Internal Audit- Follow-Up of Actions previously agreed by Management in response to Audit Recommendations
North Lanarkshire Council · 16 February 2023
Back to Audit and Scrutiny Panel — 16 February 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref KA/LM/ASP/Feb 2023 Date 16/02/23 Internal Audit: Follow up of actions previously agreed by management in response to audit recommendations From Ken Adamson, Chief Officer of Audit and Risk E-mail adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to update the Panel on the results of Internal Audit’s follow-up work reviewing the extent to which management have implemented actions previously committed to in response to previous Internal and External Audit recommendations. Information is contained in respect of the last two years External Audit outputs and those actions agreed in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed in the period up to the end of December 2022. The Panel should note that where actions are not yet ‘complete’ this does not mean that no relevant activity has been undertaken by management and that the actions taken/progress made to date will often have reduced the risk exposure in respect of the weaknesses previously identified even if the action is not yet complete. As reported to the Panel in December 2021, those recommendations which were previously reported to the Panel as partially implemented but not yet complete are now monitored against revised target implementation dates agreed with management and previously reported to the Panel. Seven of the twelve actions agreed in respect of External Audit outputs have been completed, four are not yet due and one is no longer relevant. Five of the twenty-one actions agreed in response to relevant Internal Audit recommendations due in the period have been fully completed and sixteen have been assessed as partially implemented. Recommendations The Panel is invited to: a) note the contents of this report; b) note the recommendations made by Internal Audit at Appendix 1; and c) to consider whether there are any issues arising from this report on which they wish to receive further information from relevant management. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 All Internal and External Audit reports contain management responses to audit recommendations which generally include a commitment to specific actions by a stated date. This report presents an overview of progress by management in addressing all External Audit recommendations made in the last two years and all ‘High’ and ‘Medium’ Internal Audit recommendations which were previously reported as outstanding or where the proposed actions were due to be completed by the end of December 2022. 1.2 The format of this report is designed to allow the Panel to focus on those issues where non-implementation of agreed actions presents the most significant ongoing risk to the Council and to enable the Panel to hold relevant senior management to account. 1.3 Internal Audit’s arrangements for following-up audit recommendation include, in certain circumstances, agreeing a revised implementation date and monitoring and reporting against these revised dates where we are provided with a strong rationale for the non- implementation of the audit recommendation by the originally agreed date. This avoids repeatedly reporting and focusing on actions which are ‘late’ where there are sound reasons for non-implementation by the originally agreed date. 1.4 This report presents the assessment of the potential risks arising from those planned actions agreed in response to Internal Audit recommendations due in the period (August to December 2022) which are not yet fully completed. 1.5 The updates from management on progress to date have been verified on a sample basis by Internal Audit as part of the preparation of this report. However, it should be noted that this review has focused on whether planned actions have been completed and has not included detailed substantive testing of whether the implemented actions have been effective in addressing previously identified weaknesses. 2. Report Actions previously agreed by management – Internal Audit recommendations 2.1 Table 1 below shows whether management have implemented those actions previously agreed to in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed by the end of December 2022. Overall, five of the agreed actions have been completed and sixteen have been assessed as partially implemented. Table 1 Chief Officer Area Complete Partially implemented No longer relevant Total Asset and Procurement 0 1 0 1 Audit and Risk 0 3 0 3 Business and Digital 1 4 0 5 Finance 1 0 0 1 Legal and Democratic 0 1 0 1 People Resources 2 6 0 8 Social Work 1 1 0 2 TOTAL 5 16 0 21
Page 3
