16 - 2025-09-17 IJB - Internal Audit Annual Report 2024-25
North Lanarkshire Council · 17 September 2025
Back to Health and Social Care Integration Joint Board — 17 September 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
REPORT Item No: 16 SUBJECT: Internal Audit Annual Audit Report 2024/2025 TO: Integration Joint Board Committee Lead Officer for Report: Chief Officer Author(s) of Report Chief Officer (Audit and Risk), North Lanarkshire Council Chief Internal Auditor, NHS Lanarkshire DATE: 17 September 2025 1. PURPOSE OF REPORT 1.1 This paper is coming to the IJB Committee: For approval For endorsement To note 2. ROUTE TO THE BOARD 2.1 This paper has been: Prepared By: Chief Officer (Audit and Risk), North Lanarkshire Council and Chief Internal Auditor, NHS Lanarkshire. ☒ Reviewed By: Chief Finance Officer ☒ Endorsed By: Chief Officer ☒ 3. RECOMMENDATIONS 3.1 It is recommended that the IJB PFAC: (1) Endorse the opinion of the Chief Internal Auditors that Reasonable Assurance can be placed upon the adequacy and effectiveness of the IJB’s framework of governance, risk management and internal control for the year ended 31 March 2025. 4. VARIATIONS TO DIRECTIONS Yes No N/A
Page 2
5. BACKGROUND/SUMMARY OF KEY ISSUES The Public Bodies (Joint Working) (Scotland) Act 2014 requires the IJB to comply with the accounts and audit regulations and legislation under section 106 of the Local Government (Scotland) Act 1973. The Integrated Resources Advisory Group (IRAG) guidance sets out that IJBs should make appropriate and proportionate arrangements for audit provision, including arrangements to review risk management, governance, and control of delegated resources. A professional and objective joint internal audit service has been established in accordance with recognised internal audit standards and practices as laid out in the revised Public Sector Internal Audit Standards (PSIAS), in order to comply with article 7 of the Local Authority Accounts (Scotland) Regulations 2014. The internal audit arrangements for the IJB are provided jointly by the internal audit teams of North Lanarkshire Council and NHS Lanarkshire. Appendix 1 is the IJB Internal Auditors’ 2024/25 Annual Internal Audit Report. This report is produced annually to provide the IJB with an independent view of the overall adequacy and effectiveness of the framework of governance, risk management, and control within the IJB. In turn, this informs the compilation of the IJB’s draft Annual Governance Statement, which forms part of the IJB’s Annual Accounts. 5.1 The Internal Audit Annual Audit Report 2024/2025 is based on the outcomes of the internal audit reviews of North Lanarkshire IJB Governance Arrangements and Strategy (draft report), the assessment of action taken to address previous internal audit actions, issued on 26 June 2025, review of the IJB draft Governance Statement and relevant reviews contained within the partner organisation Internal Audit Plans for 2024/2025. 6. CONCLUSIONS 6.1 The Internal Audit Annual Audit Report for 2024/2025 provides a high-level overview of the activity undertaken by the Internal Audit teams during the year, as reflected in the annual opinion. 6.2 Based on the work undertaken directly on behalf of the IJB and being informed by internal audit work undertaken independently by each respective internal audit function within North Lanarkshire Council and NHS Lanarkshire, it is concluded that Reasonable Assurance can be provided on the adequacy and effectiveness of the IJB’s framework of governance, risk management, and internal controls for the year ending 31 March 2025. 6.3 Internal Audit will, as part of the agreed 2025/2026 workplan, undertake follow-up work on the implementation of actions agreed in response to relevant audit recommendations and report on this work to the PFAC during 2025/2026. 7. IMPLICATIONS 7.1 National Outcomes Link(s) to National Health and Wellbeing Outcomes:
Page 3
People are able to look after and improve their own health and wellbeing and live in good health for longer ☒ People, including those with disabilities or long-term conditions, or who are frail, are able to live, as far as reasonable practicable, independently and at home or in a homely setting in their community ☒ People who use Health and Social Care Services have positive experiences of those services, and have dignity respected ☒ Health and Social Care Services are centred on helping to maintain or improve the quality of life of people who use those services ☒ Health and Social Care Services contribute to reducing health inequalities ☒ People who use Health and Social Care Services are safe from harm ☒ People who work in Health and Social Care Services feel engaged with the work they do and are supported to continuously improve the information, support, care and treatment they provide ☒ Resources are used effectively and efficiently in the provision of Health and Social Care Services ☒ 7.2 Associated Measure(s) The PFAC and both partners are required to ensure effective governance arrangements are in place. 7.3 Financial There was no charge for the provision of internal audit work as joint working arrangements have been developed to deliver this service. This paper has been reviewed by Finance: Yes No N/A 7.4 Risk Assessment/Risk Management The management of risk is an integral part of the development of the Internal Audit Plan. The IJB risk register was reviewed as part of year end assurance work. The ‘Ineffective Governance arrangements’ risk is scored as Low. Mitigating controls include the review of IJB governance arrangements and update of associated documents and the review of Internal Audit team programme of work and participation in the IJB. 7.5 Engagement & Participation The Chief Officer and the Chief Financial Officer have both been consulted on the content of the Internal Audit Annual Report 2024/2025. Objectives Further details ☐ Involve stakeholders in the development work aimed at achieving the national outcomes N/A ☐ Provide stakeholders with information on how to get involved N/A ☐ Ensure a diverse range of engagement and participation and opportunities are in place to suit different needs N/A
