained in iTrent to identify/detect any short-term supply teachers continuously working on a single engagement for more than 20 working days. The HRBP team therefore, rely on Headteachers notifying them when the use of short-term supply teachers becomes long-term. Teachers represent a significant proportion of the Council’s workforce and are a unique/discrete group of employees who are governed by different legal obligations and corporate expectations; therefore we consider it important that the management arrangements in place are subject to compliance reviews to gain assurance in this area. Following retirement of certain elements of the SEEMIS system in July 2021, the HRBP team has implemented interim arrangements, utilising spreadsheets, to facilitate the tracking of long-term cover requirements across the school estate and the employees that have been allocated to these positions. Our review of the short-term supply teachers at the six schools visited confirmed that Headteachers do not routinely inform the HRBP team of short-term supply teachers working long-term as each school had short-term supply teachers working regular hours/days over longer periods of time who were not included on the long-term cover spreadsheets maintained by the HRBP team. We also noted that the cover spreadsheet for secondary schools does not contain details of teachers who are covering promoted posts on a temporary basis thereby making it difficult to track and confirm that all vacant posts as a result of the temporary promotion are filled. No reconciliation is undertaken between the long-term cover spreadsheets maintained by the HRBP team and iTrent to confirm that all permanent and fixed-term supply teachers (on the 0410MO payrun and being paid a monthly salary over 12 periods) are actively employed and/or to identify any anomalies. Our testing identified the following issues: • One fixed term 20/21 teacher (5013623) who is a current employee (and now entitled to permanency) but is not recorded on the cover spreadsheet and has not received a contract for their permanent pool post (employed on a permanent basis but not based at a specific school); • Nine permanent teachers recorded on iTrent who were not recorded on the cover spreadsheets. It was confirmed that six teachers had been omitted from the cover spreadsheets in error and are undertaking a cover role at a school, therefore we have no concerns over them receiving their monthly salary. However, three teachers (5009382, 5010659 and 5013543) had ended their employment on 14/08/22 but continued to be paid, with two receiving a salary payment until 31/08/22 (overpayment of salary of just under £900 each) and one continuing to receive their monthly salary until 30/11/22 (overpayment of salary of £7,700) when internal Audit queried it with the HRBP team; • Six teachers recorded on the cover spreadsheet with the incorrect employee number; and • Two teachers recorded on the cover spreadsheet who had no record on iTrent (neither took up post before pre-employment checks were complete). Additionally, no checks are undertaken by People Resources to confirm that the information contained in iTrent regarding contract type and position held is accurate, and our review of the Masterfile data of all supply teachers on iTrent identified the following inaccuracies in the data recorded on iTrent: • Short-term and fixed-term supply teachers recorded as permanent; permanent pool, core supply and additional basic teachers recorded as temporary; and basic teachers working additional hours with no additional basic teacher role; • Short-term supply teachers recorded as additional basic teachers when they do not hold a basic teacher role (should be recorded as short-term supply teachers); • Fixed term 20/21 teachers (probationers from 2019/20) who are now entitled to permanency (as they have two years continuous service) but are still recorded as fixed term temporary teachers on iTrent (instead of permanent pool); • Supply teachers recorded on iTrent with occupancy end dates which have now passed, and may therefore, not have a valid contract and may not be located in the school which they are currently allocated to on iTrent; and • Short-term supply teachers recorded as being allocated to a specific reporting manager, despite being employed to work in any school. Our review also noted that there is no routine checking to promptly identify short-term supply teachers who are entitled to permanency (relies on supply teachers contacting the HRBP team) and there is no monitoring/analysis of the utilisation of reason codes by schools to determine whether the same short-term supply teachers are being continuously employed within the same school for various reasons. All of the above confirms that there is a lack of adequate and effective oversight on the use of all categories of supply teachers and that the processes currently in place need to be improved to ensure that legislative requirements and corporate expectations are implemented and adhered to. (Continued over page) Page 70 of 285
Page 71
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 6 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Implication Recommendation Priority Management response Implementation Month/Year Management may be unaware of the extent of compliance with key corporate expectations and/or may fail to identify issues requiring action. A lack of appropriate oversight of supply teachers could result in the Council not adhering to legislative requirements and corporate expectations by not providing staff with appropriate contracts of employment and not offering permanent roles to staff when they become entitled. If inaccurate information is held on both Council systems and spreadsheets, staff may not be paid the correct amounts for work undertaken, which could lead to overpayments. People Resources and Education and Families should: (1) undertake a comprehensive review of current arrangements for oversight of all categories of supply teachers and consider how management can review and better gain assurance on the extent of compliance with legal obligations and key corporate expectations regarding this discrete group of staff. This might include, but is not necessarily limited to, reconciliations between spreadsheets used to record long-term supply cover and iTrent to enable appropriate checks on the completeness and accuracy of information held within iTrent and the use of iTrent reports to identify potential anomalies, exceptions, errors and/or outstanding actions; and (2) review and consider the errors highlighted in the finding and undertake appropriate action to correct these including ensuring that any overpayments arising are recovered. High Agree (1) Fiona Whittaker, Chief Officer of People Resources & Gerard McLaughlin, Chief Officer of Education (North) A comprehensive review will be undertaken to ensure that all legal requirements and key corporate expectations are being complied with and that E&F management have visibility of all supply teachers across the estate to assist them in the management of this discrete staffing group. (2) Fiona Whittaker Chief Officer of People Resources The errors highlighted have been reviewed and action taken as appropriate to correct them. August 2023 Complete Page 71 of 285
Page 72
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 7 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Ref Finding 3 Several errors and duplicate entries were identified in payments made to short-term supply teachers. Temporary teachers (short-term supply and permanent teachers working additional hours) are required to claim their days/hours worked through the Myself module of iTrent, recording the date earned, pay element (days/hours), cost centre (to ensure the payment is charged to the correct establishment), reason code (to establish whether the payment should be charged to the school or centrally) and number of days/hours worked. Once submitted, these claims require to be checked and authorised by the appropriate Headteacher/Depute Headteacher to ensure that the claim is fully completed and to confirm that the dates claimed have been worked. iTrent then automatically calculates the payment due in line with SNCT guidelines. iTrent does not detect, or highlight to the authoriser, claims where the same date has been claimed twice and there is no simple way for authorisers to easily view previously approved claims to identify any duplicate entries. To ensure the accuracy of claims made through iTrent and assist with the authorisation process, Headteachers should hold separate documentation detailing the days/hours worked by temporary teachers and the reason code for the cover, and this should be referred to during the authorisation process to ensure the accuracy of claims and that only those days/hours actually worked are claimed and authorised. Our review of the documentation held by schools for a sample of 21 temporary teachers’ payments identified a number of issues, including: • three schools which did not hold any separate supporting documentation to record supply cover (teacher, days and hours worked); • claims which did not match the supporting documentation (e.g. incorrect dates, incorrect days/hours); • claims for dates when the school was closed (e.g. Queen’s funeral on 19/09/22); • claims for dates when the teacher was recorded as being sick; and • only one school had marked the documentation to confirm that the dates had been claimed and authorised to assist with the prevention of authorising duplicate claims. We obtained an iTrent report detailing all temporary teacher claims paid between August 2021 and August 2022. Our analysis of this report identified a high number of payments where teachers had been paid twice for the same dates (50 dates claimed by 30 temporary teachers), resulting in an overpayment. Details of these claims have been provided to the Service under separate cover. Whilst the cost centre and reason code fields are required for financial purposes, these fields are not mandatory on iTrent and are often not completed, resulting in Financial Solutions undertaking additional work to identify the correct cost centre and reason code, and potentially understatement of schools’ budget commitments. For the temporary teachers claims paid between August 2021 and August 2022, we identified a number of claims, authorised by different people, which had no cost centre and/or reason code recorded. This confirms that the required completeness checks are not always being undertaken prior to authorisation. Implication Recommendation Priority If separate records detailing days worked by supply teachers are not maintained by Schools and used by authorising officers to check supply teacher claims for payments, claims may be incorrectly authorised which could lead to supply teachers not being paid correctly and additional cost to the Council. Incomplete claims with omitted cost centre/reason codes could impact on the school budget as commitment for supply teachers will be understated. People Resources, in conjunction with Education and Families, should: (1) advise Headteachers that they should hold separate documentation detailing the hours/days worked by temporary teachers and the reason code, refer to this documentation when authorising Myself claims to satisfy themselves that the claim is accurate, and update the documentation to clearly reflect dates which have been claimed to avoid duplicate payments; (2) remind supply teachers and Headteachers of the need to ensure that all Myself claims are fully and accurately completed (in particular, cost centres and reason codes) prior to submission/authorisation; and (3) review the list of duplicate payments/errors identified by Internal Audit during the audit and take appropriate action to correct these. Details of these payments have been provided under separate cover. Medium Page 72 of 285
Page 73
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 8 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Management response Implementation Month/Year Agree Fiona Whittaker, Chief Officer of People Resources & Gerard McLaughlin, Chief Officer of Education (North) (1) The iTrent system does not have the functionality to prevent duplicate claims being made – this would require considerable financial investment for further development of the system. Employees will be reminded of their personal responsibility when making financial claims to ensure submissions are completed fully and accurately and that they do not inadvertently commit unintended fraud by making duplicate claims. Due to the extent and labour-intensive process required to ensure that all claims made are singular, a review will be undertaken by Education and Families in conjunction with Support Services (People Resources and Financial Solutions) to consider the most appropriate way to assist Headteachers to monitor and manage the use and payment of temporary teachers. It is anticipated that this will be in the form of a retrospective report-based process that will be consistently implemented across the school estate. (2) A reminder will be issued to Headteachers and Teachers of the requirement to ensure all claims are accurately and fully completed prior to submission for authorisation and follow-on processing. (3) The list of duplicate payments/errors is currently being reviewed and corrective action taken as necessary. August 2023 February 2023 February 2023 Page 73 of 285
Page 74
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 9 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Ref Finding 4 There is a need to continue to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements. It is recognised in national guidance that Headteachers require the assistance of suitably qualified and experienced staff and information systems to effectively fulfil their responsibilities in respect of the day-to-day operation of the Devolved School Management (DSM) scheme. In respect of financial support, each Headteacher has been aligned to and is supported by an Administrative Finance Assistant (AFA), allocated to schools on a cluster basis (secondary school and any associated primary and ASN schools). Previously, AFAs were line managed by their respective secondary school Headteacher, however, CMT agreed to transfer this to Schools Finance Officers within Financial Solutions from August 2022. A DSM working group with representatives from Education and Families, Financial Solutions, HR and Headteachers has been established to discuss the role of the AFA, their workload/tasks, identify any required amendments to job descriptions and training needs. Financial Solutions has prepared a draft AFA workplan which details the tasks which an AFA is required to undertake on a weekly basis over a four-week period. Financial Solutions anticipate that this workplan will be completed by the AFA and discussed with their Schools Finance Officer to enable progress monitoring and ensure that all the required tasks are being completed within the required timescales. Whilst a lot of work has, and continues to be, undertaken by Financial Solutions in relation to the transfer of AFAs to Financial Solutions and to provide high quality and robust financial assistance to schools, many aspects of this are still under development such as changes to job descriptions, finalisation and implementation of the draft AFA work plan (expected January 2023) and identifying the training requirements of individual AFAs. Additionally, the Council previously used the SEEMIS system as a budget monitoring tool to support DSM, however, when this part of the system was retired in July 2021, Financial Solutions had to implement alternative measures for financial and budget monitoring for schools. We have not reviewed or assessed the adequacy or effectiveness of these interim measures as part of this audit review. We noted that historically there has been a high level of absences/vacancies of AFAs and this has led to some schools having no AFA support and staffing reconciliations not being completed as often or in a timely manner, making it more difficult for Headteachers to monitor their staffing budgets. We understand that work continues to identify the most appropriate long-term mechanism/system to facilitate effective financial and budget monitoring at schools. Implication Recommendation Priority Headteachers may not receive regular and up to date financial management information and advice which could result in inability to monitor budgets and identify under/overspends and any anomalies on a timely basis. Education and Families, Financial Solutions and People Resources should: (1) continue to progress the necessary actions identified as a result of the transfer of AFAs to the Service; and (2) monitor the interim arrangements for financial and budget monitoring for schools to ensure that they provide a robust and effective financial control framework. Medium Management response Implementation Month/Year Agree Thomas O’Hagan (Business Finance Manager) (1) The further integration of AFAs into Financial Solutions will be reflected in the completion of formal tasks such as updating Job Descriptions, completing PRDs and ensuring a full complement of staff are in post. Equally important is that the ongoing mentoring, training and development of the AFA staff cohort continues, alongside the effective communication of plans and expectations to both AFAs and headteachers. (2) The arrangements for the management of school resources continues to be driven by key corporate and Service documents including the Financial Regulations, Scheme of Delegation, DSM Scheme and Financial Procedures Manual. A risk-based approach to the provision of financial information during the period following the retirement of the SEEMiS Budget and Finance modules has been undertaken which has ensured sufficient data and information is available to undertake key tasks such as year-end accounts preparation and budget creation, and allowed statutory returns and grant claims to be submitted when required. Budget Unit staff and AFAs also regularly attend briefings to raise awareness and knowledge of the reports and workarounds that have been created to aid the periodic budget monitoring process and furnish Headteachers with relevant financial data. The temporary financial monitoring arrangements are reflected in the SEEMIS replacement Project Risk Register and are managed/reported in accordance with the Council’s Project Management Guidance. April 2023 Ongoing Page 74 of 285
Page 75
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 10 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 75 of 285
Page 76
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 11 Appendix 2 – Supply Teacher Definitions Category Definition applied in NLC Short-term (casual) Employed on a casual, temporary basis to provide supply cover at various schools on an ad-hoc basis, with a single engagement (i.e. continuous cover at the same school) for a period of up to 20 days. Fixed Term (temporary) Employed for a set number of hours on a temporary basis for a fixed term to provide long-term supply cover (over 20 days), often to cover a temporary vacancy. Core Supply (permanent) Employed on a permanent basis, initially placed in a 1FTE position at a specific school for one academic year and thereafter allocated to available permanent school positions. If no permanent positions are available, placement in a school specific post is deferred and the employee is placed in a further temporary position until the following year. Permanent Pool (permanent) Employed for a set number of hours on a permanent basis but not permanently based at a specific school. Page 76 of 285
Page 77
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT CREDITORS Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officer of Place (Action Plan ref 1(1)), Chief Officer of Asset and Procurement (Action Plan ref 1(2)) and Chief Officer of Finance (Action Plan ref 2). Copied to: Business Finance Manager (Resources and Payments), Chief Executive and Depute Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of key controls in relation to the authorisation and payment of creditors by the Council. This includes arrangements for ensuring that payments are only made in respect of amounts properly due in respect of goods and services which have been ordered and received, that payments have been properly authorised and that where amounts are paid these are correctly calculated and recorded. Based on the results of our audit work, we have categorised this audit as offering ‘reasonable assurance’ as we have concluded that there is a generally sound control environment in place although some relatively minor issues, non-compliance or scope for improvement have been identified. We were pleased to note that the revised invoice certification and submission process introduced in July 2021 continues to be applied accurately across the Council. Services are sending invoices to creditors for processing with procedures ensuring all invoices are properly authorised prior to payment in accordance with expected arrangements. We also found that appropriate supporting documentation was generally being held in respect of payments; and that transactions were being properly and accurately recorded in the Council’s general ledger. Although the results of our audit were generally positive, we have identified a small number of instances of non-compliance with expected arrangements and/or where scope for improvement in the control environment has been identified. Most significantly, although a compensating control has been established to address the previously identified control weakness that arose when the interface between PECOS and eFinancials (which provided an automated process to match invoices to orders) was removed, this was intended to be a short-term requirement until the link could be re-established. For several reasons this link is still not in place. Work is underway, however, via the Purchase to Pay (P2P) digital workstream to address this issue and we consider that this work, to enhance the control environment for processing and paying invoices, needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to. It is important, therefore, that Services make maximum use PECOS for ordering and invoice processing, wherever possible, as this will enable the Council to make more effective use of resources, help improve invoice processing times and ensure a more robust and consistent approach to ordering and invoice processing activity across the Council. Recommendations are included at Section 3 of the report. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0200/2023/003 Date issued 30/01/23 Audit Team Elaine MacDonald, Paula Hendry and Jackie Struthers Page 77 of 285
Page 78
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 2 1. Executive Summary Objectives The purpose of this audit is to provide independent assurance that key controls in relation to the approval and payment of creditors by the Council are operating effectively. This includes arrangements for ensuring that payments are only made in respect of amounts properly due in respect of goods and services which have been ordered and received and have been properly authorised and that where amounts are paid these are correctly calculated and recorded. The work was designed to offer an audit opinion on the following: • Whether effective controls continue to operate which ensure that all payments are properly authorised in accordance with expected management arrangements; • That appropriate supporting documentation is held in respect of all payments; and • That all transactions are properly and accurately recorded in the Council’s general ledger. Substantive testing of the effective operation of key controls was based on a sample of 100 payments made across all service areas selected from the period April to September 2022. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 2 0 Key areas requiring management action (High) There are no key areas requiring urgent management action. Good practice identified We noted the following areas of good practice during the audit: • The General Contract Standing Orders sets out the rules and procedures that apply relating to supplies, the provision of services and the execution of works including expected arrangements and controls relating to procurement/ordering and the authorisation of invoices; • Orders placed via the PECOS purchasing system are subject to robust system-imposed controls including appropriate segregation of duties and the application of a hierarchy of authority limits to raise orders; • In the absence of a functioning operational interface between PECOS and eFinancials which electronically matches invoices to orders, a compensating control has been established designed to ensure compliance with the Council’s Financial Regulations. This requires positive confirmation from an authorised officer that for the invoice presented, the goods or services are as ordered, that payment is properly due under the terms of any contract, and that the prices and all relevant arithmetical details are correct, and that the expenditure has been properly incurred; and • Relevant cost centres and account codes charged in the financial ledger are appropriate in relation to the goods/services purchased. Other areas for improvement (Medium) The following issues and/or areas for improvement were identified: • Work currently underway to enhance the control environment for processing and paying invoices needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to; and • Some Services directly inputting invoices to eFinancials are not always fully complying with current invoice certification and processing expectations. Page 78 of 285
Page 79
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 3 3. Action Plan Creditors Regularity 0200/2023/003 Ref Finding 1 Work currently underway to enhance the control environment for processing and paying invoices needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to. The Council has a devolved operating model for procurement activity and Chief Officers are therefore responsible for ensuring their Service areas adhere to the corporate expectations around purchasing/ordering of goods and services and the payment of creditors. The current expectation (as per the Council’s general contract standing orders and financial regulations) is that PECOS or other approved electronic purchasing systems should be used, wherever possible, for all purchases. This system facilitates the creation of purchase orders and the receipting of goods/services received. As reported in our audit of creditors in 2020 (0220/2020/002), the interface between PECOS and e-financials that provided a key element of the control environment for processing invoices (for orders raised through PECOS) ceased to be operational in February 2018, as it was no longer supported. The previous automated system arrangement involved the invoice being matched with the purchase orders/goods received notes held on PECOS and if the information from both systems did not agree (within certain parameters/tolerance levels) then the invoice would not be matched to an appropriately authorised order and could not be passed for payment. A new interface was expected to be developed within a few months of the ‘switch off’ of previous arrangements, however the replacement interface at the time of our audit in 2020 was still not operational. In response to the recommendations made in the 2020 report regarding the weakened control environment, Financial Solutions reviewed and established revised requirements for the certification and submission of invoices. This required all invoices submitted to creditors for processing (regardless of ordering process i.e. PECOS or non-PECOS) to be signed by an authorised signatory with delegated authority to approve invoices and for this signature to be accompanied by clear wording to demonstrate that the authorising officer was confirming compliance with paragraph 14.4 of the financial regulations which requires that for the invoice presented, the goods or services are as ordered, that payment is properly due under the terms of any contract, and that the prices and all arithmetical details are correct, and that the expenditure has been properly incurred. The onset of the Covid-19 pandemic meant that although there was a requirement for all invoices to be authorised by an officer with delegated authority the amendment to the certification to explicitly confirm compliance with financial regulations was not introduced until July 2021. We were pleased to note that our testing during this current audit confirmed that this process is being adhered to across services by way of a covering email from a Council Officer with suitable delegated authority quoting the required narrative, is submitted to creditors with the associated invoices attached to be paid. The alternative certification arrangements detailed above were intended to provide a compensating control, in the short term, until the interface between PECOS and eFinancials could be re-stablished recognising this would provide for a more robust control environment. The development of the interface between e-financials and PECOS is now part of the much wider corporate Purchase to Pay (P2P) digital workstream with the Chief Officer of Place designated as the Senior Responsible Officer (SRO) for this project. The P2P Project Team are now responsible for the development and implementation of this project, the first phase of which is to re-establish a link between PECOS and eFinancials for invoice processing. We understand that work on this is significantly progressed with a solution about to undergo user acceptance testing with the expectation by the Project Team that it will go live in April 2023. Although the link between PECOS and eFinancials is not currently operational, as mentioned above, the PECOS system still provides a mechanism for raising orders and receipting goods. In respect of this we noted a number of instances where the PECOS system was not being used in accordance with corporate expectations as follows: • we identified a number of cases where PECOS was not always used to raise orders by Services who have access to it; • a small number of instances where details recorded on PECOS were vague/unclear; • orders being raised retrospectively for which no pertinent reason as to why this was so, was apparent and/or provided; and • several PECOS orders where the system had not been updated to record that the goods/services had been received but the invoice had been passed for payment. These were evidenced across several Services but were more proportionately more significant in Education and Families. In each case the Service had received the goods/services, but the system had not been updated to reflect this. The forthcoming re-introduction of an interface between PECOS and eFinancials will enable the Council to strengthen the control environment, make more effective use of resources, help improve invoice processing times and ensure a more robust and consistent approach to ordering and invoice processing activity across the Council. (Continued overleaf) Page 79 of 285
Page 80
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 4 3. Action Plan Creditors Regularity 0200/2023/003 Implication Recommendation Priority Management response Implementation Month/Year Expenditure may not be properly incurred. Increased potential risk of fraud and/or error and that any relevant issues would not be identified in a timely manner. (1) Chief Officer of Place should ensure that completion of the interface between PECOS and eFinancials via the P2P project is progressed in line with proposed timescales. Once complete appropriate guidance on its use and any associated expectations should be prepared and communicated to Services; and (2) Chief Officer of Assets and Procurement should ensure that Services are reminded: i. That PECOS is expected to be used, wherever possible, as the Council’s default ordering and invoice processing system; ii. Of the need to raise orders for all purchases and that, as far as possible purchase orders should be raised ahead of procuring goods/services and accurately and fully populated with relevant details (description, quantity and price); and iii. PECOS users are reminded of the need to ensure goods/services are receipted on the relevant order before the invoice is passed for payment to the supplier. Medium Agree (1) Pamela Humphries, Chief Officer of Place Good progress has been made by the Council’s 3rd party contractor to resolve technical issues with the interface between Pecos and eFinancials as part of the P2P workstream to allow automated ‘matching’ of orders with invoices to facilitate a more streamlined and efficient payment process. The interface is the responsibility of the Council’s 3rd party contractor and although there are issues still to be resolved in respect of NLP invoices, the system now appears to be working for all other invoices. A Steering Group has been established with service representation across the Council which will be used as a vehicle to roll-out the implementation of the updated P2P process and in due course e-invoicing. It is currently anticipated that user testing will be fully complete by end April 2023 with training and roll-out progressing during May 2023. (2) Audrey Telfer, Category Manager (Corporate and Digital) Assets & Procurement will issue a Corporate Procurement Advisory to remind Services that: • Pecos is expected to be used wherever possible as the Council’s default ordering and invoice processing system; • there is a need to raise orders for all purchases and as far as possible ahead of procuring Goods/Services and that all orders must be accurately and fully populated with the relevant key details (description, quantity and price; and • Pecos users must ensure that Goods/Services are receipted on the relevant order before the invoice is processed and passed for payment to the Supplier. June 2023 February 2023 Page 80 of 285
Page 81
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 5 3. Action Plan (continued) Creditors Regularity 0200/2023/003 Ref Finding 2 Some Services directly inputting invoices to eFinancials are not always fully complying with current invoice certification and processing expectations. The pandemic resulted in the need to introduce revised working practices for invoice processing. This covered both PECOS and non-PECOS orders and as well as providing a mechanism by which the Council could continue operating when staff were working remotely, revised arrangements also provided a compensating control to replace the previously automated arrangement for matching invoices to PECOS orders (see point 1 above). As noted at point 1 above, our testing of a sample of invoices during this audit confirmed that the revised invoice certification and processing arrangements had largely been adhered to by Services submitting invoices to creditors for processing. We did, however, identify a potential gap in the arrangements for those Service areas who directly input invoices to eFinancials. Included within our audit sample were some invoices for Facility Support Services who are one area that input their own invoices. They have done this for some time and during the Covid-19 pandemic continued to be office based with no change to their normal operating arrangements. As such their invoice processing arrangements remained the same. We understand that their arrangements require the invoice to be checked to PECOS to confirm the order was appropriately authorised and goods received. If the details agree, the invoice will be processed without any further authorisation and as such are not currently adhering to the revised corporate expectation for invoice certification and processing as outlined elsewhere in this report. A difference between order and invoice would require the PECOS order to be updated and re-submitted for authorisation. Whilst our audit did not highlight any instances where invoices were being processed that had not been agreed to the authorised order and confirmation that goods had been received, there is an increased risk that an invoice could be processed for which authorisation from an officer with delegated authority to do so has not been obtained (i.e. if the value of the invoice was significantly different to the original order value that had been approved). Internal Audit considers that until such times as the interface between PECOS and eFinancials is restored (see point 1 above), the corporate expectation that all invoices require authorisation by an officer with delegated authority to do so accompanied by explicit confirmation that the requirements of financial regulation 14.4 have been complied with, regardless of method of order, should be adhered to by all Services including those directly inputting to the system. Implication Recommendation Priority Management response Implementation Month/Year There is a risk of inconsistency in the way invoices are approved for payment that is not fully compliant with the Financial Regulations. Invoices may be paid which are not fully or properly approved in line with corporate expectations. The Chief Officer for Finance should ensure that arrangements in Services with the ability to processing invoices directly on eFinancials are reviewed to determine whether controls are sufficiently robust and operating effectively and/or whether any changes to these Services’ arrangements are required pending/until the introduction of the new interface. Medium Agree Nicola Lynch, Business Finance Manager (Resources and Payments) The Chief Officer for Finance will undertake a review of the processes being completed by Services who directly input invoices to eFinancials. The review will ensure that there is a consistent approach to the way that invoices are approved for all Council Services and that this is fully compliant with the Financial Regulations. Any additional training required will be undertaken by the Central Creditors Team March 2023 Page 81 of 285
Page 82
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 6 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 82 of 285
Page 83
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 1 INTERNAL AUDIT REPORT CYBER SECURITY Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1 Audit grading Appendix 2 Good Practice Checklist Issued to: Chief Officer of Business and Digital Copied to: Information Risk Manager, Chief Executive and Depute Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber-security threats and/or attacks. In particular, the audit focused on whether the arrangements and controls in place are in accordance with relevant external standards and/or where not, that there are clear, risk-based and realistic plans to address any areas of weakness or non- compliance and that these are being satisfactorily progressed. Cyber security is the activity required to protect an organisation’s data, devices, networks and software from unintended or unauthorised access, change or destruction via the internet or other communications systems or technologies. Cyber incidents pose an increasing threat to public bodies’ management of their information with hacking, ransomware, cyber-fraud and accidental losses all evident across the public and private and sectors. In recent years, there has been an increasing prevalence of targeted ransomware, including those which can cause serious disruption to an organisation, and which can result in significant additional costs and reputational harm. This audit was undertaken in collaboration with Business and Digital staff from the Information Risk and Security Team using a good practice checklist which was developed from a variety of resources including relevant guidance from the National Audit Office (NAO), the National Cyber Security Centre (NCSC) and from learning material for public bodies circulated by the Scottish Government following the widely reported 2020 SEPA ransomware attack. The Council continues to be committed to ensuring it has robust and effective information governance arrangements and has recognised the threats posed from cyber-security risks. While the Council has elected for practical reasons not to seek Cyber Essentials accreditation, we noted that it that it seeks to guard against common cyber-security threats and/or attacks through a range of cyber-security arrangements, controls and activities including PSN compliance and regular threat assessments including penetration testing. We have categorised this audit as offering ‘reasonable assurance’. We consider that the Council’s arrangements appear largely commensurate with good practice and that these arrangements are subject to regular review and, based on most recent review/assessments, appear to be operating effectively. We were pleased to note that significant additional resources have been devoted to these activities in recent years and that a range of further planed actions to improve the control environment have been identified. We have identified a small number of areas for improvement and our recommendations are detailed at Section 3 of this report. The most significant of these issues is that the current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales to provide a clearer mechanism for identifying and monitoring planned cyber-security activities. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance Organisational impact (see definition at Appendix 1) Major Report status FINAL Audit ref 0420/2023/001 Date issued 25/01/23 Audit Team Lynn McCrum and Paula Hendry Page 83 of 285
Page 84
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 2 1. Executive Summary Objectives The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber-security threats and/or attacks. In particular, the audit focused on whether the arrangements and controls in place are in accordance with relevant external standards and/or where not that there are clear, risk-based and realistic plans to address any areas of weakness or non- compliance and that these are being satisfactorily progressed. During the audit, we considered the following: • whether the Council implemented a formal regime or structured approach to cyber security which guides its activities and expenditure. • how management has decided what level of risk it will tolerate in relation to cyber and information security and how it will manage that risk. • whether the Council understands if its risk profile and appetite has changed due to COVID-19; and • whether the Council has identified and deployed the capability it needs in this area? This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 2 0 Good practice identified We noted the following areas of good practice during the audit: • The Council has appropriate governance structures in place relating to Information Governance and Information Security which includes the Data Governance Board and Data Management Team. • The Council’s Chief Officer of Business and Digital is the Senior Information Risk Owner (SIRO) for the organisation and has overall authority and responsibility for information governance and security. • The SIRO Annual Report reflects annually on the Council’s information governance work, including providing an overview of relevant activity including providing assurance that personal data is held securely. References is made within the report as to activities which have been undertaken, or are planned, to mitigate against cyber risks. • The Information Risk and Security Team within Business and Digital are responsible for oversight of cyber security. • There is an Information Security and Information Governance corporate risk, with corresponding controls and actions identified. This is monitored in accordance with the associated residual risk rating. • There are mandatory information governance and security training modules for staff tailored to suit the needs of individual roles. • Effective communication channels exist within the Council to inform Services and staff of relevant issues and developments in relation to cyber security. • The Council’s Cyber Security arrangements have been assessed against the Public Services Network (PSN) Code of Conduct, with the Council having achieved full compliance. • Independent IT Health checks are undertaken annually, including penetration testing and other testing of the effectiveness of network controls. • Improvements have been made to supply chain management security through adoption of the Scottish Government’s ‘Cyber Security Procurement Support Toolkit’ (CSPST). • The Council’s ICT resilience capability has been tested through use of the NCSC developed ‘Exercise-in- a-Box’ toolkit. Page 84 of 285
Page 85
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 3 Good practice identified (continued) We noted the following areas of good practice during the audit: • There are robust authentication and access control procedures (including multi-factor authentication) in place to protect Council systems from unauthorised access. • A suite of malware protection products has been fully deployed (e.g. antivirus software, web filtering and email malicious content/payload detection systems) in addition to real-time analysis of security threats identified and managed through deployment of Security Incident Event Management (SIEM) software. • The Council have procured a cyber incident retainer service meaning professional support can be available on-site at short notice to help limit the impact of any significant cyber incident and to assist in recovery thereafter. Key areas requiring management action (High) No key areas which require urgent management action been identified. Other areas for improvement (Medium) Two other areas for improvement were identified: • The current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales. • Proposed arrangements and expectations associated with the refreshed ICT Disaster Recovery Plan need to be finalised and communicated to Services. Page 85 of 285
Page 86
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 4 3. Action Plan Cyber Security 0400/2023/001 Ref Finding 1 The current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales. The Information Risk & Security Team have an Information Security Action Plan in place for 2022/23. This Action Plan was an interim measure to assist management with logging the tasks to be undertaken in the immediate short-term. The plan lists the individual projects/programmes identified by the Team as being pertinent to address key areas of risk and provides brief details/summaries of each including responsible officer; PMO ID; anticipated duration; description; due date; limited narrative on current status; and RAG status. The Information Risk and Security Team recognise that they do not have sufficient dedicated resource to undertake all the work streams per their action plan. Internal Audit notes that the current plan is high-level and consider that there would be merit in there being more detailed work plans for each of the planned actions providing a summary of the proposed actions; relevant milestones and associated timescales which would enable progress to be better tracked on an on-going basis. In addition, whilst we acknowledge that there appears to have been a degree of consideration given to prioritisation of the individual work streams/activities on the Action Plan, we consider that it would be more pragmatic to assess each of these activities in terms of significance and risk impacts/risk exposure to determine how best they should be prioritised. The Information Risk Manager advised that the work streams contained within the Action Plan are currently monitored using an agile and continuous improvement approach and a monthly summary of activities, including progress made, is provided for management review and updates are provided to the ICT management team meetings. We also noted that there is currently no Action Plan beyond that for 2022/23 although, from discussions with the Service, we understand that work is currently ongoing to develop a strategy and more formal work-plan for the next three years. We recognise that, given the nature of the topic and the ever-changing landscape and threats, the longer-term aspects of this Action Plan are likely to be more ‘fluid’. In previous years the Council held the Scottish Government recommended Cyber Essentials accreditation. Business and Digital submitted the Council’s application towards the end of 2020-21 but failed to meet the updated and significantly more onerous compliance requirements of this external accreditation. The Service has since determined that Cyber Essentials no longer meets the Council’s needs and it now seeks to protect itself from common cyber-attacks through full compliance with the externally inspected Public Sector Network (PSN) accreditation, the required IT Health Checks and regular threat assessments. In addition, the Service advised that going forward they intend to refer to and align with the requirements contained within the more recently issued Scottish Government Cyber Resilience Framework, which incorporates standards/expectations from a number of various sources, including elements of Cyber Essentials. The Senior Information Risk Officer (SIRO) recognises that in times of increasing cyber-attacks and continued use of ageing legacy applications there is a growing concern regarding the Council’s vulnerability including ability to fully secure data held on business-critical applications. Implication Recommendation Priority Failure to have appropriately detailed project plans may result in an increased risk to the successful delivery of the actions stated in the work plan and the achievement of intended outcomes. The Chief Officer of Business and Digital should ensure: (1) going forward, a formal risk-based approach to developing the Information Security Action Plan is adopted and that the resultant Plan is sufficiently detailed to include relevant milestones thus enabling tracking on an ongoing basis and proper consideration to be given to the prioritisation of actions and associated timescales; (2) a longer-term work plan (i.e. beyond 12 months) is formulated, agreed and thereafter monitored; and (3) highlight to relevant Services where additional risks are present in relation to legacy systems that need to be reflected in Service risk registers. Medium Page 86 of 285
Page 87
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 5 3. Action Plan (continued) Cyber Security 0400/2023/001 Management response Implementation Month/Year Agree Katrina Hassell, Chief Officer of Business and Digital (1) A risk-based approach has been, and will continue to be, used to inform priorities and future iterations of the Information Security Action Plan. For example, the previous two SIRO reports highlight the Gartner ‘IT Score for Security & Risk Management’ assessment, which is used to inform prioritisation and planning, and this is presently being scheduled for the forthcoming financial year and beyond. In addition, it has already been proposed that the Council assure itself against the Scottish Government’s Cyber Resiliency Framework, which takes a risk-based approach to determining the cyber security controls applicable to Scottish public sector organisations generically. Where applicable, milestones, etc. will be determined, but an agile-based methodology incorporating continual improvement will continue to be a significant element of the Council’s cyber security posture in the face of an ever-changing risk landscape and the evolving nature of the organisation’s digital footprint. (2) The team are developing an information security strategy which will include the desired ‘future state’ (beyond just one year) for cyber security. Provisos need to be accepted, however, that longer-term plans give rise to less certainty, and that regular monitoring may see such subject to regular change. This aims to build upon existing planning, including the Council’s 5-year capital plan which presently details several longer-term plans around cyber security, such as procurement of vulnerability management systems, phishing simulators and new security incident and event monitoring tools. (3) The SIRO report references several concerns regarding legacy systems. Business and Digital will risk-assess these over the course of 2023-24 and will use those findings to inform services of high-risk systems which they should include in their service risk registers. June 2023 June 2023 March 2024 Page 87 of 285
Page 88
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 6 3. Action Plan (continued) Cyber Security 0400/2023/001 Ref Finding 2 Proposed arrangements and expectations associated with the refreshed ICT Disaster Recovery Plan need to be finalised and communicated to Services. The Council’s ICT Disaster Recovery (DR) plan was updated in 2020, with ongoing amendments thereafter reflective of changes made to line of business and productions systems. As part of this review the plan content was assessed to ensure systems were correctly identified and classified by their value/importance, and that system recovery details were accurate. To support the DR Plan, an ICT DR and Resiliency Standard was created and approved by the Data Governance Board in September 2021. This standard lays out the expectations and requirements for both making systems suitably resilient and supporting DR processes. This includes referencing that a standard and defined process will be put in place to ensure all systems are assessed for resiliency and DR requirements in the same manner and categorised into Gold, Silver and Bronze with a typical approach for system architecture DR and resiliency assigned to each class. The document also identified opportunities for further improvements to be made to the existing DR Plan. As a result, a refresh of the DR planning within the Council has been identified as an action in the Information Security Action Plan 2022/23, with an expected completion date of 31 March 2023. A detailed improvement plan has been created in this respect with progress of actions monitored an on-going basis. Business and Digital envisage that this refresh will ensure a more modular approach to managing DR documentation and will see the documentation broken into three components; an overarching procedural document which will detail how the ICT DR will be operated by the Council and the various processes required to support that operation (including Incident Response Plans for individual events, such as ransomware and data loss, that commonly affect organisations); individual system ICT DR plans and an index providing detail on where ICT system/application controls are located; review periods; testing history; classification and any other metadata relevant to individual plans. These fields will be held as an extension to the Council’s application catalogue. The Service’s plans also reference that an audit process, co-ordinated by Technology Solutions, will be implemented to ensure DR plans are in place, subject to review, and are tested according to an agreed schedule. We noted that to date, and due to the significant pressures facing Services responding to the challenges presented by the pandemic, there has been only limited testing of Services’ DR arrangements of late primarily due to Covid. However, Business and Digital undertook a corporate exercise, with participants from all relevant Services, to assess the organisation’s understanding of, and preparedness for, dealing with a potential cyber threat using the NCSC ‘Exercise-in-a-Box’ toolkit, most recently in December 2022. Whilst we acknowledge the positive direction of travel in respect of the review and refresh of DR arrangements, we consider that it is important that as part of this process, engagement with Services is undertaken to ensure they have a clear understanding of the DR arrangements assigned to their system, are clear on the roles and responsibilities of both Business and Digital and themselves and that due consideration of the recovery timescales can be reflected in their individual business continuity plans. Implication Recommendation Priority A lack of appropriate and detailed guidance (and/or understanding of such guidance) may result in the inability of Services to fully consider the impact of a loss of IT at a service level and the steps necessary to respond to minimise disruption to the Council and/or service areas. The absence of up-to-date, comprehensive ICT Disaster Recovery plans could result in the inability to restore corporate or service infrastructure in line with expectations. Business and Digital management should: (1) ensure the ICT Disaster Recovery Plan refresh progresses in line with expected timescales to ensure that fully documented plans are in place; (2) communicate with system owners to ensure that Services are clear on their responsibilities and planned recovery times in relation ICT disaster recovery and the need for this to be aligned with their Service business continuity plans; and (3) ensure appropriate oversight/review of Services/System Owners ICT disaster recovery arrangements/plans to ensure these are consistent with and fully meet the requirements of the Council’s disaster recovery standard. Medium Page 88 of 285
Page 89
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 7 3. Action Plan (continued) Cyber Security 0400/2023/001 Management response Implementation Month/Year Agree Katrina Hassell, Chief Officer of Business and Digital (1) Activities are well under way to progress the refreshed programme. The baseline refresh will be complete by the end of June 2023, after which a programme of continual improvement will commence. (2) Services are frequently reminded, for example at governance forums, that they are ultimately responsible for ensuring DR plans for the systems they own meet their requirements. As part of the refresh programme, meetings with line of business system owners took place over December 2022 – February 2023 to reinforce this message. (3) Processes for auditing compliance of plans with overarching guidance form part of the refresh programme and are identified in the ICT Disaster Recovery Operations Manual, which is currently in draft. June 2023 Complete March 2023 Page 89 of 285
Page 90
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 8 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls. Page 90 of 285
Page 91
Appendix 2 – Good Practice Checklist Ref Questions Section 1: NAO – Cyber and Information Security Good Practice Guide (a) Approach to Cyber Security 1 Has a formal regime or structured approach to cyber security been implemented which guides its activities and expenditure? 2 (a) Is there an information security management system in place covering policy, processes, governance, skills and training? (b) Who actively manages this system? (c) Has the Council/Business Solutions achieved formal certification through a scheme such as Cyber Essentials or ISO 27001/ISO IEC 27002? (d) Has the system been implemented or certified by consultants or specialist bodies from government? 3 Have boards, working groups and individuals been allocated specific responsibilities for managing cyber risks? 4 (a) Are there plans in place for resilience and recovery in respect of common cyber-attacks? (b) Are such plans tested regularly? 5 Has Business Solutions undertaken a clear assessment of the potential risk arising from electronic links with any supply chain or operational partners? (b) Cyber and information security risks 6 How has management decided what level of risk it will tolerate and how it will manage that risk? 7 Have senior management discussed its overall approach, based on a clear and common understanding of the range of information assets it holds and agreed which of those are critical to the Council’s business? 8 Is there a clear understanding of the kind of threats and risks the Council actually faces, based on incident reporting and relevant performance indicators? 9 Are cyber risks proactively managed as an integrated facet of broader risk management, including scrutiny of security policies, technical activity, information security breach reporting, user education and testing and monitoring regimes? 10 Is Business Solutions involved in sector or peer information exchange mechanisms to improve its understanding? (c) Effect of Covid-19 on risk profile and appetite 11 Does Business Solutions understand if the Council’s risk profile and appetite has changed due to Covid- 19? 12 (a) What working practices have changed as a result of Covid-19? (b) Have these been documented and presented as changes to operating models and workforce planning? (c) Are cyber security and information risks presented clearly set out, including mitigations and plans? 13 Is there evidence to demonstrate that a review of any required re-development and realignment of processes, working practices and policies due to Covid-19 has been carried out to assess the assurance on cyber security and information risk? 14 Have staff been provided with adequate cyber security and information risk training and support: (a) Throughout changes to workforce planning and operating models (b) In an environment of stabilisation and new ways of working Page 91 of 285
Page 92