2.2 Internal Audit has reviewed the management updates and agreed with relevant management revised implementation dates for all sixteen recommendations listed as partially implemented at Table 1. These recommendations will now be monitored in line with the agreed revised date and will be reported back to the Panel in accordance with this revised timescale, at which time consideration will be given as to whether previously identified weaknesses have now been addressed. 2.3 Detail in respect of each of these recommendations and the current residual risk assessed by Internal Audit as a result of partial implementation is provided in Appendix 1, in which we have also made suggestions as to how the Panel may wish to consider these issues. Definitions of the residual risk ratings are provided at Appendix 2. Actions previously agreed by management – External Audit recommendations 2.4 Table 2 shows the status of actions agreed by management in response to External Audit reports issued as part of the 2020-21 and 2021-22 audits. Internal Audit has concluded that seven of the twelve agreed actions have been completed, four are not yet due and the remaining actions is no longer relevant. Table 2 Completed Partially implemented Not yet due No longer relevant Total Report Title/Year 2020-21 Interim Audit Report 3 0 0 1 4 Annual Report 3 0 0 0 3 2021-22 Annual Report 1 0 4 0 5 TOTAL 7 0 4 1 12 2.5 The External Audit action assessed as ‘no longer relevant’ relate to issues on which External Audit have made a similar recommendation in subsequent audit reports. 3. Measures of success 3.1 Internal Audit report each cycle to the Audit and Scrutiny Panel on the progress made by management in implementing actions previously committed to in response to Internal and External Audit reports. 4. Supporting documentation Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Appendix 2 Residual risk rating definition Ken Adamson, Chief Officer of Audit and Risk
Page 4
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure by Services to address previously identified issues and/or weaknesses will impact on the effectiveness of the relevant control framework. This, depending on the nature of the issue, will be captured and should be reflected in the relevant service risk register or the corporate risk register (as appropriate). 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒
Page 5
Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Asset and Procurement Enterprise Project (May 2022) Risk: Without a robust and realistic contingency plan in place the Council may not be able to ensure continuity of service delivery and achievement of ambitions. Recommendation: The Enterprise Project Board should ensure that the key tasks required to fully document a contingency plan, including key milestones and lead times/critical path, is included in the project plan and thereafter monitor development of the contingency plan to ensure that an alternative ‘Plan B’ is available, and lead times/critical path are clearly understood should the project not be able to be progressed as currently envisaged. Category: Medium The Project Board has set out the actions required to be taken, to mitigate the identified risks at this stage of the project, in a report to the Policy and Strategy Committee in December 2022. Committee approved these actions which are now being progressed and include consideration of contingency planning requirements as appropriate, which will inform the way forward. Original timescale: July 2022 Revised timescale: December 2022 Further revised timescale: September 2023 We acknowledge that work in this area has been ongoing and action to be taken to mitigate the identified risks were outlined in a report to the Policy and Strategy Committee in December 2022. Given that further action is required to fully address the recommendations we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of May 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow- up report. Chief Officer of Audit and Risk Risk Management (July 2022) Risk: Without appropriate training, staff may not be aware of their roles in respect of risk management. Recommendation: The Head of Audit and Risk should: (1) remind Services of the need to complete and monitor uptake of the mandatory risk management training by staff; (2) determine how best to capture/monitor the uptake of mandatory training module for each Service and the Council as a whole in accordance with expected timescales, ensuring that this is regularly monitored, and action taken as appropriate on any issues arising, by the Corporate Risk Team and RMCWG; and (3) ensure the risk network training is finalised and implemented within a reasonable timescale. Category: Medium Services have been reminded of the need to complete and monitor uptake of mandatory risk training. Data on the uptake of the mandatory risk management training module is now available and the RMCWG members will now seek to agree and implement an approach to monitor the uptake. The risk network training has been postponed pending changes to the risk scoring approach which is proposed as part of the review of the Risk Management Strategy which is due to be submitted to Policy and Strategy for approval in March 2023. The training will be launched in April 2023 and will reflect the revised strategy. Original timescale: October 2022 Revised timescale: June 2023 We acknowledge that there has been significant action taken to address the recommendations made and that delay in finalising and implementing the risk network training were necessary to ensure this fully reflects the revised Risk Management Strategy. However, it is important that the outstanding actions are addressed and actioned in line with revised timescales. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 6
