Internal Audit Progress Report
North Lanarkshire Council · 16 February 2023
Back to Audit and Scrutiny Panel — 16 February 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No ☐approval ☒noting Ref KA/ASP/Feb23 Date 16/02/23 Internal Audit progress report From: Ken Adamson, Chief Officer - Audit and Risk E-mail: adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to provide an overview of Internal Audit activity and to report the results of Internal Audit outputs finalised since the last update to the Panel in November 2022. This report highlights the most significant issues arising from these recently completed Internal Audit assignments as well as providing updates on other aspects of the work of Internal Audit. Appendix 1 provides a summary of the scope and key findings of each substantive planned audit report and relevant investigative outputs. Full copies of the relevant audit outputs highlighted in this report are also included in the meeting papers In line with best professional practice and the approved Internal Audit Charter and associated reporting protocol. The 2022-23 Annual Plan was approved by the Audit and Scrutiny Panel in September 2022. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work be periodically reported to CMT and the Panel. This report fulfils that expectation. Recommendations The Panel is invited to: (a) note the findings, conclusions and recommendations of completed Internal Audit reports together with the associated management responses; (b) consider whether there are any issues raised by Internal Audit which the Panel consider are sufficiently significant to require a further report from management to be submitted to a future meeting of the Panel; (c) request that Internal Audit provide a report to future meetings of the Panel reporting progress made by management implementing agreed management actions in relation to all audit recommendations categorised as ‘High’ or ‘Medium’; and (d) otherwise note this report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 The 2022-23 Annual Plan was approved by the Audit and Scrutiny Panel in September 2022. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work be periodically reported to CMT and the Panel. This report fulfils that expectation. 2. Report Audit reviews completed in the period 2.1 Table 1 below provides an overview of completed Internal Audit reports since the last update to the Panel in November. Work is currently underway on other assignments included in the 2022-23 Plan and this work will be reported to the Panel as it is completed. Table 1: Completed Internal Audit outputs in the period Subject Internal Audit Opinion 1. Education quality assurance arrangements Reasonable assurance (Green-Amber) 2. Income and cash collection (leisure sites) Reasonable assurance (Green-Amber) 3. Controls – Use of Supply teachers Limited assurance (Amber-Red) 4. Creditors Reasonable assurance (Green-Amber) 5. Cyber-security Reasonable assurance (Green-Amber) 6. Investigation – Primary School A (Note 1) Not applicable Note 1: A summary of the key findings of this investigation is included in this report in line with the Internal Audit Reporting Protocol, but in view of ongoing police involvement, a copy of the full audit report is not included in the papers for this meeting. 2.2 Appendix 1 provides a summary of those reports forming part of the annual programme of planned assurance work and investigation reports as required by the Internal Audit Charter and associated reporting protocol. This report excludes audit outputs produced for the North Lanarkshire IJB which are reported directly to its senior management team and audit committee. 2.3 Appendix 2 contains detailed definitions of the categories used by Internal Audit when making recommendations, providing an audit opinion and on the extent of assurance which is being provided to management and Panel members on those systems or areas of Council operations examined by Internal Audit. 2.4 In addition to the above reports, work is currently underway on a range of topics including Contract management, Housing allocations, Single-tender response contract awards, Social Work quality assurance arrangements and the Council’s Corporate Governance arrangements. Once finalised, these reports will be submitted to a future meeting of the Panel.
Page 3
Commentary on completed planned ‘core’ Internal Audit work 2.5 The nature of Internal Audit exercises means that most audit reviews invariably find some scope for improvement, usually in the form of controls which are weak or only partially effective and, therefore, contain recommendations. 2.6 One of the five substantive non-investigation reports being reported in the period is assessed as providing only limited assurance, while four of the reports provided more positive levels of assurance. All five reports contain a range of improvement actions and made a series of recommendations. 2.7 Our work on Education quality assurance arrangements focused on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of primary and secondary education. Our work during the audit included benchmarking the Council’s quality assurance and continuous improvement arrangements against good practice extracted from a range of statutory and other relevant guidance. 2.8 The Covid-19 pandemic has significantly impacted on education provision over the last few years and presented unprecedented challenges to the Service. Consequentially, many aspects of the expected quality assurance framework did not operate as intended during this period. Quality assurance activity during this period focused on vulnerable children, digital provision and the alternative certification model required in lieu of SQA examinations. During 2021-22, the Service undertook a review of its quality assurance processes to refine and refresh the model with the aim of producing an ambitious, effective and sustainable model of school improvement underpinned by rigorous self- evaluation and robust processes and procedures. 2.9 Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council’s quality assurance arrangements are broadly consistent with Education Scotland’s expectations and the National improvement Framework and are designed to deliver continuous improvement. Reports have been produced for key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes. 2.10 Whilst we were pleased to note that progress was being made to roll out the recently refreshed approach across all schools in the current session 2022-23, progress to date has been slower than expected and the Service needs to accelerate implementation to ensure adequate coverage/implementation of expected arrangements across all the Council’s 142 mainstream schools. A small number of recommendations were contained within the audit report. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.11 Our report on Income and cash collection: Leisure sites is the second of two reports focused on the adequacy and effectiveness of the Council’s management arrangements and key controls in relation to income and cash collection activities. A report on First Stop Shops/cash offices was reported to the Panel in November 2022. This report relates to arrangements in respect of the Council’s leisure sites. 2.12 The review focused on whether cash/income received was properly recorded in the Council’s financial systems and regularly reconciled to amounts recorded within the cash receipting system. We also assessed whether cash/income is held securely and banked timeously and whether there are appropriate security arrangements in place to prevent/discourage thefts and to address the safety and security of staff. 2.13 Based on the results of our work, we are satisfied that cash/income received by the Council at the selected leisure sites is being properly recorded in the Council’s financial systems and is being reconciled to amounts recorded within the cash receipting system. We are also generally satisfied that all cash/income is held securely and banked timeously and that there are appropriate security arrangements in place.
Page 4
2.14 We have categorised this audit as offering ‘reasonable assurance’. While we consider that the control environment is generally adequate, we identified a degree of inconsistency and some areas of non-compliance and/or weaknesses identified which require to be addressed and our recommendations are detailed at Section 3 of the audit report. The most significant of these issues is that current guidance/procedures are now significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.15 The purpose of our work on Controls – Use of supply teachers was to provide assurance on the adequacy and effectiveness of the Council’s key controls and management arrangements associated with ensuring that teaching supply staff are recruited and employed in a manner consistent with the Council’s legal obligations, the approved Devolved School Management scheme and the Council’s Financial Regulations and corporate budget monitoring and control arrangements. 2.16 Local authorities are expected to devolve appropriate resources to individual schools and as such, the Council has developed and implemented staffing models for school sectors, with Headteachers expected to design and deliver the most appropriate and efficient use of staff. The use of short and long-term supply staff is a long-standing practice, with schools using supply teachers to fill both day-to-day gaps (e.g., to cover illness and training courses) and longer-term vacancies (e.g., to cover maternity and long-term sickness). Permanent and long-term supply resource requirements are managed at school level by the HR Business Partner (HRBP) team within People Resources. The placement and management of short-term supply teachers is undertaken largely by Headteachers. 2.17 Based on the results of our work, we are satisfied that supply staff are being recruited and paid in accordance with legislation, SNCT guidelines and corporate expectations. The removal of SEEMIS has, however, significantly impacted upon many of the key processes used for managing and monitoring the use of supply teachers, from both a staffing and financial perspective. This along with arrangements which have been in place for some time and which have become ‘custom and practice’ around the use of supply staff has led to some gaps or weaknesses in aspects of the control framework, which we consider are not always adequately addressed by the alternative arrangements put in place. As such, we have identified weaknesses in several areas of the control environment including non-compliance with SNCT guidelines in relation to issuing contracts/letters of engagement for supply engagements exceeding two days, inadequacies in the monitoring and oversight of the use of short-term supply teachers and issues in relation to financial monitoring within schools. As a result, we have categorised this audit as offering only ‘Limited assurance’. 2.18 We consider that there is significant scope for improvement in the management arrangements surrounding the Council’s use of short and long-term supply teachers and we have raised several issues and made recommendations for management consideration. These are detailed in section 3 of the audit report and include a lack of clearly documented guidance and appropriate processes around the management of short-term supply teachers. We also commented that processes for monitoring the use and payment of supply teachers need strengthened and reported that several errors and duplicate entries were identified in payments made to short-term supply teachers. We also commented on the need to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements. Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 5
2.19 Our work on Creditors was designed to provide independent assurance on the adequacy and effectiveness of key controls in relation to the authorisation and payment of creditors by the Council. This includes arrangements for ensuring that payments are only made in respect of amounts properly due in respect of goods and services which have been ordered and received, that payments have been properly authorised and that where amounts are paid these are correctly calculated and recorded. 2.20 We have categorised this audit as offering ‘reasonable assurance’ as we have concluded that there is a generally sound control environment in place although some relatively minor issues, non-compliance or scope for improvement have been identified. We were pleased to note that the revised invoice certification and submission process introduced in July 2021 continues to be applied accurately across the Council. Services are sending invoices to creditors for processing with procedures ensuring all invoices are properly authorised prior to payment in accordance with expected arrangements. We also found that appropriate supporting documentation was generally being held in respect of payments; and that transactions were being properly and accurately recorded in the Council’s general ledger. 2.21 Although the results of our audit were generally positive, we have identified a small number of instances of non-compliance with expected arrangements and/or where scope for improvement in the control environment has been identified. Most significantly, although a compensating control has been established to address the previously identified control weakness that arose when the interface between PECOS and eFinancials (which provided an automated process to match invoices to orders) was removed, this was intended to be a short-term requirement until the link could be re- established. For several reasons this link is still not in place. Work is underway, however, via the Purchase to Pay (P2P) digital workstream to address this issue and we consider that this work, to enhance the control environment for processing and paying invoices, needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.22 Our work on Cyber Security was designed to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber-security threats and/or attacks. In particular, the audit focused on whether the arrangements and controls in place are in accordance with relevant external standards and/or where not, that there are clear, risk-based and realistic plans to address any areas of weakness or non-compliance and that these are being satisfactorily progressed. 2.23 Cyber security is the activity required to protect an organisation’s data, devices, networks and software from unintended or unauthorised access, change or destruction via the internet or other communications systems or technologies. Cyber incidents pose an increasing threat to public bodies’ management of their information with hacking, ransomware, cyber-fraud and accidental losses all evident across the public and private and sectors. In recent years, there has been an increasing prevalence of targeted ransomware, including those which can cause serious disruption to an organisation, and which can result in significant additional costs and reputational harm. 2.24 This audit was undertaken in collaboration with Business and Digital staff from the Information Risk and Security Team using a good practice checklist which was developed from a variety of resources including relevant guidance from the National Audit Office (NAO), the National Cyber Security Centre (NCSC) and from learning material for public bodies circulated by the Scottish Government following the widely reported 2020 SEPA ransomware attack.
Page 6
2.25 The Council continues to be committed to ensuring it has robust and effective information governance arrangements and has recognised the threats posed from cyber-security risks. While the Council has elected for practical reasons not to seek Cyber Essentials accreditation, we noted that it that it seeks to guard against common cyber-security threats and/or attacks through a range of cyber-security arrangements, controls and activities including PSN compliance and regular threat assessments including penetration testing. 2.26 We have categorised this audit as offering ‘reasonable assurance’. We consider that the Council’s arrangements appear largely commensurate with good practice and that these arrangements are subject to regular review and, based on most recent review/assessments, appear to be operating effectively. We were pleased to note that significant additional resources have been devoted to these activities in recent years and that a range of further planed actions to improve the control environment have been identified. We have identified a small number of areas for improvement. The most significant of these issues is that the current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales to provide a clearer mechanism for identifying and monitoring planned cyber-security activities. Satisfactory responses have been received from management in response to the audit findings and recommendations. Commentary on completed unplanned ‘non-core’ Internal Audit work 2.27 There is one fraud/irregularity investigation report arising from areas of unplanned or ‘non-core’ work undertaken by Internal Audit in the period that I require to bring to your attention in accordance with the Internal Audit reporting protocol. This relates to our investigation in respect of Primary School A which was undertaken in response to concerns raised by the Service with regards to missing school fund monies at the school. 2.28 Audit work identified that there were significant control weaknesses relating to cash handling within the school that we concluded were almost certainly exploited by a member of staff, who has subsequently resigned. Whilst our investigation was unable to prove, beyond all reasonable doubt, that the employee in question misappropriated school fund monies, it was our opinion, on the balance of probability and based on the reasons set out in the report, that they had stolen the money. Following approval by the Chief Executive, this matter has now been referred by Internal Audit to the Police. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.29 A further complicating factor in this case, is that the employee suspected of theft who resigned during the audit investigation, also resigned in similar circumstances during an audit investigation into a similar matter back in 2015 (although at that time no Police referral was made). Significantly, despite Internal Audit recommending at that time that this be flagged in case the individual sought re-employment with the Council at a later date, this does not appear to have occurred. Discussions are ongoing with relevant management about actions requiring to be implemented to prevent this, and any similar scenarios, from happening again in future. 2.30 There are no other issues arising from core Internal Audit work which I consider sufficiently significant to highlight to the Panel. Future follow-up reports will provide the Panel with information on the implementation, or otherwise, of all actions proposed by management in response to audit recommendations categorised as ‘High’ or ‘Medium’.
