Item 6 - Internal Audit Review - Due Diligence Review
North Lanarkshire Council · 21 September 2022
Back to Health and Social Care Integration Joint Board — 21 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 REPORT Item No: 6 SUBJECT: Internal Audit Annual Audit Report 2021/2022 TO: Integration Joint Board Lead Officer for Report: Ross McGuffie, Chief Officer North HSCP Author(s) of Report Ken Adamson Head of Audit and Risk (North Lanarkshire Council) Tony Gaskin Chief Internal Auditor (NHS Lanarkshire) DATE: 21st September 2022 1. PURPOSE OF REPORT 1.1 This paper is coming to the Integration Joint Board (IJB): For approval For endorsement To note 1.2 This report provides details of the Internal Audit Annual Audit Report for the financial year 2021/2022 which also contains the independent annual opinion of the IJB’s Chief Internal Auditors on the adequacy and effectiveness of the IJB’s governance, risk management and internal control arrangements for the year ending 31 March 2022. 2. ROUTE TO THE INTEGRATION JOINT BOARD 2.1 This paper has been: 3. RECOMMENDATIONS 3.1 The IJB is asked to agree the following recommendations: (1) Note the contents of the report; and (2) Endorse the opinion of the Chief Internal Auditors that reasonable assurance can be placed upon the adequacy and effectiveness of the IJB’s framework of governance, risk management and internal control for the year ended 31 March 2022. 4. VARIATIONS TO DIRECTIONS Yes No N/A 5. BACKGROUND/SUMMARY OF KEY ISSUES 5.1 A Scottish Government Advisory Group - the Integrated Resource Advisory Group (IRAG) – produced professional guidance on integration and the responsibilities of the IJBs. This guidance included the responsibility of the IJB to establish Prepared by: Head of Audit and Risk (North Lanarkshire Council) Chief Internal Auditor (NHS Lanarkshire) Reviewed by; Chief Officer
Page 2
2 adequate and proportionate Internal Audit arrangements for review of the adequacy of arrangements for risk management, governance and control of the delegated resources. 5.2 The internal audit arrangements for the IJB are provided jointly by the internal audit teams of North Lanarkshire Council (NLC) and NHS Lanarkshire (NHSL)
Page 3
3 5. BACKGROUND/SUMMARY OF KEY ISSUES (CONT.) 5.3 In order to comply with the Public Sector Internal Audit Standards (PSIAS) and the approved Internal Audit Charter for the IJB, the Chief Internal Auditors of NLC and NHSL, acting jointly as the appointed Chief Internal Auditor for the IJB are required to present to the IJB an annual summary of the work undertaken by the Internal Audit teams and to provide an annual opinion on the adequacy and effectiveness of the IJB’s corporate governance, risk management and internal control arrangements. 5.4 The Internal Audit Annual Audit Report 2021/2022 is based on a body of work contained within the Internal Audit Plan for 2021/2022 which was previously approved by the IJB Performance, Finance and Audit Committee. 6. CONCLUSIONS 6.1 The Internal Audit Annual Audit Report for 2021/2022, a copy of which is attached, presents a high-level overview of the activity undertaken by the Internal Audit teams during the year and which are reflected in the annual opinion. 6.2 Based on the work undertaken directly on behalf of the IJB and being informed by internal audit work undertaken independently by each respective internal audit function within NLC and NHSL, it is concluded that reasonable assurance can be placed upon the adequacy and effectiveness of the IJB’s framework of governance, risk management and internal controls for the year ending 31 March 2022. 6.3 A number of recommendations and improvement actions have been agreed with senior management arising from audit work undertaken during the year. Internal Audit will, as part of the 2022/2023 workplan, develop and agree arrangements to undertake follow-up work on the implementation of actions agreed in response to relevant audit recommendations and report on this work to the IJB Performance, Finance and Audit Committee during 2022/2023. 6.4 Internal Audit staff appreciated the help and co-operation extended to them by the officers of the IJB and the staff within the partnership. 7. IMPLICATIONS 7.1 NATIONAL OUTCOMES This relates to all nine national outcomes. 7.2 ASSOCIATED MEASURE(S) The IJB and both partners are required to establish effective governance arrangements across the partnership. 7.3 FINANCIAL This paper has been reviewed by Finance: Yes No N/A 7.4 RISK ASSESSMENT/RISK MANAGEMENT Failure to operate an effective Internal Audit function consistent with the Public Sector Internal Audit Standards (PSIAS) could impair the Council’s compliance with its Code of Corporate Governance 7.5 PEOPLE
Page 4
4 None. 7.6 INEQUALITIES & FAIRER SCOTLAND DUTY EQIA Completed & Fairer Scotland Impact Assessment Form Completed: Yes No N/A 7.7 CARBON MANAGEMENT IMPLICATIONS Yes No N/A CHIEF ACCOUNTABLE OFFICER (or Depute) Members seeking further information about any aspect of this report, please contact Ross McGuffie on telephone number 01698 752 591.
