Minute - Audit and Scrutiny Panel of 16 February 2023
North Lanarkshire Council · 8 June 2023
Back to Policy and Strategy Committee — 8 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
AUDIT AND SCRUTINY PANEL - 16 FEBRUARY 2023 1 16 February 2023 at 2 pm. A Meeting of the AUDIT AND SCRUTINY PANEL PRESENT Councillor Watson, Convener; Councillor Dunbar, Vice-Convener; Councillors Hume, D. Johnston, T. Johnston, Loughran, McNally, Robinson and Stevenson. CHAIR Councillor Watson (Convener) presided. IN ATTENDANCE Chief Officer (Business and Digital); Chief Officer (Audit and Risk); Chief Social Work Officer (Education, Families, Justice and Integrated Practice); Business Finance Manager (Resource Solutions); Business Partnership Manager; Strategy and Performance Manager; Business Strategy Managers; Information Risk Manager, and Democratic Services Manager. ALSO IN ATTENDANCE J. Boyd, Audit Director and P. Murray, Senior Audit Manager, Audit Scotland. APOLOGIES Councillors Fisher and Sullivan. DECLARATIONS OF INTEREST IN TERMS OF THE ETHICAL STANDARDS IN PUBLIC LIFE ETC. (SCOTLAND) ACT 2000 1. Councillor Watson, by virtue of being a Director of North Lanarkshire Properties, declared a connection in respect of paragraph 13 – POW: 075.1 – Arm’s Length External Organisations: Governance and Risk Management Oversight and Assurance Report 2022/23 – and further declared that he considered the connection so sufficiently remote that it did not preclude his participation in that item. REMIT FROM ADULT CARE AND SOCIAL WORK COMMITTEE – QUALITY ASSURANCE ANNUAL REPORT 2. There was submitted a report by the Head of Planning, Performance and Quality Assurance which had been remitted to the Audit and Scrutiny Panel by the Adult Care and Social Work Committee at its meeting held on 15 November 2022 providing an update to that Committee on the Council’s Quality Assurance Activity over the period 1 April 2021 to 31 March 2022. Decided: that the contents of the report be noted. AUDIT AND RISK-RELATED ITEMS: ACTION LOG 3. There was submitted a report by the Chief Officer (Audit and Risk) enabling the Panel to track implementation of requests and recommendations made by it in respect of Audit and Risk related items in the previous 18 months, with the action log, attached as an Appendix to the report, recording
Page 2
AUDIT AND SCRUTINY PANEL - 16 FEBRUARY 2023 2 those requests and recommendations made by the Panel when these had been addressed and/or were expected to be addressed. Decided: that the content of the report be noted. INTERNAL AUDIT PROGRESS REPORT 4. There was submitted a report by the Chief Officer (Audit and Risk) (1) providing an overview of Internal Audit Activity; (2) reporting the results of Internal Audit outputs finalised since the last update to the Panel in November 2022; (3) highlighting the most significant issues arising from the completed audit work; (4) updating the Panel on other aspects of the work of Internal Audit, and (5) attaching, as an Appendix to the report, a brief summary of the scope and key findings of each substantive planned audit, together with a summary pack containing copies of those reports. During consideration of the report the Panel requested that a report be brought back to a future meeting regarding progress made by management regarding controls for the use of supply teachers. Decided: (1) that the findings, conclusions and recommendations of completed Internal Audit reports, together with the associated management responses, be noted; (2) that a further report be brought back to the Panel on progress made by management in respect of how the Council might address the issue relating to the re-employment of staff highlighted in the Internal Audit report “Investigation – Primary School A”; (3) that a further report be brought back to the Panel on progress made by management in respect of controls relating to the use and payment of supply teachers; (4) that Internal Audit provide a report to future meetings of the Panel reporting progress made by management in implementing the agreed management actions in relation to all audit recommendations categorised as “High” or “Medium”, and (5) that, otherwise, the contents