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Audit and Risk Risk Management (July 2022) Risk: Management may lack assurance on the extent to which key expectations/requirements contained the strategy are being complied with. Without formal processes in place for reporting risk issues, management may not be able to take appropriate or timely action to address these risks. Recommendation: The Head of Audit and Risk should ensure that: (1) work continues to develop a framework, including suitable KPIs, to appropriately monitor compliance with key aspects of the Risk Management Strategy, with areas for improvement being captured and thereafter tracked and monitored; and (2) clear expectations regarding consideration, monitoring and reporting of risk are incorporated into the revised Risk Management Strategy so that Services can incorporate this into their individual governance arrangements. Category: Medium Development of a draft compliance approach is being progressed through the RMCWG and will be incorporated into the updated/revised Risk Management Strategy which is due to be presented to the Policy and Strategy Committee in March 2023. It is thereafter intended that the new approach to compliance monitoring will commence for 2023/24. The revised Risk Management Strategy will make clear expectations and the detailed process/KPIs etc. Expectations around consideration, monitoring and reporting of risks are being progressed through the RMCWG and will be clarified in the revised Risk Management Strategy. Revised governance arrangements for the CMT, the new Business Management Team (BMT) and SMT/DMTs were approved at CMT in December 2022. The terms of reference for all groups explicitly include each group’s remit in relation to risk management. In addition, a reporting matrix is being developed that sets out organisational (including service) reporting expectations. A Risk Management planning tool is also being developed to provide oversight of key risk management activities (including reporting), and their timing across 2023. Original timescale: December 2022 Revised timescale: April 2023 We acknowledge that there has been significant action taken to address the recommendations made and that the revised Risk Management Strategy will reflect the proposed compliance approach and the monitoring and reporting of risks but consider it important that these are finalised and implemented in line with the revised timescale. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date. Risk: The absence of a fully documented corporate risk register, subject to regular monitoring and challenge may mean that key stakeholders may fail to fully understand the key risks the Council faces and in turn may consequently fail to take appropriate action to mitigate them. Recommendation: The Head of Audit and Risk should ensure that the replacement and/or new corporate risks detailed in the finding are documented, assessed and moved to ‘live’ status with a reasonable timescale. Category: Medium The corporate risks on Supply Chain and the Scottish Child Abuse Inquiry have been developed, agreed and are now ‘live’. The corporate risk in relation to the National Care Service proposals has been documented as much as can be based on current information available. This will continue to be developed as the national policy direction progresses and the current level of uncertainty reduces. Significant effort has gone into further developing and documenting the two remaining corporate risks (Educational Outcomes and Target Operating Model). These are, however, both in draft format and require further discussion and development with the relevant Risk Leads before being agreed and finalised. Original timescale: September 2022 Revised timescale: December 2022 Further revised timescale: March 2023 Whilst we acknowledge that there has been significant action taken to address the recommendations made, it is important the two remaining risks are finalised and moved to ‘live’ status at an early opportunity. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 7
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Business and Digital Digital NL (November 2021) Risk: Benefits and savings may not be being adequately tracked and monitored resulting in the Council being unable to demonstrate the achievement of the objectives of the programme. Recommendation: Management should ensure that the non-financial benefits tracker is finalised and approved with non-financial benefits thereafter identified, calculated, tracked and monitored for all workstreams. Category: Medium The non-financial benefits tracker templates for each of those sprints already live have been created and populated. Tracker templates for the Year 4 Roadmap have been created and will be populated with the Benefits Map detail for each sprint as that work progresses. From a governance perspective, consideration of the non-financial benefits tracker will focus heavily at the Project and Delivery Board meetings. Original timescale: April 2022 Revised timescale: September 2022 Further revised timescale: March 2023 Whilst we acknowledge that there has been some action taken in this area, we consider that it is important going forward that non-financial benefits are identified and captured in a timely and consistent manner for those sprints not yet underway/at an early stage. We have assessed the residual risk as ‘High’ as the recommendation has not yet been fully addressed by management and consider it important that the revised timescale is adhered to. In response to the Panel’s request following consideration of an update on progress against this recommendation at the November meeting, a separate report is included on the agenda from the Service regarding this recommendation, progress made and further proposed actions.
