Internal Audit Progress Report
North Lanarkshire Council · 18 May 2023
Back to Audit and Scrutiny Panel — 18 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No ☐approval ☒noting Ref KA/ASP/May23 Date 18/05/23 Internal Audit progress report From: Ken Adamson, Chief Officer (Audit and Risk) E-mail: adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to provide an overview of Internal Audit activity and to report the results of Internal Audit outputs finalised since the last update to the Panel in February 2023. This report highlights the most significant issues arising from these recently completed Internal Audit assignments as well as providing updates on other aspects of the work of Internal Audit. Appendix 1 provides a summary of the scope and key findings of each substantive planned audit report and relevant investigative outputs. Full copies of the relevant audit outputs highlighted in this report are also included in the meeting papers In line with best professional practice and the approved Internal Audit Charter and associated reporting protocol. One report issued in the period has been assessed as providing only limited assurance, while the other four reports provided more positive levels of assurance. The report providing only limited assurance was that in relation to Payments to staff: overtime and travel and subsistence where we have identified significant control weaknesses in relation to the prevention of duplicate claims being processed for payment and issues relating to inconsistencies between the Council’s authorised signatory database and authorisation levels within the Council’s payroll system. The 2022-23 Annual Plan was approved by the Audit and Scrutiny Panel in September 2022. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work be periodically reported to CMT and the Panel. This report fulfils that expectation. Recommendations The Panel is invited to: (a) note the findings, conclusions and recommendations of completed Internal Audit reports together with the associated management responses; (b) consider whether there are any issues raised by Internal Audit which the Panel consider are sufficiently significant to require a further report from management to be submitted to a future meeting of the Panel; (c) request that Internal Audit provide a report to future meetings of the Panel reporting progress made by management implementing agreed management actions in relation to all audit recommendations categorised as ‘High’ or ‘Medium’; and (d) otherwise note this report. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 The 2022-23 Annual Plan was approved by the Audit and Scrutiny Panel in September 2022. The Internal Audit Charter, most recently approved by the Panel in September 2021, requires that the results of Internal Audit’s work be periodically reported to CMT and the Panel. This report fulfils that expectation. 2. Report Audit reviews completed in the period 2.1 Table 1 below provides an overview of completed Internal Audit reports since the last update to the Panel in February. Work is currently underway on other assignments included in the 2022-23 Plan and this work will be reported to the Panel as it is completed. Table 1: Completed Internal Audit outputs in the period Subject Internal Audit Opinion 1. Payments to staff: overtime and travel and subsistence Limited assurance (Amber-Red) 2. Contract management Reasonable assurance (Green-Amber) 3 City Deal Substantial assurance (Green) 4 Corporate governance: Principles C and D Reasonable assurance (Green-Amber) 5 Cost of living crisis: welfare and poverty-related payments Substantial assurance (Green) 6 Investigation: Primary School B (Note 1) Not applicable Note 1: In line with the Internal Audit Reporting Protocol, a summary of the key findings of this investigation is included in this report, but a copy of the full audit report is not included in the papers for this meeting. 2.2 Appendix 1 provides a summary of those reports forming part of the annual programme of planned assurance work and investigation reports as required by the Internal Audit Charter and associated reporting protocol. This report excludes audit outputs produced for the North Lanarkshire IJB which are reported directly to its senior management team and audit committee. 2.3 Appendix 2 contains detailed definitions of the categories used by Internal Audit when making recommendations, providing an audit opinion and on the extent of assurance which is being provided to management and Panel members on those systems or areas of Council operations examined by Internal Audit. 2.4 In addition to the above reports, work is currently underway on a range of topics including the use of contract awards with single tender responses, Social Work quality assurance arrangements, housing allocations and climate change. Once finalised, these reports will be submitted to a future meeting of the Panel. Commentary on completed planned ‘core’ Internal Audit work 2.5 The nature of Internal Audit exercises means that most audit reviews invariably find some scope for improvement, usually in the form of controls which are weak or only partially effective and, therefore, contain recommendations.
Page 3
2.6 One of the five substantive non-investigation reports being reported in the period is assessed as providing only limited assurance, while four of the reports provided more positive levels of assurance. All five reports contain a range of improvement actions and audit recommendations. 2.7 Our work on Payments to staff: overtime and travel and subsistence focused on the adequacy and effectiveness of selected key controls associated with the authorisation and payment of employees’ travel and subsistence and overtime claims. The audit sought to review whether payments were only being made where there was proper entitlement; that sums paid were properly calculated and that relevant authorisation procedures were in place and operating effectively. 2.8 The Council has well-established rules and guidance covering both entitlement to, and the processing of, overtime and travel and subsistence claims. Over the last few years People Resources has continued to roll out, across the Council, the use of the Employee Self Service Portal ‘MySelf’ within iTrent to allow employees to complete and submit electronically claim forms for overtime and expenses to Mangers who authorise these claims electronically within the iTrent system. 2.9 Based on the results of our work, we were satisfied that in general authorised travel and subsistence claims were in respect of eligible costs necessarily incurred undertaking Council business and that overtime claims were in respect of work undertaken, with claims correctly calculated. However, we have categorised the audit as offering ‘limited assurance’, as we have identified significant gaps or weaknesses in the control environment and instances of non-compliance with expected procedures which we consider require to be urgently addressed by management. 2.10 Most notably we have identified significant weaknesses in the system controls/processes designed to prevent duplicate overtime transactions being authorised and paid. The combination of inadequate and/or ineffective controls means that we consider that there is a significant risk that the controls as currently operating would neither prevent error and/or fraud occurring nor detect either after the event. As such, we have recommended that management needs to urgently improve the control environment to prevent duplicate claims being authorised and paid in the future and consider what actions are required where such duplicate claims have previously been made, authorised and paid. 2.11 In addition, the Council’s financial processes require transactions to be authorised by staff who have been given the delegated authority to do so. As with previous audits in this area, we have again identified instances of overtime and expense claims authorised by officers who are either not recorded on the Council’s authorised signatory database as an authorising officer or are authorising claims for values outwith their delegated limit. In all cases, the authorising officer formed part of the Services management structure, appeared to have appropriate knowledge to determine the validity of the claim and had user permissions within iTrent to authorise overtime and expense claims. As such, we consider that there is a need for the adequacy and effectiveness of the long-established arrangements/operation of the authorised signatory database to be reviewed against the current operating environment for processing payroll transactions. 2.12 Management has responded positively to the audit recommendations contained in the report and has committed to a range of actions which are intended to address the control weaknesses identified. 2.13 Our report on Contract management was designed to provide assurance on the adequacy and effectiveness of the Council’s arrangements for contract management activities.
Page 4
2.14 Based on the results of our audit work, we have categorised this audit as offering ‘reasonable assurance’. In general, we are satisfied that the Council’s contract and supplier management guidance is generally sound and broadly reflects good practice principles. Some minor areas for improvement were identified and these have been notified separately to service management for further consideration. 2.15 In respect of the actual contract management arrangements in place for our sample, for eight of the 12 individual contracts selected for testing, we were generally satisfied that contract and supplier management was being undertaken in accordance with the guiding principles within the contract and supplier management guidance, although we identified some areas where we consider that there is scope for improvement. For the remaining four contracts, however, there was little evidence of formal contract and supplier management activity having been carried out, with the contract owners seemingly unaware of their roles and responsibilities in this regard. 2.16 Issues arising for management consideration/action are detailed at Section 3 of the report and include that there is currently no formal mechanism that allows the Council to assess whether effective contract and supplier management is being undertaken across the organisation and there is a need to ensure that all officers undertaking contract and supplier management roles are aware of their responsibilities and have been provided with appropriate training. Satisfactory responses have been received from management in response to the audit findings and recommendations. 2.17 Our work on City Deal was designed to provide assurance on the adequacy and effectiveness of the Council's arrangements in respect of its participation in the Glasgow City Region (GCR) City Deal by assessing whether the Council is adhering to key elements of the GCR City Deal Assurance framework with a focus on the processes surrounding the preparation and submission of grant claims, processes in place around change control and conduct of procurement/tendering arrangements in the period. 2.18 We also extended our audit remit for this exercise to address aspects of an intended audit by the Glasgow City Council Internal Audit Team (in their role as Internal Auditors for the GCR Cabinet) on Project Procurement Strategies. This work involved reviewing the project procurement arrangements designed to help achieve competitive bids and value for money and seeking assurance that there are appropriate controls in place particularly surrounding supply chain and supplier continuity risk identification and management. 2.19 We were satisfied with management arrangements in place and no significant issues were identified. We have assessed the audit as providing ‘substantial assurance’. 2.20 Our work on Corporate governance: Principles C and D was designed to provide independent assurance on the adequacy and effectiveness of the Council’s arrangements for ensuring that it complies with Principles C and D of the CIPFA/SOLACE ‘Delivering Good Governance in Local Government Framework (2016)’ (Principle C relates to ‘Defining outcomes in terms of sustainable economic, social, and environmental benefits’, while Principle D relates to ‘Determining the interventions necessary to optimise the achievement of the intended outcomes’). 2.21 Based on the results of our work, together with our wider general knowledge gained from previous Internal Audit reviews undertaken on this topic and work on other associated areas, we consider that the Council’s corporate governance arrangements in relation to the areas examined are generally adequate and appear to have operated effectively. We have, therefore, assessed the audit as providing ‘reasonable assurance’.
Page 5
2.22 We were pleased to note that as part of the annual review of the Council’s Strategic Governance Framework, the Council had undertaken a full self-assessment of its Local Code of Governance against the Good Governance framework. We consider that this process, which was endorsed by the Corporate Management Team (June 2022) and approved by the Audit and Scrutiny Panel (September 2022), was generally robust. In addition, we noted that the corporate self-assessment indicated a high level of compliance with the corporate governance framework, which was broadly consistent with Internal Audit’s assessment of Principles C and D. 2.23 We have however, identified a small number of areas where we consider scope for improvement exists and/or where further action is required to fully address some of the recommendations made in previous audit reports in this area. These are identified in the action plan at Section 3 of the audit report and include the need for management to take further action to ensure that key documents are reviewed, updated as appropriate and implemented/communicated to relevant staff. Satisfactory responses have been received from management in response to the audit findings and recommendations 2.24 Work on Cost-of-living crisis: welfare and poverty-related payments was designed to provide independent assurance on the adequacy and effectiveness of controls associated with a number of cost-of-living crisis, welfare and poverty related payment schemes administered by the Council. The review focused on whether there are adequate controls in place to ensure that funding is properly targeted and that the Council has adequate and effective grant administration processes in place to ensure payments are properly controlled and made only to those who meet the relevant criteria for eligibility. 2.25 Significant funding has been allocated, both from the Scottish Government and from the Council’s own resources, to respond to both the increasing financial insecurity of people on lower incomes and the increasing rate of poverty arising from the economic impacts of both the pandemic and, more recently, the cost-of-living crisis. Funding has been allocated across several different areas and is targeted at a range of groups including those at greatest risk of fuel poverty; lower-income families with children and those most likely to be at risk of, or experiencing, acute financial distress. 2.26 Funding streams reviewed by Internal Audit as part of this exercise included fuel hardship payments, tenant hardship rent grants and various other payments open to families eligible to free school meals and/or school clothing grants because of their low incomes. 2.27 Based on the results of our work, we have categorised this audit as offering ‘substantial assurance’ as we consider that the grant administration processes are adequate and have operated substantially as intended with any control issue or weaknesses identified presenting only a low risk to the control environment. We were also pleased to note that funding is being targeted at those most in need and that the processes in place generally mean that payments are being adequately controlled and being made only to those who meet the relevant criteria for eligibility. Commentary on completed unplanned ‘non-core’ Internal Audit work 2.28 There is one fraud/irregularity investigation report arising from areas of unplanned or ‘non-core’ work undertaken by Internal Audit in the period that I require to bring to your attention in accordance with the Internal Audit reporting protocol. This relates to our investigation in respect of work undertaken in response to concerns raised by the Service about the operation and administration of the school fund at Primary and Nursery School B. 2.29 Based on the results of our work, we have established that the Council’s Educational Establishment Fund Procedures (school fund) are not being adhered to at the school. We also identified a lack of expected involvement and oversight of the operation of the school fund by the Head Teacher.
Page 6
2.30 Due to the absence of records retained with regards to cash income collected by school and office staff, we have been unable to determine whether there has been any misappropriation of school funds. We consider, however, that arrangements in place with regards to cash handling within the school are significantly deficient and have made several recommendations where we consider immediate actions are required to urgently improve the control environment. 2.31 I am pleased to be able to confirm that satisfactory responses have been received from management in response to the audit findings and recommendations. As Panel members may be aware, we have had to report on issues relating to the poor administration and cash handling arrangements in respect of school funds on a number of occasions in recent years. I am pleased therefore to report that as part of the management response, as well as actions designed to address the issues identified in this school, the Service has also committed to a more general review of the Establishment Fund Procedures and that once complete, revised procedures and training material will be clearly communicated to all Heads of Establishment re-iterating their role and responsibilities. 2.32 There are no other issues arising from core Internal Audit work which I consider sufficiently significant to highlight to the Panel. Future follow-up reports will provide the Panel with information on the implementation, or otherwise, of all actions proposed by management in response to audit recommendations categorised as ‘High’ or ‘Medium’. Other Matters – Internal Audit Performance 2.33 In March 2021, the Panel were presented with a revised performance management framework for Internal Audit that was to be implemented from April 2021. Most indicators are reported on an annual basis. There are two indicators however that are subject to quarterly reporting. The first is about the implementation of agreed actions arising from Internal Audit reports by the implementation date. 58% of agreed actions have been implemented by the agreed implementation date in the period to March 2023. Progress in implementing agreed actions is monitored and reported separately to the Panel each cycle. 2.34 The second performance indicator is about client satisfaction. Appendix 4 provides a summary of the results of four key questions we ask audit clients at the conclusion of each audit assignment. The results presented continues to show positive feedback on the work of Internal Audit, with 93% of respondents in the period agreeing that Internal Audit added value by assisting in providing assurance, and that reports were relevant and constructive with findings clearly and accurately communicated. 2.35 Where management raise concerns over Internal Audit’s work, these matters are discussed with relevant senior management to fully understand the nature of any concerns and, where it is considered appropriate, to identify areas for improvement. We also seek Services’ views on what they liked or disliked about the audit process and comments received are used to inform future action plans for improving the service provided by Internal Audit. 3. Measures of success 3.1 Internal Audit reports annually on its performance to the Panel and is also subject to review annually by the Council’s appointed external auditors.
