Internal Audit Annual Plan 2023-24
North Lanarkshire Council · 18 May 2023
Back to Audit and Scrutiny Panel — 18 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☒ Yes ☐ No Ref KA/ASP/May23 Date 18/05/23 Internal Audit Annual Plan 2023-24 From: Ken Adamson, Chief Officer (Audit and Risk) E-mail: adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to present the proposed Internal Audit Plan 2023-24 to members of the Audit and Scrutiny Panel for their consideration and approval. Although senior management is consulted in the development of the plan, the Chief Officer (Audit and Risk) is solely responsible for determining the content of Internal Audit’s plans. The work proposed for 2023-24 has been discussed with, and endorsed by CMT, but responsibility for the approval of the plan lies solely with the Audit and Scrutiny Panel. The report sets out the background and context within which the internal audit planning process is undertaken and provides a high-level overview of how it is proposed Internal Audit resources will be allocated in 2023-24. The Plan follows a well-established planning methodology which is designed to ensure cyclical internal audit coverage of key corporate risks, key corporate priorities and projects (as outlined in the recently approved Programme of Work to 2028), key governance arrangements and key financial systems. Members are asked to consider whether they are content that this represents an appropriate programme of work for Internal Audit to undertake in 2023-24 and/or whether there are any items in the draft Plan that they do not consider appropriate for inclusion and/or whether there are any additional items they would wish to suggest for possible inclusion. Recommendations The Panel is invited to: (1) note the approach adopted to produce the 2023-24 Internal Audit Annual Plan; (2) consider the detailed list of proposed Internal Audit assignments for the 2023-24 Plan (at Appendix 1); and (3) subject to any changes agreed by the Chief Officer (Audit and Risk) arising from discussions with the Panel during consideration of the proposed assignments at (b) above, approve the proposed 2023-24 Internal Audit Annual Plan (at Appendix 1). The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 The Audit and Scrutiny Panel is required annually to consider and approve the Internal Audit Annual Plan for the coming financial year. 1.2 Responsibility for the production and execution of the audit plan and subsequent audit activities rests with the Council’s Chief Officer (Audit and Risk) (who fulfills the role of the ‘Chief Audit Executive’ as defined by the Public Sector Internal Audit Standards). Although senior management is consulted in the development of the plan, in line with relevant professional standards, the Chief Officer (Audit and Risk) is solely responsible for determining the content of Internal Audit’s plans. 1.3 This report sets out the background and context within which the Internal Audit planning process is undertaken and provides a high-level overview of how Internal Audit resources will be allocated in 2023-24. 1.4 In line with best professional practice, the draft plan has been discussed with the Council’s Corporate Management Team before it is presented to the Panel for consideration and approval. The main objectives of the Council’s Internal Audit service are outlined in the Internal Audit Strategy which was approved by the Panel in June 2019. 1.5 Internal Audit activity is governed by policies, procedures, rules, and regulations established by the Council including the Council’s Financial Regulations and Internal Audit Charter which is approved by the Panel, the Council’s s95 officer and the Chief Executive. The Internal Audit service is expected to comply with the standards laid down by the Public Sector Internal Audit Standards (PSIAS). 1.6 The planned work of the Internal Audit service is outlined in the Internal Audit Annual Plan, which is submitted to, and approved by, the Panel annually. Any proposed programme of work must be appropriate and sufficient to support the preparation of an opinion by the Chief Officer (Audit and Risk) on the overall soundness of the Council’s corporate governance, risk management and internal control systems. 2. Report 2.1 Internal Audit is an independent and objective assurance function whose work is designed to evaluate and improve the effectiveness of the Council’s risk management, control and governance processes. The service aims to provide a high quality and customer-focused internal audit service, which is responsive and flexible, consistent with best professional practice, aims to focus on areas that matter, to use resources efficiently and effectively and to be seen by stakeholders as adding value, providing valuable insights and making a vibrant and relevant positive contribution to the Council’s activities. The wider audit environment 2.2 The Council’s strategic-level plan (‘The Plan for North Lanarkshire’) and its associated ‘Programme of Work to 2028, most recently approved by the Policy and Strategy Committee in March 2023, sets out the Council’s strategic-ambitions and those key activities designed to deliver against them. These ambitions and the associated programmes and projects represent a bold and challenging approach to addressing the issues facing the Council and the people and communities of North Lanarkshire. 2.3 The Council also continues to seek to achieve its ambitions against a backdrop of significant financial pressures, increasing demands for many key services and ever- changing expectations about how services will be delivered. The Council also needs to respond to the impacts on it and its communities of a range of Scottish and UK Government policies. There also continue to be significant changes in governance structures and processes across the Council. Finally, ongoing events including the cost- of-living crisis, the performance of the UK and Scottish economies and the war in Ukraine as well as posing immediate challenges to which the Council is responding, also create considerable additional longer-term risks and uncertainties.
