Item 7 - Internal Audit Report
North Lanarkshire Council · 21 June 2023
Back to IJB Performance, Finance and Audit Committee — 21 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
REPORT Item No: 7 1. PURPOSE OF REPORT 1.1 This paper is coming to the Performance, Finance and Audit (PFA) Committee: For approval For endorsement For noting 1.2 This report provides an update on the results of the planned Internal Audit assignment to follow-up the status of the recommendations agreed in respect of previous internal and external audit reports. 2. ROUTE TO THE PERFORMANCE, FINANCE AND AUDIT COMMITTEE 2.1 This paper has been: Prepared By: Audit Team, North Lanarkshire Council ☒ Reviewed By: Chief Finance Officer ☒ Endorsed By: Chief Officer ☒ 3. RECOMMENDATIONS 3.1 It is recommended that the PFA Committee: (1) Acknowledge the contents of the report. 4. VARIATIONS TO DIRECTIONS 5. BACKGROUND/SUMMARY OF KEY ISSUES 5.1 This report presents the results of the recently completed internal audit work undertaken by North Lanarkshire Council (NLC) and to provide an update on the results of follow-up work which reviewed the extent to which management have implemented those actions previously committed to in response to recommendations contained in previous internal and external audit reports. 5.2 The lead for this audit was the Audit and Risk Manager for NLC. The completed audit report is attached as an appendix. 6. CONCLUSIONS 6.1 The outcome of the follow-up audit concluded the following: 19 agreed actions have been completed. 8 agreed actions are partially implemented (4 of these actions being the same risk) 1 agreed action is not yet due. 3 agreed actions are no longer relevant. SUBJECT: Internal Audit Report – Follow-up Actions TO: Performance, Finance and Audit Committee Lead Officer for Report: Ross McGuffie, Chief Officer Author(s) of Report Amanda Kilburn, Chief Financial Officer DATE: 21 June 2023 Yes No N/A 1
Page 2
6.2 Internal Audit concluded that management have taken significant action to appropriately address most of the weaknesses/improvement areas in audit outputs. 6.3 Where Internal Audit consider the actions taken by management are only partially implemented, an action plan has been agreed and is included in the attached report. These actions will be monitored in a report on agreed actions with progress reported to the PFA Committee throughout the year. 7. IMPLICATIONS 7.1 NATIONAL OUTCOMES People are able to look after and improve their own health and wellbeing and live in good health for longer ☒ People, including those with disabilities or long-term conditions, or who are frail, are able to live, as far as reasonably practicable, independently and at home or in a homely setting in their community ☒ People who use Health and Social Care Services have positive experiences of those services, and have dignity respected ☒ Health and Social Care Services are centred on helping to maintain or improve the quality of life of people who use those services ☒ Health and Social Care Services contribute to reducing health inequalities ☒ People who use Health and Social Care Services are safe from harm ☒ People who work in Health and Social Care Services feel engaged with the work they do and are supported to continuously improve the information, support, care, and treatment they provide ☒ Resources are used effectively and efficiently in the provision of Health and Social Care Services ☒ 7.2 ASSOCIATED MEASURE(S) None. 7.3 FINANCIAL This paper has been reviewed by Finance: Yes No N/A 7.4 RISK ASSESSMENT/RISK MANAGEMENT The strategic financial risks detailed in the IJB Risk Register has been updated where necessary and are included in a separate report to the IJB. Relevant Risk Register Details Current Risk Level Risk Owner 7.5 ENGAGEMENT & PARTICIPATION Please tick the engagement and participation objectives that link(s) with this piece of work and provide further details on the engagement and participation that was undertaken. 2
Page 3
Objectives Further details ☒ Involve stakeholders in the development work aimed at achieving the national outcomes ☒ Provide stakeholders with information on how to get involved ☐ Ensure a diverse range of engagement and participation and opportunities are in place to suit different needs ☒ Measure how well we involve community stakeholders in the planning, design, and delivery of our services ☒ Provide regular feedback on how stakeholder engagement and participation is shaping and influencing service development and delivery ☒ Provide support to enable stakeholder representatives to participate meaningfully and confidently at meetings ☒ Develop participation guidelines to ensure a common understanding and set of expectations for both stakeholders and partnership staff ☐ Support engagement planning and participation in localities, taking account of other engagement activity and local plans across the Community Planning Partnership 7.6 INEQUALITIES & FAIRER SCOTLAND DUTY Equality and Diversity Impact Assessment Completed & Fairer Scotland Impact Assessment Form Completed and EQIA added to website: Yes No N/A 8. BACKGROUND PAPERS None. 9. APPENDICES Appendix 1 – Internal Audit Report – Follow-Up Actions Chief Finance Officer Members seeking further information about any aspect of this report, please contact Amanda Kilburn on telephone number 07816 126362. 3
Page 4
