Internal Audit- Follow-Up of Actions previously agreed by Management in response to Audit Recommendations
North Lanarkshire Council · 18 May 2023
Back to Audit and Scrutiny Panel — 18 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel Does this report require to be approved? ☐ Yes ☒ No Ref KA/LM/ASP/May 2023 Date 18/05/23 Internal Audit: Follow up of actions previously agreed by management in response to audit recommendations From: Ken Adamson, Chief Officer (Audit and Risk) E-mail: adamsonk@northlan.gov.uk Telephone 07939 280602 Executive Summary The purpose of this report is to update the Panel on the results of Internal Audit’s follow-up work reviewing the extent to which management have implemented actions previously committed to in response to previous Internal and External Audit recommendations. Information is contained in respect of the last two years External Audit outputs and those actions agreed in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed in the period up to the end of March 2023. The Panel should note that where actions are not yet ‘complete’ this does not mean that no relevant activity has been undertaken by management and that the actions taken/progress made to date will often have reduced the risk exposure in respect of the weaknesses previously identified even if the action is not yet complete. Those recommendations which were previously reported to the Panel as partially implemented but not yet complete are now monitored against revised target implementation dates agreed with management and previously reported to the Panel. Seven of the 12 actions agreed in respect of External Audit outputs have been completed, four are not yet due and one is no longer relevant. Ten of the 21 actions agreed in response to relevant Internal Audit recommendations due in the period have been fully completed, eight have been assessed as partially implemented and three are no longer relevant/have been superseded. Recommendations The Panel is invited to: a) note the contents of this report; b) note the recommendations made by Internal Audit at Appendix 1; and c) consider whether there are any issues arising from this report on which they wish to receive further information from relevant management. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 Internal and External Audit reports contain management responses to audit recommendations which generally include a commitment to specific actions by a stated date. This report presents an overview of progress by management in addressing all External Audit recommendations made in the last two years and all ‘High’ and ‘Medium’ Internal Audit recommendations which were previously reported as outstanding or where the proposed actions were due to be completed by the end of March 2023. 1.2 The format of this report is designed to allow the Panel to focus on those issues where non-implementation of agreed actions presents the most significant ongoing risk to the Council and to enable the Panel to hold relevant senior management to account. 1.3 Internal Audit’s arrangements for following-up audit recommendation include, in certain circumstances, agreeing a revised implementation date and monitoring and reporting against these revised dates where we are provided with a strong rationale for the non- implementation of the audit recommendation by the originally agreed date. This avoids repeatedly reporting and focusing on actions which are ‘late’ where there are sound reasons for non-implementation by the originally agreed date. 1.4 This report presents the assessment of the potential risks arising from those planned actions agreed in response to Internal Audit recommendations due in the period (January to March 2023) which are not yet fully completed. 1.5 The updates from management on progress to date have been verified on a sample basis by Internal Audit as part of the preparation of this report. However, it should be noted that this review has focused on whether planned actions have been completed and has not included detailed substantive testing of whether the implemented actions have been effective in addressing previously identified weaknesses. 2. Report Actions previously agreed by management – Internal Audit recommendations 2.1 Table 1 below shows whether management have implemented those actions previously agreed to in response to ‘High’ and ‘Medium’ Internal Audit recommendations which were due to be completed by the end of March 2023. Overall, ten of the agreed actions have been completed, eight have been assessed as partially implemented and three are no longer relevant. Table 1 Complete Partially implemented No longer relevant Total Chief Officer Area Audit and Risk 0 1 0 1 Business and Digital 2 3 0 5 Education 2 0 1 3 Finance 1 0 1 2 People Resources 5 2 0 7 Place 0 1 0 1 Strategic Communication and Engagement 0 0 1 1 Social Work 0 1 0 1 TOTAL 10 8 3 21
Page 3
