IJB Internal Audit Progress Report 2024/25 and 2025/26
North Lanarkshire Council · 22 October 2025
Back to IJB Performance, Finance and Audit Committee — 22 October 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 REPORT Item No: 8 SUBJECT: Internal Audit Progress Report 2024/25 and 2025/26 TO: Integration Joint Board Performance, Finance & Audit Committee. Lead Officer for Report: Nicola Scott, Chief Finance Officer Author(s) of Report Francis Scott, Chief Officer (Audit and Risk), North Lanarkshire Council Jocelyn Lyall, Chief Internal Auditor, NHS Lanarkshire Contact details for Author(s) of Report Francis Scott – ScottFr@northlan.gov.uk Jocelyn Lyall – Jocelyn.lyall2@nhs.scot DATE: 22 October 2025 1. PURPOSE OF REPORT This paper is coming to the IJB for: For Approval: ☐ For Endorsement: ☐ To Note: ☒ 2. ROUTE TO THE PFA This paper has been: Prepared By: Chief Officer (Audit and Risk), North ☒ Reviewed By: Chief Finance Officer ☒ Endorsed By: Chief Officer ☒
Page 2
2 Lanarkshire Council and Chief Internal Auditor, NHS Lanarkshire) 3. EXECUTIVE SUMMARY The progress in respect of the Internal Audit work for 2024/2025 and 2025/2026 is summarised in Appendix 1. The internal audit annual report and opinion for 2024/2025 was presented to the North Lanarkshire Integrated Joint Board meeting on 17 September 2025. A workplan has been agreed to ensure the Internal Audit Plan 2025/2026 is delivered to inform the internal audit opinion for 2025/2026. 4. RECOMMENDATIONS 4.1 It is recommended that the IJB Performance, Finance & Audit Committee: 1) Consider the attached Progress Report at Appendix 1 and the summary of relevant partner reports at Appendix 2. 5. VARIATIONS TO DIRECTIONS? This section outlines if the report requires a direction to be issued to the Local Authority, the Health Board, to both, or that no direction is required. 6. BACKGROUND As stated in the Integrated Resources Advisory Group guidance, it is the responsibility of the Integration Joint Board (IJB) to establish an adequate and proportionate internal audit of the arrangements for risk management, governance and control of the delegated resources. The internal audit arrangements for the IJB are provided jointly by the internal audit teams of North Lanarkshire Council and NHS Lanarkshire. Fieldwork arising from the Internal Audit Plan 2024/2025 has been completed. The 2024/25 Strategy report has been issued and is with Management for their response. As part of the approval of the annual accounts, the Internal Audit Annual Report and Opinion 2024/2025 was presented to the North Lanarkshire Integrated Joint Board on 17 September 2025. The opinion provided reasonable assurance on the adequacy and effectiveness of the IJB’s Yes ☐ No ☒ N/A ☐
Page 3
3 framework of governance, risk management and internal controls for the year ended 31 March 2025. The IJB approved the Internal Audit Plan 2025/2026 on 21 May 2025. A total of 60 days has been committed to undertake the IJB Internal Audit Plan, which has been designed to target the priority issues which have been aligned to strategic risks and reflect the evolving and complex challenges to service delivery. The Internal Audit Plan 2025/2026 will provide sufficient evidence to form an Internal Audit Opinion on the overall adequacy and effectiveness of the IJB’s framework of governance, risk management and control arrangements. The Internal Audit Plan 2025/2026 also takes account of assurances which will be provided to the IJB based on the work performed under the Internal Audit Plans of both North Lanarkshire Council and NHS Lanarkshire for 2025/2026. The audit of operational activities is being undertaken under the auspices of the partner bodies. The IJB is asked to note that the outcomes of these operational audits are reported to the partner body Audit Committees and discussed with the IJB Chief Officer and IJB Chief Financial Officer. The assurances gained will be provided to the IJB as part of the overall assurances received from the partner body Audit Committees. We include a summary of relevant completed NHS Lanarkshire and North Lanarkshire Council reports at Appendix 2. 7. SUMMARY OF KEY ISSUES Progress on the Internal Audit Plans for 2024/25 and 2025/26 is at Appendix 1. The summary of relevant partner body reports is at Appendix 2. Progress since the August 2025 Performance, Finance & Audit Committee: Annual Report 2024/25 presented to the North Lanarkshire Integrated Joint Board on 17 September 2025 Strategy: Fieldwork is complete and the draft report is with Management. From 1 April 2025, Public Sector Internal Audit Standards were replaced by the GIAS supported by an ‘Application Note - Global Internal Audit Standards in the UK Public Sector’. Within the Local Government context application of GIAS is also supported by the CIPFA ‘Code of Practice for the Governance of Internal Audit in Local Government’ (The Code). Internal audit teams must work in accordance with the new standards from 1 April 2025 and by doing so will build up conformance to GIAS during 2025/2026. The Chief Internal Auditors are progressing GIAS development work and the Internal Audit Charter, including the Mandate, was approved at the 27 August 2025 Performance, Finance & Audit Committee.