Page 3
2.4 Internal Audit has an unusual role within the Council. While part of the organisation, it is operationally independent which provides a core basis for its work and the ongoing independence and objectivity which is an important element in ensuring that it can effectively meet stakeholders’ needs and expectations. It seeks to provide assurance and an annual audit opinion on the adequacy and effectiveness of the Council’s risk management, internal controls and governance arrangements, while helping to secure wider improvements, ensuring best value and assisting the Council in delivering against its corporate ambitions. Planning considerations 2.5 Internal Audit will meet this objective by operating in accordance with the Public Sector Internal Audit Standards (PSIAS) and the associated CIPFA Local Government Application Note (LGAN) which will enable the section to fulfil the roles and responsibilities given to it by the Council as laid out in the Internal Audit Charter. 2.6 Internal Audit will do this by undertaking a risk-based work programme focused on cyclical coverage of the Council’s core corporate governance processes, key corporate risks, significant programme of work activities and key financial systems. In doing so, elected members and senior management will be supported in undertaking their roles by Internal Audit providing assurance on the management of key strategic risks and priorities which could impact on the achievement of the Council’s objectives. 2.7 The Internal Audit Annual Plan for 2023-24 (at Appendix 1) has been prepared in accordance with well-established planning methodology which includes consideration of a wide range of factors including the relative scale, significance and complexity of systems, previous experience of the control environment, proposed or known changes in the environment within which the Council operates, the potential financial, operational and reputational consequences of any significant failures in relevant internal controls and the possible impact of any failures on the achievement of the Council’s objectives, priorities and ambitions. Consideration is also taken of the extent and quality of assurance available from other sources with reliance placed upon alternative sources of assurance where it is appropriate to do so (such as external regulators and selected high-quality relevant internal sources). 2.8 The Council’s risk management arrangements continue to improve, and we have incorporated management’s assessment of the risks facing the Council into our planning processes but remain of the view that these arrangements are not yet sufficiently mature to enable me to fully align our audit planning with them, although the extent of alignment continues to increase each year. Careful consideration has been given, however, in preparing the plan to the key corporate risks identified by senior management and we expect to align our planning more closely with the corporate risk management processes each year as these risk management arrangements become more mature. 2.9 Internal Audit will continue to work closely with the Council’s external auditors to ensure that all audit activities are properly coordinated to minimise any duplication of work and that the Council’s external auditors are able to place reliance on our work, where they wish to do so. 2.10 As part of planning considerations, I have considered the level of resources and the experience and skills available to Internal Audit. The section’s staffing complement for 2023-24 remains unchanged from the prior year and I remain satisfied that the resources available are adequate for the function to carry out its role effectively. This assessment is based on the level of available resources enabling adequate coverage of core corporate governance processes, key corporate risks, programme of work items and key financial systems over a rolling three-year period.
Page 4
2.11 A formal review of staffing within the function has not been undertaken for some time and the Panel may also wish to note that a full review of the staffing structure within Audit and Risk is planned for Summer 2023, with a view to ensuring that the staffing structure continues to be ‘fit for purpose’ and reflects current and likely future demands placed on the Service by changes in the auditing landscape. 2.12 As previously outlined to the Panel, I continue to review the Section’s ability to deliver the range of ICT audit work necessary and will bring forward to the Panel detailed proposals if I consider additional specialist resources may be required to supplement the work of the core team. 2.13 I am also content that the Chief Executive and Chief Officer (Finance) have previously indicated that additional resource can be made available to Internal Audit in the event of any significant unexpected demands (such as for example, the need to undertake any major unplanned investigations). 2.14 If any concerns relating to resources arise during the year which might be seen as impacting on this assessment, these will be discussed initially with the Convener and, if necessary, highlighted at the next Panel meeting. 2.15 I can also confirm the continuing independence of the Internal Audit service and its ability to act in accordance with best professional practice free from undue interference by management and/or senior elected members. I have no concerns over the role and/or status of the function and I am satisfied that the Chief Officer (Audit and Risk) post has sufficient status within the organisation, being a member of the Corporate Management Team and reporting directly to the Chief Executive. 2.16 If any such matters arise during the year which might be seen as compromising Internal Audit’s independence or ability to discharge its role, these will be discussed with the Convener and if necessary, highlighted at the following Panel meeting. 2.17 The Panel are aware, I also have management responsibility for the Council’s risk management team. This creates a potential conflict of interest which could be seen as compromising my independence when Internal Audit is reviewing the Council’s risk management arrangements, but I have previously outlined to the Panel that I consider that this risk can be effectively managed and appropriate arrangements to ensure the Panel can have confidence in the independence and robustness of future Internal Audit reviews of the risk management function were set out in the Internal Audit Charter approved by the Panel in September 2021. Reporting the audit 2.18 Internal Audit will report regularly on the results of its work in line with the reporting protocol approved by the Panel in September 2021. Each individual Internal Audit report will be issued to the relevant Chief Officer and copied to the Chief Executive and Depute Chief Executive. Reports on the work of Internal Audit will also be presented regularly during the year to the Council’s Business and Corporate Management Teams. 2.19 The Internal Audit service will continue to report progress against the plan during 2023-24 to the Audit and Scrutiny Panel. In line with the Internal Audit reporting protocol agreed by the Panel in September 2021 full copies of all substantive audit reports will normally be made available to the Panel and progress reports will include the high-level reporting of all audit outputs included in the approved plan together with more detailed consideration of all significant matters arising from those reports that the Chief Officer (Audit and Risk) considers necessary to bring to the attention of the Panel. 2.20 An annual report prepared by the Chief Officer (Audit and Risk) on the adequacy and effectiveness of the Council’s internal controls will also be presented to the Panel and the Chief Executive. The opinion in relation to 2023-24 will be included in my Annual Report for that year which will be presented to the Panel in June 2024.