Appendix 2 – Good Practice Checklist Ref Questions 15 Do you understand the overall change process experienced as a result of Covid-19, including the overall impact on risk? 16 Have you set out how a current and future business-as-usual workforce plan and operating model will take cyber security and information risk into account? (d) Identification and deployment of capability 17 Has Business Solutions identified and deployed the capability it needs in this area? 18 Is there either sufficient staff capability to deal with cyber security issues or formal arrangements made to secure this capability from external providers? 19 Are there actively managed plans in place for the recruitment and retention of staff with specialist security skills? 20 Are there clear policies in place on the handling and storage of data, based on relevant legal requirements, such as the Data Protection Act 2018? 21 Is training available for all staff to ensure appropriate levels of awareness and compliance? 22 Has testing been undertaken to measure the effectiveness of controls? Section 2: NAO Key Control Questions (Based on NCSC Cyber Security Toolkit and 10 Steps for Cyber Security) (a) Risk Management 1 Is cyber risk management part of the overall strategic and delivery planning of the Council? 2 As part of its strategic and operational planning, does Business Solutions have a clear understanding of the Council’s critical services, associated risk appetite and required overall approach to resilience, including cyber? 3 Is there a cyber and information risk strategy, detailing overall service landscapes, including shared responsibility models such as cloud, planning and mitigation? 4 Are there appropriate cyber and information risk frameworks, management and controls in place? 5 Are the governance arrangements for managing cyber and information risk based on the importance of data and criticality of services? 6 Do information professionals liaise with central government, stakeholders and suppliers to understand the threat? 7 & 8 Does senior management understand and engage with risk mitigation processes and promote a risk management culture? (b) Engagement and Training 9 Is there a clear centralised cyber security training and engagement plan? 10 Does the Council offer cyber specialist training and career routes? 11 Is there a clear understanding of skill and capability gaps? 12 Does the Council have security policies covering acceptable and secure use of data? 13 (a) Are there grade and role appropriate levels of staff training covering secure processes and use of systems? (b) Is this training undertaken by relevant staff? 14 Are there appropriate controls in place to cover the increase in remote and home working? 15 (a) Are staff aware of information security and cyber risks? (b) Do staff know how to report issues and incidents? Page 92 of 285
Page 93
Appendix 2 – Good Practice Checklist Ref Questions (c) Asset Management 16 Does the Council/Business Solutions define and utilise asset management systems? 17 Is there an asset management register detailing associated risks and linked to cyber security activities? 18 Is there a clear understanding of critical and prioritised services, detailing associated cyber and information risks? 19 Do Business Solutions/the Council understand the risks associated with legacy asset management? 20 Is there a future plan for managing asset management cyber and information security risks? (d) Architecture and Configuration 21 Is there a business, data and technology architecture within the Council, where associated cyber and information risks are mapped and understood? 22 Does the architectural language include service providers and suppliers, systems and services, with mapped cyber and information risks? 23 When planning and deciding on new services is there clear guidance on how cyber and information security should be assessed? 24 Are there effective monitoring, backup and recovery systems in place? (e) Vulnerability Management 25 Is there a clear understanding of vulnerability management and process, and its associated risks? 26 Are vulnerability management and asset management linked to gain a landscape view of cyber and information risks? 27 (a) Are potential high-risk legacy assets identified and managed? (b) If necessary is there a plan in place to address legacy remediation? 28 Are there effective vulnerability controls in place, such as automation/manual scanning, monitoring, patches and updates? 29 Are vulnerabilities tested on a regular basis, using methods such as penetration testing or ‘red team’ exercises? (f) Identity and Access Management 30 Are there appropriate identity and access management policies, including passwords? 31 Are there effective account management processes, with limits on privileged accounts? 32 When using cloud technologies is there effective management of service accounts? 33 Are user privileges controlled and monitored on the basis of policies for user authentication and access? 34 Is access to activity and audit logs controlled? 35 Are these logs reviewed for unusual behaviour? Page 93 of 285
Page 94
Appendix 2 – Good Practice Checklist Ref Questions (g) Data Security 36 Is the Council’s data architecture and data model detailing levels of security defined? 37 Does the data architecture include where partner services are used such as for cloud? 38 Does the required legal compliance for data form part of policy? 39 Is the policy understood, managed and implemented effectively? 40 Is the required level of data security and compliance understood, managed assessed and assured? 41 Is there a process in place for data monitoring and unusual behaviour detection? 42 Are there appropriate backup and resilience processes and policies in place? 43 Are there adequately secure device re-use, repair and disposal processes and policies in place? (h) Logging and monitoring 44 Is there an appropriate logging and monitoring system in place? 45 Does Business Solutions have the necessary skills and capability to interpret the information provided? 46 Where outsourced, specialist partners are used are the responsibilities for acting on information clearly defined? 47 Are there adequate automated monitoring systems and services in place? 48 Do logs and other monitoring activities enable the identification of unusual activity that could indicate an attack? 49 Can logs support investigations by showing who accessed what, when they did so and what they did to the information? (i) Incident Management 50 (a) Are there incident management plans in place? (b) Are these tested? 51 Does the incident management plan include a response and test plan? 52 Are there specific processes and policies to manage both the risk and the mitigation of a ransomware incident? 53 Does Business Solutions have an incident response and disaster recovery capability, with suitably trained staff? 54 Are potential criminal incidents reported to law enforcement bodies and relevant data breaches reported to the Information Commissioner’s Office within the timescales required by law? (j) Supply Chain Security 55 Are the supply chain and the services provisioned well understood? 56 Are cloud services in place or being considered? 57 Has recognised guidance, such as the NCSC’s cloud security principles, been followed before committing to using cloud services? 58 Is there a strategy in place for the use of cloud services, based on a clear understanding of how cloud services will interface securely with existing services, systems and processes? 59 Have Business Solutions undertaken due diligence on proposed cloud suppliers? 60 Is there a process to ensure and assure that cyber security and information risk is built into the design, development and deployment of new systems and services? 61 Is there a mechanism in place to build cyber security and information risk into the procurement and commercial process? Page 94 of 285
Page 95
Appendix 2 – Good Practice Checklist Ref Questions 62 Is there a process for ongoing improvement and development for cyber security and information risk through the lifecycle and management of the contract? Section 3: Lessons learned from SEPA Ransomware Response (a) Increasing number of people and improving training for people with access to threat alerts 1 Does Business Solutions have a dedicated and empowered team (internal, managed service or combination of both) with adequate training to identify, prioritise and rectify threats to their IT systems? 2 Are routine meetings held between at least one individual responsible for the Council’s IT systems and board-level Senior Information Risk Owner (SIRO) to successfully manage and mitigate risks? 3 Does the team have access to threat hunting software and/or management tools? 4 Has consideration been given as to whether a Security Operation Centre (SOC) is a cost effective and appropriate way to provide overall threat protection including monitoring, direct action and logging across the whole of the Council’s IT infrastructure? (b) Availability and testing of emergency management, disaster recovery and incident management plans 5 Are all emergency management plans, including wider civil contingency plans, held in hard copy or in electronic form on a device or service that is never accessible through the core network? 6 Are all emergency management plans, including wider civil contingency plans, tested at least annually to allow for continuous improvement as well as increasing confidence in those responding to any incident? 7 Has consideration been given to acquiring the services of a specialist Cyber Incident Response company as a cost-effective alternative to employing the necessary disaster recovery specialists internally? (c) Enhanced network segmentation controls 8 Have the Local Authority networks been segmented into separate areas (VLANs)? 9 If yes, has independent assurance been sought to confirm the effectiveness of the locks between each area (VLAN)? 10 If no, is this something that has been, or is being considered? Note: in delivering this there may be considerable capital expenditure required (d) Enhanced privileged account management controls 11 Has a review of user account privileges been carried out for each known system to ensure that administrative functions have only been granted to documented and planned administrator accounts? 12 Has multifactor authentication been applied to ALL administrator accounts, even those that are not normally accessible remotely? 13 Are passwords in line with the latest NCSC guidance? (e) Ensure that recovery plan activities are clearly prioritised 14 Has Business Solutions defined, and scheduled an annual review of, a priority list of all of the Council’s IT systems based on the criticality of that system to business functions, service delivery, legal responsibilities and public well-being? (f) Offline immutable back-ups 15 Has testing been conducted to ensure that systems can actually be restored from back-up? 16 (a) Has consideration been given to offline storage? (b) If so, has there been discussion and approval re securing financing of offline storage? Page 95 of 285
Page 96
Page 96 of 285
Page 97
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref KA/LM/ASP/Feb 2023 Date 16/02/23 Internal Audit: Follow up of actions previously agreed by management in response to audit recommendations From Ken Adamson, Chief Officer of Audit and Risk E-mail adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to update the Panel on the results of Internal Audit’s follow-up work reviewing the extent to which management have implemented actions previously committed to in response to previous Internal and External Audit recommendations. Information is contained in respect of the last two years External Audit outputs and those actions agreed in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed in the period up to the end of December 2022. The Panel should note that where actions are not yet ‘complete’ this does not mean that no relevant activity has been undertaken by management and that the actions taken/progress made to date will often have reduced the risk exposure in respect of the weaknesses previously identified even if the action is not yet complete. As reported to the Panel in December 2021, those recommendations which were previously reported to the Panel as partially implemented but not yet complete are now monitored against revised target implementation dates agreed with management and previously reported to the Panel. Seven of the twelve actions agreed in respect of External Audit outputs have been completed, four are not yet due and one is no longer relevant. Five of the twenty-one actions agreed in response to relevant Internal Audit recommendations due in the period have been fully completed and sixteen have been assessed as partially implemented. Recommendations The Panel is invited to: a) note the contents of this report; b) note the recommendations made by Internal Audit at Appendix 1; and c) to consider whether there are any issues arising from this report on which they wish to receive further information from relevant management. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements AGENDA ITEM 5 Page 97 of 285
Page 98
1. Background 1.1 All Internal and External Audit reports contain management responses to audit recommendations which generally include a commitment to specific actions by a stated date. This report presents an overview of progress by management in addressing all External Audit recommendations made in the last two years and all ‘High’ and ‘Medium’ Internal Audit recommendations which were previously reported as outstanding or where the proposed actions were due to be completed by the end of December 2022. 1.2 The format of this report is designed to allow the Panel to focus on those issues where non-implementation of agreed actions presents the most significant ongoing risk to the Council and to enable the Panel to hold relevant senior management to account. 1.3 Internal Audit’s arrangements for following-up audit recommendation include, in certain circumstances, agreeing a revised implementation date and monitoring and reporting against these revised dates where we are provided with a strong rationale for the non- implementation of the audit recommendation by the originally agreed date. This avoids repeatedly reporting and focusing on actions which are ‘late’ where there are sound reasons for non-implementation by the originally agreed date. 1.4 This report presents the assessment of the potential risks arising from those planned actions agreed in response to Internal Audit recommendations due in the period (August to December 2022) which are not yet fully completed. 1.5 The updates from management on progress to date have been verified on a sample basis by Internal Audit as part of the preparation of this report. However, it should be noted that this review has focused on whether planned actions have been completed and has not included detailed substantive testing of whether the implemented actions have been effective in addressing previously identified weaknesses. 2. Report Actions previously agreed by management – Internal Audit recommendations 2.1 Table 1 below shows whether management have implemented those actions previously agreed to in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed by the end of December 2022. Overall, five of the agreed actions have been completed and sixteen have been assessed as partially implemented. Table 1 Chief Officer Area Complete Partially implemented No longer relevant Total Asset and Procurement 0 1 0 1 Audit and Risk 0 3 0 3 Business and Digital 1 4 0 5 Finance 1 0 0 1 Legal and Democratic 0 1 0 1 People Resources 2 6 0 8 Social Work 1 1 0 2 TOTAL 5 16 0 21 Page 98 of 285
Page 99
2.2 Internal Audit has reviewed the management updates and agreed with relevant management revised implementation dates for all sixteen recommendations listed as partially implemented at Table 1. These recommendations will now be monitored in line with the agreed revised date and will be reported back to the Panel in accordance with this revised timescale, at which time consideration will be given as to whether previously identified weaknesses have now been addressed. 2.3 Detail in respect of each of these recommendations and the current residual risk assessed by Internal Audit as a result of partial implementation is provided in Appendix 1, in which we have also made suggestions as to how the Panel may wish to consider these issues. Definitions of the residual risk ratings are provided at Appendix 2. Actions previously agreed by management – External Audit recommendations 2.4 Table 2 shows the status of actions agreed by management in response to External Audit reports issued as part of the 2020-21 and 2021-22 audits. Internal Audit has concluded that seven of the twelve agreed actions have been completed, four are not yet due and the remaining actions is no longer relevant. Table 2 Completed Partially implemented Not yet due No longer relevant Total Report Title/Year 2020-21 Interim Audit Report 3 0 0 1 4 Annual Report 3 0 0 0 3 2021-22 Annual Report 1 0 4 0 5 TOTAL 7 0 4 1 12 2.5 The External Audit action assessed as ‘no longer relevant’ relate to issues on which External Audit have made a similar recommendation in subsequent audit reports. 3. Measures of success 3.1 Internal Audit report each cycle to the Audit and Scrutiny Panel on the progress made by management in implementing actions previously committed to in response to Internal and External Audit reports. 4. Supporting documentation Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Appendix 2 Residual risk rating definition Ken Adamson, Chief Officer of Audit and Risk Page 99 of 285
Page 100
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure by Services to address previously identified issues and/or weaknesses will impact on the effectiveness of the relevant control framework. This, depending on the nature of the issue, will be captured and should be reflected in the relevant service risk register or the corporate risk register (as appropriate). 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ Page 100 of 285
Page 101
Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Asset and Procurement Enterprise Project (May 2022) Risk: Without a robust and realistic contingency plan in place the Council may not be able to ensure continuity of service delivery and achievement of ambitions. Recommendation: The Enterprise Project Board should ensure that the key tasks required to fully document a contingency plan, including key milestones and lead times/critical path, is included in the project plan and thereafter monitor development of the contingency plan to ensure that an alternative ‘Plan B’ is available, and lead times/critical path are clearly understood should the project not be able to be progressed as currently envisaged. Category: Medium The Project Board has set out the actions required to be taken, to mitigate the identified risks at this stage of the project, in a report to the Policy and Strategy Committee in December 2022. Committee approved these actions which are now being progressed and include consideration of contingency planning requirements as appropriate, which will inform the way forward. Original timescale: July 2022 Revised timescale: December 2022 Further revised timescale: September 2023 We acknowledge that work in this area has been ongoing and action to be taken to mitigate the identified risks were outlined in a report to the Policy and Strategy Committee in December 2022. Given that further action is required to fully address the recommendations we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of May 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow- up report. Chief Officer of Audit and Risk Risk Management (July 2022) Risk: Without appropriate training, staff may not be aware of their roles in respect of risk management. Recommendation: The Head of Audit and Risk should: (1) remind Services of the need to complete and monitor uptake of the mandatory risk management training by staff; (2) determine how best to capture/monitor the uptake of mandatory training module for each Service and the Council as a whole in accordance with expected timescales, ensuring that this is regularly monitored, and action taken as appropriate on any issues arising, by the Corporate Risk Team and RMCWG; and (3) ensure the risk network training is finalised and implemented within a reasonable timescale. Category: Medium Services have been reminded of the need to complete and monitor uptake of mandatory risk training. Data on the uptake of the mandatory risk management training module is now available and the RMCWG members will now seek to agree and implement an approach to monitor the uptake. The risk network training has been postponed pending changes to the risk scoring approach which is proposed as part of the review of the Risk Management Strategy which is due to be submitted to Policy and Strategy for approval in March 2023. The training will be launched in April 2023 and will reflect the revised strategy. Original timescale: October 2022 Revised timescale: June 2023 We acknowledge that there has been significant action taken to address the recommendations made and that delay in finalising and implementing the risk network training were necessary to ensure this fully reflects the revised Risk Management Strategy. However, it is important that the outstanding actions are addressed and actioned in line with revised timescales. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 101 of 285
Page 102
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Audit and Risk Risk Management (July 2022) Risk: Management may lack assurance on the extent to which key expectations/requirements contained the strategy are being complied with. Without formal processes in place for reporting risk issues, management may not be able to take appropriate or timely action to address these risks. Recommendation: The Head of Audit and Risk should ensure that: (1) work continues to develop a framework, including suitable KPIs, to appropriately monitor compliance with key aspects of the Risk Management Strategy, with areas for improvement being captured and thereafter tracked and monitored; and (2) clear expectations regarding consideration, monitoring and reporting of risk are incorporated into the revised Risk Management Strategy so that Services can incorporate this into their individual governance arrangements. Category: Medium Development of a draft compliance approach is being progressed through the RMCWG and will be incorporated into the updated/revised Risk Management Strategy which is due to be presented to the Policy and Strategy Committee in March 2023. It is thereafter intended that the new approach to compliance monitoring will commence for 2023/24. The revised Risk Management Strategy will make clear expectations and the detailed process/KPIs etc. Expectations around consideration, monitoring and reporting of risks are being progressed through the RMCWG and will be clarified in the revised Risk Management Strategy. Revised governance arrangements for the CMT, the new Business Management Team (BMT) and SMT/DMTs were approved at CMT in December 2022. The terms of reference for all groups explicitly include each group’s remit in relation to risk management. In addition, a reporting matrix is being developed that sets out organisational (including service) reporting expectations. A Risk Management planning tool is also being developed to provide oversight of key risk management activities (including reporting), and their timing across 2023. Original timescale: December 2022 Revised timescale: April 2023 We acknowledge that there has been significant action taken to address the recommendations made and that the revised Risk Management Strategy will reflect the proposed compliance approach and the monitoring and reporting of risks but consider it important that these are finalised and implemented in line with the revised timescale. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Risk: The absence of a fully documented corporate risk register, subject to regular monitoring and challenge may mean that key stakeholders may fail to fully understand the key risks the Council faces and in turn may consequently fail to take appropriate action to mitigate them. Recommendation: The Head of Audit and Risk should ensure that the replacement and/or new corporate risks detailed in the finding are documented, assessed and moved to ‘live’ status with a reasonable timescale. Category: Medium The corporate risks on Supply Chain and the Scottish Child Abuse Inquiry have been developed, agreed and are now ‘live’. The corporate risk in relation to the National Care Service proposals has been documented as much as can be based on current information available. This will continue to be developed as the national policy direction progresses and the current level of uncertainty reduces. Significant effort has gone into further developing and documenting the two remaining corporate risks (Educational Outcomes and Target Operating Model). These are, however, both in draft format and require further discussion and development with the relevant Risk Leads before being agreed and finalised. Original timescale: September 2022 Revised timescale: December 2022 Further revised timescale: March 2023 Whilst we acknowledge that there has been significant action taken to address the recommendations made, it is important the two remaining risks are finalised and moved to ‘live’ status at an early opportunity. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 102 of 285
Page 103
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Business and Digital Digital NL (November 2021) Risk: Benefits and savings may not be being adequately tracked and monitored resulting in the Council being unable to demonstrate the achievement of the objectives of the programme. Recommendation: Management should ensure that the non-financial benefits tracker is finalised and approved with non-financial benefits thereafter identified, calculated, tracked and monitored for all workstreams. Category: Medium The non-financial benefits tracker templates for each of those sprints already live have been created and populated. Tracker templates for the Year 4 Roadmap have been created and will be populated with the Benefits Map detail for each sprint as that work progresses. From a governance perspective, consideration of the non-financial benefits tracker will focus heavily at the Project and Delivery Board meetings. Original timescale: April 2022 Revised timescale: September 2022 Further revised timescale: March 2023 Whilst we acknowledge that there has been some action taken in this area, we consider that it is important going forward that non-financial benefits are identified and captured in a timely and consistent manner for those sprints not yet underway/at an early stage. We have assessed the residual risk as ‘High’ as the recommendation has not yet been fully addressed by management and consider it important that the revised timescale is adhered to. In response to the Panel’s request following consideration of an update on progress against this recommendation at the November meeting, a separate report is included on the agenda from the Service regarding this recommendation, progress made and further proposed actions. Page 103 of 285
Page 104
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Business and Digital Governance of Capital Projects (December 2019) Risk: If Services are aware of the projects which will be reviewed, they are more likely to follow the guidance for those projects and the results of any such reviews may not provide a true representation of the extent of compliance with expected arrangements, including use of the relevant guidance and control template documents. Recommendation: Management should review the ‘project management model review programme’, particularly in relation to: • expanding the sample of projects being reviewed to incorporate some capital and non-capital projects that Services have not received advance notification; and • reviewing and updating the checklist to include consideration of the adequacy and effectiveness of the completed control document templates, determination of whether established processes have been documented and confirmation that key stakeholders have been adequately updated on the progress of the project, in line with the suggested improvements at Appendix 3. Category: Medium Project Registers have now been received from all Heads of Service and a quality assurance review process is being established to support the Project Management Framework. The quality assurance review programme, and the timings of each review to be undertaken, is informed by the Project Registers which each Chief Officer is required to maintain. Recently revised governance arrangements will now require the Programme/Project Boards to provide regular updates to CMT. A report is being submitted to CMT in early 2023 which will take into consideration the governance, oversight, monitoring and quality assurance processes that support the work of Programme/Project Boards in delivering on the wide range of programmes and projects set out in the Project Registers. Original timescale: June 2020 Revised timescale: September 2022 Further revised timescale: June 2023 Given that further action is required to progress arrangements for monitoring compliance with the refreshed project management framework, we have assessed the residual risk as ‘Medium’ and consider it appropriate that more detailed plans and timescales are identified by management at an early stage In response to the Panel’s request following consideration of an update on progress against this recommendation at the November meeting, a separate report is included on the agenda from the Service regarding this recommendation, progress made and further proposed actions. Page 104 of 285
Page 105
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Business and Digital Managing Strategic Change (June 2021) Risk: Key stakeholders may not be adequately informed of progress in the Council’s key corporate projects and may not be able to undertake effective oversight and/or ensure that timely remedial action, necessary to ensure that projects are delivered successfully, has been progressed by relevant management. Recommendation: Management should progress the previously identified action of establishing a reporting mechanism which better facilitates regular and ongoing oversight by key stakeholders of the progress of key projects against plan, including management of key risks, progress against timelines, cost against budget, achievement or otherwise of key milestones and expected outcomes or benefits realisation. We suggest that this could include introducing a standard reporting template and adopting a traffic light system to report progress against key criteria, project milestones and overall deliverability against expected time, cost and any other intended outcomes. Category: Medium The consultative draft of the Project Management Framework was approved at CMT in September 2022. It was thereafter updated in November 2022 to include reference to the reporting requirements for all stakeholders. The final Framework and supporting documentation were then uploaded to the Council’s intranet and an NLC announcement issued to staff to notify them of this. Original timescale: September 2021 Revised timescale: September 2022 Further revised timescale: To be determined by management The Service consider this action to be complete as the project management framework has now been updated and uploaded to the Council’s intranet. However, while we acknowledge that the Project Management Framework has been revised and approved, we consider that the narrative within the Framework, whilst referencing the need to report to all key stakeholders, does not fully address the recommendation which required that there be a mechanism to facilitate regular and ongoing oversight by key stakeholders of the progress of key projects against the plan. We have assessed the residual risk as ‘High’ as the recommendation has not yet been fully addressed by management and consider it important that a realistic revised timescale is determined and adhered to. In response to the Panel’s request following consideration of an update on progress against this recommendation at the November meeting, a separate report is included on the agenda from the Service regarding this recommendation, progress made and further proposed actions. Page 105 of 285
Page 106
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Business and Digital Performance Management (October 2022) Risk: It may be difficult to clearly demonstrate progress, improvement or achievement of the Council’s ambition statements and programme of work items, which could result in the Council failing to meet its obligations in relation to best value, good governance and public performance reporting. Recommendation: The Head of Business and Digital, in conjunction with all Services, should: (1) as part of the refresh of the SPF, ensure that consideration is given to all level 2 and 3 indicators to determine whether improvements in these performance indicators provide meaningful information in respect of progressing/achieving the ambition statements and programme of work items that they are linked to. This review should include the removal of any indicators which are not directly linked to planned outcomes and the identification of new indicators to assist with the monitoring of progress of ambition statements and key programme of work items; (2) consider preparing a document (or adding to existing documentation such as the SPF) which clearly indicates the Chief Officer responsible for each performance indicator; and (3) identify a suite of key performance indicators/reporting mechanism(s) that would facilitate effective scrutiny and challenge by CMT and elected members. Category: Medium The review and refresh of the Strategic Performance Framework is underway and is awaiting the outcome of the Programme of Work Development Group to ascertain items to be included in the 2023 to 2028 Programme of Work and identify any performance related requirements therein. The list of Calculating Officers and Verification Officers clearly show the corresponding service for each indicator in the Framework. A report submitted to CMT in December 2022 outlined the Performance Reporting Schedule for 2023 to 2024, which will facilitate scrutiny and challenge by CMT and elected members. Once formally approved, the Strategic Performance Framework document will be finalised accordingly. Original timescale: December 2022 Revised timescale: March 2023 We acknowledge that work in this area to review and refresh of the Strategic Performance Framework has been ongoing, however further action is required to fully develop and thereafter implement the Strategic Performance Framework, and we have assessed the residual risk as ‘Low’. We consider it important that the agreed extension date of March 2023 is achieved. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 106 of 285
Page 107
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Legal and Democratic Corporate Governance Principles E, F & G (March 2021) Risk: The Council may not be able to adequately demonstrate that it has effective audit committee arrangements and/or arrangements to ensure elected members have the skills, knowledge and, where appropriate or required, access to relevant training and resources to effectively undertake their role. Recommendation: The Head of Legal and Democratic Solutions should: (1) in conjunction with the Audit and Risk Manager, seek to introduce a formal process whereby the Audit and Scrutiny Panel periodically undertakes a self- assessment of their performance and activities against the ‘CIPFA’s Audit Committees: Practical Guidance for Local Authorities and Police (2018)’, with a report outlining the results of this review including any improvement actions being presented to the Panel and reported to the Policy and Strategy Committee. (2) In conjunction with the Business Strategy Manager, seek to introduce a formal process whereby the Audit and Scrutiny Panel periodically undertakes a separate self- assessment of the effectiveness of the performance and activities of the Panel in discharging the Scrutiny aspect of its role. Category: Medium The Strategic Self-Evaluation Review Programme has been updated to reflect this self-valuation exercise and a report was approved by the Audit and Scrutiny which re-establishes the role of the scrutiny work programme in the Panel’s activities. Membership of the Audit and Scrutiny Panel changed significantly following the Local Government elections in May 2022. However, following this there have only been two meetings of the Panel which is not considered enough time to for arrangements and the new Panel to be embedded. Original timescale: September 2021 Revised timescale: December 2022 Further revised timescale: September 2023 We acknowledge that delivery of this action has been delayed allowing for the significant changes to the membership of the Audit & Scrutiny Panel following the Local Government elections in May 2022 to be embedded. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 107 of 285
Page 108
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of People Resources Information Governance/ Security (February 2021) Risk: Staff may not understand that responsibilities for information governance and security which could result in significant additional financial and reputational costs in the event of any information breach. The ICO has historically been particularly critical of organisations who suffer breaches and who cannot demonstrate that they have effectively identified and addressed staff training needs. Recommendation: The Head of People and Organisational Development, in conjunction with the Head of Business Solutions, should progress the creation of a less intensive training for staff/roles who are not required to undertake the mandatory training modules. Category: High Following a successful recruitment campaign, additional staff have now joined the team and this action is now being taken forward. A learning resource is being created which will cover all areas required for information security at this level and this will be rolled out throughout Quarter 4 to all staff. Line managers will be trained to deliver the training within team meetings/toolbox talks to roll out the learning. The learning will then be recorded on LearnNL and reported to the Data Governance Group on a quarterly basis along with other mandatory learning statistics. Original timescale: August 2021 Revised timescale: December 2022 Further revised timescale: March 2023 We acknowledge that delivery of this action has been delayed due to a turnover of staff with the Team. Whilst we are satisfied that appropriate steps have been taken to recruit an officer, it is imperative that this issue be resolved in line with the revised timescale. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 108 of 285
Page 109
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of People Resources Corporate Governance Principles A & B (February 2022) Risk: Where individuals are not fully aware of expected codes of conduct, ethical standards, and legal obligations they may not be in a position to adhere to or embed these consistently, or to identify and/or challenge unacceptable actions or behaviours of other staff where they occur. The Council may not be able to adequately demonstrate that it has effective arrangements to ensure elected members have access to training and development opportunities to equip them with the necessary skills and experience to perform their role effectively Recommendation: The Head of People and Organisational Development, in conjunction with relevant management, should: (1) ensure that all staff are periodically/regularly made aware/reminded of the revised Employee Code of Conduct and the need to adhere to it; (2) progress plans to introduce mandatory training on the revised Code and ensure that uptake for both the Induction and Code of Conduct training is being actively monitored; and (3) undertake the planned review of the elected members site within Learn NL and consider the scope for introducing mandatory or highly recommended courses and encouraging the uptake of relevant training courses Category: Medium (1) Complete - The Council's Code of Conduct has been re-communicated to all staff with all-user emails and campaigns on Connect after each revision. Regular/periodic reminders will be issued to all staff to ensure that they are reminded of the Code and the need to adhere to it. (2) The mandatory training on the Employee Code of Conduct is being progressed and this will be launched in 2023. (3) Complete - A review of the Elected Members site within LearnNL has been completed and a number of training modules designated as mandatory. Some training sessions are now recorded to enable Elected Members to access them later, as required. Original timescale: December 2022 Revised timescale: March 2023 Whilst we acknowledge that there has ben significant action taken to address the recommendations made, it is important that the mandatory training is finalised and launched in line with the proposed timescale. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 109 of 285
Page 110
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of People Resources Corporate Governance Principles A & B (February 2022) Risk: Without effective workforce planning there is a risk the Council may not have in place (or identified the actions it needs to progress to ensure it has in place) the staff and skills it needs to enable it to deliver services and achieve planned outcomes Recommendation: The Head of People and Organisational Development should ensure that the service workforce plans are completed and reported in accordance with the revised timescales to inform future workforce planning activity. Category: Medium Work was underway to complete workforce plans within each service. However, a request was submitted to, and approved by CMT, in December 2022 to extend the deadline for completion into 2023 thus allowing more time for consideration of any significant workforce/training impacts, including service cessation, which may arise from the Council’s 3-year budget setting process. A summary report is thereafter scheduled to be presented to the Policy and Strategy Committee in Cycle 2. Original timescale: June 2022 Revised timescale: December 2022 Further revised timescale: June 2023 We acknowledge that an extension to the proposed timescale was granted by CMT to allow for consideration of the impact of the Council’s 3-year budget on Services’ workforce plans. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date ESC: Testing of Selected Key Controls (March 2022) Risk: Failure to apply conditions of service appropriately could lead to inconsistency and/or errors in payments made to employees across the Council. Recommendation: The Head of People and Organisational Development should ensure that HR Business Partners, in conjunction with service management, review how non-core hours have been calculated for all relevant employees in receipt of a standing non-core hours payment each pay period to ensure that these are accurate and consistent with the employee’s work pattern/rota and Schedule A. Category: Medium There has, to date, been no change in the position. The service has identified that all relevant parties need to engage in a discussion to ensure that a consistent approach is agreed and thereafter implemented for the new financial year. Any changes to non-core hour procedures will need to be discussed and agreed with the Trade Unions. Original timescale: December 2022 Revised timescale: March 2023 We acknowledge that delay in implementing this action is due to competing priorities and the need to discuss any changes to the processes with the Trade Unions. Following discussion with service representatives, a clear commitment has been given to implement the recommendation by the agreed extension date and as such we have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 110 of 285
Page 111
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of People Resources Supporting Attendance (August 2022) Risk: There would be no record of the key absence issues and/ or any proposed actions to be taken to address these issues having been discussed Management may not be able to take appropriate action to address key issues. Without formal documented processes outlining how performance information should be prepared, staff may not be aware of how to calculate the performance measures which may result in inaccurate performance data being reported to key stakeholders. Recommendation: People and Organisation Development should ensure that monthly performance information on sickness absence is reported as standard across all Services at SMT meetings, any key issues in relation to absences are discussed with senior management at these meetings and that appropriate documentation is maintained to support the effective monitoring of any management actions identified and/or taken to address these issues. Category: Medium High-level monthly performance information on sickness absence is provided to HR Business Partner teams by Employee Relation for them to cascade this information to Services to enable discussion at the Services’ SMT meetings. A working group is being established to develop an action plan to ensure that there is a consistent approach to the cascading of information and that appropriate actions are developed by each Service. Original timescale: December 2022 Revised timescale: September 2023 We acknowledge that some action has been taken to address the first part of the recommendation and that the delay in implementing the second part of the recommendation is due to competing priorities and resource issues within the POD teams. As a result of the above, we have assessed the residual risk for this recommendation as ‘Low’ and would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Page 111 of 285
Page 112
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Supporting Attendance (August 2022) Risk: Without a formal review of the Policy it would be difficult to determine if the new policy is effective. Without a formal action plan, it would be difficult to monitor and track identified improvement actions and the progress and resultant impact of those actions. Management may not be able to take appropriate action to address issues identified. Management may lack assurance on the extent to which key expectations/requirements contained the policy are being complied with. Recommendation: People and Organisation Development should: (1) undertake a formal review of the effectiveness and impact of the new Supporting Attendance Policy; (2) capture any agreed improvement actions for sickness absence in a corporate action plan, progress against which is then tracked and monitored; and (3) undertake periodic compliance reviews on a sample of services and/or service areas and/or individual absence cases to determine the extent to which the revised Supporting Attendance policy is being implemented across the Council in line with corporate expectations. Category: Medium (1) Meetings have been held with the Trade Unions with a view to reviewing the Supporting Attendance Policy. The Service are awaiting a response from the Trade Unions on proposed minor changes to the supporting toolkits. (2) An action plan will be developed once discussions with the Trade Unions have concluded. (3) Periodic compliance reviews will form part of the action plan referred to at point (2) above. The extent of these reviews is still to be determined. Original timescale: December 2022 Revised timescale: September 2023 We acknowledge that delay in implementing this action is due to competing priorities and resource issues within the POD teams. In addition, points (2) and (3) cannot be progressed until discussions are concluded with the Trade Unions. Given that limited action has been taken to date to address the recommendation and improve the control environment we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of September 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow-up report. Page 112 of 285
Page 113
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Social Work Officer Tackling Poverty (November 2021) Risk: Without accurate baseline data, the Council may not be able to review progress and/or predict with any accuracy whether it is on track/can achieve the Scottish Government’s statutory poverty targets and/or whether the identified actions are reasonable and appropriate. Without clear and realistic short, medium and long- term targets, the tackling poverty programme may not be able to achieve its objectives. Without effective performance management framework and formal benefits realisation processes, management may not be able to assess whether the tackling poverty programme is effective and/or may not be able to take appropriate action to address areas of ‘under-performance’ and/or properly assess and/or compare impact of different actions/interventions. Recommendation: Management should: (1) establish what information requires to be collated in respect of measuring the Scottish Government’s poverty targets and identify and progress any actions necessary to ensure that the Council can generate and/or gather the relevant data within expected timescales; (2) develop and implement more robust performance monitoring and benefits realisation frameworks that will allow management to better measure performance against the Council’s Tackling Poverty objectives and the Scottish Government targets; and (3) use the revised performance monitoring and benefits realisation frameworks to facilitate more robust setting of short and medium-term targets and to assist in the evaluation of impacts of different actions. Category: High Performance in respect of some elements of the Tackling Poverty programme is being monitored (for example income maximisation), however the Service is still working to establish a performance framework. This has been hampered by the limited guidance and detail provided by the Scottish Government in respect of setting targets and baselines and this applies to all local authorities. A Data Sub-Group, consisting of officers from the Council, North Lanarkshire Council, Third Sector and other Community Planning Partners has recently been established as part of the governance arrangements for Tackling Poverty. This Sub-Group will be tasked with: • overseeing the data collection to support the Tackling Poverty Strategy and Local Child Poverty Action Report (LCPAR) • collating, and thereafter interpreting and analysing, the data and pinpointing the location of vulnerable residents to allow resources to be targeted appropriately; and • developing methods to measure the data/activity of the Tackling Poverty Strategy action plan, including the LCPAR, to allow the reporting of outcomes and tracking of targets set by the action plans and the Scottish Government targets for child poverty. Original timescale: November 2022 Revised timescale: November 2023 Whilst we acknowledge that, there has been some action taken in this area, it has been recognised by the Scottish Government that establishing a baseline and tracking progress on meeting the targets for child poverty is a complex matter and will take time to establish a model that will allow outcomes/measures to be more effectively monitored, measured and delivered. Given that significant action is required to improve the control environment and implement the recommendations, we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of November 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow-up report. Page 113 of 285
Page 114
Appendix 2 Residual risk rating definition Internal Audit assessment of residual risk from non-implementation High Non-implementation of actions has the potential to significantly undermine the relevant control environment. Medium Non-implementation of actions has the potential to impact upon the achievement of the control environment. Low Other issues which require management attention but which pose less significant or less immediate impacts to the control environment. Page 114 of 285
Page 115
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No ☐approval ☒noting Ref KA/ASP/Feb23 Date 16/02/23 Audit Scotland – Audit strategy letter 2022-23 From: Ken Adamson, Chief Officer - Audit and Risk E-mail: adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to provide members with information from Audit Scotland, the Council’s appointed external auditors, on the status of their 2022-23 audit planning. As outlined by Audit Scotland (at Appendix 1), Covid-19 has continued to impact on the completion of the 2021/22 audits with ongoing extensions to statutory deadlines. This, along with the changeover in the appointed auditor, has impacted on the timing of their planning work on the 2022/23 audits. Appendix 1 provides an overview of key aspects arising from the audit planning process including a timetable for key audit outputs. This includes finalisation of the 2022-23 Audit Plan which is expected to be completed by 31 March 2023. This document will be circulated to Panel members on receipt and tabled formally at the next subsequent Panel meeting. The external auditors will speak to the Panel about their plans at the meeting and highlight to members any issues arising from their planning process so far that they wish to bring to the Panel’s attention. Recommendations The Panel is requested to invite Audit Scotland to comment on the development and status of their planned audit approach to the 2022-23 audit of the Council. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements AGENDA ITEM 6 Page 115 of 285
Page 116
1. Background 1.1 The Accounts Commission appointed Audit Scotland as the Council’s external auditor for the five-year period from 2022-23. 1.2 Audit Scotland’s Code of Audit Practice and International Standards on Auditing stipulate that areas to be examined and expected outputs to be produced by the external auditors require to be outlined each year in their annual planning document. 2. Report Audit reviews completed in the period 2.1 As outlined by Audit Scotland (at Appendix 1), Covid-19 has continued to impact on the completion of the 2021/22 audits with ongoing extensions to statutory deadlines. This, along with the changeover in the appointed auditor, has impacted on the timing of their planning work on the 2022/23 audits. 2.2 Appendix 1 provides an overview of key aspects arising from the audit planning process to date including a timetable for key audit outputs. This includes finalisation of the 2022-23 Audit Plan which is now expected to be completed by 31 March 2023. 2.3 Panel members should note that good professional practice requires the external auditor to communicate and discuss planned external audit activity with the senior management of a body and with those elected members charged with governance matters, but it is for the external auditor alone to determine the work considered necessary by him/her to fulfil their responsibilities. 3. Measures of success 3.1 The external auditors report annually to the Council and the Controller of Audit on the results of their work. 4. Supporting documentation Appendix 1 Audit Scotland Audit Strategy Letter Ken Adamson, Chief Officer - Audit and Risk Page 116 of 285
Page 117
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☐ No ☒ 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ Page 117 of 285
Page 118
102 West Port Edinburgh EH3 9DN 8 Nelson Mandela Place Glasgow G2 1BT The Green House Beechwood Business Park North Inverness IV2 3BL T: 0131 625 1500 E: info@audit-scotland.gov.uk www.audit-scotland.gov.uk North Lanarkshire Council 03 February 2023 Update on the 2022/23 audit of North Lanarkshire Council 1. The purpose of this letter is to provide members with an update on the 2022/23 audit of North Lanarkshire Council (the Council). Covid-19 has continued to impact on the completion of the 2021/22 audits with ongoing extensions to statutory deadlines. This, along with the changeover in the appointed auditor, has impacted on the timing of our planning work on our 2022/23 audits. 2. Our planning work on the 2022/23 audit of the Council is at an early stage. Therefore, we are not able to present our Annual Audit Plan to the Audit and Scrutiny Panel (ASP) at the meeting on 16 February 2023. We have included this Audit Strategy Letter to update members on progress and highlight key audit matters. Following the conclusion of our audit planning procedures, we will issue a copy of the Annual Audit Plan to officers and members of the ASP by 31 March 2023. Risks 3. Our preliminary planning work has identified the following significant risks that requires specific audit considerations. • Risk of material misstatement due to management override of controls: International Standard on Auditing 240 (ISA 240) require that audits are planned to consider the risk of material misstatement in the financial statements caused by fraud, which is presumed to be a significant risk in any audit. This includes the risk of fraud due to the management override of controls to change the position disclosed in the financial statements. • Estimation in the valuation of land and buildings: The Council held land and buildings with a net book value of £2,860 million as at 31 March 2022. There is a significant degree of complexity and subjectivity in the valuation of land and buildings. Valuations are based on specialist and management assumptions and changes in these can result in material changes to valuations. Through our initial risk assessment we consider this to be an area of increased risk. Through our audit work we will pinpoint our risk to areas most susceptible to material misstatement and include this in our external audit plan. 4. ISA 240 presumes a risk of fraud in revenue recognition which is extended to expenditure by Practice Note 10. There is a risk that income or expenditure may be fraudulently misstated resulting in a material misstatement in the financial statements. We do not consider these to be significant risks for the Council as there are limited opportunities to manipulate the way income or expenditure are recognised in the financial statements and have therefore rebutted these risks. 5. Our Annual Audit Plan will include any further risks identified from our planning work and outline our response to all identified risks. Page 118 of 285
Page 119
Audit Fee 6. The proposed baseline audit fee for the 2022/23 audit is £607,796 (2021/22: £540,526). Our fees have increased in 2022/23 and this is a reflection of the current audit market and the rising costs in delivering high quality audit work. There are increased regulatory expectations and risks placed on audit and its quality, as well as a widening in the scope of work audit must cover. 7. In setting the fee for 2022/23 we have assumed that the Council has effective governance arrangements and will prepare comprehensive and accurate accounts for audit in line with the agreed timetable for the audit. The audit fee assumes there will be no major change in respect of the scope of the audit during the year and where our audit cannot proceed as planned, a supplementary fee may be levied. Exhibit 1 Audit fees (including VAT) Fee component Fees (£) External Auditor Remuneration 356,320 Contribution to Audit Scotland costs 13,510 Contribution to Performance and Best Value 118,120 Sectoral Cap Adjustment 115,660 2022/23 Audit fee 603,610 Audit of Charitable Trusts 4,186 Total 2022/23 fee 607,796 Source: Audit Scotland Audit Timetable 8. As outlined in paragraph 1, Covid-19 has continued to impact on the timings of our 2022/23 audit planning. We are working towards issuing the independent auditor’s report and Annual Audit Report by the statutory deadline of 30 September 2023. However, we acknowledge this may not be achievable due to ongoing pressures. We will maintain a pragmatic and flexible approach to the audit and will continue to have discussions with management and the Convener of the ASP around the progress of our work and any changes that may be required to the target dates outlined in Exhibit 1. Exhibit 1 Audit outputs Audit Output Target date Audit and Scrutiny Panel date Annual Audit Plan 31 March 2023 We will distribute our final audit plan to Audit Page 119 of 285
Page 120
and Scrutiny Panel by 31 March 2023 Independent Auditor's Report 30 September 2023 TBC Annual Audit Report 30 September 2023 TBC Source: Audit Scotland Best Value 9. Under the 2021 Code of Audit Practice, the audit of Best Value in councils is fully integrated within our annual audit work. 10. Best Value at North Lanarkshire Council will be assessed comprehensively over the period of the audit appointment and will include an annual evaluation of North Lanarkshire Council’s approach to demonstrating improvement in the effective use of resources and public performance reporting. We will also follow up findings reported previously in the Best Value Assurance Report in May 2019 to assess the pace and depth of improvement. 11. In addition to our annual work on Best Value we will conduct thematic reviews as directed by the Accounts Commission. In 2022/23 our focus will be on the effectiveness of council leadership in developing new local strategic priorities following the elections in May 2022. Our conclusions and judgements will be reported in a separate report to management and summarised in our Annual Audit Report. Independence and Objectivity 12. Auditors appointed by the Accounts Commission or Auditor General must comply with the Code of Audit Practice and relevant supporting guidance. When auditing the financial statements, auditors must also comply with professional standards issued by the Financial Reporting Council and those of the professional accountancy bodies. These standards impose stringent rules to ensure the independence and objectivity of auditors. Audit Scotland has robust arrangements in place to ensure compliance with these standards including an annual “fit and proper” declaration for all members of staff. The arrangements are overseen by the Executive Director of Innovation and Quality who serves as Audit Scotland’s Ethics Partner. 13. The engagement lead (i.e. appointed auditor) for the Council is John Boyd, Audit Director. Auditing and ethical standards require the engagement lead to communicate any relationships that may affect the independence and objectivity of audit staff. We are not aware of any such relationships pertaining to the audit of North Lanarkshire Council. John Boyd Audit Director Audit Scotland 4th Floor, South Suite The Athenaeum Building 8 Nelson Mandela Place Glasgow G2 1BT Page 120 of 285