Page 4
4 8. CONCLUSIONS The Internal Audit Plan 2025/2026 is designed to target the priority issues and to provide sufficient evidence to form an Internal Audit Opinion on the overall adequacy and effectiveness of the IJB’s framework of governance, risk management and control arrangements. 9. IMPLICATIONS 9.1 NATIONAL OUTCOMES Link(s) to National Health and Wellbeing Outcomes People are able to look after and improve their own health and wellbeing and live in good health for longer. ☐ People, including those with disabilities or long-term conditions, or who are frail, are able to live, as far as reasonably practicable, independently and at home or in a homely setting in their community. ☐ People who use Health and Social Care Services have positive experiences of those services, and have dignity respected. ☐ Health and Social Care Services are centred on helping to maintain or improve the quality of life of people who use those services. ☐ Health and Social Care Services contribute to reducing health inequalities. ☐ People who use Health and Social Care Services are safe from harm. ☐ People who work in Health and Social Care Services feel engaged with the work they do and are supported to continuously improve the information, support, care and treatment they provide. ☐ Resources are used effectively and efficiently in the provision of Health and Social Care Services. ☒ 9.2 ASSOCIATED MEASURE(S) 9.3 FINANCIAL There are no financial impacts arising directly from this report. This paper has been reviewed by Finance: Yes No N/A
Page 5
5 9.4 RISK ASSESSMENT/RISK MANAGEMENT The internal audit planning process which produced the Annual Internal Audit Plan considers the strategic risk profile of the organisation. Individual internal audit assignments identify the key risks at the planning stage and our work is designed to evaluate whether appropriate systems are in place and operating effectively to mitigate the risks identified. Legislative requirements are a core consideration in planning all internal audit reviews. Relevant Risk Register Details Current Risk Level Risk Owner Ineffective Governance Arrangements Low Chief Officer
Page 6
6 9.5 ENGAGEMENT & PARTICIPATION The Chief Officer and the Chief Finance Officer have both been consulted in respect of the preparation of the Internal Audit progress report. 9.6 INEQUALITIES & FAIRER SCOTLAND DUTY An EQIA & Fairer Scotland Impact Assessment Form is not required as there are no EQIA implications arising directly from this report. All internal audit reviews which involve review of policies and procedures will examine the way in which equality and diversity is incorporated within documentation. EQIA Completed & Fairer Scotland Impact Assessment Form Completed and attached to report: Yes No N/A EQIA added to website: Yes No N/A 10. BACKGROUND PAPERS N/A 11. APPENDICES Appendix 1 Internal Audit Progress – 2024/2025 and 2025/2026 Appendix 2 Summary of Relevant NHS Lanarkshire and North Lanarkshire Council Reports issued.
Page 7
7 Chief Finance Officer CHIEF ACCOUNTABLE OFFICER (or Depute) Members seeking further information about any aspect of this report, please contact the following:
Page 8
Appendix 1 8 Ref Audit Indicative Scope Target Audit Committee Planning Stage Work in Progress Draft Issued Completed Grade Internal Audit Plan 2024/25 NL01-25 Audit Planning Agreeing audit universe and preparation of internal audit annual plan. May 2024 N/A NL02-25 Audit Management Liaison with management, liaison with Chief Finance Officer and attendance at Audit Committee. Ongoing N/A N/A N/A N/A N/A NL03-25 Audit Follow Up Review of progress made by management in implementing those actions committed to in response to previously agreed Internal Audit recommendations. August 2025 N/A NL04-25 Annual Report Preparation for Annual Report including assistance with completion of IJB governance self-assessment checklist. August 2024 Reasonable
Page 9
Appendix 1 9 NL05-25 Governance arrangements Review of governance arrangements with reference to the Blueprint for Good Governance in NHS Scotland. August 2025 Adequate NL06-25 Strategy Review of the content and implementation of the Strategic Commissioning Plan, including assessing the adequacy and effectiveness of arrangements for monitoring of delivery and performance reporting. August 2025 Reasonable
Page 10
Appendix 1 10 Ref Audit Indicative Scope Target Audit Committee Planning Stage Work in Progress Draft Issued Completed Grade Internal Audit Plan 2025/26 NL01-26 Audit Planning Agreeing audit universe and preparation of internal audit annual plan. May 2025 N/A NL02-26 Audit Management Liaison with management, liaison with Chief Finance Officer and attendance at Audit Committee. Ongoing N/A N/A N/A N/A N/A NL03-26 Audit Follow Up Review of progress made by management in implementing those actions committed to in response to previously agreed Internal Audit recommendations. August 2026 NL04-26 Annual Report Preparation for Annual Report including assistance with completion of IJB governance self-assessment checklist. August 2026
Page 11
Appendix 1 11 NL05-26 Financial Sustainability Effective, efficient and economic use of resources to ensure financial sustainability, with a focus on transformation. May 2026 NL06-26 Performance / Committee Effectiveness Accurate, relevant and reliable reporting to the Board, staff, the SGHSCD and the public. March 2026
Page 12
