ITEM 13.1 NL IJB IA progress report May 2025
North Lanarkshire Council · 21 May 2025
Back to IJB Performance, Finance and Audit Committee — 21 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Appendix 1 1 IJB Reporting Template REPORT Item No: 13.1 SUBJECT: Internal Audit Progress Report 2024/25 TO: Integration Joint Board Performance, Finance & Audit Committee. Lead Officer for Report: Nicola Scott, Chief Finance Officer Author(s) of Report Francis Scott, Chief Officer (Audit and Risk), North Lanarkshire Council Jocelyn Lyall, Chief Internal Auditor, NHS Lanarkshire Contact details for Author(s) of Report Francis Scott – ScottFr@northlan.gov.uk Jocelyn Lyall – Jocelyn.lyall2@nhs.scot DATE: 21 May 2025 1. PURPOSE OF REPORT This paper is coming to the IJB PFA for: For Approval: ☐ For Endorsement: ☐ To Note: ☒ 2. ROUTE TO THE PFA This paper has been: Prepared By: ☒ Reviewed By: ☒ Endorsed By: ☒
Page 2
Appendix 1 2 Chief Officer (Audit and Risk), North Lanarkshire Council and Chief Internal Auditor, NHS Lanarkshire) Chief Finance Officer Chief Officer 3. EXECUTIVE SUMMARY The progress in respect of the Internal Audit Plan 2024/2025 is summarised in Appendix 1. A workplan has been agreed to ensure the Internal Audit Plan 2024/2025 is delivered to inform the internal audit opinion for 2024/25. 4. RECOMMENDATIONS 4.1 It is recommended that the IJB Performance, Finance & Audit Committee: 1) Consider the attached Progress Report at Appendix 1 and the summary of relevant partner reports at Appendix 2. 2) Consider the changes arising from the new Global Internal Audit Standards (GIAS) and the implications for the Internal Audit Service and the Performance, Finance and Audit Committee. 5. VARIATIONS TO DIRECTIONS? This section outlines if the report requires a direction to be issued to the Local Authority, the Health Board, to both, or that no direction is required. 6. BACKGROUND As stated in the Integrated Resources Advisory Group guidance, it is the responsibility of the Integration Joint Board (IJB) to establish an adequate and proportionate internal audit of the arrangements for risk management, governance and control of the delegated resources. The internal audit arrangements for the IJB are provided jointly by the internal audit teams of North Lanarkshire Council and NHS Lanarkshire. The IJB approved the Internal Audit Plan 2024/2025 on 22 May 2024. A total of 60 days has been committed to undertake the IJB Internal Audit Plan, which Yes ☐ No ☒ N/A ☐
Page 3
Appendix 1 3 has been designed to target the priority issues which have been aligned to strategic risks and reflect the evolving and complex challenges to service delivery. The Internal Audit Plan 2024/2025 will provide sufficient evidence to form an Internal Audit Opinion on the overall adequacy and effectiveness of the IJB’s framework of governance, risk management and control arrangements. The Internal Audit Plan 2024/2025 also takes account of assurances which will be provided to the IJB based on the work performed under the Internal Audit Plans of both North Lanarkshire Council and NHS Lanarkshire for 2024/2025. The audit of operational activities is being undertaken under the auspices of the partner bodies. The IJB is asked to note that the outcomes of these operational audits are reported to the partner body Audit Committees and discussed with the IJB Chief Officer and IJB Chief Financial Officer. The assurances gained will be provided to the IJB as part of the overall assurances received from the partner body Audit Committees. We include a summary of relevant completed NHS Lanarkshire and North Lanarkshire Council reports at Appendix 2. 7. SUMMARY OF KEY ISSUES Progress on the Internal Audit Plan i2024/25 is at Appendix 1. The Summary of relevant partner body reports is at Appendix 2. From 1 April 2025, Public Sector Internal Audit Standards were replaced by the GIAS supported by an ‘Application Note - Global Internal Audit Standards in the UK Public Sector’. The Application Note “provides a framework for the practice of internal audit in the UK public sector when taken together with the Global Internal Audit Standards (GIAS) issued by the Institute of Internal Auditors (IIA). It sets out interpretations and requirements which need to be applied to the GIAS requirements, in order that these form a suitable basis for internal audit practice in the UK public sector.” Within the Local Government context application of GIAS is also supported by the CIPFA ‘Code of Practice for the Governance of Internal Audit in Local Government’ (The Code). The Code addresses the responsibilities of senior management and the Audit Committee towards Internal Audit to ensure that Internal Audit services delivered have the necessary authority, support and oversight of the organisation. The Code provides a link between the recommended practices in GIAS and established governance arrangements of local government bodies and reflects the legislation and practices of local government bodies. GIAS consists of 5 domains which are supported by 15 principles: • Purpose of Internal Auditing • Ethics and Professionalism (principles 1-5)
Page 4