Page 5
2.21 A performance management framework for Internal Audit was approved by the Panel in March 2021. This sets out what information will be recorded and presented, to whom and with what frequency. As part of this framework, and in response to improvement actions agreed in response to our external review, this includes greater formality around seeking stakeholder feedback on Internal Audit performance from both senior management and elected members. Main areas of the 2023-24 Annual Plan 2.22 The proposed programme of Internal Audit activity is detailed at Appendix 1. There are several major categories of work within the Annual Plan. These include: • Work on core governance matters including the Council’s wider corporate governance, risk management and performance management arrangements. In 2023-24 this will include work associated with on the Council’s compliance with corporate governance principles, on the Council’s risk management arrangements and work assessing the adequacy and robustness of reported performance data. • Work examining a sample of key strategic/corporate risks, key programmes of work and/or service risks as part of regular cyclical audit coverage. In 2023- 24, this will include work on the Enterprise Project, the Council’s approach to asset management, reviewing progress in respect of business continuity arrangements and examining the Council’s approach to meeting the challenges of climate change and net zero. • Work examining the Council’s finances and key financial systems including, as part of regular cyclical audit coverage, work on payroll, council tax, general ledger and treasury management. • A range of follow-up work to ensure that previously agreed management actions in respect of both internal and external audit recommendations are being implemented by management. In addition to detailed follow-up work on specific audit reviews, we will also provide quarterly updates in respect of management implementation of actions agreed in response to ‘Red’ and ‘Amber’ audit recommendations; and 2.23 We will also continue to contribute to a wide range of corporate working groups and Project Boards and to provide internal audit services to the North Lanarkshire Health and Social Care Integrated Joint Board. 2.24 In line with good practice, the plan will be reviewed on a regular basis and may be adjusted where necessary in response to changes in the Council’s business, risks, operations, programmes, systems and controls. Any material changes and the rationale for such changes will be reported to the Panel. 3 Measures of success 3.1 Provision of independent assurance in accordance with Public Sector Internal Audit Standards. 3.2 Satisfactory assessment of the work of Internal Audit by the Council’s appointed auditors. 3.3 Positive assessment of the work of Internal Audit by key stakeholders including senior management and members of the Audit and Scrutiny Panel.