Appendix 2 12 The following relevant reports have been issued by NHS Lanarkshire: Report Audit Opinion Key findings L02/25 Internal Control Evaluation Reasonable Assurance This audit covered the totality of the internal control environment which impacts on all of NHS Lanarkshire’s corporate risks and aimed to provide early warning of any significant issues that may affect the Governance Statement. Key Themes: As previously reported by internal audit, financial sustainability must underpin all decision making and service transformation must be realistic, effective, and make the best use of resources. The challenge is in identifying achievable recurring savings targets and reducing reliance on non- recurring savings. There must be an impetus to ‘do things differently’ and to prioritise in line with a clearly communicated, realistic and coherent, integrated Lanarkshire wide strategic direction for transformation, within the available financial and staffing envelope. The NHS in Scotland 2024 report also highlighted that effective leadership and collaboration are essential, and that senior leaders must have a clear vision and strategic direction for reform. This will of course include working collaboratively with partners. The Workforce Plan is key in identifying the future availability of staff and where those staff are needed. The report reflected numerous key developments, evidencing continuous improvement and ongoing development of governance and assurance structures. Internal Audit confirmed that Management continued to respond positively to internal audit findings and there was a clear focus on achieving actions in response to our ICE and other reports, as it evidenced though regular Audit Follow up reporting. Internal Audit made seven recommendations (one ‘significant’, and six ‘moderate’) are aimed at ensuring coherence between Governance Structures, Performance Management, Risk Management and Assurance.
Page 13
Appendix 2 13 Report Audit Opinion Key findings L11/25 Review of Clinical Governance Reasonable Assurance Internal Audit concluded that while there were regular updates on the Quality Strategy 2023-2029 reported through governance structures and that the 2024/2025 True North Action Plans have been formally approved, reporting on implementation of True North Action Statements could be improved through standardisation of reporting and through more timely reporting. Management have agreed that True North updates will continue to be reported to the committees that are assigned True North actions, and that they will strive to ensure completion in a timely manner. A 2024/25 end of year report on outcomes of the Quality Strategy 2023-2029 will be produced. L19/25 Financial Management Reasonable Assurance The NHS Lanarkshire Financial and Transformation Plan 2024/2025 aligns the Annual Delivery Plan and regular finance reports were presented to NHS Lanarkshire Board and the Planning, Performance and Resources Committee for awareness, discussion, and assurance. Internal Audit confirmed that relevant, reliable and meaningful monthly budget reports are distributed with support and training provided for budget holders. Management have agreed that: Where budgets are widely different from actuals in year, each division will review variances to determine if these have been created from one-off cost pressures or a substantive change; a business case would be expected before adjusting budgets. Finance will continue to set, review and report on all budget areas within the current funding envelope and would propose a budget “rewash” exercise be progressed where areas of expenditure reporting recurring reductions be reinvested across areas experiencing higher levels of expenditure/activity. Consideration will be given to the process around escalating budget management concerns and the team will work towards the implementation of a procedure which will aid management control and reporting as well as escalating areas of concern.
Page 14
Appendix 2 14 Report Audit Opinion Key findings L20/25 Review of Property Management Strategy Substantial Assurance Based on examination of the control structure and the procedures in place, we confirmed that objectives were met for the submission of the Business Continuity Investment Plan in compliance with DL (2024) 02. NHS Lanarkshire's Business Continuity & Essential Investment Infrastructure Plan was endorsed at the 14 January 2025 Finance & Resources Sub-Committee and approved by the Planning, Performance & Resources Committee (PPRC) before submission to the Scottish Government by 31 January 2025. We concluded that the project governance groups fulfilled their remits of co-ordinating activity, overseeing development of the Business Continuity & Essential Investment Plan and its approval through NHS Lanarkshire’s governance structures. L24/25 Cyber Resilience / Information Security Framework Reasonable Assurance The NHSL Digital Plan 2023-2028 is aligned to the Cyber Resilience Framework. The NHS Lanarkshire Network & Information Systems (NIS) Audit Programme 2024 Progress Review Interim Report was published on 29 November 2024 and concluded positively on compliance with asset management aspects of the Cyber Resilience Framework. The aim of 100% implementation of security patches (software and operating system updates that aim to fix security vulnerabilities) within 14 days of release has been achieved in 5 months of the 14-month period from November 2023 – December 2024. Management have active reporting implemented to identify any non-compliance with the 14-day target for security patches. There are significant business challenges involved with some Application Owners unable to agree the required downtime to apply the patches and this issue was escalated to the March 2025 Cyber Security Group. Risk record (83) - Asset Management process and controls will be reviewed and updated to ensure that the risk and potential impact is clearly described, and all current controls documented. Planned mitigating actions along with target dates will also be added. No relevant reports have been issued by North Lanarkshire Council in this period.