ITEM 12 Internal Audit Annual Report 2023-24
North Lanarkshire Council · 21 August 2024
Back to IJB Performance, Finance and Audit Committee — 21 August 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 REPORT Item No: 12 SUBJECT: Internal Audit Annual Audit Report 2023/2024 TO: Integration Joint Board Performance Finance & Audit Committee Lead Officer for Report: Ross McGuffie, Chief Officer NL HSCP Author(s) of Report Paula Hendry Acting Chief Officer (Audit and Risk), North Lanarkshire Council Jocelyn Lyall Chief Internal Auditor, NHS Lanarkshire DATE: 21 August 2024 1. PURPOSE OF REPORT 1.1 This paper is coming to the IJB Performance, Finance and Audit Committee (PFAC): For approval For endorsement To note 2. ROUTE TO THE BOARD 2.1 This paper has been: Prepared By: Acting Chief Officer (Audit and Risk), North Lanarkshire Council and Chief Internal Auditor, NHS Lanarkshire. ☒ Reviewed By: Chief Finance Officer ☒ Endorsed By: Chief Officer ☒ 3. RECOMMENDATIONS 3.1 It is recommended that the IJB PFA: (1) Endorse the opinion of the Chief Internal Auditors that Reasonable Assurance can be placed upon the adequacy and effectiveness of the IJB’s framework of governance, risk management and internal control for the year ended 31 March 2024. 4. VARIATIONS TO DIRECTIONS Yes No N/A
Page 2
2 5. BACKGROUND/SUMMARY OF KEY ISSUES The Public Bodies (Joint Working) (Scotland) Act 2014 requires the IJB to comply with the accounts and audit regulations and legislation under section 106 of the Local Government (Scotland) Act 1973. The Integrated Resources Advisory Group (IRAG) guidance sets out that IJBs should make appropriate and proportionate arrangements for audit provision, including arrangements to review risk management, governance, and control of delegated resources. A professional and objective joint internal audit service has been established in accordance with recognised internal audit standards and practices as laid out in the revised Public Sector Internal Audit Standards (PSIAS), in order to comply with article 7 of the Local Authority Accounts (Scotland) Regulations 2014. The internal audit arrangements for the IJB are provided jointly by the internal audit teams of North Lanarkshire Council and NHS Lanarkshire. Appendix 1 is the IJB Internal Auditors’ 2023/24 Annual Internal Audit Report. This report is produced annually to provide the IJB PFAC with an independent view of the overall adequacy and effectiveness of the framework of governance, risk management, and control within the IJB. In turn, this informs the compilation of the IJB’s draft Annual Governance Statement, which forms part of the IJB’s Annual Accounts. 5.1 The Internal Audit Annual Audit Report 2023/2024 is based on a body of work contained within the partner organisation Internal Audit Plans for 2023/2024 and also takes cognisance of the outcomes of the internal audit review of North Lanarkshire IJB governance arrangements and the assessment of action taken to address previous internal audit actions, issued on 11 July 2024. 6. CONCLUSIONS 6.1 The Internal Audit Annual Audit Report for 2023/2024 provides a high-level overview of the activity undertaken by the Internal Audit teams during the year, as reflected in the annual opinion. 6.2 Based on the work undertaken directly on behalf of the IJB and being informed by internal audit work undertaken independently by each respective internal audit function within North Lanarkshire Council and NHS Lanarkshire, it is concluded that reasonable assurance can be placed upon the adequacy and effectiveness of the IJB’s framework of governance, risk management, and internal controls for the year ending 31 March 2024. 6.3 Internal Audit will, as part of the agreed 2024/2025 workplan, develop and agree arrangements to undertake follow-up work on the implementation of actions agreed in response to relevant audit recommendations and report on this work to the PFAC during 2024/2025. 7. IMPLICATIONS 7.1 National Outcomes Link(s) to National Health and Wellbeing Outcomes:
Page 3
3 People are able to look after and improve their own health and wellbeing and live in good health for longer ☒ People, including those with disabilities or long-term conditions, or who are frail, are able to live, as far as reasonable practicable, independently and at home or in a homely setting in their community ☒ People who use Health and Social Care Services have positive experiences of those services, and have dignity respected ☒ Health and Social Care Services are centred on helping to maintain or improve the quality of life of people who use those services ☒ Health and Social Care Services contribute to reducing health inequalities ☒ People who use Health and Social Care Services are safe from harm ☒ People who work in Health and Social Care Services feel engaged with the work they do and are supported to continuously improve the information, support, care and treatment they provide ☒ Resources are used effectively and efficiently in the provision of Health and Social Care Services ☒ 7.2 Associated Measure(s) The PFAC and both partners are required to ensure effective governance arrangements are in place. 