2.2 Internal Audit has reviewed the management updates and agreed with relevant management revised implementation dates for all eight recommendations listed as partially implemented at Table 1. These recommendations will now be monitored in line with the agreed revised date and will be reported back to the Panel in accordance with this revised timescale, at which time consideration will be given as to whether previously identified weaknesses have now been addressed. 2.3 Detail in respect of each of these recommendations and the current residual risk assessed by Internal Audit as a result of partial implementation is provided in Appendix 1, in which we have also made suggestions as to how the Panel may wish to consider these issues. Definitions of the residual risk ratings are provided at Appendix 2. 2.4 The three issues assessed as being ‘no longer relevant’ relate to Creditors, Education and Corporate Governance. These have been followed up separately as part of detailed audit work recently undertaken in these areas and, where appropriate, updated recommendations have been made in the current audit report which supersede the earlier recommendations. Actions previously agreed by management – External Audit recommendations 2.4 Table 2 shows the status of actions agreed by management in response to External Audit reports issued as part of the 2020-21 and 2021-22 audits. Internal Audit has concluded that seven of the agreed actions have been completed, four are not yet due and the remaining action is no longer relevant. Table 2 Completed Partially implemented Not yet due No longer relevant Total Report Title/Year 2020-21 Interim Audit Report 3 0 0 1 4 Annual Report 3 0 0 0 3 2021-22 Annual Report 1 0 4 0 5 TOTAL 7 0 4 1 12 2.5 The External Audit action assessed as ‘no longer relevant’ relate to issues on which External Audit have made a similar recommendation in subsequent audit reports. 3. Measures of success 3.1 Internal Audit report each cycle to the Audit and Scrutiny Panel on the progress made by management in implementing actions previously committed to in response to Internal and External Audit reports. 4. Supporting documentation Appendix 1 Internal Audit recommendations: Management actions assessed as ‘not yet complete’ in this cycle Appendix 2 Residual risk rating definition Ken Adamson, Chief Officer (Audit and Risk)
Page 4
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If yes, please provide a summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Failure by Services to address previously identified issues and/or weaknesses will impact on the effectiveness of the relevant control framework. This, depending on the nature of the issue, will be captured and should be reflected in the relevant service risk register or the corporate risk register (as appropriate). 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒
Page 5
Appendix 1 Internal Audit recommendations - Management actions assessed as ‘not yet complete’ in this cycle Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Audit and Risk) Risk Management (July 2022) Risk: The absence of a fully documented corporate risk register, subject to regular monitoring and challenge may mean that key stakeholders may fail to fully understand the key risks the Council faces and in turn may consequently fail to take appropriate action to mitigate them. Recommendation: The Head of Audit and Risk should ensure that the replacement and/or new corporate risks detailed in the finding are documented, assessed and moved to ‘live’ status with a reasonable timescale. Category: Medium The corporate risks on Supply Chain and the Scottish Child Abuse Inquiry have been developed, agreed and are now ‘live’. The corporate risk in relation to the National Care Service proposals has been documented as much as can be based on current information available and scored accordingly. This will continue to be developed as the national policy direction progresses and the current significant level of uncertainty hopefully begins to reduce. The corporate risk on Educational Outcomes has been finalised and a report on this matter is included as a separate agenda item for this meeting of the Audit and Scrutiny Panel. The corporate risk on the Target Operating Model is currently being refined following approval of both the budget for 2023-24 and the new Programme of Work to 2028. Revised governance arrangements in respect of the new Programme of Work are currently being finalised and were the subject of a report to CMT on 21 April 2023. The corporate risk on the Targeting Operating Model will be updated accordingly to reflect decisions made at that meeting and subsequent discussions and will be finalised shortly thereafter. Original timescale: September 2022 Revised timescale: December 2022 Further revised timescale: May 2023 We acknowledge that there has been ongoing activity to address the recommendations made and that delays in the finalisation of the two remaining risks are as a result of a number of factors. Given that further action is required to finalise this action, we have assessed the residual risk as ‘High’ and consider it appropriate that the remaining risk is finalised in line with the revised timescale. Accordingly, we would suggest that the Panel may wish to consider requesting a further update from relevant senior management at the next meeting of the Panel.