Page 5
5 INTERNAL AUDIT ANNUAL AUDIT REPORT 2021/2022 Appendix 1 1 Purpose of Report 1.1 To report the activities undertaken by Internal Audit on behalf of the IJB for the year 2021/2022 and to present an independent annual opinion on the adequacy and effectiveness of the IJB’s internal controls based on the work undertaken during the year. 2 Background 2.1 Internal Audit is an independent and objective assurance function designed to add value and improve the IJB’s operations. It helps the IJB accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of the IJB’s risk management, internal control and governance processes thereby assisting the IJB, the Performance, Finance and Audit Committee (‘the Committee’) and the senior management team to effectively discharge their role and responsibilities. 2.2 Internal Audit’s purpose, authority and responsibilities are set out in more detail in the Internal Audit Charter, which was previously approved by the Performance, Finance and Audit Sub- Committee. 2.3 Internal Audit reports its outputs to the Committee which also approves Internal Audit’s annual audit plan and monitors the performance of the function. 2.4 Internal Audit activity is planned to enable an independent annual opinion to be given by the Chief Internal Auditors on the adequacy and effectiveness of internal controls within the IJB, including the systems that achieve the corporate objectives of the IJB and those that manage the material risks they face. It should be noted, however, that the presence of an effective internal audit function contributes towards, but is not a substitute for, effective control and it is primarily the responsibility of line management to establish internal controls so that the IJB’s activities are conducted in an efficient and well-ordered manner, to ensure that management policies and directives are adhered to and that any relevant assets and records are safeguarded. 3 High level overview of Internal Audit activity during 2021/2022 3.1 We are pleased to confirm that Internal Audit operated throughout 2021/2022 with no impairments or restrictions in scope or independence. Internal Audit activity during the year was undertaken in accordance with the Internal Audit Annual Plan which was approved by the IJB Performance, Finance and Audit Committee. 3.2 Action plans are agreed with management in response to all recommendations made within Internal Audit reports. These actions will be followed up to ensure that actions agreed by management in response to audit recommendations have been successfully implemented. 3.3 Both Internal Audit functions operated throughout 2021/2022 in accordance with the Public Sector Internal Audit Standards (PSIAS).
Page 6
6 INTERNAL AUDIT ANNUAL AUDIT REPORT 2021/2022 (Continued) Appendix 1 (Continued) 4 Issues arising from Internal Audit activity during 2021/2022 4.1 Three Internal Audit assignments were planned during the year. The status of these reviews are detailed in the table below. Report title Status Date issued Level of Assurance (see Appendix 4 for definitions) Follow up of actions previously agreed by management in response to Audit recommendations Complete March 2022 N/A Response to Covid-19 Pandemic - Strategic Planning In progress Expected October 2022 To be confirmed Value For Money Audit – Joint Equipment Store Projec t Deferre d Project Deferred N/A 4.2 The limited progress by the Project Group established in respect of the potential joint equipment store has meant that no specific audit work was undertaken this year. Internal Audit will ensure that consideration is given to including value for money work in this area in future work programmes when appropriate. 4.3 In addition to the above work, NLC and NHSL undertook a range of audit work within their respective organisations. For NLC this included work undertaken on a range of systems and activities (such as business continuity planning, procurement, risk management and key financial systems such as creditors and payroll) which also provide assurance in respect of NLC operations for which the IJB has delegated responsibility. Of particular note for NHSL were the Internal Control Evaluation and Annual Internal Audit report, both of which provided a holistic view of the adequacy and effectiveness of Internal Controls across NHSL, including delegated functions. Whilst these NHSL reviews provided positive assurance, they highlighted the demand, financial and workforce challenges facing the Board and the need for a strategic response to be developed, with partners. Other relevant areas covered by NHSL included resilience, adverse event management, Staff governance, clinical governance, risk management, health strategy and a range of Information governance reviews. 4.4 Internal Audit recognises that Integration Authorities are functioning within a challenging environment and that delivering the key national and local objectives around integration, whilst managing demand for services within available budgets, continues to be a significant challenge. The additional challenges presented in 2021/2022 by the COVID-19 pandemic further increased the scale and complexity of issues facing the IJB. Overall, however, the findings and results of our work, including evidence obtained as part of audit reviews which have not yet been formally completed and audit work undertaken as part of work done within NLC and NHSL, support a generally positive view of the IJB’s governance and internal control arrangements.