Page 6
4. Supporting Documents Appendix 1 Proposed Internal Audit Plan 2023-24 Appendix 2 Internal Audit coverage of current key corporate risks over the last 5 years Appendix 3 Internal Audit coverage of key financial systems over the last 5 years Appendix 4 Consideration of Internal Audit activity (previous and planned) against the Programme of Work to 2028 Appendix 5 Internal Audit performance framework Ken Adamson Chief Officer (Audit and Risk)
Page 7
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi- Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ Internal Audit forms part of the control framework for the management of several corporate risks relating to corporate governance issues and these are documented in the relevant corporate risk ‘deep dive’ documents which are subject to periodic review by relevant management. Operational risks for the Service itself are documented in the Service’s risk register and are regularly reviewed by the Chief Officer (Audit and Risk) and the service management team. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex-Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒
Page 8
Appendix 1 Proposed Internal Audit Plan 2023-2024 Topic Days Rationale and proposed scope Corporate governance Risk management 30 Core corporate governance process. Follow-up of work undertaken in 2021-22 to review the adequacy and effectiveness of the Council's risk management arrangements with a particular focus on risk management arrangements within Services. Corporate governance 20 Core corporate governance process. Work will review the adequacy and effectiveness of the Council's corporate governance arrangements and how the Council assesses compliance with the relevant Code. The review will also follow-up previous recommendation and consider the ongoing adequacy and effectiveness of the Council’s strategic governance and self-evaluation frameworks including how management gains assurance on compliance and performance. Performance management 70 Core corporate governance process. Follow-up of work undertaken in 2021-22 to review the adequacy and effectiveness of the Council's strategic performance framework. A particular focus will be on arrangements rolled-out in 2022-23 for monitoring and reporting on performance to key stakeholders (including Service committees) and reviewing the accuracy and robustness of reported performance data. Key strategic / corporate risks Workforce planning 40 Carried forward from 2022-23, work will focus on providing assurance on the adequacy and effectiveness of the Council’s approach to workforce planning including the extent to which plans appear comprehensive and planned actions are being satisfactorily progressed. Enterprise Project 30 Depending on the outcome of work currently underway, we would expect to provide assurance on the adequacy and effectiveness of management processes and arrangements surrounding the Enterprise Project. Managing strategic change 30 Work will focus on providing assurance on the adequacy and effectiveness of the Council’s recently revised governance arrangements including those being implemented to oversee delivery of the Programme of Work to 2028. Climate change 30 Key corporate risk. Carried forward from 2022-23, work will focus on providing an assessment of the adequacy and effectiveness of the Council’s arrangements. This is expected to include reviewing how well the Council is developing/progressing realistic plans against relevant local and national commitments and statutory obligations.
Page 9
Appendix 1 Proposed Internal Audit Plan 2023-2024 (continued) Topic Days Rationale and proposed scope Key strategic / corporate risks / programmes of work (continued) ICT operational capability 40 Work will focus on the adequacy and robustness of ICT governance arrangements including how the Service manages relevant key risks. Follow-up: Business continuity planning 30 Work will focus on reviewing the effectiveness and impacts of actions taken by management in response to previous audit findings. Future operating model 30 Carried forward from 2022-23, work will focus on providing assurance that the Council’s future operating model is being managed and implemented in an efficient and effective manner. This will include consideration of any impacts on asset rationalisation and the implementation of hybrid working arrangements. Service / operational/ Programmes of work Housing Asset Management Plan 40 Work will be focused on providing assurance that the Council has adequate and effective asset management arrangements in respect of its own housing stock. Clyde Valley Waste Partnership 20 Assurance work required every two years in line with Inter-Authority Operating Agreement. City Deal 20 Assurance work required annually in line with Glasgow City Region assurance framework. Housing Capital Programme 40 Work will be focused on providing assurance on the adequacy and effectiveness of the Council’s arrangements for effective procurement, contract management and performance monitoring arrangements in relation to the housing capital programme. Social Work quality assurance arrangements 40 Work will be designed to provide assurance on the adequacy and effectiveness of the Council’s quality assurance arrangements in relation to the provision of social work and social care services.
Page 10
Appendix 1 Proposed Internal Audit Plan 2023-2024 (continued) Topic Days Rationale and proposed scope Financial management and key financial systems Payroll – selected controls 40 Work will focus on assessing the adequacy and effectiveness of arrangements designed to prevent and detect errors and/or regularity issues associated with the Council’s payroll operations. Regularity work - financial systems - Payroll 40 Substantive testing of selected key controls associated with the authorisation, regularity and processing of payroll transactions. Regularity work - financial systems - Creditors 30 Substantive testing on selected key controls associated with authorisation, regularity and processing of creditor payments. Council Tax 40 Work will focus on assessing the adequacy and effectiveness of key controls associated with the billing and collection of Council Tax income. Treasury Management 30 Work will focus on assessing the adequacy and effectiveness of key controls associated with the operation of the Council’s treasury management function including compliance with the relevant CIPFA Code. General Ledger 30 Work will focus on assessing the adequacy and effectiveness of key controls associated with selected activities associated with the operation of the Council’s general ledger. Provision of IA services to third parties Integrated Health and Social care - North Lanarkshire JIB 30 Annual programme of work to be agreed with relevant senior management and NL JIB Performance, Finance and Audit Sub-Committee. Fraud and irregularity Review of the Council's Anti-Fraud arrangements 30 Work reviewing the current corporate anti-fraud policies and arrangements and implementing any identified actions necessary to ensure that the Council’s arrangements are more fully consistent with recognised good practice (this may include developing a Counter Fraud strategy and/or an annual Counter Fraud Action Plan which more clearly sets out planned actions for managing the risk of fraud and corruptions and any planned fraud prevention and/or pro-active detection work). National Fraud Initiative 30 Work co-ordinating and progressing the Council’s involvement with the NFI. Allowance for fraud and irregularity investigations 70 Demand-led allowance to enable investigations to be undertaken as required.