Page 8
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Business and Digital Governance of Capital Projects (December 2019) Risk: If Services are aware of the projects which will be reviewed, they are more likely to follow the guidance for those projects and the results of any such reviews may not provide a true representation of the extent of compliance with expected arrangements, including use of the relevant guidance and control template documents. Recommendation: Management should review the ‘project management model review programme’, particularly in relation to: • expanding the sample of projects being reviewed to incorporate some capital and non-capital projects that Services have not received advance notification; and • reviewing and updating the checklist to include consideration of the adequacy and effectiveness of the completed control document templates, determination of whether established processes have been documented and confirmation that key stakeholders have been adequately updated on the progress of the project, in line with the suggested improvements at Appendix 3. Category: Medium Project Registers have now been received from all Heads of Service and a quality assurance review process is being established to support the Project Management Framework. The quality assurance review programme, and the timings of each review to be undertaken, is informed by the Project Registers which each Chief Officer is required to maintain. Recently revised governance arrangements will now require the Programme/Project Boards to provide regular updates to CMT. A report is being submitted to CMT in early 2023 which will take into consideration the governance, oversight, monitoring and quality assurance processes that support the work of Programme/Project Boards in delivering on the wide range of programmes and projects set out in the Project Registers. Original timescale: June 2020 Revised timescale: September 2022 Further revised timescale: June 2023 Given that further action is required to progress arrangements for monitoring compliance with the refreshed project management framework, we have assessed the residual risk as ‘Medium’ and consider it appropriate that more detailed plans and timescales are identified by management at an early stage In response to the Panel’s request following consideration of an update on progress against this recommendation at the November meeting, a separate report is included on the agenda from the Service regarding this recommendation, progress made and further proposed actions.
Page 9
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Business and Digital Managing Strategic Change (June 2021) Risk: Key stakeholders may not be adequately informed of progress in the Council’s key corporate projects and may not be able to undertake effective oversight and/or ensure that timely remedial action, necessary to ensure that projects are delivered successfully, has been progressed by relevant management. Recommendation: Management should progress the previously identified action of establishing a reporting mechanism which better facilitates regular and ongoing oversight by key stakeholders of the progress of key projects against plan, including management of key risks, progress against timelines, cost against budget, achievement or otherwise of key milestones and expected outcomes or benefits realisation. We suggest that this could include introducing a standard reporting template and adopting a traffic light system to report progress against key criteria, project milestones and overall deliverability against expected time, cost and any other intended outcomes. Category: Medium The consultative draft of the Project Management Framework was approved at CMT in September 2022. It was thereafter updated in November 2022 to include reference to the reporting requirements for all stakeholders. The final Framework and supporting documentation were then uploaded to the Council’s intranet and an NLC announcement issued to staff to notify them of this. Original timescale: September 2021 Revised timescale: September 2022 Further revised timescale: To be determined by management The Service consider this action to be complete as the project management framework has now been updated and uploaded to the Council’s intranet. However, while we acknowledge that the Project Management Framework has been revised and approved, we consider that the narrative within the Framework, whilst referencing the need to report to all key stakeholders, does not fully address the recommendation which required that there be a mechanism to facilitate regular and ongoing oversight by key stakeholders of the progress of key projects against the plan. We have assessed the residual risk as ‘High’ as the recommendation has not yet been fully addressed by management and consider it important that a realistic revised timescale is determined and adhered to. In response to the Panel’s request following consideration of an update on progress against this recommendation at the November meeting, a separate report is included on the agenda from the Service regarding this recommendation, progress made and further proposed actions.
Page 10
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Business and Digital Performance Management (October 2022) Risk: It may be difficult to clearly demonstrate progress, improvement or achievement of the Council’s ambition statements and programme of work items, which could result in the Council failing to meet its obligations in relation to best value, good governance and public performance reporting. Recommendation: The Head of Business and Digital, in conjunction with all Services, should: (1) as part of the refresh of the SPF, ensure that consideration is given to all level 2 and 3 indicators to determine whether improvements in these performance indicators provide meaningful information in respect of progressing/achieving the ambition statements and programme of work items that they are linked to. This review should include the removal of any indicators which are not directly linked to planned outcomes and the identification of new indicators to assist with the monitoring of progress of ambition statements and key programme of work items; (2) consider preparing