07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report
North Lanarkshire Council · 27 August 2025
Back to IJB Performance, Finance and Audit Committee — 27 August 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 Item No: 7 SUBJECT: Internal Audit Progress Report 2024/25 and 2025/26 TO: Integration Joint Board Performance, Finance & Audit Committee. Lead Officer for Report: Nicola Scott, Chief Finance Officer Author(s) of Report Francis Scott, Chief Officer (Audit and Risk), North Lanarkshire Council Jocelyn Lyall, Chief Internal Auditor, NHS Lanarkshire Contact details for Author(s) of Report Francis Scott – ScottFr@northlan.gov.uk Jocelyn Lyall – Jocelyn.lyall2@nhs.scot DATE: 27 August 2025 1. PURPOSE OF REPORT This paper is coming to the IJB for: For Approval: ☐ For Endorsement: ☐ To Note: ☒ 2. ROUTE TO THE PFA This paper has been: Prepared By: Chief Officer (Audit and Risk), North Lanarkshire Council and Chief Internal Auditor, NHS Lanarkshire) ☒ Reviewed By: Chief Finance Officer ☒ Endorsed By: Chief Officer ☒
Page 2
2 3. EXECUTIVE SUMMARY The progress in respect of the Internal Audit Plans for 2024/2025 and 2025/26 is summarised in Appendix 1. A workplan has been agreed to ensure the Internal Audit Plans 2024/2025 and 2025/26 are delivered to inform the annual internal audit opinion for 2024/25 and 2025/26. 4. RECOMMENDATIONS 4.1 It is recommended that the IJB Performance, Finance & Audit Committee: 1) Consider the attached Progress Report at Appendix 1 and the summary of relevant partner reports at Appendix 2. 2) Note that the GIAS development work continues. The draft Internal Audit Charter including the Mandate is at agenda item 8. 5. VARIATIONS TO DIRECTIONS? This section outlines if the report requires a direction to be issued to the Local Authority, the Health Board, to both, or that no direction is required. 6. BACKGROUND As stated in the Integrated Resources Advisory Group guidance, it is the responsibility of the Integration Joint Board (IJB) to establish an adequate and proportionate internal audit of the arrangements for risk management, governance and control of the delegated resources. The internal audit arrangements for the IJB are provided jointly by the internal audit teams of North Lanarkshire Council and NHS Lanarkshire. The IJB approved the Internal Audit Plan 2024/2025 on 22 May 2024. A total of 60 days has been committed to undertake the IJB Internal Audit Plan, which has been designed to target the priority issues which have been aligned to strategic risks and reflect the evolving and complex challenges to service delivery. The Internal Audit Plan 2024/2025 will provide sufficient evidence to form an Internal Audit Opinion on the overall adequacy and effectiveness of the IJB’s framework of governance, risk management and control arrangements. The Internal Audit Plan 2024/2025 also takes account of assurances which are provided to the IJB based on the work performed under the Internal Audit Plans of both North Lanarkshire Council and NHS Lanarkshire for 2024/2025. The Yes ☐ No ☒ N/A ☐
Page 3
3 audit of operational activities is being undertaken under the auspices of the partner bodies. The IJB is asked to note that the outcomes of these operational audits are reported to the partner body Audit Committees and discussed with the IJB Chief Officer and IJB Chief Financial Officer. The assurances gained will be provided to the IJB as part of the overall assurances received from the partner body Audit Committees. Appendix 1 provides an update on progress with the 2024/25 and 2025/26 Internal Audit Plans. Appendix 1 also includes a summary of key findings from the completed 2024/25 internal audit of Governance Arrangements. The full report is at Appendix 3. We include a summary of relevant completed NHS Lanarkshire and North Lanarkshire Council reports at Appendix 2. The North Lanarkshire Council and NHS Lanarkshire audit grading descriptions are set out at Appendix 4. 2025/26 Plan The IJB approved the Internal Audit Plan 2025/26 on 21 May 2025. A total of 60 days has been committed to undertake the IJB Internal Audit Plan. As in previous years, the Internal Audit Plan 2025/2026 will provide sufficient evidence to form an Internal Audit Opinion on the overall adequacy and effectiveness of the IJB’s framework of governance, risk management and control arrangements. 7. SUMMARY OF KEY ISSUES Progress on the Internal Audit Plan 2024/25 is at Appendix 1. The Summary of relevant partner body reports is at Appendix 2. Progress since the May 2025 Performance, Finance & Audit Committee: • Governance arrangements o Complete – key findings are summarised at Appendix 1 and the full report is appended at Appendix 3 • Strategy o Commencement of the audit was delayed due to annual leave and prioritisation of the North Lanarkshire Health and Social Care Conference. Fieldwork is currently underway and it is anticipated that the draft report will be issued by mid-August. • Annual Report 2024/25 o Draft report to be issued by end of August. The Chief Internal Auditors are progressing Global Internal Audit Standards