Page 11
Appendix 1 Proposed Internal Audit Plan 2023-2024 (continued) Topic Days Rationale and proposed scope Audit Committee and External Audit Liaison with external audit 5 To ensure the external audit process can proceed efficiently and effectively. Assisting external audit to undertake their role including co-ordinating management responses to assist with the finalisation of audit outputs. Facilitating the work of the Audit and Scrutiny Panel 30 To enable the Audit and Scrutiny Panel to fulfil its role. Preparation of agendas and reports and attendance at meetings. Follow-up of IA and EA recommendations 80 To enable the Audit and Scrutiny Panel to fulfil its role. To monitor and report on whether management has implemented actions agreed by senior management in response to audit reports. Follow-up: Audit Scotland/Accounts Commission national reports 10 To ensure national audit reports are given proper consideration by management and to enable the Audit and Scrutiny Panel to fulfil its role in considering such reports and the Council’s responses. Focusing on how the Council is responding to key issues highlighted in national audit outputs. Contribution to good governance Provision of ad hoc advice on systems development and control issues 30 To reflect the provision of input into systems development and ongoing ad hoc advice to management on specific control and risk issues. Participation in a range of Corporate Working Groups and Project Boards 50 To ensure that Internal Audit contributes, as appropriate, to corporate arrangements for the oversight and/or development of any relevant control, risk and governance issues. Other PSIAS self-assessment and Quality Assurance Programme 20 To ensure that the service provided is consistent with expectations. Continuous improvement activity to progress recommendations arising from the PSIAS EQAR and internal self-assessment. To enable necessary work to ensure on-going PSIAS compliance can be substantiated. Community Councils 15 Facilitating the audit of community councils and liaising with external auditor on issues arising. Contingency 60 To deal with additional unplanned work Total 1180
Page 12
Appendix 2 Internal Audit coverage of current key corporate risks Key Corporate Risk 2023-24 2022-23 2021-22 2020-21 2019-20 Comments (including date any relevant assignments reported to the Audit & Scrutiny Panel) 1. Information security and information governance NO √ - √ - No specific audit work planned in 2023-24. Previous audit work has provided sufficient recent assurance on this key risk. Previous reports: Cyber Security (February 2023) and Information Governance and Security (February 2021) 2. Information governance: data migration (new) NO - - - - No specific audit work planned in 2023-24. Specific risks arising from time-bound actions/project to rationalise how the Council holds its’ data. 3. Public protection NO - - √ - No specific audit work planned in 2023-24. Previous audit work has provided sufficient recent assurance on this key risk. Follow- up work will monitor implementation of agreed management actions. Previous reports: Public Protection (September 2021) 4. Managing strategic change YES - - √ √ This remains a significant key risk and continues to merit high-level review of relevant management arrangements on an annual basis given the scale of Council’s ambitions and the challenging environment in which it is operating. Previous reports: Managing Strategic Change (June 2021) and Managing Strategic Change (February 2020). 5. Health & Safety NO - - √ - No specific audit work planned in 2023-24. Previous audit work has provided sufficient recent assurance on this key risk. Previous reports: Health and Safety (May 2021) and Health and Safety (Management of Covid risks) (November 2020). 6. Business continuity planning YES - √ - - Audit work planned in 2023-24 will review the effectiveness and impacts of actions taken by management in response to previous audit findings. Previous reports: Business Continuity Planning (July 2022).
Page 13
Appendix 2 Internal Audit coverage of current key corporate risks (continued) Key Corporate Risk 2023-24 2022-23 2021-22 2020-21 2019-20 Comments (including date any relevant assignments reported to the Audit & Scrutiny Panel) 7. Financial sustainability NO - - √ - No specific audit work planned in 2023-24. Previous audit work has provided sufficient recent assurance on this key risk. This area is also being examined by external audit as part of their 2022-23 audit process. Separate and specific work proposed on individual financial systems is also shown below. Previous reports: Financial management (March 2021) and Financial sustainability (November 2020). 8. Human Resources YES - √ - - Work on workforce planning included in 2023-24 (carried forward from 2022-23). Recent audit work has provided sufficient recent assurance on other aspects of this key risk. Follow-up work will monitor implementation of any agreed management actions. Previous reports: Supporting attendance (August 2022). 9. Engagement and consultation NO - - √ √ No specific audit work planned in 2023-24. Previous audit work has provided sufficient assurance on some aspects of this key risk. Follow-up work will monitor implementation of any agreed management actions. Previous reports: Community engagement and empowerment (June 2020) and elements covered by work on Corporate Governance Principle B Openness and stakeholder engagement (February 2022). 10. Procurement risks YES - √ √ - No specific dedicated audit work planned in 2023-24 as previous audit work has provided sufficient assurance on tendering and contract award arrangements. Procurement aspects will however be included in planned work on the Housing Capital Programme. Previous reports: Contract management (May 2023), Procurement (November 2021) and Housing Investment Programme (June 2020). Assurance also obtained via work on Creditors (see below), work currently underway in relation to the Housing Investment Programme and through work on the Enterprise Contract (March 2021).