Page 7
7 4.5 NHS Fife, Tayside and Forth Valley Internal Audit Service (FTF) have developed and now trialled a Strategy Development Checklist, which has been shared with management and will be used to assess the IJB’s approach to developing a strategic response to the challenges posed by Covid as part of the process of updating the Strategic Plan. This audit was delayed to allow the checklist to be tested and enhanced and the work is being conducted as part of a tri-partite approach including reviews of Strategy development within South Lanarkshire IJB and NHS Lanarkshire, as well as North Lanarkshire IJB.
Page 8
8 INTERNAL AUDIT ANNUAL AUDIT REPORT 2021/2022 (Continued) Appendix 1 (Continued) 4.6 Work on the follow up of IJB actions previously agreed by management in response to audit recommendations was generally positive. However, the impacts of the pandemic has required priorities to be reassessed, which has in turn had an impact on the time and resources allocated to progress agreed actions and on the ability of management to achieve many of the original timescales which had been set. We were pleased to note that management have, however, committed to revised timescales to complete the identified actions to appropriately address the weaknesses/improvement areas in audit outputs. We will continue to follow-up management implementation of all agreed actions during 2022/2023. 4.7 The results from our work suggest that there are no matters that we require to highlight and that compliance with the requirements of the corporate governance framework adopted by the IJB continues to be positive with no significant weaknesses, areas of concern, material frauds or irregularities resulting in financial loss to the IJB identified in 2021/2022 that require to be brought to your attention. 5 Annual Internal Audit Opinion 5.1 There is a formal requirement for the Chief Internal Auditors to prepare an annual opinion on the organisation’s internal control system. The opinion is presented to members of the IJB Performance, Finance and Audit Committee and the Chief Officer for Health and Social Care Integration and is intended to provide independent and objective assurance to these different stakeholders as to the adequacy and effectiveness of internal controls within the IJB. 5.2 The evaluation of the control environment is informed by a number of sources and in bringing these together, consideration has been given to whether there is evidence that any key controls are absent, inadequate or ineffective and whether the existence of any weaknesses identified, taken independently or with other findings, significantly impairs the IJB’s overall systems of internal control. Wider issues relating to the IJB’s corporate governance and risk management arrangements have also been considered. 5.3 The nature of individual audit assignments is such that most Internal Audit reports identify some weaknesses or areas where scope for improvement exists. However, we are pleased to report that, generally across the IJB, there continues to be a strong recognition amongst management of the importance of appropriate governance arrangements and proportionate but effective internal controls. 5.4 During work undertaken in 2021/2022 there have been instances where Internal Audit has made recommendations to further improve the systems of control and compliance, but Internal Audit do not consider these weaknesses significant enough to require to be highlighted in the Annual Audit Report. 5.5 The formal annual Internal Audit opinion on the soundness of the IJB’s internal control systems is presented at Appendix 2. Overall, the results of the work of Internal Audit in 2021/2022 taken with other information available did not lead us to conclude that the IJB’s overall systems of internal control were significantly or materially impaired. 5.6 I would like to thank all IJB staff who have assisted Internal Audit during the course of our work throughout 2021/2022 and to thank senior management and IJB Members for the consideration and due regard given to our work.
Page 9
9 Ken Adamson Tony Gaskin Head of Audit and Risk Chief Internal Auditor (NHS Lanarkshire) North Lanarkshire Council NHS Lanarkshire 7 September 2022 7 September 2022
Page 10
10 INTERNAL AUDIT OPINION 2021/2022 Appendix 2 To the members of North Lanarkshire IJB’s Performance, Finance and Audit Committee and the Chief Officer for Health and Social Care Integration As Joint Chief Internal Auditors, we are pleased to present the annual statement on the adequacy and effectiveness of the IJB’s framework of governance, risk management and internal control for the year ended 31 March 2022. Respective responsibilities of management and internal auditors in relation to governance, risk management and internal control It is the responsibility of the IJB’s senior management to establish appropriate and sound systems of governance, risk management and internal control and to monitor the continuing effectiveness of those systems. It is the responsibility of the Chief Internal Auditors of the IJB to provide an independent annual opinion on the adequacy and effectiveness of the IJB’s framework of governance, risk management and internal control. The IJB’s framework of governance, risk management and internal controls The main objectives of the IJB’s framework of governance, risk management and internal controls are to ensure that resources are directed in accordance with agreed plans, policies and priorities and to ensure that there is sound decision-making and clear accountability for the use of those resources in order to achieve the desired outcomes for service users and communities. This will include ensuring that appropriate internal controls and risk management arrangements are in place to effectively manage issues which might impact on the delivery of delegated functions, the achievement of corporate objectives and public confidence in the IJB. The IJB also requires effective internal controls and risk management arrangements to safeguard its employees, to protect its assets, to maintain effective stewardship of public funds, to ensure good corporate governance, to ensure compliance with statutory requirements and to ensure it continues to deliver best value. The work of Internal Audit Internal Audit is an independent and objective assurance function established by the IJB designed to add value and improve the IJB’s operations. It helps the IJB accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of the IJB’s risk management, control and governance processes and by providing an independent and objective opinion on the IJB’s internal control environment. It also objectively examines, evaluates and reports on the adequacy of the control environment as a contribution to the proper, economic, efficient and effective use of the IJB’s resources. The Internal Audit teams operated throughout 2021/2022 in accordance with the Public Sector Internal Audit Standards (PSIAS). Internal Audit undertakes an annual programme of work formally approved by the IJB Performance, Finance and Audit Committee. The audit plan is revised on an ongoing basis to reflect an ongoing assessment of the evolving risks and changes within the IJB.