Page 4
4 development work. The NHS Lanarkshire Internal Audit Charter and the NHS Lanarkshire Internal Audit Improvement Action Plan, to ensure GIAS compliance, were approved at the NHS Lanarkshire 4 June 2025 Audit and Risk Committee. The Internal Audit Charter for North Lanarkshire Council was approved by the Audit and Scrutiny Panel on 8 May 2025. 8. CONCLUSIONS The Internal Audit Plans 2024/2025 and 2025/26 are designed to target the priority issues and to provide sufficient evidence to form an Internal Audit Opinion on the overall adequacy and effectiveness of the IJB’s framework of governance, risk management and control arrangements. 9. IMPLICATIONS 9.1 NATIONAL OUTCOMES Link(s) to National Health and Wellbeing Outcomes People are able to look after and improve their own health and wellbeing and live in good health for longer. ☐ People, including those with disabilities or long-term conditions, or who are frail, are able to live, as far as reasonably practicable, independently and at home or in a homely setting in their community. ☐ People who use Health and Social Care Services have positive experiences of those services, and have dignity respected. ☐ Health and Social Care Services are centred on helping to maintain or improve the quality of life of people who use those services. ☐ Health and Social Care Services contribute to reducing health inequalities. ☐ People who use Health and Social Care Services are safe from harm. ☐ People who work in Health and Social Care Services feel engaged with the work they do and are supported to continuously improve the information, support, care and treatment they provide. ☐ Resources are used effectively and efficiently in the provision of Health and Social Care Services. ☒ 9.2 ASSOCIATED MEASURE(S) 9.3 FINANCIAL There are no financial impacts arising directly from this report. This paper has been reviewed by Finance:
Page 5
5 Yes No N/A 9.4 RISK ASSESSMENT/RISK MANAGEMENT The internal audit planning process which produced the Annual Internal Audit Plan considers the strategic risk profile of the organisation. Individual internal audit assignments identify the key risks at the planning stage and our work is designed to evaluate whether appropriate systems are in place and operating effectively to mitigate the risks identified. Legislative requirements are a core consideration in planning all internal audit reviews. Relevant Risk Register Details Current Risk Level Risk Owner Ineffective Governance Arrangements Low Chief Officer 9.5 ENGAGEMENT & PARTICIPATION The Chief Officer and the Chief Finance Officer have both been consulted in respect of the preparation of the Internal Audit progress report. 9.6 INEQUALITIES & FAIRER SCOTLAND DUTY An EQIA & Fairer Scotland Impact Assessment Form is not required as there are no EQIA implications arising directly from this report. All internal audit reviews which involve review of policies and procedures will examine the way in which equality and diversity is incorporated within documentation. EQIA Completed & Fairer Scotland Impact Assessment Form Completed and attached to report: Yes No N/A EQIA added to website:
Page 6
6 Yes No N/A 10. BACKGROUND PAPERS N/A 11. APPENDICES Appendix 1 2024/25 and 2025/26 Internal Audit Progress Report and key findings from the 2024/25 internal audit of Governance Arrangements. Appendix 2 Summary of Relevant NHS Lanarkshire and North Lanarkshire Council Reports issued. Appendix 3 Internal Audit Report - Governance Arrangements. Appendix 4 Internal Audit Gradings Description CHIEF ACCOUNTABLE OFFICER (or Depute) Members seeking further information about any aspect of this report, please contact the following: Chief Finance Officer
Page 7
Appendix 1 7 Ref Audit Indicative Scope Target Audit Committee Planning Stage Work in Progress Draft Issued Completed Grade Internal Audit Plan 2024/25 NL01-25 Audit Planning Agreeing audit universe and preparation of internal audit annual plan. May 2024 N/A NL02-25 Audit Management Liaison with management, liaison with Chief Finance Officer and attendance at Audit Committee. Ongoing N/A N/A N/A N/A NL03-25 Audit Follow Up Review of progress made by management in implementing those actions committed to in response to previously agreed Internal Audit recommendations. (included in the update on the audit of Governance Arrangements below) August 2025 N/A NL04-25 Annual Report Preparation for Annual Report including assistance with completion of IJB governance self-assessment checklist. August 2024 Reasonable
Page 8