Page 14
Appendix 2 Internal Audit coverage of current key corporate risks (continued) Key Corporate Risk 2023-24 2022-23 2021-22 2020-21 2019-20 Comments (including date any relevant assignments reported to the Audit & Scrutiny Panel) 11. Enterprise Project YES - √ √ √ Although the nature of this project has been significantly revised, it remains a high-profile key risk which warrants coverage, the scope of audit work will be dependent on progress of the project. Previous reports: Enterprise Contract (May 2022), ESCP (March 2021) and ESCP (March 2020) 12. Climate change YES - - - √ Carried forward from 2022-23, work will be focusing on reviewing how well the Council is progressing realistic plans against relevant local and national commitments and statutory obligations. Previous reports: Carbon management (May 2020) 13. Serious organised crime, fraud and corruption YES - - √ √ Carried forward from 2022-23, work will review the adequacy and effectiveness of the Council’s anti-fraud arrangements and policy. A high-level review will also be kept on the SOC issue, through attendance at the relevant corporate working group and work underway corporately to assess the Council’s arrangements against recent Police Scotland guidance to LAs on this issue. Previous reports: Review of anti-fraud arrangements (May 2020) and NFI 2022 and 2020 exercises. 14. Terrorism NO - - - - No specific audit work is proposed but a high-level watch will be kept on the issue, through attendance at the relevant corporate working group, and commentary included, as appropriate, in IA progress reports and the IA Annual Report. Previous reports: None 15. Governance, Leadership and Decision-Making NO √ - √ √ No specific audit work is proposed on this risk in 2023-24 but planned work on corporate governance is expected to also cover many aspects which relate to this issue. Routine follow-up work will monitor implementation of any previously agreed management actions. Previous reports: Corporate Governance Principles C and D (May 2023), Corporate Governance (March 2021) Corporate Governance (March 2020) and Corporate Governance Principles A and B (February 2022).
Page 15
Appendix 2 Internal Audit coverage of current key corporate risks (continued) Key Corporate Risk 2023-24 2022-23 2021-22 2020-21 2019-20 Comments (including date any relevant assignments reported to the Audit & Governance/Scrutiny Panel) 16. ICT operational capability YES - - - √ Audit work planned in 2023-24 will address ICT governance arrangements including how the Service manages relevant key risks. Previous audit work has provided assurance on some aspects of this key risk. ICT operational capabilities and governance arrangements are also addressed via work on specific systems and by previous audit work on Digital NL. Previous reports: Digital NL (September 2021) and IT Network controls (September 2019) 17. Resilience planning NO - √ √ - See Business Continuity Planning (at 5 above). Previous reports: Business Continuity Planning (July 2022) and Covid-19 response (February 2021). 18. Digital and IT strategy NO - √ √ - No specific audit work is proposed. Recent Internal Audit work in this area has focused on providing ongoing assurance in relation to the implementation and governance of the approved DigitalNL transformation programme and the ongoing digitalisation of Council services and this focus will continue in 2022-23. Previous reports: Digital NL (November 2021 and October 2020) and Network controls (September 2019). 19. Tackling poverty NO √ √ - - No specific audit work is proposed. Routine follow-up work will monitor implementation of any previously agreed management actions. Previous reports: Cost of Living Crisis / Welfare payments (May 2023) and Tackling Poverty (November 2021) 20. Implementation of Economic Regeneration Development Plan NO - √ √ - No specific audit work is proposed. Recent audit work has provided sufficient recent assurance on this key risk. Follow-up work will monitor implementation of any agreed management actions. Previous reports: ERDP (June 2021).
Page 16
Appendix 2 Internal Audit coverage of current key corporate risks (continued) Key Corporate Risk 2023-24 2022-23 2021-22 2020-21 2019-20 Comments (including date any relevant assignments reported to the Audit & Governance/Scrutiny Panel) 21. Further developments: Impacts of integration of health and social care NO - - - - No specific audit work is proposed for 2023-24 pending further clarification of the detail and timing of the implementation of proposed legislation to create a National Care Service. Specific audit work is undertaken on behalf of, and reported to, the IJB. A range of audits examining operational Social Work activities are undertaken as part of the Council plan. Recent reports: Social Work Quality Assurance arrangement (expected Autumn 2023), Public protection (June 2021), Self-Directed Support (November 2020). 22. Supply chain risks (New) NO - - - - No specific audit work is proposed for 2023-24 but a watching brief will be kept as to how this risk develops and how well the Council is managing it. Recent reports: None, although aspects will have been addressed through work on creditors and contract management. 23. Educational attainment (New) NO √ - - - No specific audit work planned in 2023-24. Previous audit work has provided sufficient assurance on some aspects of this key risk. Recent reports: Education quality assurance arrangements (January 2023), additional aspects have also been addressed through previous audit work on Pupil Equity Funding (PEF) and Scottish Attainment Challenge Funding (SAC) (various). 24. Target operating model (New) YES - - - - Carried forward from prior year, specific audit work is proposed for 2023-24 examining how the Council’s is developing and managing planned activities under this heading. 25. Scottish Child Abuse Inquiry (New) NO - - - - No specific audit work planned in 2023-24. Risk staff working closely with relevant management to ensure risks associated with the Council’s engagement with this Inquiry are understood and are being managed appropriately.