Page 7
Other Matters – Internal Audit Performance 2.31 In March 2021, the Panel were presented with a revised performance management framework for Internal Audit that was to be implemented from April 2021. Most indicators are reported on an annual basis. There are two indicators however that are subject to quarterly reporting. The first is about the implementation of agreed actions arising from Internal Audit reports by the implementation date. 57% of agreed actions have been implemented by the agreed implementation date in the period to December 2022. Progress in implementing agreed actions is monitored and reported separately to the Panel each cycle. 2.32 The second performance indicator is about client satisfaction. Appendix 4 provides a summary of the results of four key questions we ask audit clients at the conclusion of each audit assignment. The results presented continues to show positive feedback on the work of Internal Audit, with 100% of respondents in the period agreeing that Internal Audit added value by assisting in providing assurance, and that reports were relevant and constructive with findings clearly and accurately communicated. 2.33 Where management raise concerns over Internal Audit’s work, these matters are discussed with relevant senior management to fully understand the nature of any concerns and, where it is considered appropriate, to identify areas for improvement. We also seek Services’ views on what they liked or disliked about the audit process and comments received are used to inform future action plans for improving the service provided by Internal Audit. 3. Measures of success 3.1 Internal Audit reports annually on its performance to the Panel and is also subject to review annually by the Council’s appointed external auditors. 4. Supporting documentation Appendix 1 Summary of Internal Audit assignments completed in the period Appendix 2 Audit gradings Appendix 3 Internal Audit performance framework Appendix 4 Internal Audit Client Feedback Results Ken Adamson, Chief Officer - Audit and Risk
Page 8
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective responses by management to the weaknesses, control issues and/or areas of improvement identified by Internal Audit will increase the likelihood of the Council achieving its ambitions by improving control frameworks and more effectively mitigating potential risks and threats to the achievement of planned outcomes. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒
Page 9
Appendix 1 Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 1. Education quality assurance arrangements Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 1 Medium 2 Low 1 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of primary and secondary education. Our work during the audit included benchmarking the Council’s quality assurance and continuous improvement arrangements against good practice extracted from a range of statutory and other relevant guidance including the Scottish Government’s ‘National Improvement Framework,’ the ‘How Good is our School’ (HGIOS) self- evaluation toolkit, the ‘Standards in Scotland’s Schools Act 2000’, and relevant guidance from Education Scotland’s guidance on ‘Delivering Excellence and Equity: Advice on school improvement planning. The Covid-19 pandemic has significantly impacted on education provision over the last few years and presented unprecedented challenges to the Service. Consequentially, many aspects of the expected quality assurance framework did not operate as intended during this period. Quality assurance activity during this period focused on vulnerable children, digital provision and the alternative certification model required in lieu of SQA examinations. During 2021-22, the Service undertook a review of the quality assurance processes to refine and refresh the model with the aim of producing an ambitious, effective and sustainable model of school improvement underpinned by rigorous self-evaluation and robust processes and procedures. Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council’s quality assurance arrangements are broadly consistent with Education Scotland’s expectations and the National improvement Framework and are designed to deliver continuous improvement. Reports have been produced for key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes. Whilst we were pleased to note that progress was being made to roll out the recently refreshed approach across all schools in the current session 2022-23, progress to date has been slower than expected and the Service needs to accelerate implementation to ensure adequate coverage/implementation of expected arrangements across all the Council’s 142 mainstream schools. Recommendations for management consideration/action are detailed at Section 3 of the report and include: • The refreshed quality assurance framework needs to be fully implemented across all the Council’s primary and secondary schools. • Processes for preparing and reviewing annual school improvement plans (SIP) and reports (SIR) need to be undertaken and concluded in a timely manner; and • Key improvement actions included in the Service Improvement Plan which are expected to deliver educational benefits for pupils are currently not always set out using SMART principles. Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 10
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 2. Income and cash collection (leisure sites) Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 1 Medium 1 Low 3 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s management arrangements and key controls in relation to income and cash collection activities. The review focused on whether cash/income received by the Council was properly recorded in the Council’s financial systems and is regularly reconciled to amounts recorded within the cash receipting system. We also assessed whether cash/income is held securely and banked timeously and whether there are appropriate security arrangements in place to prevent/discourage thefts and to address the safety and security of staff. The review comprises two separate exercises. A report on First Stop Shops/cash offices was issued in October 2021. This report relates to the second exercise undertaken which considered arrangements in respect of the Council’s leisure sites. Leisure sites were previously part of Culture and Leisure NL (CLNL), a former Council ALEO. The delivery of culture, sport and leisure services was insourced to the Council with effect from 1 April 2020. Management responsibility for the staffing and operation of Active NL, the gym and leisure facilities provided by Active and Creative Communities, lies with Education and Families, with the responsibility for banking reconciliations and posting to the financial ledger lying with Financial Solutions. Our work involved visiting two different leisure sites and North Lanarkshire Leisure (NLL) HQ (as it is still named) where we undertook a range of checks on different aspects of cash collection activity with the aim of providing assurance to management on the adequacy and effectiveness of the control environment including compliance with expected controls and procedures. Testing was also undertaken to assess the adequacy and effectiveness of controls exercised by the Controls and Reconciliations Team who are responsible for reviewing/monitoring cash collection activity and the reconciliation of monies collected/banked/recorded. Based on the results of our work, we are satisfied that cash/income received by the Council at the selected leisure sites is being properly recorded in the Council’s financial systems and is being reconciled to amounts recorded within the cash receipting system. We are also generally satisfied that all cash/income is held securely and banked timeously and that there are appropriate security arrangements in place. We have categorised this audit as offering ‘reasonable assurance’. While we consider that the control environment is generally adequate, we identified was a high degree of inconsistency and some areas of non-compliance and/or weaknesses identified which require to be addressed and our recommendations are detailed at Section 3 of the audit report. The most significant of these issues is that current guidance/procedures are now significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. Satisfactory responses have been received from management in respect of the audit findings and recommendations.
Page 11
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 3. Controls – Use of Supply teachers Internal Audit Opinion: Limited assurance (Amber-Red) Audit recommendations: High 2 Medium 2 Low 0 The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s key controls and management arrangements associated with ensuring that teaching supply staff are recruited and employed in a manner consistent with the Council’s legal obligations, the approved Devolved School Management scheme and the Council’s Financial Regulations and corporate budget monitoring and control arrangements. For staffing matters, the Council is required to adhere to the Scottish Negotiating Committee for Teachers (SNCT) and Local Negotiating Committee for Teachers (LNCT) Agreements which outline the legal obligations for the recruitment, employment and payment of teachers. Local authorities are expected to devolve appropriate resources to individual schools and as such, the Council has developed and implemented staffing models for school sectors, with Headteachers expected to design and deliver the most appropriate and efficient use of staff. The use of short and long-term supply staff is a long-standing practice, with schools using supply teachers to fill day-to-day vacancies (e.g., to cover illness and training courses) and longer-term vacancies (e.g., to cover maternity and long-term sickness). Permanent and long- term supply resource requirements are managed at school level by the HR Business Partner (HRBP) team within People Resources. The placement and management of short-term supply teachers is undertaken largely by Headteachers, with only limited input from the HRBP team. Based on the results of our work, we are satisfied that supply staff are being recruited and paid in accordance with legislation, SNCT guidelines and corporate expectations. The removal of SEEMIS has, however, significantly impacted upon many of the key processes used for managing and monitoring the use of supply teachers, from both a staffing and financial perspective. This along with arrangements which have been in place for some time and which have become ‘custom and practice’ around the use of supply staff has led to some gaps or weaknesses in aspects of the control framework, which we consider are not always adequately addressed by the alternative arrangements put in place. As such, we have identified weaknesses in several areas of the control environment including non-compliance with SNCT guidelines in relation to issuing contracts/letters of engagement for supply engagements exceeding two days, inadequacies in the monitoring and oversight of the use of short-term supply teachers and issues in relation to financial monitoring within schools. As a result, we have categorised this audit as offering only ‘Limited assurance’. We consider that there is significant scope for improvement in the management arrangements surrounding the Council’s use of short and long-term supply teachers and we have raised several issues and made recommendations for management consideration. These are detailed in section 3 of the audit report and include: • There is a lack of clearly documented guidance and appropriate processes around the management of short-term supply teachers; • Processes for monitoring the use and payment of supply teachers need strengthened; • Several errors and duplicate entries were identified in payments made to short-term supply teachers; and • There is a need to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 12
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 4. Creditors Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 0 Medium 2 Low 0 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of key controls in relation to the authorisation and payment of creditors by the Council. This includes arrangements for ensuring that payments are only made in respect of amounts properly due in respect of goods and services which have been ordered and received, that payments have been properly authorised and that where amounts are paid these are correctly calculated and recorded. Based on the results of our audit work, we have categorised this audit as offering ‘reasonable assurance’ as we have concluded that there is a generally sound control environment in place although some relatively minor issues, non-compliance or scope for improvement have been identified. We were pleased to note that the revised invoice certification and submission process introduced in July 2021 continues to be applied accurately across the Council. Services are sending invoices to creditors for processing with procedures ensuring all invoices are properly authorised prior to payment in accordance with expected arrangements. We also found that appropriate supporting documentation was generally being held in respect of payments; and that transactions were being properly and accurately recorded in the Council’s general ledger. Although the results of our audit were generally positive, we have identified a small number of instances of non-compliance with expected arrangements and/or where scope for improvement in the control environment has been identified. Most significantly, although a compensating control has been established to address the previously identified control weakness that arose when the interface between PECOS and eFinancials (which provided an automated process to match invoices to orders) was removed, this was intended to be a short-term requirement until the link could be re-established. For several reasons this link is still not in place. Work is underway, however, via the Purchase to Pay (P2P) digital workstream to address this issue and we consider that this work, to enhance the control environment for processing and paying invoices, needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to. It is important, therefore, that Services make maximum use PECOS for ordering and invoice processing, wherever possible, as this will enable the Council to make more effective use of resources, help improve invoice processing times and ensure a more robust and consistent approach to ordering and invoice processing activity across the Council. Recommendations are included at Section 3 of the report. Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 13
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 5. Cyber Security Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 1 Medium 1 Low 0 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber-security threats and/or attacks. In particular, the audit focused on whether the arrangements and controls in place are in accordance with relevant external standards and/or where not, that there are clear, risk-based and realistic plans to address any areas of weakness or non-compliance and that these are being satisfactorily progressed. Cyber security is the activity required to protect an organisation’s data, devices, networks and software from unintended or unauthorised access, change or destruction via the internet or other communications systems or technologies. Cyber incidents pose an increasing threat to public bodies’ management of their information with hacking, ransomware, cyber-fraud and accidental losses all evident across the public and private and sectors. In recent years, there has been an increasing prevalence of targeted ransomware, including those which can cause serious disruption to an organisation, and which can result in significant additional costs and reputational harm. This audit was undertaken in collaboration with Business and Digital staff from the Information Risk and Security Team using a good practice checklist which was developed from a variety of resources including relevant guidance from the National Audit Office (NAO), the National Cyber Security Centre (NCSC) and from learning material for public bodies circulated by the Scottish Government following the widely reported 2020 ransomware attack experienced by the Scottish Environment Protection Agency (SEPA). The Council continues to be committed to ensuring it has robust and effective information governance arrangements and has recognised the threats posed from cyber-security risks. While the Council has elected for practical reasons not to seek Cyber Essentials accreditation, we noted that it that it seeks to guard against common cyber-security threats and/or attacks through a range of cyber-security arrangements, controls and activities including PSN compliance and regular threat assessments including penetration testing. We have categorised this audit as offering ‘reasonable assurance’. We consider that the Council’s arrangements appear largely commensurate with good practice and that these arrangements are subject to regular review and, based on most recent review/assessments, appear to be operating effectively. We were pleased to note that significant additional resources have been devoted to these activities in recent years and that a range of further planed actions to improve the control environment have been identified. We have identified a small number of areas for improvement and our recommendations are detailed at Section 3 of this report. The most significant of these issues is that the current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales to provide a clearer mechanism for identifying and monitoring planned cyber- security activities Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 14
Appendix 2 Audit Gradings Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance There are minimal or minor control weaknesses that present low risk to the control environment. The control environment has substantially operated as intended although some minor errors have been detected. Very few or no improvements are needed. Green-Amber Reasonable Assurance There are some control weaknesses that present a low to medium risk to the control environment. The control environment has mainly operated as intended although errors have been detected. Some improvements should be made. Amber-Red Limited Assurance There are significant control weaknesses that present medium to high risk to the control environment. The control environment has not operated as intended. Significant errors have been detected. Substantial improvements should be made. Red No Assurance There are fundamental control weaknesses that present an unacceptable level of risk to the control environment. The control environment has fundamentally broken down and is open to significant error or abuse. Immediate and major changes need to be made. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but it is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 15
Appendix 3: Internal Audit performance framework Category Measure Internal Audit management Reported to Chief Executive and CMT Reported to A&SP (Quarterly) Reported to A&SP (Annual) 1. Delivery of Annual Plan Percentage completion of agreed plan X X X 2. Targeting Percentage of key corporate risks and key financial systems over which assurance provided X X X 3. LGBF - Efficiency Cost of Internal Audit per £ million revenue budget X X 4. LGBF - Efficiency % of productive hours delivered v Plan X X 5. Delivery / recommendations Percentage implementation of agreed actions by implementation date (cumulative year to date) X X X X 6. Delivery / other Number of significant irregularity / fraud investigations X X X 7. Customer satisfaction results Scores from customer satisfaction questionnaires (audit assignments) (cumulative year to date) X X X X 8. Customer satisfaction results Scores from key stakeholders (CMT and A&SP) questionnaires (overall performance of the function) X X X 9. Quality / standards Reliance placed by External Audit on the work of Internal Audit X X X 10. Quality/ standards Quality review outcomes – EQAR or internal self- evaluation X X X 11. Delivery of Annual Report Annual opinion /report prepared by 31 May annually X X X 12. Targeting Approval by CMT and A&SP of strategy and annual plan by 31 May annually X X X Internal management performance indicators 13. Efficiency Actual v planned days on completed assignments X 14. Efficiency Time between completion of fieldwork and draft reports being issued X 15. Efficiency Time between draft reports and final reports being issued X
Page 16
Appendix 4: Internal Audit Client Feedback Results Responses received in this period from four clients related to 2022-23 assignments reported to the Panel (note these responses relate to audit assignments reported in the Internal Audit Progress Reports presented to the November 2022 meeting of the Panel) Question Strongly Agree or Agree Neither agree nor disagree Disagree Internal Audit added value to my area by assisting in providing assurance and/or identifying weaknesses and/or improvements in relevant governance/business process and internal controls 100% 0% 0% Internal Audit findings were accurate and clearly communicated 100% 0% 0% The Internal Audit report made relevant, constructive and practical recommendations to help improve operations 100% 0% 0% Internal Audit staff were professional and courteous throughout the audit process 100% 0% 0%
Page 17
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT EDUCATION: QUALITY ASSURANCE ARRANGEMENTS Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officers Education (North and South) and Deputy Chief Executive Copied to: Education and Families Manager and (once finalised) Chief Executive Headlines This audit was designed to provide independent assurance on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of primary and secondary education. Local authorities have a duty to improve standards in education, challenging and supporting educational establishments to ensure continuous improvement. North Lanarkshire’s quality improvement framework is based upon the European Framework for Quality Management (EFQM) approach. It aims to empower school leaders to secure continuous improvement while providing assurance to stakeholders on the quality of education provided for learners. Our work during the audit included benchmarking the Council’s quality assurance and continuous improvement arrangements against good practice extracted from a range of statutory and other relevant guidance including the Scottish Government’s ‘National Improvement Framework,’ the ‘How Good is our School’ (HGIOS) self- evaluation toolkit, the ‘Standards in Scotland’s Schools Act 2000’, and relevant guidance from Education Scotland’s guidance on ‘Delivering Excellence and Equity: Advice on school improvement planning. The Covid-19 pandemic has significantly impacted on education provision over the last few years and presented unprecedented challenges to the Service. Consequentially, many aspects of the expected quality assurance framework did not operate as intended during this period. Quality assurance activity during this period focused on vulnerable children, digital provision and the alternative certification model required in lieu of SQA examinations. During 2021-22, the Service undertook a review of the quality assurance processes to refine and refresh the model with the aim of producing an ambitious, effective and sustainable model of school improvement underpinned by rigorous self-evaluation and robust processes and procedures. Based on the results of our work, we have assessed the audit as providing ‘reasonable assurance’. We consider that the Council’s quality assurance arrangements are broadly consistent with Education Scotland’s expectations and the National improvement Framework and are designed to deliver continuous improvement. Reports have been produced for key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes. Whilst we are pleased to note that progress is being made to roll out the refreshed approach across all schools in the current session 2022/23, progress to date has been slower than expected and the Service needs to accelerate implementation to ensure adequate coverage/implementation of expected arrangements across all the Council’s 142 mainstream schools. Recommendations for management consideration/action are detailed at Section 3 of the report and include: • The refreshed quality assurance framework needs to be fully implemented across all the Council’s primary and secondary schools. • Processes for preparing and reviewing annual school improvement plans (SIP) and reports (SIR) need to be undertaken and concluded in a timely manner; and • Key improvement actions included in the Service Improvement Plan which are expected to deliver educational benefits for pupils are currently not always set out using SMART principles. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green - Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0450/2023/002 Date issued 20/01/23 Audit Team Elaine MacDonald and Paula Hendry
Page 18
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 2 1. Executive Summary Objectives The purpose of this audit is to provide independent assurance on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of primary and secondary education. The work will be designed to offer an audit opinion on the following: • Are the Council’s quality assurance arrangements consistent with Education Scotland’s expectations and/or the requirements of the National Improvement Framework and are they designed to deliver continuous improvement? • Have quality assurance arrangements been operated in line with the Council’s own expectations? • Is there periodic reporting to key stakeholders on the results of the Council’s quality assurance and continuous improvement activities and their impact on expected outcomes? The quality assurance arrangements surrounding schools are monitored by the Service’s Education and Family Managers (EFM). Our work during this audit involved discussions with the EFM with oversight of the quality assurance process and review of the updated/proposed approach and monitoring of SIPs and SIRS. As HMIE visits and VSE visits had been suspended during Covid we were unable to review the Council’s arrangements for recording or monitoring improvement actions arising from any such activity. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 1 2 1 Key areas requiring management action (High) One area requiring urgent management attention was identified: • The refreshed quality assurance framework needs to be fully implemented across all the Council’s primary and secondary schools. Good practice identified We noted the following areas of good practice during the audit: • The Council devotes significant resources to quality assurance and continuous improvement designed to support schools and to ensure high quality educational provision is delivered in line with national requirements and the Service’s expectations set out in Programme of Work P034.1 Improving Outcomes; • A Quality Improvement Framework has been produced by the Service; • Education and Families Managers are responsible for oversight of specific groupings of schools. This requires close working relationships with relevant Head Teachers to challenge, support, track and monitor performance and improvement and to gain good knowledge and understanding of the different circumstances of individual schools; • The Service has prepared guidance and proforma templates, in accordance with Education Scotland’s guidance, for the completion of annual School Improvement Reports (SIR) and School Improvement Plans (SIP) to facilitate the planning and monitoring of performance management and quality improvement within schools in a consistent manner; • The Service has introduced several initiatives with supporting guidance in response to its responsibilities under the Education for Scotland (2000) Standards in Schools Act to improve standards in schools; • An annual calendar of quality improvement activity is in place; and • An annual Standards and Quality Report is produced and presented to Committee outlining the Council’s educational performance against key NIF quality indicators, key activity in the period and next steps.