7.3 Financial There was no charge for the provision of internal audit work as joint working arrangements have been developed to deliver this service. This paper has been reviewed by Finance: Yes No N/A 7.4 Risk Assessment/Risk Management The management of risk is an integral part of the development of the Internal Audit Plan. The IJB risk register was reviewed as part of year end assurance work. The ‘Ineffective Governance arrangements’ risk rating was reduced from Medium to Low during 2023/24. The mitigating controls include work being carried out to embed governance processes within the Health & Social Care Partnership including risk review, complaints, patient feedback, adverse events and completion of the IJB Governance Self‐Assessment. 7.5 Engagement & Participation The Chief Officer and the Chief Financial Officer have both been consulted on the preparation of the Internal Audit Annual Report 2023/2024. Objectives Further details ☐ Involve stakeholders in the development work aimed at achieving the national outcomes N/A ☐ Provide stakeholders with information on how to get involved N/A ☐ Ensure a diverse range of engagement and participation and opportunities are in N/A
Page 4
4 place to suit different needs ☐ Measure how well we involve community stakeholders in the planning, design and delivery of our services N/A ☐ Provide regular feedback on how stakeholder engagement and participation is shaping and influencing service development and delivery N/A ☐ Provide support to enable stakeholder representatives to participate meaningfully and confidently at meetings N/A ☐ Develop participation guidelines to ensure a common understanding and set of expectations for both stakeholders and partnership staff N/A ☐ Support engagement planning and participation in localities, taking account of other engagement activity and local plans across the Community Planning Partnership N/A 7.6 Inequalities & Fairer Scotland Duty EQIA Completed & Fairer Scotland Impact Assessment Form Completed and attached to report: Yes No N/A EQIA added to website: Yes No N/A 8. BACKGROUND PAPERS None. 9. APPENDICES Appendix 1 Internal Audit Annual Report 2023/2024 ............................................................................. CHIEF OFFICER (or Depute) Members seeking further information about any aspect of this report, please contact the following: Paula Hendry, Acting Chief Officer (Audit and Risk), North Lanarkshire Council: hendryp@northlan.gov.uk Jocelyn Lyall, Chief Internal Auditor, NHS Lanarkshire: Jocelyn.lyall2@nhs.scot
Page 5
5 INTERNAL AUDIT ANNUAL AUDIT REPORT 2023/2024 Appendix 1 1 Purpose of Report 1.1 To report the activities undertaken by Internal Audit on behalf of the IJB for the year 2023/2024, and to present an independent annual opinion on the adequacy and effectiveness of the IJB’s internal controls based on the work undertaken during the year. 2 Background 2.1 Internal Audit is an independent and objective assurance function designed to add value and improve the IJB’s operations. It helps the IJB accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of the IJB’s risk management, internal control and governance processes thereby assisting the IJB, the Performance, Finance and Audit Committee (PFAC), and the Senior Management Team to effectively discharge their role and responsibilities. 2.2 Internal Audit reports its outputs to the PFAC which also approves the Internal Audit annual audit plan and monitors the performance of the function. 2.3 Internal audit activity is planned to enable an independent annual opinion to be given by the Chief Internal Auditors on the adequacy and effectiveness of internal controls within the IJB, including the systems that achieve the corporate objectives of the IJB, and those that manage the material risks they face. It should be noted, however, that the presence of an effective internal audit function contributes towards, but is not a substitute for, effective control. It is primarily the responsibility of line management to establish internal controls so that the IJB’s activities are conducted in an efficient and well-ordered manner, to ensure that management policies and directives are adhered to, and that any relevant assets and records are safeguarded. 3 High level overview of Internal Audit activity during 2023/2024 3.1 Both internal audit functions operated throughout 2023/2024 in accordance with the Public Sector Internal Audit Standards (PSIAS). 3.2 Internal Audit completed a review of the IJB Governance Checklist self-assessment and provided an adequate level of assurance. The review concluded that the arrangements in place for reviewing and assessing the governance framework are largely satisfactory and that this framework is generally consistent with legislative requirements and expected good practice. We identified the need to ensure that all improvement actions identified from the self-assessment are carried forward to the Annual Governance Statement and thereafter tracked and monitored to completion. This review also assessed the extent to which management have implemented those actions previously committed to, in response to both recommendations contained in previous internal and external audit reports and improvement actions identified by management in previous years Annual Governance Statements. Whilst reasonable progress has been made, there is a need to ensure that outstanding actions are timeously progressed to completion. 