Appendix 1 4 • Governing the Internal Audit Function (principles 6-8) • Managing the Internal Audit Function (principles 9-12) • Performing Internal Audit Services (principles 13-15) The main changes under GIAS include: • a new Purpose Statement • a requirement for internal auditors to demonstrate ‘professional scepticism’ • clearer roles and responsibilities for senior management and the Audit Committee • development and approval of an Internal Audit Mandate and Charter • development and implementation of an Audit Strategy • oversight of wider assurance sources • development of skills and technology within the function to ensure delivery of an effective internal audit service • a requirement to report where recommendations are not agreed • a requirement for formal review processes Internal audit teams are not expected to demonstrate full conformance with GIAS on 1 April 2025 but must work in accordance with the new standards from this date, and by doing so will build up conformance to GIAS during 2025/26. While much of the day-to-day internal audit practice of undertaking audit engagements will not change, it is recognised that time will be needed to make the transition to GIAS. Nationally, internal audit functions are reviewing current audit processes and an improvement plan to ensure GIAS compliance is being developed. The role of the Audit Committee is set out in some detail in GIAS Domain III “Governing the Internal Audit Function”. Whilst many of these are already in place, the main elements emphasised in GIAS are to: • Provide the mandate setting out the authority, role and responsibilities under which the Internal Audit service operates. • Review and approve the Internal Audit Charter as reflecting the Audit Committee’s expectations of the Internal Audit service that will be delivered to the IJB. • Meet with the Chief Internal Auditor on a periodic basis. • ‘Champion’ and demonstrate support for Internal Audit • Review the governance, management and reporting arrangements of the Internal Audit service. • Assist with setting audit priorities. • Review and approve arrangements for the external assessment of Internal Audit. The Chief Internal Auditors are progressing GIAS development work and the intention is to present a revised Internal Audit Charter, including the Mandate, and the Internal Audit Strategy to the next meeting of this Committee.
Page 5
Appendix 1 5 8. CONCLUSIONS The Internal Audit Plan 2024/2025 is designed to target the priority issues and to provide sufficient evidence to form an Internal Audit Opinion on the overall adequacy and effectiveness of the IJB’s framework of governance, risk management and control arrangements. 9. IMPLICATIONS 9.1 NATIONAL OUTCOMES Link(s) to National Health and Wellbeing Outcomes People are able to look after and improve their own health and wellbeing and live in good health for longer. ☐ People, including those with disabilities or long-term conditions, or who are frail, are able to live, as far as reasonably practicable, independently and at home or in a homely setting in their community. ☐ People who use Health and Social Care Services have positive experiences of those services, and have dignity respected. ☐ Health and Social Care Services are centred on helping to maintain or improve the quality of life of people who use those services. ☐ Health and Social Care Services contribute to reducing health inequalities. ☐ People who use Health and Social Care Services are safe from harm. ☐ People who work in Health and Social Care Services feel engaged with the work they do and are supported to continuously improve the information, support, care and treatment they provide. ☐ Resources are used effectively and efficiently in the provision of Health and Social Care Services. ☒ 9.2 ASSOCIATED MEASURE(S) 9.3 FINANCIAL There are no financial impacts arising directly from this report. This paper has been reviewed by Finance: Yes X No N/A
Page 6
Appendix 1 6 9.4 RISK ASSESSMENT/RISK MANAGEMENT The internal audit planning process which produced the Annual Internal Audit Plan considers the strategic risk profile of the organisation. Individual internal audit assignments identify the key risks at the planning stage and our work is designed to evaluate whether appropriate systems are in place and operating effectively to mitigate the risks identified. Legislative requirements are a core consideration in planning all internal audit reviews. Relevant Risk Register Details Current Risk Level Risk Owner Ineffective Governance Arrangements Low Chief Officer
Page 7
Appendix 1 7 9.5 ENGAGEMENT & PARTICIPATION The Chief Officer and the Chief Finance Officer have both been consulted in respect of the preparation of the Internal Audit progress report. 9.6 INEQUALITIES & FAIRER SCOTLAND DUTY An EQIA & Fairer Scotland Impact Assessment Form is not required as there are no EQIA implications arising directly from this report. All internal audit reviews which involve review of policies and procedures will examine the way in which equality and diversity is incorporated within documentation. EQIA Completed & Fairer Scotland Impact Assessment Form Completed and attached to report: Yes No X N/A EQIA added to website: Yes No X N/A 10. BACKGROUND PAPERS N/A 11. APPENDICES Appendix 1 2024/25 Internal Audit Progress Report Appendix 2 Summary of Relevant NHS Lanarkshire and North Lanarkshire Council Reports issued.