Page 19
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 3 Other areas for improvement (Medium) Areas for improvement was also identified: • Processes for preparing and reviewing annual school improvement plans (SIP) and reports (SIR) need to be undertaken and concluded in a timely manner; and • Key improvement actions included in the Service Improvement Plan which are expected to deliver educational benefits for pupils are currently not always set out using SMART principles.
Page 20
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 4 3. Action Plan EDUCATION: QUALITY ASSURANCE ARRANGEMENTS 0450/2023/001 Ref Finding 1 The refreshed quality assurance framework needs to be fully implemented across all the Council’s primary and secondary schools. During 2021-22 a review of the quality assurance processes for education was undertaken to refine and refresh the Council’s arrangements with the aim of producing an ambitious, effective and sustainable model of school improvement underpinned by rigorous self-evaluation and robust processes and procedures. Our review of this framework confirmed that in principle the arrangements are consistent with Education Scotland’s expectations and with the National Improvement Framework. An integral part of the assurance framework is the Validated Self Assessments (VSE) process which provide a means to review performance and to review, support and challenge existing arrangements within schools to identify and facilitate continuous improvement. The VSE protocol was evaluated and updated as part of the refresh and has been communicated to all Head Teachers. This has included the training of 32 education professionals as VSE Champions to facilitate the undertaking of VSE. In collaboration with individual Head Teachers a process has also recently been completed to allocate both a RAG (Red, Amber, Green) and VSE status to each school which identifies current performance and the level of support the Service considers the school requires. We understand that the Service intends to use this to inform the calendar of VSE visits to be undertaken in this school session. At the time of writing, no VSE visits yet have been undertaken in the current session at any school. HMIe visits recommenced in September 2022, and we understand that several schools for whom internal scrutiny, via a VSE visit was to be undertaken have been visited by HMIe inspectors. The Service intends to place reliance on any such external reviews and will replace any such schools in the VSE calendar of planned visits. The Service has indicated that a calendar of VSE visits for the remained of the year will be prepared and will commence in January 2023 which will enable the updated VSE approach to be piloted to enable evaluation of the impact of the new approach. We also noted that the refreshed approach planned for 2022-23 included the introduction of Attainment Trios which would have consisted of a group of Head Teachers coming together three times a year as a group of ‘critical friends’ to provide support and challenge and develop their ability to collaborate and engage in robust professional dialogue that supports continuous improvement. We noted however, that these have not progressed and in mid-November a proposal to revise this element to Self-Evaluation for Improvement Discussion (SID) Groups was presented to, and approved by, the Services Senior Leadership Team. We understand there is an intention to finalise these groups in January 2023 at which time the new process is expected to be introduced across all primary and secondary schools. Implication Recommendation Priority Management response Implementation Month/Year The service may fail to adequately review school performance and/or improvement progress in a timely and ongoing manner, resulting in a failure to identify and then progress appropriate actions to secure improvement. Education and Families should ensure that: (1) the refreshed quality assurance framework is fully implemented in a timely manner across all primary and secondary schools. (2) regular monitoring is undertaken to ensure that all planned quality assurance activities are undertaken in a timely manner consistent with an updated quality improvement framework calendar; and (3) a formal review of the adequacy and effectiveness of recently revised/updated processes (particularly VSE and SIDS) is undertaken, after a sufficient period, to assess how well they are operating, identifying and taking any necessary adjustments and/or improvement actions as appropriate. High Agree Michelle O’Halleron, Education and Families Manager (1) The implementation of the framework is now underway with the rollout continuing this school term. The responsible officer will link with all EFMs to support and ensure the ongoing implementation of the framework in a timely manner. (2) Regular monitoring will be undertaken to ensure activities within the framework are being undertaken in line with expected timescales. Progress will be reported at appropriate intervals to Education and Families SLT. (3) For a review of the adequacy and effectiveness of the refreshed framework to be meaningful, it needs sufficient time for activities to embed. Therefore a detailed review of the revised framework will be undertaken after it has been operational for a full school year, with this taking place in June 2024. During this period however, an interim review to identify any necessary initial adjustments and/or improvement actions will take place in June 2023 and January 2024. The Chief Officer of Education (South) will have strategic oversight to ensure effective implementation of delegated actions, by responsible officers, as outlined above. June 2023 June 2023 and termly thereafter June 2024
Page 21
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 5 3. Action Plan (continued) EDUCATION: QUALITY ASSURANCE ARRANGEMENTS 0450/2023/001 Ref Finding 2 Processes for preparing and reviewing annual school improvement plans (SIP) and reports (SIR) need to be undertaken and concluded in a timely manner. Head Teachers are required to produce an annual School Improvement Plan (SIP) setting out the school's intended outcomes and improvement activity for the coming session and follow this up towards the end of the school session with an annual School Improvement Report (SIR) in which they outline progress towards achieving the outcomes set out in the plan. All SIPs and SIRs are submitted for review to the respective Education and Families Manager (EFM) and feedback on their content and quality is provided to Head Teachers. We noted that the normal deadline for submission of the SIP was extended from June to August this year for a number of reasons including other priorities, the updates to the quality assurance framework and the intended format of the plans. However, despite this extension we noted that many schools had failed to submit their SIPs and SIRs per the calendar of key dates. Our review of the process for review of SIPs and SIRs identified the following: • Each EFM populates a spreadsheet to track their respective schools SIR reviews. We noted these spreadsheets did not record the dates of receipt, review and feedback to Head Teachers for action to ensure this was timely. We also noted that they were not populated in a consistent manner by EFMs and contained a lack of detail of the issues raised and/or expected corrective actions; and • EFMs also populate a similar spreadsheet for their review of schools SIPs. We noted this spreadsheet did not provide for capturing details of how well the key aspects of the SIPs have been populated, i.e., vision and values and details of engagement, or the date review issues were fed back to Head Teachers for action and showed limited evaluative commentary recorded and, in some instances, no key discussion issues with the school were noted. The Service advised in November 2022 that all SIRs for session 2021/22 and SIPs for session 2022/23 had been reviewed and feedback provide to schools by the relevant EFM. Implication Recommendation Priority Management response Implementation Month/Year The Service may find it difficult to demonstrate or evidence that appropriate and timely support and challenge has been provided to schools in the preparation and finalisation of their SIPs and SIRs. Education and Families should: (1) remind all Head Teachers and EFMs of the importance of ensuring that SIPs and SIRs are prepared in accordance with expected timelines and ensure that any overdue SIPs or SIRs are pursued as a matter of urgency; and (2) remind EFMs of the need to populate their review spreadsheets for SIRs and SIPs to fully evidence their oversight/scrutiny activity including recording key details such as dates of receipt and review, key qualitative comments and issues arising, and key feedback provided to Head Teachers to address. Medium Agree Michelle O’Halleron, Education and Families Manager (1) A protocol will be established for EFMs to implement should Head Teachers fail to submit their updates in line with agreed timescales. This protocol will include the need to highlight non-submission to EFM with strategic remit for improvement, to provide another layer of scrutiny, to ensure the documentation is submitted. Michelle O’Halleron and Jill Woodward, Education and Families Managers (2) The EFM team will utilise Microsoft teams to create a form to be issued to all Head Teachers to complete when submitting SIP/SIR. This will reduce the need for re-keying information making the review process more efficient therefore allowing EFMs to concentrate on recording key qualitative information and action points. The form will automatically record submission dates and provide for the recording of other key review dates. This will support a consistent approach across the EFM team. The Chief Officer of Education (South) will have strategic oversight to ensure effective implementation of delegated actions, by responsible officers, as outlined above. April 2023 May 2023
Page 22
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 6 3. Action Plan (continued) EDUCATION: QUALITY ASSURANCE ARRANGEMENTS 0450/2023/001 Ref Finding 3 Key improvement actions included in the Service Improvement Plan which are expected to deliver educational benefits for pupils are currently not always set out using SMART principles. The Service Improvement Plan is produced annually and monitored and reviewed on a periodic basis. Improvement actions are aligned under themes set out in NIF priorities and drivers, as well as the Council’s own PoW categories of Curriculum rebuild, Support for children and families, Pathways development, Health and Wellbeing and Learning for sustainability. The format of the plan provides for information on key actions, measures of success, responsible officer and progress to towards completion. A high-level review by Internal Audit of the 2022-23 Service Improvement Plan led us to conclude that there is scope to improve the content of the Plan by ensuring each improvement action is expressed in a manner that is consistent with SMART principles. Most specifically, in terms of ensuring that expected improvements are quantified in a measurable manner. Implication Recommendation Priority Management response Implementation Month/Year The service may fail to demonstrate that it has addressed and achieved adequate improvement in education performance. Management should ensure that actions included in the annual Service Improvement Plan are, wherever possible, framed in line with SMART principles (Specific, measurable, achievable, relevant and timely), and that the nature/extent of expected improvements is set out, including how this will be measured. Medium Agree Michelle O’Halleron, Education and Families Manager Following a review of current priorities, and our evaluation process to identify new priorities, the responsible officer will work with relevant service managers (aligned to new priorities) to ensure improvement priorities are framed in line with SMART principles. These priorities will be submitted to various committees for endorsement, prior to final submission. The Chief Officer of Education (South) will have strategic oversight to ensure effective implementation of delegated actions, by responsible officers, as outlined above. September 2023
Page 23
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 7 3. Action Plan (continued) EDUCATION: QUALITY ASSURANCE ARRANGEMENTS 0450/2023/001 Ref Finding 4 There is need to review how information is reported annually to key stakeholders in respect of performance and quality assurance arrangements. Education authorities are required under the terms of the Standards in Scotland’s Schools, etc Act 2000 to produce and annually publish a standards and quality report detailing how the service, its schools and services have sought and achieved improvements in provision. Whilst we recognise the Council’s standards and quality report which is submitted to committee needs to fully reflect relevant legislative requirements, we noted that it is a lengthy report providing lots of, often detailed, information to the reader using language and terminology that is not always readily conducive to wider engagement by stakeholders. We were pleased to note that a summary providing an overview of the Service’s progress in achieving agreed priorities was provided as an appendix to the report in 2022 but consider that the lay reader may find it difficult to distinguish key messages, achievements to date against key ambitions and continuing areas of focus/challenge and that a more user-friendly summary would be beneficial. Implication Recommendation Priority Management response Implementation Month/Year Without regular, accurate and timely reporting on monitoring activity, senior management and/or elected members may not be aware of the extent of compliance with, or the effectiveness of, the Council’s quality assurance/monitoring arrangements. The Service should review the structure and content of information currently provided annually to Committee and other key stakeholders in respect of quality assurance arrangements and schools’ performance to assess whether this could be reported in a way which better enables key stakeholders to understand and exercise effective scrutiny and oversight/challenge of performance. Low Agree Janie O’Neill, Chief Officer for Education (South) and Michelle O’Halleron, Education and Families Manager Moving forward, clearer identification of Improvement Priorities (as outlined at 3 above) will support a clearer focus for the Service to frame the annual report. The main body of the report should align with the identified priorities and key statutory reporting duties e.g. attainment information, and all other areas of Service improvement work could be included in additional documentation (appendices). The Service will also seek to monitor and review reporting timeframes, to ensure our processes align with any national changes and recommendations. The introduction of a mid-term progress update will be considered as a means of tracking progress and reducing the volume of information contained in the final Standards and Quality Report. November 2023
Page 24
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.002 - Education QA Arrangements/A - Findings and Reporting/A06a 20230120 - EDUCATION QA Final report v1.0 as issued.docx 8 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 25
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 1 INTERNAL AUDIT REPORT INCOME AND CASH COLLECTION – LEISURE SITES Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officer - Education and Families (South) Copied to: Active and Creative Communities Manager, Chief Executive and Deputy Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s management arrangements and key controls in relation to income and cash collection activities. The review focused on whether cash/income received by the Council is properly recorded in the Council’s financial systems and is regularly reconciled to amounts recorded within the cash receipting system. We also assessed whether cash/income is held securely and banked timeously and whether there are appropriate security arrangements in place to prevent/discourage thefts and to address the safety and security of staff. The review comprises two separate exercises. A report on First Stop Shops/cash offices was issued in October 2021. This report relates to the second exercise undertaken which considered the Council’s leisure sites. Leisure sites were previously part of Culture and Leisure NL (CLNL), a former Council ALEO. The delivery of culture, sport and leisure services was insourced to the Council with effect from 1 April 2020. Management responsibility for the staffing and operation of Active NL, the gym and leisure facilities provided by Active and Creative Communities, lies with Education and Families, with the responsibility for banking reconciliations and posting to the financial ledger lying with Financial Solutions. Our work involved visiting two different leisure sites and North Lanarkshire Leisure (NLL) HQ (as it is still named) where we undertook a range of checks on different aspects of cash collection activity with the aim of providing assurance to management on the adequacy and effectiveness of the control environment including compliance with expected controls and procedures. Testing was also undertaken to assess the adequacy and effectiveness of controls exercised by the Controls and Reconciliations Team who are responsible for reviewing/monitoring cash collection activity and the reconciliation of monies collected/banked/recorded. Based on the results of our work, we are satisfied that cash/income received by the Council at the selected leisure sites is being properly recorded in the Council’s financial systems and is being reconciled to amounts recorded within the cash receipting system. We are also generally satisfied that all cash/income is held securely and banked timeously and that there are appropriate security arrangements in place. We have categorised this audit as offering ‘reasonable assurance’. We consider that while the control environment is generally adequate, we identified was a high degree of inconsistency and some areas of non-compliance and/or weaknesses identified which require to be addressed and our recommendations are detailed at Section 3 of this report. The most significant of these issues is that current guidance/procedures are now significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Minor Report status FINAL Audit ref 0900/2023/007 Date issued 10/01/2023 Audit Team Lynn McCrum, Paula Hendry, Hugh Shevlin and Elizabeth Sweeney
Page 26
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 2 1. Executive Summary Objectives The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s management arrangements and key controls for income and cash collection activities. The key control objectives reviewed and tested during the audit considered: • Whether all cash/income received by the Council is properly recorded in the Council’s financial systems and regularly reconciled to amounts recorded within the cash receipting system and other accounting systems as required by relevant Service guidance; • Whether all cash/income is held securely and banked timeously; and • Whether appropriate security arrangements are in place within the cash collection facilities to prevent/discourage thefts and to address the safety and security of staff. Substantive testing was conducted at two leisure sites (Broadwood and Ravenscraig) and NLL HQ using a standard audit programme based on the current income and finance practices being operated by the leisure sites. We also reviewed the adequacy of arrangements for the monitoring and reconciliation of income collected undertaken by the Controls and Reconciliations team. This exercise focused on leisure sites. A separate exercise was also carried out at three First Stop Shops/cash offices and was the subject of a separate report issued in October 2022 to relevant Service management. This assignment has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 1 1 3 Key areas requiring management action (High) The following key areas requiring urgent management action have been identified: • Current guidance/procedures are significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. Good practice identified We noted the following areas of good practice during the audit: • Income and Finance Procedures are in operation for gym and leisure facilities provided by the Council. • Income received is reconciled to transactions processed through the MRM system. • Reconciliations between the financial ledger and bank statements, which are appropriately documented and balanced, are carried out promptly after the end of each financial period by staff independent of the cash collection process. Other areas for improvement (Medium) An area for improvement were also identified as follows: • MRM user access controls/arrangements are currently inadequate and need improved.