Page 7
4. Supporting documentation Appendix 1 Summary of Internal Audit assignments completed in the period Appendix 2 Audit gradings Appendix 3 Internal Audit performance framework Appendix 4 Internal Audit client feedback results Ken Adamson, Chief Officer (Audit and Risk)
Page 8
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact because of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Effective responses by management to the weaknesses, control issues and/or areas of improvement identified by Internal Audit will increase the likelihood of the Council achieving its ambitions by improving control frameworks and more effectively mitigating potential risks and threats to the achievement of planned outcomes. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒
Page 9
Appendix 1 Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 1 Payments to staff: Overtime and travel and subsistence Internal Audit Opinion: Limited assurance (Amber-Red) Audit recommendations: High 2 Medium 1 Low 0 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of selected key controls associated with the authorisation and payment of employees’ travel and subsistence and overtime claims. The audit sought to review whether payments were only being made where there was proper entitlement; that sums paid were properly calculated and that relevant authorisation procedures were in place and operating effectively. The Council has well-established rules and guidance covering both entitlement to, and the processing of, overtime and travel and subsistence claims. Over the last few years People Resources has continued to roll out, across the Council, the use of the Employee Self Service Portal ‘MySelf’ within iTrent to allow employees to complete and submit electronically claim forms for overtime and expenses to Mangers who authorise these claims electronically within the iTrent system. Based on the results of our work, we are satisfied that in general authorised travel and subsistence claims were in respect of eligible costs necessarily incurred undertaking Council business and that overtime claims were in respect of work undertaken, with claims correctly calculated. However, we have categorised the audit as offering ‘limited assurance’, as we have identified significant gaps or weaknesses in the control environment and instances of non-compliance with expected procedures which we consider require to be urgently addressed by management. Most notably we have identified significant weaknesses in the system controls/processes designed to prevent duplicate overtime transactions being authorised and paid. The combination of inadequate and/or ineffective controls means that we consider that there is a significant risk that the controls as currently operating would neither prevent error and/or fraud occurring nor detect either after the event. As such, management needs to urgently improve the control environment to prevent duplicate claims being authorised and paid in the future and consider what actions are required where such duplicate claims have previously been made, authorised and paid. In addition, the Council’s financial processes require transactions to be authorised by staff who have been given the delegated authority to do so. As with previous audits in this area, we have again identified instances of overtime and expense claims authorised by officers who are either not recorded on the Council’s authorised signatory database as an authorising officer or are authorising claims for values outwith their delegated limit. In all cases, the authorising officer formed part of the Services management structure, appeared to have appropriate knowledge to determine the validity of the claim and had user permissions within iTrent to authorise overtime and expense claims. As such, we consider that there is a need for the adequacy and effectiveness of the long-established arrangements/operation of the authorised signatory database to be reviewed against the current operating environment for processing payroll transactions. A range of issues were identified and our recommendations are detailed at section 3 of the report. Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 10
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 2 Contract management Internal Audit Opinion: Reasonable assurance (Green-Amber)) Audit recommendations: High 1 Medium 1 Low 1 The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council’s arrangements for contract management activities. The Council spends significant sums from both revenue and capital budgets with external contractors to provide a range of works, goods and services. Effective contract management arrangements are important in ensuring that the Council’s contractual arrangements are sustainable, deliver expected outcomes and represent best value. In 2018 the Council published its Contract and Supplier Management (C&SM) guidance, which aims to establish a consistent approach to C&SM across Council services and achieve best value and improved supplier relationship through effective engagement with suppliers throughout the lifecycle of the contract. We undertook an assessment of the Council’s C&SM guidance and existing contract management arrangements/expectations against the National Audit Office (NAO) ‘Good Practice Contract Management Framework (2008)’ and ‘Commercial and Contract Management: Insights and emerging best practice (2016)’. We also undertook in-depth reviews of the detailed operational arrangements currently in place in respect of a small sample of major contracts operated by the Council (as detailed in Appendix 2 of the report). Based on the results of our audit work, we have categorised this audit as offering ‘reasonable assurance’. In general, we are satisfied that the Council’s C&SM guidance is generally sound and broadly reflects good practice principles. Some minor areas for improvement were identified and these have been notified separately to service management for further consideration. In respect of the actual contract management arrangements in place for our sample, for eight of the 12 individual contracts selected for testing, we were generally satisfied that contract and supplier management was being undertaken in accordance with the guiding principles within the C&SM guidance, although we identified some areas where we consider that there is scope for improvement. For the remaining four contracts, however, there was little evidence of formal contract and supplier management activity having been carried out, with the contract owners seemingly unaware of their roles and responsibilities in this regard. Recommendations for management consideration/action are detailed at Section 3 of the report and include: • there is currently no formal mechanism that allows the Council to assess whether effective contract and supplier management is being undertaken across the organisation; and • there is a need to ensure that all officers undertaking C&SM roles are aware of their responsibilities and have been provided with appropriate training. Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 11
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 3 City Deal Internal Audit Opinion: Substantial assurance (Green) Audit recommendations: High 0 Medium 0 Low 1 The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council's arrangements in respect of its participation in the Glasgow City Region (GCR) City Deal by assessing the extent to which the Council is adhering to key elements of the GCR City Deal Assurance framework with a focus on the processes surrounding the preparation and submission of grant claims, processes in place around change control and conduct of procurement/tendering arrangements in the period. We also extended our audit remit for this exercise to address aspects of an intended audit by the Glasgow City Council Internal Audit Team (in their role as Internal Auditors for the GCR Cabinet) on Project Procurement Strategies. This work involved reviewing the project procurement arrangements designed to help achieve competitive bids and value for money and seeking assurance that there are appropriate controls in place particularly surrounding supply chain and supplier continuity risk identification and management. Internal Audit is also required to return an annual assurance statement to Head of Audit at Glasgow City Council, in their role as the lead auditor for the GCR City Deal, and this work will underpin the completion of the statement for 2022-23. Based on the results of our work, we have concluded that: • we are satisfied that during 2022-23 the Council complied with the GCR Assurance Framework; • the City Deal team has substantively complied with the Council’s General Contract Standing Orders in its procurement/tendering processes for City Deal projects; • the Council has continued to successfully apply expected governance arrangements in relation to the planning, controlling, monitoring and oversight of City Deal projects; and • City Deal grant claims in 2022-23 were properly prepared and submitted in accordance with the terms and conditions under which the grant award was made, the funds have been used for the intended purposes in accordance with the relevant terms and conditions under which the grant is made and the sums claimed are properly due. We have categorised the audit as offering ‘substantial assurance’ as the control environment appears adequate and to have operated as intended with only a small number of minor discrepancies or areas for improvement identified which are outlined in the Action Plan at Section 3. Based on the results of this review and our other knowledge and understanding of the Council’s arrangements, we have returned an assurance statement for City Deal to Glasgow City Council Internal Audit which states that there are no significant matters that require to be raised which could have a material impact on the GCR Annual Assurance Statement for financial year 2022- 2023. Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 12
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 4 Corporate Governance: Principles C and D Internal Audit Opinion: Reasonable assurance (Green-Amber) Audit recommendations: High 0 Medium 1 Low 2 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s arrangements for ensuring that it complies with Principles C and D of the CIPFA/SOLACE ‘Delivering Good Governance in Local Government Framework (2016)’. Principle C relates to ‘Defining outcomes in terms of sustainable economic, social, and environmental benefits’. Principle D relates to ‘Determining the interventions necessary to optimise the achievement of the intended outcomes’. As part of the audit, we assessed existing Council operational practices and management arrangements against the relevant sub-principles cited in the framework (see Appendix 2 of the audit report). We also considered the extent to which recommendations raised in previous Internal Audit reports on corporate governance had been progressed by management and reviewed the robustness and effectiveness of the Council’s Strategic Governance and Strategic Self-evaluation Frameworks in so far as they relate to compliance with the Delivering Good Governance Framework. Based on the results of our work, together with our wider general knowledge gained from previous Internal Audit reviews undertaken on this topic and work on other associated areas, we consider that the Council’s corporate governance arrangements in relation to the areas examined are generally adequate and appear to have operated effectively. We have, therefore, assessed the audit as providing ‘reasonable assurance’. We were pleased to note that as part of the annual review of the Council’s Strategic Governance Framework, the Council had undertaken a full self-assessment of its Local Code of Governance against the Good Governance framework. We consider that this process, which was endorsed by the Corporate Management Team (June 2022) and approved by the Audit and Scrutiny Panel (September 2022), was generally robust. In addition, we noted that the corporate self-assessment indicated a high level of compliance with the corporate governance framework, which was broadly consistent with Internal Audit’s assessment of Principles C and D. We have however, identified a small number of areas where we consider scope for improvement exists and/or where further action is required to fully address some of the recommendations made in previous audit reports in this area. These are identified in the action plan at Section 3 of the audit report and include the need for management to take further action to ensure that key documents are reviewed, updated as appropriate and implemented/communicated to relevant staff. Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 13
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 5 Cost of living crisis: welfare and poverty-related payments Internal Audit Opinion: Substantial assurance (Green) Audit recommendations: High 0 Medium 0 Low 2 The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of controls associated with a number of cost-of-living crisis, welfare and poverty related payment schemes administered by the Council. The review focused on whether there are adequate controls in place to ensure that funding is properly targeted and that the Council has adequate and effective grant administration processes in place to ensure payments are properly controlled and made only to those who meet the relevant criteria for eligibility. Significant funding has been allocated, both from the Scottish Government and from the Council’s own resources, to respond to both the increasing financial insecurity of people on lower incomes and the increasing rate of poverty arising from the economic impacts of both the pandemic and, more recently, the cost-of-living crisis. Proposals for the use of the Council’s Local Authority Covid Economic Recovery Fund (LACER) to assist residents impacted by the cost of-living crisis were approved by the Policy and Strategy Committee in September 2022. Funding has been allocated across several different areas and is targeted at a range of groups including those at greatest risk of fuel poverty; lower-income families with children and those most likely to be at risk of, or experiencing, acute financial distress. Funding streams reviewed by Internal Audit as part of this exercise included fuel hardship payments, tenant hardship rent grants and various other payments open to families eligible to free school meals and/or school clothing grants because of their low incomes. Based on the results of our work, we have categorised this audit as offering ‘substantial assurance’ as we consider that the grant administration processes are adequate and have operated substantially as intended with any control issue or weaknesses identified presenting only a low risk to the control environment. We were also pleased to note that funding is being targeted at those most in need and that the processes in place generally mean that payments are being adequately controlled and being made only to those who meet the relevant criteria for eligibility. We have, however, identified a small number of areas where scope for further improvement exists and accordingly, we have made a small number of recommendations for management attention at section 3 of this report. Satisfactory responses have been received from management in response to the audit findings and recommendations.
Page 14
Appendix 1 (continued) Summary of Internal Audit assignments completed in the period Internal Audit outputs: Audit opinion and commentary 6 Investigation: Primary and Nursery School B Internal Audit Opinion: N/A Audit recommendations: High 3 Medium 0 Low 0 This report presents Internal Audit’s findings in response to concerns raised by management with Internal Audit about the operation and administration of the school fund at Primary and Nursery School B. Internal Audit visited the school on several occasions and met with the Head Teacher, Depute Head Teacher and Clerical Assistant to obtain a general understanding of the relevant financial management arrangements within the school, including how the school fund operates on a day-to-day basis and the record keeping arrangements in place. As part of the work undertaken, we reviewed the cash book and supporting records held for the school fund for the current session. Given that there were limited records held by the school, we did not undertake a detailed review of the cash book and supporting records from previous sessions. Based on the results of our work, we have established that the Council’s Educational Establishment Fund Procedures (school fund) are not being adhered to at the school. We also identified a lack of expected involvement and oversight of the operation of the school fund by the Head Teacher. Due to the absence of records retained with regards to cash income collected by school and office staff, we have been unable to determine whether there has been any misappropriation of school funds. We consider, however, that arrangements in place with regards to cash handling within the school are significantly deficient and have made a number of recommendations where we consider immediate actions are required to urgently improve the control environment. Satisfactory responses have been received from management in response to the audit findings and recommendations. As well as actions to address the issues identified at this school, the Service has recognised that there have been ongoing issues historically with the administration of school funds and has also committed to a more general review of the Establishment Fund Procedures and that once complete, revised procedures and training material will be clearly communicated to all Heads of Establishment re-iterating their role and responsibilities.