Page 121
North Lanarkshire Council Report Audit and Scrutiny Panel ☐approval ☒noting Ref EK Date 26/01/23 Changes to the Code of Practice on Local Authority Accounting 2022/23 From Elaine Kemp, Chief Officer for Finance Email KempE@northlan.gov.uk Telephone 1. Background 1.1 The Council prepares its Annual Accounts in accordance with the Code of Practice on Local Authority Accounting in the United Kingdom (The Code) which sets out proper accounting practices. The Code, which is updated annually, is developed by CIPFA/LASAAC and based on International Financial Reporting Standards (IFRS). Executive Summary The Council’s Financial Statements are compiled in accordance with the Code of Practice on Local Authority Accounting in the United Kingdom (the Code) which is based on International Financial Reporting Standards (IFRS) and also the requirements of accounting and statutory guidance of central government. Further, the Code requires Appointed Auditors to pay due attention to quarterly Bulletins published by Audit Scotland Professional support. The purpose of this report is to highlight any significant changes to the Code or guidance in the Technical Bulletins which may impact on the accounting requirements and presentation of the Council’s 2022/23 Annual Accounts. The 2022/23 Unaudited Annual Accounts are due to be submitted to External Audit by 30 June 2023. Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Acknowledge the contents of the report; and (2) Recognise the actions being taken to ensure the Council submits a fully compliant set of Annual Accounts to External Audit The Plan for North Lanarkshire Priority Improve North Lanarkshire's resource base Ambition statement (25) Ensure intelligent use of data and information to support fully evidence based decision making and future planning AGENDA ITEM 7 Page 121 of 285
Page 122
1.2 Technical Bulletins are issued quarterly by Audit Scotland Professional Support which also provide guidance for Annual Accounts preparation. 2. Report 2.1 Review of the Code 2.1.1 Financial Solutions maintain an awareness of changes to accounting practices and assess the impact, if any, these changes may have on the Council’s procedures and reported financial position. 2.1.2 The process for review is carried out throughout the year and includes contributing to consultations on the development of future Codes of Practice; an assessment of the latest edition of the Code; review of the quarterly Audit Scotland Bulletins; and attending CIPFA run workshops to discuss and share best practice for the implementation of any changes adopted by the Code. This process will highlight where changes are required to our financial reporting. 2.1.3 Financial Solutions will work with all relevant parties within the Council to ensure that changes are fully assessed and ensure any necessary amendments to current working practices are implemented, in order to ensure the Council’s Financial Statements remain fully compliant with the Code. 2.1.4 As identified in the 2021/22 Annual Accounts, the 2022/23 code has introduced the following standards with an effective date of 1 April 2022 however there are no material changes expected from the introduction of these standards; • IFRS1 (First – time adoption) – amendments relates to foreign operations of acquired subsidiaries transforming to IFRS. • IAS 37 (Onerous contracts) – clarifies the intention of the standard • IAS 41 (Agriculture) expected to apply to local authorities in limited circumstances 2.2 Accounting Standards Issued but not Yet Adopted 2.2.1 Panel members may recall that the implementation of IFRS 16 (Leases) was originally expected to take effect from 1 April 2019 but for various reasons including the impact of COVID-19, the implementation date was initially deferred to financial year 2022/23. Following further consultation CIPFA/LASAAC have deferred mandatory adoption till 2023/24. 2.2.3 In preparation for the implementation of the standard in 2023/24, Financial Solutions continue to engage with all Services to progress a review of the current lease portfolio held, including operating and finances leases. This review will inform how those leases should be accounted for and identify any impact on the financial position. However, as previously advised the impact of adopting IFRS 16 Leases will be immaterial. 3. Land and Building Valuations 3.1 The accounting code contains an interpretation of IAS 16 which requires valuations of land and buildings to be in accordance with the Royal Institution of Chartered Surveyors (RICS) valuation standards. Valuations should be made at least every five years by a qualified valuer. However, these may be required more regularly if that frequency is unable to keep pace with changes in current value. This is extremely pertinent at present due to inflationary pressures within the Construction industry. The Council have Page 122 of 285
Page 123
appointed BNP Baribas to deliver its five-year rolling revaluation programme. In the 2021/22 Annual Accounts, Leisure Properties and Open Space were subject to a full valuation. In addition, appropriate indexation processes including the use of British Construction Information Service (BCIS) indices were undertaken to review the Council’s Housing and Education portfolios with subsequent revaluations incorporated in the 2021/22 Annual Accounts. 3.2 However, Audit Scotland’s Technical Bulletin 2022/3 (issued 20 September 2022), indicates that the use of indexation processes (including BCIS indices) does not constitute a valuation in accordance with the RICS standards and is not supported by the Accounting Code. However, they may provide a useful tool in demonstrating that the carrying amount of a category of asset in the Balance Sheet is materially different from its current value, and therefore identify that a formal valuation is necessary. 3.3 As a consequence, the Council has reviewed its five-year rolling valuation programme, and for the 2022/23 Annual Accounts, the Council’s Housing and Education estates will be subject to full valuations. This revised approach has been agreed with Audit Scotland. 3.4 The Council continues to liaise with BNP Paribas to ensure these valuations are carried out and the impact will be incorporated into the completion of the Council’s 2022/23 financial statements. 4. Measures of success The Council submits a fully compliant set of Annual Accounts to External Audit 5. Supporting documents No Supporting Documents Elaine Kemp, Chief Officer for Finance Page 123 of 285
Page 124
6. Impacts ( http://connect/report-template-guidance ) 6.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality-and-fairer- scotland-duty-impact-assessments Yes ☐ No ☐ 6.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Financial Solutions? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 6.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People and Organisational Development? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 6.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic Solutions? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 6.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 6.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Page 124 of 285
Page 125
Where the impact identifies a requirement for technology, has an assessment been carried out (or scheduled) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 6.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 6.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 6.9 Risk impact Is there a risk impact? Yes ☐ No ☒ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? 6.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☐ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 125 of 285
Page 126
Page 126 of 285
Page 127
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref: KA/ASP/2023/Feb Date 16/02/23 Risk Management update From Ken Adamson, Chief Officer - Audit & Risk E-mail adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The Council continues to operate within a complex and challenging environment reflected in corporate and service risks registers. This report provides the Panel with a brief update on key risk management developments since the most recent update report to the Panel in November 2022. As well as providing an update on the Council’s corporate risk register and highlighting a selection of the more significant issues which are of current focus from a risk perspective, the report also provides an update on recent changes in internal governance arrangements and the expected impacts on how risk issues are managed and monitored by senior management. The report also confirms that the planned review of the Council’s Risk Management Strategy is now complete and a report setting out proposed changes will be submitted for approval to the Policy and Strategy meeting due to be held on 16 March 2023. Strategically significant risks of current focus remain largely unchanged from the last update and include responding to the ongoing challenges presented by current inflationary pressures and future levels of funding for local government. The Council is also fully engaged with ongoing attempts to assess and respond effectively to the likely significant impacts of the National Care Service draft legislation and associated guidance on service users, staff and the Council more generally. How the Council is responding to this latter issue is the subject of a separate report to the Panel. Significant operational risks of current focus include work to ensure the resilience of the Council’s home care service in light of ongoing pressures and increased challenges over the winter period and ongoing work relating to staffing issues, including responding to industrial action and to recruitment and retention challenges. Finally, risk issues continue to be addressed in relation to a number of significant projects and programmes of work. Recommendations The Panel is asked to consider the contents of the report and to: (1) note the current residual scores for those risks agreed for inclusion in the corporate risk register for 2022-23 at Appendix 1; (2) note the references to other topical risk issues highlighted in Section 2; and (3) note the work ongoing to further strengthen and embed risk management arrangements. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements AGENDA ITEM 8 Page 127 of 285
Page 128
1. Background 1.1 The Council’s Risk Management Strategy requires that the corporate risk register is refreshed on an annual basis; led by the Corporate Risk Team, working with the Risk Management Corporate Working Group (RMCWG) on behalf of, and in consultation with, the Corporate Management Team (CMT). In addition, each Service is required to maintain its own risk register in respect of the operational service risks within their areas of responsibility. CMT previously approved the 2022-23 corporate risk register as outlined in the table at Appendix 1. 1.2 It is widely recognised that the environment within which the Council operates and provides services is dynamic, and corporate and service risk registers must continually evolve to keep pace with and accurately reflect, the ongoing challenges facing the Council. 1.3 The current Risk Management Strategy sets out required frequencies for the ongoing review by management of both Corporate and Service risks. 2. Report 2.1 The corporate risk register approved for 2022-23 is at Appendix 1. Risks contained within the register have been subject to ongoing monitoring and review throughout the year, with regular risk reporting to CMT and the Panel both on the overall register, and with detail on individual risks being reported by relevant Risk Leads. 2.2 The definition of a corporate risk is ‘those risks which can impact the Council in achieving its priorities and stated objectives and/or are more strategic in nature and require corporate oversight. For example, such risks may have the potential to impact many Services, and/or can impact significantly on the Council in terms of financial costs and reputational damage. The Corporate Risk Register will reflect an amalgamated position of Service-level risks and may also include significant Service-level risks which have been escalated for attention at a strategic level.’ Update on the 2022-23 corporate risk register 2.3 Since the last update to the Panel, there have been no substantive changes to the risks contained within the corporate risk register or the scores of those risks since the report to the Panel in November 2022. Additional issues currently being considered for possible future inclusion in the corporate risk register include Black Start/Power Resilience, Home Support service delivery and Home to School Transport. 2.4 Currently all bar three risks are classified as ‘live’ with completed risk documentation; the two risks classified as ‘draft’ where relevant documentation is currently being finalised are ‘Target Operating Model’ and ‘Improving Educational Outcomes’. Both risks are due to be finalised and to be able to be reported as live before the end of the financial year. The remaining risk, ‘Impact of National Care Service proposals’ is documented but remains unscored and actively under review in light of ongoing uncertainty and developments as the relevant legislative process proceeds. 2.5 Members will note at Appendix 1, that the overall corporate risk profile has changed with a notable increase in the number of risks which now sit within the ‘High’ category for residual risk rating. This is to be expected because of the complex and challenging environment in which the Council is operating, and the changing risk profile itself should be a key consideration in the planning and decision-making activities of the Council. 2.6 Generally corporate risks are being reviewed within reasonable timescales, however there can be occasions where they fall overdue and Risk Leads have been reminded of the need to contact the Corporate Risk Team promptly when e-mail reminders are received to advise that a risk is due its review. The Corporate Risk team will then assist in the facilitation and co-ordination of those reviews, and timely consideration will allow risk review frequencies to be maintained aligned to risk rating, and avoid risks becoming out of date, ensuring risks are current and reflective of the most current position. Page 128 of 285
Page 129
2.7 It had previously been proposed, with effect from this committee cycle, to supplement the Corporate/Strategic risk register information included in this report with, for the first time, a summary of key Service risks from service risk registers. However, work to do so has identified a lack of consensus on how service risks might be selected for reporting and a degree of inconsistency in the quality and content of Service risk registers. Consequently, key Service risks are not included in this report and the Risk Management Corporate Working Group continues to explore with Service Risk Champions how best to identify which Service risks will be reported to both CMT and the Panel in future risk management update reports. As part of this process, Services have also been asked to review and ensure that risk registers are comprehensive, of appropriate quality and up to date (and that this is reported to, and confirmed by, Service Management Teams as part of their formal role as outlined below). Governance arrangements - oversight of risk registers 2.8 Regular consideration by senior management of Service risks and Service risk registers is expected, but how such consideration is undertaken has previously not been prescribed as it was considered appropriate to ensure that how risks are considered is aligned to and integrated within each Service areas own distinct management arrangements. All Services have been encouraged however to regularly review risk registers for completeness and to ensure that Service risks are reported regularly to Service management teams. 2.9 Recent changes to internal governance arrangements at senior management level within the Council have, however, provided an opportunity to strengthen and further embed risk management and specific responsibilities in respect of risk have been included in relevant terms of reference. The Corporate Management Team (CMT) will retain responsibility for oversight of corporate risks and ensuring that these are being managed in accordance with the approved Risk Management Strategy. Service Management Team (SMT) meetings are now formally expected to regularly review and monitor service risk registers ensuring that registers are complete and up-to-date, and that new and emerging risks are identified, assessed and managed effectively and that service risk registers are used to support management discussions and inform decision-making. 2.10 The corporate risk team will be developing formal measures to review and report on compliance in this aspect of the Council’s risk arrangements during 2023-24. The Corporate Risk team will continue to work with Corporate Risk Leads and Service Risk Champions to ensure that risks registers continue to capture and reflect the current key challenges facing the organisation. Strategic and operational risks of current focus 2.11 Strategically significant risks of current focus include responding to the ongoing challenges presented by current inflationary pressures and increased uncertainty over future levels of funding for local government in light of wider developments in UK and Scottish public sector finances. These issues have been the subject of recent reports to the Policy and Strategy Committee. 2.12 The Council is also fully engaged with wider policy developments which have the potential to impact significantly on the Council and its corporate ambitions. This includes ongoing attempts to understand, assess and respond effectively to the likely significant impacts on service users, staff and the Council more generally of the National Care Service draft legislation and associated guidance. Responding to the outcomes arising from the current consultation by the Scottish Government on the future of education in Scotland is also likely to be of increasing focus. National developments in both areas will continue to be kept under review and actioned as required, with updates provided to relevant Committees at key development points. Page 129 of 285
Page 130
2.13 The National Care Service (Scotland) Bill proposals allows Scottish Ministers to transfer social care responsibility from local authorities to a new national service. Policy and Strategy Committee were provided with a report in September 2022 which provided an update on the then current position of the Bill. 2.14 In view of the significant and wide-ranging impact which the NCS proposals are likely to have on the Council and the future delivery of support to individuals and families, the Policy and Strategy Committee (in September 2022) approved the establishment of a Member Officer Group to guide the council’s future engagement with the Bill process, support planning and management of the potential impacts for the council, and ensure the delivery of public services remain steadfast during what is expected to be a significant period of change. 2.15 The Bill also has significant implications for the council in terms of the proposed transfer on existing functions and staffing, the wider impact on service delivery and delivery of The Plan for North Lanarkshire, and on the future functions of the council. A separate report from management outlines how the Council plans to ensure the ongoing identification and effective management of associated risks and provide oversight in relation to the operational impact on future council functions. 2.16 Operationally, the Council continues to manage a wide range of risks associated with day-to-day service delivery and progressing projects and programmes of work. Significant operational risks of current focus currently include work underway to ensure the resilience of the Council’s home care service in light of ongoing pressures and the increased challenges facing the Service over the winter period and ongoing work around responding in both the short and longer-term to current and future challenges around the provision of school transport. Staffing issues, including industrial action and responding to recruitment and retention challenges, have also featured prominently in recent months. Finally, risk issues continue to be addressed in relation to a number of significant projects and programmes of work including the Enterprise Contract, which was the subject of a report to Policy and Strategy in December. Review and updating of the Risk Management Strategy 2.17 The planned review of the existing Corporate Risk Management Strategy has now been undertaken, with the proposed revised strategy being reported to the Policy and Strategy Committee for approval in March 2023. Full details of the planned changes will be included in that report, but the Panel should note that the proposed changes to the strategy are, overall, relatively minor and are designed to deliver incremental improvements to what is assessed as an already sound strategic approach. 2.18 It is being proposed as part of the revised Corporate Risk Management Strategy that there will be some focus on ‘fine-tuning' the risk scoring approach to ensure this provides greater differentiation in ratings (and rationale for those ratings), that will enable CMT and elected members to better distinguish areas that require more focus particularly within the ‘High’ residual risk category. More details on the impact of this change (if approved) will be provided in the next update to the Panel. 3. Measures of success 3.1 The corporate risk management team will continue to report quarterly to BMT and CMT and the Audit and Scrutiny Panel providing an overview of key developments in risk management and updating on progress in respect of planned improvements to the Council’s risk management arrangements. Page 130 of 285
Page 131
3.2 The adequacy and effectiveness of the Council’s risk management arrangements will be independently and regularly reviewed by Internal Audit, who will report directly on the results of that work to the Audit and Scrutiny Panel. 3.3 Effective risk management arrangements assist the Council in achieving planned outcomes and/or help the Council mitigate the impacts of adverse events. 4. Supporting documentation Appendix 1: 2022-23 corporate risk register Appendix 2: Risk scoring matrix and descriptors Ken Adamson Chief Officer - Audit and Risk Page 131 of 285
Page 132
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective risk management arrangements including the identification, assessment, management and oversight of relevant risks will increase the likelihood of the Council achieving its ambitions and plans by making it more likely that the Council will be able to effectively mitigate potential threats to planned outcomes. It also contributes to effective management of risks relating to all service and operational areas. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ Page 132 of 285
Page 133
Appendix 1: 2022-23 corporate risk register CORPORATE RISKS (Operational) Likelihood Impact Rating Evaluation 1. Information Governance – Data Migration 5 5 25 High 2. Information Governance & Information Security 5 4 20 High 3. ICT operational capability 4 4 16 High 4. Public Protection 4 4 16 High 5. Human Resources 4 4 16 High 6. Governance Leadership & Decision Making 4 4 16 High 7. Supply Chain Risk 4 4 16 High 8. Scottish Child Abuse Inquiry 4 4 16 High 9. Health and Safety 5 3 15 High 10. Business continuity planning 5 3 15 High 11. Terrorism 3 5 15 High 12. Procurement risk 3 4 12 Medium 13. Resilience planning 2 5 10 Medium 14. Serious organised crime, fraud and corruption 3 3 9 Medium CORPORATE RISKS (Strategic) Likelihood Impact Rating Proximity 15. Tackling Poverty 5 4 20 High 16. Climate Change 4 4 16 High 17. Implementation of Economic Regeneration Development Plan 3 5 15 High 18. Financial Sustainability 3 5 15 High 19. Enterprise Project 3 4 12 Medium 20. Managing strategic change 3 4 12 Medium 21. Digital and IT strategy 4 3 12 Medium 22. Engagement and consultation 3 3 9 Medium 23. Target Operating Model – (Ensuring resources (workforce, digital and assets) and service delivery are fully aligned to support the successful implementation of the Council’s future operating model. To be confirmed To be confirmed To be confirmed To be confirmed 24. Impact of National Care Service To be confirmed To be confirmed To be confirmed To be confirmed 25. Improving Educational Outcomes To be confirmed To be confirmed To be confirmed To be confirmed Page 133 of 285
Page 134
APPENDIX 2: LIKELIHOOD / IMPACT DESCRIPTORS AND RISK MATRIX Likelihood Descriptors: Score Probability of occurrence Description 5 Over 90% Almost certain to occur within 12 months 4 61-90% Likely to occur within 12 months 3 31-60% Possible that it may occur within 12 months 2 11 - 30% Unlikely to occur within 12 months 1 10% or less Rare that it would occur within 12 months Impact Descriptors: Score Description of impact On Service Objectives Financial On people On time to recover On reputation 5 Catastrophic Unable to function, inability to fulfil obligations Severe financial loss (over 25% of budget) Death Serious – more than 2 years to recover to pre- event position Highly damaging, severe loss of public confidence 4 Major Significant impact on service objectives Major financial loss (between 10% and 25% of budget) Extensive injury, major permanent harm Major – between 1 and 2 years to recover to pre-event position Major adverse publicity, major loss of confidence 3 Moderate Moderate impact on service objectives Significant financial loss (between 2.5% and 10% of budget) Medical treatment required, semi- permanent harm up to one year Considerable – between 6 months to 1 year to recover to pre- event position Some adverse publicity, legal implications 2 Minor Minor impact on service objectives Moderate financial loss (between 1% and 2.5% of budget) First aid treatment, non- permanent harm up to 1 month Some – 2 to 6 months to recover to pre-event position Short-term public embarrassment and no damage to reputation 1 Insignificant Minimal impact, no service disruption Minimal loss (up to 1% of budget) No obvious harm/injury Minimal – up to 2 months to recover No interest to the media, internal only. Risk Matrix: Likelihood 5 - Almost certain 5 10 15 20 25 4 - Likely 4 8 12 16 20 3 - Possible 3 6 9 12 15 2 - Unlikely 2 4 6 8 10 1 - Rare 1 2 3 4 5 1 - Insignificant 2 - Minor 3 - Moderate 4 - Major 5 - Catastrophic Impact Risk Rating Insignificant 1-3 Low 4-6 Medium 8-12 High 15-25 Page 134 of 285
Page 135
Page 135 of 285
Page 136
Page 136 of 285
Page 137
North Lanarkshire Council Report Does this report require to be approved? ☐ Yes ☒ No Ref AG/MF Date 16/02/23 From Alison Gordon, Chief Social Work Officer E-mail gordonal@northlan.gov.uk Telephone 01698 332001 Executive Summary To support the Council in mitigating risks and uncertainty, the Council operates risk management arrangements which identify, evaluate, manage, and control a range of key corporate risks. All risks identified and agreed as meriting inclusion in the corporate risk register are subject to regular monitoring and review by relevant senior management and periodic review/consideration of individual risks by both the CMT and the Audit and Scrutiny Panel (ASP) in line with the Council’s Risk Management Strategy and their respective governance roles. This report focuses on a new risk within the Council’s Corporate Risk Register relating to proposals for a National Care Service as set out within the National Care Service (Scotland) Bill introduced to the Scottish Parliament on the 21st June 2022. The report provides an overview of the current risk environment as set out and assessed within the draft Deep Dive document attached at Appendix 1. Members should note that this document is in development with further work required to full analyse risk impacts and to reflect and develop mitigating actions and controls which may be exercised by the Council. This will form part of the agenda for the newly established NCS Member Officer Group. The level of uncertainty with respect both to the Bill process and lack of detail within the legislation, which is presented as a framework Bill, alongside the scale and complexity of the reorganisation likely to arise from the proposals, is reflected in an indicative inherent and residual risk scoring of 25. Recommendations The Panel is asked to consider the contents of the report and to: (1) Note the draft deep-dive document (at Appendix 1) and indicative risk scoring which reflects both the very high level of uncertainty and potentially high and wide-ranging impacts for the council associated with this risk. (2) Note that this risk documentation remains in development and will be regularly reviewed in keeping with both the high indicative scoring and the fluid risk environment. (3) Note that core structures for the management and mitigation of this risk have been enhanced through the establishment of the NCS Member Officer Group which will meet for the first time in February 2023. Audit and Scrutiny Panel National Care Service Proposals AGENDA ITEM 9 Page 137 of 285
Page 138
The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements 1. Background 1.1 CMT has previously approved the corporate risk register for 2022-23. 1.2 The definition of a corporate risk is ‘those risks which can impact the Council in achieving its priorities and stated objectives or are more strategic in nature and require corporate oversight. For example, such risks may have the potential to impact many Services, and/or can impact significantly on the Council in terms of financial costs and reputational damage. The Corporate Risk Register will reflect an amalgamated position of Service-level risks and may also include significant Service-level risks which have been escalated for attention at a strategic level.’ 1.3 Risks contained within the register are subject to ongoing monitoring and review throughout the year, with regular risk reporting to CMT and Audit & Scrutiny Panel both on the overall register, and with detail on individual risks being reported by relevant Risk Leads. 2. Report 2.1 ‘Proposals for the National Care Service’ is a new risk incorporated within the Corporate Risk Register for 2022/23. 2.2 The Council response to the consultation on proposals was approved by Policy and Strategy Committee in October 2021. Similarly, the Council also submitted a response to the Call for Views on the published Bill, with this approved by the Policy and Strategy Committee in September 2022. 2.3 The legislation supporting the establishment of a National Care Service (NCS) was introduced to the Scottish Parliament on the 21st June 2022 with a view to facilitating large scale structural reform and to address the recommendations of the Independent Review of Adult Social Care (the Feeley Review) which reported in February 2021. The Bill sets out provisions which would enable the transfer of responsibility for social work and social care functions from local authorities to local care boards reporting to Scottish Ministers, alongside this allowing for the transfer of staff, property and financial resource from local authorities to the NCS. The Bill is essentially a ‘framework’ Bill, and it is proposed that much of the detail of the new NCS will be developed within a process of ‘co-design’ and effectively shaped by secondary legislation/regulation. There is an ambitious timescale to establish the NCS by the end of this parliamentary term. Whilst not in scope of the Independent Review of Adult Social Care, the Bill allows for the incorporation of Justice and Children and Family Social Work Services within the NCS however further to the initial NCS consultation planned ‘evidence reviews’ and further public consultation will take place on this. These processes will run in parallel with other preparatory work and the parliamentary process with the Scottish Government due to decide on the position of Children’s and Justice Services in early 2024. In the interim four parliamentary committees have heard evidence at Stage 1 of the Bill process, with the Finance Committee first to publish its report in December 2022. This raised concerns on the adequacy of the accompanying financial memorandum and impact on scrutiny of the reliance on secondary legislation. Page 138 of 285
Page 139
2.4 Initial scoping by council officers has identified that depending on the employment model ultimately adopted up to 2,395 staff currently employed by the council could be transferred via TUPE to the new NCS/local care board should all social work services and associated support functions be incorporated. Similarly, it is estimated that approximately 24% of the council’s revenue budget could transfer to the new organisation. 2.5 Proposals for the NCS equate to the most significant public sector reform within Scotland in many years. In this context the draft Deep Dive has identified three principal categories of risk: • Risks arising from implementation processes. • Risks which impact on operations on an ongoing basis. • Risks which have strategic impact. 2.6 Risks arising from implementation processes: These include organisational change capacity and the quality of planning being stretched both by the complexities and uncertainties within the process and the impact on workforce planning at a time when there are significant existing workforce pressures. Potential centralisation of functions may also cut across existing contracts and supplier relationships due to continue beyond the proposed implementation timescale. In addition there is no certainty around change management liabilities associated with any staff transfer and any resultant redundancy issues. 2.7 Risks which impact on operations on an ongoing basis: These include ongoing impact associated with potential disruption in improvement activity arising from the change process as well as loss of co-ordination in planning and dilution of joint-working arrangements between teams and services transferred to the NCS and wider council services. This may impact across a range of areas but in particular on the current integrated operational model which has been developed within Education and Families. Other risks operationally included the loss of economies of scale within areas including support services as well as loss of local focus or coherence in community engagement within the new organisation impacting on the service provided to individuals and communities. There also remain uncertainties around how specific statutory functions will be exercised within new arrangements including with the respect to the impact on the council’s overarching responsibilities for public protection, the employment of MHOs and the role currently undertaken by the Chief Social Work Officer and whether there will be a loss of the checks and balances within the current system. 2.8 Risks which have strategic impact: In addition to the areas outlined above there are risks to the delivery of the Plan for North Lanarkshire and its associated ambitions through both through the governance changes associated with the proposals and their potential impact on the co- ordination of local planning and existing partnership structures. 2.9 In view of the level of uncertainty which remains around the NCS proposals and their significance not only for services and functions which may transfer but to wider council operations the Corporate Management Team has recognised the need for a range of Chief Officers to support planning in this area. In late September 2022 Policy and Strategy Committee also approved the establishment of a Member Officer Group to guide future engagement with the Bill process and to support future planning with respect to the NCS. This group will meet for the first time in early February 2023. This will support the ongoing risk management and review of this risk in line with the Corporate Risk Strategy with future reporting to Audit and Scrutiny Panel at agreed intervals. Page 139 of 285
Page 140
3. Measures of success 3.1 CMT and ASP are content with, and have an appropriate understanding of, the key risks facing the Council and how these are being managed. 3.2 The corporate risk management team will continue to report quarterly to CMT and the ASP providing an overview of key developments in risk management and updating on progress in respect of planned improvements to the Council’s risk management arrangements. 3.3 The adequacy and effectiveness of the Council’s risk management arrangements will be independently and regularly reviewed by Internal Audit, who will report directly on the results of that work to the ASP. 3.4 Effective risk management arrangements assist the Council in achieving planned outcomes and/or help the Council mitigate the impacts of adverse events. 4. Supporting documentation 4.1 Appendix 1 – Deep Dive Report - Proposal to Create a National Care Service. Alison Gordon Chief Social Work Officer Page 140 of 285
Page 141
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Page 141 of 285
Page 142
Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Included in the corporate risk register. Effective risk management arrangements including the identification, assessment, management and oversight of relevant risks will increase the likelihood of the Council achieving its ambitions and plans by more effectively mitigating potential threats to planned outcomes. It also contributes to effective management of risks relating to all service and operational areas 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 142 of 285
Page 143
Jan 13, 2023, 3:28 PM Appendix 1 Deep Dive Report RIS0000604 Risk Title Proposals to create a National Care Service Owner Alison Gordon Risk Context The National Care Service (Scotland) Bill sets out provisions to enable Ministers to transfer certain social care and social work functions from local authorities to a national service. The Bill provides wide-ranging powers to Scottish Ministers for the transfer of local authority social work and social care functions, budgets, staff, property and liabilities to the National Care Service accountable directly to Scottish Ministers or via care boards. The Bill also includes the power to transfer Children’s and Justice Services to a National Care Service through further regulation, but this will be the subject of further public consultation, stakeholder engagement and evidence review prior to a final decision on this being made. Currently, there remains considerable uncertainty over how this policy will be progressed. Neither the Bill nor the accompanying documents currently provide significant detail on the move from the current arrangements to the proposed operating model (including the proposed Care Boards). It is not yet known which employer model will be chosen for staff in scope for NCS. If NCS is the employer, then staff will be expected to TUPE across with the potential transfer of 2,395 FTE Council staff and over £272 million of revenue funding. If a commissioning model is chosen (where the Council remains the employer) then NCS is likely to become responsible for procuring services, training, standards and workforce planning. In budgetary terms, the transfer of the functions (if including Children’s and Justice Services) would account for approximately 24% of the Council’s current revenue budget. The detailed work and timing associated with any Programme of Work requiring to be progressed by the Council to facilitate the implementation of the National Care Service proposals remains unclear but is likely to be significant and require considerable lead time and efforts to ensure a seamless and stable transition and to ensure no detrimental impacts on service users and service delivery. Work is also required to clarify and document the likely wider impacts on the Council of the NCS proposals including planned actions which may now be not required and/or may require to be paused or rescheduled due to the creation of the NCS. The impact of transfer on the council’s short and medium-term financial plans and financial strategy will also require to be worked through, although to date the processes to be used for identifying and agreeing budgets in scope for transfer remains uncertain. The Council will continue to work, through COSLA, to engage with the Scottish Government to obtain more detail of what the NCS proposals mean for local authorities to understand potential impacts and their likely timing more fully. Risk Description There is a risk that the introduction of a National Care Service will have multiple detrimental impacts on service users, staff, service delivery and the Council. As proposals for the National Care Service are still evolving there is currently a high level of ambiguity and uncertainty over much of the detail creating difficulty in being able to precisely identify the resulting risks. As such, this initial risk assessment must be considered as being volatile and can be expected to change substantially as more details of the proposals are advised. These risks can be categorised as follows: Organisation Structure North Lanarkshire Corporate Page 143 of 285
Page 144
Jan 13, 2023, 3:28 PM a) Risks arising from implementation processes • Lack of clarity, ambiguity in proposals and complex issues not addressed with continual changes resulting in increased effort and additional unplanned resources required; • Organisational capacity likely to be stretched across implementation activity at a time when Services are already dealing with significant demands including staffing and financial pressures and the ongoing impacts from the pandemic and cost of living crisis • Potentially very short time to implement resulting in increased risks around poor planning/project management arrangements; • Increased uncertainty may exacerbate existing workforce planning challenges; • Unclear if NCS/CHSCB financial information will be managed centrally or locally and via which management information systems. There are significant information governance risks, including increased risks of possible data breaches, associated with significant volumes of sensitive data being transferred to a new external agency e.g., transfer and storage of sensitive MAPPA data. Any such breaches could have serious physical safety and other consequences on those whose data is released and there is the possible of high level of fines and restrictions by the regulator. • Although there remains considerable uncertainty, there is an indication that the NCS will look to centralise supplier relationships; the Council currently has several contracts with external partners and providers which are scheduled to run several years into the future but there is a lack of clarity on who would be responsible for potential penalty or break clauses should contracts be terminated early and the value of break clauses; • Previous national re-structures have resulted in voluntary or compulsory redundancies for incumbent staff. If this scenario is repeated with the creation of the NCS/CHSCB it is unclear who will be responsible for meeting these redundancy costs as well as any ongoing pension costs. b) Risks which impact operations on an ongoing basis • Reduced co-ordination between teams/functions transferred out of the Council and those remaining within the Council where current service delivery or activity involves staff from both transferred and retained teams; • Loss of inter-connected working between NCS and Council services that impact on the wider health and wellbeing agenda (i.e., housing, employability support, education etc.) which are not included in NCS plans; • Some of the budget of central overhead functions, e.g. Finance, Payroll, Business Solutions and People and Organisational Development will likely transfer to NCS but the remaining costs will require to split across fewer/smaller services resulting in loss of economies of scale. A further resultant issue is whether remaining central functions? services are cost-effective or require to be reviewed and/or delivered in a different manner. This could create additional projects/workloads; • A range of support services e.g., fleet, transport, catering and cleaning currently support the delivery of functions to be transferred to the NCS but have, to date, not been considered in NCS planning. Potential impacts include financial risks to the Council and potential disruption in support services impacting on end users of NCS; • Reduction in resources available to deliver on wider community engagement activities including those associated with the Community Empowerment Act and the legislative framework for local improvements; • Reduced budgets and reduced flexibility in the use of budgets; • Lack of clarity in which organisation crucial role of Mental Health Officer will be based; • Complaint handling transferred to NCS risks adding an additional layer of bureaucracy with complaints taking longer to resolve as will any resulting improvements and an overall detriment in service; Page 144 of 285
Page 145
Jan 13, 2023, 3:28 PM • A lack of clarity over roles and responsibilities and the ability of NLC to adhere with Chief Social Work Officer responsibilities if Chief Social Work Officer post is within NCS; • Lack of local focus may impact service users who are service users of both NCS and NLC and they could experience a lower level or disjointed service; • Different information systems for NLC and NCS creates difficulties and risks on sharing information and impacts on identifying and delivering services to users; • If Justice Social Work transferred, the proposed arrangements may be too large and centralised and unable to reflect local requirements; • Unclear if enforcement powers would be with the regulator and whether they undertake inspections of care providers or will this role will remain with council; • If TUPE transfer is undertaken this will bring significant workload for remaining staff who are already stretched across a range of activities and projects; • The level of uncertainty created and the scale and timing of any proposed implementation will impact staff morale and engagement at a time when all resources are needed to be working at full capacity to deliver services without any disruptions and/or drop in standards; • Transfers to this new team could further exacerbate problems in delivering essential services which remain with NLC c) Risks which have a strategic impact on NLC • Likely to become more difficult or impossible to implement parts of the existing Plan for NL some of which will no longer be fit for purpose and/or will require to be revisited; • NCS plans and activities may not align with, or adequately support, the Council’s wider ambitions for NL; • Remaining structures may no longer be fit for purpose and potential for substantial disruption especially of some remaining E&F functions.; • Increased risks around partnership working with a new body accountable to Scottish Ministers; • Increased risks that resources are diverted from delivering existing national strategies and objectives. This includes ‘The Promise’ that our public services will work for, and with children, young people, and their families; • Greater difficulty in achieving objectives in relation to Community Empowerment Act and to Deliver for Communities and its ability to deliver against the key ambitions and priorities outlined in the Plan for North Lanarkshire and associated Programmes of Work; • Governance of services provided to residents in North Lanarkshire could be centralised within NCS which may result in lack or loss of local focus; and • Human Rights and Equality Issues arise, new commitments do not progress. Corporate Priorities • Improve the health and wellbeing of our communities Page 145 of 285
Page 146
Jan 13, 2023, 3:28 PM Inherent Assessment ASM0003133 Likelihood - 5 Impact - 5 High - 25 Likelihood Reason There currently remains a high degree of uncertainty over much of the detail relating to the creation of a National Care Service. Without detailed planning, the proposals could result in significant disruption to service users and service delivery, have detrimental impacts on staff and on the Council’s financial planning arrangements. There are also real risks surrounding the impact of the proposals on the ability of the Council to progress key areas of The Plan for North Lanarkshire. The high degree of uncertainty means that the Council cannot, at this stage, develop the necessary detailed plans or progress actions to mitigate many of the identified risks. Impact Reason The proposal to create a National Care Service presents considerable operational and strategic risks to the Council which if not properly addressed have the potential to significantly impact on current and future service delivery arrangements, on staff and the Council’s financial sustainability and on the Council’s ability to deliver against a wide range of corporate ambitions. Residual Assessment ASM0003133 Likelihood - 5 Impact - 5 High - 25 Likelihood Reason Residual Likelihood TBA. This is currently rationale and rating for Inherent. There currently remains a high degree of uncertainty over much of the detail relating to the creation of a National Care Service. Without detailed planning, the proposals could result in significant disruption to service users and service delivery, have detrimental impacts on staff and on the Council’s financial planning arrangements. There are also real risks surrounding the impact of the proposals on the ability of the Council to progress key areas of The Plan for North Lanarkshire. The high degree of uncertainty means that the Council cannot, at this stage, develop the necessary detailed plans or progress actions to mitigate many of the identified risks. Impact Reason Residual Rating TBA. This is currently rationale and rating for Inherent. The proposal to create a National Care Service presents considerable operational and strategic risks to the Council which if not properly addressed have the potential to significantly impact on current and future service delivery arrangements, on staff and the Council’s financial sustainability and on the Council’s ability to deliver against a wide range of corporate ambitions. Page 146 of 285
Page 147
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref KH/SL Date 16/02/23 New approach to auditing Best Value From Katrina Hassell, Chief Officer (Business and Digital) E-mail HassellK@northlan.gov.uk Telephone 07903 096 121 Executive Summary Members of the Audit and Scrutiny Panel are well versed in the Best Value duty which requires the council to ensure arrangements are in place to secure continuous improvement in performance for all the functions and activities undertaken to deliver services and improve outcomes. Since implementation of the duty, all local authorities in Scotland have been subject to ongoing national and local audit processes to ensure they continue to be able to demonstrate Best Value in practice. The latest national audit programme concluded in 2022 and a new approach is being rolled out from 2022/23 onwards in line with the five-year external audit appointments. The new approach moves to more frequent arrangements that integrate the process for auditing Best Value within each individual council’s external auditors Annual Audit Report (AAR) activity. This means that the council will, in effect, undergo an annual assessment in terms of particular aspects of Best Value in order to provide the Accounts Commission with the relevant assurances in terms of the performance of the council and the quality of services to the public. Although the specific details of the external auditors annual audit plan have still to be finalised by the incoming Audit Scotland audit team, information from the Accounts Commission’s workplan to 2024 along with presentations made by Audit Scotland in a national forum in November 2022 provide a broad overview in this respect. This report provides members of the Audit and Scrutiny Panel with an overview of the new national approach to auditing Best Value, based on information available at the current time. While Best Value has a focus on good governance and managing resources effectively, in practice it is about so much more - it’s about improving the functions and activities the council undertakes to deliver the best possible outcomes and services that improve the everyday lives of local people. Elected Members therefore have a key role to play to ensure the council continues to demonstrate Best Value in practice and, as members of the Audit and Scrutiny Panel are charged with oversight of the governance of the council, this report aims to help Panel members fulfil that role. AGENDA ITEM 10 Page 147 of 285
Page 148
1. Background 1.1 Members of the Audit and Scrutiny Panel will recall the report in November 2022 which presented the updated Strategic Self Evaluation Framework and rolling Review Programme up to 2023. This Framework provides the council with a structured programme of self-evaluation which underpins the Best Value duty to secure continuous improvement in performance for all the functions and activities undertaken to deliver services and improve outcomes. 1.2 As the council is required to demonstrate Best Value in practice - and is regularly audited by both internal and external auditors on many aspects of Best Value - the assessment criteria within the Strategic Self-Evaluation Framework aligns to the seven Best Value themes (noted below) and the national guidance which was updated in March 2020: 1. Vision and leadership. 2. Governance and accountability. 3. Effective use of resources. 4. Partnerships and collaborative working. 5. Working with communities. 6. Sustainability. 7. Fairness and equality. 1.3 As the Panel will recall, the council was in year three of the five-year national Best Value audit programme which concluded with publication of a positive Best Value Assurance Report (BVAR) for North Lanarkshire in May 2019. Due to the impact of the pandemic, this national programme was extended from five to six years and all 32 councils have now undergone the BVAR review process. 1.4 A new national approach to auditing Best Value now comes into effect as part of the external auditor appointments for the five-year term from 2022/23. Following these appointments Audit Scotland were retained as the council’s external auditor for the next five-year term (from December 2022). The new approach will not see a repeat of the national BVAR audit process for all 32 councils, rather the focus moves to more frequent and ongoing arrangements that integrate the process for auditing Best Value within each individual council’s external auditors Annual Audit Report (AAR) activity. 1.5 This means that the council will, in effect, undergo an annual assessment in terms of particular aspects of Best Value in order to provide the Accounts Commission - the Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Are aware of the new national approach to auditing Best Value and the implications for the council in this respect, and (2) Endorse their role on the Panel (in line with the Scheme of Administration) in terms of ensuring the council continues to secure Best Value in practice in line with the statutory duty. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Page 148 of 285
Page 149
public spending watchdog for local government in Scotland whose duty is to ensure that public money is spent properly, efficiently, and effectively - with the relevant assurances in terms of the performance of the council and the quality of services to the public. 1.6 The specific details of the external auditors annual audit plan have still to be finalised by the incoming Audit Scotland audit team, however the Accounts Commission’s workplan to 2024 along with presentations made by Audit Scotland in a national forum in November 2022 provide a broad overview in this respect. 1.7 This report provides members of the Audit and Scrutiny Panel with an overview of the new national approach to auditing Best Value from 2022/23, based on the information available at the current time. 2. Best Value audit approach in councils 2.1 Following work to produce all 32 councils’ Best Value Assurance Reports (BVARs) over the six year period from 2017 to 2022, the national audit process for Best Value is now fully integrated within the wider scope of the external auditors annual audit work (as noted in paragraph 1.4 above). 2.2 The requirements for external auditors in all areas of their audit work, including Best Value, are set out in the Code of Audit Practice. This is issued by Audit Scotland to define auditors’ objectives and responsibilities and it is a condition of each auditors’ appointment that they follow the Code. Supplementary guidance is also provided to assist external auditors in meeting the Best Value requirements of the Code; this promotes a consistent approach to the audit work across all 32 councils. External audit work from 2022/23 2.3 From 2022/23, the external auditors annual audit programme will have four strands: (1) Follow up work regarding the progress made in implementing recommendations arising from the previous audit plan, including recommendations from BVARs. (2) Annual reporting of service performance and reporting in line with the Accounts Commission’s statutory direction. (3) Coverage of Best Value thematic work. (4) Regular review of Annual Audit Reports (AARs) by the Accounts Commission. Each of these strands are set out in more detail in paragraphs 2.4 to 2.19 below. (1) Follow up work regarding the progress made in implementing recommendations arising from the previous audit plan, including recommendations from BVARs. 2.4 It is expected this will include audit work which follows up on the implementation of the recommendations made through (a) previous Annual Audit Reports (AARs), and (b) the council’s 2019 BVAR. This will not just report on the progress made in terms of implementing previous recommendations, but more importantly the impact of those improvement actions and what difference has been made for local people and communities. 2.5 Where the external auditors identify any risks in relation to any aspects of Best Value, these will be covered as part of the Annual Audit Report (AAR) process. The good practice statements supporting each of the Best Value themes (listed in paragraph 1.2 above) will form the basis for this proportionate / risk based element to the audit work. Page 149 of 285
Page 150
(2) Annual reporting of service performance and reporting in line with the Accounts Commission’s statutory direction. 2.6 The Accounts Commission’s statutory direction (set out in Appendix 1) places a requirement on councils to report a range of information in terms of (a) improving local services and outcomes, and (b) demonstrating Best Value. 2.7 It is therefore expected that audit work will include annual reporting of performance that demonstrates continuous improvement in delivering services and improving outcomes in line with the council’s strategic priorities (i.e. as set out in The Plan for North Lanarkshire). It is also expected that auditors will seek to gain assurances in terms of the alignment of these priorities within delivery plans and more specifically (for example) resource, financial, and workforce plans. 2.8 As well as reflecting on the council’s performance monitoring, management, and reporting arrangements and contents of performance reports, auditors will expect to see evidence of improvements identified / made as a result of performance falling below expected targets, and evidence of impact in terms of the difference that has been made for local people and communities. Auditors will continue to use Local Government Benchmarking Framework (LGBF) results for comparison purposes and will expect to see benchmarking activity that contributes to continuous improvement in performance. (3) Coverage of Best Value thematic work. 2.9 In addition to the external auditors annual audit plan, the Accounts Commission have asked auditors to cover specific Best Value thematic work across Scotland. In the past this type of work was carried out at varying times and in different ways, moving forward each theme will be audited at the same time and in the same way across all 32 councils in order to gather views from across Scotland and compare councils as at the same point in time. This aims to provide assurance on areas of risk / interest across Scotland as at a defined point in time. Leadership of the development of new local strategic priorities 2.10 Thematic audit work for 2022/23 will be centred on leadership of the development of new local strategic priorities, focusing specifically on the following: • Consideration of how the council has focused its priorities since the local government elections. Reflecting on current local government focus, i.e. Covid recovery, cost of living challenges, reducing inequalities, and climate change. • In recognition of finite resources, setting clear priorities and planning how to deliver on them as well as monitoring progress and performance. 2.11 From this thematic work auditors will publish a management report on the findings at each council and a summary will be included in the 2022/23 Annual Audit Report (AAR) - scheduled to be presented to the Audit and Scrutiny Panel in the autumn of 2023. 2.12 The Accounts Commission have yet to finalise how the intelligence gained from the Best Value thematic work will be reported nationally; at present it is currently planned to include this in the spring 2024 Local Government Overview report. Climate change 2.13 In addition, the Auditor General and Accounts Commission are developing a programme of work on climate change to include climate change specific national Page 150 of 285