Page 27
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 3 3. Action Plan Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 1 Current guidance/procedures are significantly out-of-date, and management needs to ensure up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. An ‘NLL Income and Finance Procedures’ manual has previously been prepared and is in operation for North Lanarkshire Council’s gym and leisure facilities which now come under the auspices of Active NL. However, this has not been reviewed or updated for several years and does not reflect the current operating environment either in terms of gym and leisure activities now being insourced to the Council or the move to a less cash-orientated business through changes in society. In addition, there were no records retained to evidence that staff have received training on expected processes and procedures relating to income/cash-handling. We reviewed current practices in place within the selected leisure sites against the procedures the Service expects their sites to adhere to and noted that there were a number of areas of non-compliance. The most significant of these included: • staff unable to locate relevant documentation at the time of Internal Audit fieldwork (including paperwork completed, individual debit/credit card receipts and X reading receipts etc.); • relevant documentation not always being fully completed, completed accurately and/or signed by appropriate staff; • standard documentation as referenced in the procedures is not always being used (this includes safe contents sheet; safe contents monitoring sheet; safe check book/sheet) and where alternative documentation was being completed this did not always contain all expected information; • instances where cash is being counted by only one person (albeit checks are later carried out by the Team Leader); • refunds can be processed by anyone with access to the MRM system and there is generally no documentation to support refunds, or monitoring thereof; • overages and shortages are not being recorded consistently; • X and Z readings are not being carried out for each Chip and Pin machine at the end of each shift (Ravenscraig); • security uplift receipts are not always being attached to the record of banking/uplifts; and • delays in paperwork from leisure sites being received by Controls and Reconciliations Team. Although the control environment appears generally adequate, the non-compliance issues noted above as well as the adequacy of current guidance and lack of review since insourcing indicate the need for a review of both current and expected practice. Furthermore, we identified that there was generally no evidence of there being proper management oversight of the handling and processing of income at leisure sites. As a minimum, we would have expected there to have been management checks undertaken to ensure that appropriate documentation was fully and accurately completed; explanations were obtained for any discrepancies and/or refunds and that these were thereafter monitored. It should be noted that while we did identify issues as detailed above, we found no evidence of irregularities or misappropriation of funds. Implication Recommendation Priority Management response Implementation Month/Year Procedures may be inadequate resulting in processes being undertaken unnecessarily. Procedures and/or arrangements may not be operating as expected and/or may not be being applied consistently across all leisure sites with an increased risk that income collected may not be fully recorded and/or properly accounted for. Service management should ensure that a comprehensive review of all aspects of the control framework for income/cash- handling at leisure sites is undertaken with a view to ensuring that up-to-date written procedures clearly setting out expected controls and actions are prepared and then implemented. These should reflect the current operating environment and include consideration of each of the issues identified above. Once finalised, revised guidance should be circulated to all staff and training delivered as appropriate. High Agree Heather Liddle, Active & Creative Communities Manager We will review and re-issue Income and Finance Procedures manual and staff training on all aspects of procedures including completion of relevant paperwork will be undertaken. April 2023
Page 28
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 4 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 2 MRM user access controls/arrangements are currently inadequate and need improved. The MRM system is used to record transactions (including payments and refunds) both within the leisure centre and those made online/telephone. Each activity and product have an individual MRM product code on the system and corresponding price. Staff within the leisure sites and NLL HQ processing such transactions have access to the system via a log-in and password. These logins are generally unique to the person authorised to use the system. The only exception to this is within the Cafés, where there is a generic log-in and password to record transactions going through the till. The ‘NLL Income and Finance Procedures’ outline that this is to enable transactions to be completed by several members of staff working at the same point of sale. While we appreciate that historically, for the Café, there has been a generic log-in and password, in order to comply with best practice, reduce the risk of non-repudiation and being able to hold persons to account in the event of an error, fraud or theft, every member of staff with access to the system should have an individual log-in and password. We obtained a list of persons with access to the MRM system from NLL HQ and noted that this list was out of date and included persons who were no longer employed by the Council. There were also a number of staff with access to the system at both Broadwood and Ravenscraig Leisure sites who did not appear on this list and/or location differed. A general review of this list also identified that whilst it provides details of the users and their access level, it does not always provide details of their location. Furthermore, a review of the access levels detailed on this list highlighted numerous persons where the access level attributed to them does not appear appropriate to their role. The Manager at Broadwood Leisure Centre was unclear as to whether access to the MRM system would be deactivated by IT as part of the leaving process. These issues indicate a lack of appropriate and regular oversight and review of user access rights to the MRM system. Implication Recommendation Priority Management response Implementation Month/Year Without a formal process for reviewing and updating details held with regards to system access, these details held may not be up to date and/or staff who may have inappropriate access to the system and information within it. Service management should ensure that: (1) a full and comprehensive review of system users on the MRM system is undertaken, including access levels, to ensure that the access attributed to users is appropriate to their role and, that at a minimum, an annual review of users and their access is thereafter undertaken to ensure this remains appropriate and accurate/up to date; (2) consideration is given as to whether it would be practical to issue Café staff with individual log-in’s and passwords; and (3) line managers are reminded that when a system user leaves the Council or moves position their system access is deactivated and/or revised as appropriate for their new role promptly. Medium Agree Heather Liddle, Active & Creative Communities Manager We will undertake the following: • review all MRM system users including location, access levels and remove any leavers. Procedure will be developed for the ongoing update of user accounts when someone leaves the organisation or changes roles; and • we have considered the reasoning for login process for café staff and alternatives have been investigated. This has been reviewed at length with Business Solutions and another solution is not possible – current arrangement will remain in place. April 2023
Page 29
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 5 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 3 Some aspects of the security arrangements within leisure sites require to be re-enforced and/or enhanced. We reviewed the security arrangements in place within the selected leisure sites and while we are satisfied that generally these arrangements are adequate, we identified a number of areas where these security arrangements could be improved. The most significant of these include: • access to the reception areas at both Broadwood and Ravenscraig Leisure Centres is not always restricted to authorised personnel; • there is no record maintained of the Duty Manager at Ravenscraig Leisure Centre being informed of missed scheduled banking uplifts; • Ravenscraig Leisure Centre had run out of banking bags which resulted in the security firm being unable to proceed with one of the scheduled uplifts; • the Insurance section do not hold up to date information regarding the safe or value of insurance cover at either Broadwood or Ravenscraig Leisure Centres; and • the key, which operates the café till drawer in the event of the computer system being down, was not working at both Broadwood and Ravenscraig Leisure Centres. Implication Recommendation Priority Management response Implementation Month/Year If security arrangements are not adhered to there is an increased risk of theft and/or misappropriation of funds and/or risks to the safety and security of staff. Where the Insurance section are not fully informed of the safe details and values of cash transactions, the level of insurance cover held may no longer be appropriate. Service management should ensure that: (1) staff are reminded of expected procedures with regards to security/controlled access for areas where monies are held and counted; (2) staff are reminded of the importance of ensuring that where an uplift does not take place as scheduled, this is recorded and the Duty Manager promptly notified of this including the reason(s) why; and (3) each of the leisure sites provide the Insurance section with details of the safe(s) at the site and the values of daily cash transactions and to enable them to determine the level of cover required. Low Agree Heather Liddle, Active & Creative Communities Manager We will undertake the following: • Staff training on security/access control for relevant areas and uplift procedures including process in the event of a missed submission; • All till drawers to be made functional and keys available and correctly held; and • Information to be supplied to the insurance section on details of all safes and values of daily cash held so that sufficient cover can be arranged. April 2023
Page 30
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 6 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 4 The MRM system does not always update to reflect debit and credit card payments and/or refunds processed. The ‘NLL Income and Finance Procedures’ reference an issue which occasionally occurs when processing debit and credit card payments or refunds. This issue means that while payments have been taken/refunds made they may not be updated on the MRM system. When processing the payment/refund, if this error occurs a message is displayed to alert the member of staff to this error. For NLL HQ, checks are undertaken to ensure that the totals on the daily receipt vouchers agree with the totals from each member of staffs’ merchant receipts for that day. Where there are differences, work is carried out to identify where these lie and to which activity/service they should be allocated in the ledger. The daily receipt voucher is thereafter updated to reflect the correct amount. However, no formal record is maintained where differences are identified and changes made. For the leisure sites, each site should advise their Duty Manager where there is a difference and manually correct the paperwork prior to it being forwarded to Controls & Reconciliations. However, this is not always being done and our fieldwork highlighted instances where the paperwork had not been corrected prior to being forwarded to Controls & Reconciliations. Where paperwork is not updated in respect of these errors, the monies banked cannot be reconciled to that which should be uploaded to the ledger from the receipt voucher. Controls & Reconciliations advised that there are often differences between the daily receipt vouchers received from the leisure sites and the monies banked which leads to delays in posting to the ledger. They notify the relevant leisure site and ask that they investigate this and resubmit adjusted paperwork. We were advised that one potential solution to this issue may be to seek to transfer business from the current card payment merchant (Worldpay) to another. We noted, however that no formal decision has been made on how best to address this long-standing issue. Implication Recommendation Priority Management response Implementation Month/Year There is an increased risk that any issues, errors or discrepancies arising would not be identified and corrected in a timely manner leading to a delay in posting the transactions to the financial ledger and an inability or delay in undertaking bank reconciliations. Service management should: (1) remind staff if the need to ensure that appropriate records are retained by leisure sites (including NLL HQ) which clearly show any such instances where debit and credit card payments/refunds have been made but are not reflected on the MRM system; and (2) consider whether a more permanent and practical resolution to this issue can be identified and progressed to address this long-standing issue. Low Agree Heather Liddle, Active & Creative Communities Manager We will undertake the following: • introduce a recording process for transactions which fail to process via MRM accurately and ensure these records are retained; and • investigate alternative solutions to reduce chances of payments failures leading to discrepancies and thereafter take action as appropriate. April 2023
Page 31
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 7 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Ref Finding 5 Some other areas for improvement were noted that need to be considered and addressed. During our review, we identified several other areas which require attention as follows: • there was some disparity in the information held by Treasury Management in respects of floats and imprest and that provided by the Duty Manager at both Broadwood and Ravenscraig Leisure Centres. Treasury Management records showed an imprest of £200 for each of Broadwood and Ravenscraig. At each site, the Duty Manager confirmed there was no imprest held. Treasury Management confirmed that the monies had been held in imprest bank accounts for the centres which not been used at either site and have now closed these accounts; • the cash float held at Broadwood Leisure Centre differed by £400 between the records held by Treasury Management and those held by the Leisure Centre. Following investigation by Internal Audit, Treasury Management advised that the £400 had been returned when the Finance section at NLL HQ (Broadwood) moved to the Council but had not been ledgered correctly. Treasury Management have committed to updating the financial records accordingly. Similarly, the cash float held at Ravenscraig Leisure Centre differed by £100 between the records held by Treasury Management and those held by the Leisure Centre as the cash float for catering is not recorded in Treasury Management’s records; • during our cash counts at both Broadwood and Ravenscraig Leisure sites we noted a number of small differences. Most significantly, on the day of Internal Audit’s cash count, the change float at Ravenscraig Leisure Centre was £26.40 less than expected and records held did not reflect this difference. The safe content sheet is ticked as checked each day but, when asked, the Team Leader confirmed he had not actually counted the cash; • customers can sign up and pay for a membership which entitles them to access and use the leisure facilities in the centres operated by the Council throughout North Lanarkshire. There are a number of discounts to which a customer may be entitled and proof of entitlement should be obtained prior to the discount being awarded. We reviewed a sample of five recent memberships and were unable to verify if discounts were appropriately checked as evidence of such is not retained or noted with the system simply being updated to read ‘proof shown’. In addition, from our small sample, we identified an instance where a member was paying a discounted membership rate for a number of months despite no qualifying evidence having been presented or viewed. We understand that this was followed up by NLL HQ and as no evidence was subsequently received the member has been charged the full adult membership rate from October 2022; and • when a customer takes out a membership, they receive a fob which they use to access the leisure facilities and on presentation of their fob, their photo appears on a small screen at reception which allows staff to ensure that it is the member who is accessing the leisure activity. The checking by staff of memberships and their validity is a key control which at busy times may be problematic and more difficult to do. Implication Recommendation Priority Without proper checks and balances, differences in the imprest or cash floats held may go unaccounted for. Without appropriate processes and checks being undertaken, there is an increased risk that persons could receive a discount to which they are not entitled and/or persons could access leisure facilities without having made appropriate payment both of which would result in a loss of income to the Council. Service management should ensure that: (1) leisure site management should ensure that details held by Treasury Management in respect of imprests and floats held is accurate and reflects what is actually held at each site; (2) leisure site management are reminded of the requirement to count and check cash floats each day to ensure these are as expected, with any discrepancies investigated and appropriate documentation completed and signed as evidence of such; (3) staff are reminded of the importance of ensuring that entitlement to discounts is obtained and fully recorded on the system prior to the discount being awarded; and (4) remind staff of the need to ensure that those accessing the facility using fobs are checked to ensure they are the correct owner of the fob and that their membership is current. Low
Page 32
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 8 3. Action Plan (continued) Income and Cash Collection (Leisure Sites) 0900/2023/007 Management response Implementation Month/Year Agree Heather Liddle, Active & Creative Communities Manager We will undertake the following: • update details of floats held with Treasury Management; • ensure staff are aware of the need to check and verify cash floats every day, with any discrepancies highlighted and investigated as appropriate and appropriate documentation completed and signed as evidence of such; • ensure staff are aware of the importance of ensuring that entitlement to discounts is properly checked and recorded on the system prior to the discount being awarded. We will also ensure that the process for obtaining proof and updating records as necessary is being followed; and • ensure entry control procedures are followed and member pictures are held and updated and that staff are thereafter checking that the correct person is using fobs to gain entry in all cases. April 2023
Page 33
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.007 - Income and Cash Collection/A - FINDINGS AND REPORT/A12 20230110 Cash collection leisure sites final report as issued.docx 9 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 34
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT CONTROLS – USE OF TEACHING SUPPLY STAFF Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: Supply Teacher Definitions Issued to: Chief Officer of People Resources, Chief Officer of Finance, Chief Officers of Education (North and South) Copied to: HR Business Partnership Manager, Business Finance Manager, Chief Executive and Deputy Chief Executive Headlines The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s key controls and management arrangements associated with ensuring that teaching supply staff are recruited and employed in a manner consistent with the Council’s legal obligations, the approved Devolved School Management scheme and the Council’s Financial Regulations and corporate budget monitoring and control arrangements. For staffing matters, the Council is required to adhere to the Scottish Negotiating Committee for Teachers (SNCT) and Local Negotiating Committee for Teachers (LNCT) Agreements which outline the legal obligations for the recruitment, employment and payment of teachers. Local authorities are expected to devolve appropriate resources to individual schools and as such, the Council has developed and implemented staffing models for school sectors, with Headteachers expected to design and deliver the most appropriate and efficient use of staff. The use of short and long-term supply staff is a long-standing practice, with schools using supply teachers to fill day-to-day vacancies (e.g., to cover illness and training courses) and longer-term vacancies (e.g., to cover maternity and long-term sickness). The identification of resource requirements within schools and the placement of permanent pool, core supply and long-term supply staff are managed by the HR Business Partner (HRBP) team within People Resources. The placement and management of short-term supply teachers is the responsibility of the Education and Families Service and is undertaken by Headteachers. Based on the results of our work, we are satisfied that supply staff are being recruited and paid in accordance with legislation, SNCT guidelines and corporate expectations. The SEEMIS organisation’s decision to retire some aspects of the SEEMIS system in July 2021 has, however, significantly impacted upon many of the key processes used for managing and monitoring the use of supply teachers, from both a staffing and financial perspective. This along with arrangements which have been in place for some time and which have become ‘custom and practice’ around the use of supply staff has led to some gaps or weaknesses in aspects of the control framework, which we consider are not always adequately addressed by the alternative arrangements put in place. As such, we have identified weaknesses in several areas of the control environment including non-compliance with SNCT guidelines in relation to issuing contracts/letters of engagement for supply engagements exceeding two days, inadequacies in the oversight of the use of short-term supply teachers and issues in relation to financial monitoring within schools. As a result, we have categorised this audit as offering only ‘Limited assurance’. We consider that there is significant scope for improvement in the management arrangements surrounding the Council’s use of short and long-term supply teachers and we have raised several issues and made recommendations for management consideration. These are detailed in section 3 of the audit report and include: • There is a lack of clearly documented guidance and appropriate processes around the management of short- term supply teachers; • Processes for the oversight of the use and payment of supply teachers need strengthened; • Several errors and duplicate entries were identified in payments made to short-term supply teachers; and • There is a need to continue to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements. Internal Audit Opinion (see definition at Appendix 1) Limited assurance Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0450/2023/001 Date issued 25/01/23 Audit Team Lesley Armstrong and Paula Hendry
Page 35
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 2 1. Executive Summary Objectives This audit exercise was designed to provide assurance on the adequacy and effectiveness of the Council’s key controls and management arrangements associated with ensuring that teaching supply staff are recruited and employed in a manner consistent with the Council’s legal obligations, the approved Devolved School Management scheme and the Council’s Financial Regulations and corporate budget monitoring and control arrangements. The work was designed to offer an opinion on the following: (1) Are supply staff being recruited, employed and paid in accordance with key legal obligations and corporate expectations? (2) Is there appropriate and effective monitoring and oversight of how schools utilise supply staff to ensure that any risks arising from the use of such staff are appropriately managed? Work undertaken during the audit included discussions with the HRBP Team and with Financial Solutions staff to obtain an overview of the guidance and processes in place for employing, paying and monitoring the use of supply teachers; discussions with the Headteachers at six schools (3 primary and 3 secondary) to ascertain how arrangements surrounding the use of supply teachers operates in practice in schools; and consideration of iTrent and analysis of various iTrent reports to confirm whether key controls were operating effectively. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 2 2 0 Key areas requiring management action (High) The following key areas requiring urgent management action have been identified: • There is a lack of clearly documented guidance and appropriate processes around the management of short- term supply teachers; and • Processes for the oversight of the use and payment of supply teachers need strengthened. Good practice identified We noted the following areas of good practice during the audit: • Supply teachers are recruited/appointed in line with the Council’s recruitment procedures. All supply teachers are required to have completed satisfactory pre-employment verification checks, including confirmation of GTC registration and PVG prior to commencing their employment. • Short-term supply teachers claim payment for work undertaken via the Myself module of iTrent and claims need to be authorised by an authorising officer prior to being processed for payment. • The HRBP team undertake a staffing exercise, commencing in February each year, to confirm school rolls and identify any staffing requirements for the following school year, thereby informing the recruitment process and allocation of staffing to individual schools. Other areas for improvement (Medium) A number of other areas for improvement were also identified: • Several errors and duplicate entries were identified in payments made to short-term supply teachers; and • There is a need to continue to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements.