Page 15
Appendix 2 Audit gradings Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance There are minimal or minor control weaknesses that present low risk to the control environment. The control environment has substantially operated as intended although some minor errors have been detected. Very few or no improvements are needed. Green-Amber Reasonable Assurance There are some control weaknesses that present a low to medium risk to the control environment. The control environment has mainly operated as intended although errors have been detected. Some improvements should be made. Amber-Red Limited Assurance There are significant control weaknesses that present medium to high risk to the control environment. The control environment has not operated as intended. Significant errors have been detected. Substantial improvements should be made. Red No Assurance There are fundamental control weaknesses that present an unacceptable level of risk to the control environment. The control environment has fundamentally broken down and is open to significant error or abuse. Immediate and major changes need to be made. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but it is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 16
Appendix 3: Internal Audit performance framework Category Measure Internal Audit management Reported to Chief Executive and CMT Reported to A&SP (Quarterly) Reported to A&SP (Annual) 1. Delivery of Annual Plan Percentage completion of agreed plan X X X 2. Targeting Percentage of key corporate risks and key financial systems over which assurance provided X X X 3. LGBF - Efficiency Cost of Internal Audit per £ million revenue budget X X 4. LGBF - Efficiency % of productive hours delivered v Plan X X 5. Delivery / recommendations Percentage implementation of agreed actions by implementation date (cumulative year to date) X X X X 6. Delivery / other Number of significant irregularity / fraud investigations X X X 7. Customer satisfaction results Scores from customer satisfaction questionnaires (audit assignments) (cumulative year to date) X X X X 8. Customer satisfaction results Scores from key stakeholders (CMT and A&SP) questionnaires (overall performance of the function) X X X 9. Quality / standards Reliance placed by External Audit on the work of Internal Audit X X X 10. Quality/ standards Quality review outcomes – EQAR or internal self- evaluation X X X 11. Delivery of Annual Report Annual opinion /report prepared by 31 May annually X X X 12. Targeting Approval by CMT and A&SP of strategy and annual plan by 31 May annually X X X Internal management performance indicators 13. Efficiency Actual v planned days on completed assignments X 14. Efficiency Time between completion of fieldwork and draft reports being issued X 15. Efficiency Time between draft reports and final reports being issued X
Page 17
Appendix 4: Internal Audit client feedback results Responses received in this period from five clients related to 2022-23 assignments reported to the Panel (note these responses primarily relate to audit assignments reported in the Internal Audit Progress Reports presented to the February 2023 meeting of the Panel) Question Strongly Agree or Agree Neither agree nor disagree Disagree Internal Audit added value to my area by assisting in providing assurance and/or identifying weaknesses and/or improvements in relevant governance/business process and internal controls 100% 0% 0% Internal Audit findings were accurate and clearly communicated 100% 0% 0% The Internal Audit report made relevant, constructive and practical recommendations to help improve operations 80% 20% 0% Internal Audit staff were professional and courteous throughout the audit process 100% 0% 0%
Page 18
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0350.2023.001 - payroll - overtime, travel and subsistence/a. findings and report/a06a 20230420 payments to staff ot & ts final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT PAYMENTS TO STAFF KEY CONTROLS: OVERTIME AND TRAVEL AND SUBSISTENCE Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officer of People Resources (point 1 and 3) and Chief Officer of Finance (point 2) Copied to: HR Operations and Workforce Manager, Chief Executive and Depute Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of selected key controls associated with the authorisation and payment of employees’ travel and subsistence and overtime claims. The audit sought to review whether payments were only being made where there was proper entitlement; that sums paid were properly calculated and that relevant authorisation procedures were in place and operating effectively. The Council has well-established rules and guidance covering both entitlement to, and the processing of, overtime and travel and subsistence claims. Over the last few years People Resources has continued to roll out, across the Council, the use of the Employee Self Service Portal ‘MySelf’ within iTrent to allow employees to complete and submit electronically claim forms for overtime and expenses to Mangers who authorise these claims electronically within the iTrent system. Based on the results of our work, we are satisfied that in general authorised travel and subsistence claims were in respect of eligible costs necessarily incurred undertaking Council business and that overtime claims were in respect of work undertaken, with claims correctly calculated. However, we have categorised the audit as offering ‘limited assurance’, as we have identified significant gaps or weaknesses in the control environment and instances of non-compliance with expected procedures which we consider require to be urgently addressed by management. Most notably we have identified significant weaknesses in the system controls/processes designed to prevent duplicate overtime transactions being authorised and paid. The combination of inadequate and/or ineffective controls means that we consider that there is a significant risk that the controls as currently operating would neither prevent error and/or fraud occurring nor detect either after the event. As such, management needs to urgently improve the control environment to prevent duplicate claims being authorised and paid in the future and also consider what actions are required where such duplicate claims have previously been made, authorised and paid. In addition, the Council’s financial processes require transactions to be authorised by staff who have been given the delegated authority to do so. As with previous audits in this area, we have again identified instances of overtime and expense claims authorised by officers who are either not recorded on the Council’s authorised signatory database as an authorising officer or are authorising claims for values outwith their delegated limit. In all cases, the authorising officer formed part of the Services management structure, appeared to have appropriate knowledge to determine the validity of the claim and had user permissions within iTrent to authorise overtime and expense claims. As such, we consider that there is a need for the adequacy and effectiveness of the long-established arrangements/operation of the authorised signatory database to be reviewed against the current operating environment for processing payroll transactions. The issues identified and our recommendations are detailed at section 3 of the report for management consideration/action. Internal Audit Opinion (see definition at Appendix 1) Limited assurance (Amber-Red) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0350/2023/001 Date issued 20/04/22 Audit Team Jacquie Howden, Paula Hendry, Elizabeth Sweeney and Hugh Shevlin
Page 19
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0350.2023.001 - payroll - overtime, travel and subsistence/a. findings and report/a06a 20230420 payments to staff ot & ts final report v1.0 as issued.docx 2 1. Executive Summary Objectives The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of selected key controls associated with the authorisation and payment of employees’ travel and subsistence and overtime claims. In particular, the work was designed to offer an audit opinion on whether: • all authorised travel and subsistence claims were in respect of eligible costs necessarily incurred undertaking Council business; • all authorised overtime claims were in respect of work undertaken and contractual entitlement; • only properly authorised travel and subsistence and overtime claims were passed for payment; • all travel and subsistence claims were supported by receipts where appropriate or where required; and • all claims and payments were correctly calculated. A key objective of this exercise was to substantively test a sample of payments to ensure that controls are operating effectively so that such payments are only being made where there is proper entitlement; sums paid are properly calculated; and authorisation procedures are robust and were operating effectively. We therefore selected a sample of 50 overtime and 80 expenses (travel and subsistence (50), mileage (30) and excess travel(10)) payments made during the period January to August 2022 covering a broad range of service activities across the council. While some work was required in respect of the Employee Service Centre (ESC), the focus of this exercise was on the relevant controls within Services. The audit did not consider or review payments in respect of designated user allowances (DUA) but did include a sample of excess travel payments. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 2 1 0 Key areas requiring management action (High) The following key areas requiring urgent management action have been identified: • There are significant weaknesses in the system controls/processes designed to prevent the duplication of overtime transactions which require urgent management action; and • The adequacy and effectiveness of the authorised signatory database needs to be reviewed. Good practice identified We noted the following areas of good practice during the audit: • The Council has well-established rules and guidance (available on mySelf and MyNL) covering both entitlement to, and the processing of, overtime and travel and subsistence claims. • Proforma templates for claiming overtime, expenses and mileage are also held on mySelf, providing a standardised approach to submitting claim information, with most claims being processed by members of staff directly through the mySelf portal. • All overtime and expenses claims are subject to a separate authorisation process by the employee’s line manager prior to processing and payment of the claim. • There are documented core conditions of service for all Council employees, which include detailed guidance on eligibility, entitlement and rates of pay in respect of overtime payments. • Overtime claims are being paid at the appropriate rates. Other areas for improvement (Medium) A further area for improvement was also identified: • Overtime and expenses claims are not being claimed in accordance with the Council’s guidance and expected procedures.
Page 20
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0350.2023.001 - payroll - overtime, travel and subsistence/a. findings and report/a06a 20230420 payments to staff ot & ts final report v1.0 as issued.docx 3 3. Action Plan Key controls - overtime and travel & subsistence claims 0350/2023/001 Ref Finding 1 There are significant weaknesses in the system controls/processes designed to prevent the duplication of overtime transactions which require urgent management action. The current configuration of the iTrent system does not prevent an overtime claim for the same period being submitted and/or authorised more than once. We noted that a warning has been built into some of the forms set up in the iTrent system (at the top of the employee’s claim submission screen and managers’ authorising screen) to highlight potential duplicate overtime transactions and prompting appropriate checks to be undertaken prior to submitting and authorising the claim. It is our view that as this warning is not prominent on screen and as it does not appear as a pop-up on the screen, it could be easily missed by the employee and/or manager. During our audit testing, we identified nine cases (from a sample of 50 claims) where duplicate overtime claims had been processed and subsequently authorised and paid. All duplicate claims identified had been processed through the mySelf module of iTrent where employees input claims directly on the system for electronic authorisation by managers. The total estimated overpayment for our sample was £5,648. From discussions with the Workforce Systems and Analytics Manager, we noted some significant weaknesses within the current system and process which we consider require urgent management attention and action as follows: • For a warning to be triggered, the details of the overtime claims must be processed in an identical way (i.e. dates, number of hours worked and the reason for the overtime). Where any of these elements differ, the system does not automatically recognise the potentially duplicate transaction. We understand that, although the system includes fields for entering the start and finish times for overtime, these fields are ’free text’ and therefore, the system does not undertake any validation checks based on this data or provide a warning if similar information appears within another claim; • The system allows both the employee and the authorising manager to ignore the warning and submit or authorise the claim without any further checks being undertaken; • Authorising officers can currently authorise overtime claims via their ‘To do’ list without viewing the detailed content of the individual claim. In such instances, we understand that the manager would not be alerted to the warnings and would, therefore, be able to authorise the transactions without further checks or other preventative measures being triggered; • The warning is not currently active on any forms within iTrent created before the current system functionality was introduced in February 2020. We understand that the ESC plans to update all forms to ensure that the validation checks are in place, although no timescales have as yet been set for undertaking this; and • As a significant number of employees now complete an online form to claim overtime, the system does not provide a user friendly or efficient mechanism for Mangers to undertake the necessary checks on previously approved claims to be able to confirm that any overtime claimed has not previously been claimed and/or paid. People Resources are aware of the current limitations with the system and we understand that the system supplier has developed additional functionality which, if implemented, is expected to resolve many of the issues identified, however any system enhancements would require further investment by the Council. We also noted that there are no routine periodic checks undertaken by the ESC to identify any potential duplicate payments, therefore current operating arrangements solely rely on managers undertaking appropriate checks prior to approval of claims. Whilst it could be argued that this represents a reasonable approach, the results of our testing have shown that this is neither an adequate nor an effective control. Following discussion with the Workforce Systems and Analytics Team, a report to identify potential duplicate claims over the last few years has been generated. This report has identified that of approximately 97,000 claims processed in the period, 2,431claims from 739 employees contained a potential duplicate entry (i.e. employee number, date of claim, overtime code, start time and hours claimed all match across more than one claim). This report will require further review and analysis to determine frequency of claims by individual employees and the value of overpayments arising from any confirmed duplicate payments. We understand that ESC management intend to introduce this as a standing report each pay period and are currently considering how and who will action the output from this report which would allow duplicate claims to be identified and stopped prior to payment.
Page 21
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0350.2023.001 - payroll - overtime, travel and subsistence/a. findings and report/a06a 20230420 payments to staff ot & ts final report v1.0 as issued.docx 4 3. Action Plan (continued) Key controls - overtime and travel & subsistence claims 0350/2023/001 Implication Recommendation Priority Management response Implementation Month/Year A lack of effective preventative controls increases the risk of duplicate claims being processed at potentially significant cost to the council. Without periodic checks and/or robust reports, management may not be aware of the scale of the issues in respect of duplicated claims. The Chief Officer of People Resources should: (1) as a matter of urgency, review the current control framework to identify, and thereafter introduce, more effective preventative controls to ensure duplicate claims cannot be submitted, authorised and processed for payment; (2) put in place interim arrangements to highlight potential duplicate claims prior to payment (through the use of appropriate exception reports) and to identify and resolve any issues arising; (3) use relevant information to identify any areas of recurring non-compliance and report this to the appropriate Chief Officer; and (4) in conjunction with relevant Service management, consider and determine appropriate actions to be taken with regards the duplicate claims identified during our audit and in the subsequent exception report referenced in the finding above. High Agree Jennifer Hardy, HR Operations and Workforce Manager The review of the current control environment has been completed and this has confirmed the control weakness identified by Internal Audit. Interim arrangements have now been determined with a process developed to identify duplicate claims and these will be deleted prior to payruns being finalised for payment to be made to staff. This process will remain under review with amendments made as necessary to ensure it remains effective. As part of this process Managers who authorise duplicate claims will be notified of the error. Employees who continually submit duplicate claims will be notified to the relevant Manager for review, investigation, and action. In addition, details of Managers who continually authorise duplicate claims will be escalated to Chief Officers for appropriate review, investigation and action. A CMT report will be prepared to highlight this issue to all Chief officers and advise that further investigation is required to identify a longer-term solution within the iTrent system to improve the current control environment. This report will also include detailed analysis of the duplicate claims paid over the last few years including frequency of occurrence and value of claims. Initial interrogation of this report indicates the total value of overpayments to be in the region of £150,000 but this has still to be further interrogated to determine the actual value. A decision on how these overpayments will be recovered will be sought from CMT as part of this report. Work will then commence to investigate and determine such solutions with a report back to CMT for a decision on the way forward. Complete April 2023 June 2023 December 2023
Page 22
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0350.2023.001 - payroll - overtime, travel and subsistence/a. findings and report/a06a 20230420 payments to staff ot & ts final report v1.0 as issued.docx 5 3. Action Plan (continued) Key controls - overtime and travel & subsistence claims 0350/2023/001 Ref Finding 2 The adequacy and effectiveness of the authorised signatory database needs to be reviewed. The Council’s financial processes are well established and require all transactions to be authorised by staff who have been given the delegated authority to do so. The types, and values/limits of the transactions set for each authorising officer are determined by management and are recorded in the Council’s Authorised Signatories Database (ASDB) maintained by Financial Solutions. All overtime and expenses claims must be authorised by an appropriate authorising officer (generally the employees’ line manager) prior to payment in accordance with the Council’s delegated authority arrangements. The processes for authorising overtime and expenses claims are clearly set out in the ‘mySelf Mileage, expenses and overtime guide’. In addition, we noted that guidance on the authorisation of payments is available on myNL and myTeams, with periodic myTeam sessions run for managers throughout the year. From the sample of overtime and expenses claims reviewed we identified several claims where the authorisation processes were not operating as expected. In particular, we identified: • eight overtime and five expenses claims where the authorising officer was not included in the ASDB; • two expenses claims where the authorising officer was included in the ASDB but did not have the appropriate delegated authority to approve travel and subsistence expenses; and • seven overtime and three expenses claims where the authorising officer had authorised claim values in excess of their delegated authorisation limits. In each case, the authorising officer had line management responsibility for the employee submitting the claim and had user permissions within iTrent that enabled them to authorise overtime and expense claims. These findings are consistent with the results of audits in this area in previous years and, in response to those audit findings, an action was identified by People Resources to work with Financial Solutions to seek to determine how to integrate the ASDB into the iTrent system. To date, however, whilst we understand People Resources have been actively engaging with Financial Solutions on this, how this could be achieved has not been identified and/or progressed. Current processes, therefore, rely on authorising officers checking that they have the appropriate financial authority before authorising a claim. Although we understand that the email notification alerting the manager to a claim requiring authorisation includes the financial value of the claim, the actual claim on the iTrent system which is reviewed and authorised does not include the financial value of the claim, therefore at the point of authorisation, the manager cannot see the value of the claim they are authorising. Internal Audit considers that, although delegated authority remains a requirement for payroll related transactions, the ongoing move to authorisation processes being completed within the iTrent system, means a review is required as to whether the current standalone authorised signatory database remains fit for purpose in relation to the authorisation of payroll related transactions or if parameters/permissions can be set against job roles within the iTrent system to discharge this requirement. Implication Recommendation Priority Overtime and expenses transactions which have not been properly authorised may be processed, resulting in an increased risk of incorrect, invalid or inappropriate payments being made. The Chief Officer of Finance should: (1) in conjunction with the Chief Officer of People Resources, review the appropriateness of the current authorised signatory database for payroll transactions and consider if controls built into the iTrent system itself would provide a more effective means of operating delegated authority requirements; and (2) undertake a review of the appropriateness and effectiveness of the current arrangements for the ASDB for other types of transactions, taking into consideration current operating environments (with many authorisations now taking place using user permissions set-up within relevant systems), to determine whether it remains fit for purpose and how delegated authorities can, going forward, be best established and effectively discharged. High