Page 151
outputs that focus on key issues and challenges, as well as moving towards integrating climate change considerations into all aspects of audit work. 2.14 For 2022/23 audits, auditors are therefore required to provide answers to six questions (set out in Appendix 2) and report a summary of findings in their Annual Audit Report (AAR). Note these questions relate to all audited bodies, not just councils. (4) Regular review of Annual Audit Reports (AARs) by the Accounts Commission. 2.15 As noted in the paragraphs above, Best Value work in the councils from 2022/23 will be fully integrated with the external auditor’s annual audit plan and reported in Annual Audit Reports (AARs), this includes risk-based, follow up, and thematic Best Value work. AARs for each council will be reviewed by the Accounts Commission (under the cover of the s102 Controller of Audit report) at least once over the five-year appointment to provide the Commission with assurance on Best Value in each individual council. 2.16 This programme of Controller of Audit reports will cover all 32 councils over the period from October 2023 to August 2027; eight councils will be reported each year over the four years. Year one councils (reporting October 2023 to August 2024) are Falkirk, Moray, Clackmannanshire, Orkney Islands, South Ayrshire, Dumfries and Galloway, West Dunbartonshire, and City of Dundee. 2.17 Controller of Audit reports will cover each councils latest Annual Audit Report (AAR) and be a summary of the information and judgements reported. The Accounts Commission will consider the report and may report findings publicly or request a hearing (in extreme circumstances). 2.18 External auditors will undergo a clearance process with each council for the Controller of Audit reports. Thereafter these reports will be expected to be submitted to the relevant committee for Elected Member’s discussion and oversight. 2.19 The Commission will use their Annual Assurance and Risks Report (AARR) process to identify thematic work for the coverage by all auditors in the following year’s audit. The Annual Assurance and Risks Report (AARR) is the annual report from the Controller of Audit about the work undertaken by all council’s external auditors over the past year on the Commission's behalf. Best Value audit work in Integrated Joint Boards (IJBs) 2.20 In May 2022 the Accounts Commission took the decision not to proceed with the proposed rollout of Best Value in IJBs in light of the significant uncertainties in the IJB operating environment and the matters arising from developments around the National Care Service (NCS) for Scotland. There will therefore be no programme of Controller of Audit reports on individual IJBs. 2.21 The Accounts Commission did however agree that they would “continue to provide robust, independent oversight and public reporting at both national and local level on the current performance of IJBs”. As such, moving forward the Best Value focus will be on national reporting that uses individual IJBs as case studies where appropriate. 2.22 Auditors of IJBs are required to include commentary in their Annual Audit Reports (AARs) on how the IJB demonstrates that it is meeting its Best Value duties. Auditors are to report on the IJBs' own arrangements for doing this. It is therefore expected that IJBs will have their own framework in place to report self-assessments against the seven Best Value themes (listed in paragraph 1.2). Page 151 of 285
Page 152
2.23 From a North Lanarkshire perspective, a self-evaluation exercise was undertaken in 2022 to assess the effectiveness of current arrangements for the North Lanarkshire health and social care IJB and how well the Board meets its intended outcomes. The findings (reported to the Integration Joint Board - Performance, Finance, and Audit Committee in August 2022) were positive and served to reassure the new members of the IJB (both Elected Members and executive members) of the effectiveness of the current arrangements for the Board and its supporting governance, and set out the priorities for improvement in this respect. 2.24 There is no Best Value thematic work scheduled for IJBs. Detailed work by the external auditors is not required against each of the Best Value themes, however commentary is expected in the Annual Audit Reports (AARs) on wider scope audit work which covers specific aspects of Best Value (such as financial sustainability, governance, service performance, and leadership). 2.25 National performance reporting on health and social care continues through the Accounts commission forward work programme. Case studies on individual IJBs may be part of this. Next steps 2.26 The new national approach to auditing Best Value means the council will, in effect, undergo an annual assessment in terms of particular aspects of Best Value. Considering that the North Lanarkshire BVAR is over three years old (and pre-dates the pandemic), it is important to ensure the council continues to be able to demonstrate Best Value and evidence this in practice. As reported to the Audit and Scrutiny Panel in November 2022, it is therefore the intent of the council’s Corporate Management Team that a self-evaluation will be undertaken in 2023 that is in essence a Best Value follow up. 2.27 The follow up Best Value self-evaluation is incorporated into the Strategic Self- Evaluation Framework rolling Review Programme for 2022 to 2023 and an update in this respect will be reported to a future meeting of the Audit and Scrutiny Panel. 2.28 National developments in terms of the new approach to auditing Best Value, as well as feedback from other councils, will continue to be kept under review as the process evolves. 3. Measures of success 3.1 Measures of success include: • Regular oversight and monitoring of performance across the organisation to gain assurances in terms of governance and accountability. • Regular review and challenge processes to scrutinise the performance of the council to ensure effective use of resources and that resources are directed in accordance with agreed policy and according to priorities, while ensuring sound decision making and clear accountability for the use of resources in achieving improved outcomes for service users and the local community. • Performance monitoring, management, and reporting arrangements that support the demonstration of improved performance in local services and outcomes, and the delivery of Best Value. 4. Supporting documentation 4.1 Appendix 1: Accounts Commission statutory direction for performance reporting: Page 152 of 285
Page 153
2022/23 to 2024/25. Appendix 2: Auditing climate change in 2022/23. Katrina Hassell Chief Officer (Business and Digital) 5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? The Local Government in Scotland Act 2003 introduced the duty of Best Value; this requires that councils “make arrangements to secure continuous improvement in performance”. The Local Government Act 1992 established the role of the Statutory Direction to direct the “publication of information as to standards of performance”. Page 153 of 285
Page 154
5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☐ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Ensuring that members of the Audit and Scrutiny Panel are aware of their role and how this supports the council’s ability to achieve Best Value contributes to the mitigation of the risk on the Corporate Risk Register for governance, leadership, and decision making. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 154 of 285
Page 155
Appendix 1: Accounts Commission statutory direction for performance reporting: 2022/23 to 2024/25. Page 155 of 285
Page 156
Appendix 2: Auditing climate change The Auditor General and Accounts Commission are developing a programme of work on climate change to include climate change specific national outputs that focus on key issues and challenges, as well as moving towards integrating climate change considerations into all aspects of audit work. For 2022/23 audits, auditors are required to provide answers to the following questions and report a summary in their Annual Audit Report (AAR): 1. What targets has the body set for reducing emissions in its own organisation or in its local area? 2. Does the body have a climate change strategy or action plan which sets out how the body intends to achieve its targets? 3. How does the body monitor and report progress towards meeting its emission targets internally and publicly? 4. Has the body considered the impact of climate change on its financial statements? 5. What are the areas of the financial statements where climate change has, or is expected to have, a material impact? 6. Does the body include climate change in its narrative reporting which accompanies the financial statements and is it consistent with those financial statements? Page 156 of 285
Page 157
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref KH/SL Date 16/02/23 Annual scrutiny programme From Katrina Hassell, Chief Officer (Business and Digital) E-mail HassellK@northlan.gov.uk Telephone 07903 096 121 Executive Summary This report sets out the annual programme for the scrutiny function of the Audit and Scrutiny Panel. It follows on from the report to the Panel in September 2022 which outlined the process by which members of the Audit and Scrutiny Panel are able to submit items, functions, or activities requiring scrutiny and the subsequent assessment and prioritisation mechanism. Traditionally, the scrutiny function of the Audit and Scrutiny Panel has been twofold, comprising (1) items, functions, or activities requiring scrutiny identified and submitted by Panel members, and (2) the presentation of information and reports aligned to the long- term vision set out in The Plan for North Lanarkshire and its supporting strategic frameworks. This report therefore combines both these aspects in a composite programme which lists all scrutiny related reports scheduled to be presented to the Audit and Scrutiny Panel during each cycle of 2023/24. This approach aims to ensure the council fulfils its statutory Best Value duty (with scrutiny structures that support Elected Members in reviewing and challenging performance) and the principles of good corporate governance. It also aims to ensure all scrutiny activity remains framed within the context of The Plan for North Lanarkshire and is focused on improving local public services and improving local outcomes. Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Endorse the composite programme and reporting timetable, set out in this report and Appendix 1, in order to establish an annual programme for the scrutiny function of the Audit and Scrutiny Panel, (2) Continue to endorse the role of Panel members in identifying, assessing, and prioritising items for inclusion in the scrutiny work programme in line with the updated process, and (3) Continue to carry out their scrutiny role in reviewing and challenging performance to ensure the council fulfils its statutory Best Value duty. AGENDA ITEM 11 Page 157 of 285
Page 158
1. Background 1.1 Audit and Scrutiny Panel members will recall the report in September 2022 which set out the updated assessment and prioritisation process for the Panel to use to determine the work programme for scrutiny. 1.2 This report focused on the process through which members of the Audit and Scrutiny Panel would be able to identify and submit specific items, functions, or activities requiring scrutiny. This process allows for the relative merits of each issue brought forward by Panel members to be assessed objectively, thus making prioritising and choosing between possibly competing items requiring scrutiny easier and transparent. 1.3 This process supports the Audit and Scrutiny Panel to fulfil its remit (in line with the Scheme of Administration) to provide an “independent review of the council's governance, risk management, performance, and control frameworks, and oversee the financial reporting and annual governance processes.” 1.4 It also contributes to discharging the scrutiny function in line with the Panel’s specific remit to: • Review and monitor the performance of the council in delivering upon its priorities, outcomes, programme of work, and targets in the council plan; specifically performance in improving local public services and local outcomes and in demonstrating Best Value. • Review performance to assess whether intended policy outcomes have been achieved. • Consider the council's performance, improvement, and governance arrangements to ensure that approaches continue to facilitate effective and efficient delivery of planned services and outcomes and the council’s vision. 1.5 The scrutiny function of the Audit and Scrutiny Panel has a key role to play in ensuring the council fulfils both its statutory Best Value duty (with scrutiny structures that support Elected Members in reviewing and challenging performance) and the corporate governance principles (as set out in the national Delivering Good Governance in Local Government: Framework, 2016). As such, the approach to discharging the scrutiny function - in line with the Panel’s specific remit - has traditionally been twofold, comprising: (1) Items, functions, or activities requiring scrutiny identified and submitted by Panel members (in line with the process approved by the Panel in August 2018 and subsequently updated in September 2022). (2) Presentation of information and reports aligned to long-term vision set out in The Plan for North Lanarkshire and its supporting strategic frameworks (as per the process reported to the Panel in November 2019). 1.6 This report therefore combines both these aspects in a composite scrutiny programme. The programme (set out in Appendix 1) lists all scrutiny related reports which are scheduled to be presented to the Audit and Scrutiny Panel in each cycle, from cycle 1 in 2023 to cycle 1 in 2024. This approach aims to ensure all scrutiny activity remains The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Page 158 of 285
Page 159
framed within the context of The Plan for North Lanarkshire and what it aims to achieve, and is focused on improving local public services and improving local outcomes. 2. Composite scrutiny programme 2.1 The development of a work programme for the scrutiny function of the Audit and Scrutiny Panel is founded on items identified and submitted for consideration being evidence based. This is essential in order to ensure a fully informed assessment and prioritisation process. As such, the September 2022 report highlighted the wide range of information which exists to complement the scrutiny process, including: • Performance indicators from the Strategic Performance Framework. • Information on the volume, nature, and outcome of complaints. • Benchmarking results and comparisons with other councils, where available and aligned to themes linked to the five priorities in The Plan for North Lanarkshire (as per the approach established by the Panel in September 2021). • Demographics and future projections, e.g. for population or households. • Policies in place, or under development in line with the Strategic Policy Framework review programme. • Improvements already identified and implemented arising from the Strategic Self- Evaluation Framework review programme. • Elements or mechanisms from the Strategic Governance Framework review programme. 2.2 While the information set out in paragraph 2.1 above supports (1) the items, functions, or activities requiring scrutiny identified and submitted by Panel members, it also forms the basis for (2) the presentation of information and reports aligned to long-term vision set out in The Plan for North Lanarkshire and its supporting strategic frameworks. 2.3 Members will recall the inter-related strategic frameworks aim to assess the success of The Plan for North Lanarkshire, while ensuring each stage of delivery towards achieving the overall vision is appropriately planned, guided, implemented, and governed. As such, these frameworks focus on ensuring a corporate one council approach in respect of Policy, Governance, Performance, Self-Evaluation, and Project Management and an annual position statement for each Framework was reported to the Panel in November 2022. 2.4 To ensure these frameworks remain aligned to The Plan for North Lanarkshire, each is on a programme to undergo a regular review and refresh exercise. Those within the remit of the Audit and Scrutiny Panel are set out within the composite scrutiny programme in Appendix 1. Type of scrutiny review 2.5 Appendix 1 also contains four specific areas of scrutiny identified by Panel members to undergo an in-depth review at a future Panel meeting. Members will recall the types of scrutiny review which can be undertaken were set out in the report in November 2022. To ensure the most effective approach to scrutiny, reviews can take one of three formats: • An in-depth review - which can be undertaken by all Panel Members or, if required, a smaller subgroup. This would require a clear scope to be developed along with a timetable for the work to be undertaken. The work of any subgroup Page 159 of 285
Page 160
would require a report, with recommendations, to be submitted back to the full Audit and Scrutiny Panel for consideration and approval. • A spotlight on - short, sharp focused scrutiny activity, which could form one agenda item for a Panel meeting. • A focus on - presentations to Panel Members to share information and raise awareness or increase knowledge of a particularly complex area of activity or issue. 2.6 As such, the four specific areas of scrutiny identified by Panel members to undergo an in-depth review at a future Panel meeting are currently at the scoping stage. A reporting cycle will be added to the timetable in Appendix 1 once scoping is complete and the assessment and prioritisation process has been undertaken. Next steps 2.7 The composite scrutiny programme in Appendix 1 will be established annually and reported to the Audit and Scrutiny Panel in cycle 1 each year. Any new items, functions, or activities requiring scrutiny will be added to the programme as they are identified, scoped (where required), assessed, and prioritised. 3. Measures of success 3.1 The key measure of success is the use of the scrutiny function of the Audit and Scrutiny Panel to identify specific areas of service requiring improvement, that are aligned to The Plan for North Lanarkshire and will have a positive impact on the council’s ability to deliver the long-term vision. 4. Supporting documentation 4.1 Appendix 1 - Annual composite scrutiny programme with timetable of reports to future Panel meetings - 2023 to 2024. Katrina Hassell Chief Officer (Business and Digital) 5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ Page 160 of 285
Page 161
5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? The Local Government Act 1992 established the role of the Statutory Direction to direct the “publication of information as to standards of performance”. The Local Government in Scotland Act 2003 introduced the duty of Best Value; this requires that councils “make arrangements to secure continuous improvement in performance”. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Page 161 of 285
Page 162
Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Implementation of the annual composite scrutiny programme will facilitate an effective approach to the scrutiny of performance and contribute to the mitigation of the risk on the Corporate Risk Register for governance, leadership, and decision making. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 162 of 285
Page 163
Appendix 1 Annual composite scrutiny programme with timetable of reports to future Panel meetings - 2023 to 2024 The following programme will be updated as new items requiring scrutiny are identified, scoped (where required), assessed, and prioritised. Scrutiny items, functions, or activities for future Audit and Scrutiny Panel meetings Scrutiny of this item, function, or activity aims to … Cycle 1 16th Feb 2023 Cycle 2 18th May 2023 Cycle 3 31st Aug 2023 Cycle 4 16th Nov 2023 Cycle 1 15th Feb 2024 Identified by Members of the Audit and Scrutiny Panel Digital Broadband. Carry out an in-depth scrutiny review. This item is currently at the scoping stage prior to undergoing the assessment and prioritisation process. Laundries in towers. Carry out an in-depth scrutiny review. ✓ Supported businesses. Carry out an in-depth scrutiny review. ✓ Housing refurbishments. Carry out an in-depth scrutiny review. ✓ Sale of housing. Carry out an in-depth scrutiny review. ✓ Work programme for scrutiny Annual composite scrutiny programme with timetable of reports to future Panel meetings. Support the Best Value governance and accountability theme by ensuring the council’s scrutiny structures support Elected Members in reviewing and challenging performance. ✓ ✓ Strategic Performance Framework Annual Performance Reporting schedule. Support the Best Value governance and accountability theme by ensuring the council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. Fulfil the Panel’s remit as per the Scheme of Administration to: • Review and monitor the performance of the council in delivering upon its priorities, outcomes, programme of work, and targets in the council plan, specifically performance in improving local services and outcomes and in demonstrating Best Value. • Review performance to assess whether intended policy outcomes have been achieved. ✓ ✓ Performance in terms of improving outcomes (level 1 health check indicators). ✓ ✓ Performance in improving services (levels 2 and 3 indicators, which includes Local Government Benchmarking Framework (LGBF) results aligned to the council’s strategic priorities. ✓ ✓ Page 163 of 285
Page 164
Scrutiny items, functions, or activities for future Audit and Scrutiny Panel meetings Scrutiny of this item, function, or activity aims to … Cycle 1 16th Feb 2023 Cycle 2 18th May 2023 Cycle 3 31st Aug 2023 Cycle 4 16th Nov 2023 Cycle 1 15th Feb 2024 Strategic Government Framework Annual review and refresh of the Framework and an update to the review programme. Fulfil the Panel’s remit as per the Scheme of Administration to: • Consider the council's performance, improvement, and governance arrangements to ensure that approaches continue to facilitate effective and efficient delivery of planned services and outcomes and the council's vision. Ensure good governance principles are in place to enable the council to effectively pursue the ambition set out in The Plan for North Lanarkshire within appropriate controls and the management of risk. This is also central to ensuring effective scrutiny and delivery of statutory Best Value obligations. This means ensuring resources are directed in line with agreed policies, priorities, and project management procedures, and there is sound and inclusive decision making and clear accountability for the use of those resources in achieving improved outcomes for service users and communities. ✓ Annual Governance Statement Consider and note the Annual Governance Statement each year, and confirm the inclusion of the assurance statement regarding the management of the risk of fraud and corruption. Fulfil the Panel’s remit as per the Scheme of Administration to: • Consider the council's performance, improvement, and governance arrangements to ensure that approaches continue to facilitate effective and efficient delivery of planned services and outcomes and the council's vision. • Review the Annual Governance Statement prior to approval and consider whether it properly reflects the risk environment and supporting assurances, taking into account Internal Audit’s opinion on the overall adequacy and effectiveness of the council’s framework of governance, risk management and control. Fulfil the requirements of the Delivering Good Governance in Local Government: Framework (2016) and the Local Authority Accounts (Scotland) Regulations 2014 by ensuring that: • The council conducts a review at least once in each financial year of the effectiveness of its system of internal control. • The findings from the review are considered at a meeting of a committee whose remit includes audit or governance functions. ✓ Strategic Self- Annual review and Fulfil the Panel’s remit as per the Scheme of Administration to: ✓ Page 164 of 285
Page 165
Scrutiny items, functions, or activities for future Audit and Scrutiny Panel meetings Scrutiny of this item, function, or activity aims to … Cycle 1 16th Feb 2023 Cycle 2 18th May 2023 Cycle 3 31st Aug 2023 Cycle 4 16th Nov 2023 Cycle 1 15th Feb 2024 Evaluation Framework refresh of the Framework and an update to the review programme. • Consider the council's performance, improvement, and governance arrangements to ensure that approaches continue to facilitate effective and efficient delivery of planned services and outcomes and the council's vision. Complaints handling performance Annual report on the council’s performance in complaints handling. Report on the suite of Scottish Public Services Ombudsman (SPSO) indicators which measures the council’s performance in implementing the Local Authority Model Complaints Handling Procedure. Fulfil the requirements of the Delivering Good Governance in Local Government: Framework (2016), in particular principle A1.4 Behaving with integrity and “demonstrating, communicating, and embedding the standard operating principles or values through appropriate policies and processes which are reviewed on a regular basis to ensure that they are operating effectively”. ✓ Position statement on the six strategic frameworks Annual report to demonstrate Best Value in good governance and effective use of resources that leads to improving the functions and activities the council undertakes to deliver the best possible outcomes and services that improve the everyday lives of local people. Support the Best Value governance and accountability theme by ensuring the council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. Fulfils the Panel’s purpose as per the Scheme of Administration to provide “independent review of the council’s governance, risk management, performance and control frameworks”. Ensure good governance principles are in place to enable the council to effectively pursue the ambition set out in The Plan for North Lanarkshire within appropriate controls and the management of risk. This is also central to ensuring effective scrutiny and delivery of statutory Best Value obligations. This means ensuring resources are directed in line with agreed policies, priorities, and project management procedures, and there is sound and inclusive decision making and clear accountability for the use of those resources in achieving improved outcomes for service users and communities. ✓ Project Management Elected Member oversight in terms of the Fulfil good practice in project management which recommends that a council's audit and scrutiny committee have an ✓ Page 165 of 285
Page 166
Scrutiny items, functions, or activities for future Audit and Scrutiny Panel meetings Scrutiny of this item, function, or activity aims to … Cycle 1 16th Feb 2023 Cycle 2 18th May 2023 Cycle 3 31st Aug 2023 Cycle 4 16th Nov 2023 Cycle 1 15th Feb 2024 Framework independent strategic oversight and assurance process quality assurance process and review programme for the Project Management Framework. important role to play in providing independent assurances about the delivery of major programmes and projects. The Panel’s role in this respect is therefore to be assured that suitable review procedures have been adopted and to gain assurance about the value of independent reviews that are undertaken during the project life cycle. Self-evaluation of the Audit and Scrutiny Panel Effectiveness of the performance and activities of the Audit and Scrutiny Panel in discharging the scrutiny aspects of its role. Fulfil corporate governance principle E2.4 in line with the Delivering Good Governance in Local Government: Framework (2016) in terms of developing capabilities to ensure Elected Members have the appropriate skills, knowledge, resources, and support to fulfil their roles and responsibilities and ensuring they are able to update their knowledge on a continuing basis. Address the risk identified by Internal Audit in terms of the council being able to adequately demonstrate that it has effective audit committee arrangements and/or arrangements to ensure Elected Members have the skills, knowledge and (where appropriate or required) access to relevant training and resources to effectively undertake their role. ✓ Training and development Elected Member training on the scrutiny function, of the Audit and Scrutiny Panel, including aspects of Best Value and the supporting strategic frameworks (i.e. Policy, Governance, Performance, Self- Evaluation, and Project Management) relevant to each Member’s role on the Panel. Note, formal training will be scheduled for cycle 4 but informal 1:1s can be requested at any time. Support the Best Value vision and leadership theme in terms of Elected Members being self-aware and committed to training and personal development to update and enhance their knowledge, skills, capacity, and capabilities to deliver Best Value and perform their leadership roles, and they receive sufficient support to do so. Fulfil corporate governance principle E2.4 in line with the Delivering Good Governance in Local Government: Framework (2016) in terms of developing capabilities to ensure Elected Members have the appropriate skills, knowledge, resources, and support to fulfil their roles and responsibilities and ensuring that they are able to update their knowledge on a continuing basis. ✓ Page 166 of 285
Page 167
Page 167 of 285
Page 168
Page 168 of 285
Page 169
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref KH/SL Date 16/02/23 Strategic Performance Framework - Performance Reporting Schedule 2023 to 2024 From Katrina Hassell, Chief Officer (Business and Digital) E-mail HassellK@northlan.gov.uk Telephone 07903 096 121 Executive Summary As one of the strategic frameworks which supports The Plan for North Lanarkshire, the Strategic Performance Framework sets out performance measurement at three levels in order to collectively provide an overview of performance to help understand the impact of council activities on improving services and outcomes for the people and communities of North Lanarkshire. The measures in this Framework allow for day to day activities, and progress towards achieving the long-term vision set out in The Plan for North Lanarkshire, to be regularly monitored, reported, assessed, and scrutinised. A Performance Reporting Schedule was established to facilitate this process, and reported to the Audit and Scrutiny Panel in March 2021. As the Panel are aware, from 2022/23 demonstrating Best Value in practice moves to a more frequent annual audit assessment which will be undertaken as part of the external auditors existing Annual Audit Report (AAR) process. It is therefore important to ensure that the council continues to be able to demonstrate Best Value and evidence this in practice, in particular through robust scrutiny and performance reporting. Moving forward however, auditing Best Value will go beyond simply focusing on the arrangements themselves and will have a specific focus on assessing effectiveness and ascertaining if performance reporting can demonstrate the council is making a real difference - having an impact - on improving services and outcomes for local people. This report therefore updates the Performance Reporting Schedule initially established in 2021 and sets out the service specific, statutory, corporate, and Strategic Performance Framework performance reporting arrangements for 2023 to 2024. Consideration of the Performance Reporting Schedule at the Audit and Scrutiny Panel supports the Best Value governance and accountability theme by ensuring the council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. It also aims to fulfil the Panel’s remit as per the Scheme of Administration to: • Review and monitor the performance of the council in delivering upon its priorities, outcomes, programme of work and targets in the council plan, specifically performance in improving local services and outcomes and in demonstrating Best Value. • Review performance to assess whether intended policy outcomes have been achieved. AGENDA ITEM 12 Page 169 of 285
Page 170
1. Background 1.1 Members of the Audit and Scrutiny Panel will recall the strategic frameworks annual position statement report in November 2022 which provided an update on the inter- related strategic frameworks which are key to assessing the success of The Plan for North Lanarkshire and monitoring delivery towards achieving the overall vision by ensuring each stage is appropriately planned, guided, implemented, and governed. 1.2 The frameworks focus on ensuring a corporate one council approach in respect of Policy, Governance, Performance, Self-Evaluation, Project Management, and Demonstrating Improved Outcomes for Communities. To ensure these frameworks continue to align to, and support delivery of, The Plan for North Lanarkshire all are on a programme for a regular review and refresh exercise. 1.3 The role of the Strategic Performance Framework was reiterated in the report to the Panel in November 2022. This sets out the framework for performance measurement at three levels (as per the diagram on the right). This aims to collectively provide an overview of performance to help understand the impact of council activities on improving services and outcomes for the people and communities of North Lanarkshire. 1.4 The measures in this Framework allow for day to day activities, and progress towards achieving the long-term vision set out in The Plan for North Lanarkshire, to be regularly monitored, reported, assessed, and scrutinised. A Performance Reporting Schedule was established to facilitate this process, and reported to the Audit and Scrutiny Panel in March 2021. 1.5 The Strategic Performance Framework is aligned to the Accounts Commission statutory direction (set out in Appendix A) which places a requirement on councils to report a range of information in terms of (1) improving local services and outcomes, and (2) demonstrating Best Value. 1.6 Auditing the council’s compliance with the Accounts Commission statutory direction forms part of the work undertaken by the external auditors each year in the production of their Annual Audit Report (AAR). Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Maintain an awareness of the reports within the Performance Reporting Schedule for 2023 to 2024 in line with the Panel’s remit to provide “independent review of the council’s governance, risk management, performance and control frameworks”, and (2) Are aware that the Performance Reporting Schedule forms a key part of the scrutiny work programme that supports the Best Value governance and accountability theme by ensuring the council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Page 170 of 285
Page 171
1.7 In line with the next steps set out in the November 2022 report, and following a review and refresh exercise, this report herewith provides the Audit and Scrutiny Panel with the updated Performance Reporting Schedule. This sets out the performance reporting, review, and scrutiny arrangements for 2023 to 2024 and the reporting standards which required to be followed. 2. Performance reporting, review, and scrutiny arrangements for 2023 to 2024 2.1 When approved in September 2019, the Strategic Performance Framework included a reporting schedule; this outlined the reporting frequency and audiences for the performance indicators within the framework. This also highlighted a range of service specific performance reporting which takes place each year to meet both business and statutory obligations. The previous Performance Reporting Schedule for 2021/22 was approved in April 2021; Appendix B attached to this report provides hyperlinks to the latest reports in this respect. 2.2 Following a review and refresh exercise, the Performance Reporting Schedule has been updated for 2023 to 2024. This is attached in Appendix B and sets out the timetable for: (1) Chief Officer’s individual six monthly Performance Reviews at Service Committees in line with the Strategic Performance Framework. (2) Corporate reporting to the Audit and Scrutiny Panel and Policy and Strategy Committee in line with the Strategic Performance Framework. (3) Chief Officer service specific performance reporting which takes place each year to meet both business and statutory obligations. 2.3 A set of non-negotiable standards was also established in the original Strategic Performance Framework. This requires all Chief Officers to ensure a set of five non- negotiable standards are applied in all performance reports to Service Committees that are aligned to the Strategic Performance Framework. These standards aim to ensure that performance reporting is: • Aligned - to The Plan for North Lanarkshire to give stakeholders an insight into the performance of council activities in the short-term and against the long-term ambitions. • Consistent - to ensure a standard, easily recognisable, and well established process across each different audience over time. This aims to help build credibility, reliability, and a common understanding. • Transparent - to allow stakeholders to understand what is being measured, what it means, what level of performance has actually been achieved, and what difference this means in reality for the people and communities of North Lanarkshire. • In context - to avoid the So What? question and provide a coherent narrative to ensure fully informed review, reporting, scrutiny, and decision making processes. • Balanced - to ensure any text adds value and tells a balanced narrative. Performance reports should identify areas requiring improvement as well as areas of good performance. Narrative should include reasons for performance levels not in line with targets and the remedial action undertaken to address this. Next steps 2.4 To ensure adherence to the non-negotiable standards, a standardised template has been developed for Chief Officers to use when reporting the items in section (1) of Page 171 of 285
Page 172
Appendix B to the respective Service Committee. This aims to achieve consistency of approach which will help build credibility, reliability, and a common understanding. 2.5 Corporate reporting to the Audit and Scrutiny Panel (in line with the Strategic Performance Framework) will commence in cycle 2 as per section (2) in Appendix B. Note this aligns to the scrutiny work programme report on the Panel’s agenda today which sets out the Annual composite scrutiny programme with timetable of reports to future Panel meetings. 2.6 Performance reports submitted to the respective Committee (in line with items (1), (2), and (3) in paragraph 2.2 above - as set out in Appendix B) will be kept under review by the Corporate Management Team so that adherence to the timetable is maintained. This will also seek to provide the relevant assurances in terms of performance management arrangements that promote the effective use of the council’s resources, performance being scrutinised at a senior management level, and arrangements being effective in addressing areas of underperformance, identifying the scope for improvement, and agreeing remedial action. 3. Measures of success 3.1 Measures of success include: • Regular oversight and monitoring of performance across the organisation to gain assurances in terms of governance and accountability. • Regular review and challenge processes to scrutinise the performance of the council to ensure effective use of resources and that resources are directed in accordance with agreed policy and according to priorities, while ensuring sound decision making and clear accountability for the use of resources in achieving improved outcomes for service users and the local community. • Performance monitoring, management, and reporting arrangements that support the demonstration of improved performance in local services and outcomes, and the delivery of Best Value. 4. Supporting documentation 4.1 Appendix A: Accounts Commission statutory direction for performance reporting: 2022/23 to 2024/25. Appendix B: Performance Reporting Schedule 2023 to 2024. Katrina Hassell Chief Officer (Business and Digital) Page 172 of 285
Page 173
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? The Local Government Act 1992 established the role of the Statutory Direction to direct the “publication of information as to standards of performance”. The Local Government in Scotland Act 2003 introduced the duty of Best Value; this requires that councils “make arrangements to secure continuous improvement in performance”. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital Page 173 of 285
Page 174
transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Improvements in the presentation of performance information to various audiences are being advanced in line with the development of the DigitalNL work package for the Business Intelligence (BI) Hub. Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Implementation of the Performance Reporting Schedule, which will facilitate effective review and scrutiny processes, contributes to the mitigation of the risk on the Corporate Risk Register for governance, leadership, and decision making. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 174 of 285
Page 175
Appendix A: Accounts Commission statutory direction for performance reporting: 2022/23 to 2024/25. Page 175 of 285
Page 176
Appendix B: Performance Reporting Schedule 2023 to 2024 The following provides a timetable outlining dates for: (1) Chief Officer’s individual six monthly Performance Reviews at Service Committees in line with the Strategic Performance Framework. (2) Corporate reporting by the Chief Officer (Business and Digital) in line with the Strategic Performance Framework. (3) Chief Officer service specific performance reporting which takes place each year to meet both business and statutory obligations. (1) Chief Officer’s individual six monthly Performance Reviews at Service Committees in line with the Strategic Performance Framework Chief Officer Committee meeting dates Committee Latest report Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 Business and Digital 1 Mar 2023 13 Sept 2023 28 Feb 2024 Finance and Resources Committee 23-02-22 Latest performance results for Business and Digital https://mars.northlanarkshire.gov.uk/egenda /images/att97665.pdf Finance 1 Mar 2023 13 Sept 2023 28 Feb 2024 Finance and Resources Committee 10-03-22 Latest performance results for Finance https://mars.northlanarkshire.gov.uk/egenda /images/att97666.pdf Legal and Democratic 1 Mar 2023 13 Sept 2023 28 Feb 2024 Finance and Resources Committee - Asset and Procurement 1 Mar 2023 13 Sept 2023 28 Feb 2024 Finance and Resources Committee - People Resources 1 Mar 2023 13 Sept 2023 28 Feb 2024 Finance and Resources Committee - Community Operations 3 May 2023 1 Nov 2023 Environment and Climate Change Committee 09-02-22 Latest performance results for Regulatory Services and Waste Solutions https://mars.northlanarkshire.gov.uk/egenda /images/att97662.pdf 09-02-22 Latest performance results for Environmental Assets https://mars.northlanarkshire.gov.uk/egenda /images/att97663.pdf Place 11 May 2023 17 Nov 2023 Enterprise and Fair Work Committee 07-11-19 Strategic Performance Framework reporting https://mars.northlanarkshire.gov.uk/egenda /images/att92355.pdf Place 10 May 2023 8 Nov 2023 Housing Committee 20-11-19 Strategic Performance Framework reporting https://mars.northlanarkshire.gov.uk/egenda /images/att92330.pdf Housing Management 10 May 2023 8 Nov 2023 Housing Committee 20-11-19 Strategic Performance Framework reporting https://mars.northlanarkshire.gov.uk/egenda /images/att92330.pdf Housing Property Services 10 May 2023 8 Nov 2023 Housing Committee 20-11-19 Strategic Performance Framework reporting https://mars.northlanarkshire.gov.uk/egenda /images/att92330.pdf Education 28 Feb 2023 12 Sept 2023 27 Feb 2024 Education, Children, and Families Committee 12-11-19 Strategic Performance Framework reporting https://mars.northlanarkshire.gov.uk/egend Page 176 of 285
Page 177
Chief Officer Committee meeting dates Committee Latest report Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 a/images/att92322.pdf Education - Active and Creative Communities 24 Apr 2023 30 Oct 2023 Communities Committee 24-08-20 Culture and LeisureNL Ltd - Performance report for quarter 4 (January - March 2020) and year end 2019/20 https://mars.northlanarkshire.gov.uk/egenda /images/att94269.pdf Children, Families, Justice - Tackling Poverty 5 May 2023 3 Nov 2023 Wellbeing and Tackling Poverty Committee - Children, Families, Justice - Community Learning and Development 24 Apr 2023 30 Oct 2023 Communities Committee - Children, Families, Justice - Child protection and children’s social work 23 May 2023 21 Nov 2023 Education, Children, and Families Committee - Strategic Communication and Engagement 24 Apr 2023 30 Oct 2023 Communities Committee - Audit and Risk 18 May 2023 16 Nov 2023 Audit and Scrutiny Panel 08-09-22 2021-22 Internal Audit performance data https://mars.northlanarkshire.gov.uk/egenda /images/att98464.pdf Adult Social Work (integrated quarterly report) 15 Feb 2023 19 Apr 2023 21 Jun 2023 18 Oct 2023 14 Feb 2023 Integration Joint Board (Performance, Finance, and Audit Committee) 15-11-22 Adult social care performance report Q1 2022/23 https://mars.northlanarkshire.gov.uk/egenda /images/att99225.pdf (2) Corporate reporting by the Chief Officer (Business and Digital) in line with the Strategic Performance Framework. Corporate reporting requirement Committee meeting dates Committee Latest report(s) Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 Strategic oversight by the Policy and Strategy Committee in line with their remit as per the Scheme of Administration to “oversee the development, co-ordination and monitoring of the Plan for North Lanarkshire”. 16 Mar 2023 28 Sept 2023 14 Mar 2024 Policy and Strategy Committee 17-03-22 Health Check Indicators update (in Programme of Work report) https://mars.northlanarkshire.gov.uk/egenda/images/ att97996.pdf Strategic oversight by the Audit and Scrutiny Panel in line with their purpose as per the Scheme of Administration which includes providing “independent review of the council’s governance, risk management, performance and control frameworks”, and their remit in relation to the scrutiny function which is to: • review and monitor the performance of the council in delivering upon its priorities, outcomes, programme of work and targets in the council plan, specifically performance • review performance to assess whether intended policy outcomes have been achieved • consider the council's performance, improvement, and governance arrangements to ensure that approaches continues to 16 Feb 2023 18 May 2023 31 Aug 2023 16 Nov 2023 15 Feb 2024 Audit and Scrutiny Panel 22-09-21 The Plan for North Lanarkshire - performance benchmarking https://mars.northlanarkshire.gov.uk/egenda/images/ att96914.pdf 10-12-20 Benchmarking results - Local Government Benchmarking Framework (LGBF) https://mars.northlanarkshire.gov.uk/egenda/images/ att95182.pdf 23-09-20 Strategic Performance Framework reporting https://mars.northlanarkshire.gov.uk/egenda/images/ att94661.pdf 20-02-20 Page 177 of 285
Page 178
Corporate reporting requirement Committee meeting dates Committee Latest report(s) Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 facilitate effective and efficient delivery of planned services and outcomes and the council's vision • commission independent short life task group reviews (based on evidence), and carry out reviews recommended from service committees, to enable in-depth scrutiny of policy, practices, and performance where the challenge and scrutiny function can make an impact or add value Strategic Performance Framework reporting https://mars.northlanarkshire.gov.uk/egenda/images/ att92926.pdf 14-11-19 Strategic Performance Framework reporting https://mars.northlanarkshire.gov.uk/egenda/images/ att92362.pdf Performance in complaints handling in line with corporate governance requirements 31 Aug 2023 Audit and Scrutiny Panel 21-02-19 Complaints handling - follow up report on learning from complaints https://mars.northlanarkshire.gov.uk/egenda/images/ att89785.pdf (3) Chief Officer service specific performance reporting which takes place each year to meet both business and statutory obligations. Performance report Committee meeting dates Chief Officer responsible Committee Latest version submitted to Committee Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 Scottish Housing Regulator: annual landlord report This report presents the annual landlord report published by the Scottish Housing Regulator (SHR) which shows Scotland’s social landlords’ performance for both Local Authorities and Registered Social Landlords (RSL’s) against the Scottish Social Housing Charter (SSHC). 8 Nov 2023 Chief Officer (Housing Management) Housing Committee 16-11-22 Scottish Housing Regulator: 2021/22 Landlord Report https://mars.northlanarkshire.gov.uk/egenda/images/att99127.pdf Scottish Housing Regulator: Annual Assurance Statement Since April 2019, Social Landlords in Scotland are required to advise the Scottish Housing Regulator (SHR) if they meet the regulatory standards and requirements by submitting an Annual Assurance Statement between April and October each year. Each landlord should confirm in its Statement its level of compliance with all of the relevant requirements at section 3 of the Regulatory Framework. The SHR assesses each Statement as part of their regulatory risk assessment and publishes an engagement plan for each landlord. From March 2021, RSL engagement plans include a regulatory status which is the SHR judgment on whether the RSL complies with regulatory standards and requirements. 30 Aug 2023 Chief Officer (Housing Management) Housing Committee 31-08-22 Scottish Housing Regulator: 2021/22 Annual Assurance Statement https://mars.northlanarkshire.gov.uk/egenda/images/att98392.pdf Annual housing / Scottish Social Housing Charter performance report The annual performance report to tenants is designed to keep tenants, service users, and other customers informed of council performance and how the council is progressing towards meeting the outcomes of the Scottish Social Housing Charter (SSHC). X Chief Officer (Housing Management) - 26-10-22 Housing annual performance report 2021/2022 https://www.northlanarkshire.gov.uk/housing/housing-annual- performance-report/housing-annual-performance-report-20212022 Community safety CCTV performance This report provided a one off update on the performance of the Community Safety Hub following its merger into Housing Solutions Moving forward this report will be incorporated into the service’s programme of annual service performance reports. 10 May 2023 Chief Officer (Housing Management) Housing Committee 17-02-20 Community safety CCTV https://mars.northlanarkshire.gov.uk/egenda/images/att95512.pdf Homeless performance and processes This report provided a one off update in terms of performance in relation to the provision of homelessness services which continued to be delivered throughout the pandemic and, despite the challenges the pandemic brought, highlights many areas of 10 May 2023 Chief Officer (Housing Management) Housing Committee 08-09-21 Homeless performance and processes https://mars.northlanarkshire.gov.uk/egenda/images/att96707.pdf Page 178 of 285
Page 179
Performance report Committee meeting dates Chief Officer responsible Committee Latest version submitted to Committee Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 improved performance. Moving forward this report will be incorporated into the service’s programme of annual service performance reports. Planning performance framework This report updates on the Scottish Government’s feedback on the performance of the planning and place service for the latest year based on the Planning Performance Framework (PPF) submitted each year. 2 Mar 2023 29 Feb 2024 Chief Officer (Place) Planning Committee 24-02-22 Planning Performance Framework 2020-21 https://mars.northlanarkshire.gov.uk/egenda/images/att97854.pdf Economic Regeneration Delivery Plan (ERDP) Performance Framework The ERDP Performance Framework was approved by Committee in February 2021. This comprises a group of performance indicators at three levels. These indicators aim to collectively provide an overview of how the North Lanarkshire economy is performing as well as help to understand the impact that the delivery of the ERDP is having on improving economic opportunities and outcomes for all. 1 Sept 2023 Chief Officer (Place) Enterprise and Fair Work Committee 29-08-22 Economic Regeneration Delivery Plan and Performance Framework - annual progress updates https://mars.northlanarkshire.gov.uk/egenda/images/att98536.pdf Food law service plan All local authority regulators of food safety are required to plan their enforcement and advisory activities and in accordance with independent auditor preference, present that plan (with an update on performance achieved to date) before a relevant committee for its approval. 23 Aug 2023 Chief Officer (Community Operations) Environment and Climate Change Committee 24-08-22 Business Regulation Service Plan 2022-23 https://mars.northlanarkshire.gov.uk/egenda/images/att98473.pdf Annual Building Standards performance There is a statutory requirement to produce and publish on the council website an Annual Building Standards Verification Performance Report. The report includes a broad range of performance and service improvement information and it looks back at the previous 12 months, as well as looking forward to the next period. X Chief Officer (Community Operations) - Building Standards annual verification performance report 2021/22 https://www.northlanarkshire.gov.uk/planning-and-building/building- standards/building-performance Annual Standards and Quality report This annual report serves three purposes: (i) To provide all stakeholders and the public with the performance information across the six National Improvement Framework (NIF) drivers and against improvement priorities to measure performance in improving educational outcomes for young people. (ii) To meet the statutory requirement under the Standards in Schools etc. Act 2000 (as amended by the Education (Scotland) Act 2016). (iii) To provide the information required to contribute to the Scottish Government’s annual report on the six NIF drivers for improvement. 21 Nov 2023 Chief Officer (Education) Education, Children and Families Committee 22-11-22 Improving outcomes standards and quality report 2021/22 https://mars.northlanarkshire.gov.uk/egenda/images/att99340.pdf Scottish Attainment Challenge This report updates on progress made in the Attainment Challenge during the latest session, and gives detail on areas of improvement within literacy, numeracy, and health and wellbeing and presents the end of academic year report as submitted to the Scottish Government. Moving forward, the SAC report will now be referred to as the SEF (Strategic Equity Fund). 21 Nov 2023 Chief Officer (Education) Education, Children and Families Committee 22-11-22 Scottish Attainment Challenge and Pupil Equity Fund update https://mars.northlanarkshire.gov.uk/egenda/images/att99342.pdf Local child poverty action report The Child Poverty (Scotland) Act 2017 places a duty on local authorities and NHS Boards to jointly develop and publish an annual Local Child Poverty Action Plan (LCPAR). The annual Child Poverty Action Report covers previous year activities and outlines future plans, in line with the statutory requirements and aligned to the Plan for North Lanarkshire. 8 Jun 2023 Chief Social Work Officer Policy and Strategy Committee 29-09-22 Tackling Poverty and Maximising the Local Authority Economic Recovery Fund https://mars.northlanarkshire.gov.uk/egenda/images/att98916.pdf https://mars.northlanarkshire.gov.uk/egenda/images/att99040.pdf Annual Report of the Chief Social Work Officer The Chief Social Work Officer (CSWO) of each local authority is required to provide an annual report and a standard template for this purpose is issued by the office of the Chief Social Work Advisor to the Scottish Government. 21 Feb 2023 --- 28 Feb 14 Nov 2023 --- 21 Nov Chief Social Work Officer Adult Care and Social Work Committee 15-02-22 Annual Report of the Chief Social Work Officer 2020/21 https://mars.northlanarkshire.gov.uk/egenda/images/att98095.pdf Page 179 of 285
Page 180
Performance report Committee meeting dates Chief Officer responsible Committee Latest version submitted to Committee Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 The North Lanarkshire CSWO report provides information on the delivery of statutory functions, and performance and improvement activity across the range of social work services over the last year. 2023 2023 --- Education, Children and Families Committee Adult Support and Protection This reports on the work carried out by social work services within Health and Social Care North Lanarkshire, in respect of the council’s statutory duties set out in the Adult Support and Protection (Scotland) Act 2007. The Adult Support and Protection (Scotland) Act 2007 set up multi-agency Adult Protection Committees (APCs) in every council area. The committee monitors and reviews what is happening locally to safeguard adults. It is made up of senior staff from many of the agencies involved in protecting adults who may be at risk. These include staff from the council, the NHS and the police. APCs are chaired by independent convenors, who cannot be members or officers of the council. APCs have a central role to play in taking an overview of adult protection activity in each council area and making recommendations to ensure that adult protection activity is effective. Adult Protection Committees are required to submit a report to Scottish Ministers every two years. 21 Feb 2023 20 Feb 2024 Chief Officer (Adult Social Work Services) Chief Social Work Officer Adult Care and Social Work Committee 08-09-20 Adult Support and Protection - Social Work annual report 2019/20 https://mars.northlanarkshire.gov.uk/egenda/images/att94418.pdf An update in terms of adult support and protection is included in the 2020/21 Annual Report of the Chief Social Work Officer 15-02-22 Annual Report of the Chief Social Work Officer 2020/21 https://mars.northlanarkshire.gov.uk/egenda/images/att98095.pdf Community payback order annual report Section 227ZM of the Criminal (Procedure) Scotland Act 1995 places a duty on local authorities to prepare an annual report outlining the operation of Community Payback Orders (CPOs). Annual reports require to be submitted both to Scottish Government and Community Justice Scotland by the end of each October. This report summarises activity undertaken in relation to the supervision of CPOs in North Lanarkshire over the past year, the ongoing development of the service, and the progress secured against agreed targets. 21 Nov 2023 Chief Social Work Officer Education, Children and Families Committee 22-11-22 Annual report - Community Payback 2021/22 https://mars.northlanarkshire.gov.uk/egenda/images/att99332.pdf Financial inclusion service activity annual report This report provides details of the income maximisation work carried out by the tackling poverty team in the last year. Also covered within the report is the activity undertaken by the external services commissioned by the council under the commissioning model. 18 Aug 2023 Chief Social Work Officer Wellbeing and Tackling Poverty Committee 22-08-22 Financial Inclusion Team activity report 2021/2022 https://mars.northlanarkshire.gov.uk/egenda/images/att98421.pdf Community learning and development This report provides an overview of the performance of the community learning and development service during the latest year. It also highlights details of service provision and the impacts on North Lanarkshire communities, with an emphasis on engagement with vulnerable people living in the lowest 20% data zones. 21 Aug 2023 Chief Social Work Officer Communities Committee 22-08-22 Report on progress in relation to community learning and development activity https://mars.northlanarkshire.gov.uk/egenda/images/att98419.pdf Health and Social Care North Lanarkshire annual performance report The Public Bodies (Joint Working) (Scotland) Act 2014 requires the Integration Joint Board to publish an Annual Performance Report, setting out an assessment of performance in planning and carrying out those functions for which it is responsible. With the cessation of the emergency legislation, Annual Performance Reports for 2022/23 will revert to the original statutory timescale. (15 Feb 2023) 20 Sept 2023 Head of Planning, Performance, and Quality Assurance Integration Joint Board (Performance, Finance, and Audit Committee) 08-12-21 Annual Performance Report 2020‐21 https://mars.northlanarkshire.gov.uk/egenda/images/att97549.pdf Quality assurance annual report The role of quality assurance covers a range of functions across social work by facilitating the delivery of high-quality services through effective business planning, maintaining quality standards and quality monitoring information. A commitment is in place to provide an annual report on activity carried out in the preceding year. --- 16 Feb 2023 14 Nov 2023 --- --- 15 Feb 2024 Head of Planning, Performance, and Quality Assurance Adult Care and Social Work Committee --- Audit and Scrutiny Panel 15-11-22 Quality assurance annual report https://mars.northlanarkshire.gov.uk/egenda/images/att99223.pdf Community asset transfer and participation requests annual report 21 Aug Chief Officer Communities 23-08-21 Page 180 of 285