Page 6
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Business and Digital) Digital NL (November 2021) Risk: Benefits and savings may not be being adequately tracked and monitored resulting in the Council being unable to demonstrate the achievement of the objectives of the programme. Recommendation: Management should ensure that the non-financial benefits tracker is finalised and approved with non-financial benefits thereafter identified, calculated, tracked and monitored for all workstreams. Category: Medium Although non-financial benefits were identified as a key driver of the DigitalNL programme, during the financial year 2019-20 with the Council moving towards a challenging 3-year budget, the emphasis on financial benefits became the main focus. For a variety of reasons, it has proved difficult to retrospectively identify and measure the non-financial benefits for those sprints now completed. The Business Analysts now have access to Dynamics which will enable them to access data to measure the non-financial benefits going forward. Data from the waste sprint has been gathered and the benefits tracker populated in this respect. All future financial and non-financial benefits identified on the Year 5 Roadmap (2023/24) will be progressed in line with the approved benefits approach. Full implementation of the Benefits Tracker remains a key objective and will be supported through maximising the use of the Digital Platform, linking with the BI Hub operating model and the Customer Service Hub feedback strategy. From a governance perspective, specific information on the non-financial benefits is now, and will continue to be, presented to the Project and Delivery Board meetings. Original timescale: April 2022 Revised timescale: September 2022 Further revised timescale: March 2024 We acknowledge that there has been considerable action taken in this area which demonstrates a positive direction of travel and have thus assessed the residual risk as ‘Low’. We consider that it is important going forward that non-financial benefits are identified, measured and reported in a timely and consistent manner for those sprints not yet underway/at an early stage and we take cognisance of the Service’s comments that this will be evidenced by the progression of all future financial and non-financial benefits identified on the Year 5 Roadmap. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 7
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Business and Digital) Managing Strategic Change (June 2021) Risk: Key stakeholders may not be adequately informed of progress in the Council’s key corporate projects and may not be able to undertake effective oversight and/or ensure that timely remedial action, necessary to ensure that projects are delivered successfully, has been progressed by relevant management. Recommendation: Management should progress the previously identified action of establishing a reporting mechanism which better facilitates regular and ongoing oversight by key stakeholders of the progress of key projects against plan, including management of key risks, progress against timelines, cost against budget, achievement or otherwise of key milestones and expected outcomes or benefits realisation. We suggest that this could include introducing a standard reporting template and adopting a traffic light system to report progress against key criteria, project milestones and overall deliverability against expected time, cost and any other intended outcomes. Category: Medium The recent changes in the Council’s governance arrangements will impact on the oversight and reporting of key corporate projects. The Council’s Programme of Work covering the period to 2028 was approved at the Policy and Strategy Committee in March 2023. This now comprises 7 overarching themes which require to be integrated and aligned with the existing programmes and projects and the existing investment from the Strategic Capital Programme in order to prioritise activities and develop supporting delivery plans. The tasks in this process have been clearly defined and were approved by CMT on 21 April 2023. Work to progress this will take place over the next 12 months with interim updates on progress scheduled to be presented to CMT in August 2023 and February 2024 for submission thereafter to the Policy and Strategy Committee. The Strategic Capital Delivery Group has recently agreed a new approach to the reporting of capital projects, which would include CMT and/or BMT oversight and is currently under development. Original timescale: September 2021 Revised timescale: September 2022 Further revised timescale: March 2024 We acknowledge the change in direction of travel with the recently refreshed programme of work and the planned development of governance arrangements associated with this. We have assessed the residual risk as ‘Medium’ as the recommendation has not yet been fully addressed. It is Internal Audit’s view that the original audit recommendation can be addressed as part of actions scheduled during the next 12 months. This will include ensuring that the refreshed governance arrangements incorporate reporting on progress of all key corporate projects (both capital and non-capital) and the consideration of timely remedial action to ensure that projects are delivered successfully and on time. Accordingly, we would suggest that the Panel may wish to consider requesting a further update from relevant senior management after the first interim update has been presented to CMT and Policy and Strategy.
Page 8
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Business and Digital) Performance Management (October 2022) Risk: It may be difficult to clearly demonstrate progress, improvement or achievement of the Council’s ambition statements and programme of work items, which could result in the Council failing to meet its obligations in relation to best value, good governance and public performance reporting. Recommendation: The Head of Business and Digital, in conjunction with all Services, should: (1) as part of the refresh of the SPF, ensure that consideration is given to all level 2 and 3 indicators to determine whether improvements in these performance indicators provide meaningful information in respect of progressing/achieving the ambition statements and programme of work items that they are linked to. This review should include the removal of any indicators which are not directly linked to planned outcomes and the identification of new indicators to assist with the monitoring of progress of ambition statements and key programme of work items; (2) consider preparing a document (or adding to existing documentation such as the SPF) which clearly indicates the Chief Officer responsible for each performance indicator; and (3) identify a suite of key performance indicators/reporting mechanism(s) that would facilitate effective scrutiny and challenge by CMT and elected members. Category: Medium A report submitted to CMT in December 2022 outlined the Performance Reporting Schedule for 2023 to 2024, which will facilitate scrutiny and challenge by CMT and elected members. This was also reported to the Audit and Scrutiny Panel in February 2023. Indicators within the Strategic Performance Framework are being reviewed and updated in line with the development of Chief Officers’ reporting to Committee as per the Performance Reporting Schedule. The review and update of indicators and targets within the Strategic Performance Framework is nearing completion and the updated suite of measures and targets will be made available for oversight and challenge by the BMT in June 2023 in line with their new governance and assurance role. Final developments to the Strategic Performance Framework will be considered in line with the requirements of the new Programme of Work and its associated delivery plans. The list of Calculating Officers and Verification Officers clearly show the corresponding service for each indicator in the Framework. Original timescale: December 2022 Revised timescale: March 2023 Further revised timescale: September 2023 We acknowledge that there has been significant action taken to address the recommendation made and that the requirements of the new Programme of Work and its associated delivery plans will be taken into consideration when finalising the review of performance measures and targets. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Panel may simply wish to consider agreeing to note the progress made and the revised completion date.