Appendix 1 8 NL05-25 Governance arrangements Review of governance arrangements with reference to the Blueprint for Good Governance in NHS Scotland. August 2025 Adequate NL06-25 Strategy Review of the content and implementation of the Strategic Commissioning Plan, including assessing the adequacy and effectiveness of arrangements for monitoring of delivery and performance reporting. August 2025
Page 9
Appendix 1 9 Summary of IJB Audits 2024/25 Ref Audit Opinion Key Findings NL05- 25 Governance Arrangements Adequate Assurance This audit sought to determine whether North Lanarkshire Health and Social Care Partnership (NL HSCP) has effective governance structures in place that provide effective oversight, challenge and direction in line with the Scottish Government document, ‘The Blueprint for Good Governance in NHS Scotland’ (the Blueprint). The audit also considered the progress in implementing previously agreed audit recommendations. NL HSCP has self-assessed compliance with the Blueprint and identified improvement actions which were grouped together for inclusion in the Action Plan included in NL HSCP’s Annual Governance Statement for 2024-25. We consider that the governance structures in place within NL HSCP generally provide effective oversight, challenge and direction and are generally consistent with the Blueprint. Of the 13 recommendations and actions made (some of which have been outstanding for a number of years), three were fully implemented, three were not yet due and seven were partially implemented. The progression of the majority of these actions has been hampered by a combination of awaiting the outcome of the Scottish Government’s National Care Standards proposals and the significant changes in the Senior Management Team of NL HSCP in the last 12 months. Areas for improvement relating to the implementation of previous recommendations and the preparation of an NL HSCP Internal Audit Charter were agreed by management, and progress on these will be reported to future meetings of PFAC.
Page 10
Appendix 1 10 Ref Audit Indicative Scope Target Audit Committee Planning Stage Work in Progress Draft Issued Completed Grade Internal Audit Plan 2025/26 NL01-26 Audit Planning Preparation of internal audit annual plan 2025/26. May 2024 N/A NL02-26 Audit Management Liaison with management, liaison with Chief Finance Officer and attendance at Audit Committee. Ongoing N/A NL03-26 Audit Follow Up Review of progress made by management in implementing those actions committed to in response to previously agreed Internal Audit recommendations. August 2026 NL04-26 Annual Report Prepare and present an annual report containing the Annual Internal Audit Opinion for 2024/2025. November 2025
Page 11
Appendix 1 11 NL05-26 Financial Sustainability Effective, efficient and economic use of resources to ensure financial sustainability, with a focus on transformation. May 2026 NL06-26 Performance / Committee Effectiveness Accurate, relevant and reliable reporting to the Board, staff, the SGHSCD and the public. March 2026
Page 12
Appendix 2 12 The following relevant reports have been issued by NHS Lanarkshire: Report Audit Opinion Key findings L01/26 Internal Audit Annual Report 202425 Reasonable Assurance This Annual Report provided an overview of the outcomes of the 2024/25 internal audit programme and the Chief Internal Auditor’s opinion on NHS Lanarkshire’s internal control framework for the 2024/25 financial year. The Chief Internal Auditor concluded that in 2024/25 the Board has adequate and effective governance, risk management and internal control arrangements in place and the Accountable Officer had implemented a governance framework in line with required guidance sufficient to discharge the responsibilities of this role. Key themes included: • National developments including the renewed approach to population-based planning and collaborative working, and the NHS Scotland Operational Improvement Plan, published on 31 March 2025. • The work of the Interface Directorate, which aims to drive and influence improvements, collaboration, cohesion and communication. • Performance remains variable for NHSL and to drive improve, the focus is on four key priority areas. • Governance Structures continue to bed in and a new Board Secretary is post. Internal Audit would anticipate that development of the Board Assurance Framework (BAF) and application of Committee Assurance Principles will be a priority going in to 2025/26. There had also been significant development of risk management arrangements during the year. • The 2024/2025 financial plan supported financial sustainability, with well managed controls, but Internal Audit did highlight the challenges for all Health Boards, and the importance of sustainable cost improvement and enhanced financial controls. Key developments included: • Board agreement of Corporate Objectives for the year, with mid-year assurance reported through governance structures. • Approval of the Risk Management Strategy and Risk Appetite Statement