Page 8
Appendix 1 8 CHIEF ACCOUNTABLE OFFICER (or Depute) Members seeking further information about any aspect of this report, please contact the following: Chief Finance Officer Nicola Scott ScottN@northlan.gov.uk
Page 9
Appendix 1 9 Ref Audit Indicative Scope Target Audit Committee Planning Stage Work in Progress Draft Issued Completed Grade Internal Audit Plan 2024/25 NL01-25 Audit Planning Agreeing audit universe and preparation of internal audit annual plan. May 2024 N/A NL02-25 Audit Management Liaison with management, liaison with Chief Finance Officer and attendance at Audit Committee. Ongoing N/A N/A N/A N/A N/A NL03-25 Audit Follow Up Review of progress made by management in implementing those actions committed to in response to previously agreed Internal Audit recommendations. August 2025 N/A NL04-25 Annual Report Preparation for Annual Report including assistance with completion of IJB governance self-assessment checklist. August 2024 Reasonable
Page 10
Appendix 1 10 NL05-25 Governance arrangements Review of governance arrangements with reference to the Blueprint for Good Governance in NHS Scotland. August 2025 NL06-25 Strategy Review of the content and implementation of the Strategic Commissioning Plan, including assessing the adequacy and effectiveness of arrangements for monitoring of delivery and performance reporting. August 2025
Page 11
Appendix 2 11 The following relevant reports have been issued by NHS Lanarkshire: Report Audit Opinion Key findings L02/25 Internal Control Evaluation Reasonable Assurance This audit covered the totality of the internal control environment which impacts on all of NHS Lanarkshire’s s corporate risks and aimed to provide early warning of any significant issues that may affect the Governance Statement. Key Themes: • As previously reported by internal audit, financial sustainability must underpin all decision making and service transformation must be realistic, effective, and make the best use of resources. The challenge is in identifying achievable recurring savings targets and reducing reliance on non-recurring savings. • There must be an impetus to ‘do things differently’ and to prioritise in line with a clearly communicated, realistic and coherent, integrated Lanarkshire wide strategic direction for transformation, within the available financial and staffing envelope. • The NHS in Scotland 2024 report also highlighted that effective leadership and collaboration are essential, and that senior leaders must have a clear vision and strategic direction for reform. This will of course include working collaboratively with partners. • The Workforce Plan is key in identifying the future availability of staff and where those staff are needed. The report reflected numerous key developments, evidencing continuous improvement and ongoing development of governance and assurance structures. Internal Audit confirmed that Management continued to respond positively to internal audit findings and there was a clear focus on achieving actions in response to our ICE and other reports, as it evidenced though regular Audit Follow up reporting. Internal Audit made seven recommendations (one ‘significant’, and six ‘moderate’) are aimed at ensuring coherence between Governance Structures, Performance Management, Risk Management and Assurance.
Page 12
Appendix 2 12 Report Audit Opinion Key findings L11/25 Review of Clinical Governance Reasonable Internal Audit concluded that while there were regular updates on the Quality Strategy 2023-2029 reported through governance structures and that the 2024/2025 True North Action Plans have been formally approved, reporting on implementation of True North Action Statements could be improved through standardisation of reporting and through more timely reporting. Management have agreed that True North updates will continue to be reported to the committees that are assigned True North actions, and that they will strive to ensure completion in a timely manner. A 2024/25 end of year report on outcomes of the Quality Strategy 2023-2029 will be produced. L19/25 Financial Management Reasonable The NHS Lanarkshire Financial and Transformation Plan 2024/2025 aligns the Annual Delivery Plan and regular finance reports were presented to NHS Lanarkshire Board and the Planning, Performance and Resources Committee for awareness, discussion, and assurance. Internal Audit confirmed that relevant, reliable and meaningful monthly budget reports are distributed with support and training provided for budget holders. Management have agreed that: • Where budgets are widely different from actuals in year, each division will review variances to determine if these have been created from one-off cost pressures or a substantive change; a business case would be expected before adjusting budgets. • Finance will continue to set, review and report on all budget areas within the current funding envelope and would propose a budget “rewash” exercise be progressed where areas of expenditure reporting recurring reductions be reinvested across areas experiencing higher levels of expenditure/activity. • Consideration will be given to the process around escalating budget management concerns and the team will work towards the implementation of a procedure which will aid management control and reporting as well as escalating areas of concern.
Page 13
Appendix 2 13 Report Audit Opinion Key findings L24/25 Cyber Resilience / Information Security Framework Reasonable The NHSL Digital Plan 2023-2028 is aligned to the Cyber Resilience Framework. The NHS Lanarkshire Network & Information Systems (NIS) Audit Programme 2024 Progress Review Interim Report was published on 29 November 2024 and concluded positively on compliance with asset management aspects of the Cyber Resilience Framework. The aim of 100% implementation of security patches (software and operating system updates that aim to fix security vulnerabilities) within 14 days of release has been achieved in 5 months of the 14-month period from November 2023 – December 2024. Management have active reporting implemented to identify any non-compliance with the 14-day target for security patches. There are significant business challenges involved with some Application Owners unable to agree the required downtime to apply the patches and this issue was escalated to the March 2025 Cyber Security Group. Risk record (83) - Asset Management process and controls will be reviewed and updated to ensure that the risk and potential impact is clearly described, and all current controls documented. Planned mitigating actions along with target dates will also be added. No relevant reports have been issued by North Lanarkshire Council