a document (or adding to existing documentation such as the SPF) which clearly indicates the Chief Officer responsible for each performance indicator; and (3) identify a suite of key performance indicators/reporting mechanism(s) that would facilitate effective scrutiny and challenge by CMT and elected members. Category: Medium The review and refresh of the Strategic Performance Framework is underway and is awaiting the outcome of the Programme of Work Development Group to ascertain items to be included in the 2023 to 2028 Programme of Work and identify any performance related requirements therein. The list of Calculating Officers and Verification Officers clearly show the corresponding service for each indicator in the Framework. A report submitted to CMT in December 2022 outlined the Performance Reporting Schedule for 2023 to 2024, which will facilitate scrutiny and challenge by CMT and elected members. Once formally approved, the Strategic Performance Framework document will be finalised accordingly. Original timescale: December 2022 Revised timescale: March 2023 We acknowledge that work in this area to review and refresh of the Strategic Performance Framework has been ongoing, however further action is required to fully develop and thereafter implement the Strategic Performance Framework, and we have assessed the residual risk as ‘Low’. We consider it important that the agreed extension date of March 2023 is achieved. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 11
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of Legal and Democratic Corporate Governance Principles E, F & G (March 2021) Risk: The Council may not be able to adequately demonstrate that it has effective audit committee arrangements and/or arrangements to ensure elected members have the skills, knowledge and, where appropriate or required, access to relevant training and resources to effectively undertake their role. Recommendation: The Head of Legal and Democratic Solutions should: (1) in conjunction with the Audit and Risk Manager, seek to introduce a formal process whereby the Audit and Scrutiny Panel periodically undertakes a self- assessment of their performance and activities against the ‘CIPFA’s Audit Committees: Practical Guidance for Local Authorities and Police (2018)’, with a report outlining the results of this review including any improvement actions being presented to the Panel and reported to the Policy and Strategy Committee. (2) In conjunction with the Business Strategy Manager, seek to introduce a formal process whereby the Audit and Scrutiny Panel periodically undertakes a separate self- assessment of the effectiveness of the performance and activities of the Panel in discharging the Scrutiny aspect of its role. Category: Medium The Strategic Self-Evaluation Review Programme has been updated to reflect this self-valuation exercise and a report was approved by the Audit and Scrutiny which re-establishes the role of the scrutiny work programme in the Panel’s activities. Membership of the Audit and Scrutiny Panel changed significantly following the Local Government elections in May 2022. However, following this there have only been two meetings of the Panel which is not considered enough time to for arrangements and the new Panel to be embedded. Original timescale: September 2021 Revised timescale: December 2022 Further revised timescale: September 2023 We acknowledge that delivery of this action has been delayed allowing for the significant changes to the membership of the Audit & Scrutiny Panel following the Local Government elections in May 2022 to be embedded. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 12
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of People Resources Information Governance/ Security (February 2021) Risk: Staff may not understand that responsibilities for information governance and security which could result in significant additional financial and reputational costs in the event of any information breach. The ICO has historically been particularly critical of organisations who suffer breaches and who cannot demonstrate that they have effectively identified and addressed staff training needs. Recommendation: The Head of People and Organisational Development, in conjunction with the Head of Business Solutions, should progress the creation of a less intensive training for staff/roles who are not required to undertake the mandatory training modules. Category: High Following a successful recruitment campaign, additional staff have now joined the team and this action is now being taken forward. A learning resource is being created which will cover all areas required for information security at this level and this will be rolled out throughout Quarter 4 to all staff. Line managers will be trained to deliver the training within team meetings/toolbox talks to roll out the learning. The learning will then be recorded on LearnNL and reported to the Data Governance Group on a quarterly basis along with other mandatory learning statistics. Original timescale: August 2021 Revised timescale: December 2022 Further revised timescale: March 2023 We acknowledge that delivery of this action has been delayed due to a turnover of staff with the Team. Whilst we are satisfied that appropriate steps have been taken to recruit an officer, it is imperative that this issue be resolved in line with the revised timescale. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 13