of the report be noted. INTERNAL AUDIT: FOLLOW UP OF ACTIONS PREVIOUSLY AGREED BY MANAGEMENT IN RESPONSE TO AUDIT RECOMMENDATIONS 5. There was submitted a report by the Chief Officer (Audit and Risk) (1) detailing the extent to which management had implemented actions previously committed to in response to recommendations in Internal Audit reports, where those actions were due to be completed by the end of December 2022; (2) advising that Internal Audit had concluded that, of the 21 outstanding Internal Audit recommendations, five had been completed and 16 partially implemented; (3) explaining that of the 12 outstanding recommendations made by External Audit, seven had been completed, four were not yet due and one was considered no longer relevant, and (4) attaching, as an Appendix to the report, commentary from management and details of proposed management actions, together with revised target dates for completion of those outstanding audit recommendations where Internal Audit had assessed the residual risk as High or Medium. Decided: (1) that the contents of the report be noted, and
Page 3
AUDIT AND SCRUTINY PANEL - 16 FEBRUARY 2023 3 (2) that the recommendations made by Internal Audit, attached as Appendix 1 to the report, be noted. AUDIT SCOTLAND – AUDIT STRATEGY LETTER 2022-23 6. There was submitted a report by the Chief Officer (Audit and Risk) providing Members with information from Audit Scotland, the Council's appointed external auditors, on the status of its 2022-23 audit planning (1) detailing that, as outlined by Audit Scotland in its letter attached at Appendix 1 to the report, Covid 19 had continued to impact on the completion of audits with ongoing extensions to statutory deadlines continuing to remain in place and that, along with the changeover in the appointed auditor, there had been an impact on the timing of Audit Scotland's work on the 2022-23 audit, and (2) indicating that Appendix 1 to the report provides an overview of key aspects arising from the audit planning process, including a timetable for key audit outputs and the finalisation of the 2022-23 audit plan, which was expected to be completed by 31 March 2023, with that document to be circulated to members of the Panel on receipt and to be tabled formally at the next Panel meeting. Thereon J. Boyd, Audit Director, Audit Scotland provided an oral summary of the letter from Audit Scotland, attached as an Appendix to the report. Decided: that the letter from Audit Scotland, together with the oral update provided at the meeting in relation to the planned audit approach by Audit Scotland to the 2022-23 audit of the Council, be noted. CHANGES TO THE CODE OF PRACTICE ON LOCAL AUTHORITY ACCOUNTING 2022/23 7. There was submitted a report by the Chief Officer (Finance) (1) explaining that the Council's Financial Statements are compiled in accordance with the Code of Practice on Local Authority Accounting in the United Kingdom, which is based on International Financial Reporting Standards (IFRS) and also the requirements of the accounting and statutory guidance of the UK Government and that, further, the Code requires appointed auditors to pay due attention to quarterly bulletins published by Audit Scotland; (2) highlighting any significant changes to the Code, or guidance in the technical bulletins, which might impact on the accounting requirements and presentation of the Council's 2022/23 Annual Accounts, and (3) indicating that the 2022/23 Unaudited Annual Accounts were due to be submitted to External Audit by 30 June 2023. Decided: (1) that the contents of the report be acknowledged, and (2) that the actions being taken to ensure that the Council submits a fully compliant set of Annual Accounts to External Audit be recognised. RISK MANAGEMENT UPDATE 8. There was submitted a report by the Chief Officer (Audit and Risk) providing an update to the Panel on key risk management developments since the most recent report in November 2022; (2) highlighting a selection of the more significant issues which are of current focus from a risk perspective, and (3) confirming that risk issues continue to be addressed in relation to a number of significant projects and programmes of work.