Page 36
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 3 3. Action Plan Controls – Use of Teaching Supply Staff 0450/2023/001 Ref Finding 1 There is a lack of clearly documented guidance and weaknesses in some important aspects of the current processes around the use of short-term supply teachers. The SNCT handbook outlines the legal obligations for the recruitment, employment and payment of teachers. It defines short-term supply teachers as teachers engaged on a daily basis, where a single engagement does not exceed two days and states that fixed term temporary contracts should be issued for engagements which extend beyond this period. The Council’s Local Agreement in relation to the Code of Practice on the Use of Temporary Contracts (LNCT Agreement) concurs with the SNCT guidance, however, in practice since 1996, the Council in agreement with Trade Unions categorises short-term supply as engagements not extending beyond 20 working days, upon which there is an obligation for Headteachers to notify the HRBP team of the cover requirement (or earlier if the requirement is expected to exceed 20 days). The HRBP has no involvement in the placement or management of short-term supply teachers (as this is the responsibility of Headteachers), however, they actively facilitate and administer the identification of resource requirements within schools and the placement of all permanent pool, core supply and long-term supply (see Appendix 2 for definitions) resource requirements and ‘normal’ staffing at a school level, maintaining a cover spreadsheet for each sector area (secondary, primary and additional supported needs (ASN)) to record and monitor all long-term supply cover requirements within individual schools and the teachers who have been allocated to meet each requirement. The HRBP team consider that Headteachers should be fully aware of the expectations for short-term supply teachers as this forms part of regular discussions between both parties. The team meets with individual Headteachers in February each year to discuss and identify all permanent and long-term temporary teachers in post, short-term supply teachers being utilised by the school and any anticipated vacancies, with a view to planning the projected workforce for the forthcoming academic year. This is followed-up with a further re-evaluation and adjustment of the projected workplans in September after the new academic year has commenced and discussions throughout the year as required. Additionally, the HRBP team attend Headteacher engagement sessions, held by Education and Families Senior Leadership Team, during which they present an HRBP update with information relevant to staffing in schools. Despite this, we consider that there is a lack of formally documented guidance which clearly distinguishes between short and long-term supply teachers and the respective roles and responsibilities of both Headteachers and People Resources in relation to these staff. This lack of documentation was confirmed through discussions with Headteachers at a sample of schools, and these discussions further highlighted that there is uncertainty over the definitions of short and long-term supply teachers, and at which point the HRBP team should be notified. Consequently, our review of the use of supply teachers within the small random sample of schools visited identified a number of short-term supply teachers working regular hours/days over long periods of time (and more than 20 working days) who had not been notified to the HRBP team and were therefore, not included on the relevant cover spreadsheet, not being monitored by the HRBP team and had not been issued with an appropriate contract to reflect the long-term engagement. As short-term supply with the Council is classed as engagements not exceeding 20 working days and this is not monitored by the HRBP team, temporary contracts are currently not issued for engagements exceeding two days, in line with the SNCT guidelines, where the HRBP team have not been notified of the engagement. We noted that new contract templates have been prepared for each type of supply teacher and that a process has recently been devised by People Resources for Headteachers to promptly notify the HRBP team/Employee Service Centre (ESC) of supply cover engagements extending beyond two days to enable a contract to be issued and iTrent to be updated as appropriate. This process has not yet been finalised or implemented. Relevant teams within People Resources have also held initial discussions regarding a process for monitoring these arrangements once implemented, however, this is currently still under discussion and has not yet been confirmed/agreed as People Resources consider that a significant amount of additional resource is required to fulfil this function. As part of support offered to schools in early 2020 to assist with the short-term demand that occurred at the start of the Covid 19 pandemic, the HRBP team issued a detailed list of all staff members categorised as “Supply Teacher” to all schools. Since that point in 2020 when the list was issued to HTs, and as a direct consequence of the increased number of long-term COVID19 absences and cover demands, we understand that this list was generally exhausted from a central perspective by the HRBP Team with teachers who were available for supply being utilised for long term cover automatically. Following the retirement of certain elements of the SEEMIS system in July 2021, the HRBP team has created a Supply Register using information extracted from iTrent, which details all teachers recorded in a supply role (short or long-term). Review of this Register identified a number of teachers who are recorded on iTrent but are not included on the Register (12 primary and 16 secondary) and further teachers included on the Register who are not recorded on iTrent (4 primary and 4 secondary). The current version of this register has not yet been with Headteachers, who often rely on utilising supply teachers that they know, have previously used or have been advised of by other Headteachers or the HRBP team. Additionally, the Register does not confirm the current availability of supply teachers. We understand that the HRBP team are currently devising a process for obtaining confirmation of supply teachers’ availability to work and recording this on the Supply Register, and plan to share the Register with Headteachers to provide up-to-date information on the availability of supply teachers. This process has not yet been finalised and implemented. (Continued over page)
Page 37
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 4 3. Action Plan Controls – Use of Teaching Supply Staff 0450/2023/001 Implication Recommendation Priority Management response Implementation Month/Year A lack of appropriate guidance in relation to supply teachers could lead to confusion over definitions, uncertainty around the expectations and responsibilities of Headteachers and the HRBP team not being made aware of all short-term supply teachers undertaking long-term engagements which could further lead to supply teachers not being provided with appropriate contracts of employment and the Council not complying with SNCT guidelines. If a supply register detailing short- term supply teacher availability is not maintained and provided to Headteachers, they may have difficulty identifying an appropriate resource to undertake their supply needs which could lead to Headteachers not notifying the HRBP team where a resource is found or an increased risk of teachers being employed who have not been subjected to the Council’s recruitment process and pre- employment verification checks. People Resources, in conjunction with Education and Families, should: (1) prepare and issue documented guidance providing clear definitions of short and long-term supply teachers and outlining the responsibilities and required actions of Headteachers in relation to supply teachers; and (2) finalise and implement the proposed processes for the management of short-term supply teachers as highlighted in the finding (i.e. notification of engagements and the Supply Register) and ensure that a formal review of the adequacy and effectiveness of these processes is undertaken, after a sufficient period of time, to assess how well they are operating, identifying and taking any necessary improvement actions as appropriate. High Agree (1) Fiona Whittaker, Chief Officer of People Resources The workforce planning guidance discussed and shared with Headteachers during management briefing sessions and the twice-yearly individual workforce planning meetings will be formally documented and issued via email to Headteachers and Education and Families service and publicised through the Council MyNL platform alongside the other relevant People Resources workforce information for future ease of reference. (2) Fiona Whittaker Chief Officer of People Resources & Gerard McLaughlin, Chief Officer of Education (North) An automated systems process is at a development stage within the Council’s iTrent system, that will automatically generate and issue employment contracts to short-term supply Teachers, when the Headteacher authorises their salary payment through the iTrent system. It is anticipated that when this process is implemented a report will be generated and issued to Headteachers (monthly in line with Payroll) which will facilitate better checking and monitoring of the use of short-term supply Teachers. This together with action (1) above will assist with ensuring that Headteachers notify the HRBP team as required when the use of individual Teachers goes beyond 20 days. Monitoring of the use of short-term supply teachers will be undertaken by Headteachers in conjunction with the Education and Families service and relevant support services (People Resources and Financial Solutions) as required. Once in place for a reasonable period, a review of the adequacy and effectiveness of the revised arrangements noted above will be undertaken with any amendments required identified. February 2023 August 2023 January 2024
Page 38
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 5 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Ref Finding 2 Processes for the oversight of the use and payment of supply teachers need strengthened. There is currently no oversight of short-term supply teachers within the Council and there does not appear to be any proactive checks undertaken on the information contained in iTrent to identify/detect any short-term supply teachers continuously working on a single engagement for more than 20 working days. The HRBP team therefore, rely on Headteachers notifying them when the use of short-term supply teachers becomes long-term. Teachers represent a significant proportion of the Council’s workforce and are a unique/discrete group of employees who are governed by different legal obligations and corporate expectations; therefore we consider it important that the management arrangements in place are subject to compliance reviews to gain assurance in this area. Following retirement of certain elements of the SEEMIS system in July 2021, the HRBP team has implemented interim arrangements, utilising spreadsheets, to facilitate the tracking of long-term cover requirements across the school estate and the employees that have been allocated to these positions. Our review of the short-term supply teachers at the six schools visited confirmed that Headteachers do not routinely inform the HRBP team of short-term supply teachers working long-term as each school had short-term supply teachers working regular hours/days over longer periods of time who were not included on the long-term cover spreadsheets maintained by the HRBP team. We also noted that the cover spreadsheet for secondary schools does not contain details of teachers who are covering promoted posts on a temporary basis thereby making it difficult to track and confirm that all vacant posts as a result of the temporary promotion are filled. No reconciliation is undertaken between the long-term cover spreadsheets maintained by the HRBP team and iTrent to confirm that all permanent and fixed-term supply teachers (on the 0410MO payrun and being paid a monthly salary over 12 periods) are actively employed and/or to identify any anomalies. Our testing identified the following issues: • One fixed term 20/21 teacher (5013623) who is a current employee (and now entitled to permanency) but is not recorded on the cover spreadsheet and has not received a contract for their permanent pool post (employed on a permanent basis but not based at a specific school); • Nine permanent teachers recorded on iTrent who were not recorded on the cover spreadsheets. It was confirmed that six teachers had been omitted from the cover spreadsheets in error and are undertaking a cover role at a school, therefore we have no concerns over them receiving their monthly salary. However, three teachers (5009382, 5010659 and 5013543) had ended their employment on 14/08/22 but continued to be paid, with two receiving a salary payment until 31/08/22 (overpayment of salary of just under £900 each) and one continuing to receive their monthly salary until 30/11/22 (overpayment of salary of £7,700) when internal Audit queried it with the HRBP team; • Six teachers recorded on the cover spreadsheet with the incorrect employee number; and • Two teachers recorded on the cover spreadsheet who had no record on iTrent (neither took up post before pre-employment checks were complete). Additionally, no checks are undertaken by People Resources to confirm that the information contained in iTrent regarding contract type and position held is accurate, and our review of the Masterfile data of all supply teachers on iTrent identified the following inaccuracies in the data recorded on iTrent: • Short-term and fixed-term supply teachers recorded as permanent; permanent pool, core supply and additional basic teachers recorded as temporary; and basic teachers working additional hours with no additional basic teacher role; • Short-term supply teachers recorded as additional basic teachers when they do not hold a basic teacher role (should be recorded as short-term supply teachers); • Fixed term 20/21 teachers (probationers from 2019/20) who are now entitled to permanency (as they have two years continuous service) but are still recorded as fixed term temporary teachers on iTrent (instead of permanent pool); • Supply teachers recorded on iTrent with occupancy end dates which have now passed, and may therefore, not have a valid contract and may not be located in the school which they are currently allocated to on iTrent; and • Short-term supply teachers recorded as being allocated to a specific reporting manager, despite being employed to work in any school. Our review also noted that there is no routine checking to promptly identify short-term supply teachers who are entitled to permanency (relies on supply teachers contacting the HRBP team) and there is no monitoring/analysis of the utilisation of reason codes by schools to determine whether the same short-term supply teachers are being continuously employed within the same school for various reasons. All of the above confirms that there is a lack of adequate and effective oversight on the use of all categories of supply teachers and that the processes currently in place need to be improved to ensure that legislative requirements and corporate expectations are implemented and adhered to. (Continued over page)
Page 39
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 6 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Implication Recommendation Priority Management response Implementation Month/Year Management may be unaware of the extent of compliance with key corporate expectations and/or may fail to identify issues requiring action. A lack of appropriate oversight of supply teachers could result in the Council not adhering to legislative requirements and corporate expectations by not providing staff with appropriate contracts of employment and not offering permanent roles to staff when they become entitled. If inaccurate information is held on both Council systems and spreadsheets, staff may not be paid the correct amounts for work undertaken, which could lead to overpayments. People Resources and Education and Families should: (1) undertake a comprehensive review of current arrangements for oversight of all categories of supply teachers and consider how management can review and better gain assurance on the extent of compliance with legal obligations and key corporate expectations regarding this discrete group of staff. This might include, but is not necessarily limited to, reconciliations between spreadsheets used to record long-term supply cover and iTrent to enable appropriate checks on the completeness and accuracy of information held within iTrent and the use of iTrent reports to identify potential anomalies, exceptions, errors and/or outstanding actions; and (2) review and consider the errors highlighted in the finding and undertake appropriate action to correct these including ensuring that any overpayments arising are recovered. High Agree (1) Fiona Whittaker, Chief Officer of People Resources & Gerard McLaughlin, Chief Officer of Education (North) A comprehensive review will be undertaken to ensure that all legal requirements and key corporate expectations are being complied with and that E&F management have visibility of all supply teachers across the estate to assist them in the management of this discrete staffing group. (2) Fiona Whittaker Chief Officer of People Resources The errors highlighted have been reviewed and action taken as appropriate to correct them. August 2023 Complete
Page 40