Page 13
Appendix 2 13 Report Audit Opinion Key findings • Development of a Business Case to support the Interface Division in providing alternatives to hospital based care and emergency department admissions. Internal Audit identified three significant and one moderate action points in the areas of: • Governance around the Performance, Planning and Resources Committee, to be reviewed as part of the wider governance review. • Timing of production and presentation of Annual Reports to provide year end assurances. As part of the ongoing review of Governance a review of the remit and purpose of the PPRC together with that of the sub committees will be undertaken to ensure that any gaps in the process are mitigated. • Performance Reporting and provision of a cover for the Integrated Performance and Quality Report, highlighting key performance issues, clearly linking performance to risk and highlighting where improvement is required. • The risk associated with Artificial Intelligence. It was agreed that an AI risk assessment will be undertaken. L22/25 Review of Requisitioning, Order and Receipt Substantial Assurance NHS Lanarkshire has well established systems for requisitioning, ordering receipting and invoicing which are built into the national Pecos and efinancial systems. Internal Audit identified the following issues: • The size of the Invoice Register continues to increase in both volume and value • If the end-user does not enter the number of units when receipting an order on Pecos, they are not alerted to the issue by the Pecos system. The order does not interface with the eFinancial system, resulting in a delay in paying the invoice as the order is not marked as goods received • Not all of the invoices we reviewed were paid within the credit terms of 30 days • The P2P Group has not met since 14 December 2023. The group does not have formal Terms of Reference and there are no minutes’/action notes recorded from any of the meetings • None of the 11 Accounts Payable Policies/Procedures have been reviewed by their scheduled review date of October 2024 • The 'Business Continuity Plan - Procurement & Logistics' document was last refreshed in June 2022 and has no scheduled review date recorded on the document. The Pecos guide does not cover the most recent version of Pecos
Page 14
Appendix 2 14 Report Audit Opinion Key findings Agreed Action: Work has already started on review of historical items in the invoice register. Numbers are consistently reducing and this will be monitored on a monthly basis. The order receipting guidance will be updated to reflect the most recent version of PECOS system and will be communicated to users. Supplier statement reconciliations have now recommenced and the top 30 suppliers on quantity and volume of invoices are reconciled on a quarterly basis which should lead to a positive impact on payment terms this will be monitored and progressed by the Accounts Payable Manager. The P2P meetings will recommence from March 2025 and quarterly going forward. Minutes and action notes will be maintained for all future meetings. Policies and procedures in relation to payment of goods and services will be reviewed by financial year end and will be made available to staff. The Procurement & Logistics Business Continuity Plan will be reviewed by June 2025 and a scheduled review date will be recorded. The Pecos guide will be updated to reflect the most recent version of PECOS. L18/25 Review of Financial Planning Substantial This review considered whether there was robust strategic financial planning and prioritisation to support corporate strategies and priorities for the 2025-2026 Financial Plan. The Substantial Assurance opinion was provided on the basis that the 2025/2026 – 2027/28 financial plan supports financial sustainability and the risks are well managed. Existing controls were likely to achieve and maintain financial sustainability in 2025/26. In 2025/26 brokerage will no longer be available and all NHS Boards must work towards break-even with historic outstanding brokerage to be re-paid when the Board return to financial balance. However, financial sustainability remains a significant and enduring risk for all Health Boards and financial and service challenges across health and social care will require continued joint working across Lanarkshire, with a focus on transformation. Delivering the required level of recurrent savings in years 2 and 3 will be extremely challenging and there will be a continued requirement for financial sustainability to underpin all decisions taken by the NHS Board and by Officers, and for sustainability to be given appropriate priority. There were no recommendations from this review.