Page 23
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0350.2023.001 - payroll - overtime, travel and subsistence/a. findings and report/a06a 20230420 payments to staff ot & ts final report v1.0 as issued.docx 6 3. Action Plan (continued) Key controls - overtime and travel & subsistence claims 0350/2023/001 Management response Implementation Month/Year Agree Elaine Kemp, Chief Officer (Finance) and Fiona Whitaker, Chief Officer (People Resources) (1) We agree that in-built controls to the iTrent system would provide a more effective means of operating delegated authority requirements for payroll transactions. At present there are no validation options within iTrent. However, with some development work it is possible to create a report, to highlight in advance any payments that have been authorised beyond the Manager’s limit. People Resources and Financial Solutions will review and explore the opportunities around this, including the possibility to hold all authorised signatories and limits within iTrent, thus removing the requirement to maintain a separate ASDB going forward (this links to recommendation 2). This review will include setting out any new governance arrangements as a result i.e., how iTrent is updated/ maintained/ by whom/ access etc., perhaps as part of the starters/ leavers/ movers’ procedures. Currently Financial Solutions supply a weekly report to ESCWT of any recent changes to the ASDB and vice versa. This captures leavers, vacancies etc. In addition, there is on-going collaboration between both teams to incorporate information required on iTrent, into the ASDB database e.g., additional field such as POSN number. However, in light of the audit findings, such as missing permissions on the ASDB, a review exercise will be undertaken to reconcile both the list of staff with permissions to authorise payroll claims held by ESC Workforce Team (ESCWT) and the list in the Financial Solutions ASDB. Following this, all relevant service users will be contacted to ensure necessary procedures have been followed and appropriate forms completed. This is a short-term measure subject to the development work outlined above. The above actions will not prevent iTrent users approving claims they are not authorised to do. Therefore, in the absence of iTrent system controls on authorisation limits, the responsibility for ensuring users approve transactions within their approved limits remains a compliance matter for all services. (2) As a result of the migration to MS Teams and associated decommissioning of physical servers, along with no future support from Business Solutions for Access databases, which is the format in which the ASDB is held, a need to review the current arrangements for the ASDB has already been identified by Financial Solutions. In light of the audit recommendations this exercise will also include the need to review the appropriateness and effectiveness of the current arrangements for the ASDB for other types of transactions, taking into consideration current operating environments, to determine whether it remains fit for purpose and how delegated authorities can, going forward, be best established and effectively discharged. Part of this review will include exploring the possibility of in-built system controls/ validations of approved users/limits of the various central systems. The development work referenced at (1) above may provide a new solution or support from Business Solutions may be required to develop an alternative system that can be accessed by all relevant services for checking and maintaining authorised persons and limits. It should be noted that in lieu of any possible systems developments to successfully provide such in-built controls, responsibility remains with all central systems owners and users to pro-actively check all transactions to ensure compliance with approvals permitted per the ASDB. September 2023
Page 24
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0350.2023.001 - payroll - overtime, travel and subsistence/a. findings and report/a06a 20230420 payments to staff ot & ts final report v1.0 as issued.docx 7 3. Action Plan (continued) Key controls - overtime and travel & subsistence claims 0350/2023/001 Ref Finding 3 Overtime and expenses claims are not always being claimed in accordance with the Council’s guidance and expected procedures. The Council’s ‘Mileage, Expenses and Overtime guide’ was revised in January 2022 and is currently available to all staff, on Myself and MyNL. The guide, together with further summary guidance on Myself, clearly sets out the rules for claiming overtime and expenses and detailing the expected procedures and documentation to be used in each case. We selected a sample of overtime and expenses (travel and subsistence, mileage and excess travel) claims from a broad range of service activities across the Council for the period January to August 2022, with a view to ensuring that only valid/eligible claims were being made; claims were properly calculated and were supported by the appropriate receipts; and the claims were being submitted in accordance with the expected timescales. We were satisfied that the claims were generally valid and necessarily incurred and had generally been processed and authorised through mySelf using the relevant expenses claim form (where appropriate). However, we noted that there was a high level of both overtime and expenses where we consider that claims had not been made in accordance with the guidance/expected procedures. The majority of these claims also contained one or more errors, suggesting that insufficient checks were being undertaken prior to submitting claims for authorisation and payment. In each of these cases, the claim had been authorised and paid. The key issues arising include: • Insufficient information recorded in mySelf and/or timesheets to support the reason for/eligibility of the overtime/expenses being claimed (including start/end times for overtime and journeys); • Overtime claims incorrectly input by employees, with half hour breaks not being deducted for periods of overtime worked of six hours or more and/or overtime being claimed for periods of less than half an hour; • Receipts for travel, subsistence and mileage claims not always being attached to claim forms within mySelf to support the expenses being claimed and/or the receipts provided not corresponding with the amounts being claimed; • Instances of subsistence being claimed over the maximum rate for meals; • mileage being claimed for journeys that exceeded the expected mileage for the journey (mileage and excess travel claims) when compared to the distance as calculated using on-line tools such as the AA Route Map etc; • mileage/travel costs being claimed which related to normal home to work commutes (and should therefore not have been re-imbursed). It appears that some Services may be unclear on the expectations surrounding excess travel when an employee’s designated place of work has changed; and • Employees’ driving licence/current insurance certificates were not always being routinely reviewed and confirmation of this check being recorded in myTeam to support the mileage claims in accordance with the expected procedures. Implication Recommendation Priority Management response Implementation Month/Year Claims may be submitted, authorised and paid that do not reflect amounts properly due and/or incurred undertaking Council business. A lack of properly documented claims and supporting evidence increases the risk that incorrect and/or inappropriate payments may be processed. The Chief Officer of People Resources should ensure that regular reminders/communications are issued to all staff and authorising officers outlining the key expectations regarding completion and review of overtime and expense claim forms ensuring the specific issues noted above are sufficiently covered in any such reminders. Medium Agree Jennifer Hardy, HR Operations and Workforce Manager Reminders will be issued periodically from March 2023. March 2023
Page 25
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0350.2023.001 - payroll - overtime, travel and subsistence/a. findings and report/a06a 20230420 payments to staff ot & ts final report v1.0 as issued.docx 8 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 26
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 1 INTERNAL AUDIT REPORT CONTRACT MANAGEMENT ARRANGEMENTS Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: Contracts selected for testing Appendix 3: Contract and Supplier Management corporate expectations Issued to: Chief Officer of Asset and Procurement (point 1(1), 2 and 3), Chief Officers of Education (North and South) (point 1(2) only) Copied to: Chief Executive, Deputy Chief Executive and all Chief Officers Headlines The purpose of this review was to provide assurance on the adequacy and effectiveness of the Council’s arrangements for contract management activities. The Council spends significant sums from both revenue and capital budgets with external contractors to provide a range of works, goods and services. Effective contract management arrangements are important in ensuring that the Council’s contractual arrangements are sustainable, deliver expected outcomes and represent best value. In 2018 the Council published its Contract and Supplier Management (C&SM) guidance, which aims to establish a consistent approach to C&SM across Council services and achieve best value and improved supplier relationship through effective engagement with suppliers throughout the lifecycle of the contract. We undertook an assessment of the Council’s C&SM guidance and existing contract management arrangements/expectations against the National Audit Office (NAO) ‘Good Practice Contract Management Framework (2008)’ and ‘Commercial and Contract Management: Insights and emerging best practice (2016)’. We also undertook in-depth reviews of the detailed operational arrangements currently in place in respect of a small sample of major contracts operated by the Council (as detailed in Appendix 2 of the report). Based on the results of our audit work, we have categorised this audit as offering ‘reasonable assurance’. In general, we are satisfied that the Council’s C&SM guidance is generally sound and broadly reflects good practice principles. Some minor areas for improvement were identified and these have been notified separately to service management for further consideration. In respect of the actual contract management arrangements in place for our sample, for eight of the 12 individual contracts selected for testing, we were generally satisfied that contract and supplier management was being undertaken in accordance with the guiding principles within the C&SM guidance, although we identified some areas where we consider that there is scope for improvement. For the remaining four contracts, however, there was little evidence of formal contract and supplier management activity having been carried out, with the contract owners seemingly unaware of their roles and responsibilities in this regard. Recommendations for management consideration/action are detailed at Section 3 of the report and include: • there is currently no formal mechanism that allows the Council to assess whether effective contract and supplier management is being undertaken across the organisation; and • there is a need to ensure that all officers undertaking C&SM roles are aware of their responsibilities and have been provided with appropriate training. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0900/2023/006 Date issued 20/04/23 Audit Team Jacquie Howden, Paula Hendry, Hugh Shevlin and Elizabeth Sweeney
Page 27
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 2 1. Executive Summary Objectives The purpose of this review was to provide assurance on the adequacy and effectiveness of the Council’s arrangements for contract management activities. In particular, the review sought to consider the following: • Whether the Council prepares adequately for contract management, including ensuring clear accountability/responsibility for carrying out contract management activities; • How effectively the Council develops strong internal and external relationships to facilitate delivery; • How the Council ensures that the goods and services and service performance provided is in line with the contract; • Ensuring payments are made to suppliers in line with contracts and that, where relevant, appropriate incentive mechanisms are in place and well managed; • Whether the Council understands and effectively manages contractual and supplier risk; • Where appropriate, whether any changes to contracts are handled effectively; and • Where appropriate, how well the Council undertakes supplier development, supplier relationship management and wider market management activities. Internal Audit last reviewed the Council’s contract management arrangements in 2018. Recent audit work in relation to procurement has focused on the processes associated with inviting, evaluating and awarding contracts while recent work in relation to Creditors has focused on controls relating to the authorisation of payments. The focus of this audit was on the post-procurement and post tendering/evaluation contract management processes. We did not, therefore, undertake a review of relevant procurement activity as part of this audit. Work undertaken included a review of the adequacy of the Council’s existing corporate expectations/requirements and included an assessment of the Council’s practices and management arrangements against the National Audit Office (NAO) ‘Good Practice Contract Management Framework (2008)’ and ‘Commercial and Contract Management: Insights and emerging best practice (2016)’. We also undertook in-depth reviews of the detailed operational arrangements currently in place in respect of a sample of major contracts operated by the Council. The Council’s joint-venture arrangements with Amey and Mears were specifically excluded from the scope of this audit as, despite both representing significant commercial arrangements, the contract management arrangements in place are significantly different from that expected in respect of other contractors (reflecting the Council’s relationship with each as a joint venture vehicle). This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 1 1 1 Key areas requiring management action (High) The following key area requiring urgent management action has been identified: • There is currently no formal mechanism that allows the Council to assess whether effective contract and supplier management is being undertaken across the organisation. Good practice identified We noted the following areas of good practice during the audit: • The Council’s Contract and Supplier Management (C&SM) guidance was issued in 2018 and is available to all staff on InsideNL (and previously on Connect). It was developed in conjunction with/compliments the Council’s Procurement Strategy (updated for 2022-2023), the General Contract Standing Orders and the values of the Scottish Procurement & Commercial Directorate (SPCD) Supplier’s Charter. It also encompasses the best practice set out in the SPCD Procurement Journeys.
Page 28
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 3 Good practice identified (continued) We noted the following areas of good practice during the audit: • The C&SM guidance clearly sets out the roles and responsibilities of the Contract owner and includes a ‘contract owner checklist’ which summarises the key actions the contract owner requires to take during the planning and preparation, managing service delivery, managing supplier relationship and contract administration phases, together with further details points/areas to consider in the C&SM process. • The C&SM guidance also contains a number of proforma documents designed to standardise the approach to C&SM across the council, allow for operational day-to-day management throughout the lifecycle of the contract and maintaining the relationship between the Contract Owner and the Supplier. Other areas for improvement (Medium) Another area for improvement was also identified: • There is a need to ensure that all officers undertaking C&SM roles are aware of their responsibilities and have been provided with appropriate training.
Page 29
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 4 3. Action Plan Contract Management 0900/2023/006 Ref Finding 1 There is currently no formal mechanism that allows the Council to assess whether effective contract and supplier management is being undertaken across the organisation In 2018, the Corporate Procurement Team (CPT) within Asset & Procurement Solutions produced its Contract and Supplier Management (C&SM) guidance, which aims to provide a consistent approach to C&SM activities across the Council and improve supplier relationship through effective engagement with suppliers throughout the lifecycle of the contract. The guidance recognises that some services may have existing, embedded, and compliant C&SM processes in place and is not designed to replace these. The presumption in the guidance is, however, that any alternative arrangements must reflect the same principles and priorities as are included in the corporate guidance. From discussions with the former Procurement & Support Manager, we noted that the CPT is not currently aware of the extent to which services are (or are not) using the C&SM guidance or any alternative arrangements and/or the extent to which any alternative arrangements reflect the principles contained in the corporate guidance. We also noted that, at present, there is no corporate group/resource in place with overarching responsibility for driving C&SM activities/performance across the council and/or for monitoring performance and ensuring that services are complying with the principles and priorities contained in the guidance. We understand that the CPT is responsible for providing support and advice to services for procurement exercises only, with responsibility for C&SM passing fully to the Contract Owners within individual services as soon as the contract is awarded. The Council maintains a register of all live contracts in excess of £50,000. We obtained a copy of the contracts register database from the former Procurement & Support Manager and noted that it contained the key contract details including the reference number, procurement title/category, contract value, key CPT/Service lead officers and the contract award/start/end dates together with the details of any applicable extension periods. The database also contained a ‘Contract Management overview’ section which we understand is designed to record/monitor key aspects of C&SM activity, including the name of the contract manager, the assessed level of C&SM and the frequency, date and outcome/score of the latest performance appraisals. We noted, however that a significant amount of the data held within the database regarding this was out of date or incomplete, with contract manager details often incorrect/unknown and no details of the performance appraisals being held, resulting in the contract status generally showing as ‘action overdue’ or ‘no information available’. From discussions with the CPT, we understand that there is no formal process in place to ensure that the database is regularly/routinely updated to reflect the recent C&SM activity within Services and/or for ensuring that performance appraisals are being undertaken in accordance with the assigned level of C&SM for each contract. Instead, we understand that the CPT reviews the database on an ad hoc basis and will issue informal reminders to contract leads to obtain updated information, which isn’t always followed-up where the service does not provide the required information. We also understand that the database information is not routinely reported to senior management. In addition, we noted that there is currently no contract management ‘community’ within the Council, which allows Contract Owners to share good practice/lessons learned and/or lead the wider contract management arrangements. The Corporate Procurement Working Group’s (CPWG) terms of reference state that the group is responsible for ensuring that ‘continuous improvement is embedded in contract management and service provision’. However, despite this we noted that the CPWG and the Procurement Networking Group (PNG) currently in place deal exclusively with procurement-related issues. We selected a sample of 12 individual contracts from across the council (as detailed in Appendix 2) to determine the extent to which the C&SM guidance and associated arrangements were being followed in practice. We noted that in eight cases the services were either using their own adapted C&SM guidance, a hybrid of the Council’s C&SM and project management processes and documentation and/or the contracts were being managed externally/on a national level. The extent of C&SM being undertaken in these cases varied significantly between services and we noted that the alternative processes used did not always allow for all expected elements of C&SM activities to be formally evidenced. In the remaining four cases, there was little/no evidence of formal C&SM activity being undertaken on the contracts, with proforma C&SM documents not being routinely completed, supplier health checks not being undertaken and/or balanced scorecards/KPIs not being used to routinely monitor supplier performance. Two of these contracts related to Education & Families and further discussion with Service management has indicated a lack of formal C&SM activity being undertaken more generally on contracts across the Service. We understand that Education and Families management has committed to identifying all live contracts within their service and implementing a formal training programme for relevant officers to ensure that expected requirements are understood and that appropriate and proportionate formal contract management arrangements are put in place. (Continued over page)