Page 181
Performance report Committee meeting dates Chief Officer responsible Committee Latest version submitted to Committee Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 This report fulfils the legislative requirements as set out in Parts 3 and 5 of the Community Empowerment (Scotland) Act 2015 which requires relevant authorities to publish an annual report setting out the number of requests received and the outcome of these. 2023 (Strategic Communicatio n and Engagement) Committee Community Asset Transfer and Participation Requests - annual report 2020-21 https://mars.northlanarkshire.gov.uk/egenda/images/att96621.pdf Locality planning year-end report The Community Empowerment (Scotland) Act 2015 requires Community Planning Partnerships (CPPs) to identify and understand priority communities experiencing the most significant levels of inequality. CPPs are required to agree a framework for partnership action to develop targeted, partnership interventions and approaches through working with local communities set out and articulated though Locality Plans. This report outlines the progress achieved via Locality Planning in North Lanarkshire. 21 Aug 2023 Chief Officer (Strategic Communicatio n and Engagement) Communities Committee 24-08-20 Locality planning year-end report https://mars.northlanarkshire.gov.uk/egenda/images/att94257.pdf Community grants annual report The community grants scheme exists to provide small amounts of funding to community and voluntary organisations operating in North Lanarkshire. The purpose of this report is to provide details of the applications submitted for funding from the community grants scheme during the latest year and the awards made. 21 Aug 2023 Chief Officer (Strategic Communicatio n and Engagement) Communities Committee 23-08-21 Community Grants - annual report 2020/21 https://mars.northlanarkshire.gov.uk/egenda/images/att96620.pdf End of year absence statistics This reports on the council’s year-end outturn position (including teachers and local government employees) for the average FTE days lost per employee due to sickness absence. 3 Oct 2023 Chief Officer (People Resources) JCC for Local Government Employees 26-10-22 End of year absence statistics 2021/22 https://mars.northlanarkshire.gov.uk/egenda/images/att99108.pdf Public Sector Equality Duties Every two years public bodies covered by the Public Sector Equality Duties (PSED) are required to publish a number of reports and information to evidence how they are meeting the needs of people whose characteristics are protected by the Equality Act 2010 - the PSED (General Duty). 5 May 2023 --- 8 Jun 2023 Chief Officer (People Resources) Wellbeing and Tackling Poverty Committee --- Policy and Strategy Committee 03-06-21 Public Sector Equalities Duty https://mars.northlanarkshire.gov.uk/egenda/images/att96170.pdf Freedom of Information annual report This report provides details of the number of Freedom of Information (FOI) and Environmental Information Requests (EIR) received by the council during the previous financial year and those completed by the statutory deadlines and also provides further comparative and ancillary information. 22 Nov 2023 Chief Officer (Legal and Democratic) Finance and Resources Committee 30-11-22 Annual Freedom of Information report financial year 2021/22 https://mars.northlanarkshire.gov.uk/egenda/images/att99389.pdf Registration service performance This report provides an update on the performance of the registration service, for the latest calendar year. The performance of the Registration Service provided is monitored annually by the District Examiners from National Records of Scotland. Note, production of this report relies on the timely receipt of the respective performance data from the NRS. 1 Mar 2023 Chief Officer (Legal and Democratic) Finance and Resources Committee 20-04-21 Registration performance report for 2020 https://mars.northlanarkshire.gov.uk/egenda/images/att96131.pdf Annual data protection report This reports on the council’s data protection compliance and activity for the latest financial year in lined with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) which came into force on 25 May 2018. The report is from the council’s Data Protection Officer (DPO) and provides an update, following the introduction of the legislation, in relation to data sharing, breaches, complaints, and training. 1 Mar 2023 Chief Officer (Legal and Democratic) Finance and Resources Committee 28-05-20 Annual Data Protection report financial year 2019/20 https://mars.northlanarkshire.gov.uk/egenda/images/att94014.pdf Senior Information Risk Owner (SIRO) annual report This report provides an update relating to the responsibilities of North Lanarkshire council’s Senior Information Risk Owner (SIRO) and outlines activity and performance elated to information governance. It provides assurances that information risks are 16 Feb 2023 Chief Officer (Business and Digital) Audit and Scrutiny Panel 09-12-21 Senior Information Risk Owner (SIRO) - proposed information governance assurance and performance report (2019/20 and 2020/21) https://mars.northlanarkshire.gov.uk/egenda/images/att97501.pdf Page 181 of 285
Page 182
Performance report Committee meeting dates Chief Officer responsible Committee Latest version submitted to Committee Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 being effectively managed; what is going well, and where improvements can be made. It complements the data protection annual report by the council’s Data Protection Officer (DPO). North Lanarkshire Community Planning Partnership - annual report The Community Empowerment (Scotland) Act 2015 introduced a range of new requirements on local authorities and community planning partners to empower and strengthen community involvement in the design, planning and delivery of local services. The statutory duty of community planning requires all public sector agencies to work collaboratively in agreeing both strategic and local priorities for their areas to improve outcomes and address poverty and inequalities. Community Planning Partnerships must also annually review and report on their progress. 6 Feb 2023 Chief Officer (Business and Digital) Communities Committee 30-09-21 North Lanarkshire Community Planning Partnership - Improvement Plan Update and Future Reporting https://mars.northlanarkshire.gov.uk/egenda/images/att96876.pdf Public Sector Duties Climate Change annual report As part of its climate change duties, the council is required to complete an annual submission to demonstrate that as a public sector organisation it is contributing to the nationally set climate change targets as well as adhering to its other responsibilities in terms of both adaptation and sustainability. 8 Feb 2023 Chief Officer (Assets and Procurement) Environment and Climate Change Committee 09-02-22 Public Sector Duties Climate Change Report 2020/2021 https://mars.northlanarkshire.gov.uk/egenda/images/att97672.pdf Annual procurement report This report discharges the council’s duties in terms of the Procurement Reform (Scotland) Act 2014, to prepare an annual report on its regulated procurement activities. 13 Sept 2023 Chief Officer (Assets and Procurement) Finance and Resources Committee 14-09-22 Annual Procurement Report 2021/22 https://mars.northlanarkshire.gov.uk/egenda/images/att98654.pdf Revenues and benefits update report This report provides an update on the payment performance for council tax and non- domestic rates and the administration of welfare benefits and Council Tax Reduction Scheme. 1 Mar 2023 24 May 2023 13 Sept 2023 22 Nov 2023 28 Feb 2024 Chief Officer (Finance) Finance and Resources Committee 30-11-22 Revenues and Benefits update https://mars.northlanarkshire.gov.uk/egenda/images/att99378.pdf Treasury Management annual activity report This report fulfils the key requirements of the council’s reporting procedures for Treasury Management in accordance with the CIPFA Code of Practice on Treasury Management and the CIPFA Prudential Code for Capital Finance in Local Authorities and reports on the council’s performance in complying with the mandatory prudential indicators. 13 Sept 2023 Chief Officer (Finance) Finance and Resources Committee 14-09-22 Treasury Management Annual Activity Report - 2021/22 https://mars.northlanarkshire.gov.uk/egenda/images/att98651.pdf Financial monitoring report - council summary (revenue) This report presents the council’s revenue monitoring position for the General Fund Account, Housing Revenue Account, and Adult Health and Social Care. 1 Mar 2023 24 May 2023 13 Sept 2023 22 Nov 2023 28 Feb 2024 Chief Officer (Finance) Finance and Resources Committee 30-11-22 Revenue monitoring report - council summary 1 April to 18 September 2022 https://mars.northlanarkshire.gov.uk/egenda/images/att99380.pdf Financial monitoring report - council summary (capital) This report presents the council’s capital monitoring position for the council’s capital programmes, including general services, housing revenue account, City Deal, etc. 1 Mar 2023 24 May 2023 13 Sept 2023 22 Nov 2023 28 Feb 2024 Chief Officer (Finance) Finance and Resources Committee 30-11-22 Capital programme 2022/23 monitoring report https://mars.northlanarkshire.gov.uk/egenda/images/att99387.pdf Financial monitoring - savings This report provides an update on the achievement of the three-year financial savings targets and progress in implementing one-off investment priorities. 1 Mar 2023 24 May 2023 13 Sept 2023 22 Nov 2023 28 Feb 2024 Chief Officer (Finance) Finance and Resources Committee 14-09-22 Review of 2022/23 budget savings https://mars.northlanarkshire.gov.uk/egenda/images/att98648.pdf Annual accounts The Local Authority Accounts (Scotland) Regulations 2014 require the council to prepare an annual Statement of Accounts in accordance with proper accounting practices. These regulations also required that, as a committee of the authority whose remit includes audit or governance functions, the Audit and Scrutiny Panel meet to consider the audited annual accounts with the aim to approve these for signature no later than 30th September, and to publish these by 31st October immediately following the financial year to which they relate. Note, statutory Annual Accounts timescales means that a special meeting of the Audit and Scrutiny Panel often requires to be set. Unaudited - date tbc Audited - date tbc Chief Officer (Finance) Audit and Scrutiny Panel 27-10-22 Annual Accounts 2021/22 (Audited) https://mars.northlanarkshire.gov.uk/egenda/images/att99220.pdf Page 182 of 285
Page 183
Performance report Committee meeting dates Chief Officer responsible Committee Latest version submitted to Committee Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 Scottish Road Works Commissioner annual road works performance review The Scottish Road Works Commissioner oversees improvements to the planning, co- ordination, and quality of road works by both local authorities and statutory undertakers in Scotland. The council has a statutory duty under section 118(1) of the New Roads and Street Works Act 1991, to co-ordinate the execution of works of all kinds in roads for which they are responsible: (a) In the interests of safety. (b) To minimise inconvenience to persons using the road. (c) To protect the structure of the road and integrity of apparatus in it. This report will present details of the Scottish Road Works Commissioner’s annual performance review in terms of how well the council is meeting its statutory obligations. X Chief Officer (Community Operations) - - Arm’s length external organisation (ALEO) reporting The council is required to report on the performance of its ALEOs, including financial performance. These reports (listed below) are presented to the Committee linked to the ALEO’s client service: Amey Public Services LLP The council created the roads, street lighting, and winter maintenance services LLP in 2010, following a tender exercise for a strategic partner to deliver such services over a ten year period. The successful bidders were Amey Local Government Limited and the contract commenced on 14 December 2010. Amey LG Ltd (now Amey Public Services LLP) owns a 67% shareholding in the strategic partnership with the council owning the remaining 33%. 3 May 2023 1 Nov 2023 Chief Officer (Community Operations) Environment and Climate Change Committee 09-11-22 Amey Public Services LLP: Operational and Financial Performance Monitoring Report for 01 October 2021 to 30 September 2022 and Financial Performance to 31 July 2022 https://mars.northlanarkshire.gov.uk/egenda/images/att99185.pdf Mears LLP In 2010 Morrisons Facilities Services Ltd successfully bid to become the council’s strategic partner to deliver housing and corporate repairs over a 10- year period with the contract commencing on 21 January 2011. Mears PLC subsequently bought Morrisons Facilities Services Ltd as a going concern, so now own the 67% shareholding in the Mears Scotland LLP (Mears) strategic partnership and the inherent North Lanarkshire service contract. The council owns the remaining 33% of Mears Scotland LLP. 15 Feb 2023 30 Aug 2023 14 Feb 2024 Chief Officer (Housing Property Services) Housing Committee 31-08-22 Mears LLP: Operational and Financial Performance Monitoring Report to 30 June 2022 https://mars.northlanarkshire.gov.uk/egenda/images/att98397.pdf Saltire Following approval by Committee in March 2017, the sale of the council’s 33% shareholding in Saltire was concluded in May 2017. The works agreement would govern the Central Heating Repairs and Maintenance Delivery service, also being varied to maintain the benefits and protections which the council had previously enjoyed from its shareholding until expiry on the contract in January 2021 and agreed extensions that have been approved at Committee. In relation to the contract extension, Saltire are now in the second year, this commenced on 8 January 2022 until 7 January 2023. The third year has been approved at committee (from 8 January 2023 to 7 January 2024). 15 Feb 2023 30 Aug 2023 14 Feb 2024 Chief Officer (Housing Property Services) Housing Committee 31-08-22 Saltire Performance Report to 30 June 2022 https://mars.northlanarkshire.gov.uk/egenda/images/att98398.pdf North Lanarkshire Properties NLP LLP is a limited liability partnership established in 2013 between the council and its wholly owned company, North Lanarkshire Property Investments Ltd. NLP LLP undertakes the marketing, leasing, and management of the council’s commercial property portfolio (shop units, office accommodation, business centres, industrial yards, and storage units) and, on behalf of the Council, manages legacy properties which remain in the council’s investment property portfolio. It also delivers services in relation to externally owned properties that the council leases for its own operational use and provides general advice on lease transactions. 24 May 2023 22 Nov 2023 Chief Officer (Assets and Procurement) Finance and Resources Committee 30-11-22 North Lanarkshire Properties LLP – Performance Indicators: 13 January 2022 – 27 July 2022 and Financial Performance as at 22 July 2022 https://mars.northlanarkshire.gov.uk/egenda/images/att99391.pdf Page 183 of 285
Page 184
Performance report Committee meeting dates Chief Officer responsible Committee Latest version submitted to Committee Cycle 1 Jan - Mar 2023 Cycle 2 Apr - Jun 2023 Cycle 3 Aug - Sept 2023 Cycle 4 Oct - Dec 2023 Cycle 1 Jan - Mar 2024 Fusion Assets Fusion Assets is a wholly owned subsidiary of the council. It focuses on delivering physical economic regeneration projects across North Lanarkshire and in particular industrial development - a market where there is currently limited speculative development. Unlike more traditional council owned property companies, Fusion Assets is more similar to an urban regeneration company whose role is focused on the redevelopment of vacant and derelict land and brownfield sites rather than commercial property management. 11 May 2023 6 Nov 2023 Chief Officer (Place) Enterprise and Fair Work Committee 18-11-22 Fusion Assets Performance and Financial Monitoring Report https://mars.northlanarkshire.gov.uk/egenda/images/att99315.pdf Routes to Work Routes to Work, established in 2002, is a company limited by guarantee with charitable status which is wholly owned by the council. The organisation provides a range of free employability services to North Lanarkshire residents and specialises in providing case worker support to unemployed residents as well as support with accessing vocational training and the short-term costs associated with moving from benefits to employment, such as childcare and travel. 11 May 2023 6 Nov 2023 Chief Officer (Education) Enterprise and Fair Work Committee 04-11-21 Routes to Work Ltd - Performance Report (Quarter 4 2020/21 and Quarter 1 2021/22) https://mars.northlanarkshire.gov.uk/egenda/images/att97126.pdf X Reports are required for public reporting or regulatory purposes, and are not submitted to committee. Page 184 of 285
Page 185
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref KH/JL Date 16/02/23 PoW:075.1 - Arm’s Length External Organisations: Governance and Risk Management Oversight and Assurance Report 2022/23 From Chief Officer (Business and Digital) E-mail Hassellk@northlan.gov.uk Telephone 07903 096 121 Executive Summary Critical frontline services, including road and street lighting repairs; repairs to council homes and properties; employability support and training, especially for those furthest from the labour market; and business support, through commercial property letting and major industrial investments, are delivered on behalf of the council by arm’s length bodies and partnership agreements that have developed over a significant number of years. Given the importance of these services and the levels of investment, it is imperative that the council has robust oversight of governance, financial stewardship and management arrangements within each of these companies and can assure itself that they are all delivering services on the council’s behalf that meet contractual requirements, satisfy the council and customers’ needs and expectations and are delivered to a high standard. Consideration of this report by the Audit and Scrutiny Panel is a key element in the council’s Strategic Performance Framework. It provides the mechanism for elected members to scrutinise ALEOs’ effectiveness, value for money, governance and risk management arrangements in line with the Panel’s approved Terms of Reference. This composite report provides the six monthly overview of ALEOs’ governance, financial governance, risk management and service delivery arrangements. Importantly it highlights, through the inclusion of individual updates on each company, how they are being impacted by and responding to the cost of living crisis, inflationary pressures and labour shortages. Recommendations The Audit and Scrutiny Panel is request to: 1) Acknowledge that ALEO governance, performance reporting and financial monitoring arrangements are progressing satisfactorily; 2) Confirm that the performance monitoring and oversight arrangements are suitably robust and provide assurance that service delivery reflects Best Value; 3) Agree that a full report on Routes to Work’s performance, as at year end 2021/22 and year to date in 2022/23, should be submitted to the Enterprise and Fair Work Committee at its meeting on 11 May 2023; 4) Endorse the potential for liaison and engagement between the council and ALEOs to explore where current labour shortages and opportunities for AGENDA ITEM 13 Page 185 of 285
Page 186
1. Background 1.1. North Lanarkshire Council has traditionally developed a number of innovative service delivery arrangements through the establishment of Arm’s Length External Organisations – delivering services in ways that are more responsive or commercially focused and creating opportunities to generate additional resources or income. 1.2. The number of Arm’s Length External Organisations (ALEOs) has reduced in recent years following service review activity and/or changes in the external operating environment which identified that the outsourced delivery method no longer represented best value for the council. Despite these reductions, however, significant responsibility for frontline service delivery continues to be channelled through council ALEOs, joint ventures and statutory partnerships. As such, the council has a statutory responsibility and is required under our ‘Following the Public Pound’ obligations to ensure that the organisations delivering services on our behalf have robust governance and accountability arrangements in place, are financially sound and that services meet the council’s requirements and specification and are delivered to a high standard. 1.3. This composite report provides assurances into the ALEOs’ governance, financial governance and risk management arrangements. Oversight and scrutiny by this Panel is an integral element of the council’s wider approach to monitoring the ALEOs’ performance; outcomes; financial stewardship and compliance with the individual contractual agreements in place between the council and each company. 2. Report Types of Organisation/Joint Venture/Partnership 2.1. The portfolio of council business and statutory functions delivered by ALEOs, joint ventures and strategic partnerships is varied and the well-established service delivery arrangements reflect partnership working and contractual agreements that have built up over the past 20+ years. The individual legal entities include limited companies and partnerships, such as Routes to Work Ltd, where the council is sole shareholder; joint venture companies where the council has a 33.33% shareholding in each company; and statutory public bodies. employment and training may be developed as part of the Workforce for the Future Strategy The Plan for North Lanarkshire Priority Improve North Lanarkshire's resource base Ambition statement (21) Continue to identify and access opportunities to leverage additional resources to support our ambitions (25) Ensure intelligent use of data and information to support fully evidence based decision making and future planning Page 186 of 285
Page 187
ALEOs – where the company(ies) are wholly owned by the council through 100% shareholding Established • Routes to Work Limited (Ltd) Employability services, including training and support programmes delivered on behalf of the Scottish and UK Governments, often targeting people who are furthest from the labour market or are looking to upskill or return to work after a period of unemployment or redundancy. 2002 • North Lanarkshire Properties LLP and North Lanarkshire Property (Investments) Ltd Responsible for marketing, leasing and managing the council’s commercial properties. NLP also manages the remaining balance of the council’s investment property - the “legacy estate” and provides general advice on wider lease transactions, including managing lease arrangements where the council occupies externally owned properties. 2012 • Fusion Assets Ltd Economic regeneration and infrastructure investment, particularly in areas where there is little speculative development. Fusion Assets works in partnership with the council to secure Scottish Government Vacant and Derelict Land Funding and Regeneration Capital Grant Funding and regularly maximises the potential and value of this through innovative private sector funding agreements. 2006 Joint Venture Companies – formal partnership arrangements where the council has 33.33% shareholding, and the parent company holds the remaining 66.66% • MEARS Scotland Limited Liability Partnership (LLP) Housing repairs. Corporate properties’ repairs and maintenance. 2010 • Amey Public Services LLP Roads and streetlighting repairs. Winter maintenance including gritting and snow clearing. 2010 2.2. The council appoints elected members and Chief Officers to serve as directors or representatives on the Boards or Management Committees of each of the above. These appointments, which are subject to council approval, help to ensure robust governance and oversight and promote opportunities for collaboration and partnership working between the council and individual companies. Elected members and Chief Officers bring personal skills, knowledge and experience, adding value to the organisation’s decision making and ensuring that the individual companies’ business objectives are aligned with The Plan for North Lanarkshire and are consistent with the council’s overall aims and duties. Elected members are also able to draw on their constituency knowledge and experience to ensure that services reflect local needs and priorities. Statutory Bodies 2.3. In addition to the above, the council also appoints elected members to serve on the Boards of the following statutory public bodies: Page 187 of 285
Page 188
2.3.1. Health and Social Care North Lanarkshire; 2.3.2. Lanarkshire Valuation Joint Board; and 2.3.3. Strathclyde Partnership for Transport and Strathclyde Concessionary Travel Scheme. 2.4. These have been established through separate pieces of legislation to deliver services across a wider geographical area or in ways that increase joint working by combining previously discrete responsibilities. Ongoing ALEO Winding-up and Strike-Off Activity 2.5. As reported previously to Panel members in September 2022, the council is in the process of winding-up the affairs of Culture and Leisure North Lanarkshire Ltd (and North Lanarkshire Leisure Ltd) and North Lanarkshire Municipal Bank Limited prior to dissolution and application for formal and strike-off. Culture and Leisure North Lanarkshire (NL) Limited 2.6. The cultural and leisure services previously provided by Cultural and Leisure NL (CLNL) Ltd have been in-sourced since April 2021 based on the findings and recommendations from a series of reviews between 2017 and 2020 which concluded that in-sourcing presented the greatest opportunity for alignment with the council’s ambitions and The Plan for North Lanarkshire. Due diligence activity, including approval and filing of the financial accounts and annual report for 2021/22 with Companies House is continuing, as described more fully at paragraphs 2.16 to 2.18, and the intention is that dissolution and application for strike-off will be completed within this calendar year. North Lanarkshire Municipal Bank Limited 2.7. The council decision to close North Lanarkshire Municipal Bank Ltd was based on significantly heightened anti-money laundering and anti-financial crime safeguards introduced in recent years and the substantial levels of investment that would be required to ensure full compliance, alongside the council’s own review which had previously identified a declining customer base and limited opportunities to introduce more modern, digital banking services. As such the Bank ceased to provide accounts for new customers from October 2021 and closed to existing customers on 30 September 2022. The focus now is on: 2.7.1. Continuing to publicise, via various communication methods, that remaining account holders who had not come forward to close their accounts before the Bank’s closure can submit closure requests via the council’s First Stop Shops, whilst the council is simultaneously safeguarding these monies by holding the remaining funds on behalf of the NLMB customers; and, 2.7.2. Progressing with all banking and statutory requirements in advance of company dissolution and application for strike-off. 2.8. Appendix 1 provides a summary of the council’s ALEO landscape including details of council appointments and service committee reporting, described more fully below. Monitoring, Oversight and Performance Reporting 2.9. The council’s monitoring and oversight arrangements are well-established with performance, including financial performance, reported to the relevant service Page 188 of 285
Page 189
committee every six months and a nominated Client Officer in place to ensure that service delivery is responsive, effective and to a high standard and that the council’s expectations are being met. 2.10. The council is also required by the Code of Practice on Local Authority Accounting to disclose its interest when preparing our annual statutory accounts in companies where the council has a controlling influence or has the potential to exert ‘control or influence’ through levels of funding or representation on the Board. 2.11. The diagram below illustrates the inter-connected monitoring arrangements in place. 2.12. The level and frequency of performance reporting is proportionate based on the scale of activity and potential level of risk for the council. As such, annual oversight reports on the statutory public bodies, Strathclyde Partnership for Transport (including Strathclyde Concessionary Travel Scheme) and Lanarkshire Valuation Joint Board, are submitted to the Environment and Climate Change and Regulatory Committees respectively given that these bodies are already subject to separate legislation, scrutiny and public accountability in their own right. 2.13. Health and Social Care North Lanarkshire’s Integrated Joint Board (IJB) has its own monitoring and oversight arrangements in place through its Performance, Audit and Finance Committee (click on link). 2.14. ALEO reporting is included in the Strategic Performance Framework reported separately to the Panel on this agenda. Financial Governance 2.15. The council has a duty under it’s “Following the Public Pound” obligations to ensure that the external organisations delivering services on its behalf are financially sound. The Chief Officer of Financial Solutions, as the council’s Section 95 Officer, is responsible for maintaining appropriate and proportionate processes and procedures for scrutinising ALEOs’ financial performance. The individual contractual arrangements specify the financial information which each ALEO must submit to the Page 189 of 285
Page 190
council, and this enables Financial Solutions to assess and report on any potential financial risk likely to arise as a result of the council using the ALEO to deliver services. The following paragraphs highlight, by exception, financial matters that require close monitoring by the individual ALEOs’ Board of Directors or Management Committees, along with robust, separate oversight by Financial Solutions. Culture and Leisure NL (CLNL) Ltd 2.16. Following service insourcing from 1 April 2021, the focus of activity shifted to winding- up the business and affairs of the predecessor providers Culture and Leisure North Lanarkshire (CLNL) Ltd and North Lanarkshire Leisure (NLL) Ltd. 2.17. The statutory accounts for 2021/22 for CLNL, NLL and both Trading Community Interest Companies were approved by the Board in December 2022 and submitted to OSCR and Companies House. 2.18. CLNL Ltd has now received confirmation from HMRC that the VAT de-registration is complete. The final requirement is to agree with all parties the treatment of a small number of insurance claims that remain outstanding, and this is being prioritised to enable the dissolution and striking-off process to be completed for CLNL and NLL. North Lanarkshire Properties LLP (NLP) 2.19. North Lanarkshire Properties (NLP) are affected by supply chain labour shortages and inflationary pressures which have impacted the property and construction industry in the last six months. There is a potential risk that these delays will impact on the timescales relating to re-letting properties. 2.20. NLP are further monitoring the impact of the cost of living crisis and current inflation rates (in particular energy costs) in the current market. Any impact is reported to the Management Committee together with corresponding management action. 2.21. In light of the cost of living crisis the company’s lender has agreed to extend the Covenant ratio rates, per the Facilities Agreement, to 31 October 2023 to ensure covenant compliance reporting. 2.22. NLP are currently reviewing the company’s 5 year Investment Plan. As a business NLP are having to align the medium to long term investment plan with market conditions and where possible this will continue to be funded by long term rent reviews. 2.23. A project team has been established to support the company in securing refinancing of the remaining outstanding loan balance (approximately £33m) from 1 November 2023. A procurement exercise to obtain professional advice and support on general and specific matters and considerations in relation to the Company’s future borrowing requirements was undertaken, with Azets Holding Limited successfully appointed. Amey Public Services LLP 2.24. The sale of the Amey Group has now been concluded. The company has been acquired by One Equity Partners and Buckthorn Partners. Following a review of the potential risks associated with sale, the council has concluded that there are no material risks to the council or the council’s shareholding in the joint venture company, Amey Public Services LLP. Page 190 of 285
Page 191
Routes to Work Limited 2.25. An in-year risk associated with an unexpected vacancy in position of Interim Finance Manager position led to some delays in information being prepared timeously, however, this issue has now been resolved through the appointment of a new interim Finance Manager in December 2022. 2.26. The council’s Financial Solutions team have previously highlighted high levels of unrestricted reserves held by Routes to Work. However, several contingent liabilities are being held against these reserves reducing this value to a potential target of £25k. The impact of liabilities materialising will need to be monitored throughout the year by Routes to Work to ensure the reserves position does not outturn as a negative balance and Financial Solutions will maintain separate oversight seeking clarification from the charity on any potential areas of concern. ALEO Oversight and Assurance Update 2.27. Service delivery and business operations have now largely returned to pre-pandemic models across all ALEOs. While the majority of companies have introduced hybrid operating models where appropriate, with a balance of home working and office, depot or on-site attendance, MEARS Scotland LLP has fully returned all employees. MEARS retains capacity and the technological infrastructure, however, to reinstate hybrid working or emergency responses should a critical situation materialise. 2.28. Council appointments to the outside bodies’ Boards and Management Committees following recent retirals through Delivering for Communities, the elections in May 2022 and the more recent deletion of the former Head of Environmental Assets’ post are now implemented and induction training sessions and briefings have been provided to the new appointees. 2.29. Individual updates on the wholly owned ALEOs and joint venture companies that are within the scope of this Panel are provided at Appendix 2. These describe in detail governance, risk management and business continuity arrangements within each company. The updates also summarise activity by the individual companies to return to ‘business as usual’, however this is within a significantly changed and extremely fluid operating environment that sees labour shortages and ongoing supply chain issues, further compounded more recently through inflationary pressures, continuing high fuel and energy costs and the cost of living crisis. The updates describe how these issues are impacting on company business and trading and also highlight revisions to existing working practices, including increased support for employees who are experiencing cost of living hardships, to mitigate the impact of external challenges and resource pressures. 2.30. From the ALEO summaries attached at Appendix 2 it is clear that labour shortages are continuing to impact not just the individual companies themselves, as described by Routes to Work, MEARS and Amey, but also within the sub-contractor and supply chain sectors as described by North Lanarkshire Properties. To this end, an opportunity exists to ensure that the council, through its Workforce for the Future Strategy, Routes to Work and the Built Environment Skills Academy, is liaising with the ALEOs and joint venture companies to identify labour and skills shortages and examine where potential training, apprenticeship and employment pathways can be further developed. 2.31. Performance monitoring and oversight by service committees following changes to the Council’s Scheme of Administration is largely now all in place and reflected in the Page 191 of 285
Page 192
Strategic Performance Framework’s reporting schedule. It should be noted, however, that Routes to Work’s 2021/22 year-end performance reporting, alongside year-to- date reporting in 2022/23 remains outstanding. This is due to revisions to the Scheme of Administration coinciding with full implementation of the Delivering for Communities restructure from 1 April 2022 and the transfer of responsibility for employability services. A full report on Routes to Work’s performance, including financial performance, in 2021/22 plus a year-to-date report on performance in this financial year will be submitted to the Enterprise and Fair Work Committee at its meeting on 11 May 2023. 3. Measures of success 3.1. The following measures of success are highlighted for Panel members’ consideration: 3.1.1. Arm’s length service delivery providers continue to deliver high quality public services that achieve Best Value for the council. 3.1.2. Effective and timely monitoring and reporting to relevant service committees and this Panel provide assurance to the council that adequate governance, financial and risk management procedures are operating effectively in each of the ALEOs. 3.1.3. Panel members have adequate assurance that the council is fulfilling its ‘Following the Public Pound’ obligations and the externalised service delivery mechanisms are delivering services as per the council’s requirements and expectations with minimal risk to the council, or effectively managing risks where such are unavoidable. 3.1.4. Robust due diligence and legislative compliance continue to be prioritised in the winding-up and subsequent applications for strike-off in respect of Culture and Leisure NL Ltd and North Lanarkshire Municipal Bank Ltd. 4. Supporting documentation 4.1 Appendix 1: Summary of in-scope ALEOs and Strategic Partnerships 4.2 Appendix 2: ALEOs’ Governance, Service Delivery, Risk and Business Continuity Oversight Summaries Katrina Hassell Chief Officer (Business and Digital) Page 192 of 285
Page 193
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☒ No ☐ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact Financial management within the ALEOs is reported to the service committees, as outlined in Appendix 1, every six months with the exception of the statutory public bodies which are subject to separate reporting within in their own right and described at paragraphs 2.12 and 2.13. In addition, the contractual arrangements in place between each entity and the council require the individual companies to submit monthly management accounts and additional information such as Business Plans and annual accounts to the council’s Section 95 Officer. This information enables Financial Solutions to assess and report any financial risk likely to arise as a result of the council using the ALEO to deliver these services. Financial governance, including any potential risks are reported to this Panel by exception allowing members to identify any additional controls which require to be implemented in addition to continued financial monitoring by the individual ALEOs and Financial Solutions. 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Proposed revisions to company Articles of Association, Partnership Agreements or Service Level Agreements are reviewed by the Chief Officer (Legal and Democratic) during the initial consideration and drafting stages with final proposals subject to council approval through the relevant Service Committee and full Council where required. Page 193 of 285
Page 194
5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☒ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Individual ALEOs are responsible for identifying and managing risks and reporting these to their Boards and Management Committees. In addition the council has identified the risks associated with service delivery via an external body and these are captured and monitored through Business and Digital’s Service Risk Register. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 194 of 285
Page 195
Appendix 1 Summary of in-scope ALEOs and Strategic Partnerships WHOLLY OWNED ALEOs OBJECTIVES / SERVICES DELIVERED STATUS BOARD OF DIRECTORS COMPOSITION SERVICE COMMITTEE AND REPORTING Routes to Work (RtW) Ltd Relief of poverty through supporting individuals to secure and sustain employment Advance education and training, particularly where this will lead to paid employment. Incorporated as a limited company with charitable status. Council is sole shareholder (100%). Maximum of up to 10 directors of whom: • Up to 2 are Category A Directors (1 elected member & 1 chief officer) appointed by NLC; • Up to 8 are Category B Directors representative of local community or possessing key skills/experience Enterprise and Fair Work Committee. Previously reported Operational and Financial Performance as at year-end 31/03/21 and in the period 1 April to 30 June 2022 (Q1) plus proposed revisions to Articles of Association to former Enterprise and Growth Committee on 4/11/22. NLC representatives appointed to serve on the RtW Board: Provost Cllr K Duffy and Chief Officer (People Resources) Fusion Assets Ltd Physical regeneration and infrastructure projects, focusing in remediation of vacant and derelict land where there is little speculative development by the private sector and/or market failure. Incorporated as a limited company. Council is sole shareholder (100%). Maximum of up to 8 directors of whom: • Up to 5 are Partner Directors (3 elected members & 2 chief officers) appointed by NLC; • Up to 3 are Co-opted Directors possessing key skills/experience Enterprise and Fair Work Committee Previously reported operational performance to 30/9/22 plus service highlights in 2021/22 (Q3 and Q4) and 2022/23 (Q1 and Q2) along with financial performance in the period 1/4/21 to 30/6/22 and financial standing as at 30/06/22 on 18 November 2022. NLC representatives appointed to serve on the Fusion Board: Councillors B McCulloch; F McKay; and R Sullivan, plus Chief Officer (Financial Solutions) and Chief Officer (Place) North Lanarkshire Properties LLP Management, marketing and leasing of commercial property portfolio that transferred from NLC in 2013. Provision of general lease advice to NLC and management of NLC’s retained commercial properties (Legacy Estate). Incorporated as a limited liability partnership with 2 members: NLC owns a 99.999% shareholding and NL Property Investments Ltd holds a 0.001% shareholding. Maximum of 6 Management Committee members: • 5 representatives are appointed by NLC (4 elected members and 1 chief officer); • 1 representative is appointed by NL Property Investments Ltd Finance and Resources Committee Previously reported operational performance from 13/01/22 to 27/07/22, including service delivery highlights, plus 2022/23 financial performance from 01/04/22 to 22/07/22 on 30 November 2022. NL Property Investments Ltd To facilitate and support North Lanarkshire Properties LLP Incorporated as a limited company. Council is sole shareholder (100%). Maximum of 6 directors appointed by NLC (5 elected members & 1 chief officer being the same individuals as those referenced above) Finance and Resources Committee (Limited separate reporting requirement since business is transacted through the LLP above.) Page 195 of 285
Page 196
WHOLLY OWNED ALEOs OBJECTIVES / SERVICES DELIVERED STATUS BOARD OF DIRECTORS COMPOSITION SERVICE COMMITTEE AND REPORTING NLC representatives appointed to serve on the NLP Board and Management Committee: Councillors B Baudo; P Di Mascio; Provost K Duffy; T Fisher; S Watson, and Chief Officer (Housing Property Services) STRATEGIC PARTNERSHIP VEHICLES OBJECTIVES / SERVICES DELIVERED STATUS MANAGEMENT COMMITTEE COMPOSITION SERVICE COMMITTEE Amey Public Services LLP Provision of roads, street lighting and winter services contract Incorporated as a limited liability partnership with Amey LG Ltd holding a 67% shareholding and NLC holding a 33% shareholding • 5 representatives with 3 appointed by Amey LG Ltd and 2 appointed by NLC (1 elected member and 1 chief officer) Environment and Climate Change Committee Operational performance for the period October 2021 to September 2022 and financial performance to 31/07/22 reported on 9 November 2022. NLC representatives appointed to serve on the Amey Management Committee: Councillor M McPake and Chief Officer (Community Operations) MEARS Scotland LLP Provision of housing and corporate property repairs Incorporated as a limited liability partnership with MEARS plc holding a 67% shareholding and NLC holding a 33% shareholding • 5 representatives with 3 appointed by MEARS plc and 2 appointed by NLC (1 elected member and 1 chief officer) Housing Committee 2022/23 operational performance year to date and financial performance as at 31 March 2022. NLC representatives appointed to serve on the MEARS Management Committee: Councillor M Coyle and Chief Officer (Housing Management) STATUTORY PARTNERSHIPS OBJECTIVES / SERVICES DELIVERED STATUS BOARD OF DIRECTORS COMPOSITION SERVICE COMMITTEE Lanarkshire Valuation Joint Board The Assessor and Electoral Registration Officer is responsible for preparation and maintenance of the: • Register of Electors which is published at least annually; • Valuation List - listing all heritable properties within Lanarkshire for Council Tax purposes; and, • Valuation Roll - public document containing an entry for all non-domestic properties in Lanarkshire except those Established by the Valuation Joint Boards (Scotland) Order 1995 to allow for the valuation functions of North and South Lanarkshire Councils to be discharged jointly following local government reorganisation in 1996. • 16 members: 8 from North Lanarkshire Council and 8 from South Lanarkshire Council. Regulatory Committee 2020/21 Annual Oversight Report reported to Finance and Resources Committee on 10 March 2022. Page 196 of 285
Page 197
STATUTORY PARTNERSHIPS OBJECTIVES / SERVICES DELIVERED STATUS BOARD OF DIRECTORS COMPOSITION SERVICE COMMITTEE specifically excluded by law and includes the Rateable Value. • The Board also acts as a Joint Committee responsible for the electoral registration duties of both authorities. NLC representatives appointed to serve on the LVJB Board of Directors: Councillors B Burgess; L Jarvie; T Johnston; F MacGregor; A McVey; J Reddin; B Shields; A Thomas. Substitutes: Cllr N Shevlin and any SNP Member Strathclyde Partnership for Transport (SPT) SPT has a statutory duty to develop a transport strategy for its region taking account of: • Demographics and meeting the needs of all inhabited places; • Enhancing social and economic well-being; and • Promoting public safety and sustainable development. SPT subsidises socially necessary bus services, operates bus stations and the Glasgow subway. SPT maintains bus shelters and administers ticketing including the ZoneCard. Established under the Transport (Scotland) Act 2005 • 20 elected members representing the 12 local authorities in the West of Scotland and up to 9 appointed members. Environment and Climate Change Committee 2020/21 Annual Oversight Report reported to the former Environment and Transportation Committee on 10 November 2021. NLC representatives appointed to serve on the SPT Board of Directors: Councillors G Currie; M McPake; A Smith. Substitutes: Cllrs H Loughran and J Keltie Strathclyde Concessionary Travel Scheme Joint Committee Administers concessionary travel for the over 60s and disabled people (and in certain cases, concessionary travel for companions). • The Transport Act 1985 allows transport authorities to make concessionary transport schemes. • Strathclyde Concessionary Travel Scheme Committee was set up in 1999 to determine concessionary fares and criteria applicable for concessionary travel on subway, rail services and • One member (and one substitute member) from each of the 12 constituent councils with the SPT area plus the Chair of SPT. Environment and Climate Change Committee 2020/21 Annual Oversight Report reported to the former Environment and Transportation Committee on 10 November 2021. Page 197 of 285
Page 198
STATUTORY PARTNERSHIPS OBJECTIVES / SERVICES DELIVERED STATUS BOARD OF DIRECTORS COMPOSITION SERVICE COMMITTEE on ferry services within the Strathclyde scheme area. NLC representatives appointed to serve on the SPT Concessionary Travel Scheme: Councillor W Goldie North Lanarkshire Health and Social Care Integration Joint Board Responsible for planning and delivering all community based adult health and social care services across North Lanarkshire. For example: • Health visiting and district nursing • Community addiction services • Mental Health and Learning Disability services • Adult Social Work Services • Adult protection • Home Support Services • Community paediatrics and children’s health services The functions delegated by North Lanarkshire Council (NLC) and NHS Lanarkshire (NHSL) are detailed in an Integration Scheme which must be approved by Scottish Ministers. Established under the Public Bodies (Joint Working) (Scotland) Act 2014 and designed to improve adult health and care services through better integration and more joined-up support and care, particularly for people with complex or multiple long term conditions. • 8 voting members – 4 elected members and 4 non-executive directors appointed by NHS Lanarkshire. • Senior officers attend in a non-voting capacity along with representatives for staff, the third sector, service users and carers. Adult Care and Social Work Committee Adult Social Care Performance Report Q 1 – 2022/23 reported on 15 November 2022 NLC representatives appointed to serve on the Health & Social Care IJB: Councillors G Brennan; B Burgess; P Kelly; A Khan Page 198 of 285
Page 199
Appendix 2 ALEOs Governance, Service Delivery, Risk and Business Continuity Oversight Summaries Routes to Work Ltd Governance Board of Directors meets quarterly with dates scheduled to December 2023. The AGM was held on 9 November 2022. Separate Finance, Governance and HR Sub Groups are in place with authority to progress business as delegated to them by the Board or to consider matters in advance of submitting findings or recommendations to the Board. The Sub Groups meet quarterly mid-way between each Board cycle. The council appointed Councillor Duffy to serve on the Board with effect from 6 October 2022 and an introductory meeting has taken place providing an overview on the work of the company; current strategic direction and priorities; and high-level governance arrangements. Further induction training is planned for early 2023. Summary of Recent and Planned Service Delivery 2022/23 Staffing – Business as Usual and Hybrid Working Following the re-opening of Routes to Work offices in the early Spring 2022 with hybrid working arrangements in place, Routes to Work are currently trialling a Hybrid Working Policy which provides the facility for staff to work up to 40% of their weekly working hours flexibly (managed over a 4-week reporting period and in line with existing flexi-time arrangements). This allows staff to schedule their caseloads and manage and balance their office-based and outreach days with the opportunity to work from home. Introduced in November 2022, following Board approval in August, the Hybrid Working Policy is being trialled for one year. Staffing – 2022 Pay Award In July 2022 Routes to Work awarded a pay increase of 3% plus £300 to staff and backdated this to 1 April. Thereafter, and reflecting the enhanced pay offer made to local authority colleagues and the significant cost of living pressures being felt by all staff, a further 2022 pay award of 2.7% (based on 2021 salary scales), plus a further £300 per head (pro-rata and calculated on the number of weekly hours worked) was approved by the Board in December 2022. This results in an overall 2022 pay award of 5.7% plus £600 per head (pro-rata). Establishment As described in the previous Panel report in September 2022, Routes to Work’s management restructure to meet current operational commitments and future-proof the charity for the remaining period of the business plan is now complete. The restructure included the creation of a Strategic Growth Manager post, funded by company reserves, to grow the company’s reach and geographical footprint with the successful candidate commencing employment on 24th October. Funding for the Airdrie Central Community Engagement Project has been extended to 31st March 2023, allowing Routes to Work to extend fixed-term contracts of employment for 7 staff to continue delivery of this highly successful project. Routes to Work’s 2022/23 headcount, now stands at 86.1 Full Time Equivalent (FTE) posts. (Permanent posts – 74.6 FTE / Fixed-term posts – 11.5 FTE.) Risk Management Routes to Work’s Risk Register is reviewed quarterly by the Senior Management Team and discussed at the Governance Sub-Group. A Risk Management update report is discussed at each Board meeting. This identifies any new risks and outlines where the impact of a potential risk is considered to have heightened in terms of severity or proximity. The Risk Management report also confirms where the impact of a potential risk is considered to have become less of a threat, including the point at which the risk is deemed to be sufficiently manageable or insignificant and Page 199 of 285
Page 200
may be removed from the Risk Register. Risks are assessed using a Red, Amber and Green (RAG) methodology. The Risk Register had a full review in October 2022 with further review in January 2023. Top 5 Risks Under- performance on key contracts Failure to gain funding from UK Shared Prosperity Fund Information security breach Lack of long-term funding beyond 2022/23 Failure to deliver excellent quality of service standards to clients Business Continuity Routes to Work experienced some business continuity issues during the autumn 2022 caused by an unexpected temporary vacancy in the role of Interim Finance Manager/Company Secretary. This impacted on the charity’s financial reporting timetable. A new interim appointment was made with effect from 12th December 2022 and this will enable the Finance Sub Group to review December 2022’s management accounts at its February meeting. Routes to Work has also experienced some low-level staff shortages, caused largely by the current labour market and a rise in sickness absence levels. A deep dive was conducted into the causes and contributory factors to the increased sickness absence rate with a detailed report presented to the HR sub-group at the meeting on 8 November 2022 with mitigating actions identified and agreed. Service Developments / Highlights Cost of Living Response Routes to Work staff have been fully involved in the Cost of Living events across the area organised by the council and partnership agencies. This has been extensive, identifying the benefits of work, and fair work, as route out of poverty and aligned to the ‘Increase Income Through Employment’ driver in the ‘Towards a Fairer North Lanarkshire Tackling Poverty Strategy.’ Service Developments/Extensions Routes to Work has now been included on the council’s new four-year Flexible Framework for services linked to the Scottish Attainment Challenge and Pupil Equity Fund, ‘Delivering the Young Workforce’ (Lot 10) following a successful bid by the charity. Fusion Assets Ltd Governance The Fusion Assets’ Board of Directors meets quarterly with meeting dates scheduled to November 2023. The AGM was held on 24 November 2022. Board meetings continue to be held on a virtual basis via Teams, but it is expected that they will return to physical meetings during 2023. Following the local government elections in May 2022, three new elected members were appointed to the Board of Fusion Assets by the council. Copies of Fusion Assets’ Corporate Governance Manual were circulated to the new councillors, along with an Induction Pack and offer to undertake site visits. At the council meeting on 15 December 2022, Councillor McCulloch was appointed to the Board in place of Councillor Crichton. The Chief Officer of Place has provided background information on the company to Councillor McCulloch and Fusion Assets will provide induction information and training, as well as a tour of the Fusion Assets’ sites. Articles of Association Currently, as per the existing Fusion Assets’ Articles of Association, only Partner Page 200 of 285
Page 201
Directors (i.e. council appointees) can be included in constituting the quorum of 4 directors to permit Board meetings to take place. This requirement, which is not reflected in other wholly owned ALEOs, has on occasion led to meetings not always being quorate. As a result, the Board is currently looking to amend the Company Articles of Association to allow the three Co-Opted (private sector) Board members to be included within the quorum provisions. In addition to strengthening governance arrangements, further revisions are being drafted including the potential for directors to appoint an alternate director if they are unable to attend a Board meeting and formal provision for meetings, or participation by an individual, to be virtual. Legal and Democratic Solutions are liaising with Fusion Assets’ solicitors in ensuring that the proposed revisions are likely to be acceptable to the council - safeguarding our interests and the effectiveness and probity of the company overall. North Lanarkshire Council, as the sole member of Fusion Assets is required to approve any changes to the company’s Memorandum and Articles of Association and as such it is anticipated that the proposed revisions will be submitted to the Enterprise and Fair Work Committee at its meeting on 11 May 2023 for consideration. Summary of Recent and Planned Service Delivery 2022/23 Business as Usual and Hybrid Working Fusion Assets continues to operate in a ‘business as usual’ manner from its new office in the Muirfield Centre, Cumbernauld, on the basis of a hybrid working arrangement with staff now spending on average three – four days a week in the office. Service Developments Planned developments for 2023 include the creation of a new joint venture company at Eurocentral to construct a speculative multi-let industrial scheme at Condor Park and the construction of a new industrial building at Link Park, Newhouse directly by Fusion Assets. Construction costs continue to rise (in part impacted now by rising energy /production costs) coupled with higher borrowing costs which means that viable speculative development continues to be challenging, however, with an overall lack of supply across North Lanarkshire for modern building premises, demand remains consistently high. This is encouraging and provides a degree of optimism and as such, interest from potential occupiers is being recorded. Risk Management Overall, the main corporate and project risks to the company remain the same as previously reported in September 2022. In the short term, the overall programme delivery associated with annual grant funding awards remains a key risk area due to external factors including negotiations on site acquisitions with third parties and delays associated with obtaining statutory consents. However progress is being made with some key milestones achieved. Longer term, in the current market accessing adequate financial resources to scale up the company’s activities remains a challenge due to increased borrowing costs from private lenders and ongoing resource pressures within the public sector. Corporate Risk Reports, based on the Figtree management system used by the council, are presented to the Board on a regular basis. Outwith this, where any issues arise, the Board takes suitable action to address these issues. Top 5 Risks Programme delivery Property acquisition Contracts and procurement risks Accessing adequate financial resources Grant availability Business Continuity There have been no business continuity issues over the past six months. The appointment of the Development Manager, who is able to substitute for the Managing Director as and when required, has reduced the potential risks or continuity concerns arising through loss of personnel and/or capacity issues. Page 201 of 285
Page 202