Page 15
Appendix 2 15 Relevant reports issued by North Lanarkshire Council Report Audit Opinion Key findings Internal Audit Annual Report and Opinion 2024-25 Reasonable Assurance This report provided an annual summary of the work undertaken by Internal Audit and allowed the Chief Officer (Audit and Risk) to provide an independent opinion on the Council’s control environment. The annual opinion for 2024/25 is unqualified and states that reasonable assurance can be placed on the Council’s governance, risk management and internal control arrangements. While some audit issues were noted during the year, there were no key points relating to NL HSCP of the Council’s provision of social care.
Page 16
Appendix 3 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 16 INTERNAL AUDIT REPORT REVIEW OF NORTH LANARKSHIRE HEALTH AND SOCIAL CARE PARTNERSHIP GOVERNANCE ARRANGEMENTS Headlines This audit sought to determine whether North Lanarkshire Health and Social Care Partnership (NL HSCP) has effective governance structures in place that provide effective oversight, challenge and direction in line with expected good practice. The audit also considered the progress in implementing previously agreed audit recommendations. NL HSCP has self-assessed compliance with the Scottish Government document, ‘The Blueprint for Good Governance in NHS Scotland’ (the Blueprint), which provides guidance on how to deliver and sustain good corporate governance in the healthcare sector. This self-assessment identified improvement actions which were grouped together for inclusion in the Action Plan included in NL HSCP’s Annual Governance Statement (AGS) for 2024/25. NLC Internal Audit thereafter undertook a high-level review of NL HSCP’s arrangements against the Blueprint to identify areas where improvements could be made to strengthen the governance arrangements. Generally, we concurred with the observations and improvement actions identified from the self-assessment. We have, therefore, categorised this audit as providing adequate assurance meaning that we consider that the governance structures in place within NL HSCP generally provide effective oversight, challenge and direction and are generally consistent with the Blueprint. Work undertaken by NLC Internal Audit to assess management progress in implementing previously agreed audit recommendations and improvement actions identified from the self- assessments, identified that of the 13 recommendations and actions made (some of which have been outstanding for a number of years), three were fully implemented, three were not yet due and seven were partially implemented. The progression of the majority of these actions has been hampered by a combination of awaiting the outcome of the Scottish Government’s National Care Standards proposals and the significant changes in the Senior Management Team of NL HSCP in the last 12 months, with a new Chief Officer, Chief Finance Officer and Business Support Manager being appointed during this time. Whilst the IJB and the Performance, Finance and Audit Committee (PFAC) meetings were held as scheduled, and the majority of key matters were addressed, there were no reports on the progress of implementation of previously agreed actions. Further details on this finding and the associated recommendations made by NLC Internal Audit are included in the action plan at section 3 of this report. Assurance Opinion Adequate assurance
Page 17
Appendix 3 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 17 Priority of Recommendations High Medium Low 0 1 1 Report status FINAL Audit ref 0500/2025/004 Date issued 26/06/2025 Audit Team Elaine MacDonald, Lynn McCrum and Lesley Armstrong Issued To Chief Officer (NL HSCP) Copied To Chief Finance Officer (NL HSCP)
Page 18
Appendix 3 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 18 1. Executive Summary Objectives The purpose of this audit was to determine, and provide independent assurance, on the following areas: • Are there effective governance structures that provide effective oversight, challenge and direction, in line with guidance issued by the Scottish Government? • Has sufficient progress been made in implementing audit recommendations, with specific reference to long-standing actions? Work undertaken by NLC Internal Audit included gathering appropriate evidence and undertaking a high-level review of the governance arrangements in place in NL HSCP against the Blueprint as well as obtaining evidence and having discussions with relevant officers to ascertain the current position of outstanding recommendations. This engagement has been conducted in accordance with the Global Internal Audit Standards. The Internal Audit section reports formally on conformance with these standards to the PFAC. We would like to thank officers involved in this audit for their cooperation and assistance. 2. Findings and Recommendations Key areas requiring management action (High) There were no areas requiring urgent management attention identified. Good practice identified We noted the following areas of good practice during the audit: • NL HSCP includes an AGS in their Annual Accounts. The AGS provides an assessment of the adequacy and effectiveness of NL HSCP’s governance arrangements and system of internal control and provides an explanation as to how NL HSCP complies with the Code of Corporate Governance and meets the requirements of the CIPFA Delivering Good Governance in Local Government Framework (2016). • The AGS also includes an update on how continuous improvement actions identified in previous years in respect of internal controls, risk management and other governance arrangements have been/are being progressed. • NL HSCP has undertaken a self-assessment in respect of their compliance with the Scottish Government guidance document ‘The Blueprint for Good Governance in NHS Scotland’. Other areas for improvement (Medium) One other area for improvement was identified: • Appropriate and timely action is required to progress previously agreed outstanding audit recommendations and improvement actions identified during NL HSCP’s self-assessment of governance arrangements.