Page 4
☐ Measure how well we involve community stakeholders in the planning, design and delivery of our services N/A ☐ Provide regular feedback on how stakeholder engagement and participation is shaping and influencing service development and delivery N/A ☐ Provide support to enable stakeholder representatives to participate meaningfully and confidently at meetings N/A ☐ Develop participation guidelines to ensure a common understanding and set of expectations for both stakeholders and partnership staff N/A ☐ Support engagement planning and participation in localities, taking account of other engagement activity and local plans across the Community Planning Partnership N/A 7.6 Inequalities & Fairer Scotland Duty EQIA Completed & Fairer Scotland Impact Assessment Form Completed and attached to report: Yes No N/A EQIA added to website: Yes No N/A 8. BACKGROUND PAPERS None. 9. APPENDICES Appendix 1 Internal Audit Annual Report 2024/2025 ............................................................................. CHIEF OFFICER (or Depute) Members seeking further information about any aspect of this report, please contact the following: Francis Scott, Chief Officer Audit and Risk, North Lanarkshire Council: ScottFr@northlan.gov.uk Jocelyn Lyall, Chief Internal Auditor, NHS Lanarkshire: Jocelyn.lyall2@nhs.scot
Page 5
INTERNAL AUDIT ANNUAL REPORT 2024/2025 Appendix 1 1 Purpose of Report 1.1 To report the activities undertaken by Internal Audit on behalf of the IJB for the year 2024/2025, and to present an independent annual opinion on the adequacy and effectiveness of the IJB’s internal controls based on the work undertaken during the year. 2 Background 2.1 Internal Audit is an independent and objective assurance function designed to add value and improve the IJB’s operations. It helps the IJB accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of the IJB’s risk management, internal control and governance processes thereby assisting the IJB, the Performance, Finance and Audit Committee (PFAC), and the Senior Management Team to effectively discharge their role and responsibilities. 2.2 Internal Audit reports to the PFAC which also approves the Internal Audit annual audit plan and monitors the performance of the function. 2.3 Internal audit activity is planned to enable an independent annual opinion to be given by the Chief Internal Auditors on the adequacy and effectiveness of internal controls within the IJB, including the systems that achieve the corporate objectives of the IJB, and those that manage the material risks they face. It should be noted, however, that the presence of an effective internal audit function contributes towards, but is not a substitute for, effective control. It is primarily the responsibility of management to establish internal controls so that the IJB’s activities are conducted in an efficient and well-ordered manner, to ensure that management policies and directives are adhered to, and that any relevant assets and records are safeguarded. 3 High level overview of Internal Audit activity during 2023/2024 3.1 Both internal audit functions operated throughout 2024/2025 in accordance with the Public Sector Internal Audit Standards (PSIAS). 3.2 The 2024/25 Internal Audit Annual Plan included two audits in the areas of Governance and Strategy. 3.3 For the audit of Governance, Internal Audit was satisfied that the governance structures in place within the IJB provide effective oversight, challenge and direction, and are consistent with the Scottish Government guidance document “The Blueprint for Good Governance in NHS Scotland”, and the audit was therefore deemed to provide Adequate Assurance. The main finding from the audit work was for management to implement enhanced monitoring and reporting of previously agreed audit recommendations, to ensure the resulting actions are implemented within a reasonable timescale. 3.4 Internal Audit also completed a review of the content of the Strategic Commissioning Plan 2023-26, the associated governance and performance reporting arrangements for delivery of the Strategy and arrangements for the next iteration of the Strategy. The draft report was issued on 2 September and is currently with Management for factual accuracy check and response. Internal Audit provided ‘Reasonable Assurance’ and concluded positively on the content of the extant Strategic Commissioning Plan and noted that reporting on the Programme of Works to implement the Strategy could be enhanced. The report provided suggestions to further develop plans for the next iteration of the Strategic Commissioning Plan with a focus on the role of the Board in contributing to development of the Strategic Commissioning Plan and in monitoring progress. 4.2 In addition, the North Lanarkshire Council and NHS Lanarkshire internal audit teams undertook a range of audit work within their respective organisations. 4.3 For North Lanarkshire Council this included a review of the quality assurance arrangements for social work and social care, which included monitoring of external care providers and
Page 6