Page 9
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (People Resources) Equalities (November 2022) Risk: Without appropriate scrutiny/challenge or monitoring processes, the Council’s equalities arrangements may not be fit for purpose. Without clearly defined terms of reference, members if the relevant groups and other key stakeholders may not be fully aware of relevant roles and responsibilities in respect of the equalities agenda and/or be taking appropriate actions in respect of these responsibilities. There would be no effective process in place for ensuring that actions taken to address issues are being properly managed on a timely basis and/or monitored for impact. Management may not be aware of the extent of compliance with expected processes and actions. Recommendation: The Head of People and Organisational Development should ensure that: (1) the current governance arrangements for equalities are reviewed and updated (having due regard to the issues raised above) to ensure that the Council can better demonstrate compliance with its general and specific duties for equalities under the PSED. As a minimum, consideration should be given to establishing an Equalities Board (or equivalent) to ensure that equalities activities are being progressed and regularly reviewed/monitored at both corporate and service level; (2) an action/workplan capturing all required work around equalities, including responsible officers and timescales, is prepared and suitable monitoring arrangements are put in place to ensure any actions are appropriately progressed in line with expected timescales; and (3) a framework is developed to appropriately monitor compliance with key aspects of the Equality strategy and associated procedures. Category: High This action is largely complete. The governance arrangements for equalities have been reviewed and updated and an Equality Board has been established. The Terms of Reference for the Board have been agreed and are in place and the first meeting of the Board has taken place. The Delivery Framework for Equalities has been developed and was presented to the Wellbeing and Tackling Poverty Committee in February 2023. Both these tools will assist with ensuring that equalities activities and compliance with the Equalities Strategy, are being regularly reviewed and/or monitored. Work is still on-going to prepare and develop working group and Service action plans and these will be presented to Committee in Cycle 3. Original timescale: March 2023 Revised timescale: September 2023 We acknowledge that there has been significant action taken to address this recommendation and that work is on-going to complete the relevant actions plans, with the Service giving a firm commitment that these will be in place by the agreed revised timescale. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. A report from management, at the Panel’s earlier request, is already scheduled to be submitted to the September meeting of the Panel giving an update on progress of implementation of all actions in the Equalities Internal Audit report.
Page 10
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (People Resources) ESC: Testing of Selected Key Controls (March 2022) Risk: Failure to apply conditions of service appropriately could lead to inconsistency and/or errors in payments made to employees across the Council. Recommendation: The Head of People and Organisational Development should ensure that HR Business Partners, in conjunction with service management, review how non-core hours have been calculated for all relevant employees in receipt of a standing non-core hours payment each pay period to ensure that these are accurate and consistent with the employee’s work pattern/rota and Schedule A. Category: Medium People Resources have now ascertained that there are significant complexities, additional risks (including employment legislation and industrial relation risks) and potential increased costs to the Council which would flow from implementation of this recommendation. Due to the potential scale and impact, and the need for caution linked to the additional risks now emerging, further discussion has taken place with colleagues in Legal and Democratic and with the Chief Executive. Accordingly, it has been agreed that the Council will proceed with caution on this matter, and as such specialist legal advice from an external legal firm, on how best to address the matters highlighted, has now been sought. On receipt of this advice People Resources and Legal and Democratic, will determine how to proceed and document this within an action plan with clear milestones and responsible officers. The resulting proposed approach will be presented to CMT and Committee for approval by December 2023. It is expected that implementation of any approved action plan will be complete by December 2024. Original timescale: December 2022 Revised timescale: March 2023 Further revised timescale: December 2024 As highlighted in the management update, People Resources have identified that there are significant complexities, additional risks and potential increased costs to the Council which would flow from this recommendation and as such have sought specialist legal advice from an external legal firm to assist them in identifying how best to proceed. Once this advice has been received and considered, the Service has committed to identifying, securing approval for, and documenting the actions to be taken together with clear milestones, responsible officers and target dates. We have assessed the residual risk as ‘High’ as the recommendation has not yet been fully addressed by management and accordingly, we would suggest that the Panel may wish to consider requesting a further update in Spring 2024 from relevant senior management to the Panel once management have had sufficient time to consider the next steps and secure approval for any proposed course of action.