Service Developments / Highlights Business Plan 2023 to 2025 Work on updating Fusion Assets’ Business Plan for 2023 – 2025 is underway and will incorporate recent governance changes, including the new scheme of delegation and adoption of a new Environmental, Social and Governance (ESG) Policy and Action Plan for the company. North Lanarkshire Properties (NLP) LLP and NL Property Investments Ltd Governance North Lanarkshire Properties LLP and NL Property Investments Ltd’s business are transacted at the same meetings which have now been held in-person since August 2022. Both companies’ AGMs were held on 30 September 2022 with a Management Committee and Board meeting thereafter on 17 November 2022. In line with the council’s calendar of meetings, provisional dates have been scheduled to March 2027. The senior officer position on both the Management Committee and the Board of Directors is now held by the Chief Officer (Housing Property Services) and Councillor Watson replaced Councillor Lennon in October 2022. Copies of the induction pack presented in August 2022 have been shared with the new representatives and briefings provided by the Strategic Asset Manager. Site visits will also be organised for the early spring to provide representatives with an overview of the range of properties held in NLP’s portfolio. Summary of Recent and Planned Service Delivery 2022/23 Business as Usual and Hybrid Working Hybrid working, introduced in April 2022, is continuing with NLP’s employees adopting to work for a minimum of 2 office days each week. The hybrid model works well for the organisation as there is a natural requirement for a combination of office and on-site delivery associated with the majority of the roles. Continuity of service was able to be maintained throughout Covid as a consequence of the business’s ability to deal with transactions digitally and adopt new processes to complete contractual requirements where necessary. Property Maintenance Management NLP continues to align with the council’s business model and shared ambitions. NLP has commenced the outsourcing of the Uniform database maintenance to the software designer IDOX which will alleviate the need for downtime and business critical bottlenecks that can be associated with fault rectification. This will support the finance team and technical team in maintaining continuity in support of the rent roll, new lease transactions and terminations and allay associated reputational damage associated with system downtime. Labour Shortages, Inflation and Cost Pressures Supply chain and labour shortage issues have been felt throughout the property and construction industry in the last 6 months. Lead in times and completion dates for repairs and projects are areas where the business has experienced some delays. This can have a compounded effect on timescales relating to re-letting properties. Inflation has and will continue to have an effect on budgets. The Investment Plan is currently being reviewed in order to address best value. As a business NLP must align its medium to long term Investment Plan with market conditions and where possible this will continue to be funded by long term rent reviews. Risk Management The Management Committee considers a Risk Update report at each meeting identifying the key risks facing the organisation and the actions and controls in place to mitigate the likelihood of risks materialising or their potential impact. Page 202 of 285
Page 203
Top 5 Risks IT Systems and Software Failure - leading to loss of the main reporting and management systems resulting in failure to collect rent. Business Continuity Management - staff resource levels and potential loss of staff. Planning and Resources Financial – Reduction in income due to pandemic and/or cost of living crisis. Strategic change – failure to align new strategies to change in market conditions. Financial - Inability to make loan repayments and/or change in bank covenant. Business Continuity NLP and company operations have been robust throughout the pandemic and post pandemic period and the company’s business operations align well with the hybrid working regime put in place. Some challenges have been experienced where NLP is reliant on external partner organisations who provide repairs services and monitoring and testing functions across our property portfolio. Issues are communicated via internal and external working groups and managed accordingly where service is disrupted. NLP continue to support and manage the asset management function for the council and NHS Lanarkshire via the Service Level Agreement vehicle. Most issues are resolved via one-to-one meetings or enquiries that are allocated across the Estates team. Regular meetings are held between NLP, NHS Lanarkshire and NLP’s appointed facilities management partner where issues are addressed as part of 360° action and feedback. Service by utility suppliers continues to impinge on project completion and re-letting of a small number of vacant properties, however the council’s Energy Assets Team are engaged on NLP’s behalf as and when required to help resolve issues. Service Developments / Highlights – Business Plan and Investment Plan Updates Both the Business Plan 2019 to 2023 and the company’s 5-year Investment Plan are currently under review with draft proposals being prepared for the 1st quarter in 2023. Loan Facility Agreement Refinancing North Lanarkshire Properties LLP funded its acquisition of the council’s commercial properties in October 2013 by entering into a contract with the company’s current lending provider for a £45m loan facility to finance the property transfer. The Loan Agreement was agreed for an initial 10-year period and is subject to an 80% guarantee being provided by the council. The Loan Agreement is due to terminate on 31 October 2023 and as such the company is now looking to refinance its remaining borrowing requirements. NLP has procured expert financial advice to provide specialist advice and guidance in the loan refinancing and negotiations, with the ultimate objective of enabling NLP to secure the most advantageous loan facility agreement terms and rates for the company. Amey Public Services (APS) LLP Governance Quarterly Management Committee meetings have occurred as scheduled during the reporting period and have returned to ‘in person’ meetings. Future dates for the remainder of this year have been agreed. As previously reported, the Chief Officer (Community Operations) was appointed to the Management Committee in June 2022 and in October 2022 the council appointed Councillor McPake to replace Councillor Masterton. Parent Company Sale At the end of December 2022, Buckthorn Partners and One Equity Partners acquired Amey from the existing parent company, Ferrovial. (Referenced in the Financial Assurance section of this report at paragraph 2.24.) This sale has no impact on the Limited Liability Partnership with North Page 203 of 285
Page 204
Lanarkshire Council (Amey Public Services LLP) and the Management Committee was informed on progress throughout the sale process. Council Engagement and Performance Monitoring The Senior Management Teams from Amey and the council’s Roads and Land Maintenance division meet on a monthly basis at the Roads, Street Lighting and Winter Services monthly meetings. The standing agenda includes: Contract Performance Management (including review of Performance Indicators); Financial Management; Health and Safety; Operational Service Delivery; Winter; and any issues escalated from other meetings or engagement between the council and APS. In addition, there have been regular meetings between APS and the council to discuss governance and progress with the various capital schemes being delivered by APS and highlighted in the section below. Regular dialogue is in place between Amey and the council’s Financial Solutions team, however, the schedule of joint meetings that took place prior to the pandemic has not yet been reinstated due in part to restructure within the council and the appointment of a new Finance Manager within Amey. Summary of Recent and Planned Service Delivery 2022/23 Business as Usual and Hybrid Working Amey continued to deliver both core services as per the Roads, Street Lighting and Winter Services Contract and capital schemes throughout the reporting period. Amey operational staff (frontline, supervisors and managers) continued to work from the depots to ensure safe delivery of site operations. Some office-based staff continued to work on a hybrid basis depending on personal requirements, circumstances and preferences. Staffing Over the reporting period Amey experienced some capacity pressures on its staff resources, partly as a result of the resurgence of the housing sector and partly due to the shortage of Class 1 and Class 2 goods vehicle drivers. As a result, Amey struggled to retain front-line staff due to the demand for their skills and the higher pay being offered across both these sectors. The company sought to replace these experienced resources from the available labour market and were partially successful through employing apprentices and less experienced/trained staff. This reduction in resources had an impact on delivery and productivity during the working week requiring Amey to extend to weekend working, with the additional associated overtime costs to ensure delivery of schemes for the council. Cost of Living Response Inflation and Cost Pressures The hyperinflation seen on construction materials (e.g. steel columns, road salt, road surfacing material, LED lanterns), fuel price increases and cessation of the use of red diesel has had a significant impact on the costs for APS to deliver operations for the council. This is partly dealt with by indexation/inflation indices, but these do not cover the full costs of the price increases. Discussions are ongoing with council officers in respect of individual material cost increases. Support for Employees Amey’s Employee Assistance Programme provides free and anonymous support and advice to employees across a number of areas including: financial information; family issues; legal information; medical and health information; addiction issues; relationship advice; childcare support; domestic abuse; housing concerns; and tax information; etc. This service predates the current cost of living crisis and is available to employees, their partners and dependents. Page 204 of 285
Page 205
Risk Management There is no substantial variation in Amey’s top five risks to those reported in September 2022. The Partnership Risk Register is reviewed as required at the monthly Roads, Street Lighting and Winter Services contract monitoring meetings. If there is a need for an issue/risk to be escalated to the Management Committee then this is included in the Committee Papers and discussed at the quarterly Management Committee meetings. During this current period fortnightly client meetings on winter treatments are held to ensure timely closeout and address any live issues presented in the period for redress and action, whilst assisting in positive cashflow and reducing the risk of legacy issues amassing at the end of the winter treatment period. Top 5 Risks Insufficient Revenue and Capital budgets from the council to maintain APS resource levels, productivity and utilisation. Continuing labour market pressures and competition (e.g. house builders, competitors and haulage/delivery market) attracting operational staff away from APS with higher wages. In addition, difficulty attracting new entrants to a predominantly manual labour career. Requirement to try and develop additional workstreams (either from within the council or externally) to offset any council budget constraints/reductions. Impact of hyper-inflation and changes in law which have resulted in significant increases in materials costs (e.g. steel prices, road materials prices, fuel costs, red diesel usage changes), which have not been fully reflect in contact indexation criteria. Business Continuity – While there are no significant business continuity concerns at the current time, Amey continues to monitor the conflict in Ukraine, hyperinflation and any residual after-affects from COVID (including the current winter flu virus) on an ongoing basis. Any impacts are reported at the monthly Roads, Street Lighting and Winter Services contract monitoring meetings. More generally, Amey continues to keep its Business Continuity Plan and other risk assessments under review on an ongoing basis to reflect current external and internal risks facing the Partnership. Service Developments / Highlights – ADEPT Live Labs 2 Working in partnership, Amey and the council successfully submitted the ADEPT Net Zero proposal in early October 2022 and this is now one of 10 UK wide projects shortlisted to the next round and competing for a share of the £30m funding available. The ADEPT initiative focuses on ‘Net Carbon Zero’ in the construction and maintenance of highways and local roads, as well as improving environmental impacts. Council and Amey representatives presented to the ADEPT ‘Dragons’ Den’ in November 2023 and are currently awaiting formal notification of the outcome of the application with the successful proposals due to be announced within the next three months. Capital Projects Capital schemes completed during the reporting period include: • A71 Horsley Brae junction improvement works on behalf of North and South Lanarkshire Councils and SPT. These works included construction of a sheet piled wall, road widening for a right turn filter lane at new signalised junction and realignment of Brownlee Road. • Installation of approximately 36,000 LED street lighting lanterns across residential roads and remote footpaths, alongside the installation of approximately 4,000 LED lanterns (as part of an anticipated wider programme of around 9,000 lanterns) installed across the council’s main roads. • Construction of high access kerbs to assist access to buses at approximately 35 bus laybys in Motherwell. • Footpath widening, lighting and traffic island installation works at Lancaster Avenue, Chapelhall and other traffic calming works in Chapelhall. Page 205 of 285
Page 206
• Junction improvement to Pather Drive, Wishaw. Other works ongoing at the end of the reporting period include the widening and lighting of the footway between Newhouse and Salsburgh. MEARS (Scotland) LLP Governance The Management Committee meets quarterly with the next meeting scheduled for 28 February 2023 where the remaining schedule of dates for this year will be agreed. The Chief Officer (Housing Management) continues to represent the council on the Management Committee and Cllr Coyle was appointed in June 2022. Dr Graham Paterson was appointed as Managing Directors of MEARS Scotland LLP in July 2022 and now represents MEARS on the Management Committee. Briefings and company information have been provided to the new representatives. Council Engagement and Performance Monitoring MEARS engages with the Client Monitoring Officer from Housing Property Services through four- weekly liaison meetings in addition to quarterly governance meetings focusing on Service Improvement and Customer Success Improvements. Monthly liaison meetings are also held between MEARS’s finance team and Financial Solutions. Business as Usual and Hybrid Working MEARS staff have all returned to the office on a full-time basis. All digital infrastructure remains in place ensuring that all staff have the correct kit and security protocols in place to allow a quick transition to home working should an emergency situation arise. MEARS contingency arrangements were recently tested due to a network outage in December and the transition was seamless. MEARS operating model has returned to ‘business as usual,’ continuing to work in partnership with North Lanarkshire Council to deliver all services within the contract. Cost of Living Response MEARS acknowledges the cost-of-living crisis and the difficulty that employees may experience, and the company is actively implementing initiatives to support its employees at this time. In Quarter 4 of 2022 MEARS rolled out an Energy Saving e-learning module to educate employees on energy saving tips within their own households. MEARS have also implemented an employee hardship fund which anyone who is in financial difficulty can apply to. These initiatives are actively promoted through the internal ‘MEARS Rewards’ platform and local communication strategy across the workforce and within the depot and office. Inflation and Cost Pressures MEARS are also committed to being a Scottish Living Wage employer with all employees being paid fairly in line with the scheme rules. In Quarter 1 of 2023 all employees on more recent MEARS terms and conditions will receive a flat rate pay increase of £2000 per annum. Due to the timing of the COSLA pay award negotiations, the funding award for employees who are on local authority terms and conditions will apply retrospectively. Page 206 of 285
Page 207
Health and Safety remains centric to MEARS’s operating model and the company has confirmed that it will continue to work to the approved Risk and Method Statements and procedures to ensure a safe working environment for company staff and to protect the wellbeing of tenants. Digital Field Services In September 2022 MEARS, in partnership with the council’s Business and Digital division, successfully implemented Microsoft Field Services. This provides fully integrated digital procedures for recording repairs, prioritising and allocating these and allowing the operatives to input, via hand held devices, when a repair is completed and can be closed out. The operatives also receive regular updates on the status and any additional information relating to jobs that remain outstanding. The Field Services system, which is hosted via Microsoft Dynamics, can be interrogated to provide business critical intelligence and data including for example, specific information relating to the frequency and types of repairs; geographical areas; property types; and time taken to complete repairs. This management information and trend analysis supports more informed management decision making on workloads, prioritisation and helps to identify future safety checks and maintenance requirements including cyclical maintenance. Risk Management MEARS Management Committee monitor, review and manage risks on a quarterly basis and a range of specific controls are in place for each of the risks identified below. Top 5 Risks Health and Safety breaches, particularly around additional Covid-19 safeguards. Consequences of Risk Management Failure: • Financial penalties - HSE fine; • Reputational damage; • Employee disengagement/ concern around Mears values as an employer. Resource Supply: • Labour – attraction and retention of suitably qualified labour; • Material – Market pressures on price; • Subcontractors . Partnership Finance: • Final contract year; • Demobilisation; • Council award of Enterprise Contract. Failure to comply with Data Protection legislation. Consequences of Risk Management Failure: • Fines up to 4% of Group Turnover; • Potential for criminal action; • Reputational damage / loss of confidence in the sector. Failure to provide market competitive /comparable T&Cs and pay rates. Consequences of Risk Management Failure: • Poor staff retention • Negative impact on service and failure to meet demand due to vacant posts • Not perceived as a company of choice by applicants. Business Continuity The Business Continuity Plan was updated in December 2022 to reflect MEARS’s newly implemented restructure and revisions to the key personnel who should be engaged/notified depending on the nature of event or incident. All systems are accessible remotely and data protected through MEARS’s remote desktop Virtual Private Network. Service Developments / Highlights Partnership Agreement The partnership between the council and MEARS originated in 2010 when Morrison Facilities Services Ltd successfully bid to become the council’s strategic partner to deliver housing and corporate property repairs over a ten year period. The contract commenced on 21 January 2011. Mears PLC subsequently bought Morrison Facilities Services Ltd from Anglian Water as a going concern, and subsequently own the 67% shareholding in the MEARS Scotland LLP strategic partnership and the inherent North Lanarkshire service contract. North Lanarkshire Council owns the remaining 33% of Mears Scotland LLP. Page 207 of 285
Page 208
Housing repairs, corporate property maintenance and capital investment proposals are all currently in-scope for delivery through the new North Lanarkshire Council Enterprise Project. To ensure continuity of service and enable anticipated inclusion of housing and corporate property maintenance within the North Lanarkshire Council Enterprise Project, the Housing and Regeneration Committee at its meeting on 20 May 2020 agreed that provision should made for up to three annual extensions to the strategic partnership with MEARS, taking the overall partnership duration potentially up to January 2024. Annual contract extensions, based on evidence of satisfactory performance, service delivery and overall contract compliance have continued to be awarded by the council during the intervening period with the most recent, third year and final year extension, covering the period 22 January 2023 to 21 January 2024, approved by the Housing and Regeneration Committee on 16 February 2022. Business Plan 2023/24 MEARS’s Business Plan will be reviewed and updated to reflect that the partnership has now entered the final year of the contract extension described above. It is anticipated that during 2023 the focus will shift from larger Capital works to increased routine work. Apprenticeship Programme Despite now being in the final year of the original Partnership Agreement, MEARS continues to invest in the apprenticeship programme with an intake of 20 new apprenticeship posts in 2023 and the offer of retention for all time-served apprentices. Page 208 of 285
Page 209
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref: RL/KA/KH Date 16/02/23 Cyber Security Assessment – Supplementary Report From Chief Officers (Audit and Risk) and (Business and Digital) E-mail adamsonk@northlan.gov.uk hassellk@northlan.gov.uk Telephone 07939 280602 07903 096121 Executive Summary During financial year 2022-23, Internal Audit worked alongside Business and Digital to review and assess cyber security practice within North Lanarkshire Council. That assessment – categorised as reasonable assurance - determined the Council has robust and effective information governance arrangements, duly recognises the risks associated with cyber security threats, and operates practices commensurate with the good practice recommended by bodies such as the National Audit Office. This report seeks to supplement Internal Audit’s findings and recommendations – reported separately within the Internal Audit Progress report - through providing Panel members with additional details of cyber security activities performed by the Council. The audit report notes the Council seeks to guard against common cyber security threats and/or attacks through a range of cyber security arrangements, controls, and activities. With the Scottish public sector remaining vigilant against the threat of cyber-attack, and the outage suffered by the Scottish Environmental Protection Agency (SEPA) following the attack on them in 2020 continuing to resonate through this sector and beyond, the broad themes referenced within the Internal Audit report are expanded further in this supplemental Panel report. The Council endeavours to follow good practice guidelines and recommendations in terms of cyber security, but the threat landscape continues to flux making it challenging to achieve a substantial assurance Internal Audit opinion. Notwithstanding this, the Council’s security and risk management function respond positively by continuing to actively monitor how such changes affect the Council’s security posture and the adequacy of existing controls. The active, ongoing monitoring of risk and continual development of the cyber security control set is one of the key focus points of this report. The Cyber Security review and assessment was undertaken in a structured format using templates and guidance created by the National Audit Office, National Cyber Security Centre (NCSC), and Scottish Government. This report therefore follows that same structure to provide Panel members with a high-level overview of the cyber security management principles adopted by the Council. Recommendations The Panel is asked to note the contents of the report. AGENDA ITEM 14 Page 209 of 285
Page 210
1. Background 1.1 Cyber security is the activity of protecting an organisation’s data, devices, networks, and software from unintended or unauthorised access, change or destruction via the internet or other communications systems or technologies. Cyber incidents pose a significant threat to all organisations and the number of cyber-attacks is growing in terms of both number and sophistication. 1.2 SEPA was the subject of a major cyber-attack in 2020, with investigation findings being released to public sector bodies over the course of 2021-22. In response, the Chief Executive of NLC requested Business and Digital and Internal Audit work together to examine the effectiveness of the Council’s approach to cyber security. Internal Audit used a range of resources to create a ‘good practice’ checklist as the basis of this joint review and assessment. Amongst these were: • National Audit Office’s Good Practice Guide – Cyber and Information Security • NCSC’s Cyber Security Toolkit for Boards • NCSC’s 10 Steps to Cyber Security • SEPA Report – Response and Recovery from Major Cyber Attack • SEPA Report – Lessons Identified for Local Authority senior IT Managers 1.3 Internal Audit sought to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber security threats and/or attacks. A particular focus was on whether adequate arrangements and controls are in place in accordance with relevant external standards. Internal Audit categorised their findings as reasonable assurance, with those findings and recommendations reported separately within this agenda. 1.4 The adoption of home/hybrid working, the shift to online services, and the rapid uptake of ‘Cloud’ digital services mean that the threat landscape and cyber-risk profile of the Council has altered dramatically in the space of a noticeably short period. 1.5 That said, the Council’s approach to cyber security seeks to follow good practice guidelines and recommendations, which are recognised in several externally validated assessments including: 1.5.1 Annual accreditation with the Public Services Network (PSN) Code of Connection (CoCo), against which the Council is fully compliant. 1.5.2 Annual independent IT health checks which include penetration testing and other testing of the effectiveness of network cyber security controls; and 1.5.3 The council’s ICT resilience capability being evaluated using NCSC’s “Exercise in a Box.” 1.6 This report summarises the areas examined within the recent cyber security assessment. In recognising the prevalent threat landscape makes it challenging to achieve a substantial assurance audit opinion, the report also outlines for the Panel how existing good practice assists in preventing and detecting, and thereafter limiting the impact of significant cyber incidents. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Page 210 of 285
Page 211
2. Report 2.1 The internal audit assessment process examined various elements of cyber security that together were deemed to be indicative of good practice. These included technical controls, human factors (including staff training and awareness raising), the risk management approach adopted by the Council and, importantly, operational context. This latter element included the impact of the Covid-19 pandemic and the move to home and hybrid working, and the technical and human security challenges these presented. Additionally, the fast-paced rate of changes to risk factors resulting from the ongoing digitisation of services and the uptake of third party-hosted ‘Cloud’ solutions were a focus of the audit. 2.2 The report produced by Internal Audit provides independent assurance on the adequacy and effectiveness of the Council’s approach to cyber security. Whilst findings were identified through collaboration between Internal Audit and Business and Digital, the audit was based on National Audit Office areas for examination and conducted in accordance with the ’Public Sector Internal Audit Standards.’ 2.3 The audit itself was structured into three sections, each separately subdivided. The audit covered the full breadth of expected cyber security practices, and detailed responses were documented within a checklist spanning 111 different questions, structured as follows: • The National Audit Office’s Cyber and Information Security Good Practice Guide o Approach to cyber security o Cyber and information security risks o Effect of Covid-19 on risk profile and appetite o Identification and deployment of capability • National Audit Office’s Key Controls (based on NCSC Cyber Security Toolkit and 10 Steps to Cyber Security) o Risk management o Engagement and training o Asset management o Architecture and configuration o Vulnerability management o Identity and access management o Data security o Logging and monitoring o Incident management o Supply chain security • Lessons Learnt from SEPA Ransomware Response o Increasing number of people and improving training for people with access to threats o Availability and testing of emergency management, disaster recovery and incident management plans o Enhanced network segmentation controls o Enhanced privileged account management controls o Ensure that recovery plan activities are clearly prioritised o Offline immutable backups Page 211 of 285
Page 212
2.4 During the initial collaboration and engagement a positive, evidence-based response was given to the topics assessed within the detailed checklist. Five areas were noted where the Security & Risk Management function believed assurance could only be partially given. There are no specific audit recommendations aligned to these areas, but additional commentary is provided below to assure the Panel that mitigating and preventative actions remain ongoing within them: 2.4.1 Approach to cyber security It was noted that the Council does not formally accredit to a scheme such as Cyber Essentials or ISO 27001. Formal accreditation to the PSN Code of Connection (CoCo) is maintained however, as evidence of the Council meeting the cyber security requirements of an external independent body. The process of accrediting with the PSN CoCo requires an annual submission of compliance and the conducting of IT health checks/penetration tests by independent and qualified personnel. In addition, the Council fully complies with the Scottish Government’s Public Sector Action Plan for Cyber Resiliency 2017-2018 and adopts relevant controls including implementation of strategies covering supply chain, email, and active cyber defence measures. And finally, adherence and accreditation with the Payment Card Industry Data Security Standard (PCI DSS) is maintained and relevant cyber security requirements formally adhered to. 2.4.2 Identification and deployment of capability Risks in terms of staff capability and the ability to recruit and retain staff were highlighted. These stem from the rapidly changing threat landscape and modus operandi of attackers, and the exceptionally high demand in the marketplace for experienced security personnel, meaning the public sector has considerable challenges in recruiting and retaining staff. To counter these risks a partnership agreement with a cyber incident responder has been entered into, and a ‘grow your own’ approach adopted, where appropriate, to develop suitably trained personnel. 2.4.3 Enhanced privileged account management controls Whilst privileged user and service accounts provisioned by Business and Digital are well-managed, it is important to note that line of business system user accounts are system owners’ responsibility, this being called out in the council’s Access Control Standard. 2.4.4 Ensure that recovery plan activities are clearly prioritised Resilience and incident response plans are assessed annually using NCSC’s ‘Exercise-in-a-Box’ methodology, most recently by an independent assessor in the employ of the Scottish Business Resiliency Centre. However, individual system owners are responsible for determining the level of criticality and recovery arrangements of their systems; this having been advised to individuals who hold that role. As outlined in paragraphs 2.16 and 2.17 below, service responsibility for recovery planning is being progressed through the Resilience Development Unit, with support as appropriate from Business and Digital. 2.4.5 Offline immutable backups At the time the audit was undertaken and owing to the in-flight procurement of new tooling in this area, it was not possible to give an exact breakdown of the funding (the balance between capital and revenue costs) for the provisioning of offline backups. This has now been determined and the procurement exercise completed. Page 212 of 285
Page 213
2.5 Turning to the good practice areas specifically identified within the Internal Audit report, Panel members may wish to note the following additional detail: • The Council having appropriate governance structures in place relating to Information Governance and Information Security which includes the Data Governance Board and Data Management Team. Panel members will also wish to note that several other boards, committees, and forums provide insight and direction for information and cyber security. There is representation on the Corporate Management Team where cyber security matters can be presented and if necessary approved. Strategic changes impacting council-wide business objectives have previously been discussed at the Organisational Design Authority with representation from several areas of expertise including information security and risk. New proposals requiring specific tooling and meaningful change to operational process are brought for initial approval at the Enterprise Architecture Governance Group (EAGG). The Technical Design Authority (TDA) acts as a subgroup to the DigitalNL Delivery Board ensuring DigitalNL architectural proposals are well designed, and implications understood. • The Council’s Chief Officer (Business and Digital) being the Senior Information Risk Owner (SIRO) for the organisation has overall authority and responsibility for information governance and security. The Information Risk Manager consults regularly with the SIRO and cyber security matters are co- ordinated by the Information Security and Risk Management Team in liaison with appropriate staff across the council and operational officer working groups. Other industry bodies, such as the NCSC or Digital Office for Scottish Local Authorities provide threat intelligence, as necessary, to the information risk manager to discuss with the SIRO. • The SIRO Annual Report reflects on the Council’s information governance work, including providing an overview of relevant activity including providing assurance that personal data is held securely. Reference is made within the report as to activities which have been undertaken, or are planned, to mitigate against cyber risks. • The Information Risk and Security Team within Business and Digital is responsible for oversight of cyber security. Whilst this team takes lead responsibility, the delivery of security controls and functionality extends beyond them, with nearly all of Technology Solutions personnel responsible for implementing, operating, and maintaining specific security controls within their remit. Furthermore, through ongoing communications and awareness-raising activities, all staff and Council personnel are made aware of their responsibilities for cyber security. • There is an Information Security and Information Governance corporate risk, with corresponding controls and actions identified. This is monitored in accordance with the associated residual risk rating. • There are mandatory information governance and security training modules for staff tailored to suit the needs of individual roles. These training modules, which must be re-taken at appropriate intervals, provide a solid foundation for information and cyber security. On top of that, a programme of continual awareness-raising of cyber security takes place through the introduction of added content or the refreshing of published guidance and leveraging of tooling such as the Council’s phishing email simulator. Page 213 of 285
Page 214
• Effective communication channels exist within the Council to inform Services and staff of relevant issues and developments in relation to cyber security. The introduction of specific social media-like platforms for generating ad-hoc content and the creation of a security-specific site within the Council’s Intranet (Yammer) has provided a further mechanism to promote good information and cyber security practices. It is recognised that this continual awareness raising through all user emails, Intranet, social media-like platforms, the phishing email simulator, training modules and verbal colleague communications all add to the strengthening of cyber defences and improvement of the Council’s security posture. • The Council’s Cyber Security arrangements have been assessed against the PSN CoCo, with the Council having achieved full compliance. As per many other local authorities and as explained in the audit report, while the Council has elected, for practical reasons, not to seek Cyber Essentials accreditation it nevertheless continues to ensure independently assessed accreditation against a sector-approved cyber security standard. In addition to the PSN CoCo, the Council complies with cyber security arrangements required to adhere to the PCI DSS. • Independent IT Health checks are undertaken annually, including penetration testing and other testing of the effectiveness of network controls. Such testing is conducted by industry-approved and accredited testing organisations and personnel. • Improvements have been made to supply chain management security through adoption of the Scottish Government’s ‘Cyber Security Procurement Support Toolkit’ (CSPST). This ensures the Council now adopts processes that the Scottish Government has recommended be used across the wider Scottish public sector to implement appropriate cyber security within the supply chain. • The Council’s ICT resilience capability has been evaluated through use of the NCSC developed ‘Exercise-in-a-Box’ toolkit. Such testing last happened in December 2022 and was performed in conjunction with a 3rd-party organisation, the Scottish Business Resiliency Centre. • There are robust authentication and access control procedures (including multi-factor authentication) in place to protect Council systems from unauthorised access. This has included the adoption of NCSC recommendations on access control such as using MFA and enhancements to existing access control methods. • A suite of malware protection products has been fully deployed (e.g. antivirus software, web filtering and email malicious content/payload detection systems) in addition to real-time analysis of security threats identified and managed through deployment of Security Incident Event Management (SIEM) software. Such products are regularly reassessed for effectiveness and efficiency and subject to updates as required, with all examples given being changed for new product sets within the last two years. • The Council has procured a cyber incident retainer service meaning professional support can be available on-site at short notice to help limit the impact of any significant cyber incident and to assist in recovery thereafter. This was one of the significant, if not most significant, recommendations emanating from the SEPA attack of 2020. Page 214 of 285
Page 215
2.6 The Information Security and Risk Team continue to support cyber security with policy development to direct the council’s approach to various aspects of cyber security. An example of this is the new password policy requiring long and strong passwords to access council devices – which further strengthens the technical measures already in place such as Multi-Factor Authentication, etc. 2.7 In addition to policy measures the Information Security and Risk team conduct significant activity in relation to staff awareness via email and staff announcement tools. Activity is split into publicising general good practice and more immediate cyber threats to the Council. 2.8 The use of threat intelligence-gathering tools augments the efforts made in 2.7 as well as informing the adequacy of technical capability. 2.9 Phishing is a type of cyber security attack that attempts to obtain sensitive data such as Username and Password. It attacks the user through mail, text, or direct messages, and with users believing the email, text or message came from a trusted source, they open the attachment activating the malicious code to ‘open the door’ to data breaches, compromised systems and ransomware. Looking to minimise these risks, the Council now operates an email phishing simulator on a pilot basis. This tool enables simulated phishing emails with varying levels of complexity to be sent to Council personnel. Intelligence on the type of malicious emails more likely to be received or opened is used to inform future campaigns. The tool uses short videos to raise awareness for those who click contained in a link in a simulated phishing email. The pilot will run until mid- summer 2023 and will help inform the longer-term strategy for managing the risk posed by phishing emails. 2.10 Building upon this, tooling now exists for staff to alert when suspected phishing emails are received. When used any offending email is deleted from inboxes and forwarded to interested parties for examination. 2.11 As well as awareness training which all staff must undertake to directly address cyber security, related courses cover wider information security concerns, data protection, and records management. All course content is updated regularly and as warranted by changing environmental factors. 2.12 The Council employs a variety of technical measures to bolster its cyber defences to prevent and detect common attacks. These include: • Firewalls • Network segmentation • Web filtering • Intrusion prevention systems • Penetration testing • Health checks • Vulnerability scanning • Regular system and security patching • Anti-malware tools • Conditional access tools being used • Virtual private network technology • Cloud access security brokering • Email protections • Computer policies limiting capability for standard users • Privileged account access management Page 215 of 285
Page 216
• Role-based access controls • Multi-Factor Authentication • Full disk encryption • Security Incident and Event Monitoring (SIEM) 2.13 Beyond technical considerations, management of the security risk function is robustly maintained and a process for identifying future strategy appropriately applied. With digital now an essential component of modern life and destructive cyber-attacks ever increasing, Business and Digital’s recent restructures expanded the core information security and risk management assurance team. This has grown from essentially being a one-person role less than 3-years ago to a permanent full-time equivalent headcount of 4.8 people. The number of individuals with responsibility for operational maintenance of security tools and functions is, in turn, much larger than that. Risk-based and industry-standard approaches inform future strategies, for example by leveraging maturity assessment frameworks and Scottish Government cyber security benchmarks for the public sector. 2.14 Turning now to Internal Audit’s recommended areas of improvement: • The current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones, and timescales. • Proposed arrangements and expectations associated with the refreshed ICT Disaster Recovery Plan need to be finalised and communicated to Services 2.15 The SIRO report available separately on the agenda confirms Business and Digital’s intention to use Gartner’s ‘IT Score for Security and Risk Management’ and the Scottish Government’s Cyber Resiliency Framework to inform and shape future iterations of a risk-based Information Security Action Plan. Panel will wish to note however that this action plan needs to dovetail with the division’s overarching Prioritisation Matrix and Integrated Programme Plan, which allocates workload to employees in accordance with ten criteria including: compliance and security; corporate governance and performance; strategic alignment; cost avoidance and operational risk. Given all required activity is dependent upon employee numbers, skills and capacity, action plan milestones and timescales are necessarily subject to change as there is always a high likelihood that officers will be asked to focus on alternative higher priority tasks. 2.16 The Panel have received regular updates on ICT disaster recovery (DR) in recent years and months and are therefore sighted on the roadmap Business and Digital have been following to refresh outdated arrangements to ensure DR processes are fit for modern ICT service delivery. Roadmap activities are well underway, and the service remains committed to a new DR baseline – clearly detailing a Recovery Point Objective and Recovery Time Objectives for critical systems based on services’ business impact assessments – being completed by June 2023. Business and Digital continue to lead this process, and now have regular interaction with identified Line of Business System Owners regarding differing roles and responsibilities. Notwithstanding this, further dialogue is required through the Resilience Development Unit to ensure services are clear on their responsibilities for DR and Business Continuity Planning (BCP). 2.17 Business and Digital remain committed to supporting previous recommendations from Internal Audit (September 2022) to formally review/challenge - and thereafter test - service DR and BCP to ensure they sufficiently detail the methodology and processes to be deployed to maintain critical service activities in the event of an ICT incident or cyber-attack. Given destructive attacks can lead to compromised systems and communications, and often occur out of hours, the Scottish Government’s Cyber Page 216 of 285
Page 217
Resilience Unit now recommend all functions update their DR and BCP to recognise that ICT and network services could be unavailable for extended periods of time. Business and Digital will continue to support and advise the Resilience Development Unit and services with formal testing arrangements. 2.18 Whilst this cyber security review and assessment confirms security matters are well managed and practiced within the Council, it must be recognised that the risk of the Council suffering a significant cyber breach cannot be removed. Given the evidence of many industry sectors and individual high-profile organisations being affected by massively disrupting cyber breaches – despite high levels of investment in security controls being present – very few businesses are willing to describe themselves as safe from the threat of being affected by a successful cyber-attack. Panel members are therefore asked to acknowledge that the likelihood of achieving a substantial assurance audit opinion in this area is low. 3. Measures of success 3.1 Ongoing initiatives and investments to enhance cyber security across the council will further protect council information, networks, and devices at a time when the council’s attack surface is growing. The threat environment is becoming increasingly complex and sophisticated. The Council’s approach seeks to reduce the likelihood of a successful attack – but the impact is harder to reduce. It should be remembered that there will always be a risk that an attack is successfully launched against the council however ongoing measures will seek to minimise this threat. 3.2 Immediate activities underway that will enable the security and risk management function to deliver a high-level of performance in a strategic sense, and that can be used to demonstrate measurable success, include: 3.2.1 Completion of the maturity assessment programme currently under way. 3.2.2 Development of the strategy that will inform the activities of the next financial year, and aspirationally beyond that. 3.2.3 Adoption of the Scottish Government’s toolset for more thoroughly assessing and assuring cyber security practices – the Cyber Resiliency Framework. 4. Supporting documentation Internal Audit Report Katrina Hassell Chief Officer (Business and Digital) Ken Adamson Chief Officer (Audit & Risk) Page 217 of 285
Page 218
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Page 218 of 285
Page 219
Section 2.12 of the report details several technical measures used by the Council to bolster its cyber defences to prevent and detect common attacks. Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Section 2.5 of the report confirms any new proposals requiring specific tooling and meaningful change to operational process are considered in the first instance by the Enterprise Architecture Governance Group (EAGG) and/or Technical Design Authority (TDA). Yes ☒ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Cyber incidents pose an increasing threat to information management, and therefore give rise to increased risk of service delivery disruption, additional costs, and reputational harm. This report recognises the prevalent threat landscape and outlines for the Panel’s assurance how existing good practice assists in preventing and detecting, and thereafter limiting the impact of significant cyber incidents on Council service delivery. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 219 of 285
Page 220
Page 220 of 285
Page 221
North Lanarkshire Council Report Audit and Scrutiny Panel ☐approval ☒noting Ref KH/RL/SC Date 16/02/23 Senior Information Risk Owner (SIRO) – Information Governance – Assurance and Performance Report 2021-2022 From Katrina Hassell, Chief Officer (Business & Digital) Email HassellK@northlan.gov.uk Telephone 07903 096 121 1. Background 1.1 There are several officers and teams across the Council with responsibility for information governance and information security, but good information governance involves everyone. This report describes how these roles collectively ensure organisational compliance with the legislative and regulatory requirements relating to the handling and processing of information. 1.2 As corporate champion for information governance, the SIRO aims to provide the Audit and Scrutiny Panel with assurances that information risks are being effectively managed. To this end, this report outlines information governance activity and performance in respect of financial year 2021-2022, detailing what is going well, and where improvements can be made. Executive Summary This SIRO report aims to provide assurances that information risks are being effectively managed to ultimately enable the Council to comply with legislative requirements and good practice. It outlines activity and performance related to information governance in respect of financial year 2021-2022 and details the improvement actions which the Data Management Team (DMT) aim to progress to further improve awareness, understanding and compliance. Recommendations It is recommended the Audit and Scrutiny Panel: (1) Note the activities which have been undertaken or are underway to enable the SIRO to provide assurances information risks are being effectively managed; and (2) Note the activities and next steps planned to further improve the Council’s information governance arrangements. The Plan for North Lanarkshire Priority All priorities Ambition statements All ambition statements AGENDA ITEM 15 Page 221 of 285
Page 222
2. Report 2.1. The Council has always been committed to effective information governance with sound arrangements for ensuring compliance with legislation and recognised best practice appropriately managed as part of the Council’s risk management and corporate governance arrangements. 2.2. SIRO responsibilities have been aligned with the Chief Officer of Business & Digital remit since September 2019. Previous details in respect of financial years 2019- 2020 and 2020-2021, considered by the Audit and Scrutiny Panel in December 2021, demonstrated significant improvements were delivered over the 2-year period to formalise and improve the Council’s information governance management arrangements. 2.3. This report relates to financial year 2021-2022, with sections 14 to 63 of the SIRO report provided as Appendix 1 detailing activity and performance undertaken to ensure personal data is held securely, and information disseminated effectively. Key highlights for Panel consideration include: ➢ Data Governance Board (DGB) Self evaluation undertaken to establish and monitor whether the Board’s arrangements adequately contribute to the achievement of the Council’s vision as detailed in the Data and Information Management Strategic Roadmap ➢ Information Security and Information Governance corporate risk monitored in accordance with residual risk ratings, with corresponding mitigating actions identified and deployed ➢ Several activities undertaken to mitigate against cyber risk, and to improve the Council’s ICT Disaster Recovery (DR) arrangements ➢ Business Data Owners and Line of Business Data Steward roles and responsibilities defined, enabling services to consider appropriate deployment of the approved Data Governance and Management Framework ➢ Mandatory information governance and security training modules tailored to suit the needs of individual roles, with Advanced Data Protection module also made mandatory for employees with staff responsibilities as well as any staff roles specifically identified by Services. ➢ Full refresh, and subsequent promotion, of the Council’s Information Governance Policy Framework 2.4. Complementing the Corporate Data Protection Officer’s annual report to the Finance and Resources Committee, sections 21 to 30 of the SIRO report highlight for Panel consideration any breaches of confidentiality and security considered by the DGB during financial year 2021-22, alongside assessment of the remedial actions identified. 2.5. Sections 31 to 36 focus specifically on ICT Security and Cyber risks, advising of the accreditations and approaches adopted by the Council to mitigate against this high-risk area. 2.6. Paragraphs 61 to 63 detail actions taken to maintain compliance with the Public Records (Scotland) Act 2011. Page 222 of 285
Page 223
Next steps 2.7. The Council is committed to a clear strategy and sustainable framework for information governance and security, and effective data and information management governance is an essential component of that. Given this report presents information assurance for financial years 2021-2022, the live improvement plan detailed in section 65 of the Appendix highlights activity planned in March 2022 to strengthen existing arrangements. These actions are progressing well and will be detailed for Panel consideration within the 2022-2023 SIRO report. 2.8. By way of summary, the key priorities identified within the improvement plan include: a. Refresh and strengthen our approach to mitigating Cyber security risks b. Implement improvement actions identified in DGB Self-evaluation exercise c. Raise profile and prioritisation of Information Governance and Data Protection responsibilities; and d. Incremental implementation of the Data and Information Management Strategic Roadmap (the Roadmap) 2.9 Improvements can always be made to our information governance arrangements, and with a residual risk score of 20 (March 2022) prevalent in respect of our Information Governance and Information Security corporate risk, it is essential this subject matter remains as a high priority improvement area for the Council. Progress against these key next steps will be managed by the DGB, who will look to further develop policies, guidance, standards, processes, and approaches as appropriate to improve awareness, understanding and compliance with legislative requirements and good practice. 3. Measures of success 3.1 Effective Information Security and Information Governance assists the Council in protecting itself from cyber-attacks and security breaches, which can both give rise to service delivery and financial pressures. Measures of success therefore flow from demonstrated and continued compliance with all information governance legislative and regulatory requirements. 4. Supporting documents 4.1 Appendix 1 – SIRO Information governance – assurance & performance – 2021- 22 Report. Katrina Hassell Chief Officer (Business & Digital) Page 223 of 285
Page 224
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Financial Solutions? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? There are no financial implications arising from this report, however the promotion and implementation of effective information governance impacts positively on the Council’s ability to mitigate its exposure to financial risk, particularly monetary penalties levied by the Information Commissioner's Office for non-compliance. Notwithstanding this, section 34 of the SIRO report so appended illustrates we must also consider costs involved in achieving compliance with good practice standards, as such can be cost prohibitive for the Council to achieve given its complex portfolio. 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People and Organisational Development? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic Solutions? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Section 4 of the SIRO report as appended outlines the legislative and regulatory requirements placed on the Council in respect of information processing, security, and management. General Data Protection Regulations (GDPR) continue to apply to the United Kingdom post-Brexit implementation. Page 224 of 285
Page 225
5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☒ No ☐ Section 4 of the SIRO report as appended outlines the legislative and regulatory requirements placed on the Council in respect of information processing, security, and management. General Data Protection Regulations (GDPR) continue to apply to the United Kingdom post-Brexit implementation. Paragraphs 21 to 30 also highlight any breaches of confidentiality and security considered by the DGB during financial year 2021-22, with corresponding remedial actions identified If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☒ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Sections 31 to 36 of the SIRO report focus specifically on ICT Security and Cyber risks. The council operates a complex technology network, and through its DigitalNL programme, will significantly change its server, applications, and software estate, as well as the underlying connectivity. All changes will be considered by the appropriate corporate working group, with any technology components fully assessed as required by the corporate Enterprise Architecture Governance Group. Where the impact identifies a requirement for technology, has an assessment been carried out (or scheduled) by the Enterprise Architecture Governance Group (EAGG)? Yes ☒ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☒ No ☐ Sections 6 and 65 of the SIRO report highlight everyone – staff and elected members – must understand the importance of information governance and Page 225 of 285
Page 226
security, which when combined with lower than desired mandatory training take- up does illustrate a requirement for ongoing communication of requirements If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? In line with the Council’s corporate risk management arrangements and a requirement for risk to be managed at an appropriate level of the organisation, the Chief Officer of Business & Digital has lead officer responsibility for the corporate risk regarding Information Security and Information Governance. Approved risk management arrangements further require the assessment, monitoring, and review of individual risks to be assigned to relevant Corporate Working Groups, and this particular risk sits within the remit of the DGB. Improving our information governance arrangements will positively impact the Council’s risk management arrangements, consequently leading to greater confidence in the accuracy of data used to support decision-making Page 226 of 285
Page 227
SENIOR INFORMATION RISK OWNER (SIRO) INFORMATION GOVERNANCE – ASSURANCE & PERFORMANCE: 2021 – 2022 REPORT NORTH LANARKSHIRE COUNCIL December 2022 Page 227 of 285
Page 228
1 Table of Contents Executive summary .............................................................................................................................. 1 Introduction........................................................................................................................................... 2 Key Roles and Responsibilities ......................................................................................................... 2 Governance and Monitoring Arrangements ...................................................................................... 4 Risk Management and Assurance ........................................................................................................ 5 Compliance with Data Protection and GDPR Requirements ................................................................ 6 ICT security and cyber risks ................................................................................................................. 8 Corporate governance activity ............................................................................................................ 10 Live Improvement plan ....................................................................................................................... 18 Conclusion.......................................................................................................................................... 21 EXECUTIVE SUMMARY This report provides an update relating to the responsibilities of North Lanarkshire Council’s Senior Information Risk Owner (SIRO). It outlines activity and performance related to information governance and provides assurances that information risks are being effectively managed. It outlines what is going well, and where improvements can be made. This report relates to financial year 2021-22, so covers activities and assessments up to March 2022. Page 228 of 285