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 7 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Ref Finding 3 Several errors and duplicate entries were identified in payments made to short-term supply teachers. Temporary teachers (short-term supply and permanent teachers working additional hours) are required to claim their days/hours worked through the Myself module of iTrent, recording the date earned, pay element (days/hours), cost centre (to ensure the payment is charged to the correct establishment), reason code (to establish whether the payment should be charged to the school or centrally) and number of days/hours worked. Once submitted, these claims require to be checked and authorised by the appropriate Headteacher/Depute Headteacher to ensure that the claim is fully completed and to confirm that the dates claimed have been worked. iTrent then automatically calculates the payment due in line with SNCT guidelines. iTrent does not detect, or highlight to the authoriser, claims where the same date has been claimed twice and there is no simple way for authorisers to easily view previously approved claims to identify any duplicate entries. To ensure the accuracy of claims made through iTrent and assist with the authorisation process, Headteachers should hold separate documentation detailing the days/hours worked by temporary teachers and the reason code for the cover, and this should be referred to during the authorisation process to ensure the accuracy of claims and that only those days/hours actually worked are claimed and authorised. Our review of the documentation held by schools for a sample of 21 temporary teachers’ payments identified a number of issues, including: • three schools which did not hold any separate supporting documentation to record supply cover (teacher, days and hours worked); • claims which did not match the supporting documentation (e.g. incorrect dates, incorrect days/hours); • claims for dates when the school was closed (e.g. Queen’s funeral on 19/09/22); • claims for dates when the teacher was recorded as being sick; and • only one school had marked the documentation to confirm that the dates had been claimed and authorised to assist with the prevention of authorising duplicate claims. We obtained an iTrent report detailing all temporary teacher claims paid between August 2021 and August 2022. Our analysis of this report identified a high number of payments where teachers had been paid twice for the same dates (50 dates claimed by 30 temporary teachers), resulting in an overpayment. Details of these claims have been provided to the Service under separate cover. Whilst the cost centre and reason code fields are required for financial purposes, these fields are not mandatory on iTrent and are often not completed, resulting in Financial Solutions undertaking additional work to identify the correct cost centre and reason code, and potentially understatement of schools’ budget commitments. For the temporary teachers claims paid between August 2021 and August 2022, we identified a number of claims, authorised by different people, which had no cost centre and/or reason code recorded. This confirms that the required completeness checks are not always being undertaken prior to authorisation. Implication Recommendation Priority If separate records detailing days worked by supply teachers are not maintained by Schools and used by authorising officers to check supply teacher claims for payments, claims may be incorrectly authorised which could lead to supply teachers not being paid correctly and additional cost to the Council. Incomplete claims with omitted cost centre/reason codes could impact on the school budget as commitment for supply teachers will be understated. People Resources, in conjunction with Education and Families, should: (1) advise Headteachers that they should hold separate documentation detailing the hours/days worked by temporary teachers and the reason code, refer to this documentation when authorising Myself claims to satisfy themselves that the claim is accurate, and update the documentation to clearly reflect dates which have been claimed to avoid duplicate payments; (2) remind supply teachers and Headteachers of the need to ensure that all Myself claims are fully and accurately completed (in particular, cost centres and reason codes) prior to submission/authorisation; and (3) review the list of duplicate payments/errors identified by Internal Audit during the audit and take appropriate action to correct these. Details of these payments have been provided under separate cover. Medium
Page 41
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 8 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Management response Implementation Month/Year Agree Fiona Whittaker, Chief Officer of People Resources & Gerard McLaughlin, Chief Officer of Education (North) (1) The iTrent system does not have the functionality to prevent duplicate claims being made – this would require considerable financial investment for further development of the system. Employees will be reminded of their personal responsibility when making financial claims to ensure submissions are completed fully and accurately and that they do not inadvertently commit unintended fraud by making duplicate claims. Due to the extent and labour-intensive process required to ensure that all claims made are singular, a review will be undertaken by Education and Families in conjunction with Support Services (People Resources and Financial Solutions) to consider the most appropriate way to assist Headteachers to monitor and manage the use and payment of temporary teachers. It is anticipated that this will be in the form of a retrospective report-based process that will be consistently implemented across the school estate. (2) A reminder will be issued to Headteachers and Teachers of the requirement to ensure all claims are accurately and fully completed prior to submission for authorisation and follow-on processing. (3) The list of duplicate payments/errors is currently being reviewed and corrective action taken as necessary. August 2023 February 2023 February 2023
Page 42
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 9 3. Action Plan (continued) Controls – Use of Teaching Supply Staff 0450/2023/001 Ref Finding 4 There is a need to continue to progress identified actions around financial management arrangements in schools and to continue to monitor the effectiveness of revised arrangements. It is recognised in national guidance that Headteachers require the assistance of suitably qualified and experienced staff and information systems to effectively fulfil their responsibilities in respect of the day-to-day operation of the Devolved School Management (DSM) scheme. In respect of financial support, each Headteacher has been aligned to and is supported by an Administrative Finance Assistant (AFA), allocated to schools on a cluster basis (secondary school and any associated primary and ASN schools). Previously, AFAs were line managed by their respective secondary school Headteacher, however, CMT agreed to transfer this to Schools Finance Officers within Financial Solutions from August 2022. A DSM working group with representatives from Education and Families, Financial Solutions, HR and Headteachers has been established to discuss the role of the AFA, their workload/tasks, identify any required amendments to job descriptions and training needs. Financial Solutions has prepared a draft AFA workplan which details the tasks which an AFA is required to undertake on a weekly basis over a four-week period. Financial Solutions anticipate that this workplan will be completed by the AFA and discussed with their Schools Finance Officer to enable progress monitoring and ensure that all the required tasks are being completed within the required timescales. Whilst a lot of work has, and continues to be, undertaken by Financial Solutions in relation to the transfer of AFAs to Financial Solutions and to provide high quality and robust financial assistance to schools, many aspects of this are still under development such as changes to job descriptions, finalisation and implementation of the draft AFA work plan (expected January 2023) and identifying the training requirements of individual AFAs. Additionally, the Council previously used the SEEMIS system as a budget monitoring tool to support DSM, however, when this part of the system was retired in July 2021, Financial Solutions had to implement alternative measures for financial and budget monitoring for schools. We have not reviewed or assessed the adequacy or effectiveness of these interim measures as part of this audit review. We noted that historically there has been a high level of absences/vacancies of AFAs and this has led to some schools having no AFA support and staffing reconciliations not being completed as often or in a timely manner, making it more difficult for Headteachers to monitor their staffing budgets. We understand that work continues to identify the most appropriate long-term mechanism/system to facilitate effective financial and budget monitoring at schools. Implication Recommendation Priority Headteachers may not receive regular and up to date financial management information and advice which could result in inability to monitor budgets and identify under/overspends and any anomalies on a timely basis. Education and Families, Financial Solutions and People Resources should: (1) continue to progress the necessary actions identified as a result of the transfer of AFAs to the Service; and (2) monitor the interim arrangements for financial and budget monitoring for schools to ensure that they provide a robust and effective financial control framework. Medium Management response Implementation Month/Year Agree Thomas O’Hagan (Business Finance Manager) (1) The further integration of AFAs into Financial Solutions will be reflected in the completion of formal tasks such as updating Job Descriptions, completing PRDs and ensuring a full complement of staff are in post. Equally important is that the ongoing mentoring, training and development of the AFA staff cohort continues, alongside the effective communication of plans and expectations to both AFAs and headteachers. (2) The arrangements for the management of school resources continues to be driven by key corporate and Service documents including the Financial Regulations, Scheme of Delegation, DSM Scheme and Financial Procedures Manual. A risk-based approach to the provision of financial information during the period following the retirement of the SEEMiS Budget and Finance modules has been undertaken which has ensured sufficient data and information is available to undertake key tasks such as year-end accounts preparation and budget creation, and allowed statutory returns and grant claims to be submitted when required. Budget Unit staff and AFAs also regularly attend briefings to raise awareness and knowledge of the reports and workarounds that have been created to aid the periodic budget monitoring process and furnish Headteachers with relevant financial data. The temporary financial monitoring arrangements are reflected in the SEEMIS replacement Project Risk Register and are managed/reported in accordance with the Council’s Project Management Guidance. April 2023 Ongoing
Page 43
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 10 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 44
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0450.2023.001 - Controls - Use of Teaching Supply Staff/A - FINDINGS AND REPORT/A09a 20230125 Supply Teachers Final report v1.0 as issued.docx 11 Appendix 2 – Supply Teacher Definitions Category Definition applied in NLC Short-term (casual) Employed on a casual, temporary basis to provide supply cover at various schools on an ad-hoc basis, with a single engagement (i.e. continuous cover at the same school) for a period of up to 20 days. Fixed Term (temporary) Employed for a set number of hours on a temporary basis for a fixed term to provide long-term supply cover (over 20 days), often to cover a temporary vacancy. Core Supply (permanent) Employed on a permanent basis, initially placed in a 1FTE position at a specific school for one academic year and thereafter allocated to available permanent school positions. If no permanent positions are available, placement in a school specific post is deferred and the employee is placed in a further temporary position until the following year. Permanent Pool (permanent) Employed for a set number of hours on a permanent basis but not permanently based at a specific school.
Page 45
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT CREDITORS Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officer of Place (Action Plan ref 1(1)), Chief Officer of Asset and Procurement (Action Plan ref 1(2)) and Chief Officer of Finance (Action Plan ref 2). Copied to: Business Finance Manager (Resources and Payments), Chief Executive and Depute Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of key controls in relation to the authorisation and payment of creditors by the Council. This includes arrangements for ensuring that payments are only made in respect of amounts properly due in respect of goods and services which have been ordered and received, that payments have been properly authorised and that where amounts are paid these are correctly calculated and recorded. Based on the results of our audit work, we have categorised this audit as offering ‘reasonable assurance’ as we have concluded that there is a generally sound control environment in place although some relatively minor issues, non-compliance or scope for improvement have been identified. We were pleased to note that the revised invoice certification and submission process introduced in July 2021 continues to be applied accurately across the Council. Services are sending invoices to creditors for processing with procedures ensuring all invoices are properly authorised prior to payment in accordance with expected arrangements. We also found that appropriate supporting documentation was generally being held in respect of payments; and that transactions were being properly and accurately recorded in the Council’s general ledger. Although the results of our audit were generally positive, we have identified a small number of instances of non-compliance with expected arrangements and/or where scope for improvement in the control environment has been identified. Most significantly, although a compensating control has been established to address the previously identified control weakness that arose when the interface between PECOS and eFinancials (which provided an automated process to match invoices to orders) was removed, this was intended to be a short-term requirement until the link could be re-established. For several reasons this link is still not in place. Work is underway, however, via the Purchase to Pay (P2P) digital workstream to address this issue and we consider that this work, to enhance the control environment for processing and paying invoices, needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to. It is important, therefore, that Services make maximum use PECOS for ordering and invoice processing, wherever possible, as this will enable the Council to make more effective use of resources, help improve invoice processing times and ensure a more robust and consistent approach to ordering and invoice processing activity across the Council. Recommendations are included at Section 3 of the report. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0200/2023/003 Date issued 30/01/23 Audit Team Elaine MacDonald, Paula Hendry and Jackie Struthers
Page 46
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 2 1. Executive Summary Objectives The purpose of this audit is to provide independent assurance that key controls in relation to the approval and payment of creditors by the Council are operating effectively. This includes arrangements for ensuring that payments are only made in respect of amounts properly due in respect of goods and services which have been ordered and received and have been properly authorised and that where amounts are paid these are correctly calculated and recorded. The work was designed to offer an audit opinion on the following: • Whether effective controls continue to operate which ensure that all payments are properly authorised in accordance with expected management arrangements; • That appropriate supporting documentation is held in respect of all payments; and • That all transactions are properly and accurately recorded in the Council’s general ledger. Substantive testing of the effective operation of key controls was based on a sample of 100 payments made across all service areas selected from the period April to September 2022. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 2 0 Key areas requiring management action (High) There are no key areas requiring urgent management action. Good practice identified We noted the following areas of good practice during the audit: • The General Contract Standing Orders sets out the rules and procedures that apply relating to supplies, the provision of services and the execution of works including expected arrangements and controls relating to procurement/ordering and the authorisation of invoices; • Orders placed via the PECOS purchasing system are subject to robust system-imposed controls including appropriate segregation of duties and the application of a hierarchy of authority limits to raise orders; • In the absence of a functioning operational interface between PECOS and eFinancials which electronically matches invoices to orders, a compensating control has been established designed to ensure compliance with the Council’s Financial Regulations. This requires positive confirmation from an authorised officer that for the invoice presented, the goods or services are as ordered, that payment is properly due under the terms of any contract, and that the prices and all relevant arithmetical details are correct, and that the expenditure has been properly incurred; and • Relevant cost centres and account codes charged in the financial ledger are appropriate in relation to the goods/services purchased. Other areas for improvement (Medium) The following issues and/or areas for improvement were identified: • Work currently underway to enhance the control environment for processing and paying invoices needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to; and • Some Services directly inputting invoices to eFinancials are not always fully complying with current invoice certification and processing expectations.