Page 11
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Officer (Place) Economic Regeneration Development Plan (June 2021) Risk: Without formal plans which contain realistic and achievable milestones and actions and identified resource requirements, the programme may not achieve its objectives within the expected timescales. Recommendation: Management should ensure that appropriate formal plans/programmes of work are put in place in respect of the ‘Town Centre Regeneration’ and ‘Business and Industry’ themes as soon as possible. As part of this process, realistic and achievable actions should be developed and aligned with resourcing requirements to undertake the identified actions. Category: Medium Town Visions were finalised and approved by the Policy and Strategy Committee in September 2021. The next stage of the process was to develop Town Action Plans for each of the town centres and consultation on the first three of these covering Airdrie, Motherwell and Wishaw will be undertaken between March and April 2023. This was delayed avoiding occurring over the Winter period when turnout was expected to be low. An update report will be submitted to the Enterprise and Fair Work Committee in Cycle 2 with the Town Action Plans finalised thereafter. In addition, work on the Business and Industry Strategy is underway and is scheduled to be presented to Committee in Cycle 2, having been impacted by staff absence. Original timescale: March 2022 Revised timescale: March 2023 Further revised timescale: August 2023 We acknowledge that the finalisation and implementation of this action has been delayed due to staff absences and the consultation being delayed and extended to avoid it being carried out over the Winter period when turnout was expected to be low and thus have assessed the residual risk for this recommendation as ‘Medium’. We consider it important that the agreed extension date of August 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being made as part of the follow-up report to be submitted in November 2023.
Page 12
Appendix 1 (continued) Internal Audit recommendations - Management actions assessed as ‘not yet complete’ Chief Officer Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment Chief Social Work Officer Tackling Poverty (November 2021) Risk: Without regular and/or appropriate reporting of significant issues and progress, key stakeholders would not be aware of how the programme is performing against expectations, milestones and/or planned targets and may not be able to take remedial action in a timely manner, where appropriate. Without a formal risk register, there is greater scope for relevant risks not to be identified and/or appropriately mitigated and greater potential for risks to impact on planned outcomes and/or the successful delivery of the programme. Recommendation: Management should: (1) ensure that an appropriate report format (perhaps based on, or similar to, the pro-forma highlights report contained within the Council’s project management methodology) is developed as soon as possible for consideration by the TPOAG and that key information on the progress of individual actions and the programme as a whole is reported to key stakeholders on a regular basis. The report should include, as a minimum, information on: • progress against key milestones, targets and measures of success; • details of expenditure v budget; • a summary of key issues arising and any decisions requiring to be made; and • details on key programme/operational risks as appropriate; and (2) prepare a risk register for the tackling poverty programme, which captures all key risks which have the potential to affect the successful delivery of the individual actions and the programme as a whole and ensure that this risk register is regularly monitored in accordance with the corporate risk management strategy. Category: Medium (1) A Data Group has been established to collate the data that allows progress to be measured against the key milestones and targets. A RAGG (Red, Amber, Green & Grey) rating has been introduced to track key milestones, targets, tasks completed and those requiring further development. Two new Assistant Tackling Poverty Manager posts were established in July 2022, and these posts will enable the Tackling Poverty Action Officers Action Group (TPAOG) to ensure reporting on individual actions, and the programme as a whole, on a more regular basis. The reporting format, including information to be reported as per the recommendation, has been added to the agenda of the next TPAOG meeting for consideration. The format of such reports will need to be agreed by the TPAOG. (2) The Tackling Poverty Team (Financial Inclusion Team) have 8 Operation risks which impact on the delivery of the Tackling Poverty Strategy. There are currently 3 drivers of poverty within the strategy with a 4th to be introduced in the new strategy which are wider than the Tackling Poverty Team. There are also controls within the corporate risk on tackling poverty that impact on the operational element of the tackling poverty programme. Further work is required in revising the operational risks of the programme. Original timescale: March 2023 Revised timescale: September 2023 We acknowledge that while there has been some action taken to address the points made in the recommendation, there is still further work required to determine and agree a reporting format for the Service to report on the progress of individual actions and the programme as a whole. Work is also required to further develop the operational risk register for the tackling poverty programme. We have assessed the residual risk for this recommendation as ‘Medium’ and consider it important that the agreed extension date of September 2023 is achieved. We would suggest that the Panel may wish to consider agreeing to note the progress made to date and the revised completion date and to monitor progress being reported at future meetings of the Panel.
Page 13
Appendix 2 Residual risk rating definition Internal Audit assessment of residual risk from non-implementation High Non-implementation of actions has the potential to significantly undermine the relevant control environment. Medium Non-implementation of actions has the potential to impact upon the achievement of the control environment. Low Other issues which require management attention but which pose less significant or less immediate impacts to the control environment.