Page 17
Appendix 3 Internal Audit coverage of key financial systems Key Financial Systems 2023-2024 2022-23 2021-22 2020-21 2019-20 Comments (including date any relevant assignments reported to the Audit & Governance/Scrutiny Panel) 1. General ledger YES - √ - Previous audit work has provided positive assurance but planned cyclical coverage will focus on key areas such as controls over journals, use of suspense accounts and other risk areas. Routine follow-up work will monitor implementation of any agreed management actions. Previous report: General ledger (November 2020) 2. Payroll YES √ √ √ √ Recent audit work has indicated some concerns over the robustness of the control environment, and this combined with the complexity and value of transactions requires regular audit coverage. Previous reports: Payroll – Overtime and T&S (April 2023), ESC selected controls (March 2022 and June 2021), Payroll – overtime (May 2020) and Payroll – selected key controls (November 2019). 3. Creditors YES √ √ √ √ Recent audit work indicates that the control environment is generally robust, but complexity and value of transactions requires regular audit coverage. Previous reports: Creditors (January 2023), Creditors (March 2022), Creditors selected key controls (February 2021, March 2020 and May 2019). 4. Council Tax YES - - √ - Previous audit work has provided positive assurance but planned cyclical coverage will focus on key aspects of the billing and collection of Council Tax income. Previous reports: Council Tax (November 2020). 5. Non- domestic rates NO - √ - - Previous audit work has provided positive assurance. Routine follow-up work will monitor implementation of any agreed management actions. Previous reports: Non-Domestic Rates (January 2022). 6. Housing Rents NO - √ - - Previous audit work has provided positive assurance. Routine follow-up work will monitor implementation of any agreed management actions. Previous reports: Housing Rents (October 2021 and November 2018).
Page 18
Appendix 3 Internal Audit coverage of key financial systems (continued) Key Financial Systems 2023-24 2022-23 2021-22 2020-21 2019-20 Comments (including date any relevant assignments reported to the Audit & Governance/Scrutiny Panel) 7. Treasury management YES - - √ - Previous audit work has provided positive assurance but planned cyclical coverage will focus on compliance with expected controls and relevant national guidance. Previous reports: Treasury management (December 2020) 8. Financial management NO - - √ - No work planned for 2023-24 as previous audit work and external inspections have provided positive assurance on this key risk area. This issue will also be examined by the Council’s external auditors in 2023 as part of their annual audit work. Previous reports: Financial management (February 2021) and Financial management (November 2020). 9. Housing Benefit NO √ - - √ No work planned for 2023-24 as previous audit work has provided positive assurance on this area and the control framework is relatively stable and transaction volumes are progressively lower due to Universal Credit. Previous reports: Housing Benefit and Council Tax Reduction (September 2022) and Housing Benefit (September 2019). 10. Cash/income collection NO √ - - √ No work planned for 2023-24 as previous audit work has provided positive assurance on this area. Previous reports: Income and cash collection - Cash offices (October 2022), Income and cash collection – Lesiure sites (January 2023) and Cash collection offices (August 2019). 11. Debtors NO √ - - √ No work planned for 2023-24 as recent audit work has provided assurance on this area. Management responses to previous audit findings will be tracked as part of routine follow-up work. Previous reports: Sundry Debt/Debt management (November 2022) and Debt management (December 2019)
Page 19
Appendix 4 Internal Audit coverage (recent and planned) of ‘Programme of Work to 2028’ strategic themes. 1. Transforming Places and Invest in North Lanarkshire Includes the following programmes, projects and activities: • City Deal • Economic Regeneration Delivery Plan activities • Housing New Supply Programme • Town Centre Visions • Cumbernauld Town Centre • Town and Community Hub Delivery • Towers Reprovisioning • Enterprise Project • Open Space strategy • Housing property repairs and maintenance activities • Business and inward investment support activity • Housing Asset Management Plan • Active Travel Strategy 2021-31 • Local Housing Strategy 2021-26 Recent audit coverage on activities relevant to this strategic theme has included work on ERDP (June 2021), City Deal ((May 2023 and required annually as part of GCR governance arrangements), New Supply (March 2020), Town and Community Hub Programme (November 2021) and Enterprise Project (June 2022). Internal Audit proposed coverage in 2023-24 will include the following: • City Deal • Housing capital programme • Enterprise Project • Housing Asset Management Plan 2. Sustainable