Page 229
2 INTRODUCTION 1. The Senior Information Risk Owner (SIRO) Annual Report reflects on the Council’s information governance work, aiming to provide assurances that personal data is held securely, and information disseminated effectively. This report focuses on financial year 2021-2022. 2. The Council continues to be committed to effective information governance, with sound arrangements in place to ensure compliance with legislation and recognised best practice. Governance arrangements are closely monitored to ensure systems, policies and procedures are fit for purpose, and that all staff and elected members understand the importance of information governance and security, with good practice considered everyone’s business. 3. ICT security and cyber risks present an ever-increasing challenge to all organisations and the Council is no different. Arrangements to manage these risks, in consideration of the threat landscape, are contained within the report, with a summary included to highlight action underway and planned to maintain and strengthen defences and enhance corporate resilience. 4. Specifically, this report: a. Documents organisational compliance with the legislative and regulatory requirements relating to the handling and processing of information and provides assurance of ongoing improvements to manage information risks. This includes the Council’s consideration and performance relating to: ➢ Data Protection Act 2018 and General Data Protection Regulations (GDPR) 2016 ➢ Public Records (Scotland) Act 2011, and ➢ Information Security Standard ISO/IEC 27001:2013 b. Provides an overview of Council governance arrangements and key roles and responsibilities. c. Outlines any serious incidents which required investigation over the duration of this report, relating to any losses of personal data or breaches of confidentiality. Key Roles and Responsibilities 5. The Chief Officer of Business and Digital within the Chief Executive’s Office is the Council’s Senior Information Risk Officer. Key responsibilities include: a. Leadership and overall ownership of the Council’s Corporate Governance Action Plan, acting as corporate champion for information governance; b. Acting as Executive Sponsor and advocate for the management of information governance at a senior level; c. Providing advice and reports in respect of information incidents and risks, including the content of the council’s Annual Governance Statement relating to information risk; d. Owning the management of information governance and associated risk assessment processes within the Council; e. Understanding how the strategic priorities of the Council may be impacted by information governance risks, and how these risks need to be managed including the adequacy of resources and levels of independent scrutiny. Page 229 of 285
Page 230
3 6. There are several officers and teams across the Council that have professional expertise relating to information governance and information security, but good information governance involves everyone. All staff and elected members therefore have personal responsibility to ensure information and data is held securely, processed appropriately and safely destroyed when not required. 7. Diagram 1 below illustrates existing responsibilities and governance arrangements in respect of information governance, clearly highlighting the differing responsibilities of the SIRO, Data Protection Officer, and Records Manager, as well as the oversight responsibilities of the strategic Data Governance Board (DGB) and operational Data Management Team (DMT). Diagram 1 8. Recognising these wider responsibilities, this report complements the annual report prepared by the Chief Officer of Legal and Democratic Solutions – the Corporate Data Protection Officer (DPO) - in respect of his responsibility for data sharing, data breaches, Information Commissioner Office (ICO) complaints and training. The detail in respect of financial year 2021-22 is due to be considered by the Finance & Resources Committee on 1st March 2023. Page 230 of 285
Page 231
4 Governance and Monitoring Arrangements 9. The Council’s Data Governance Board (DGB) is responsible for developing and implementing strategies, policies, and standards in relation to data governance and management. Additionally, the board is responsible for directing improvements identified within the Data and Information Management Strategic Roadmap, and for ensuring measures are in place, through the Data Management Team, to monitor compliance with approved policies and standards. 10. The DGB is chaired by the SIRO, includes the Corporate Records Manager, Data Protection Officer (DPO), Chair of the Data Management Team (DMT) and key representation from all Council functions. 11. The key Terms of Reference of the DGB include: a. To ensure the Council’s information governance policies and management arrangements reflect current legislation, guidance/policies, and relevant professional codes of practice. b. To ensure that the Council undertakes or commissions annual assessments and/or audits of its information governance policies, procedures, and arrangements, with all findings included within improvement plans as appropriate. c. To receive the Annual Data Protection Officer report and scheduled internal audit reports, reviewing progress against required and identified actions as appropriate. d. To receive and consider reports into breaches of confidentiality and security and where appropriate undertake or recommend remedial action. e. To establish an information governance improvement plan, secure the relevant resources and monitor implementation of the plan. f. To ‘sign off’ the information governance assurance annual return and corporate information governance risk reviews prior to submission in line with the timetable issued each year. g. To promote a Council wide culture that information governance is the responsibility of all elected members and staff and to promote learning that arises out of investigations into breaches in information governance. h. To ensure that staff are trained in information governance, comply with, and understand the consequences of not adhering to relevant policies and procedures, monitoring the provision and uptake of such training in accordance with identified targets. i. To assist the Senior Information Risk Owner (SIRO) in producing information appropriate for inclusion within an annual Information Governance Report. Through this report, the Data Governance Board provides assurance to the Corporate Management Team and Audit and Scrutiny Panel. j. To ensure the Council develops and maintains an appropriate framework for the management and protection of information which is appropriately supported by information asset owners and administrators. k. To ensure the Council achieves positive movement on the data maturity curve, directing activities towards achievement of the ‘advancing’ stage of the maturity curve. 12. These Terms of Reference are reviewed annually to ensure the Board continues to meet the Council’s business needs. Terms are regularly referenced at Board meetings, with members given opportunity to identify any additional support required to enable them to fulfil their responsibilities. 13. During 2021-22, the Board also completed a self-evaluation to establish whether its Terms of Reference and oversight arrangements adequately contribute to the achievement of the council’s vision as detailed in the approved strategic roadmap. Details are contained within paragraphs 38 to 43 below. Page 231 of 285
Page 232
5 RISK MANAGEMENT AND ASSURANCE 14. The Council’s Corporate Risk Register includes a risk in respect of Information Security and Information Governance. This risk is defined as “There is a risk that information, in whatever format, is not managed securely or that Information Governance across the Council and its ALEOs is ineffective. This includes implementation of enhanced and appropriate controls to address the additional information security and information governance risks arising from the significant shift to home working triggered by the COVID-19 pandemic”. 15. The council identifies and monitors significant risk to its operations. The Information Security and Information Governance risk is assessed and monitored using the standard council- approved process for risk management. The inherent score of this risk is 25, having been assessed at the maximum score of 5 for both likelihood and impact. 16. The agreed approach to the management of key corporate risks sees all risks allocated to a member of CMT and a Corporate Working Group, with such responsible for assessing, monitoring, and reviewing in accordance with residual risk ratings. This particular risk is aligned to the Data Governance Board (DGB) with the Chief Officer of Business and Digital identified as the Corporate Risk Lead. 17. The formal annual review of the Corporate Risk Register 2021-22 was considered by the Audit and Scrutiny Panel in June 2021. This review confirmed that Information Governance and Information Security would remain as a corporate risk given the impacts which breached, inaccurate or lost data could have on the Council achieving its priorities and stated objectives. This report identified the deep dive review in respect of this corporate risk would be scheduled for Corporate Management Team and Audit & Scrutiny Panel consideration in April and June 2021 respectively. Both targets were achieved. 18. Throughout 2019-20 and 2020-21, this risk carried a residual risk assessment of 20, “almost certain” likelihood (5) and “major” impact (4) and was therefore monitored quarterly. This was revised down to 16 over the course of 2021-22 as controls implemented over the course of the COVID-19 pandemic and around remote working took effect. Owing to the worsening geopolitical climate, particularly the situation in Ukraine, the residual risk assessment was revised upwards to 20 in the March 2022 review. 19. The March 2022 review confirmed the likelihood of a breach was high, as it had been throughout 2021-22, despite minor variation in the precise level of residual risk The following provides illustrative examples of information security and governance controls documented within the Council’s risk register and enhancements made over the course of 2021-22. Control (C) / Action (A) Description ➢ CON0001054 Corporate and Service Business Continuity Plans in place and stress tested to inform priorities and decision making ➢ CON0001055 Increased suite of remote access concentrators to cope with and support increased numbers of remote users ➢ CON0001056 Guidance issued to managers and staff on home working which includes reference to data security ➢ CON0001058 Technical controls in place such as device authentication check, network-level user multi-factor authentication etc Page 232 of 285
Page 233
6 Control (C) / Action (A) Description ➢ CON0001064 Secured Premises with secure storage and monitoring of security arrangements ➢ ACT0000610 Review current training content to ensure home working risks are identified in relation to information governance and expectations of staff are fully reflected ➢ ACT0000878 Security good practice training commenced across front-line staff during Q4 of 2021/22 with uptake monitored. ➢ ACT0000879 Training reviewed in March 2022 in light of move to hybrid working and security awareness module revised as appropriate. ➢ CON0001386 The move to hybrid working and revised use of buildings following on from the COVID pandemic saw a programme launched to ensure premises are assessed and appropriate secure storage and monitoring of security arrangements put in place. ➢ CON0002060 PROTECTIVE technical controls in place such as device authentication checks, multi-factor authentication, network segmentation, web gateways, email filtering solutions, etc. ➢ CON0002061 DETECTIVE technical controls in place such as a security event and incident management, intrusion detection, and malware detection solutions, ongoing penetration testing, etc. ➢ CON0002062 RESPONSIVE technical controls in place inc. malware containment and recovery tooling. 20. The DGB will continue to review controls and actions in accordance with the residual risk rating, which is presently quarterly. Reporting to CMT and the Audit & Scrutiny Panel continues to be scheduled in accordance with the timelines recommended by the Chief Officer of Audit and Risk. COMPLIANCE WITH DATA PROTECTION AND GDPR REQUIREMENTS 21. UK GDPR and the Data Protection Act 2018 categorise the Council as a Data Controller, with the DPO tasked with ensuring compliance with all associated data protection arrangements. Responsibilities include maintaining relevant policies, monitoring compliance with such, raising awareness of those policies and ensuring relevant training is provided to all staff to enable the Council to satisfy its legal obligations. Since May 2018, the Council has also had a legal obligation to undertake Data Protection Impact Assessments (DPIA) when processing personal data. 22. This section of the report highlights any breaches of confidentiality and security considered by the DGB during financial year 2021-22, alongside assessment of the remedial actions identified. Page 233 of 285
Page 234
7 23. The Chief Officer of Legal and Democratic Solutions is scheduled to present details of the Council’s 2021-22 data protection compliance alongside the outcome of the review of Corporate Data Protection arrangements to the Finance & Resources Committee on 1st March 2023. In line with paragraph 11 (c) above, he has however submitted details of 2021-22 data protection compliance to the December 2022 meeting of the DGB for consideration and review. 24. Paragraph 11(d) above further illustrates that numbers of breaches and near misses are reported to the Data Governance Board (DGB), with remedial and learning actions arising from investigations discussed to ensure clarity of change and/or requirement, with such subsequently cascaded council wide through the Data Management Team (DMT). 25. In financial year 2021-22, the Council recorded and investigated 69 potential data breaches, a significantly higher level (41% increase) compared to the previous year level of 49. These figures can be interpreted in two ways. Firstly, higher numbers reported demonstrate employees are aware – per the approved Data Protection Policy – of the requirement to report incidents, ergo demonstrating good awareness of data protection and information security requirements. Secondly however, higher levels of breaches do give cause for concern as these have the potential to lead to information falling into the wrong hands. Considering this alongside the timescales for reporting of breaches is therefore key to ensuring the Council is compliant with the Data Protection principles. 26. To enable the Council to comply with its obligation to report high-risk personal data breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of said breach, all NLC officers, staff, elected members and third-party contractors must inform Legal and Democratic Solutions of personal data breaches and ‘near misses’ within 72 hours of incidents occurring. The DGB considers 90% to be a realistic KPI for reporting potential breaches to Legal Services, with performance against this monitored quarterly. For financial year 2021-22, actual performance averaged 69.6%, with only 48 breaches reported within 72 hours. Improvement is therefore required, and activity to raise awareness of the 72-hour reporting timeframe will be factored into the DMT’s action plan. 27. Chart 1 below compares recorded breaches from 2018-19 to 2021-22. The high volumes recorded in November 2018 and October 2021 follow targeted promotion of mandatory training on GDPR and Data Protection, thereby demonstrating that increasing – and then maintaining - awareness of personal responsibility on the use and protection of information better enables the Council to identify and address data breaches, near misses or information security incidents. Chart 1 Page 234 of 285
Page 235
8 28. Chart 2 below compares the recorded breaches, per service, over the 2018-19 to 2021-22 timeframe. Chart 2 29. In investigating recorded incidents, consideration is given to whether such should be referred to the Information Commissioner’s Office (ICO). Reportable incidents are considered to present a risk to the rights and freedoms of individuals, and for financial year 2021-22, 5 incidents satisfied this threshold and were reported accordingly. This is a significant improvement on the previous year position of 12 incidents being reported to the ICO. Notwithstanding the overall improvement, the reported incident regarding a cyber- attack on a system used by a council contractor highlights vulnerabilities can and do exist within supply chains. Business and Digital sought to actively address this risk during 2021-22 through adoption of the Scottish Government’s ‘Cyber Security Procurement Support Toolkit. 30. Categories of breaches include device/documents left in insecure locations, unauthorised system/app use, failure to redact data and wrongful disclosure of data. Per the DPO’s Annual Data Protection report, there was no enforcement action or fines applied by the ICO in respect of these breaches, but various recommendations were made. These include reviewing existing policies and practices, working towards a high completion rate for information governance training, and reviewing the security and procedures surrounding the issue of correspondence by services which include customer details. DGB discussions confirmed learning actions were appropriately documented, with all recommendations subsequently included within the action plans of both DGB and DMT. ICT SECURITY AND CYBER RISKS 31. As the importance of digital information and networks grow, cyber security is of high importance and therefore a corporate priority. The type of risks posed include theft of sensitive corporate and personal data, theft or damage to data, threat of hacking for criminal or fraud purposes, and potential disruption to infrastructure such as Council ICT systems, intranet, and public facing website. 32. The Council complies with the requirements of the Scottish Government Cyber Resilience Framework by having the Chief Officer of Business and Digital, as SIRO, identified as responsible for organisational cyber resilience arrangements. In addition, the Council works towards adoption of recommendations published by the National Cyber Security Centre (NCSC), who advise that cyber risk has been, and is likely to continue to, increase substantially. To mitigate against cyber risks, the Council follows published NCSC guidance and adopts the following approaches: Page 235 of 285
Page 236
9 a. Full compliance with the externally inspected Public Sector Network (PSN) accreditation via submission of the required IT health check applications, and implementation of all recommendations subsequently identified as potentially high risk. Our next accreditation submission date falls due in May 2023. b. Compliance with the Payment Card Industry Data Security Standard (PCI DSS), with the Council now fully compliant across both person present and ecommerce payment channels, and work under way to achieve the same for the telephony channel. c. A suite of malware protection products fully deployed e.g., antivirus software, web filtering, and email malicious content/payload detection systems, together with real- time analysis of security threats identified and managed through deployment of Security Incident Event Management (SIEM) software. d. Firewalls installed to protect the network, systems, and devices from external attack, exploitation, and data breaches, with an external contract in place to undertake penetrative testing, and any issues, anomalies or system vulnerabilities identified, investigated, and remediated. e. Operation of a robust “patching” regime, with such automatically applied on scheduled dates or as and when critical vulnerabilities are identified, and patches made available; f. Robust authentication and access control procedures e.g.: multi-factor authentication, in place to protect Council systems from unauthorised access, with such now of significance given the increase in hybrid and mobile working by individuals in response to the Covid-19 pandemic. g. ICT systems securely configured as part of the initial commissioning process, with formal change control procedures being in place should system settings need to be modified. h. Office “based” staff required to complete Mandatory Information Security Awareness training. i. External assurance of the Council’s cyber security posture provided through accreditation against HMG’s PSN ‘Code of Connection’. As above, the Council’s current accreditation runs through to May 2023. 33. The Information Security and Information Governance risk process described in paragraphs 14 to 20 above does not record all activities underway to maintain the Council’s security posture considering the threat landscape. Business and Digital officers routinely seek to improve arrangements, with the Audit and Scrutiny Panel previously advised of the self- analysis tool used during 2020-21 to help identify priority improvement actions. In light of the findings from the self-analysis and additional input from the Council’s security, governance and operations teams, the following ICT and cyber security focussed activities were undertaken during 2021-22: ➢ Deployment of the DigitalNL agenda and migration to M365 allowing the application of improved conditional access controls. ➢ Procurement of a new anti-malware solution, Microsoft Defender for Endpoint, which offers improved integration with the Council’s Microsoft suite of products when compared with the previous toolset. ➢ The in-sourcing of Culture Leisure North Lanarkshire Limited (CLNL), offering the opportunity to embed a much-improved cyber security posture across the activities of these previously external organisations. ➢ Creation of a better resourced larger security team (the Information Risk and Security Team). This now has 4.8 FTE members of staff, in addition to one temporary member and a modern apprentice. Page 236 of 285
Page 237
10 ➢ Review of ICT disaster recovery (DR) arrangements undertaken, and improvement plan created, which is currently being worked through. ➢ Testing of ICT resiliency capability through use of the NCSC developed ‘Exercise-in-a- Box’ toolkit. ➢ Procurement of a phishing simulator solution, subsequently launched in financial year 2022-23. ➢ Improvements to supply chain management security through adoption of the Scottish Government’s ‘Cyber Security Procurement Support Toolkit.’ ➢ Commencement of a programme to develop a suite of documented security standards. The focus on 2021-22 was ICT DR and supply chain. The future document set has been identified and aligns with the international information security standard ISO 27001. ➢ Replacement of the previous web gateway with a more modern, capable, and flexible product (Netskope) which offers improved performance for the new model of hybrid working adopted by the Council. ➢ Reducing scope for hackers to access Council data by revising the password policy for council systems and devices 34. With compliance standards now including requirements to for example, fully transition to supported tools and deploy all updates/patches within 14 days of release, achieving compliance is cost and resource prohibitive for the Council. To provide some context, the council’s technology network presently includes 656 servers, circa. 200 server software/applications and approx. 1,500 different desktop/device types of software. 35. Whilst the Council’s DigitalNL transformation programme continues to transition all products to more secure and modern cloud-hosted solutions, such cannot be achieved overnight. In considering that business-critical systems such as MySwis, eFinancials and Achieve rely on older – and often unsupported – software and applications, alongside the resources (people and money) required to fully replace such, there is presently no scope for the Council to satisfy all the requirements of compliance schemes such as Cyber Essentials. Business and Digital will continue to protect the Council from common cyber-attacks through PSN accreditation and regular threat assessments, but in times of increasing cyber-attacks and continued use of ageing legacy applications, there is a growing concern regarding the Council’s ability to fully secure the data held on business-critical applications. 36. The council was not affected directly by any ICT or cyber security incidents over the course of 2021-22. However, it was and continues to be affected by day-to-day events that all organisations are affected by, and which are mitigated through the suite of technological and process controls in place, such as email filters, web gateways, network firewalls, web application firewalls, and anti-malware tools. In December 2021 the Council was notified of a major vulnerability that affected nearly all organisations globally, known as ‘Log4J’. Several Council and third-party hosted systems which the Council relies on were identified as being potentially affected. Appropriate measures were taken to address these, with workarounds in play on impacted legacy systems such as efinancials now heavily tracked to facilitate quicker identification of potential vulnerabilities. CORPORATE GOVERNANCE ACTIVITY 37. The Council is committed to a clear strategy and sustainable framework for information governance and security so deploys its requirements through its Information Governance Policy Framework, most recently reviewed and approved by the Policy and Strategy Committee in June 2021. Having also refreshed its corporate working arrangements during Page 237 of 285
Page 238
11 2019-20 to create the Data Governance Board (DGB) and Data Management Team (DMT), revised arrangements now see Business Data Owners assigned to manage the data classifications of customers, cases, people, and the organisation. DGB Self-Evaluation 38. An internal audit of Information Governance and Information Security (reported in March 2021) recommended the DGB and DMT be reviewed to ensure both groups were effectively discharging their respective roles to develop, implement, and ensure compliance with data governance and management strategies, policies, and standards. 39. With a self-assessment recommended, and the Chief Officer of Business and Digital championed to ensure alignment with the Strategic Self-Evaluation Framework, the DGB agreed in May 2021 that 17 statements from the Strategic Self-Evaluation Framework were in scope for its self-assessment exercise. 40. The evidence obtained from the self-evaluation presented to the DGB in September 2021 demonstrated the DGB has a clear vision and effective leadership with a sound approach that provides a clear direction for its work. This approach is underpinned by well-defined processes, is aligned to The Plan for North Lanarkshire, and supports the council’s aims and objectives. Findings also confirmed the DGB regularly reviews its approaches and makes improvements as a matter of course to ensure the security of the council’s information resource. 41. The self-evaluation considered the statements outlined within Table 1 below to be areas of good practice: Theme Assessment Statement Vision and Leadership Strategic plans reflect a pace and depth of improvement that will lead to the realisation of the local authority’s priorities and the long-term sustainability of services. Leadership is effective and there is good collaborative working. Members and senior managers have a culture of co-operation and working constructively in partnership, informed by a clear understanding of their respective roles and responsibilities and characterised by mutual respect, trust, honest, and openness and by appropriate behaviours. Governance and Accountability An information governance framework is in place that ensures proper recording of information, appropriate access to that information including by the public, and legislative compliance. Table 1 42. Four improvement actions were identified in respect of the efficient operation of the DGB and effective use of resources, and these are therefore reflected within the live action plan detailed within section 65 of this report. 43. Having concluded the self-evaluation and Terms of Reference review, Board membership continues to focus on the key master data entities of customers, cases, people, and organisation. All Business Data Owners remained constant throughout 2021-22, with assessments and activities focussed on actions which will improve compliance and see Council data virtualised and available as ‘a single view’ to aid decision-making. Page 238 of 285
Page 239
12 Information Governance Training 44. The DGB and DMT have responsibility for continuously monitoring the actions required to manage information issues, risks, and cultural behaviour to improve existing data governance and management. Paragraph 11(h) above specifically references the importance of information governance training, an identified area of improvement and activity over the last few years. 45. The Audit and Scrutiny Panel were previously advised through the SIRO report 2019 – 2021 of several steps being taken throughout 2019-20 and 2020-21 to refresh, promote and monitor completion of mandatory Data Protection Essentials, Records and Information Management and Information Security training modules. However, a low uptake of these mandatory modules remained as an identified improvement area within the Information Governance Internal Audit report presented to the Audit and Scrutiny Panel in March 2021. In recognising this recommendation alongside the TUPE transfer into the Council of staff formerly employed by Culture Leisure North Lanarkshire Ltd (CLNL) and a requirement to identify posts mandated to complete the Data Protection Advanced module, the DGB determined that further development and promotion of proportionate training be included as an area of focus within its live 2021-22 information governance action plan. 46. Progressing this action through the Data Management Team, the Business Data Owner for the ‘people’ data entity and Business and Digital’s Relationship Manager developed a suite of information governance and security training modules for services to tailor to suit the needs of their individual posts. Information governance training now available to support employees to ensure information/data is held securely, processed appropriately and safely destroyed when not required can therefore be summarised in Table 2 as follows: ‘Course’ Employees in scope Context Existing KPI Data Protection Essentials All except frontline workforce 12,530 √ Information Security Awareness Records and Information Management Data Protection Advanced Those with staff management responsibility 1,939 √ Frontline Toolbox Talk Frontline workforce 2,300 Table 2 47. Acknowledging that work remains ongoing to improve both training take-up and performance monitoring, and to commence the tailored toolbox training for frontline employees, chart 3 below details the level and percentage of completions, per service, for each of the mandatory modules, as well as the Data Protection Advanced training module now categorised mandatory for those employees with staff responsibilities. Chart 3 also compares the level of completions against those expected – per service – so providing an evidential base to support further targeted activity. 48. Chart 3 further illustrates that the Data Protection Essentials course has had the highest ‘attendance’ over the 2-year period to 31st March 2022, with 6,299 (50%) of employees having completed the mandatory courses. “Attendance” at each of the essential mandatory courses remains largely consistent in overall terms, with 5,969 (48%) employees having also Page 239 of 285
Page 240
13 completed Information Security Awareness and Records and Information Management mandatory modules. Chart 3 49. Initially introduced in September 2020, the Data Protection Advanced module received its mandatory classification status in June 2021, resulting in significantly higher numbers of in scope employees – 1,223 (63%) – achieving certified status by 31st March 2022. Compliance levels per service for this advanced module range though from 48% in Enterprise and Communities (485 employees) to 100% within Chief Executive (226 employees). 50. There is clearly variation present in each service’s level of compliance with the mandatory training requirements. Focussing upon the ‘essential’ modules, members may wish to note compliance levels range from 36% in Adult Health and Social Care to 66% in both Enterprise and Communities and Chief Executive office respectively. 51. Though presenting an obvious area of concern and a need for targeted activity and improvement, the low statistics within Adult Health and Social Care are understandable given the pressures facing the service following the outbreak of the Covid-19 pandemic, and the challenges faced therein in managing attendance and retaining/recruiting to essential service delivery posts. 52. Turning now to Education and Families. Whilst there has been an intensive period of training underway within Education and Families, particularly within their Active and Creative Communities functions, compliance levels within this service – circa. 46% - are visibly lower than required, highlighting further targeted activity is required. 53. Given mandatory modules need to be completed biennially, this information forms the starting point firstly for the DGB to gain assurances that staff are being trained in information governance; secondly, to identify areas requiring targeted activity, and finally, to assess the 0 2000 4000 6000 8000 10000 12000 14000 In Scope Compliance In Scope Compliance In Scope Compliance In Scope Compliance In Scope Compliance Chief Executive's Adult Health and Social CareEnterprise and Communiti es Education and Families Council Totals INFORMATION GOVERNANCE MANDATORY TRAINING COMPLIANCE AS AT 31 MARCH 2022 Records and Information Management Information Security Awareness Data Protection Advanced Data Protection Essentials Page 240 of 285
Page 241
14 impact which planned improvements regarding performance monitoring have had. Chart 4 below provides the Audit and Scrutiny Panel with additional context, through analysing the peaks and troughs of training activity progressed in the 2-year period April 2020 to March 2022. 54. As noted in the SIRO report to March 2021, the ‘essential’ mandatory completions were very low council-wide during the early months of the pandemic, with compliance vastly improving from August 2020 following promotion of modules by DGB and DMT members and regular NLC email announcements advising employees to ensure information remained secure whilst working from home. It is clear from the chart below that targeted promotion, generation of automatic ‘reminder’ emails from Learn NL and events such as the annual Information Management Week do appear to spur employees to complete their training. However, percentage compliance levels do still provide cause for concern, requiring awareness raising and GDPR compliance to remain as a key activity on the information governance improvement action plan for 2022-23. Chart 4 Data and IM Strategic Roadmap 55. As outlined in paragraph 37 above, the Council refreshed its corporate information governance arrangements following Policy & Strategy Committee approval of the Digital & IT Strategy 2019-2023. These refreshed arrangements commenced in January 2020, with the Data Governance Board and Data Management Team having opportunity to enhance their knowledge of each group’s remit, the DigitalNL transformation programme and existing information governance policies, thereby fully preparing them to support the Council to ensure that its information governance policies and management arrangements reflect current legislation, guidance/policies, and relevant professional codes of practice. 56. The development of a data-driven decision-making model is a key deliverable of the DigitalNL transformation programme and The Plan for North Lanarkshire (“The Plan”). As previously advised to the Audit and Scrutiny Panel, this model sits at the centre of the Data and Information Management Strategic Roadmap (the Roadmap), endorsed by the former Transformation and Digitisation Committee on 24th February 2021. 0 100 200 300 400 500 600 700 800 900 1000 Mandatory module completions trend April 2020 to March 2022 Data Protection Essentials Data Protection Advanced Information Security Awareness Records & Information Management Page 241 of 285
Page 242
15 57. The Roadmap provides a strategic vision for data, supported by the development of both the Data Custodian Data Governance model and a Business Intelligence Hub to transition the Council from its existing ‘basic’ data maturity score to an ‘advancing’ score, with all data being virtualised and available as ‘a single view’; firstly to assist services in monitoring performance against The Plan for NL outcomes, and secondly, to support strategic decision making, service delivery, cost reduction and risk management arrangements. 58. The Roadmap presents as a series of work packages to provide opportunities to facilitate an incremental improvement in the Council’s data maturity score. To enable the Council to establish clear timelines for the transition, the Data Governance Board: a. Successfully changed membership from service specific representation to functional master data representation. with Business Data Owners identified for the key master data entities of customers, cases, people, and organisation effective from January 2021. b. Manages the development and delivery of the Data Custodian Model including role descriptors, data quality guidance and critical data audit as outlined in paragraph 60 below. 59. The former Transformation and Digitisation Committee reviewed the roadmap progress in February 2021, noting such would be driven forward through the DGB over an envisaged 3- year timeframe. Through Business and Digital’s Programme of Work 2021-22, a further update of progress against this strategic data roadmap was reported to Committee in November 2021. 60. Four key Roadmap recommendations are detailed in Table 3 below for Audit and Scrutiny Panel information, together with the progress made during 2021-22: Roadmap Recommendation Update Formalise and cascade the Council’s data and information management vision, ensuring such aligns with The Plan for NL, DigitalNL objectives, and the approved Digital & IT Strategy. • Continued focus on the vision with ongoing oversight through the Data Governance Board and progress reviewed at each meeting. • Data Governance Board completed self-evaluation during 2021-22 and Data Management Team self-evaluation process now programmed for 2022-23. This will embed the Data Custodian model fully within the governance framework Ensure data is viewed and used as an asset by implementing a revised Data Governance and Management framework and appropriately defining and using Business Data Owners, Line of Business Data Stewards, and Data Architect roles. • In May 2021 Framework agreed. Roles of Business Data Owners and Line of Business Data Stewards defined and DGB members shared with Service Management Teams to ensure appropriate consideration in development of Delivering for Communities Transition plans. • Data Quality Checklist agreed in principle in May 2021 with data quality assessment guidance to follow. • Work continued with Line of Business Data Stewards for the Data Entities of Customers, Cases and Place identified in September 2021. Page 242 of 285
Page 243
16 • Introductory session for nominated Line of Business Data Stewards across the council took place in January 2022. This session introduced the new Data Governance Framework, outlined the role of Line of Business Data Steward role, and launched the Critical Data Audit. • As BI Hub development continues the required personas including the Data Architect role continue to be scoped and skill requirements identified. This is a key deliverable identified for Phase 4 - July 2022 - March 2023. Within the Data Governance Board, structured around four new key ‘entities’ of Master Data, Customer, Cases, Employees and Place, develop clear oversight of use and quality of data for each. • In progress - identification of Business Data Owners for each data entity complete. • Mapping exercise for each complete. • Current phase of Critical Data Audit for all council data underway to be completed Summer 2022 and thereafter analysed for consideration by DGB. Develop a hub and spoke Business Intelligence (BI) Hub, with key roles embedded in directorates, and the core hub based in Business and Digital Solutions. • In Progress – Data Intelligence team created and BI Hub in development. Data Insights Manager recruited and in post January 2022. • Phase 3 development nearing completion and was focused on the development and delivery of a wide range of data products. • Phase 4 programmed for July 2022 - March 2023 and will focus on skills and knowledge transfer from the contracted provider to Council staff to ensure the Business Intelligence Hub can be developed and maintained in-house by Council staff when the current contract expires. This will include finalisation of the Operating Model which includes role descriptors and skills requirements both basic and advanced linked to the Data Custodian model. Develop a formalised data quality improvement framework to increase trust in data, facilitate more effective data sharing, and to ultimately use a single source of information to predict future trends and demographics, thereby supporting effective resource allocation and service delivery. • In progress - draft data quality assessment guidance approved by DGB in November 2021. • Critical Data Audit launched January 2022 and will be completed Summer 2022. • Next stage will be Critical Data Audit learning fed back to DGB and thereafter quality standards will be agreed, and improvement actions identified for each data entity. • Line of Business Data Stewards identified development of a new Line of Business Data Steward Lead role underway and following Data Management Team self-evaluation will be incorporated into this team. Table 3 - Data and Information Management Strategic Roadmap (the Roadmap) Progress Page 243 of 285
Page 244
17 Records Management Plan 61. The Public Records (Scotland) Act 2011 Assessment Team has a mechanism that allows authorities to self-assess on its records management arrangements and the commitments it laid out in its current Records Management Plan (RMP). The Council was commended for submitting a Progress Update Review (PUR) and continuing to take its statutory obligations seriously in this report from February 2021. NRS – Progress Update Review (PUR) Final Report by the PRSA Assessment Team for North Lanarkshire Council and Licensing Board, February 2021 (nrscotland.gov.uk) 62. Because of the Assessment Team’s scheduling issues, no PUR was requested or submitted in 2021-22 but the Council will participate in the scheme in 2022-23. The Council continues to work on the areas that the Keeper of the Records of Scotland identified for improvement namely File Plan, Destruction Arrangements, Vital Records and Audit Trail. Much of this work is currently being addressed by migration to a file plan within O365 and implementation of automated retention periods. 63. The current RMP is now five years old, but the Corporate Records Manager has not yet received an invitation to submit a new Records Management Plan. It is known that there are some delays in issuing invitations so it may be 2023 before this invitation is received, as determined by the Assessment Teams own schedule. The Assessment Team generally give a six-month timeline to complete and submit a new Records Management Plan. Page 244 of 285
Page 245
18 LIVE IMPROVEMENT PLAN 64. Paragraph 11e above highlights the DGB Terms of Reference require the group to establish, resource and monitor an information governance improvement plan. Such an action plan is maintained, and outlines key tasks required, together with details of the responsible officers, completion timescales, status, and percentage complete. The plan is monitored by the DMT and is a standing agenda item at meetings of the DGB, enabling progress updates and escalation of specific tasks as required. 65. By its nature, the plan must be flexible and dynamic, with any new improvement areas identified by for example services, Business Data Owners, management, and Internal Audit appropriately incorporated. The following represents a summary of the key actions included within the improvement plan at March 2022. It is envisaged these will be progressed throughout 2022-2023 to further strengthen the Council’s information governance and data accuracy arrangement a. Refresh and strengthen approach to mitigating Cyber Security risks ➢ With Cyber Essentials cost prohibitive for the Council to use, our focus has shifted to using PSN accreditation as the principle means of demonstrating external oversight of the Council’s security posture. With the Council having accredited to the PSN through to May 2023, work has already commenced on ensuring this is maintained beyond then. ➢ Continual improvement to manage risk is the bedrock of information security practice within the Council. From a thematic perspective, improvement actions currently underway can crudely be separated into the adoption of technical and non-technical controls. The programme of work to improve technical security includes examination and where necessary upgrading access and authentication controls. As intimated, separation between what may be termed technical and non-technical controls is crude, and this line of activity extends to the less technical elements such as user onboarding and offboarding practices. Other technical improvements on the current roadmap include the procurement of new backup tools to provide better assurance around the integrity of backups, and the onboarding of a new security event and incident management system. ➢ The application of technical cyber security controls is one dimension where the council will continually seek to make improvements where warranted. At the same time, processes for managing risk and assuring the council’s posture will continue to be taken forward. A programme of documenting baseline security controls is under way to demonstrate alignment with Scottish Government expectations for the Scottish public sector. Awareness-raising for staff will continue to be a significant theme, with formal council training materials being scheduled for a major review. Compliance will continue to be a significant theme with PCI DSS and PSN regimes being the focus. Internally, collaboration with Internal Audit will continue to take place to ensure appropriate controls and practices are adopted as necessary. ➢ Several other initiatives are planned for 2022-23, including procuring a cyber incident retainer partnership with a third-party organisation experienced in managing major cyber outages, and on a related note improving ICT disaster recovery and incident response practice. Improving the gathering of metrics about security posture and threat will be looked at, as will elements of supply chain security, and benefits of cyber insurance. Page 245 of 285
Page 246
19 ➢ In the previous SIRO report workstreams were identified from the findings of the Information Security Maturity Assessment (IT Score) exercise carried out in January 2021. Though paragraph 33 details activities progressed to deliver on required improvements in respect of controls catalogue, monitoring risk exposure and documenting technical plans, capacity issues will always remain, and to that end, Business and Digital will look to assess itself against Gartner’s Information Security Maturity Assessment by the end of financial year 2022-23 to ensure improvement effort scheduled reflects the right priorities and business needs. b. Implement Improvement Actions identified in DGB Self-evaluation exercise Section 42 above illustrates that DGB effectiveness can be enhanced by addressing four identified improvement areas as follows: ➢ Enhancing the knowledge and understanding of all DGB members, especially those new to the role ▪ Develop induction pack for members, comprising role profile, FAQ, and jargon buster ▪ Provide opportunities for members to have oversight of Disaster Recovery plans to ensure systems remain resilient ▪ Implement membership monitoring scheme to ensure regular attendance of knowledgeable individuals ▪ DGB members to confirm completion of all mandatory e-learning ▪ Occasionally focus agendas on deployment of the Data Custodian Model. ➢ Raising awareness and understanding of information security and governance, and managing information as a strategic resource across the Council, and with the public through the Community Boards ▪ Develop a targeted communication plan to raise the profile of the work of the DGB and DMT ▪ Develop protocols regarding data sharing ➢ Fully deploying the various processes and practices more systematically and consistently across the Council ▪ Develop champion process / lead Data Steward for each master data entity ▪ Develop information governance guidance on working with O365, focussing on file creation, file migration, effective use of Teams etc ➢ Making better use of a range of tools, techniques, and measures to regularly assess and promote the effectiveness and success of the work of the DGB ▪ Develop measures of success for the DGB, establishing a baseline which facilitates measurement of outcomes Page 246 of 285
Page 247
20 c. Raise the profile and prioritisation of Information Governance and Data Protection responsibilities ➢ Section 2 above illustrates everyone - staff and elected members - must understand the importance of information governance and security, as compliance with its requirements depends on all operating good practice. ➢ Mandatory training completion rates for the last 2 years - as detailed in sections 61 and 62 above - remain lower than desired. In considering this alongside the less than satisfactory level of data breaches reported within 72 hours (paragraph 26), awareness raising, and targeted promotion clearly remain a key priority on the information governance improvement plan. To improve scope for this activity to increase compliance levels, the feedback received through LearnNL training evaluations will be used to improve and tailor course content to the needs of individual posts. ➢ Additional discretionary training, linked to the new requirements associated with Business Data Owners, Data Stewards, and Data Architects, is required, and will therefore be developed during 2022-23. ➢ The Business Data Owner for the ‘people’ data entity (Employee Service Centre Manager) and Relationship Manager within Business and Digital will continue to work with services as a priority to: ▪ Deploy tailored toolbox training for frontline employees ▪ Identify posts required to complete mandatory information governance training modules. ➢ Both will also work with the Talent and Organisation Development (TOD) team to identify training to appropriately increase the awareness of other roles and elected members regarding their responsibilities to ensure information and data is held securely, processed appropriately and safely destroyed when not required. d. Incremental implementation of the Data and IM Strategic Roadmap (the Roadmap) ➢ Section 60 above illustrates the Roadmap will be implemented through a series of work packages. Given the inherent links to the DigitalNL Programme and developing Business Intelligence Hub, aspects of the Roadmap are already underway. Other aspects will be taken forward incrementally through the DGB and DMT, with detailed timescales for delivery established. ➢ The new Data Governance and Management Framework is essential for ensuring data is viewed and used as an asset council wide. This, and the associated Data Custodian, Data Steward, and Data Architect roles, will be further defined, developed, and deployed within services through the refreshed DGB and DMT arrangements. ➢ DMT Terms of Reference to be reviewed to ensure effective alignment with the approved Data Governance and Management Framework. DMT membership to vary to ensure Data Steward representation adequately reflects all key Line of Business (LOB) systems, with joint work between services and Business and Digital planned to identify all key LOB. Page 247 of 285
Page 248
21 CONCLUSION 66. In summary, significant progress to strengthen the Council’s approach to managing its information risks continued throughout 2021-22 with sections 37 to 63 above providing relevant context and detail. 67. Improvements can always be made, and with a residual risk score of 20 prevalent in respect of our Information Governance and Information Security corporate risk (March 2022), this subject matter remains a high priority improvement area for the Council. 68. A detailed improvement plan exists and is monitored by the DMT. A summary of the priority actions at March 2022, is detailed above. Progress against these will be managed by the DGB throughout 2022-23, who will look to further develop policies, guidance, standards, processes, and approaches as appropriate to improve awareness, understanding and compliance with legislative requirements and good practice. 69. There is a growing concern however, in these times of increasing cyber-attacks, regarding the Council’s ability to fully secure the data held within older legacy business applications. Action is therefore required through existing capital and revenue resources, and Business Continuity Planning, to address this growing risk. Katrina Hassell Chief Officer of Business and Digital Page 248 of 285
Page 249
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref: KH/LJ Date 16/02/23 PO003.2: DigitalNL Quantifying and Reporting on Non-Financial Benefits From Katrina Hassell, Chief Officer (Business and Digital) E-mail HassellK@northlan.gov.uk Telephone 07903 096 121 Executive Summary The DigitalNL programme is subject to a series of audits with such aimed at providing levels of assurance that the overall programme is progressing against predetermined targets, that governance is robust and that benefits as outlined in the approved Full Business Case are being realised. To date, the DigitalNL programme has been subject to four audits with each making a small number of recommendations with regards suggested improvements. On each occasion management within Business and Digital have viewed the outcome of such reports and the recommendations contained therein as valuable feedback for improving processes within the overall programme. This report focusses on the recommendation made within the most recent internal audit report for DigitalNL completed in November 2021 with regard to the identification, calculation, monitoring and tracking of non-financial benefits. This recommendation was assessed with a residual risk rating of medium. The tools and techniques developed and utilised within the service for the DigitalNL programme are highlighted as is the complexity of such in capturing and reporting on both council-wide and service non-financial benefits in line with the already approved Year 4 Roadmap. The report highlights a number of next steps to be developed in order to finalise and fully deploy the non-financial benefits element of the Benefits Tracker. Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Recognise the development and implementation of a bespoke Benefits Tracker to capture financial and non-financial benefits for the DigitalNL Programme (2) Acknowledge the robust processes in place for capturing non-financial benefits (3) Recognise the commitment to the continued development of non-financial benefits through the deployment of the approved Year 4 Roadmap (4) Support the next steps outlined in paragraph 2.23 of this report Otherwise note the report. AGENDA ITEM 16 Page 249 of 285
Page 250
1. Background 1.1 The DigitalNL Transformation Business Case (FBC) approved by Policy and Strategy Committee in March 2019 highlighted that transformation had to go beyond council walls and operations, with a whole place approach required to turn the Council’s Digital Vision and The Plan for North Lanarkshire into reality. Recognising the complexity of change required to operational and customer facing infrastructure, IT services and culture, this FBC proposed two complementary and interdependent programmes (a) Digital Economy and Place and (b) Digital Council Transformation (DigitalNL), be progressed to enable the Council to use technological advancement such as ultra-fast broadband, artificial intelligence and next generation smart devices to redesign services around the needs of communities and businesses. Whilst non-financial benefits were identified as the key drivers of these complementary programmes, our Digital Business partner’s experience of similar transformations indicted the proposed digital solution deployments could also be financially beneficial to the Council. 1.2 The DigitalNL aspect of the Council’s Transformation Programme focussed on three distinct areas: - • Digital Workplace (M365) to improve collaboration • Cloud Storage Solution to create agility and efficiencies • Digital Platform (Customer Relationship Management) transforming how the council interacts with its citizens. 1.3 However, as Members are aware aspirational programmes such as DigitalNL and Smart NL slowed considerably during 2020-21 and 2021-22 as the Covid-19 pandemic took hold. 1.4 As part of the Council’s recovery planning, and the governance arrangements in place for the DigitalNL Programme, during 2021-22 and 2022/23, a series of root and branch reviews of the programme focussed on: • The planning of future years’ business change, service design and technology build • Alignment of associated capital and revenue expenditure • Envisaged financial and non-financial benefits 1.5 At its meeting of 1 December 2022 the Policy and Strategy Committee received a report “PoW003.2 DigitalNL – Next Steps” from the Chief Executive which provided a review of the programme deliverables achieved to date against those outlined in the FBC approved by Members in March 2019. It outlined what had gone well alongside the challenges encountered in achieving financial and non-financial benefits to date. 1.6 Since its inception the DigitalNL Programme, including that of the FBC, has been subject to a series of internal audits with the aim of providing assurance on the adequacy and effectiveness of the arrangements in managing the programme. The Plan for North Lanarkshire Priority Improve North Lanarkshire's resource base Ambition statement (18) Ensure our digital transformation is responsive to all people's needs and enable access to the services they need Page 250 of 285
Page 251
1.7 The fourth such audit was reported to Audit and Scrutiny Panel on 9 December 2021 and recognised that the governance arrangements for the Programme appeared to be adequate. However, the audit also highlighted that given the programme’s performance to date in delivering expected savings, the compression of the programme as a result of Covid and other impacts and the challenges presented by delivering many of the remaining individual projects/workstreams it was considered that uncertainty remained over the ability of the programme to fully deliver future expected savings”. 1.8 The report further recognised the work of Business and Digital in devising a Benefits Tracker, with Internal Audit advising that they were pleased to note that re-baselined financial benefits were being tracked. 1.9 However, there was recognition that non-financial benefits required to be adequately tracked and monitored to allow the Council to demonstrate the achievement of the objectives of the programme. As a result, the report recommended that “the non- financial benefits tracker is finalised and approved with non-financial benefits thereafter identified, calculated, tracked and monitored for all workstreams.” 1.10 Updates on progress with the development of the non-financial benefits element of the Benefits Tracker were provided to the Audit and Scrutiny Panel in September and November 2022 respectively. Having considered the current position and associated Internal Audit commentary on 24 November 2022, the Panel requested senior management provide a report for their next meeting which details plans to finalise the non-financial benefits element of the Benefits Tracker. This report satisfies that request, but also takes the opportunity to remind members of the progress and approvals realised to date. 2. Report 2.1 It was highlighted in the FBC in March 2019 that non-financial benefits, including process efficiency, upskilling of the workforce and development of data as a strategic asset were the key drivers for the DigitalNL Programme. However, during financial year 2019-20, with the Council moving towards a challenging 3-year budget, the emphasis on financial benefits became the prominent driver. 2.2 Notwithstanding this, initial design concept work for the Council’s benefits management arrangements, and specifically processes for identifying non-financial benefits, continued with support from our Business Partner, PwC, moving into the development phase during early 2020. 2.3 The intended aim behind such a development was to integrate benefits management as the way in which the council would know that the planned change(s) has happened, is fully sustainable and that the benefits identified are being realised. By proactively managing this approach, the Council would ensure that anticipated improvements and returns from investment are realised. 2.4 From the outset the design documents set out five key pillars to ensure the design and delivery of the council’s future state with benefits at its core, would incorporate the following: (i) Be as straightforward and as easy to understand as possible to ensure adherence to processes. Page 251 of 285