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/IJB/2022-23/0500_2023_003 IJB Follow Up/A - Findings and Reporting/A04a 20230606 IJB Follow-Up Final Report v1.0 as issued.docx 1 INTERNAL AUDIT REPORT FOLLOW-UP OF ACTIONS PREVIOUSLY AGREED BY MANAGEMENT IN RESPONSE TO AUDIT RECOMMENDATIONS Contents 1. Work undertaken 2. Summary of progress made on previous recommendations Appendix 1: Management actions assessed as ‘not yet complete’ Appendix 2: Residual risk rating definition Issued to: Chief Officer (North Lanarkshire HSCP) Copied to: Chief Finance Officer Headlines The purpose of this report is to update the Integrated Joint Board (IJB) on the results of Internal Audit’s follow-up work which reviewed the extent to which management have implemented those actions previously committed to in response to recommendations contained in previous Internal and External Audit reports. Information is contained in respect of the last three years External Audit Annual Reports and those actions agreed in response to ‘Red’ and ‘Amber’ Internal Audit recommendations from reports issued. We have also included an assessment of the current position in respect of improvement actions identified by management in the last three years’ Annual Governance Statements (AGS). The status of each agreed action is based on the position as at the time of audit fieldwork which was undertaken in February and March 2023. An update on progress to date regarding the agreed actions was reported to the Performance, Finance and Audit Committee on 19 April 2023, thereafter reviewed by Internal Audit and our assessment of progress updated accordingly. Overall, we have assessed that 19 of the 31 agreed actions have been completed, nine are partially implemented, two are no longer relevant and one where the agreed target timescales are not yet due. One of the actions categorised as being no longer relevant relates to an action in a previous year’s AGS and has been superseded by a similar action in the most recent AGS (2021/22). The other action categorised as no longer relevant relates to action previously included in the AGS which related to the South Lanarkshire IJB as opposed to that of North Lanarkshire. We were pleased to note that management have taken significant action to appropriately address most of the weaknesses/improvement areas in audit outputs. Of the nine actions assessed as partially implemented, four relate to the finalisation of the Service Level Agreement for Children, Families and Justice Services and one relates to the National Care Service proposals. Progression of each of these has been hindered by the uncertainties and delays around the development of the National Care Service proposals and the impacts that may arise as a result. A summary of progress made on previous recommendations is contained at Section 2 of this report. Appendix 1 provides full details of the management actions assessed as ‘not yet complete’. Report status FINAL Audit Ref 0500/2023/003 Date issued 06/06/2023 Audit Team Lynn McCrum and Paula Hendry 4 Appendix 1
Page 5
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/IJB/2022-23/0500_2023_003 IJB Follow Up/A - Findings and Reporting/A04a 20230606 IJB Follow-Up Final Report v1.0 as issued.docx 2 1. Work undertaken All Internal and External Audit reports contain management responses to audit recommendations which generally include a commitment to specific actions by a stated timescale. The purpose of this report is to update the IJB on the results of Internal Audit’s follow-up work reviewing the extent to which management have implemented those actions previously committed to in response to audit recommendations. Information is contained in respect of the 2019-20, 2020-21 and 2021-22 External Audit Annual Reports and the three Internal Audit reports, with recommendations, issued during 2018-19 and 2019-20. We have also included an assessment of the current position in respect of continuous improvement actions identified by management in the 2019-20, 2020-21 and 2021-22 Annual Governance Statements (AGS) and in the self- evaluation of the North Lanarkshire Health and Social Care Integration Joint Board exercise undertaken in 2021/22. The internal audit reports included within this review are: • Risk maturity assessment (issued August 2019); • Performance management (issued August 2019); and • Due Diligence (issued May 2020). The status of each agreed action is based on the position as at the time of audit fieldwork which was conducted during February and March 2023. An update on progress to date regarding the agreed actions was reported to the Performance, Finance and Audit Committee on 19 April 2023 and thereafter reviewed by Internal Audit and our assessment of progress updated accordingly. The updates on progress to date have been verified on a sample basis by Internal Audit during the preparation of this report. However, it should be noted that this review has focussed on whether planned actions have been completed as previously committed to and has not included detailed testing of whether the implemented actions have been effective in addressing the previous identified weaknesses. This engagement has been conducted by the Internal Audit team at North Lanarkshire Council in accordance with the ‘Public Sector Internal Audit Standards’. The Internal Audit section periodically reports formally on conformance with these standards to the Council’s Audit and Scrutiny Panel. 2. Summary of progress made on previous recommendations 2.1 Table 1 below shows whether management have implemented those actions previously agreed to in response to External Audit recommendations, ‘Red’ and ‘Amber’ Internal Audit recommendations and continuous improvement actions identified by management in the Annual Governance Statements and the self-evaluation exercise undertaken in 2021/22. Overall, 19 of the agreed actions have been completed, eight are partially implemented, three are no longer relevant and the target timescale for the remaining action has not yet passed. Table 1 Source Report Complete Partially implemented Not yet due No longer relevant Total Internal Audit 3 5 0 0 8 External Audit 6 1 1 0 8 Actions in AGS 7 2 0 3 12 Self-evaluation exercise 3 0 0 0 3 TOTAL 19 8 1 3 31 2.2 Internal Audit has reviewed the management progress updates as reported to the Performance, Finance and Audit Committee in April 2023 and the revised implementation dates for all nine recommendations which are partially implemented as listed in Table 1 above. Internal Audit then assessed the significance of non-implementation for recommendations which were not fully implemented to determine the residual risk remaining in relation to the outstanding aspects of the original recommendation. Definitions of the residual risk ratings are provided at Appendix 2. 2.3 Detail in respect of each of these recommendations and the current residual risk assessed by Internal Audit is provided in Appendix 1. In this appendix, we have also made suggestions as to how the Board may wish to consider these issues. 5