Futures Includes the following programmes, projects and activities: • Climate Change/Climate Plan activities • Local Heat and Energy Efficiency Strategy • Vehicle replacement programme (decarbonisation of fleet) • Refuse collection and recycling. • Clyde Valley Waste Partnership • School transport • Corporate fleet maintenance • Strathclyde Country Park - Green Growth Accelerator • Eco Hub – Bellshill • Solar Farms - Auchinlea/Dalmacoulter Recent audit coverage on activities relevant to this strategic theme has included work on Carbon Management (May 2020), Waste and Fleet staffing issues (May 2023), Clyde Valley Waste Partnership (April 2022 and required bi-annually as part of contractual governance arrangements). Internal Audit proposed coverage in 2023-24 will include the following: • Climate change • Clyde Valley Waste Partnership
Page 20
Appendix 4 (continued) Internal Audit coverage (recent and planned) of ‘Programme of Work to 2028’ strategic themes. 3. Resilient People Includes the following programmes, projects and activities: • Home Support • Tackling Poverty • 1140 Hours Early Learning • ASN activities • SAC and PEF • Schools - Curriculum delivery • National Care Service • Public Protection • Children’s Services • Community Learning and Development activities • Range of services and activities delivered via Social Work, Third Sector and through IJB Strategic Commissioning Recent audit coverage on activities relevant to this strategic theme has included work on Tackling Poverty (November 2021), Public Protection (September 2021), SAC and PEF (various dates, most recently August 2021), Education Quality Assurance arrangements (January 2023) and Welfare and Poverty related payment (May 2023) Internal Audit proposed coverage in 2023-24 will include the following: • Social Work Quality Assurance 4. Brighter Futures Includes the following programmes, projects and activities: • Workforce for the Future • Skills development/Sector Academies • Employability Services No recent audit coverage has been undertaken on activities relevant to this strategic theme. • Workforce planning 5. Digital North Lanarkshire Includes the following programmes, projects and activities: • Digital NL • Smart NL • ICT support and systems management • BI Hub • HSMS replacement • Corporate and Service technology projects • IT and Information Security Recent audit coverage on activities relevant to this strategic theme has included work on Cyber Security (January 2023), Information Governance and Security (January 2021) and Digital NL (various dates, most recently in November 2021) Internal Audit proposed coverage in 2023-24 will include the following: • ICT operational capability
Page 21
Appendix 4 (continued) Internal Audit coverage (recent and planned) of ‘Programme of Work to 2028’ strategic themes. 6. One Service Includes the following programmes, projects and activities: • Office rationalisation • Leadership and Operating Model • Asset management • Demolition and New Build • Corporate property and repairs Recent audit coverage on activities relevant to this strategic theme has included work on Business continuity planning (July 2022), Asset rationalisation (May 2021) and Managing strategic change (June 2021). Internal Audit proposed coverage in 2023-24 will include the following: • Future operating model • Business continuity planning
Page 22
Appendix 5: Internal Audit performance framework Category Measure Internal Audit management Reported to Chief Executive and CMT Reported to A&SP (Quarterly) Reported to A&SP (Annual) 1. Delivery of Annual Plan Percentage completion of agreed plan X X X 2. Targeting Percentage of key corporate risks and key financial systems over which assurance provided X X X 3. LGBF - Efficiency Cost of Internal Audit per £ million revenue budget X X 4. LGBF - Efficiency % of productive hours delivered v Plan X X 5. Delivery / recommendations Percentage implementation of agreed actions by implementation date (cumulative year to date) X X X X 6. Delivery / other Number of significant irregularity / fraud investigations X X X 7. Customer satisfaction results Scores from customer satisfaction questionnaires (audit assignments) (cumulative year to date) X X X X 8. Customer satisfaction results Scores from key stakeholders (CMT and A&SP) questionnaires (overall performance of the function) X X X 9. Quality / standards Reliance placed by External Audit on the work of Internal Audit X X X 10. Quality/ standards Quality review outcomes – EQAR or internal self-evaluation X X X 11. Delivery of Annual Report Annual opinion /report prepared by 31 May annually X X X 12. Targeting Approval by CMT and A&SP of strategy and annual plan by 31 May annually X X X Internal management performance indicators 13. Efficiency Actual v planned days on completed assignments X 14. Efficiency Time between completion of fieldwork and draft reports being issued X 15. Efficiency Time between draft reports and final reports being issued X