Page 47
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 3 3. Action Plan Creditors Regularity 0200/2023/003 Ref Finding 1 Work currently underway to enhance the control environment for processing and paying invoices needs to be progressed to conclusion to enable automated controls to be more fully utilised and thereafter that key requirements/expectations are consistently adhered to. The Council has a devolved operating model for procurement activity and Chief Officers are therefore responsible for ensuring their Service areas adhere to the corporate expectations around purchasing/ordering of goods and services and the payment of creditors. The current expectation (as per the Council’s general contract standing orders and financial regulations) is that PECOS or other approved electronic purchasing systems should be used, wherever possible, for all purchases. This system facilitates the creation of purchase orders and the receipting of goods/services received. As reported in our audit of creditors in 2020 (0220/2020/002), the interface between PECOS and e-financials that provided a key element of the control environment for processing invoices (for orders raised through PECOS) ceased to be operational in February 2018, as it was no longer supported. The previous automated system arrangement involved the invoice being matched with the purchase orders/goods received notes held on PECOS and if the information from both systems did not agree (within certain parameters/tolerance levels) then the invoice would not be matched to an appropriately authorised order and could not be passed for payment. A new interface was expected to be developed within a few months of the ‘switch off’ of previous arrangements, however the replacement interface at the time of our audit in 2020 was still not operational. In response to the recommendations made in the 2020 report regarding the weakened control environment, Financial Solutions reviewed and established revised requirements for the certification and submission of invoices. This required all invoices submitted to creditors for processing (regardless of ordering process i.e. PECOS or non-PECOS) to be signed by an authorised signatory with delegated authority to approve invoices and for this signature to be accompanied by clear wording to demonstrate that the authorising officer was confirming compliance with paragraph 14.4 of the financial regulations which requires that for the invoice presented, the goods or services are as ordered, that payment is properly due under the terms of any contract, and that the prices and all arithmetical details are correct, and that the expenditure has been properly incurred. The onset of the Covid-19 pandemic meant that although there was a requirement for all invoices to be authorised by an officer with delegated authority the amendment to the certification to explicitly confirm compliance with financial regulations was not introduced until July 2021. We were pleased to note that our testing during this current audit confirmed that this process is being adhered to across services by way of a covering email from a Council Officer with suitable delegated authority quoting the required narrative, is submitted to creditors with the associated invoices attached to be paid. The alternative certification arrangements detailed above were intended to provide a compensating control, in the short term, until the interface between PECOS and eFinancials could be re-stablished recognising this would provide for a more robust control environment. The development of the interface between e-financials and PECOS is now part of the much wider corporate Purchase to Pay (P2P) digital workstream with the Chief Officer of Place designated as the Senior Responsible Officer (SRO) for this project. The P2P Project Team are now responsible for the development and implementation of this project, the first phase of which is to re-establish a link between PECOS and eFinancials for invoice processing. We understand that work on this is significantly progressed with a solution about to undergo user acceptance testing with the expectation by the Project Team that it will go live in April 2023. Although the link between PECOS and eFinancials is not currently operational, as mentioned above, the PECOS system still provides a mechanism for raising orders and receipting goods. In respect of this we noted a number of instances where the PECOS system was not being used in accordance with corporate expectations as follows: • we identified a number of cases where PECOS was not always used to raise orders by Services who have access to it; • a small number of instances where details recorded on PECOS were vague/unclear; • orders being raised retrospectively for which no pertinent reason as to why this was so, was apparent and/or provided; and • several PECOS orders where the system had not been updated to record that the goods/services had been received but the invoice had been passed for payment. These were evidenced across several Services but were more proportionately more significant in Education and Families. In each case the Service had received the goods/services, but the system had not been updated to reflect this. The forthcoming re-introduction of an interface between PECOS and eFinancials will enable the Council to strengthen the control environment, make more effective use of resources, help improve invoice processing times and ensure a more robust and consistent approach to ordering and invoice processing activity across the Council. (Continued overleaf)
Page 48
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 4 3. Action Plan Creditors Regularity 0200/2023/003 Implication Recommendation Priority Management response Implementation Month/Year Expenditure may not be properly incurred. Increased potential risk of fraud and/or error and that any relevant issues would not be identified in a timely manner. (1) Chief Officer of Place should ensure that completion of the interface between PECOS and eFinancials via the P2P project is progressed in line with proposed timescales. Once complete appropriate guidance on its use and any associated expectations should be prepared and communicated to Services; and (2) Chief Officer of Assets and Procurement should ensure that Services are reminded: i. That PECOS is expected to be used, wherever possible, as the Council’s default ordering and invoice processing system; ii. Of the need to raise orders for all purchases and that, as far as possible purchase orders should be raised ahead of procuring goods/services and accurately and fully populated with relevant details (description, quantity and price); and iii. PECOS users are reminded of the need to ensure goods/services are receipted on the relevant order before the invoice is passed for payment to the supplier. Medium Agree (1) Pamela Humphries, Chief Officer of Place Good progress has been made by the Council’s 3rd party contractor to resolve technical issues with the interface between Pecos and eFinancials as part of the P2P workstream to allow automated ‘matching’ of orders with invoices to facilitate a more streamlined and efficient payment process. The interface is the responsibility of the Council’s 3rd party contractor and although there are issues still to be resolved in respect of NLP invoices, the system now appears to be working for all other invoices. A Steering Group has been established with service representation across the Council which will be used as a vehicle to roll-out the implementation of the updated P2P process and in due course e-invoicing. It is currently anticipated that user testing will be fully complete by end April 2023 with training and roll-out progressing during May 2023. (2) Audrey Telfer, Category Manager (Corporate and Digital) Assets & Procurement will issue a Corporate Procurement Advisory to remind Services that: • Pecos is expected to be used wherever possible as the Council’s default ordering and invoice processing system; • there is a need to raise orders for all purchases and as far as possible ahead of procuring Goods/Services and that all orders must be accurately and fully populated with the relevant key details (description, quantity and price; and • Pecos users must ensure that Goods/Services are receipted on the relevant order before the invoice is processed and passed for payment to the Supplier. June 2023 February 2023
Page 49
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 5 3. Action Plan (continued) Creditors Regularity 0200/2023/003 Ref Finding 2 Some Services directly inputting invoices to eFinancials are not always fully complying with current invoice certification and processing expectations. The pandemic resulted in the need to introduce revised working practices for invoice processing. This covered both PECOS and non-PECOS orders and as well as providing a mechanism by which the Council could continue operating when staff were working remotely, revised arrangements also provided a compensating control to replace the previously automated arrangement for matching invoices to PECOS orders (see point 1 above). As noted at point 1 above, our testing of a sample of invoices during this audit confirmed that the revised invoice certification and processing arrangements had largely been adhered to by Services submitting invoices to creditors for processing. We did, however, identify a potential gap in the arrangements for those Service areas who directly input invoices to eFinancials. Included within our audit sample were some invoices for Facility Support Services who are one area that input their own invoices. They have done this for some time and during the Covid-19 pandemic continued to be office based with no change to their normal operating arrangements. As such their invoice processing arrangements remained the same. We understand that their arrangements require the invoice to be checked to PECOS to confirm the order was appropriately authorised and goods received. If the details agree, the invoice will be processed without any further authorisation and as such are not currently adhering to the revised corporate expectation for invoice certification and processing as outlined elsewhere in this report. A difference between order and invoice would require the PECOS order to be updated and re-submitted for authorisation. Whilst our audit did not highlight any instances where invoices were being processed that had not been agreed to the authorised order and confirmation that goods had been received, there is an increased risk that an invoice could be processed for which authorisation from an officer with delegated authority to do so has not been obtained (i.e. if the value of the invoice was significantly different to the original order value that had been approved). Internal Audit considers that until such times as the interface between PECOS and eFinancials is restored (see point 1 above), the corporate expectation that all invoices require authorisation by an officer with delegated authority to do so accompanied by explicit confirmation that the requirements of financial regulation 14.4 have been complied with, regardless of method of order, should be adhered to by all Services including those directly inputting to the system. Implication Recommendation Priority Management response Implementation Month/Year There is a risk of inconsistency in the way invoices are approved for payment that is not fully compliant with the Financial Regulations. Invoices may be paid which are not fully or properly approved in line with corporate expectations. The Chief Officer for Finance should ensure that arrangements in Services with the ability to processing invoices directly on eFinancials are reviewed to determine whether controls are sufficiently robust and operating effectively and/or whether any changes to these Services’ arrangements are required pending/until the introduction of the new interface. Medium Agree Nicola Lynch, Business Finance Manager (Resources and Payments) The Chief Officer for Finance will undertake a review of the processes being completed by Services who directly input invoices to eFinancials. The review will ensure that there is a consistent approach to the way that invoices are approved for all Council Services and that this is fully compliant with the Financial Regulations. Any additional training required will be undertaken by the Central Creditors Team March 2023
Page 50
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0200.2023.003 - Creditors/A - FINDINGS & REPORT/A06a 20230130 CREDITORS - Final report v1.0 as issued.docx 6 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 51
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 1 INTERNAL AUDIT REPORT CYBER SECURITY Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2 Good Practice Checklist Issued to: Chief Officer of Business and Digital Copied to: Information Risk Manager, Chief Executive and Depute Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber-security threats and/or attacks. In particular, the audit focused on whether the arrangements and controls in place are in accordance with relevant external standards and/or where not, that there are clear, risk-based and realistic plans to address any areas of weakness or non- compliance and that these are being satisfactorily progressed. Cyber security is the activity required to protect an organisation’s data, devices, networks and software from unintended or unauthorised access, change or destruction via the internet or other communications systems or technologies. Cyber incidents pose an increasing threat to public bodies’ management of their information with hacking, ransomware, cyber-fraud and accidental losses all evident across the public and private and sectors. In recent years, there has been an increasing prevalence of targeted ransomware, including those which can cause serious disruption to an organisation, and which can result in significant additional costs and reputational harm. This audit was undertaken in collaboration with Business and Digital staff from the Information Risk and Security Team using a good practice checklist which was developed from a variety of resources including relevant guidance from the National Audit Office (NAO), the National Cyber Security Centre (NCSC) and from learning material for public bodies circulated by the Scottish Government following the widely reported 2020 SEPA ransomware attack. The Council continues to be committed to ensuring it has robust and effective information governance arrangements and has recognised the threats posed from cyber-security risks. While the Council has elected for practical reasons not to seek Cyber Essentials accreditation, we noted that it that it seeks to guard against common cyber-security threats and/or attacks through a range of cyber-security arrangements, controls and activities including PSN compliance and regular threat assessments including penetration testing. We have categorised this audit as offering ‘reasonable assurance’. We consider that the Council’s arrangements appear largely commensurate with good practice and that these arrangements are subject to regular review and, based on most recent review/assessments, appear to be operating effectively. We were pleased to note that significant additional resources have been devoted to these activities in recent years and that a range of further planed actions to improve the control environment have been identified. We have identified a small number of areas for improvement and our recommendations are detailed at Section 3 of this report. The most significant of these issues is that the current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales to provide a clearer mechanism for identifying and monitoring planned cyber-security activities. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance Organisational impact (see definition at Appendix 1) Major Report status FINAL Audit ref 0420/2023/001 Date issued 25/01/23 Audit Team Lynn McCrum and Paula Hendry
Page 52
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 2 1. Executive Summary Objectives The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s approach to guarding against common cyber-security threats and/or attacks. In particular, the audit focused on whether the arrangements and controls in place are in accordance with relevant external standards and/or where not that there are clear, risk-based and realistic plans to address any areas of weakness or non- compliance and that these are being satisfactorily progressed. During the audit, we considered the following: • whether the Council implemented a formal regime or structured approach to cyber security which guides its activities and expenditure. • how management has decided what level of risk it will tolerate in relation to cyber and information security and how it will manage that risk. • whether the Council understands if its risk profile and appetite has changed due to COVID-19; and • whether the Council has identified and deployed the capability it needs in this area? This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 2 0 Good practice identified We noted the following areas of good practice during the audit: • The Council has appropriate governance structures in place relating to Information Governance and Information Security which includes the Data Governance Board and Data Management Team. • The Council’s Chief Officer of Business and Digital is the Senior Information Risk Owner (SIRO) for the organisation and has overall authority and responsibility for information governance and security. • The SIRO Annual Report reflects annually on the Council’s information governance work, including providing an overview of relevant activity including providing assurance that personal data is held securely. References is made within the report as to activities which have been undertaken, or are planned, to mitigate against cyber risks. • The Information Risk and Security Team within Business and Digital are responsible for oversight of cyber security. • There is an Information Security and Information Governance corporate risk, with corresponding controls and actions identified. This is monitored in accordance with the associated residual risk rating. • There are mandatory information governance and security training modules for staff tailored to suit the needs of individual roles. • Effective communication channels exist within the Council to inform Services and staff of relevant issues and developments in relation to cyber security. • The Council’s Cyber Security arrangements have been assessed against the Public Services Network (PSN) Code of Conduct, with the Council having achieved full compliance. • Independent IT Health checks are undertaken annually, including penetration testing and other testing of the effectiveness of network controls. • Improvements have been made to supply chain management security through adoption of the Scottish Government’s ‘Cyber Security Procurement Support Toolkit’ (CSPST). • The Council’s ICT resilience capability has been tested through use of the NCSC developed ‘Exercise-in- a-Box’ toolkit.
Page 53
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 3 Good practice identified (continued) We noted the following areas of good practice during the audit: • There are robust authentication and access control procedures (including multi-factor authentication) in place to protect Council systems from unauthorised access. • A suite of malware protection products has been fully deployed (e.g. antivirus software, web filtering and email malicious content/payload detection systems) in addition to real-time analysis of security threats identified and managed through deployment of Security Incident Event Management (SIEM) software. • The Council have procured a cyber incident retainer service meaning professional support can be available on-site at short notice to help limit the impact of any significant cyber incident and to assist in recovery thereafter. Key areas requiring management action (High) No key areas which require urgent management action been identified. Other areas for improvement (Medium) Two other areas for improvement were identified: • The current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales. • Proposed arrangements and expectations associated with the refreshed ICT Disaster Recovery Plan need to be finalised and communicated to Services.