Page 4
AUDIT AND SCRUTINY PANEL - 16 FEBRUARY 2023 4 Decided: (1) that the current residual scores for those risks agreed for inclusion in the Corporate Risk Register for 2022/23, attached at Appendix 1 to the report, be noted; (2) that the references to other topical risk issues highlighted in the report be noted, and (3) that the work ongoing to further strengthen and embed risk management arrangements be noted. NATIONAL CARE SERVICE PROPOSALS 9. There was submitted a report by the Chief Social Work Officer (Education, Families, Justice and Integrated Practice) (1) confirming that, to mitigate risks and uncertainty, the Council operates risk management arrangements which identify, evaluate, manage and control a range of key corporate risks with all risks identified and agreed as meriting inclusion in the Corporate Risk Register being subject to regular monitoring and review by relevant senior management and periodic review/consideration of individual risks by both the Corporate Management Team and the Audit and Scrutiny Panel in line with the Council's Risk Management Strategy and their respective governance roles; (2) providing a focus on a new risk within the Council's Corporate Risk Register relating to proposals for a National Care Service as set out within the National Care Service (Scotland) Bill introduced in the Scottish Parliament on 21 June 2022; (3) providing an overview of the current risk environment as set out and assessed within the draft Deep Dive document attached as Appendix 1 to the report; (4) noting that the Deep Dive document is in development with further work required to fully analyse risk impacts and to reflect and develop mitigating actions and controls which may be exercised by the Council; (5) advising that this work will form part of the agenda for the newly created Member/Officer Group, and (6) advising that the level of uncertainty with respect both to the Bill process, alongside the scale and complexity of the reorganisation likely to arise from the proposals, is reflected in an indicative inherent and residual risk scoring of 25. Decided: (1) that the draft Deep Dive document, attached as Appendix 1 to the report, and the indicative risk scoring which reflects both the very high level of uncertainty and potential high and wide-ranging impacts for the Council associated with this risk, be noted; (2) that it be noted that this risk document remains in development and will be regularly reviewed in keeping with both the high indicative scoring and the fluid risk environment, and (3) that it be noted that core structures for the management and mitigation of this risk have been enhanced through the establishment of the National Care Service Member/Officer Group, which met for the first time in February 2023. NEW APPROACH TO AUDITING BEST VALUE 10. There was submitted a report by the Chief Officer (Business and Digital) (1) reminding the Panel of the Best Value duty which requires the Council to ensure arrangements are in place to secure continuous improvement in the performance of all functions and activities undertaken to deliver services and improve outcomes; (2) explaining that, since implementation of the duty, all local authorities in Scotland had been subject to ongoing national and local audit processes to ensure they continue to be able to demonstrate Best Value in practice; (3) indicating that, from 2022/23 onwards, a new approach to the National Audit Programme is being rolled out in line with the five-year external audit appointments and that the new approach involves more frequent arrangements that integrate the process of auditing Best Value within each individual Council's External Auditors Annual Audit Report activity; (4) informing the Panel that this means that the Council will, in effect, undergo an
Page 5
AUDIT AND SCRUTINY PANEL - 16 FEBRUARY 2023 5 annual assessment in terms of particular aspects of Best Value in order to provide the Accounts Commission with the relevant assurances in terms of the performance of the Council and the quality of services to the public.; (5) providing an overview of the new national approach to auditing Best Value, and (6) indicating that Elected Members have a key role to play to ensure that the Council continues to demonstrate Best Value and providing information to assist the Members of the Audit and Scrutiny Panel to fulfil that role. Decided: (1) that the new national approach to auditing Best Value, and the implications for the Council in this respect, be noted, and (2) that the role of the Panel, in terms of ensuring that the Council continues to secure Best Value in line with the statutory duty, be endorsed. ANNUAL SCRUTINY PROGRAMME 11. There was submitted a report by the Chief Officer (Business and Digital) (1) setting out the annual programme for the scrutiny function of the Panel; (2) outlining the process by which members of the Panel are able to submit items, functions or activities requiring scrutiny and the subsequent assessment and prioritisation mechanism, and (3) advising that a composite programme listing all scrutiny related reports is scheduled to be presented to the Panel during each cycle of 2023/24. Decided: (1) that the composite programme and reporting timetable, as set out in the report and Appendix 1 to the report, in order to establish an annual programme for the scrutiny function of the Panel be endorsed, and (2) that the role of Panel members in identifying, assessing and prioritising items for inclusion in the scrutiny work programme, in line with the updated process, be endorsed. STRATEGIC PERFORMANCE FRAMEWORK – PERFORMANCE REPORTING SCHEDULE 2023 TO 2024 12. There was submitted a report by the Chief Officer (Business and Digital) (1) explaining that the Strategic Performance Framework sets out performance