Page 11
11 All Internal Audit reports identifying system weaknesses and/or non-compliance with expected controls are brought to the attention of management and include appropriate recommendations and agreed action plans. It is management’s responsibility to ensure that proper consideration is given to Internal Audit reports and that appropriate action is taken on audit recommendations. Internal Audit is required to ensure that appropriate arrangements are made to determine whether action has been taken on Internal Audit recommendations or, where appropriate, that management has understood and assumed the risk of not acting. Significant matters (including non-compliance with audit recommendations) arising from internal audit work are, when required, reported to the Chief Officer and to the IJB Performance, Finance and Audit Committee.
Page 12
12 INTERNAL AUDIT OPINION 2020/2021 (Continued) Appendix 2 (Continued) Basis of Opinion The evaluation of the control environment is informed by several sources: ▪ the audit work undertaken by Internal Audit during the year to 31 March 2022; ▪ the assessment of risk completed during the preparation of the 2021/2022 and 2022/2023 annual plans; ▪ our wider knowledge of the IJB’s corporate governance, risk management and performance management arrangements; ▪ other relevant reports issued by NHSL and NLC Internal Audit teams during 2021/2022; and ▪ reports issued by the IJB’s external auditors during 2021/2022, together with reports from other external review and inspection bodies. Opinion It is our opinion that reasonable assurance can be placed upon the adequacy and effectiveness of the North Lanarkshire Health and Social Care Integration Joint Board’s framework of governance, risk management and internal control for the year ended 31 March 2022. Ken Adamson CPFA Tony Gaskin Head of Audit and Risk Chief Internal Auditor (NHS Lanarkshire) North Lanarkshire Council NHS Lanarkshire 8 September 2022 8 September 2022
Page 13
13 RESPONSIBILITIES OF MANAGEMENT AND INTERNAL AUDIT Appendix 3 It is the responsibility of the IJB’s senior management to establish and maintain appropriate and sound systems of governance, risk management and internal control and to monitor the continuing effectiveness of those systems. It is the responsibility of Internal Audit to provide an independent opinion on the adequacy and effectiveness of the IJB’s framework of governance, risk management and internal control. Internal audit work should not be seen as a substitute for management’s responsibilities for the design and operation of these systems. We endeavour to plan and undertake our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carry out additional work. However, internal audit procedures alone, even when carried out with due professional care, do not guarantee that all weaknesses, fraud or irregularities will be detected. Accordingly, our examinations as internal auditors should not be relied upon solely to disclose weaknesses, fraud, defalcations or other irregularities which may exist Engagements are conducted in accordance with the ‘Public Sector Internal Audit Standards’.
Page 14
14 LEVEL OF ASSURANCE DEFINITIONS Appendix 4 Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Level of Assurance Definition Substant ial assuran ce Sound systems for risk, control and governance are in place and should be effective in mitigating risks to the achievement of business and control objectives. Some minor improvements to existing controls in a few areas may be required. Adequa te assuran ce The systems for risk, control and governance are largely satisfactory, but there is some scope for improvement as the present arrangements could undermine the achievement of business and/or control objectives and/or leave them vulnerable to some risk of error/abuse. Limited assurance The systems for risk, control and governance have some satisfactory aspects, but contain a number of significant weaknesses that are likely to undermine the achievement of business and/or control objectives and leave them vulnerable to an unacceptable risk of error or abuse. Recommendation priority Priority Definition Red Significant weaknesses which management needs to address to achieve objectives. Amber Weaknesses which require prompt action to avoid exposure to risks in achieving objectives. Green Action advised/area for improvement to enhance control or improve efficiency.