Page 54
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 4 3. Action Plan Cyber Security 0400/2023/001 Ref Finding 1 The current Information Security Action Plan needs more clarity in respect of relative priorities, key planned actions, milestones and timescales. The Information Risk & Security Team have an Information Security Action Plan in place for 2022/23. This Action Plan was an interim measure to assist management with logging the tasks to be undertaken in the immediate short-term. The plan lists the individual projects/programmes identified by the Team as being pertinent to address key areas of risk and provides brief details/summaries of each including responsible officer; PMO ID; anticipated duration; description; due date; limited narrative on current status; and RAG status. The Information Risk and Security Team recognise that they do not have sufficient dedicated resource to undertake all the work streams per their action plan. Internal Audit notes that the current plan is high-level and consider that there would be merit in there being more detailed work plans for each of the planned actions providing a summary of the proposed actions; relevant milestones and associated timescales which would enable progress to be better tracked on an on-going basis. In addition, whilst we acknowledge that there appears to have been a degree of consideration given to prioritisation of the individual work streams/activities on the Action Plan, we consider that it would be more pragmatic to assess each of these activities in terms of significance and risk impacts/risk exposure to determine how best they should be prioritised. The Information Risk Manager advised that the work streams contained within the Action Plan are currently monitored using an agile and continuous improvement approach and a monthly summary of activities, including progress made, is provided for management review and updates are provided to the ICT management team meetings. We also noted that there is currently no Action Plan beyond that for 2022/23 although, from discussions with the Service, we understand that work is currently ongoing to develop a strategy and more formal work-plan for the next three years. We recognise that, given the nature of the topic and the ever-changing landscape and threats, the longer-term aspects of this Action Plan are likely to be more ‘fluid’. In previous years the Council held the Scottish Government recommended Cyber Essentials accreditation. Business and Digital submitted the Council’s application towards the end of 2020-21 but failed to meet the updated and significantly more onerous compliance requirements of this external accreditation. The Service has since determined that Cyber Essentials no longer meets the Council’s needs and it now seeks to protect itself from common cyber-attacks through full compliance with the externally inspected Public Sector Network (PSN) accreditation, the required IT Health Checks and regular threat assessments. In addition, the Service advised that going forward they intend to refer to and align with the requirements contained within the more recently issued Scottish Government Cyber Resilience Framework, which incorporates standards/expectations from a number of various sources, including elements of Cyber Essentials. The Senior Information Risk Officer (SIRO) recognises that in times of increasing cyber-attacks and continued use of ageing legacy applications there is a growing concern regarding the Council’s vulnerability including ability to fully secure data held on business-critical applications. Implication Recommendation Priority Failure to have appropriately detailed project plans may result in an increased risk to the successful delivery of the actions stated in the work plan and the achievement of intended outcomes. The Chief Officer of Business and Digital should ensure: (1) going forward, a formal risk-based approach to developing the Information Security Action Plan is adopted and that the resultant Plan is sufficiently detailed to include relevant milestones thus enabling tracking on an ongoing basis and proper consideration to be given to the prioritisation of actions and associated timescales; (2) a longer-term work plan (i.e. beyond 12 months) is formulated, agreed and thereafter monitored; and (3) highlight to relevant Services where additional risks are present in relation to legacy systems that need to be reflected in Service risk registers. Medium
Page 55
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 5 3. Action Plan (continued) Cyber Security 0400/2023/001 Management response Implementation Month/Year Agree Katrina Hassell, Chief Officer of Business and Digital (1) A risk-based approach has been, and will continue to be, used to inform priorities and future iterations of the Information Security Action Plan. For example, the previous two SIRO reports highlight the Gartner ‘IT Score for Security & Risk Management’ assessment, which is used to inform prioritisation and planning, and this is presently being scheduled for the forthcoming financial year and beyond. In addition, it has already been proposed that the Council assure itself against the Scottish Government’s Cyber Resiliency Framework, which takes a risk-based approach to determining the cyber security controls applicable to Scottish public sector organisations generically. Where applicable, milestones, etc. will be determined, but an agile-based methodology incorporating continual improvement will continue to be a significant element of the Council’s cyber security posture in the face of an ever-changing risk landscape and the evolving nature of the organisation’s digital footprint. (2) The team are developing an information security strategy which will include the desired ‘future state’ (beyond just one year) for cyber security. Provisos need to be accepted, however, that longer-term plans give rise to less certainty, and that regular monitoring may see such subject to regular change. This aims to build upon existing planning, including the Council’s 5-year capital plan which presently details several longer-term plans around cyber security, such as procurement of vulnerability management systems, phishing simulators and new security incident and event monitoring tools. (3) The SIRO report references several concerns regarding legacy systems. Business and Digital will risk-assess these over the course of 2023-24 and will use those findings to inform services of high-risk systems which they should include in their service risk registers. June 2023 June 2023 March 2024
Page 56
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 6 3. Action Plan (continued) Cyber Security 0400/2023/001 Ref Finding 2 Proposed arrangements and expectations associated with the refreshed ICT Disaster Recovery Plan need to be finalised and communicated to Services. The Council’s ICT Disaster Recovery (DR) plan was updated in 2020, with ongoing amendments thereafter reflective of changes made to line of business and productions systems. As part of this review the plan content was assessed to ensure systems were correctly identified and classified by their value/importance, and that system recovery details were accurate. To support the DR Plan, an ICT DR and Resiliency Standard was created and approved by the Data Governance Board in September 2021. This standard lays out the expectations and requirements for both making systems suitably resilient and supporting DR processes. This includes referencing that a standard and defined process will be put in place to ensure all systems are assessed for resiliency and DR requirements in the same manner and categorised into Gold, Silver and Bronze with a typical approach for system architecture DR and resiliency assigned to each class. The document also identified opportunities for further improvements to be made to the existing DR Plan. As a result, a refresh of the DR planning within the Council has been identified as an action in the Information Security Action Plan 2022/23, with an expected completion date of 31 March 2023. A detailed improvement plan has been created in this respect with progress of actions monitored an on-going basis. Business and Digital envisage that this refresh will ensure a more modular approach to managing DR documentation and will see the documentation broken into three components; an overarching procedural document which will detail how the ICT DR will be operated by the Council and the various processes required to support that operation (including Incident Response Plans for individual events, such as ransomware and data loss, that commonly affect organisations); individual system ICT DR plans and an index providing detail on where ICT system/application controls are located; review periods; testing history; classification and any other metadata relevant to individual plans. These fields will be held as an extension to the Council’s application catalogue. The Service’s plans also reference that an audit process, co-ordinated by Technology Solutions, will be implemented to ensure DR plans are in place, subject to review, and are tested according to an agreed schedule. We noted that to date, and due to the significant pressures facing Services responding to the challenges presented by the pandemic, there has been only limited testing of Services’ DR arrangements of late primarily due to Covid. However, Business and Digital undertook a corporate exercise, with participants from all relevant Services, to assess the organisation’s understanding of, and preparedness for, dealing with a potential cyber threat using the NCSC ‘Exercise-in-a-Box’ toolkit, most recently in December 2022. Whilst we acknowledge the positive direction of travel in respect of the review and refresh of DR arrangements, we consider that it is important that as part of this process, engagement with Services is undertaken to ensure they have a clear understanding of the DR arrangements assigned to their system, are clear on the roles and responsibilities of both Business and Digital and themselves and that due consideration of the recovery timescales can be reflected in their individual business continuity plans. Implication Recommendation Priority A lack of appropriate and detailed guidance (and/or understanding of such guidance) may result in the inability of Services to fully consider the impact of a loss of IT at a service level and the steps necessary to respond to minimise disruption to the Council and/or service areas. The absence of up-to-date, comprehensive ICT Disaster Recovery plans could result in the inability to restore corporate or service infrastructure in line with expectations. Business and Digital management should: (1) ensure the ICT Disaster Recovery Plan refresh progresses in line with expected timescales to ensure that fully documented plans are in place; (2) communicate with system owners to ensure that Services are clear on their responsibilities and planned recovery times in relation ICT disaster recovery and the need for this to be aligned with their Service business continuity plans; and (3) ensure appropriate oversight/review of Services/System Owners ICT disaster recovery arrangements/plans to ensure these are consistent with and fully meet the requirements of the Council’s disaster recovery standard. Medium
Page 57
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 7 3. Action Plan (continued) Cyber Security 0400/2023/001 Management response Implementation Month/Year Agree Katrina Hassell, Chief Officer of Business and Digital (1) Activities are well under way to progress the refreshed programme. The baseline refresh will be complete by the end of June 2023, after which a programme of continual improvement will commence. (2) Services are frequently reminded, for example at governance forums, that they are ultimately responsible for ensuring DR plans for the systems they own meet their requirements. As part of the refresh programme, meetings with line of business system owners took place over December 2022 – February 2023 to reinforce this message. (3) Processes for auditing compliance of plans with overarching guidance form part of the refresh programme and are identified in the ICT Disaster Recovery Operations Manual, which is currently in draft. June 2023 Complete March 2023
Page 58
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0400.2023.001 - Cyber Security/A - FINDINGS AND REPORT/A07a 2023025 Cyber Security Final report as issued.docx 8 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 59
Appendix 2 – Good Practice Checklist Ref Questions Section 1: NAO – Cyber and Information Security Good Practice Guide (a) Approach to Cyber Security 1 Has a formal regime or structured approach to cyber security been implemented which guides its activities and expenditure? 2 (a) Is there an information security management system in place covering policy, processes, governance, skills and training? (b) Who actively manages this system? (c) Has the Council/Business Solutions achieved formal certification through a scheme such as Cyber Essentials or ISO 27001/ISO IEC 27002? (d) Has the system been implemented or certified by consultants or specialist bodies from government? 3 Have boards, working groups and individuals been allocated specific responsibilities for managing cyber risks? 4 (a) Are there plans in place for resilience and recovery in respect of common cyber-attacks? (b) Are such plans tested regularly? 5 Has Business Solutions undertaken a clear assessment of the potential risk arising from electronic links with any supply chain or operational partners? (b) Cyber and information security risks 6 How has management decided what level of risk it will tolerate and how it will manage that risk? 7 Have senior management discussed its overall approach, based on a clear and common understanding of the range of information assets it holds and agreed which of those are critical to the Council’s business? 8 Is there a clear understanding of the kind of threats and risks the Council actually faces, based on incident reporting and relevant performance indicators? 9 Are cyber risks proactively managed as an integrated facet of broader risk management, including scrutiny of security policies, technical activity, information security breach reporting, user education and testing and monitoring regimes? 10 Is Business Solutions involved in sector or peer information exchange mechanisms to improve its understanding? (c) Effect of Covid-19 on risk profile and appetite 11 Does Business Solutions understand if the Council’s risk profile and appetite has changed due to Covid- 19? 12 (a) What working practices have changed as a result of Covid-19? (b) Have these been documented and presented as changes to operating models and workforce planning? (c) Are cyber security and information risks presented clearly set out, including mitigations and plans? 13 Is there evidence to demonstrate that a review of any required re-development and realignment of processes, working practices and policies due to Covid-19 has been carried out to assess the assurance on cyber security and information risk? 14 Have staff been provided with adequate cyber security and information risk training and support: (a) Throughout changes to workforce planning and operating models (b) In an environment of stabilisation and new ways of working
Page 60
Appendix 2 – Good Practice Checklist Ref Questions 15 Do you understand the overall change process experienced as a result of Covid-19, including the overall impact on risk? 16 Have you set out how a current and future business-as-usual workforce plan and operating model will take cyber security and information risk into account? (d) Identification and deployment of capability 17 Has Business Solutions identified and deployed the capability it needs in this area? 18 Is there either sufficient staff capability to deal with cyber security issues or formal arrangements made to secure this capability from external providers? 19 Are there actively managed plans in place for the recruitment and retention of staff with specialist security skills? 20 Are there clear policies in place on the handling and storage of data, based on relevant legal requirements, such as the Data Protection Act 2018? 21 Is training available for all staff to ensure appropriate levels of awareness and compliance? 22 Has testing been undertaken to measure the effectiveness of controls? Section 2: NAO Key Control Questions (Based on NCSC Cyber Security Toolkit and 10 Steps for Cyber Security) (a) Risk Management 1 Is cyber risk management part of the overall strategic and delivery planning of the Council? 2 As part of its strategic and operational planning, does Business Solutions have a clear understanding of the Council’s critical services, associated risk appetite and required overall approach to resilience, including cyber? 3 Is there a cyber and information risk strategy, detailing overall service landscapes, including shared responsibility models such as cloud, planning and mitigation? 4 Are there appropriate cyber and information risk frameworks, management and controls in place? 5 Are the governance arrangements for managing cyber and information risk based on the importance of data and criticality of services? 6 Do information professionals liaise with central government, stakeholders and suppliers to understand the threat? 7 & 8 Does senior management understand and engage with risk mitigation processes and promote a risk management culture? (b) Engagement and Training 9 Is there a clear centralised cyber security training and engagement plan? 10 Does the Council offer cyber specialist training and career routes? 11 Is there a clear understanding of skill and capability gaps? 12 Does the Council have security policies covering acceptable and secure use of data? 13 (a) Are there grade and role appropriate levels of staff training covering secure processes and use of systems? (b) Is this training undertaken by relevant staff? 14 Are there appropriate controls in place to cover the increase in remote and home working? 15 (a) Are staff aware of information security and cyber risks? (b) Do staff know how to report issues and incidents?
Page 61
Appendix 2 – Good Practice Checklist Ref Questions (c) Asset Management 16 Does the Council/Business Solutions define and utilise asset management systems? 17 Is there an asset management register detailing associated risks and linked to cyber security activities? 18 Is there a clear understanding of critical and prioritised services, detailing associated cyber and information risks? 19 Do Business Solutions/the Council understand the risks associated with legacy asset management? 20 Is there a future plan for managing asset management cyber and information security risks? (d) Architecture and Configuration 21 Is there a business, data and technology architecture within the Council, where associated cyber and information risks are mapped and understood? 22 Does the architectural language include service providers and suppliers, systems and services, with mapped cyber and information risks? 23 When planning and deciding on new services is there clear guidance on how cyber and information security should be assessed? 24 Are there effective monitoring, backup and recovery systems in place? (e) Vulnerability Management 25 Is there a clear understanding of vulnerability management and process, and its associated risks? 26 Are vulnerability management and asset management linked to gain a landscape view of cyber and information risks? 27 (a) Are potential high-risk legacy assets identified and managed? (b) If necessary is there a plan in place to address legacy remediation? 28 Are there effective vulnerability controls in place, such as automation/manual scanning, monitoring, patches and updates? 29 Are vulnerabilities tested on a regular basis, using methods such as penetration testing or ‘red team’ exercises? (f) Identity and Access Management 30 Are there appropriate identity and access management policies, including passwords? 31 Are there effective account management processes, with limits on privileged accounts? 32 When using cloud technologies is there effective management of service accounts? 33 Are user privileges controlled and monitored on the basis of policies for user authentication and access? 34 Is access to activity and audit logs controlled? 35 Are these logs reviewed for unusual behaviour?
Page 62
Appendix 2 – Good Practice Checklist Ref Questions (g) Data Security 36 Is the Council’s data architecture and data model detailing levels of security defined? 37 Does the data architecture include where partner services are used such as for cloud? 38 Does the required legal compliance for data form part of policy? 39 Is the policy understood, managed and implemented effectively? 40 Is the required level of data security and compliance understood, managed assessed and assured? 41 Is there a process in place for data monitoring and unusual behaviour detection? 42 Are there appropriate backup and resilience processes and policies in place? 43 Are there adequately secure device re-use, repair and disposal processes and policies in place? (h) Logging and monitoring 44 Is there an appropriate logging and monitoring system in place? 45 Does Business Solutions have the necessary skills and capability to interpret the information provided? 46 Where outsourced, specialist partners are used are the responsibilities for acting on information clearly defined? 47 Are there adequate automated monitoring systems and services in place? 48 Do logs and other monitoring activities enable the identification of unusual activity that could indicate an attack? 49 Can logs support investigations by showing who accessed what, when they did so and what they did to the information? (i) Incident Management 50 (a) Are there incident management plans in place? (b) Are these tested? 51 Does the incident management plan include a response and test plan? 52 Are there specific processes and policies to manage both the risk and the mitigation of a ransomware incident? 53 Does Business Solutions have an incident response and disaster recovery capability, with suitably trained staff? 54 Are potential criminal incidents reported to law enforcement bodies and relevant data breaches reported to the Information Commissioner’s Office within the timescales required by law? (j) Supply Chain Security 55 Are the supply chain and the services provisioned well understood? 56 Are cloud services in place or being considered? 57 Has recognised guidance, such as the NCSC’s cloud security principles, been followed before committing to using cloud services? 58 Is there a strategy in place for the use of cloud services, based on a clear understanding of how cloud services will interface securely with existing services, systems and processes? 59 Have Business Solutions undertaken due diligence on proposed cloud suppliers? 60 Is there a process to ensure and assure that cyber security and information risk is built into the design, development and deployment of new systems and services? 61 Is there a mechanism in place to build cyber security and information risk into the procurement and commercial process?
Page 63
Appendix 2 – Good Practice Checklist Ref Questions 62 Is there a process for ongoing improvement and development for cyber security and information risk through the lifecycle and management of the contract? Section 3: Lessons learned from SEPA Ransomware Response (a) Increasing number of people and improving training for people with access to threat alerts 1 Does Business Solutions have a dedicated and empowered team (internal, managed service or combination of both) with adequate training to identify, prioritise and rectify threats to their IT systems? 2 Are routine meetings held between at least one individual responsible for the Council’s IT systems and board-level Senior Information Risk Owner (SIRO) to successfully manage and mitigate risks? 3 Does the team have access to threat hunting software and/or management tools? 4 Has consideration been given as to whether a Security Operation Centre (SOC) is a cost effective and appropriate way to provide overall threat protection including monitoring, direct action and logging across the whole of the Council’s IT infrastructure? (b) Availability and testing of emergency management, disaster recovery and incident management plans 5 Are all emergency management plans, including wider civil contingency plans, held in hard copy or in electronic form on a device or service that is never accessible through the core network? 6 Are all emergency management plans, including wider civil contingency plans, tested at least annually to allow for continuous improvement as well as increasing confidence in those responding to any incident? 7 Has consideration been given to acquiring the services of a specialist Cyber Incident Response company as a cost-effective alternative to employing the necessary disaster recovery specialists internally? (c) Enhanced network segmentation controls 8 Have the Local Authority networks been segmented into separate areas (VLANs)? 9 If yes, has independent assurance been sought to confirm the effectiveness of the locks between each area (VLAN)? 10 If no, is this something that has been, or is being considered? Note: in delivering this there may be considerable capital expenditure required (d) Enhanced privileged account management controls 11 Has a review of user account privileges been carried out for each known system to ensure that administrative functions have only been granted to documented and planned administrator accounts? 12 Has multifactor authentication been applied to ALL administrator accounts, even those that are not normally accessible remotely? 13 Are passwords in line with the latest NCSC guidance? (e) Ensure that recovery plan activities are clearly prioritised 14 Has Business Solutions defined, and scheduled an annual review of, a priority list of all of the Council’s IT systems based on the criticality of that system to business functions, service delivery, legal responsibilities and public well-being? (f) Offline immutable back-ups 15 Has testing been conducted to ensure that systems can actually be restored from back-up? 16 (a) Has consideration been given to offline storage? (b) If so, has there been discussion and approval re securing financing of offline storage?