Page 19
Appendix 3 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 19 3. Action Plan Review of NL HSCP Governance Arrangements 0500/2025/004 Ref Finding 1 Appropriate and timely action is required to progress both previously agreed outstanding audit recommendations and improvement actions identified during NL HSCP’s self-assessment of governance arrangements. All Internal and External Audit reports contain management responses to audit recommendations which generally include a commitment to specific actions by a stated timescale. NLC Internal Audit reviewed the extent to which management have implemented previously agreed Internal and External Audit recommendations and improvement actions identified by management in both the current and previous years’ self-assessment exercises. Across the three sources, there were 13 actions and progress of these actions is detailed in the table below. Source Complete Partially implemented Not yet due Total Internal Audit reports 3 3 0 6 External Audit reports 0 2 1 3 Self-assessments 0 2 2 4 TOTAL 3 7 3 13 Seven of the previously agreed actions have not been progressed as expected and, as such, have only been partially implemented. Six of these were not tracked or monitored during the year, primarily due to significant changes in the Senior Management Team in the last 12 months, however, we were pleased to note that the Chief Finance Officer has already addressed this by including the outstanding action, with revised timescales, on an action plan in the AGS and has committed to ensuring that these are regularly tracked and monitored through their inclusion as a standing agenda item in future meetings of the PFAC. The remaining action relates to the review and update of NL HSCP Audit Charter. The delay in implementation of this action is largely due to the recent introduction of the Global Internal Audit Standards, effective from 1 April 2025, and this action is being progressed by the Chief Officer (Audit and Risk) and Chief Auditor (NHS Lanarkshire). Further details of these outstanding actions are included at Appendix 2. Implication Recommendation Priority Management response Implementation Date Risks previously identified may not be appropriately mitigated, exposing the HSCP to these risks and leaving them vulnerable. The Chief Internal Auditors may not be in a position to conclude on the level of assurance that can be placed upon the overall adequacy and effectiveness of the HSCP’s framework of governance, risk (1) The Chief Officer (NL HSCP) should ensure that appropriate and timely action is taken to fully address the previously agreed audit recommendations in line with timescales detailed in the Action Plan contained within the AGS and that the actions are regularly monitored with progress reported at each meeting of the PFAC. (2) The Chief Officer (Audit and Risk) and the Chief Internal Auditor (NHS Lanarkshire) should ensure that NL HSCP Audit Charter is updated and reviewed to reflect the current environment and Medium (1) Agree Claire Rae, Chief Officer (NL HSCP) The Annual Governance Statement, prepared as part of the 2024-25 Annual Report, includes details of all previous audit recommendations with timescales for action provided. These timescales will be monitored through a progress report presented to each PFAC, with the first report going to the October meeting. (2) Agree December 2025
Page 20
Appendix 3 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 20 management and internal control arrangements. working arrangements whilst taking account of the Global Internal Audit Standards. Francis Scott, Chief Officer (Audit and Risk) and Jocelyn Lyall, Chief Internal Auditor (NHS Lanarkshire) September 2025 3. Action Plan Review of NL HSCP Governance Arrangements 0500/2025/004 Ref Finding 2 Rolling Action Logs, discussed at meetings of the IJB and PFAC, are not always fully populated. A standing agenda item at meetings of both the IJB and the PFAC is the Rolling Action Log. This document comprises of actions discussed and agreed to be taken forward at the Board/Committee meetings and requires details to be added with regards to whom the action has been allocated to, action taken/progress made, the due date and completion status. From our review of the Rolling Action Log, we noted that it was not always fully completed, often with detail in respect of the due date and completion status being omitted. We understand that the remit of the newly appointed Business Support Manager will include overseeing the Rolling Action Log and ensuring that it is fully populated. Implication Recommendation Priority Management response Implementation Date If actions are not properly recorded and tracked, it may be difficult to determine the status of the actions and whether these are being addressed timeously. The Chief Officer (NL HSCP) should ensure that the Rolling Action Log presented to each IJB and PFAC is fully completed following each meeting, with details of discussions and/or decisions regarding actions required, progress to date, proposed completion dates and completion status. Low Agree Claire Rae, Chief Officer (NL HSCP) The new Business Support Manager will ensure the action logs for both meetings are completed and monitored appropriately. August 2025