measurement at three levels in order to collectively provide an overview of performance to help understand the impact of Council activities on improving services and outcomes for people and communities; (2) reiterating that from 2022/23, demonstrating Best Value moves to a more frequent annual audit assessment which will be undertaken as part of the External Auditor's existing Annual Audit Report process and that, therefore, it is important to ensure that the Council continues to be able to demonstrate Best Value and evidence this in practice, in particular through robust scrutiny and performance reporting; (3) providing an update on the performance reporting schedule initially established in 2021 setting out the service specific, statutory, corporate and strategic performance reporting arrangements for the period 2023/24, and (4) reminding the Panel that consideration of the performance reporting schedule at its meetings supports the Best Value governance and accountability theme by ensuring that the Council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. Decided: (1) that the Panel maintain an awareness of the reports within the performance reporting schedule for 2023 to 2024 in line with the Panel’s remit, and
Page 6
AUDIT AND SCRUTINY PANEL - 16 FEBRUARY 2023 6 (2) that it be noted that the performance reporting schedule forms a key part of the scrutiny work programme that supports the Best Value governance and accountability theme by ensuring that the Council can demonstrate the existence of robust arrangements for scrutiny and performance reporting. Councillor Watson, prior to consideration of the following item of business, having declared a connection by virtue of being a director of North Lanarkshire Properties, had further declared that he considered the matter so sufficiently remote that it did not preclude his participation in this item. POW: 075.1 – ARM’S LENGTH EXTERNAL ORGANISATIONS: GOVERNANCE AND RISK MANAGEMENT OVERSIGHT AND ASSURANCE REPORT 2022/23 13. There was submitted a report by the Chief Officer (Business and Digital) (1) reminding the panel that a number of Council services are delivered on behalf of the Council by Arm’s Length Bodies and Partnership Agreements and that these have developed over a significant number of years; (2) confirming that, given the importance of these services and the levels of investment, it is imperative that the Council has robust oversight of governance, financial stewardship and management arrangements within each of these companies and that it can assure itself that they are all delivering services on the Council’s behalf that meet the contractual requirements, and satisfy the Council and customers’ needs and that expectations are delivered to a high standard; (3) intimating that consideration of this report by the Panel is a key element in the Council’s strategic performance framework as it provides the mechanism for Elected Members to scrutinise Arm’s Length Organisations’ effectiveness, value for money, governance and risk management arrangements, and (4) providing the six monthly overview of Arm’s Length Organisations’ governance, financial governance, risk management and service delivery arrangements. During consideration of the report, and following an oral summary of that report by the appropriate officer, the Panel requested that further information be provided to Members of the Panel in relation to contingent liabilities and unrestricted reserves. Decided: (1) that it be acknowledged that Arm’s Length External Organisation governance, performance reporting and financial monitoring arrangements are progressing satisfactorily; (2) that it be confirmed that the Performance Monitoring and Oversight arrangements are suitably robust and provide assurance that service delivery reflects Best Value; (3) that a full report on Routes to Work’s performance, as at year end 2021/22 and year to date in 2022/23, should be submitted to the Enterprise and Fair Work Committee at its meeting in May 2023, and (4) that the potential for liaison and engagement between the Council and External Organisations to explore where current labour shortage is an opportunity for employment and training and may be developed as part of the workforce for the future strategy be endorsed. CYBER SECURITY ASSESSMENT – SUPPLEMENTARY REPORT 14. There was submitted a joint report by the Chief Officer (Audit and Risk) and the Chief Officer (Business and Digital) (1) reporting that during financial year 2022/23, Internal Audit had worked alongside Business and Digital to review and assess Cyber Security practice within the Council and that the assessment (categorised as reasonable assurance) had determined that the Council had robust and effective information governance arrangements, duly recognised the risks associated with cyber security threats and operated practices commensurate with the good practice recommended by bodies such as the National Audit Office; (2) seeking to supplement Internal Audit’s findings and
Page 7