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of People Resources Corporate Governance Principles A & B (February 2022) Risk: Where individuals are not fully aware of expected codes of conduct, ethical standards, and legal obligations they may not be in a position to adhere to or embed these consistently, or to identify and/or challenge unacceptable actions or behaviours of other staff where they occur. The Council may not be able to adequately demonstrate that it has effective arrangements to ensure elected members have access to training and development opportunities to equip them with the necessary skills and experience to perform their role effectively Recommendation: The Head of People and Organisational Development, in conjunction with relevant management, should: (1) ensure that all staff are periodically/regularly made aware/reminded of the revised Employee Code of Conduct and the need to adhere to it; (2) progress plans to introduce mandatory training on the revised Code and ensure that uptake for both the Induction and Code of Conduct training is being actively monitored; and (3) undertake the planned review of the elected members site within Learn NL and consider the scope for introducing mandatory or highly recommended courses and encouraging the uptake of relevant training courses Category: Medium (1) Complete - The Council's Code of Conduct has been re-communicated to all staff with all-user emails and campaigns on Connect after each revision. Regular/periodic reminders will be issued to all staff to ensure that they are reminded of the Code and the need to adhere to it. (2) The mandatory training on the Employee Code of Conduct is being progressed and this will be launched in 2023. (3) Complete - A review of the Elected Members site within LearnNL has been completed and a number of training modules designated as mandatory. Some training sessions are now recorded to enable Elected Members to access them later, as required. Original timescale: December 2022 Revised timescale: March 2023 Whilst we acknowledge that there has ben significant action taken to address the recommendations made, it is important that the mandatory training is finalised and launched in line with the proposed timescale. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 14
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of People Resources Corporate Governance Principles A & B (February 2022) Risk: Without effective workforce planning there is a risk the Council may not have in place (or identified the actions it needs to progress to ensure it has in place) the staff and skills it needs to enable it to deliver services and achieve planned outcomes Recommendation: The Head of People and Organisational Development should ensure that the service workforce plans are completed and reported in accordance with the revised timescales to inform future workforce planning activity. Category: Medium Work was underway to complete workforce plans within each service. However, a request was submitted to, and approved by CMT, in December 2022 to extend the deadline for completion into 2023 thus allowing more time for consideration of any significant workforce/training impacts, including service cessation, which may arise from the Council’s 3-year budget setting process. A summary report is thereafter scheduled to be presented to the Policy and Strategy Committee in Cycle 2. Original timescale: June 2022 Revised timescale: December 2022 Further revised timescale: June 2023 We acknowledge that an extension to the proposed timescale was granted by CMT to allow for consideration of the impact of the Council’s 3-year budget on Services’ workforce plans. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date ESC: Testing of Selected Key Controls (March 2022) Risk: Failure to apply conditions of service appropriately could lead to inconsistency and/or errors in payments made to employees across the Council. Recommendation: The Head of People and Organisational Development should ensure that HR Business Partners, in conjunction with service management, review how non-core hours have been calculated for all relevant employees in receipt of a standing non-core hours payment each pay period to ensure that these are accurate and consistent with the employee’s work pattern/rota and Schedule A. Category: Medium There has, to date, been no change in the position. The service has identified that all relevant parties need to engage in a discussion to ensure that a consistent approach is agreed and thereafter implemented for the new financial year. Any changes to non-core hour procedures will need to be discussed and agreed with the Trade Unions. Original timescale: December 2022 Revised timescale: March 2023 We acknowledge that delay in implementing this action is due to competing priorities and the need to discuss any changes to the processes with the Trade Unions. Following discussion with service representatives, a clear commitment has been given to implement the recommendation by the agreed extension date and as such we have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 15
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer of People Resources Supporting Attendance (August 2022) Risk: There would be no record of the key absence issues and/ or any proposed actions to be taken to address these issues having been discussed Management may not be able to take appropriate action to address key issues. Without formal documented processes outlining how performance information should be prepared, staff may not be aware of how to calculate the performance measures which may result in inaccurate performance data being reported to key stakeholders. Recommendation: People and Organisation Development should ensure that monthly performance information on sickness absence is reported as standard across all Services at SMT meetings, any key issues in relation to absences are discussed with senior management at these meetings and that appropriate documentation is maintained to support the effective monitoring of any management actions identified and/or taken to address these issues. Category: Medium High-level monthly performance information on sickness absence is provided to HR Business Partner teams by Employee Relation for them to cascade this information to Services to enable discussion at the Services’ SMT meetings. A working group is being established to develop an action plan to ensure that there is a consistent approach to the cascading of information and that appropriate actions are developed by each Service. Original timescale: December 2022 Revised timescale: September 2023 We acknowledge that some action has been taken to address the first part of the recommendation and that the delay in implementing the second part of the recommendation is due to competing priorities and resource issues within the POD teams. As a result of the above, we have assessed the residual risk for this recommendation as ‘Low’ and would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 16