Page 30
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 5 3. Action Plan Contract Management 0900/2023/006 Implication Recommendation Priority Management response Implementation Month/Year Without robust over- arching review/ monitoring arrangements, management would not be able to determine whether effective C&SM activities were being undertaken in accordance with corporate expectations. C&SM performance issues may not be appropriately managed, and lessons learned/good practice may not be adequately shared across the council. (1) The Chief Officer (Asset and Procurement) should: (a) review and determine a proportionate risk-based approach for the Council to gain assurance on the extent of compliance across Services with key corporate expectations in relation to contract and supplier management. This might include requiring Chief Officers to attest that the arrangements within their Service areas comply with the guiding principles within the C&SM guidance (where alternative Service specific arrangements are in place), an annual confirmation by Chief Officers that C&SM activity within their Services is operating as intended and periodic compliance checks on a sample of contracts to verify that expected processes are being properly adhered to; and (b) consider the adequacy of the current arrangements for reviewing/updating the contract management information within the contract register database and determine how this might be used to facilitate effective C&SM monitoring and oversight as per recommendation (a) above. (2) The Chief Officers of Education (North and South) should, as a matter of priority, ensure that all current contracts under their remit are identified and appropriate contract management arrangements established for each contract including identifying training needs for those staff identified as contract owners. High (1) Agree James McKinstry, Chief Officer (Asset and Procurement) (a) The Chief Officer (Asset and Procurement) will establish and implement a process for a proportionate risk-based approach for the Council to gain assurance on the extent of compliance across Services with key corporate expectations in relation to contract and supplier management. This will include an annual confirmation by Chief Officers that C&SM activity within their Services is operating as intended and periodic compliance checks to verify that expected processes are being properly adhered to. (b) The Chief Officer (Asset and Procurement) will consider the adequacy of the current arrangements for reviewing/updating contract management information contained within the contract register database to determine how it can be used to facilitate effective C&SM monitoring and corporate oversight of the Council’s C&SM activity. (2) Agree Gerard McLaughlin and Janie O’Neill, Chief Officers of Education (North and South) We will ensure that all current contracts awarded through the Council’s GCSO process within Education and Families are identified and formal contract management arrangements are thereafter put in place to ensure that the Council’s corporate expectations as set out in the Contract and Supplier Management (C&SM) guidance are followed. We will also ensure that moving forward all contract owners are fully trained and understand the corporate C&SM guidance. December 2023 September 2023
Page 31
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 6 3. Action Plan (continued) Contract management 0900/2023/006 Ref Finding 2 There is a need to ensure that all officers undertaking C&SM roles are aware of their responsibilities and have been provided with appropriate training The council’s C&SM guidance states that Chief Officers are required to identify appropriately experienced/knowledgeable Contract Owners to manage every contract and to ensure that the officers attend training to develop the necessary skills and expertise to lead the C&SM process. The C&SM guidance clearly sets out the roles and responsibilities of the Contract Owner for C&SM throughout the lifetime of the contract. Through discussions with the former Procurement & Support Manager we noted that, whilst for construction contracts the Contract Owner tends to be an Architect (or similar), there is currently no standardised approach across the Council to assigning appropriately experienced officers as Contract Owners for non-construction contracts. We understand that the C&SM guidance was developed around the skills and competencies contained in the Scotland’s National Procurement Competency Framework and that Chief Officers are expected to follow these when assigning suitable Contract Owners. The guidance does not, however, currently specify what skills the Contract Owner is expected to have. We also noted that there is currently no formal process in place for ensuring that Contract Owners are aware of their responsibilities for C&SM and/or for assessing their performance in respect of delivering C&SM. For the sample of 12 individual contracts selected for testing, we noted that in four cases the Contract Owner either did not consider that they had the appropriate skills/experience to effectively undertake the role, had not been made aware of the C&SM guidance and/or had not been given any training to allow them to effectively undertake this role. We also noted that although the guidance is currently available to all staff on InsideNL (and previously on Connect), that there had been no formal reminders issued to staff making them aware of the existence of the guidance since it was issued in 2018. In addition, we noted that there has been no review of, or updates to, the C&SM guidance since it was originally issued. We also noted that the eLearning training module ‘Procurement – effective contract management essentials’ currently available on LearnNL does not refer to the Council’s C&SM guidance or the process for assessing the level of C&SM to be undertaken in accordance with the corporate methodology. We understand that the module is part of a series of training courses linked to the new Scheme of Delegated Procurement Authority (DPA), which is currently being developed by the CPT in conjunction with the Talent & Organisational Development (TOD) team as part of the 2023-2025 Procurement Improvement Plan. We also understand that it is intended that training (including training on the C&SM guidance) will be provided to officers identified as Contract Owners in due course. At the time of our audit, we noted that several eLearning modules on Procurement have now been developed and published on LearnNL. The original module in respect of contract management essentials (above), however, has not as yet been amended to incorporate reference/links to the C&SM guidance and no formal training dates have as yet been planned. Implication Recommendation Priority Inexperienced officers may be identified as Contract Owners which may prevent the contracts from being managed effectively. Staff may not be aware of the Council’s C&SM guidance and/or the corporate expectations on Contract owners for undertaking C&SM. Without the appropriate training, officers would not be able to effectively undertake their duties for C&SM. The Chief Officer (Asset and Procurement) should ensure that: (1) all Chief Officers are reminded of the need to nominate appropriately skilled/experienced officers as contract owners and ensure that such staff are made aware as soon as possible of the C&SM guidance and the responsibilities and corporate expectations placed on them when undertaking such a role; (2) the eLearning modules and associated training continue to be developed in accordance with the expected timescales and consideration is given to the need for specific mandatory training on the corporate C&SM guidance for those nominated as Contract Owners; and (3) the C&SM guidance is subject to periodic review to ensure that it continues to be adequate and reflects current corporate expectations in relation to C&SM activity across the Council. Medium
Page 32
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 7 3. Action Plan (continued) Contract management 0900/2023/006 Management response Implementation Month/Year Agree James McKinstry, Chief Officer (Asset and Procurement) (1) All Chief Officers will be reminded of the need to nominate appropriately skilled/experience officers as Contract Owners and to ensure that they are made aware of the corporate C&SM guidance, and the responsibilities expectations placed on them when undertaking the role. (2) Asset and Procurement will continue with the development of eLearning modules and associated training and will also consider the need for mandatory training and awareness of the corporate C&SM guidance for officers nominated as Contract Owners (3) The Chief Officer (Asset and Procurement) will ensure the C&SM guidance is subject to periodic review to ensure that it continues to be adequate to reflect the corporate expectations in relation to C&SM activity across the Council. June 2023 December 2023 December 2023
Page 33
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 8 3. Action Plan (continued) Contract management 0900/2023/006 Ref Finding 3 Some compliance issues were identified where management action should be considered With regards contracts, the Council’s financial regulations (section 15.4) state that “any variations where the outturn/expected costs exceed the tendered contract price by the higher of £25,000 or 5%, or where the outputs/outcomes achieved by the expenditure differ significantly from those originally envisaged, shall be reported by the appropriate Chief Officer/Head of Service (Budget Holder) to the relevant Spending Committee at the earliest opportunity”. Our review of the financial monitoring arrangements for the 12 contracts from across the Council (as detailed in Appendix 2 highlighted that there was scope for improvement to the financial monitoring arrangements in place. Whilst we were satisfied that appropriate arrangements for monitoring contract spend where in place for five contracts, we obtained limited information regarding the arrangements for the remaining seven and as such were unable to fully consider and determine the appropriateness of these arrangements. In addition, our review of the sample of 12 individual contracts from across the council (as detailed in Appendix 2) to determine the extent to which the C&SM guidance and associated arrangements were being followed in practice identified the following compliance issues: • Proforma C&SM documents (including Contract Mobilisation documents, Mobilisation Plans, lessons learned and exit strategies not being routinely completed; • Supplier health checks not always being regularly undertaken; • Balanced scorecards and/or KPIs not always being used to routinely monitor supplier performance. • Contract risks not always being effectively managed through formal risk registers; and • Review meetings with suppliers not being undertaken in accordance with the appropriate level of C&SM. Implication Recommendation Priority Management response Implementation Month/Year If contract management activity is not undertaken in accordance with key corporate expectations performance, financial and/or related issues may not be identified, and appropriate action taken on a timely basis. The Chief Officer (Asset & Procurement) should remind Services of the need to ensure that key aspects of contract and supplier management noted above are complied with including the need to ensure that robust arrangements are put in place to enable accurate and up to date financial spend management information to be collated and reported to key stakeholders on a timely basis. Low Agree James McKinstry, Chief Officer (Asset and Procurement) The Chief Officer (Asset and Procurement) will remind Services of the need to ensure that key aspects of C&SM are complied with including the need to ensure that robust arrangements are in place to enable accurate and up to date financial spend management information to be collated and reported to key stakeholders on a timely basis. June 2023
Page 34
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 9 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 35
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 10 Appendix 2 – Contracts selected for testing The following contracts were selected for detailed testing purposes as part of our audit. Sample Contract ref Contract name Contract value (£) 1 NLC-CPT-20-070 Flexible framework for Self-Directive Services (SDS) 820,000,000 2 NLC - CPT-20-057 New Build Programme - construction of units at Dykehead Road, Airdrie 26,996,625 3 NLC-CPT-19-038 MTC - Replacement of windows and doors 2020-2025 25,000,000 4 CPT-194-ML-FC-15 Office equipment & print management software 4,852,403 5 CPT-NT-ED-18-426 Framework for Foundation Apprenticeship 2018-2023 4,000,000 6 NLC-CPT-19-083 Liquid Fuels (SP-19-009) 8,000,000 7 NLC-CPT-21-016 Provision of Digital Connectivity Partner 150,000,000 8 NLC-CPT-21-091 Design and Build Development agreement for construction of Carnbroe and Sikeside Community Hub 24,821,452 9 NLC-CPT-19-090 Janitorial and cleaning products 3,500,000 10 CPT-DS-HSC-18-411 NL Adults and Young Carers Support Services 4,315,264 11 NLC-CPT-20-058 Flexible framework for outdoor education centre 15,500,000 12 NLC-CPT-20-005 MTC-Re-roofing, re-rendering and insulation works 2020-2023 32,500,000
Page 36
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 11 Appendix 3 – Contract and supplier management (C&SM) corporate expectations Key questions that contract management arrangements were assessed against to determine extent of compliance with key corporate expectations in the CSM guidance. Ref Question 1 Has a named contract owner been identified/assigned to the contract? 2 Does the contract owner have appropriate experience and knowledge to undertake the C&SM role? 3 Has the contract owner received appropriate C&SM training to undertake the role? 4 Is the Contract owner aware of their role/responsibility in respect of C&SM and the relationship with the contracted supplier throughout the lifecycle of the contract? 5 Is the Contract owner aware of/have they received a copy of the Council’s Contract & Supplier Management Guidance and proforma C&SM documents? 6 Is the Contract owner aware of the specific tasks and detailed activities (as detailed on page 5 and Appendix 6 of the C&SM guidance) in respect of: • Contract and Relationship Management (Performance and Measurement Structure); • Operational & Administrative Contract and Supplier Management; • Reporting to Senior Management; and • Contract Review. 7 Has the Chief Officer provided the Contract Owner with the appropriate resources to ensure that the contract can be managed and are these resources considered proportionate for the contract? 8 Is there evidence to support a formal handover of the contract from the Corporate Procurement Team (CPT) Lead and Chief Officer to the Contract Owner? 9 Has a proforma Contract Mobilisation document been fully completed which clearly sets out: • The key contract information (including start/end dates, contract value, mobilisation team, contract owner); • Admin set up (including details of any employers/public liability insurances and/or professional indemnity, supplier certifications, ordering/invoicing set up – PECOS/CEDAR refs, risk assessment and escalation process); • Contractual requirements (including the contract methodology and performance requirements); • A contract mobilisation plan (including milestones/actions, responsible owners, key staff, start/end date, dependencies, risks and RAG status); and • Contract management activities (including performance meetings schedule, reporting requirements and service levels/monitoring arrangements. 10 Has a formal assessment of the level of C&SM been undertaken in accordance with the methodology contained within the C&SM Guidance (page 9) i.e. based on size, value, length of contract, business criticality, number of customers, public visibility, performance criteria and risk)?
Page 37
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 12 Appendix 3 (continued) – Contract and supplier management (C&SM) corporate expectations Ref Question 11 Have formal arrangements been put in place to ensure that the contract can be managed in accordance with the agreed level of C&SM: • Low level C&SM – monitoring management information from the supplier/end-user feedback, managing delivery and compliance of the contract using four high level indicators (i.e. cost, quality, delivery and service); • Medium level C&SM – monitoring management information from the supplier/end-user feedback, managing delivery and compliance of the contract using four high level indicators (i.e. cost, quality, delivery and service) plus a minimum of a bi-annual or annual review meeting; and • High level C&SM – monitoring management information from the supplier/end-user feedback, managing delivery and compliance of the contract using four high level indicators (i.e. cost, quality, delivery and service) use of a Balanced Scorecard and quarterly review meetings. 12 Has a Contract Implementation Plan been completed with the following contact information: • Contract title; • Supplier name; • Contract owner; • Key milestones/activities; • Senior responsible officer; • Key staff required to input to the activity; • Start/completion dates; • Dependencies: • Cost: • Relevant risks: and • RAG status. 13 Has a Contract & Supplier Management Plan been fully completed with the following details: • Roles and responsibilities of each of the key contract personnel; • The agreed level of management (low/medium/high); • Contract objectives; • The agreed performance management framework (setting out the expected performance and quality levels to be delivered along with the method by which performance will be monitored, measured, reported and managed); • A summary of the mobilisation plan; • A summary of the Migration plan (from supplier to ‘go live’); • Contract compliance – cost, quality, delivery and service performance indicators; • Escalation process (within supplier organisation and the Council); • A Contract Exit Plan which sets out: o The contract details; o A brief description of the need for an exit plan and the plan itself; o Key milestones/activities; and o The items to be handed over. • Review schedule meeting; • Risks and issues; and • Process for conducting supplier financial checks.
Page 38
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 13 Appendix 3 (continued) – Contract and supplier management (C&SM) corporate expectations Ref Question 14 Is there documented evidence to support the initial/kick-off meeting having been held with the supplier? 15 Is there appropriate evidence held on file to support the contract being managed/monitored in accordance with the approved level of C&SM? i.e. For Low level C&SM contracts is contract/supplier performance being managed through: • A review of management information received from supplier/end-user feedback; and • Is the contract compliance being considered in respect of the agreed performance indicators i.e. o Cost; o Quality; o Delivery & o Service; For Medium level C&SM contracts – is contract/supplier performance managed through: • A review of management information received from supplier/end-user feedback; • Is the contract compliance being considered in respect of the agreed performance indicators i.e. o Cost; o Quality; o Delivery & o Service; and • have review meetings been held with the supplier on a bi-annual or annual basis as a minimum For High Level C&SM contracts – is the contract and supplier performance being monitored/managed using: • A review of management information received from supplier/end-user feedback; • Is the contract compliance being considered in respect of the agreed performance indicators i.e. o Cost; o Quality; o Delivery & o Service; • Are Balanced Scorecards being used to monitor performance in respect of cost, quality, delivery and service (as above); and • have quarterly review meetings been held to monitor performance and are the Balanced Scorecards being discussed routinely at each meeting 16 Are arrangements for undertaking supplier health checks throughout the lifetime of the contract in place and are these are being undertaken at least annually. Do these checks include: • Financial status; • Legislation & regulatory provisions; • Insurances; • Relevant accreditations/registrations; • Corporate social responsibility; • Business probity; • Sustainability and environmental; • Criminal conviction checks; and • Health and safety arrangements.