4.2 In addition, the North Lanarkshire Council and NHS Lanarkshire internal audit teams undertook a range of audit work within their respective organisations. For North Lanarkshire Council this included work undertaken on a range of systems and activities in the areas of including procurement, creditors, petty cash and payroll which also provide assurance in respect of North Lanarkshire Council operations for which the IJB has delegated responsibility. 4.3 Of particular note for NHS Lanarkshire were the Internal Control Evaluation and Annual Internal Audit Report, both of which provided a holistic view of the adequacy and effectiveness of Internal Controls across NHS Lanarkshire, including delegated functions. Whilst these reviews provided positive assurance, they highlighted the demand, financial and workforce challenges facing the Board and the need for a strategic response to be developed, with partners. Other relevant areas covered by NHS Lanarkshire included resilience, adverse
Page 6
6 event management, staff governance, clinical governance, risk management, health strategy, and financial sustainability reviews. 4.4 Audit work undertaken within North Lanarkshire Council and NHS Lanarkshire support a generally positive view of the IJB’s governance and internal control arrangements. 4.5 The results from our work suggest that there are no matters that we require to highlight no significant weaknesses, areas of concern, material frauds or irregularities resulting in financial loss to the IJB were identified in 2023/2024 that require to be brought to your attention. 4 Annual Internal Audit Opinion 5.1 There is a formal requirement for the Chief Internal Auditors to prepare an annual opinion on the organisation’s internal control system. The opinion is presented to members of the PFAC and the Chief Officer, North Lanarkshire Health and Social Care Partnership and is intended to provide independent and objective assurance to these different stakeholders as to the adequacy and effectiveness of internal controls within the IJB. 5.2 The evaluation of the control environment is informed by a number of sources, and primarily by validation of the governance checklist self-assessment. In bringing these together, consideration has been given to whether there is evidence that any key controls are absent, inadequate or ineffective and whether the existence of any weaknesses identified, taken independently or with other findings, significantly impairs the IJB’s overall systems of internal control. Wider issues relating to the IJB’s corporate governance and risk management arrangements have also been considered. 5.3 We would like to thank all IJB staff who have assisted Internal Audit during the course of our work throughout 2023/2024. Basis of Opinion The evaluation of the control environment is informed by: Validation of the IJB governance self-assessment checklist. Our wider knowledge of the IJB’s corporate governance, risk management and performance management arrangements. Relevant reports issued by NHS Lanarkshire and North Lanarkshire Council Internal Audit teams during 2023/2024. Reports issued by the IJB’s External Auditors during 2023/2024, together with reports from other external review and inspection bodies. Opinion It is our opinion that reasonable assurance can be placed upon the adequacy and effectiveness of the North Lanarkshire Health and Social Care Integration Joint Board’s framework of governance, risk management, and internal control for the year ended 31 March 2024.
Page 7
7 LEVEL OF ASSURANCE DEFINITION Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion Level of Assurance Definition Substantial assurance Sound systems for risk, control and governance are in place and should be effective in mitigating risks to the achievement of business and control objectives. Some minor improvements to existing controls in a few areas may be required. Adequate assurance The systems for risk, control and governance are largely satisfactory, but there is some scope for improvement as the present arrangements could undermine the achievement of business and/or control objectives and/or leave them vulnerable to some risk of error/abuse. Limited assurance The systems for risk, control and governance have some satisfactory aspects, but contain a number of significant weaknesses that are likely to undermine the achievement of business and/or control objectives and leave them vulnerable to an unacceptable risk of error or abuse. Recommendation priority Priority Definition Red Significant weaknesses which management needs to address to achieve objectives. Amber Weaknesses which require prompt action to avoid exposure to risks in achieving objectives. Green Action advised/area for improvement to enhance control or improve efficiency.