AUDIT AND SCRUTINY PANEL - 16 FEBRUARY 2023 7 recommendations through providing the Panel with additional details of cyber security activities performed by the Council; (3) noting that the Council seeks to guard against common cyber security threats and/or attacks through a range of cyber security arrangements, controls and activities; (4) highlighting that the Council endeavours to follow good practice guidelines and recommendations in terms of cyber security and that the Council’s Security and Risk Management function actively monitors how such changes in the threat landscape affect the Council’s security position and the adequacy of existing controls, and (5) reporting on the format and structure of the assessment. Decided: that the contents of the report be noted. SENIOR INFORMATION RISK OWNER (SIRO) - INFORMATION GOVERNANCE - ASSURANCE AND PERFORMANCE REPORT 2021/22 15. There was submitted a report by the Chief Officer (Business and Digital) (1) providing assurances that information risks are being effectively managed to ultimately enable the Council to comply with legislative requirements and good practice, and (2) outlining activity and performance related to information governance in respect of financial year 2021/22 and detailing improvement actions which the Data Management Team aims to progress to further improve awareness, understanding and compliance. During consideration of the report, and following an oral summary of it by the appropriate officer, the Panel requested that it receive a report to a future meeting in respect of proposals by management to ensure that mandatory training by staff is completed. The Chief Officer (Audit and Risk) advised that this matter would be included within the Audit and Scrutiny Panel action log. Decided: (1) that the activities which had been undertaken, or are underway, to enable the SIRO to provide assurances that information risks are being effectively managed be noted; (2) that the activities and next steps planned to further improve the Council’s Information Governance arrangements be noted, and (3) that a further report be provided by management outlining how the Council, more generally, monitors and ensures that staff periodically undertake all mandatory training relevant to their individual posts. PO003.2: DIGITAL NL QUANTIFYING AND REPORTING ON NON-FINANCIAL BENEFITS 16. There was submitted a report by the Chief Officer (Business and Digital) (1) explaining that the Digital NL Programme is subject to a series of audits aimed at providing levels of assurance that the overall programme is progressing against pre-determined targets, that governance is robust and that benefits are being realised; (2) reporting that, to date, the Digital NL Programme has been subject to four audits with each making a small number of recommendations with regards to suggested improvements and that, on each occasion, management within Business and Digital have viewed the outcome of such reports and the recommendations contained therein as valuable feedback for improving processes within the overall programme; (3) providing a focus on the recommendation made within the most recent Internal Audit report in November 2021 with regard to the identification, calculation, monitoring and tracking of non-financial benefits, and (4) highlighting a number of next steps to be developed in order to finalise and fully deploy the non-financial benefits element of the Benefits Tracker.
Page 8
AUDIT AND SCRUTINY PANEL - 16 FEBRUARY 2023 8 Decided: (1) that the development and implementation of a bespoke Benefits Tracker to capture financial and non-financial benefits for the Digital NL Programme be recognised; (2) that the robust process in place for capturing non-financial benefits be acknowledged; (3) that the commitment to the continued development of non-financial benefits through the deployment of the approved Year 4 Roadmap be recognised, and (4) that the next steps as outlined in the report be supported. UPDATE ON THE IMPLEMENTATION OF THE REFRESHED PROJECT MANAGEMENT FRAMEWORK 17. There was submitted a report by the Chief Officer (Business and Digital) (1) reminding the Panel of work undertaken in 2022 to review and refresh the Council's corporate project arrangements, with the review culminating in the launch of the refreshed Project Management Framework on 16 December 2022; (2) clarifying that the review of this Framework followed recommendations arising from Internal Audit reports, which both reported a reasonable assurance audit opinion but considered that further action was required for improvement in five specific areas; (3) intimating that the review and refresh exercise was also considered necessary in light of the changes in the Council's operating environment since implementation of the Model in 2018 and that these changes have led to a rapid evolution of programmes and projects across the Council, as well as increasing complexities in the delivery of many of these, and a greater need to be certain of the range of inter connections and inter dependencies across an increasing number of related areas of work; (4) narrating that this resulted in a growing need for a flexible framework that facilitates good governance and good project management in the set up and delivery of a wider range of projects at pace and scale; (5) providing a focus on two recommendations arising from the governance of Capital Projects and Managing Strategic Change audits and, specifically, providing information on reporting to all stakeholders on key projects and the arrangements for monitoring compliance with the Project Management Framework through a review programme. Decided: (1) that it be noted that information in respect of reporting to all stakeholders on key projects, and the arrangements for monitoring compliance with the Project Management Framework through a review programme, is contained within the refreshed Project Management Framework, as attached in the Appendices to the report; (2) that the work underway to establish the quality assurance process and the review programme for the Project Management Framework for implementation in 2023/24 be acknowledged; (3) that the commitment to ensuring that the programme of activity is implemented to its full and final conclusion, with ongoing monitoring and strategic oversight in place thereafter, be recognised; (4) that the Elected Member oversight role in terms of the quality assurance process and the review programme for the Project Management Framework be noted, and (5) that, otherwise, the contents of the report be noted.