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Supporting Attendance (August 2022) Risk: Without a formal review of the Policy it would be difficult to determine if the new policy is effective. Without a formal action plan, it would be difficult to monitor and track identified improvement actions and the progress and resultant impact of those actions. Management may not be able to take appropriate action to address issues identified. Management may lack assurance on the extent to which key expectations/requirements contained the policy are being complied with. Recommendation: People and Organisation Development should: (1) undertake a formal review of the effectiveness and impact of the new Supporting Attendance Policy; (2) capture any agreed improvement actions for sickness absence in a corporate action plan, progress against which is then tracked and monitored; and (3) undertake periodic compliance reviews on a sample of services and/or service areas and/or individual absence cases to determine the extent to which the revised Supporting Attendance policy is being implemented across the Council in line with corporate expectations. Category: Medium (1) Meetings have been held with the Trade Unions with a view to reviewing the Supporting Attendance Policy. The Service are awaiting a response from the Trade Unions on proposed minor changes to the supporting toolkits. (2) An action plan will be developed once discussions with the Trade Unions have concluded. (3) Periodic compliance reviews will form part of the action plan referred to at point (2) above. The extent of these reviews is still to be determined. Original timescale: December 2022 Revised timescale: September 2023 We acknowledge that delay in implementing this action is due to competing priorities and resource issues within the POD teams. In addition, points (2) and (3) cannot be progressed until discussions are concluded with the Trade Unions. Given that limited action has been taken to date to address the recommendation and improve the control environment we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of September 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow-up report.
Page 17
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Social Work Officer Tackling Poverty (November 2021) Risk: Without accurate baseline data, the Council may not be able to review progress and/or predict with any accuracy whether it is on track/can achieve the Scottish Government’s statutory poverty targets and/or whether the identified actions are reasonable and appropriate. Without clear and realistic short, medium and long- term targets, the tackling poverty programme may not be able to achieve its objectives. Without effective performance management framework and formal benefits realisation processes, management may not be able to assess whether the tackling poverty programme is effective and/or may not be able to take appropriate action to address areas of ‘under-performance’ and/or properly assess and/or compare impact of different actions/interventions. Recommendation: Management should: (1) establish what information requires to be collated in respect of measuring the Scottish Government’s poverty targets and identify and progress any actions necessary to ensure that the Council can generate and/or gather the relevant data within expected timescales; (2) develop and implement more robust performance monitoring and benefits realisation frameworks that will allow management to better measure performance against the Council’s Tackling Poverty objectives and the Scottish Government targets; and (3) use the revised performance monitoring and benefits realisation frameworks to facilitate more robust setting of short and medium-term targets and to assist in the evaluation of impacts of different actions. Category: High Performance in respect of some elements of the Tackling Poverty programme is being monitored (for example income maximisation), however the Service is still working to establish a performance framework. This has been hampered by the limited guidance and detail provided by the Scottish Government in respect of setting targets and baselines and this applies to all local authorities. A Data Sub-Group, consisting of officers from the Council, North Lanarkshire Council, Third Sector and other Community Planning Partners has recently been established as part of the governance arrangements for Tackling Poverty. This Sub-Group will be tasked with: • overseeing the data collection to support the Tackling Poverty Strategy and Local Child Poverty Action Report (LCPAR) • collating, and thereafter interpreting and analysing, the data and pinpointing the location of vulnerable residents to allow resources to be targeted appropriately; and • developing methods to measure the data/activity of the Tackling Poverty Strategy action plan, including the LCPAR, to allow the reporting of outcomes and tracking of targets set by the action plans and the Scottish Government targets for child poverty. Original timescale: November 2022 Revised timescale: November 2023 Whilst we acknowledge that, there has been some action taken in this area, it has been recognised by the Scottish Government that establishing a baseline and tracking progress on meeting the targets for child poverty is a complex matter and will take time to establish a model that will allow outcomes/measures to be more effectively monitored, measured and delivered. Given that significant action is required to improve the control environment and implement the recommendations, we assess the residual risk as ‘Medium’ and consider it important that the agreed extension date of November 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made and the revised completion date and to monitor progress being made as part of the next follow-up report.
Page 18
Appendix 2 Residual risk rating definition Internal Audit assessment of residual risk from non-implementation High Non-implementation of actions has the potential to significantly undermine the relevant control environment. Medium Non-implementation of actions has the potential to impact upon the achievement of the control environment. Low Other issues which require management attention but which pose less significant or less immediate impacts to the control environment.