compliance with the contract management framework. Further audit work was undertaken on a range of systems and activities in the areas of corporate governance, performance management, cyber security, business continuity planning, project management and payroll which also provide general assurance in respect of North Lanarkshire Council operations for which the IJB has delegated responsibility. The Council’s Internal Audit Annual Report for 2024/25 provided an overall annual opinion of Reasonable Assurance in relation to governance, risk management and internal control. 4.4 Of note for NHS Lanarkshire were the Internal Control Evaluation and Annual Internal Audit Report 2024/25, both of which provided a holistic view of the adequacy and effectiveness of Internal Controls across NHS Lanarkshire, including delegated functions. In the 2024/25 Annual Report the Chief Internal Auditor concluded that NHS Lanarkshire Board has adequate and effective governance, risk management and internal control arrangements in place and the Accountable Officer had implemented a governance framework in line with required guidance sufficient to discharge the responsibilities of this role. Internal Audit identified three significant and one moderate action points in the areas of: governance of the Performance, Planning and Resources Committee; timing of production and presentation of Annual Reports to provide year end assurances; performance reporting highlighting key performance issues and clearly linking performance to risk; the risk associated with Artificial Intelligence. 4.5 Other relevant NHS Lanarkshire 2024/25 audits included reviews of Requisitioning, Order and Receipt, Financial Planning, Financial Management, Clinical Governance, Cyber Resilience / Information Security, Board & Operational Committees, Risk Management, Strategic Planning, Review of Delayed Discharge & Data and Waiting Times. 4.6 Audit work undertaken within North Lanarkshire Council and NHS Lanarkshire support a generally positive view of the IJB’s governance and internal control arrangements. 4.7 In addition, we confirmed consistency of the draft IJB Annual Governance Statement with information that we are aware of from our work. 4.8 The results from our work suggest that there are no matters that we require to highlight. No significant weaknesses and no material frauds or irregularities resulting in financial loss to the IJB were identified in 2024/2025 that require to be brought to your attention. 4 Annual Internal Audit Opinion 5.1 There is a formal requirement for the Chief Internal Auditors to prepare an annual opinion on the organisation’s internal control system. The opinion is presented to members of the IJB Committee and the Chief Officer, North Lanarkshire Health and Social Care Partnership and is intended to provide independent and objective assurance to these different stakeholders as to the adequacy and effectiveness of internal controls within the IJB. 5.2 The evaluation of the control environment is informed by a number of sources. In bringing these together, consideration has been given to whether there is evidence that any key controls are absent, inadequate or ineffective and whether the existence of any weaknesses identified, taken independently or with other findings, significantly impairs the IJB’s overall systems of internal control. Wider issues relating to the IJB’s corporate governance and risk management arrangements have also been considered. 5.3 We would like to thank all IJB staff who have assisted Internal Audit during the course of our work throughout 2024/2025. Basis of Opinion 5.4 The evaluation of the control environment is informed by: The internal audit review of Governance Arrangements. The internal audit review of Strategy (issued in draft on 2 September 2025) Progress with the delivery of previous internal audit action points. Review of the IJB draft Governance Statement 2024/25 Our wider knowledge of the IJB’s corporate governance, risk management and
Page 7
performance management arrangements. Relevant reports issued by NHS Lanarkshire and North Lanarkshire Council Internal Audit teams during 2024/2025.Opinion It is our opinion that we can provide reasonable assurance on the adequacy and effectiveness of the North Lanarkshire Health and Social Care Integration Joint Board’s framework of governance, risk management, and internal control for the year ended 31 March 2025.
Page 8
LEVEL OF ASSURANCE DEFINITION North Lanarkshire Council Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Substantial assurance Sound systems for risk, control and governance are in place and should be effective in mitigating risks to the achievement of business and control objectives. Some minor improvements to existing controls in a few areas may be required. Reasonable assurance The systems for risk, control and governance are largely satisfactory, but there is some scope for improvement as the present arrangements could undermine the achievement of business and/or control objectives and/or leave them vulnerable to some risk of error/abuse. Limited assurance The systems for risk, control and governance have some satisfactory aspects, but contain a number of significant weaknesses that are likely to undermine the achievement of business and/or control objectives and leave them vulnerable to an unacceptable risk of error or abuse.
Page 9
NHS Lanarkshire Internal Audit Objective To assist management in assessing the overall opinion of the area under review, Internal Audit has assessed the system adequacy and control application, and categorised the opinion based on the following criteria. Level of Assurance System Adequacy Controls Substantial A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Controls are applied continuously or with minor lapses. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Controls are applied frequently but with evidence of non-compliance. Limited Significant, gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited Controls are applied but with some significant lapses. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. High risk of objectives not being achieved due to the absence of key internal controls. Significant breakdown in the application of controls.