Page 39
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 14 Appendix 3 (continued) – Contract and supplier management (C&SM) corporate expectations Ref Question 17 Have performance review meetings been held with the suppliers to formally discuss performance and feedback? Does this include formal discussion of, and is there documentary evidence on file to support: • supplier business review & update (including new developments/products, news, customer affecting issues and value adds); • Council business review/SIP update (including SIPS and council performance/issues); • Supplier Scorecard review (high level C&SM contracts); • Current contract performance against target/SLA (including review of contract delivery and issues for escalation); • Contract risk register review (including review of existing risks and mitigating actions, new risks identified, removal of old risks from the register, BCP considerations and contract exit strategy considerations); • Sustainability and community benefits (including social/economic/environmental and other benefits realised); • Financial monitoring (including purchases to pay, invoices/billing, financial sustainability, the results from the latest assessment, issues and supporting guarantees) • Process (if appropriate) including changes to delivery/contract/agreement/SLA, supporting processes and regulatory/statute; • Actions for improvement (including innovations); • Sign posting (including supplier development programme, SW Hub and the Economic Development team); and • Feedback (on council performance for each contract and the scorecard review process). 18 Is there evidence to show that minutes of review meetings, agreed actions and balanced scorecard results have been communicated to all stakeholders following each meeting? 19 Is a risk register maintained for the contract? 20 Are arrangements in place for identifying/managing/ monitoring risks at regular intervals? 21 Is a process in place escalating new/emerging risks to the Chief Officer and/or key stakeholders? 22 For reports provided to senior management in respect of the C&SM process, ensure that the reports contain the following information as a minimum (in accordance with the guidance and CSOs): • Performance; • Compliance with specification and contract terms; • Cost; • Best value requirements; and • User satisfaction and risk management 23 Does the Contract Owner regularly review financial monitoring information for all contracts above £50,000 including monitoring spend against contract value and are variances reported to Senior Management? 24 Has a formal Change Control process been put in place which sets out the respective roles and responsibilities of both the council and the supplier along with the procedures for raising, evaluating, costing and approving change requests? 25 Where changes (variations) have been made to a contract, have sequentially numbered Contract Change Notices been completed which clearly set out: • The reason for the change; • Full details of the change; • Details of the likely impact of the change on the contract; and • Agreement of the change (signed and dated) by both the Contract Owner and the supplier.
Page 40
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.006 - contract management arrangements/a - findings & report/a07a 20230420 contract management final report v1.0 as issued .docx 15 Appendix 3 (continued) – Contract and supplier management (C&SM) corporate expectations Ref Question 26 Have all contract changes been formally recorded in a Contract Change log? 27 Has a formal Contract Exit Strategy been developed as part of the procurement process? 28 Where the contract is due to end within 6-12 months, is there evidence of the Contract Exit strategy being utilised, including a lessons learned review which incorporates feedback from stakeholders, end-users and the supplier? 29 Has a final Performance Review meeting been held with the supplier and have the lessons learned been clearly documented and communicated to the appropriate stakeholders to inform any future procurement process? 30 Has the Contract Owner recorded and provided statistical data on the C&SM activity/outcomes to the Chief Officer (Asset & Procurement) as part of the Annual Procurement report for Scottish Government?
Page 41
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/CITY DEAL/0750.2023.002 City Deal - Assurance work 2022-23/A - Findings and Reports/A06a - 20230424 CITY DEAL Final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT CITY DEAL Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: City Deal Assurance Statement Issued to: Chief Officer (Place) and Chief Officer (Finance) Copied to: City Deal Manager, Business Finance Manager, Deputy Chief Executive and Chief Executive Headlines The purpose of this audit was to provide assurance on the adequacy and effectiveness of the Council's arrangements in respect of its participation in the Glasgow City Region (GCR) City Deal by assessing the extent to which the Council is adhering to key elements of the GCR City Deal Assurance framework with a focus on the processes surrounding the preparation and submission of grant claims, processes in place around change control and conduct of procurement/tendering arrangements in the period. We also extended our audit remit for this exercise to address aspects of an intended audit by the Glasgow City Council Internal Audit Team (in their role as Internal Auditors for the GCR Cabinet) on Project Procurement Strategies. This work involved reviewing the project procurement arrangements designed to help achieve competitive bids and value for money and seeking assurance that there are appropriate controls in place particularly surrounding supply chain and supplier continuity risk identification and management. Internal Audit is also required to return an annual assurance statement to Head of Audit at Glasgow City Council, in their role as the lead auditor for the GCR City Deal, and this work will underpin the completion of the statement for 2022-23. Based on the results of our work, we have concluded that: • we are satisfied that during 2022-23 the Council complied with the GCR Assurance Framework; • the City Deal team has substantively complied with the Council’s General Contract Standing Orders in its procurement/tendering processes for City Deal projects; • the Council has continued to successfully apply expected governance arrangements in relation to the planning, controlling, monitoring and oversight of City Deal projects; and • City Deal grant claims in 2022-23 were properly prepared and submitted in accordance with the terms and conditions under which the grant award was made, the funds have been used for the intended purposes in accordance with the relevant terms and conditions under which the grant is made and the sums claimed are properly due. We have categorised the audit as offering ‘substantial assurance’ as the control environment appears adequate and to have operated as intended with only a small number of minor discrepancies or areas for improvement identified which are outlined in the Action Plan at Section 3. Based on the results of this review and our other knowledge and understanding of the Council’s arrangements, we have returned an assurance statement for City Deal to Glasgow City Council Internal Audit which states that there are no significant matters that require to be raised which could have a material impact on the GCR Annual Assurance Statement for financial year 2022-2023 (Appendix 2). Internal Audit Opinion (see definition at Appendix 1) Substantial assurance Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0750/2023/002 Date issued 24/04/2023 Audit Team Elaine MacDonald, Paula Hendry and Hugh Shevlin
Page 42
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/CITY DEAL/0750.2023.002 City Deal - Assurance work 2022-23/A - Findings and Reports/A06a - 20230424 CITY DEAL Final report v1.0 as issued.docx 2 1. Executive Summary Objectives The audit was designed to assess the extent to which the Council is adhering to key elements of the GCR City Deal Assurance framework with a focus on the processes surrounding change control, the preparation and submission of grant claims and reviewing the regularity, or otherwise, of any relevant procurement/tendering arrangements. In addition, we extended our audit remit to address aspects of an intended audit by the Internal Auditors for the GCR Cabinet (Glasgow City Council Internal Audit Team) on Project Procurement Strategies for which North Lanarkshire Council had been selected for sample testing. The main additional areas of control considered were engagement with LPSG meetings, including communication with colleagues in member authorities to feedback on relevant procurement challenges and share lessons learned, that supplier continuity risks and supplier chain risk management are identified, documented and mitigation actions put in place and suitable management information is provided to the appropriate groups for scrutiny. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 0 1 Key areas requiring management action (High) No key areas requiring urgent management action have been identified. Good practice identified • We noted the following areas of good practice during the audit: • The Service has substantially complied with the Council’s General Contract Standing Orders in its procurement/tendering processes for City Deal projects; • The Council has established a series of governance arrangements in relation to the planning, delivery, controlling, monitoring and oversight of projects which is consistent with the requirements set out in the Glasgow City Region Assurance Framework 2019; • Change control processes are in place and are operating in line with identification, monitoring and reporting expectations; • Grant claims for 2022-23 have been prepared and submitted in accordance with the terms and conditions under which the grant award is made; and • NLC is represented on and attends meetings of the Procurement Support group (PSG) and Sustainable Procurement Strategy Group (SPSG) which replaced the LPSG. Lessons learned by individual authorities are shared at these meetings for others to reflect upon. Other areas for improvement (Medium) No other areas for improvement were identified.
Page 43
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/CITY DEAL/0750.2023.002 City Deal - Assurance work 2022-23/A - Findings and Reports/A06a - 20230424 CITY DEAL Final report v1.0 as issued.docx 3 3. Action Plan CITY DEAL 0750/2023/002 Ref Finding 1 Grant claims generally appeared accurate, fairly stated and the expenditure claimed was consistent with the terms and conditions of the grant offer, although some discrepancies were identified. While the results of our review of the Council’s grant claim processes was generally satisfactory, we noted: • the grant claim for quarter 2 of 2022/23 differed from the financial ledger by £6,691 (grant claim was less than ledger balance). We ascertained that this difference was costs that were to be funded by NLC directly and which had been posted to the already established City Deal ledger codes. This is because current cost centre and account codes are arranged to manage City Deal costs, however, some costs attributable to NLC and which are not rechargeable to City Deal grant funding, have also been posted here. We understand it is Finance’s intention to create new and separate cost centres for the NLC funded elements related to City Deal projects to be allocated to; • there were several coding errors on the City Deal projects ledger accounts that had not been corrected at the earliest opportunity. These were due mainly to invoices not being coded to the correct cost centre/account code initially and a delay in the Service City Deal Team actioning requests to correct these. While these had been in the main adjusted as part of the grant claim analysis, we understand the intention is to correct any still wrongly coded as part of the year end process (note – no impact on amounts claimed but purpose is to ensure all individual City Deal projects cost centres are accurate); and • salaries of the City Deal team are apportioned to the City Deal projects they work on. We noted salary for a vacant post had been capitalised, apportioned and claimed in quarter 2 of 2022/23. While the expectation had been to fill this post earlier, this had not happened. Further checks confirmed costs for this vacant post had also been claimed in part of quarter 1 and 3 grant claims for 2022/23. We understand that the Finance team intend to correct this overclaim at the year-end within the Q4 claim. Implication Recommendation Priority Management response Implementation Month/Year Control of ongoing capital expenditure for individual projects may be compromised. Expenditure may not be claimed on a timely basis and/or in accordance with the terms and conditions of the grant award. The Chief Officer (Finance) should: (1) ensure that separate ledger codes to record NLC funded elements of City Deal project costs are created promptly and used thereafter; (2) remind the City Deal team of the need to ensure invoices are coded accurately to the correct project account, or where invoices have been wrongly coded, that corrections are made in a timely manner; and (3) ensure that arrangements are put in place as part of the quarterly grant claim process to ensure that salaries are apportioned and claimed for employees only where costs have actually been incurred and that any overclaims are adjusted/reflected in subsequent claims at the earliest opportunity. Low Agree Greg Telfer, Business Finance Manager The Service will ensure all aspects of the recommendations are implemented in full. April 2023
Page 44
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/CITY DEAL/0750.2023.002 City Deal - Assurance work 2022-23/A - Findings and Reports/A06a - 20230424 CITY DEAL Final report v1.0 as issued.docx 4 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 45
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/CITY DEAL/0750.2023.002 City Deal - Assurance work 2022-23/A - Findings and Reports/A06a - 20230424 CITY DEAL Final report v1.0 as issued.docx 5 Appendix 2 Glasgow City Region – City Deal North Lanarkshire Council Assurance Statement 2022-2023 1. Purpose of Statement The purpose of this statement is to provide assurance that sound internal control and governance arrangements exist within North Lanarkshire Council in relation to City Deal, and that no material issues have been identified which may directly or indirectly have an effect on the delivery of the City Deal programme. Any issues which are identified will be used to inform the Glasgow City Region Annual Assurance Statement for financial year 2022-2023. 2. Assurance by Chief Officer (Audit and Risk), North Lanarkshire Council North Lanarkshire Council seeks at all times to adhere to the laws and regulations relating directly to the financial statements and the laws, regulations and the local code of governance under which the organisation conducts its business. I confirm that any issues identified which may have a negative impact on the City Deal programme (such as cases of actual or potential non-compliance with relevant laws and regulations, significant failures in the control environment and all known or suspected cases of fraud) have been reported to the Head of Audit of Glasgow City Council (previously, or as set out below). While I acknowledge that no system of control can ever give an absolute assurance that all transactions are properly processed, all errors have been prevented, and all policies and procedures have been fully implemented throughout the organisation I can confirm that there are no known material issues which have not been considered in the completion of this Assurance Statement. 3. Declaration There are, in my opinion, no significant matters that require to be raised in this statement which would have a material impact on the Glasgow City Region Annual Assurance Statement for financial year 2022-2023. It is my opinion that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s framework of governance, and financial controls in relation to City Deal for the year ended 31 March 2023. Ken Adamson Chief Officer (Audit and Risk), North Lanarkshire Council 24 April 2023
Page 46
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT CORPORATE GOVERNANCE – PRINCIPLES C and D Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Appendix 2: Good Governance Principles C and D Issued to: Chief Officer - Business and Digital (point 2 and 3) Chief Officer - People Resources (point 1(2)), Chief Officer – Legal and Democratic (point 1(1)) and Chief Officer (Audit and Risk) (point 1(3)) Copied to: Strategy and Performance Manager, Depute Chief Executive and Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s arrangements for ensuring that it complies with Principles C and D of the CIPFA/SOLACE ‘Delivering Good Governance in Local Government Framework (2016)’. • Principle C relates to ‘Defining outcomes in terms of sustainable economic, social, and environmental benefits’. • Principle D relates to ‘Determining the interventions necessary to optimise the achievement of the intended outcomes’. As part of the audit, we assessed existing Council operational practices and management arrangements against the relevant sub-principles cited in the framework (see Appendix 2). We also considered the extent to which recommendations raised in previous Internal Audit reports on corporate governance had been progressed by management and reviewed the robustness and effectiveness of the Council’s Strategic Governance and Strategic Self-evaluation Frameworks in so far as they relate to compliance with the Delivering Good Governance Framework. Based on the results of our work, together with our wider general knowledge gained from previous Internal Audit reviews undertaken on this topic and work on other associated areas, we consider that the Council’s corporate governance arrangements in relation to the areas examined are generally adequate and appear to have operated effectively. We have, therefore, assessed the audit as providing ‘reasonable assurance’. We were pleased to note that as part of the annual review of the Council’s Strategic Governance Framework, the Council had undertaken a full self-assessment of its Local Code of Governance against the Good Governance framework. We consider that this process, which was endorsed by the Corporate Management Team (June 2022) and approved by the Audit and Scrutiny Panel (September 2022), was generally robust. In addition, we noted that the corporate self-assessment indicated a high level of compliance with the corporate governance framework, which was broadly consistent with Internal Audit’s assessment of Principles C and D. We have however, identified a small number of areas where we consider scope for improvement exists and/or where further action is required to fully address some of the recommendations made in previous audit reports in this area. These are identified in the action plan at Section 3 and include the need for management to take further action to ensure that key documents are reviewed, updated as appropriate and implemented/communicated to relevant staff. Internal Audit Opinion (see definition at Appendix 1) Reasonable assurance (Green-Amber) Organisational impact (see definition at Appendix 1) Moderate Report status FINAL Audit ref 0900/2023/009 Date Issued 03/05/2023 Audit Team Jacquie Howden and Paula Hendry
Page 47
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 2 1. Executive Summary Objectives The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of the Council’s arrangements for ensuring that it complies with Principles C and D of the CIPFA/SOLACE ‘Delivering Good Governance in Local Government Framework’ (2016) (‘the framework’). Principle C relates to ‘Defining outcomes in terms of sustainable economic, social, and environmental benefits’ whilst Principle D relates to ‘Determining the interventions necessary to optimise the achievement of the intended outcomes’. In particular, our work was designed to offer an audit opinion on the following: • Does the Council comply with Principles C and D of the Delivering Good Governance Framework? • Has the Council progressed previous Internal Audit recommendations in relation to corporate governance? • Does the Council have robust and effective arrangements in place to self-evaluate its compliance with the Delivering Good Governance Framework, including arrangements to agree and progress any improvement actions identified? • Is Internal Audit’s assessment broadly consistent with any self-assessment undertaken by management? As part of the audit, we assessed the existing Council operational practices and management arrangements against the relevant sub-principles cited in the framework (see Appendix 2). We also considered the extent to which previous recommendations in relation to corporate governance had been progressed by management and reviewed the status, adequacy, robustness and effectiveness of the Council’s strategic governance framework and self-evaluation framework in so far as they relate to compliance with the Delivering Good Governance Framework. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 1 2 Key areas requiring management action (High) There were no key areas identified which required urgent management action. Good practice identified We noted the following areas of good practice during the audit: • A formal self-assessment of the Council’s Local Code of Conduct against the CIPFA Delivering Good Governance Framework 2016 has been completed for 2021/2022 and there are formal and generally robust arrangements in place to ensure that such reviews are undertaken on an annual basis. • The Council has a range of supporting documentation, policies and procedures in place which are consistent with good practice and which embrace the supporting principles of the Good Governance Framework. These include a Scheme of Administration, Scheme of Delegation, Financial Regulations, Risk Management Strategy and Communications strategy. • The Council has a formal strategic governance framework in place to support the Plan for North Lanarkshire (‘The Plan’) and its one Council approach. This includes six inter-related frameworks which are key to monitoring delivery towards the Council’s overall vision and ensuring that each stage is appropriately planned, guided, implemented and governed. • The Strategic Performance Framework (SPF) was approved in February 2019 and comprises a group of performance indicators at three levels which collectively provides an overview of performance to held understand the impact of the Council’s activities on improving the services and outcomes for people and communities in North Lanarkshire. Formal reporting arrangements have been put in place to ensure that periodic performance reports are being presented to committee.