Page 252
(ii) Allow tracking and assessment of all identified benefits as part of the future state design. (iii) Form a key facet of programme planning to ensure that a focus on benefits drives all activities and decision-making. (iv) Assign ownership of benefits to ensure there is always a responsible person accountable for successful delivery. (v) Include robust reporting arrangements to ensure the relevant Boards and Committees receive an update regularly. 2.5 The programme consists of three strategic strands with benefits, once identified, linked to one or more of these strands thus ensuring the Council delivers the change and demonstrates the impact of improvement. (*including transactions, workforce, analytics, and insights) 2.6 An update on the non-financial benefits for all three strands was presented within the “PoW:003.2 DigitalNL - Year 4 Roadmap report submitted to Policy and Strategy Committee on 29 September 2022. Additional information on the Digital Economy benefits was submitted to Policy and Strategy Committee on 1 December 2022 with a further update on Digital Communities being presented to the Communities Committee on 6 February 2023. 2.7 Focusing now on the Digital Council, the finalised “Benefits Realisation Management Approach” provides the framework by which financial and non-financial benefits for the Digital Council are realised. This was approved at the DigitalNL Delivery Board in May 2020 and thereafter updated and approved in February 2021 to incorporate the ‘Design to Live’ stages of Business Change. 2.8 Following approval at the DigitalNL Delivery Board the “Benefits Realisation Management Approach” was issued to the Corporate and Operational Management Teams to cascade throughout the organisation, thereby increasing council-wide awareness of the process and templates used for capturing benefits arising from Page 252 of 285
Page 253
redesign activities. The Business Change Team issue this documentation as part of the service design to live process and carry out workshops with senior service-based staff to communicate transformation processes including those required to identify, calculate, track, and monitor financial and non-financial benefits. 2.9 Following approval and cascade of the benefits realisation approaches the scope and design of the tool required to monitor financial and non-financial benefits commenced with phase one of the Benefits Tracker – identifying and monitoring financial benefits (a budget tracker) - being approved at the DigitalNL Delivery Board in February 2021. 2.10 As has been reported previously to the former Transformation and Digitisation Committee, following implementation of the Budget Tracker, and with the focus on the financial position as detailed in 2.1 above, resources were targeted towards the re- basing of the financial benefits defined in the FBC. 2.11 Phase Two, the design of the non-financial tracker, took place during 2021/22, capturing input and feedback from the Business Change Team and ensuring the strategic links to The Plan for North Lanarkshire and associated Programme of Work continue. The outline scope of the non-financial element of the Benefits Tracker was approved at the DigitalNL Delivery Board in February 2022. This summarises the benefits/achievements categorised into one of the three digital strands outlined in 2.5 above. 2.12 Non-financial benefits for the Digital Council comprising council and service-wide benefits are documented in BR08 Benefit Summary (Appendix One). A condensed version of this benefits summary was included in the aforementioned report to Policy and Strategy Committee in September 2022. Non-financial Benefits – Digital Council 2.13 Within the benefits approach a “Benefit” is defined as “The measurable improvement resulting from an outcome perceived as an advantage by one or more stakeholders, which contributes towards one or more organisational objectives” This ensures that all benefits: • are measurable • show the improvement resulting from the change • create links between tangible outputs and strategic goals • ensure alignment of effort, resources, and investment towards achieving organisational objectives 2.14 In order to ensure alignment with The Plan for North Lanarkshire there are five areas of impact to categorise benefits. These are shown in Table 1 overleaf. Page 253 of 285
Page 254
Primary Area Explanation Impact Ambition Statement Financial Saving money or reducing expenditure 21 Continue to identify and access opportunities to leverage additional resources to support our ambitions Process Improving efficiency and promoting channel shift 24 Review and design services around people, communities, and shared resources Customer Enhancing user experience and satisfaction 19 Improve engagement with communities and develop their capacity to help themselves Employee Investing in employees by providing training, tools, and support 25 Build a workforce for the future capable of delivering on our priorities and shared ambition Environmental Reducing the councils carbon footprint by producing fewer emissions etc. 22 Facilitate a North Lanarkshire wide approach to asset rationalisation, including with communities and partners Table 1 – Benefit Categories The Six Stage Process 2.15 In order to identify such benefits, a clear six-stage process is in place: Define Success develops a clear understanding of why the change programme is required Identify and quantify considers the approach to identifying benefits (including discovery workshops, benefits mapping and ‘customer insight’) as well as forecasting the scale of the improvement anticipated and identification of links to The Plan for North Lanarkshire Value and appraise models financial benefits in monetary terms; and assesses value, volume, or transactional measure for non-financial benefits Plan considers the approach to validating and prioritising benefits, selecting benefits measures, engagement with stakeholders, identifying roles and responsibilities, and pulling all document outputs together Realise covers tracking, reporting, corrective action, effective approaches to stakeholder management and achieving change Review considers the importance of review as a basis for learning and continuous improvement before, during and after change 2.16 To be successful in the realisation of benefits, the identification of a defined set of objectives, benefits, and impact is an essential start. Step 1 – identify the original objectives from the FBC – this is the first reference point Page 254 of 285
Page 255
Step 2 – identify and quantify the benefits captured from engagement activity (Opportunity Workshops, Playback Sessions and 1:1’s with Service Management Teams) Step 3 – quantify the impact if the change programme is implemented, ensuring any benefit identified have a direct link to The Plan for North Lanarkshire Step 4 – use the above information to complete the relevant supporting documents including the Benefit Profile and Map. Identification of Non-Financial Benefits 2.17 At the outset of the DigitalNL programme early indicators of non-financial benefits were captured via a benefits log and used as a reference to design benefit maps for each of the service areas within the FBC. At that time Transformation Opportunities were translated into maps with each indicating the following: • Theme • Opportunity • Requirement (relating to process, technology, and people) • New way of working • Benefit linked to one or more of the primary areas of impact: - Process – reduction in front office costs Customer – improved customer satisfaction Employee – improved staff satisfaction Environmental – improving the councils carbon footprint 2.18 Transformation opportunities were linked to associated themes and digital enablers. Digital Themes Digital Enablers 2.19 Appendix Two provides an overview of the Waste Management Self-Service theme and outlines the journey for online capabilities where customers can access online services 24/7 to pay for a service, book a service or report an issue. The final benefits map for Waste Services and that for Built Environment will be completed in January 2023. Thereafter maps will be designed for each service area in line with the approved Year 4 Roadmap. Page 255 of 285
Page 256
2.20 With non-financial benefits having been reviewed for those Council and Service sprints already complete, the updated BR08 Benefit Summary was considered at the Business and Digital Delivery Board on 15 December 2022, with Board Members confirming such sufficiently assures them that non-financial benefits are being tracked, monitored and recorded in accordance with benefit maps. Non-Financial Benefits – Achievements to date 2.21 With improved tools for communication and collaboration rolled-out across the organisation through the M365 project, the first non-financial benefits were identified through increased productivity, efficiency, and environmental sustainability. The enablement of an agile, flexible, and modern workforce by the delivery of modern technology has led to easier collaboration both internally and with external partners. A smoother hand-off between staff on business-critical documents are now evident along with the ability to implement hybrid and home working without disruption to the working day. Further details are provided in BR08 - Digital Council Summary (Appendix Three) which provides a detailed overview of the non-financial benefits currently being tracked. Category Activity Impact Process Improvement – leading to an efficiency saving by reducing manual transaction- based activities and adopting an automated on-line solution Customer Services Hub Business Intelligence Hub Robotic Process Automation (RPA) M365 File Management Digital Self Service: Transactions designed in a way that they require minimum effort from customers and staff Real-time dashboards and analytics allowing the Council to make informed operational decisions Automation of simple / rules- based queries and tasks removing time consuming low value activities The ability for staff and partners to collaborate. Staff are highly mobile and not tied to council offices Information stored in line with Corporate File Plan and retention and disposal of information managed with an electronic records management tool Improved Customer Experience – by enabling the service user to self-serve online and receive automated notifications enhancing the user experience and digital skills Customer Portal (Dynamics) Website (Drupal) Internet of Things (IoT) – Damp Monitors A digital customer interface that enables customers to self- manage, self-assess, and provide a single point of access to services Installation of damp monitor sensors to automate reporting, response and fixing of problems Page 256 of 285
Page 257
Category Activity Impact Employee Development – by providing training, tools, and support, enhancing digital skills and the workforce M365 Rollout Customer Services Hub Digital Platform and Azure Development Training ITIL Qualification On-line training suite developed for M365 Additional customer care training for customer services staff Knowledge transfer and upskilling of in-house developers and ICT staff Introduction of ITIL training for ICT and Business Change teams Environmental Sustainability – a reduction in the Council’s carbon footprint Virtual Housing Repairs Inspections Customer Portal Reduced travelling and increased productivity A digital customer interface to – reduce printing and postage costs Next Steps 2.22 Full implementation of the Benefits Tracker remains a key objective and will be supported through: • Maximising the use of the Digital Platform to achieve non-financial benefits • Identifying, calculating, and tracking the impacts of non-financial benefits arising from redesign activity detailed within the approved Year 4 Roadmap • Focussing on recommendations from Internal Audit to satisfy any further recommendations for improvement so identified. 3. Measures of success 3.1 Success will be evidenced through the realisation of non-financial benefits through the approach outlined in the Benefits Realisation Management Approach 3.2 Specific measures of success will be identified in the benefits log and maps associated with the Year 4 Sprint Roadmap. 4. Supporting documentation Appendix One – Combined Benefits Summary Appendix Two – Benefits Map – Waste Services Appendix Three - Non-financial Benefits – Digital Council Katrina Hassell Chief Officer (Business and Digital) Page 257 of 285
Page 258
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☒ No ☐ Page 258 of 285
Page 259
If Yes, please provide a brief summary of the impact? Business and Digital is responsible for the design, deployment and maintenance of all ICT and digital assets required by the Council. It has approved revenue and capital funding available to maintain supportable applications and transition Council services towards increased self-service and community-focussed delivery. Significant changes are envisaged regarding connectivity, IoT, software and hardware, but all will be considered by the Council’s Enterprise Architecture Governance Group (EAGG) as part of the overarching deployment process. Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Business and Digital have a defined risk management strategy in place to capture, assess and mitigate risks and issues. The annual review was reported to the Delivery Board on 12 December 2022 and provided clear integration between corporate, service and programme risks. Within the risk register R81 – Failure to realise identified benefits within the programme may lead to the programme not being able to deliver expected capabilities and outcomes. DNL Programme Risk Likelihood Impact Rating Evaluation Last Review Date Next Review Date Failure to realise identified benefits within the programme may lead to the programme not being able to deliver on expected capabilities and outcomes. 4 4 16 High 19/12/2022 16/01/2023 (reviewed monthly) 5.10 Armed Forces Covenant Duty Page 259 of 285
Page 260
Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 260 of 285
Page 261
Appendix One Combined Benefits Summary Page 261 of 285
Page 262
Appendix Two Page 262 of 285
Page 263
Appendix Three Page 263 of 285
Page 264
Page 264 of 285
Page 265
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref KH/SL Date 16/02/23 Update on the implementation of the refreshed Project Management Framework From Katrina Hassell, Chief Officer (Business and Digital) E-mail HassellK@northlan.gov.uk Telephone 07903 096 121 Executive Summary Following the strategic frameworks annual position statement report to the Audit and Scrutiny Panel, Members will be aware of the work undertaken in 2022 to review and refresh the council’s corporate project management arrangements. This review culminated in the launch of the refreshed Project Management Framework on 16th December 2022. The review of this framework followed recommendations arising from Internal Audit reports - on the governance of capital projects and managing strategic change - which both reported a reasonable assurance (green-amber) audit opinion, but considered further action was required and/or there was scope for improvement in five specific areas. The recommendations from these audits were assessed with a residual risk rating of medium. The review and refresh exercise was also considered necessary in light of the changes in the council’s operating environment since the implementation of the Model in 2018; changes which include the impact of the pandemic and the economic situation as well as ongoing financial pressures. These changes have led to a rapid evolution of programmes and projects across the council, as well as increasing complexities in the delivery of many of these, and a greater need to make certain of the range of interconnections and interdependencies across an increasing number of related areas of work. This resulted in a growing need for a flexible framework that facilitates good governance and good project management in the set up and delivery of a wider range of projects at pace and scale. This was considered essential to ensure future projects are well-directed, delivered to time, cost, and quality targets, and provide the expected benefits and improved local outcomes if they are to successfully deliver on the vision set out in The Plan for North Lanarkshire. In line with the Internal Audit: Follow up of actions previously agreed by management in response to audit recommendations report to the Panel in November 2022 and the subsequent request by the Panel, this report focusses on two recommendations arising from the governance of capital projects and managing strategic change audits which were considered as “not yet complete”. In doing so it specifically provides information on reporting to all stakeholders on key projects and the arrangements for monitoring compliance with the project management framework through a review programme. AGENDA ITEM 17 Page 265 of 285
Page 266
1. Background 1.1 Since the Project Management Model was launched in 2018, it has been the subject of various areas of work for Internal Audit, with the most recent audits - in terms of the governance of capital projects (December 2019) and managing strategic change (June 2021) - resulting in duplicated recommendations and the duration between audits being impacted on by the pandemic. 1.2 Notwithstanding this, work commenced in April 2020 to address the recommendations identified for the governance of capital projects. However, the subsequent impact of the pandemic and implementation of council and service Recovery Plans (whereby the Project Management Model was assessed and allocated a recovery timescale of March 2021) meant the intended enhancements became impracticable and unable to be resourced, and therefore did not progress as planned at that time. 1.3 While responding to and recovering from the pandemic in 2021, work resumed on all the strategic frameworks (including the Project Management Model) and in June 2021 the Corporate Management Team agreed the need to review the Model to ensure it remained fit for purpose given the scale of past (and future unknown) challenges. It was also considered important that moving forward the Model was flexible enough to be able to deal with potential uncertainties, and was effective in managing / delivering projects and co-ordinating teams through a new hybrid way of working. Of particular importance was the need to ensure it was operating effectively in practice in order to support the management, governance, and delivery of the wide range of council projects that required to be delivered to support The Plan for North Lanarkshire. 1.4 The review and refresh exercise was also considered necessary in light of the changes Recommendations It is recommended that the Audit and Scrutiny Panel: (1) Are aware that information in respect of reporting to all stakeholders on key projects and the arrangements for monitoring compliance with the project management framework through a review programme are contained within the refreshed Project Management Framework (2022), as per the extracts in Appendices 2 and 3 of this report, (2) Acknowledge the work underway to establish the quality assurance process and review programme for the Project Management Framework for implementation in 2023/24, (3) Recognise the commitment to ensuring that the programme of activity - to roll out the refreshed Project Management Framework and all its component parts - is implemented to its full and final conclusion, with ongoing monitoring and strategic oversight in place thereafter, (4) Are aware of the future Elected Member oversight role in terms of the quality assurance process and review programme for the Project Management Framework, and (5) Otherwise note the contents of this report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements Page 266 of 285
Page 267
in the council’s operating environment since the implementation of the Model in 2018; changes which include the pandemic and the economic situation (which has impacted on rising contract costs, availability of suppliers and service providers, increasing costs and availability of supply chain materials, and escalating energy prices), as well as the ongoing financial pressures. 1.5 These changes have led to a rapid evolution of programmes and projects across the council, as well as increasing complexities in the delivery of many of these, and a greater need to make certain of the range of interconnections and interdependencies across an increasing number of related areas of work. With the pandemic also came need for strategic project management which crossed more service and local authority boundaries and was required to be developed and implemented at a larger-scale and faster pace than ever before. 1.6 This has resulted in a growing need for a flexible framework that facilitates good governance and good project management in the set up and delivery of a wider range of projects at pace and scale. This was considered essential to ensure future projects are well-directed, delivered to time, cost, and quality targets, and provide the expected benefits and improved local outcomes if they are to successfully deliver on the vision set out in The Plan for North Lanarkshire. 1.7 A Review Group was established to review and update the Model. This group benefitted from the expertise of a wide range of officers from across the council with practical on the ground experience of project management in both construction and non-construction projects. The group participated in a review and self-evaluation exercise which comprised three parts - an initial Poll assessing the approach, its deployment, and the assessment and review processes, an assessment against the Audit Scotland model of good project management practice, and a fact-finding questionnaire about the Review Group’s knowledge and experience of the Project Management Model (2018), as well as their usage of the documentation that made up the Model and their views on its usefulness. 1.8 Following work to collate and analyse the information collected through the review and self-evaluation, five themes on areas for improvement consistently emerged. These subsequently informed the development draft which was finalised for May 2022 and the final consultative draft which was completed for September 2022. 1.9 As reported to the Audit and Scrutiny Panel in November 2022 (in the strategic frameworks annual position statement report), the consultative draft of the refreshed Project Management Framework (2022) was approved by the Corporate Management Team on 27th September 2022. 1.10 The consultation exercise with the council’s Operational Management Team and Organisational Design Authority group - to ensure appropriate feedback from a wider more operationally focussed audience - subsequently concluded in October 2022. 1.11 An engagement and communication programme was then undertaken across Services during October and November 2022 in order to raise awareness of the refreshed Project Management Framework, highlight the key differences and mandatory aspects therein, and ensure appropriate consistency of approach in terms of implementation. More importantly, this also aimed to help those affected by the change to transition seamlessly to the refreshed Framework and use it - not as a tick box exercise - but to add value and effective support to the everyday tasks involved in developing, managing, and delivering projects. Page 267 of 285
Page 268
1.12 As also noted in the report to the Audit and Scrutiny Panel in November 2022, it was recognised that the refreshed Project Management Framework contains a significant volume of information that relevant staff will require to become familiar with and apply. As such, the supporting training and learning and development programme is considered important in terms of the rollout and implementation process. A similar rollout to that which occurred in 2018 is currently under development for implementation in 2023. 1.13 Following the successful conclusion of the pilot for the new face to face training programme (which was trialled on 9th December 2022), the refreshed Project Management Framework (2022) - and all its supporting documentation - was shared across the council via a NLC Announcement on 16th December 2022. 1.14 As noted in the Internal Audit: Follow up of actions previously agreed by management in response to audit recommendations report to the Panel in November 2022 two recommendations arising from the governance of capital projects and managing strategic change audits were considered as “not yet complete”. This report herewith therefore focusses on the recommendations made within the governance of capital projects audit with regard to reporting to all stakeholders on key projects and the managing strategic change audit with regard to the arrangements for monitoring compliance with the project management framework through a review programme, and provides an updated position on these two recommendations as at the time of writing (January 2023). 1.15 In considering the updated position presented on these recommendations it is worth noting that the implementation of the refreshed Project Management Framework (2022) is a live piece of work (as evidenced by the context presented in paragraphs 1.1 to 1.13 above and the timeline in Appendix 1). As such, a programme of activity is currently underway to ensure that the refreshed Project Management Framework (and all its component parts) is implemented to its full and final conclusion, with ongoing monitoring and strategic oversight in place thereafter. 2. Project Management Framework 2.1 The refreshed Project Management Framework (2022) comprises a comprehensive section on Governance which covers the matters raised by both the governance of capital projects and managing strategic change audits. An extract of this section is attached as Appendix 2, and specific details in this respect are highlighted in paragraphs 2.2 to 2.15 below. Managing strategic change Management should progress the previously identified action of establishing a reporting mechanism which better facilitates regular and ongoing oversight by key stakeholders of the progress of key projects against plan, including management of key risks, progress against timelines, cost against budget, achievement or otherwise of key milestones and expected outcomes or benefits realisation. We suggest that this could include introducing a standard reporting template and adopting a traffic light system to report progress against key criteria, project milestones and overall deliverability against expected time, cost and any other intended outcomes. Internal Audit recommendation, June 2021 2.2 The Governance extract in Appendix 2 contains guidance on reporting to all stakeholders. This is considered essential, as to support an effective project governance model there needs to be regular and consistent reporting to all stakeholders (including the Corporate Management Team, the council’s Committees, and all relevant Boards (or equivalent)). It is also considered essential that this facilitates oversight of the relevant projects and enables scrutiny that is ongoing and Page 268 of 285
Page 269
effective. 2.3 The guidance also includes an illustration for use of a RAG status. This is based on assessment criteria for three of the key dimensions within which the project requires to be delivered (i.e. cost, time, and quality) and is recommended for use in reports which update on the progress of specific programmes or projects. 2.4 Reference is made to the role of the Senior Responsible Officer (SRO) / Project Manager in ensuring that tolerance levels are agreed at the outset of each project by the relevant governing Board (or equivalent). This includes risk impact parameters and risk tolerances. 2.5 In addition, a list of best practice is provided which highlights the information which progress reports to all stakeholders (including the Corporate Management Team, the council’s Committees, and the relevant Boards (or equivalent)) - in line with the tolerance levels and impact parameters established at the outset - should include. This list is also set out below: • The date period the report is referring to, which is important for version control purposes. • A summary of the status of the project - this may include a percentage identifying the status of projects completed, and a RAG status. • Progress made within the latest date period - including details of the milestones and performance achieved and the progress made in terms of delivering the actions in project plan, inlcuding any recommendations for areas requiring improvement. • Requests for change - details on any significant changes to the project that affect the scope and could prevent the project from progressing. • Lessons learned - details of any lessons learned within the identified time-period that will improve future delivery of the project. • Information on key risks and issues in line with the escalation process; this should provide details on any known risks and issues within the time period of the report and set out what remedial action has been taken and if anything requires to be escalated. • Progress in terms of realising the expected benefits and/or achieving the intended outcomes originally set out in the Project Business Case. 2.6 In terms of the responsibilities for ensuring reporting to all stakeholders takes place, this is clearly defined as a mandatory task for the Senior Responsible Officer (SRO) / Project Manager in stage four of the project life cycle. This task is evidence in the extract of stage four (i.e. controlling - ongoing monitoring, management, oversight, and assurance) of the fundamentals of good project management section which is attached in Appendix 3. Governance of capital projects Management should review the project management model review programme, particularly in relation to expanding the sample of projects being reviewed to incorporate some capital and non-capital projects that services have not received advance notification; and reviewing and updating the checklist to include consideration of the adequacy and effectiveness of the completed control document templates, determination of whether established processes have been documented and confirmation that key stakeholders have been adequately updated on the progress of the project, in line with the suggested improvements. Internal Audit recommendation, December 2019 2.7 This audit recommendation is framed within the context of the 2018 Project Management Model and therefore some of its terminology does not align to the Page 269 of 285
Page 270
refreshed Project Management Framework for 2022. Nevertheless, the concept of establishing a review programme to ensure compliance with corporate project management arrangements has been maintained in the refreshed Project Management Framework for 2022 and was set out in the Framework when the consultative draft was approved by the Corporate Management Team in September 2022. 2.8 The governance extract in Appendix 2 contains the respective information and guidance on a quality assurance review programme. It is considered recommended good practice to ensure that quality assurance activities are in place to establish a systematic process of reviewing the documentation and methods adopted by a project and verifying that they are meeting the intended quality standards. The information and guidance in Appendix 2 also states that as one of the five dimensions in which the project requires to be delivered (i.e. scope, quality, time, cost/resources, and risk), quality assurance is a critical success factor in project delivery - the higher the quality level, the more likely a project will meet its aims and realise the benefits and/or improved outcomes it set out to achieve. 2.9 Furthermore, the information and guidance on the quality assurance review programme extract in Appendix 2 emphasises the benefits of such a process in helping to identify potential risks arising from the way a project is being managed and/or governed. In addition, it highlights that such a process can increase the confidence of stakeholders by providing the assurances that there is a serious commitment to producing a high- quality deliverable, that project plans are well-designed and well-executed, and that good project management and good governance arrangements are in place to ensure investment is well-directed, delivered to time, cost, and quality targets, and provides the expected benefits and improved outcomes locally. 2.10 The rolling quality assurance review programme which supports the Project Management Framework aims to provide the relevant assurances that projects are performing in line with organisational requirements and project decisions, and will (where applicable) produce a formal output to serve as the basis for implementing corrective actions. The quality assurance review programme, and the timings of each review to be undertaken therein, is informed by the Project Registers which each Chief Officer is required to maintain. 2.11 As reported to the Audit and Scrutiny Panel in November 2022 (through the strategic frameworks annual position statement report), each Chief Officer is required to maintain a Project Register for their projects that use the Project Management Framework. For strategic governance and oversight purposes, Chief Officers must submit a copy of their Project Registers twice a year - as at the end of September and as at the end of March. The latter date corresponds to the submission of the annual Chief Officer Assurance Certificate and Checklist which aims to provide evidence in respect of the council’s governance arrangements. 2.12 Project Registers as at the end of September 2022 were received from all Chief Officers by November 2022. These Registers have produced a substantial volume of information in terms of programmes, projects, and contracts being delivered across the council and, as such, work is currently underway to review and classify this with a view to establishing a composite Register and a strategic portfolio management approach for the council. This work (which is also taking into consideration a review of Project Boards and their associated governance arrangements, as set out in the Strategic Self- Evaluation Framework Review Programme) is scheduled to be reported the Corporate Management Team in February 2023 for senior management oversight. 2.13 Once this approach has been established, the quality assurance review programme Page 270 of 285
Page 271
can be finalised and rolled out for implementation in 2023/24. Aligned to the five stages in the fundamentals of good project management, the type of quality assurance reviews to be undertaken will be conducted in line with the implementation of the mandatory tasks and advanced recommended practice, and with due consideration of the type, size, and complexity of a project, what the project aims to achieve, the project’s deliverables, and the requirements of any related industry standards. 2.14 As noted in the extract in Appendix 2, good practice recommends that a council's audit and scrutiny committee have an important role to play in providing assurances about the delivery of major programmes and projects. The quality assurance process that supports the refreshed Project Management Framework will therefore form part of the work programme for the scrutiny function of the council’s Audit and Scrutiny Panel and be subject to high level reporting to the Panel to ensure an independent strategic oversight and assurance process. 2.15 As noted in the accompanying report on the agenda today for the annual scrutiny programme of the Audit and Scrutiny Panel, Elected Member oversight in terms of the quality assurance process and review programme for the Project Management Framework is scheduled for cycle 4 of 2023. 3. Measures of success 3.1 Measure of success include ensuring that good project management and governance practices are in operation across the council so that projects are managed efficiently and effectively and delivered to cost, time, and quality, and managers are able to respond effectively if problems arise. 3.2 Securing delivery of the programmes and projects in the council’s portfolio in line with good project management and good governance practices will better enable the council to effectively pursue the long-term ambition set out in The Plan for North Lanarkshire to realise inclusive growth and prosperity for all and ensure a fairer distribution of wealth across all local communities, while ensuring this is underpinned with control and the management of risk. 4. Supporting documentation 4.1 Appendix 1 - Timeline of the evolution of project management in the council, 2018 to 2023. Appendix 2 - Extract of the Governance section from the Project Management Framework (2022). Appendix 3 - Extract of the Fundamentals of good project management section from the Project Management Framework (2022) regarding ongoing reporting to all stakeholders. Katrina Hassell Chief Officer (Business and Digital) Page 271 of 285
Page 272
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? The consideration of these impacts have been incorporated into the relevant stages in the refreshed Project Management Framework document itself. If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ Page 272 of 285
Page 273
If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? The consideration of the environmental / carbon impact has been incorporated into the relevant stages in the refreshed Project Management Framework document itself. 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Work to refresh the Project Management Framework and enhance the council’s arrangements in this respect further supports the management and mitigation of risk across the wide range of programmes and projects, large-scale transformational activities, and the capital investment programme required to support delivery of The Plan for North Lanarkshire. It also contribute towards the mitigation of the risks on the Corporate Risk Register for Governance, Leadership, and Decision Making and Managing Strategic Change. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services. Page 273 of 285
Page 274
Appendix 1: Timeline of the evolution of project management in the council (2018 - 2023) Page 274 of 285
Page 275
Appendix 2: Extract from the Governance section from the Project Management Framework (2022) Note, as the following extract is a straight lift from the Project Management Framework (2022) document, it maintains the same page numbering and references to diagrams. These page numbers / references are therefore not relatable to this covering report. The links in the Project Management Framework (2022) document to Connect have been removed for the purposes of this extract, as these have since been updated to reflect the move to the InsideNL platform. Strategic Governance Framework Good governance enables the council to effectively pursue the ambition set out in The Plan for North Lanarkshire within appropriate controls and the management of risk. It is also central to ensuring effective scrutiny and delivery of statutory Best Value obligations. This means ensuring resources are directed in line with agreed policies, priorities, and project management procedures, and there is sound, inclusive, and transparent decision making and clear accountability for the use of those resources in achieving improved outcomes for service users and communities. Reflecting the principles of good governance (as defined in the national Delivering Good Governance in Local Government: Framework), the council’s local code of governance is set out in the Strategic Governance Framework. This brings the principles of good governance together with legislative requirements and management processes by which the council is directed and controlled and through which it is accountable to, engages with, and leads the local community. In practice, governance comprises the combination of structures, strategies, policies, plans, frameworks, systems, processes, rules, codes, procedures, cultures, and values that are used to direct, control, and manage the council’s operations and activities. These define roles and responsibilities and accountabilities and establish mechanisms to enable the council to pursue its vision effectively and ensure that the vision is underpinned with control and the management of risk. The list of items referred to in this paragraph are usually called elements and mechanisms. This Project Management Framework is a key element within the council’s Strategic Governance as to deliver successful investment and transformational programmes and projects, and realise the ambition set out in The Plan for North Lanarkshire, the council needs to ensure plans are well-designed and well-executed. Good governance and good programme and project management arrangements therefore need to go hand in hand as essential components that ensures investment that is well-directed, delivered to time, cost, and quality targets, and provides the expected benefits and improved local outcomes. Project governance The governance of a project is much like the governance of an organisation with project governance being the framework for how project decisions are made. It keeps projects running smoothly and on budget, within time, and to the expected quality standards. It specifically refers to the elements and mechanisms that define the establishment, management, and control of projects, programmes, and portfolios. To do this consistently, there needs to be overall oversight of the project and the arrangements that define how a project should be governed. This should ensure: Page 275 of 285
Page 276
• There is a clear structure for decision making - this should include a Programme or Project Board relevant to the project in hand and clarity in terms of where this Board fits within existing council decision making structures such as the Corporate Management Team, the Strategic Capital Delivery Group, and the council’s Scheme of Delegation for Officers and Scheme of Administration. - Scheme of Delegation - The Scheme of Delegation sets out the powers delegated by the Council to officers, pursuant to the Local Government (Scotland) Act 1973. The Scheme is intended to facilitate the efficient conduct of council business by clearly setting out the nature and extent of the powers delegated to officers by the Council. All decisions require to be made in line with council policy, procedure, guidance and (where appropriate) within approved budget. This is available on Mars: https://mars.northlanarkshire.gov.uk/egenda/images/att90599.pdf - Scheme of Administration - The Scheme of Administration provides the details and different functions of committees and other groups of each council and the delegation of authority to carry out the functions of the council. This is available on Mars: https://mars.northlanarkshire.gov.uk/egenda/images/att98939.pdf • The right people are in place and roles and responsibilities are clearly identified - this includes the key roles on the Project Team, such as the Senior Responsible Officer (SRO) and Project Manager as well as the Chair and Members of the Board. The Role Descriptors (on pages 12 to 14) provide a basic framework for identifying roles and responsibilities for each project. • There is open communication and the sharing of crucial information to support an effective project governance model. This includes regular, consistent reporting to assist project scrutiny that is ongoing and effective. There are many definitions of what constitutes good project governance, but they can all be summed up in the five principles set out in Figure. 13. In more detail this means: • Alignment to organisational objectives means that the projects undertaken by the council should be able to demonstrate, in the Project Brief and the Project Business Case, the contribution they make to the council’s long-term vision set out in The Plan for North Lanarkshire. With this contribution clearly stated then the project context is clear and governance of the project can ensure that the project is - and remains to be - focused on the outcome rather than the activities. • The golden thread of delegated authority is a direct chain of accountability. Within this chain each person needs to know what their authority is and what needs to be referred to a higher level of authority within the chain, how and when. • Reporting - those to whom responsibilities have been delegated should periodically report on progress. In addition to regular progress reporting, additional reports need to be made if the person with delegated responsibility is unable to fulfil that responsibility, or if conflicts of interest arise. • Independent assurance means an ongoing independent check is required - of the structures and processes that support the project and of the information presented through the reporting process - to assess whether the project aims are being met. Figure 13: Good project governance Page 276 of 285
Page 277
• Decision gates - the adoption of disciplined project life cycle governance should include approval gates at which viability is reviewed and approved at specified points in the project life cycle in order to provide formal points of control where a decision is made to grant or renew authority for the project to continue. Capital investment Not all programmes and projects in the council’s Portfolio are part of the Strategic Capital Investment Programme, and they don’t necessarily have to be. It depends on the type and complexity of a project, and its alignment to the council’s vision set out in The Plan for North Lanarkshire. This section aims to raise awareness of the council’s capital investment arrangements in order to ensure clarity in terms of the relationship with the Project Management Framework. Improving assets through capital investment can help the council deliver services more efficiently and effectively, enhance people’s life experiences, and help to: • Sustain and improve public services and achieve delivery plans and improved local outcomes. • Improve the overall efficiency of how the council manages its properties and reduce costs in the long-term (this includes reducing carbon emissions and helping to contain the effect of rising energy prices). • Boost economic growth and stimulate economic recovery, by providing employment opportunities in construction and engineering as well as wider commercial opportunities for local and national businesses. • Achieve a wide range of other goals and objectives, in accordance with local priorities. Audit Scotland guidance on capital investment in councils states that: • Councils make their own decisions about capital investment and must ensure their spending plans are prudent, affordable, and sustainable. • Planning capital investment requires a long-term and strategic outlook. • Councils must also select, design, and deliver individual investment projects to a high standard. • Elected Members are important decision makers for capital investment and have a fundamental role in ensuring that councils deliver investment plans successfully. • Effective governance arrangements that manage, challenge, and scrutinise how capital programmes are delivered, and strong financial, project, and risk management are all important to ensure that investment provides value for money. The council’s capital governance structure is well established. At all levels of the governance structure, from working groups to committee level, there are clear arrangements for reporting and monitoring. All levels are supplied with reliable, regular information on the capital programme including details of current performance, financial performance, risk, and benefits management. The governance structure supporting the Capital Strategy to 2022/23 [ https://mars.northlanarkshire.gov.uk/egenda/images/att90194.pdf ] and five year Strategic Capital Investment Programme to 2025/26 [ https://mars.northlanarkshire.gov.uk/egenda/images/att97974.pdf ] is set out in Figure.14 below. Page 277 of 285
Page 278
Level Purpose Key activities Policy and Strategy Committee Approval body for capital investment decisions. Comprises Elected Members. • Approves the Capital Strategy. • Approves the Strategic Capital Investment Programme. • Approves the Corporate Asset Management Plan. • Approves project inclusion into the Strategic Capital Investment Programme and associated funding. Corporate Management Team Responsible for strategic oversight of The Plan for North Lanarkshire and Programme of Work. Chaired by the Chief Executive. • Maintains strategic oversight and monitoring of council budget, financial savings, housing revenue account, revenue and capital budgets, and associated programmes. Strategic Capital Delivery Group A working group convened of senior officers which advises Elected Members in terms of capital allocation and project approval and has responsibility for the day to day management of the capital programmes, including the realignment of resources to facilitate the effective delivery of the Council’s Strategic Capital Investment Programme, including: • General Services core investment programme (including town and community hubs and enterprise projects). • HRA mainstream investment programme. • HRA new supply programme. Working group chaired by the Depute Chief Executive. • Monitors the council’s Strategic Capital Investment Programme, including performance against delivery aims and objectives. • Advises Elected Members on capital allocations and project approval, making recommendations on and amendments to the approved capital programme. • Ensures the proper alignment of capital resources to allow for effective delivery of the programmes. • Monitors expenditure projections against budgets and available resources, revising these where necessary, subject to the limits set out in the Terms of Reference. • Ensures robust governance arrangements around the delivery, monitoring, and reporting of capital programmes. • Considers the quarterly capital monitoring report to Committee to ensure appropriate actions are agreed for review by Elected Members. • Ensures Participatory Budgeting principles are embedded in key capital investment decisions of the council. • Arranges and undertakes training and awareness sessions, as required, to reinforce skills and knowledge across the council in respect of capital monitoring and capital financing. • Ensures all decisions made by the Group are Intra Vires and in line with The Plan for North Lanarkshire. Programme or Project Boards Project groups for the capital programme, each chaired by a Senior Responsible Officer (SRO) • Reviews and challenges Programme / Project Plans. Figure 14: Governance of capital programmes and projects Page 278 of 285
Page 279
The key point to emphasise in relation to the Project Management Framework is that when the Strategic Capital Delivery Group assess capital bids from Chief Officers, these are not necessarily project specific and they can often be for a general sum of money. It is thereafter up to a Chief Officer (or Board or equivalent), to ensure that the specific projects to be delivered using this funding are clearly identified and developed, planned, and delivered in line with the Project Management Framework. Governance structures There are a significantly large number of Boards (or equivalent) and working groups in place to support delivery of the range of programmes and projects within the council’s portfolio. A useful distinction is set out in Figure. 15. There are also clear distinctions between programme and project Boards - the most specific being that the Programme Board is responsible for the programme blueprint (i.e. how the programme vision is to be achieved) and the means of achieving it (i.e. all the individual but related projects within it). Setting out the arrangements for a Programme or Project Board (or equivalent), which include the governance framework, is a key task in developing the Project Brief and finalising the Project Business Case. The 12 points in Figure. 16 (on page 37) provide a checklist for Project Boards (or equivalent) to ensure their arrangements comply with good governance and good project management. It is the responsibility of the Senior Responsible Officer (SRO) and the Project Manager to ensure that the items on the checklist are implemented consistently. This checklist will also be part of a regular quality assurance programme which Boards will be subject to on a periodic basis. Reporting to all stakeholders To support an effective project governance model, there needs to be regular and consistent reporting to all stakeholders (including the Corporate Figure 15: Boards -v- Working Groups Page 279 of 285
Page 280
Management Team, the council’s Committees, and all relevant Boards (or equivalent)). It is essential that this facilitates oversight of the relevant projects and enables scrutiny that is ongoing and effective. Reporting to all stakeholders should use the council’s standard report template. This template is supported by detailed guidance on how to complete each section. Good practice recommends that reports on the progress of specific programmes or projects assign a RAG status based on assessment criteria for three of the key dimensions within which the project requires to be delivered (i.e. cost, time, and quality) - as an example see Figure.17. In defining the assessment criteria required to establish the RAG status, the Senior Responsible Officer (SRO) and Project Manager should ensure that tolerance levels should be agreed at the outset of the project by the relevant governing Board (or equivalent). This includes risk impact parameters and risk tolerances. If there is insufficient information to set all impact parameters at the outset, these should be set as and when the relevant information becomes available, but certainly the time the Project Business Case is completed. Setting impact parameters allows authority levels to be set for the Project Manager above which risks and issues must be escalated for the attention of the relevant stakeholder. Other information which is considered best practice to incorporate within progress reports to all stakeholders (including the Corporate Management Team, the council’s Committees, and the relevant Boards (or equivalent)) - in line with the tolerance levels and impact parameters established at the outset - includes the following: • The date period the report is referring to, which is important for version control purposes. • A summary of the status of the project - this may include a percentage identifying the status of projects completed, and a RAG status. • Progress made within the latest date period - including details of the milestones and performance achieved and the progress made in terms of Figure 17: Example of assessment criteria to assign a RAG status Page 280 of 285
Page 281
delivering the actions in project plan, inlcuding any recommendations for areas requiring improvement. • Requests for change - details on any significant changes to the project that affect the scope and could prevent the project from progressing. • Lessons learned - details of any lessons learned within the identified time-period that will improve future delivery of the project. • Information on key risks and issues in line with the escalation process; this should provide details on any known risks and issues within the time period of the report and set out what remedial action has been taken and if anything requires to be escalated. • Progress in terms of realising the expected benefits and/or achieving the intended outcomes originally set out in the Project Business Case. Page 281 of 285
Page 282
Quality assurance review programmeGood practice recommends that quality assurance activities are in place to establish a systematic process of Figure 16: Boards - good practice checklist Page 282 of 285
Page 283
reviewing the documentation and methods adopted by a project and verifying that they are meeting the intended quality standards. As one of the five dimensions in which the project requires to be delivered (i.e. scope, quality, time, cost/resources, and risk), quality is a critical success factor in project delivery - the higher the quality level, the more likely a project will meet its aims and realise the benefits and/or improved outcomes it set out to achieve. A quality assurance process can also help to identify potential risks arising from the way the project is being managed and/or governed, and it can increase the confidence of stakeholders by providing the assurances that there is a serious commitment to producing a high-quality deliverable, that project plans are well-designed and well-executed, and that good project management and good governance arrangements are in place to ensure investment is well-directed, delivered to time, cost, and quality targets, and provides the expected benefits and improved outcomes locally. As quality assurance involves a process of continuous improvement through the use of activities to verify and improve the project deliverables, a rolling review programme supports the Project Management Framework. This aims to provide the relevant assurances that projects are performing in line with organisational requirements and project decisions, and will (where applicable) produce a formal output to serve as the basis for implementing corrective actions. The quality assurance review programme, and the timings of each review to be undertaken therein, is informed by the Project Registers which each Chief Officer is required to maintain. Aligned to the five stages in the fundamentals of good project management (set out in Figure 11. on page 17), the type of quality assurance reviews to be undertaken will be conducted in line with the implementation of the mandatory tasks and advanced recommended practice, and with due consideration of the type, size, and complexity of a project, what the project aims to achieve, the project’s deliverables, and the requirements of any related industry standards. Project registers Strategic oversight of the range of programmes and projects, large-scale transformational activities, and capital investment programme activities in the council’s portfolio that use the Project Management Framework helps to provide a single source of truth across the organisation. It also further support good governance and good project management and promotes the sharing of good practice and lessons learned. As such, each Chief Officer is required to maintain a Project Register for their projects that use the Project Management Framework. For strategic governance and oversight purposes, Chief Officers must submit a copy of their Project Registers twice a year - as at the end of September and as at the end of March. The latter date corresponds to the submission of the annual Chief Officer Assurance Certificate and Checklist which aims to provide evidence in respect of the council’s governance arrangements. Project Registers should contain the following type of information as a minimum: • The name of the project (and where it is part of any related programme). • Expected start and finish dates. • Status, i.e. complete, in progress, at feasibility stage, etc. • Name of Senior Responsible officer (SRO). • Name of Project Manager (and Programme Manager, where applicable). Page 283 of 285
Page 284
• Governing Board, Working Group, or equivalent. Scrutiny Good practice also recommends that a council's audit and scrutiny committee have an important role to play in providing assurances about the delivery of major programmes and projects. Such a committee is not a decision-making forum in this respect and it does not replace any reviews undertaken by the Project Team or any independent reviews organised by a Board. Rather the role of such a committee is to be assured that suitable review procedures have been adopted and to gain assurance about the value of independent reviews that are undertaken during the project life cycle. The role of the council’s Audit and Scrutiny Panel in this respect will therefore be carried out in line with their terms of reference to provide “independent assurance to the council and those charged with governance on the adequacy of the council's risk management framework and internal control environment”. This strategic oversight of the council's governance, risk management, performance, and control frameworks (together with the annual governance processes) is central to ensuring effective scrutiny and delivery of statutory Best Value obligations. This means that the quality assurance process that supports the Project Management Framework will form part of the work programme for the scrutiny function of the council’s Audit and Scrutiny Panel and therefore be subject to high level reporting to the Panel to ensure an independent strategic oversight and assurance process. Page 284 of 285
Page 285
Appendix 3: Extract of the Fundamentals of good project management section from the Project Management Framework (2022) regarding ongoing reporting to all stakeholders. Note, as the following extract is a straight lift from the Project Management Framework (2022) document, it maintains the same page numbering and references to diagrams. These page numbers / references are therefore not relatable to this covering report. Page 285 of 285