Page 21
Appendix 3 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 21 APPENDIX 1 – Audit Grading Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion definitions Substantial Assurance Sound systems for risk, control and governance are in place and should be effective in mitigating risks to the achievement of business and control objectives. Some minor improvements to existing controls in a few areas may be required. Adequate Assurance The systems for risk, control and governance are largely satisfactory, but there is some scope for improvement as the present arrangements could undermine the achievement of business and/or control objectives and/or leave them vulnerable to some risk of error/abuse. Limited Assurance The systems for risk, control and governance have some satisfactory aspects but contain a number of significant weaknesses that are likely to undermine the achievement of business and/or control objectives and leave them vulnerable to an unacceptable risk of error or abuse. Recommendation priority definitions High Significant weaknesses which management needs to address to achieve objectives. Medium Weaknesses which require prompt action to avoid exposure to risks in achieving objectives. Low Action advised/area for improvement to enhance control or improve efficiency.
Page 22
Appendix 3 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 22 APPENDIX 2 – Outstanding Management Actions Report Details Recommendation Management Update Original and Revised Timescales INTERNAL AUDIT Financial Due Diligence (May 2020) EXTERNAL AUDIT Annual Audit Report 2019/20 ANNUAL GOVERNANCE STATEMENT Continuous improvement actions for 2019/20 Each of the reports listed contained similar recommendations (four in total) in respect of the disaggregation of Children, Families and Justice Social Work Services and need for hosting arrangements to be finalised for cross- cutting services. The budget disaggregation exercise has been concluded and the revised IJB direction to NLC issued in March 2021 excludes the total budget transfer in respect of Children, Families and Justice Services. Management recognises that the finalisation of the Service Level Agreement (SLA) for future hosting arrangements and associated budgets is overdue. Once finalised, the SLA will be presented to a future meeting of the NLC Adult Health and Social Care Committee, the NLC Education and Families Committee and the IJB for approval. Previously, as the Scottish Government advising that the timeframe around the National Care Service had slipped further than intended, the Service advised that they would consider creating their own Service Level Agreement between Children, Families and Justice Services. There has been very little action taken in the last year with regards to this action. This is primarily due to a change in the Senior Management Team. This action has been included in the Action Plan within the draft Annual Governance Statement. The Senior Management Team have committed to reviewing this action over the Summer and providing an update on the position at the next meeting of the PFAC in August 2025. March 2021 September 2021 June 2022 March 2025 September 2025 ANNUAL GOVERNANCE STATEMENT Continuous improvement actions for 2021/22 To develop a sound understanding of the impact for the North Lanarkshire Health and Social Care Partnership (NLHSCP) of the outputs of the National Care Service legislation. There has been very little action taken to date with regards to this action. This is primarily due to both a change in the Senior Management Team and changes to the proposals for the National Care Service with the Scottish Government having concluded that they are not taking forward the legislative component of the National Care Service Bill. This action has been included in the Action Plan within the draft Annual Governance Statement and will now be tracked and monitored with progress thereafter reported at each meeting of the PFAC (from meeting scheduled for 27 August 2025 onwards). The Chief Finance Officer is liaising with the newly appointed Business Support Manager with regards to this. March 2023 March 2025 September 2025
Page 23
Appendix 3 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 23 Report Details Recommendation Management Update Original and Revised Timescales INTERNAL AUDIT Review of NL Health and Social Care Partnership Governance Arrangements 2023/24 The Chief Officer (North Lanarkshire HSCP) should liaise with the Chief Officer (Audit and Risk) to ensure that the North Lanarkshire HSCP Audit Charter is reviewed and updated as necessary. The Chief Officer (NL HSCP) instructed the Chief Officer (Audit and Risk) and the Chief Auditor (NHS Lanarkshire) to undertake a review of NL HSCP Audit Charter, however the revision of the audit charter was put on hold to take account of the introduction of the Global Internal Audit Standards, effective from 1 April 2025. The Chief Officer (Audit and Risk) and the Chief Internal Auditor (NHS Lanarkshire) have agreed that they will now review and update the Charter and submit it to the next meeting of