Page 48
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 3 Good practice identified (continued) We noted the following areas of good practice during the audit: • The Council robust financial plans and strategies in place which set out the framework for sound financial governance, planning and management of resources to support ‘The Plan’ and the financial planning assumptions relating to future revenue grants and other funding as well as clearly setting out the increasing cost pressures on the council. • The Council has formal arrangements in place for engaging with Communities through the ‘Community Matters – Working with Communities framework’ (approved in 2019) and ‘Delivering for Communities’ (approved in 2020) and a locality community planning model which includes nine Community Boards. The arrangements are currently being further developed with a view to strengthening community participation in decision-making processes. • The 5-year Medium Term Financial Plan (MTFP) sets out a range of risk-based outcomes together with the key challenges in meeting medium term financial sustainability for financial planning purposes; • There is a formal timetable for committee meetings with robust arrangements in place for ensuring committee papers are submitted in accordance with the expected timescales/frequencies. • The Council’s website contains copies of all key strategies and other information to inform service users and other key stakeholders of the council’s activities and any planned consultations. Other areas for improvement (Medium) An area for improvement was identified: • Management needs to ensure that key documents are reviewed, updated as appropriate and implemented/communicated to relevant staff.
Page 49
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 4 3. Action Plan (continued) Corporate Governance – Principles C and D 0900/2023/009 Ref Finding 1 Management needs to ensure that key documents are reviewed, updated as appropriate and implemented/communicated to relevant staff. The Corporate Management Team (CMT) is responsible for ensuring that the Strategic Governance Framework provides the most up-to-date evidence to inform the development of the Annual Governance Statement and that policies, strategies and other documents due for review are reported to Committee in accordance with the expected timescales. As part of the review of implementation of progress in implementing actions identified in our previous Internal Audit report on Corporate Governance in February 2022, we noted a number of key corporate documents which had not been recently reviewed in accordance with their expected timescales including: • the Council’s Scheme of Delegation to Officers was last updated in April 2019. The document requires to be updated to reflect the recent approved restructure (most recently the ‘One Place One Plan – Governance Update report’ – December 2022). We understand that work is currently underway with services given a deadline of mid-May to provide all proposed amendments and a report is due to be presented to Policy and Strategy Committee by June 2023; • the Code of Conduct for Chief Officers has not been updated since 2017. There was a management commitment to review/refresh this document for both the 2020/21 and 2021/22 assessments by March 2022 and 2023 respectively. We understand, however, that the review is now scheduled to commence in April 2023 with a report due to be presented to Policy and Strategy Committee in June 2023; • the Code of Conduct for Employees has not been updated since March 2021. There was a management commitment to review/refresh this document and consider the alignment/refresh of the Codes for the former Culture NL and NL Leisure employees (as appropriate) by October 2022. The timescale for completing this has now been extended to September 2023. In the meantime, management had also committed to issue an all users email to staff by January 2023 to remind them of their duties under the Code. We understand that this email has not yet been issued, but that it is due to be issued later in 2023 as part of a wider email which will also include reference to the revised Whistleblowing policy. We also noted that work is currently underway on developing the mandatory training course for the Code and this is expected to be launched during 2023. This is later than anticipated due to resource issues and competing demands within the TOD service. We understand that a first draft of the eLearning course for the Code has been prepared and is currently being reviewed by the Employee Relations team. We understand that once this has been completed the module will be rolled out to all staff on LearnNL; • the PRD process was last reviewed in 2017 and management had committed to review the process and associated documentation by March 2022 to reflect the changes regarding home working and the requirements for digital skills as part of the Digital NL programme. We understand that the review has now been undertaken and that the Learn NL functionality has now been enabled to allow staff to record their PRD conversation. We also understand that the new PRD process is due to be launched from April 2023, with the Talent and Organisational Development Team due to raise awareness sessions from May 2023; and • The Corporate Anti-Fraud Policy and Response Plan has not been updated since 2017 and requires to be reviewed to ensure that the policy properly reflects how the council responds to fraud following staffing and organisational changes. A review of the Council’s anti-fraud arrangements including review of this policy was included in the 2022-23 annual Internal Audit Plan and we understand this assignment is now underway, with a report due to be presented to the Policy and Strategy Committee in October 2023. Implication Recommendation Priority Without regular review, key corporate policies may not be appropriate or accurately reflect the Council’s arrangements and/or staff and other key stakeholders may not be aware of the most up to date policies and procedures. (1) The Chief Officer (Legal and Democratic) should ensure that the Scheme of Delegation to Officers is reviewed and updated in line with the revised timescales above; (2) The Chief Officer (People Resources) should ensure that the appropriate arrangements are put in place to allow for key HR related documents referenced in the finding above to be reviewed/refreshed and communicated to staff and that these are monitored to ensure revised timescales are achieved; and (3) The Chief Officer (Audit and Risk) should ensure that the Corporate Anti-Fraud Policy is reviewed/updated and reported in line with the expected timescales. Medium
Page 50
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 5 3. Action Plan Corporate Governance – Principles C and D 0900/2023/009 Management response Implementation Month/Year (1) Agree Andrew Rose – Democratic Services Manager The Scheme of Delegation to Officers is currently in the process of being reviewed, with all Services having been requested to provide their required changes by 19 May 2023. Thereafter, Legal Services will carry out a check of all statutory references to ensure that these are accurate prior to a report on the revisions to the Scheme being submitted firstly to the Corporate Management Team and then to the Council meeting on 22 June 2023. Archie Aitken - Chief Officer (Legal & Democratic) The Chief Officers’ Code of Conduct is currently being reviewed and a report will be submitted to the Corporate Management Team and then to the Policy & Strategy Committee on 8 June 2023. (2) Agree Fiona Whittaker – Chief Officer (People Resources) The Code of Conduct for Employees is currently being reviewed to consider the alignment of the former Culture NL and NL Leisure employees, where appropriate, and is on track for completion by September 2023. An all-users announcement will be issued thereafter to ensure that all staff are aware of the Code and their respective duties. A mandatory eLearning module on the Code of Conduct has been developed and an announcement was issued to staff in April 2023 regarding the new module and the need to complete it every two years. Agree Fiona Whittaker – Chief Officer (People Resources) As detailed in the report, the PRD process has been reviewed and the Learn NL system functionality has been enabled to allow staff to record their PRD conversations. Following an initial pilot of the new system earlier in the year, a report will be considered by BMT on 11th May 2023 to agree the full roll out and launch of the PRD process and supporting system. Full promotion of the new system approach will be undertaken as part of learning at work week in June, with further engagement and training available to support wider adoption following the launch. (3) Agree Ken Adamson, Chief Officer (Audit and Risk) As referenced in the finding above, the review of the Corporate Anti-Fraud Policy and Response Plan is underway and a refreshed anti-fraud policy will be reported to Policy and Strategy Committee during cycle 3 of 2023. June 2023 June 2023 September 2023 June 2023 October 2023
Page 51
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 6 3. Action Plan Corporate Governance – Principles C and D 0900/2023/009 Ref Finding 2 Management needs to consider how best to evidence the process for identifying, recording and reporting improvement actions and/or future planned developments in relation to key governance arrangements. The ‘Strategic Governance Framework – annual review and refresh’ report presented to the Corporate Management Team (CMT) in June 2022 sets out the requirement under the CIPFA ‘Delivering Good Governance in Local Government framework’ for Council’s to test their arrangements against the good governance principles on an annual basis; ensure that the local code is up to date; and to report on compliance with the code. The report also sets out the CMT’s dual role in the review process in respect of ensuring the local code is assessed on an annual basis to ensure ongoing effectiveness and compliance and identifying any improvement actions and/or future planned developments in relation to key governance arrangements and continuous improvement activity. As part of the audit, we considered the adequacy and effectiveness of the Council’s process for reviewing and assessing its level of compliance with the framework and the extent to which CMT had fulfilled its dual role in this process. We were generally satisfied that appropriate and robust arrangements were in place to ensure that the assessment against the framework had been undertaken in accordance with the expected timescales and that the specific governance and strategic oversight and accountability elements included from the Programme of Work for 2022-2023 (as agreed with CMT) had been appropriately incorporated into the review process. We were also pleased to note that the process, which had been endorsed by the CMT (June 2022) and approved by the Audit and Scrutiny Panel (September 2022), demonstrated a high level of compliance with the Corporate Governance framework and was broadly consistent with the assessment undertaken by Internal Audit in relation to Principles C and D. We noted areas within the current arrangements, however, where we consider that there is scope to further improve the arrangements in respect of the CMT’s role for identifying, recording and reporting improvement actions and/or areas of continuous improvement in accordance with their remit. In particular, we noted that the annual Chief Officer’s Certificate of Assurance, which is used to inform the Annual Governance Statement (AGS), did not explicitly require Chief Officers to confirm that their governance arrangements had incorporated any areas for improvement arising from the work of others such as Internal Audit, External Audit, and other external review, regulatory or inspection bodies. Neither were Services asked to reflect on progress against any issues arising from the Council’s self-evaluation framework and/or Services ’own internal review processes. In addition, we noted that the Council’s Annual Governance Statement (AGS) generally contained expected commentary, however, there was only very high-level information regarding improvement actions. Although we were pleased to note detail was included regarding continuous improvement and reference to audit outputs as well as the outcome of rolling reviews undertaken during the year as part of the self-evaluation framework, the narrative regarding the resultant improvement actions was very limited. We consider that the AGS may benefit from inclusion of specific commentary around progress made on improvement actions identified in prior years as well as planned improvement activity that will be undertaken in the year ahead. Implication Recommendation Priority Management response Implementation Month/Year Without formal documented processes in place, the CMT would be unable to evidence that they were fulfilling their role of identifying, recording and reporting improvement actions and/or future planned developments in key governance arrangements. Improvement actions may not be adequately identified and/or acted upon. The Chief Officer (Business and Digital) should: (1) In reviewing the Annual Assurance Checklists for 2023-24 consider whether a question regarding identification and completion of relevant specific improvement activity/actions within their area of responsibility should be included; and (2) in preparing the AGS consider including specific commentary around progress made on improvement actions identified in prior years as well as planned improvement activity that will be undertaken in the year ahead to better allow key stakeholders to monitor performance. Low Agree Katrina Hassell, Chief Officer (Business and Digital) With the Annual Assurance Checklist process having been in place for a number of years with minimal changes, a substantial review has been scheduled to be undertaken by the end of 2023 with a view to implementing the updated checklist for the 2023/24 year-end process. Any further/future amendments to the Annual Governance Statement process will be considered, if relevant, when there has been time to review the Annual Assurance Checklist. This review will give due consideration to the issues raised in this finding. A report will be presented to CMT to ensure all Chief Officers are sighted on, and endorse, the new process and their role and responsibilities therein. March 2024
Page 52
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 7 3. Action Plan (continued) Corporate Governance – Principles C and D 0900/2023/009 Ref Finding 3 Management should ensure that the planned review of the effectiveness of the Community Boards is completed in accordance with the agreed extended timescales. In our previous Internal Audit report on Corporate Governance (March 2021) we recommended that the Chief Executive should, after allowing a sufficient period of time for the new Community model and individual Boards to become established, undertake a formal review (or self-assessment) of the effectiveness of the Community Boards. Management commitment was initially given to undertaking work during 2022. This timescale has been extended to March 2023. We understand that changes to the CMT arrangements and the North Lanarkshire Partnership Strategic Leadership Board (NLP SLB) meeting dates were responsible for impacting on the original timescales. We noted that a self-assessment exercise was built into the Strategic Self-evaluation Framework rolling review programme for 2022-23 (as approved by CMT in October 2022) with a view to concluding in cycle 1 of 2023. The scope for the self-evaluation was agreed by CMT and we understand that the exercise is currently underway, led by the Chief Officer (Business and Digital) as the responsible officer and the Chief Officer (Audit and Risk) as the Champion for this self-evaluation on behalf of the CMT. The Strategy and Performance Manager (the project manager for the self-evaluation) has advised that the results from an online survey, which was facilitated independently by the Improvement Service, are expected to be received by the end of March 2023. We understand that, following an analysis of the survey results, the outcome of the process will be reported to ley stakeholders. Implication Recommendation Priority Management response Implementation Month/Year The operating model may result in Community Boards failing to discharge their roles and responsibilities adequately or effectively which may impact on the achievement of the shared ambition. Without formal plans to monitor/manage progress on previously agreed management actions, timescales for the implementation dates may be missed in error. The Chief Officer (Business and Digital) should ensure that appropriate action is being taken to enable the self- evaluation of the Community Boards to be completed in accordance with the expected timescales for completion and reporting with any issues arising taken forward as appropriate. Low Agree Katrina Hassell, Chief Officer (Business and Digital) / Ken Adamson, Chief Officer (Audit and Risk) – independent Champion for the self- evaluation exercise. In line with the report from the Self-Evaluation Champion to the CMT in November 2022, a subsequent report was presented from the Champion to the North Lanarkshire Partnership Strategic Leadership Board on 21 April 2023. This outlined the findings from the set of three inter-related exercises (that includes the Community Boards) and the emerging areas for improvement and suggested next steps. In this respect, the Strategic Leadership Board agreed the next steps which included an improvement planning session to be facilitated by the Improvement Service towards the end May or early June which is expected to result in a prioritised series of improvement actions being identified and agreed. The results of this planned session (agreed improvement actions and responsible officers/timescales) will then be reported formally through the Council’s governance arrangements and to key stakeholders as appropriate. An update report to CMT in May 2023 will ensure the senior management team of the Council are updated on the progress of the self-evaluation exercise including the decision of the Strategic Leadership Board as to how the exercise will now be progressed. September 2023
Page 53
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 8 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.
Page 54
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 9 Appendix 2 – Good Practice Principles C and D The core principles and sub principles of good governance set out in the 2016 CIPFA/Solace ‘Delivering good governance in Local Government Framework (‘the framework’) are taken from the International Framework: Good Governance in the Public Sector (IFAC/CIPFA 2014) and interpreted for a local government context. It is the responsibility of each local authority to: (1) Set out its commitment to the principles of good governance included in the framework; (2) Determine its own governance structure or local code by these principles; and (3) Ensure that it operates effectively in practice. Principle C: Defining outcomes in terms of sustainable economic, social, and environmental benefits Sub-principles 1. Defining outcomes 1.1 Having a clear vision, which is an agreed formal statement of the organisation’s purpose and intended outcomes containing appropriate performance indicators, which provide the basis for the organisation’s overall strategy, planning and other decisions 1.2 Specifying the intended impact on, or changes for, stakeholders including citizens and service users. It could be immediately or over the course of a year or longer 1.3 Delivering defined outcomes on a sustainable basis within the resources that will be available 1.4 Identifying and managing risks to the achievement of outcomes 1.5 Managing service user’s expectations effectively with regard to determining priorities and making the best use of resources available 2. Sustainable, economic, social and environmental benefits 2.1 Considering and balancing the combined economic, social and environmental impact of policies and plans when taking decisions about service provision. 2.2 Taking a longer-term view with regard to decision making, taking account of risk and acting transparently where there are potential conflicts between the organisation’s intended outcomes and short-term factors such as political cycle or financial constraints 2.3 Determining the wider public interest associated with balancing conflicting interests between achieving the various economic, social and environmental benefits, through consultation where possible, in order to ensure appropriate trade-offs 2.4 Ensuring fair access to services
Page 55
https://nlcgov.sharepoint.com/sites/aur-internalauditfiles/shared documents/planned work/2022-23/0900.2023.009 - corporate governance - principles c & d/a - findings and report/a05 20230503corporate governance final report v1.0 as issued.docx 10 Appendix 2 – Good Governance Principles C and D (continued) Principle D: Determining the interventions necessary to optimise the achievement of the intended outcomes Sub-principles 1. Determining interventions 1.1 Ensuring decision makers receive objective and rigorous analysis of a variety of options indicating how intended outcomes would be achieved and associated risks therefore ensuring best value is achieved however services are provided 1.2 Considering feedback from citizens and service users when making decisions about service improvements or where services are no longer required in order to prioritise competing demands within limited resources available including people, skills, land and assets and bearing in mind future impacts 2. Planning interventions 2.1 Establishing and implementing robust planning and control cycles that cover strategic and operational plans, priorities and targets 2.2 Engaging with internal and external stakeholders in determining how services and other courses of action should be planned and delivered 2.3 Considering and monitoring risks facing each partner when working collaboratively, including shared risks 2.4 Ensuring arrangements are flexible and agile so that the mechanisms for delivering goods and services can be adapted to changing circumstances 2.5 Establishing appropriate key performance indicators (KPI’s) as part of the planning process in order to identify how the performance of services and projects is to be measured 2.6 Ensuring capacity exists to generate the information required to review service quality regularly 2.7 Preparing budgets in accordance with objectives, strategies and the medium-term financial plan 2.8 Informing medium and long-term resource planning by drawing up realistic estimates of revenue and capital expenditure aimed at developing a sustainable funding strategy. 3. Optimising achievement of intended outcomes 3.1 Ensuring the medium-term financial strategy integrates and balances service priorities, affordability and other resource constraints 3.2 Ensuring the budgeting process is all-inclusive, taking into account the full cost of operations over the medium and longer term 3.3 Ensuring the medium-term financial strategy sets the context for ongoing decisions on significant delivery issues or responses to changes in the external environment that may arise during the budgetary period for outcomes to be achieved while optimising resource usage 3.4 Ensuring the achievement of ‘social value’ through service planning and commissioning
Page 56
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.008 - Welfare and Poverty Related Grants/A - FINDINGS AND REPORT/A05A 230424 Welfare Payments Final Report .docx 1 INTERNAL AUDIT REPORT COST OF LIVING CRISIS - WELFARE AND POVERTY RELATED PAYMENTS Contents 1. Executive Summary 2. Findings and Recommendations 3. Action Plan Appendix 1: Audit grading Issued to: Chief Officer (Finance), Chief Officers (Education – North and South), Chief Officer (Housing Management) Copied to: Business Finance Manager (Resource Solutions), Housing Solutions Manager, Chief Executive and Deputy Chief Executive Headlines The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of controls associated with a number of cost-of-living crisis, welfare and poverty related payment schemes administered by the Council. The review focused on whether there are adequate controls in place to ensure that funding is properly targeted and that the Council has adequate and effective grant administration processes in place to ensure payments are properly controlled and made only to those who meet the relevant criteria for eligibility. Significant funding has been allocated, both from the Scottish Government and from the Council’s own resources, to respond to both the increasing financial insecurity of people on lower incomes and the increasing rate of poverty arising from the economic impacts of both the pandemic and, more recently, the cost-of-living crisis. Proposals for the use of the Council’s Local Authority Covid Economic Recovery Fund (LACER) to assist residents impacted by the cost of-living crisis were approved by the Policy and Strategy Committee in September 2022. Funding has been allocated across several different areas and is targeted at a range of groups including those at greatest risk of fuel poverty; lower-income families with children and those most likely to be at risk of, or experiencing, acute financial distress. Funding streams reviewed by Internal Audit as part of this exercise included fuel hardship payments, tenant hardship rent grants and various other payments open to families eligible to free school meals and/or school clothing grants as a result of their low incomes. Based on the results of our work, we have categorised this audit as offering ‘substantial assurance’ as we consider that the grant administration processes are adequate and have operated substantially as intended with any control issue or weaknesses identified presenting only a low risk to the control environment. We were also pleased to note that funding is being targeted at those most in need and that the processes in place generally mean that payments are being adequately controlled and being made only to those who meet the relevant criteria for eligibility. We have, however, identified a small number of areas where scope for further improvement exists and accordingly, we have made a small number of recommendations for management attention at section 3 of this report. Internal Audit Opinion (see definition at Appendix 1) Substantial assurance (Green) Organisational impact (see definition at Appendix 1) Minor Report status FINAL Audit ref 0900/2023/008 Date issued 24/04/2023 Audit Team Lynn McCrum, Paula Hendry, Jacqueline Struthers and Elizabeth Sweeney
Page 57
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.008 - Welfare and Poverty Related Grants/A - FINDINGS AND REPORT/A05A 230424 Welfare Payments Final Report .docx 2 1. Executive Summary Objectives The purpose of this audit was to provide independent assurance on the adequacy and effectiveness of controls associated with a number of cost of living, welfare and poverty related payment schemed administered by the Council. The key control objectives reviewed and tested during the audit considered whether: • the grant administration processes are adequate and efficient with payments made only to those who are eligible; and • funding is appropriately targeted at those persons who are likely to be eligible and in greatest need. Substantive testing was carried out on a sample of applications and/or payments made in respect of the Fuel Hardship Payment; Pensioner Fuel Grant; NL Child Payment; Scottish Child Bridging Payment and Free School Meals Holiday Payment. In addition, we assessed the adequacy of the monitoring and reporting of performance information in respect of these payments. This exercise was not designed to offer assurance on the appropriateness of the eligibility criteria determined by the Council for the aforementioned funding streams. This engagement has been conducted in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section reports formally on conformance with these standards to the Audit and Scrutiny Panel. 2. Findings and Recommendations Number and category of recommendations raised (see definition of priority at Appendix 1) High Medium Low 0 0 2 Key areas requiring management action (High) There are no key areas requiring urgent management action identified during the audit. Good practice identified We noted the following areas of good practice during the audit: • An extensive communications and social media campaign has been undertaken in an attempt to reach those persons eligible for the Fuel Poverty Payment. • Eligibility criteria has been clearly defined and is being applied when assessing applications and/or making payments in respect of the welfare and poverty related payments. • Second officer checks are being undertaken on Fuel Poverty Payment applications. • Checks to identify potentially duplicate payments and confirm payee bank details are being undertaken. • Payment files are appropriately reviewed and authorised prior to being issued to Creditors for payment. • There is regular performance monitoring and reporting of relevant data to management and Committee. Other areas for improvement (Medium) No areas for improvement were identified.
Page 58
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.008 - Welfare and Poverty Related Grants/A - FINDINGS AND REPORT/A05A 230424 Welfare Payments Final Report .docx 3 3. Action Plan Cost of living crisis - Welfare and Poverty related payments 0900/2023/008 Ref Finding 1 Checks should be undertaken as appropriate to ensure that payments are made to all persons assessed as eligible for those payments based on entitlement to Free School Meals and/or Clothing Grants. Children who are of school or nursery age and have been assessed as eligible for Free School Meals on a low-income basis and/or Clothing Grant are also eligible for NL Child Payment. Children who are of school age and entitled to Free School Meals on a low-income basis are also eligible for Scottish Child Bridging Payment and Free School Meals Holiday Payment. These are automatic payments and there is no application process. Payments of these funding streams are made based on the data held on the Free School Meals module on the SEEMIS Click & Go system. The NL Child Payment and Scottish Child Bridging Payment is administered by Financial Solutions and the Free School Meals Holiday Payment is administered by Education and Families. We selected a sample of persons eligible for Clothing Grants and/or Free School Meals on a low-income basis and checked records held by Financial Solutions and Education and Families to ensure that payment of the NL Child Payment; Scottish Child Bridging Payment and Free School Meals Holiday Payment were only made to those persons who had been assessed as eligible. While we found no payments being made to those not eligible, we did identify one case where the child had not received the NL Child Payment despite being entitled due to their eligibility for a Clothing Grant. The Revenue and Benefits Manager (Business Development & Performance) investigated this and identified an issue whereby a small number of children’s records had the Free School Meals box on SEEMIS Click & Go ticked but not approved. This resulted in them not appearing on the reports run from the system which were used by Financial Solutions and Education and Families to make payments. There were six cases where the child was entitled to, but had not received, NL Child Payment and the Autumn and Winter Scottish Child Bridging Payments and five cases where the child was entitled to but had not received the NL Child Payment. The Revenue and Benefits Manager (Business Development & Performance) advised that manual payments would now be made in respect of those persons identified and that Education and Families had been notified of the issue and requested to make Free School Meals Holiday Payments for holidays and strike days that have been missed. Implication Recommendation Priority Management response Implementation Month/Year Payments may not be made to those who are eligible and in need. The Chief Officer (Finance) should ensure that where these grant schemes continue, or similar grant schemes are put in place, appropriate checks are routinely undertaken prior to future payments being made in respect of those payments based on entitlement to Free School Meals and/or Clothing Grants, to ensure that any cases applied for but not approved are identified to prevent a similar issue arising to that referenced in the finding above. Low Agree Greg Telfer, Business Finance Manager The Service will ensure that any similar future payment schemes of this nature incorporate checks to capture all eligible pupils. April 2023
Page 59
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.008 - Welfare and Poverty Related Grants/A - FINDINGS AND REPORT/A05A 230424 Welfare Payments Final Report .docx 4 3. Action Plan (continued) Cost of living crisis - Welfare and Poverty related payments 0900/2023/008 Ref Finding 2 We identified a small number of issues regarding the Fuel Hardship Payment and Pensioner Fuel Grant. Two fuel hardship funds (Fuel Hardship Payment and the Pensioner Fuel Grant) were established by the Council and both are administered by the Revenues and Benefits section within Financial Solutions. The Fuel Hardship Payment is an NLC discretionary payment aimed at providing financial support to low-income households who would only receive the UK Government universal payment of £400. Applicants must complete and submit an on-line application form and documentary proof of income. This is then assessed to determine whether or not the applicant meets the eligibility criteria based on their household composition and income. There are different income limits depending on whether the applicant is single and/or a couple and whether or not they have children. There is no requirement for the applicant to submit evidence that they are a single person, part of a couple or a parent. The Revenue and Benefits Manager advised that checks would be made to the Council Tax system with regards to the number of adults and that the decision was made at the outset not to request evidence in respect of children as it was regarded as being covered by the self-declaration on the application, which states that information provided is ‘true and accurate’. The report to Policy and Strategy Committee in September 2022 on Tackling Poverty stated that applicants would not need to prove that they met the definition of fuel poverty (defined as a household which is spending more than 10% of their net income on fuel after payment of rent/mortgage). Instead, applicants will be asked to make a self-declaration that they meet this definition of fuel poverty. However, from our review of application, we noted that this is not included in the self-declaration and, as stated in the paragraph above, it only refers to the information provided being ‘true and accurate’. The Pensioner Fuel Grant was a payment made to pensioners in receipt of either Pension Credit (Savings) or Pension Credit (Guarantee). As the Council already holds details of eligibility, there was no application process. Payment were automatically made to those households where the Council holds their bank details and, where the bank account details were not held, a bank mandate was sent to eligible households requesting that they provide their bank details to allow payment to be made directly to their bank account. We reviewed a sample of applications received in respect of the Fuel Hardship Payment and consider that in seven of the 36 cases reviewed, based on the information available, our review of the application and decision indicates thar the correct decision may not have been made for the following reasons: • two cases where we consider that there was a lack of information provided in respect of the partner’s income; • three cases where we consider that there was disparity between the number of adults on the claim and that recorded on the Council Tax system; and • one case where we consider that there was an issue with the payslip provided. In addition, we noted that the processor’s notes on the database were not always completed and thus did not provide sufficient detail on the action taken by the processer to confirm the grant payment was due. In some cases, the notes did not fully reflect the action taken or the justification for the decision made. We also reviewed a sample of payments made in respect of the Pensioner Fuel Grant and noted one case where a duplicate payment had been made to the householder in error. The original payment had been returned due to incorrect bank details, correct details obtained and a new request for payment was issued on next payment run with a note added to this effect on the customer record held on the Services application database. However, another officer who picked up the same case via a payment returned report received from creditors, noticed that correct details had been obtained and made a request for payment which resulted in the duplicate payment being made. Implication Recommendation Priority Management response Implementation Month/Year Unless the necessary checks are undertaken, payments may be made to persons who are not eligible. The Chief Officer (Finance) should ensure that, in designing and implementing any similar future grant schemes: (1) staff are reminded of the importance of ensuring that adequate documentary evidence has been provided and assessed prior to awarding payments and the notes section on the database fully reflects any action taken and reasons for the decision made; and (2) consideration is given to the additional checks required when payments are rejected, and new payments need to be made to reduce the risk of duplicate payments being made to prevent a similar issue arising to that referenced in the finding above. Low Agree Greg Telfer, Business Finance Manager Although these specific payment schemes have been concluded, for any future payments schemes the Service will implement these recommendations in full. April 2023
Page 60
https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Planned Work/2022-23/0900.2023.008 - Welfare and Poverty Related Grants/A - FINDINGS AND REPORT/A05A 230424 Welfare Payments Final Report .docx 5 Appendix 1 - Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Green Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Green-Amber Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Amber-Red Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. Red No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Organisational impact Major The weaknesses identified during the review have left the Council open to significant risk. If the risk materialises it would have a major impact upon the organisation as a whole. Moderate The weaknesses identified during the review have left the Council open to medium risk. If the risk materialises it would have a moderate impact upon the organisation as a whole. Minor The weaknesses identified during the review have left the Council open to low risk. If the risk materialises it would have a minor impact upon the organisation as a whole. Recommendation priority High Significant control failure or weakness that, if not addressed, may lead to a major financial, operational or reputational risk to the organisation and/or significantly impact the successful delivery and achievement of the objectives of the area under review. Urgent/Immediate action is required. Medium Control failure or weakness that, if not addressed, may lead to a moderate financial, operational or reputational risk to the organisation. Weakness may be individually significant but is unlikely to affect the successful delivery and achievement of the overall objectives of the area under review. The risk of error would, however, be significantly reduced if corrective action was taken. Prompt action is required. Low Control failure or weakness that may lead to a minor financial, operational or reputational risk to the organisation. Weakness does not appear to significantly affect the ability to meet objectives. Minor issue raised to improve the efficiency and effectiveness of controls.