the PFAC scheduled for 27 August 2025. March 2024 March 2025 September 2025 EXTERNAL AUDIT Annual Audit Report 2023/24 As a strategic commissioning body, the IJB should ensure that its financial performance reports retain a holistic view of the IJBs financial performance as a whole and continue to align to the reserves strategy and financial strategy. The IJB have revised financial monitoring reports to provide an overview of the delivery of services and overall funding aligned to the Strategic Commissioning Plan and Medium-Term Financial Plan. However, as reflected in the unaudited accounts, the reports provide detail around the financial and operational performances of each of the partner bodies in the delivery of the underlying services. The financial reports will be further defined to give an overview in the delivery of services against the overall funding aligned to the Strategic Commissioning Plan and Medium- Term Financial Plan/Long Term Financial Plan including earmarked reserves. This action will be tracked and monitored with progress thereafter reported at each meeting of the PFAC (from meeting scheduled for 27 August 2025 onwards). The Chief Finance Officer is liaising with the newly appointed Business Support Manager with regards to this. March 2024 March 2025 September 2025
Page 24
Appendix 4 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 24 North Lanarkshire Council Audit Gradings Audit reports are graded with an overall assurance opinion, and any issues and associated recommendations are classified individually to denote their relative importance, in accordance with the definitions in the tables below. Definition of audit assurance and recommendation categories Assurance Confidence based on sufficient evidence that internal controls are in place, operating effectively and objectives are being achieved. Assurance opinion definitions Substantial Assurance Sound systems for risk, control and governance are in place and should be effective in mitigating risks to the achievement of business and control objectives. Some minor improvements to existing controls in a few areas may be required. Adequate Assurance The systems for risk, control and governance are largely satisfactory, but there is some scope for improvement as the present arrangements could undermine the achievement of business and/or control objectives and/or leave them vulnerable to some risk of error/abuse. Limited Assurance The systems for risk, control and governance have some satisfactory aspects but contain a number of significant weaknesses that are likely to undermine the achievement of business and/or control objectives and leave them vulnerable to an unacceptable risk of error or abuse. Recommendation priority definitions High Significant weaknesses which management needs to address to achieve objectives. Medium Weaknesses which require prompt action to avoid exposure to risks in achieving objectives. Low Action advised/area for improvement to enhance control or improve efficiency.
Page 25
Appendix 4 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 25 NHS Lanarkshire Audit gradings: Internal Audit Objective To assist management in assessing the overall opinion of the area under review, Internal Audit has assessed the system adequacy and control application, and categorised the opinion based on the following criteria. Level of Assurance System Adequacy Controls Substantial A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Controls are applied continuously or with minor lapses. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Controls are applied frequently but with evidence of non-compliance. Limited Significant, gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited Controls are applied but with some significant lapses. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. High risk of objectives not being achieved due to the absence of key internal controls. Significant breakdown in the application of controls.
Page 26
Appendix 4 R:\Corporate\NL Health and Social Care Partnership\Business Support\IJB Committees\IJB PFA\2025\3. 27 August 2025\Final Word Papers\07 - 2025-08-27 IJB PFA - IJB Internal Audit Progress Report.docx 26 To assist management in assessing each audit finding and recommendation, Internal Audit has assessed the risk to the organisation of each of the weaknesses identified and categorised each finding according to the following criteria. Risk Assessment Definition Findings Fundamental Non-compliance with key controls or evidence of material loss or error. Action is imperative to ensure that the objectives for the area under review are met Significant Weaknesses in design or implementation of key controls i.e. those which individually reduce the risk scores. Requires action to avoid exposure to significant risks in achieving the objectives for the area under review. Moderate Weakness in design or implementation of controls which contribute to risk mitigation. Requires action to avoid exposure to moderate risk to achieving the objectives for area under review. Merits Attention These are generally areas of good practice. Action may be advised to enhance control or improve operational efficiency. 0