Page 6
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/IJB/2022-23/0500_2023_003 IJB Follow Up/A - Findings and Reporting/A04a 20230606 IJB Follow-Up Final Report v1.0 as issued.docx 3 Appendix 1 Management actions assessed as ‘not yet complete’ Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment INTERNAL AUDIT Financial due diligence (May 2020) – 2 actions EXTERNAL AUDIT Annual Audit Report 2019/20 – 1 action ANNUAL GOVERNANCE STATEMENT Continuous improvement actions for 2019/20 – 1 action Risk: A lack of formally documented arrangements may increase the risk that the resources transferred from the IJB to the Council do not reflect the cost of the relevant services in terms of delegated and non-delegated functions. Recommendation: Each of the reports listed contained similar recommendations in respect of the disaggregation of Children, Families and Justice Social Work Services and need for hosting arrangements to be finalised for cross-cutting services. The budget disaggregation exercise has been concluded and the revised IJB direction to NLC issued in March 2021 excludes the total budget transfer in respect of Children, Families and Justice Services. Management recognises that the finalisation of the Service Level Agreement (SLA) for future hosting arrangements and associated budgets is overdue. Once finalised, the SLA will be presented to a future meeting of the NLC Adult Health and Social Care Committee, the NLC Education and Families Committee and the IJB for approval. The Service Level Agreement between Children, Families and Justice Services will be revisited once further clarity has been obtained around what services will be part of the new National Care Service. Original timescale: March 2021 Revised timescales: September 2021 June 2022 Revised timescale to be determined once further clarity obtained regarding National Care Service proposals We are pleased to note that the budget disaggregation exercise has been concluded. We acknowledge that Covid has had a significant impact on the Health and Social Care Partnership which has in turn impacted on the prioritisation of resources. In addition, we acknowledge that further clarity around the services which will be part of the National Care Service is required before the Service Level Agreement between Children, Families and Justice Services can sensibly be finalised. Given the delays in implementation of the remaining actions, we assess the residual risk as ‘High’ and suggest that the Board may wish to consider noting the progress made to date but also request an update on this issue from relevant senior management at the next meeting of the Performance, Finance and Audit Committee. INTERNAL AUDIT REPORT Performance management (August 2019) Risk: There is no formal documented record or clear rationale for the targets and trajectories set. Recommendation: Management should ensure that a formal record is retained detailing the rationale for, and approval of, the targets and trajectories set for the indicators on the performance scorecard and this information should be shared with the Performance, Finance and Audit Committee. Category: Amber The Annual Performance Report presented to the Performance, Finance and Audit Committee in February 2022 includes details of the targets and trajectories set for the indicators on the performance scorecard. There is however currently no formal record detailing the rationale for the targets and trajectories set for the indicators on the performance scorecard. The action will now be progressed with a view to completion and reporting to the Performance, Finance & Audit Committee by September 2023. Original timescale: October 2019 Revised timescales: March 2022 September 2023 We were pleased to note that there has been some action taken in this area and acknowledge that implementation of the recommendation was delayed as a result of the pandemic in the first instance and thereafter due to the Performance Manager post being vacant for approximately 18 months. This post has now been filled, with the post holder taking up their position mid-April 2023 and work is progressing to meet the revised timescales. Given that action is required to further improve the control environment we assess the residual risk as ‘Medium’ and consider it important that the agreed revised timescale of September 2023 is achieved, We suggest that the Board may wish to consider noting the progress made to date and to monitor implementation going forward. 6
Page 7
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/IJB/2022-23/0500_2023_003 IJB Follow Up/A - Findings and Reporting/A04a 20230606 IJB Follow-Up Final Report v1.0 as issued.docx 4 Appendix 1 (continued) Management actions assessed as ‘not yet complete’ Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment INTERNAL AUDIT REPORT Performance management (August 2019) Risk: The IJB may not provide adequate performance information to key stakeholders to enable the, to make informed decisions and recommend remedial actions to address concerns arising. The IJB Performance, Finance and Audit Committee may not be in a position to fulfil its remit which includes the requirement to ‘review quarterly performance and recommend remedial action to address concerns’ and to ‘ensure effective arrangements are in place to register all performance and operational risks’. Recommendation: Management should undertake a formal review of the current arrangements for monitoring and reporting performance to reflect on whether reports are fit for purpose and contain relevant, comprehensive information useful to stakeholders. This could include comparison with other IJB published reports. Particular consideration should be given to the areas identified in the finding, i.e.: • an overview of all indicators on the performance scorecard including a mechanism to provide an update on indicators previously reported but now considered satisfactory; • areas for improvement listed should include proposed actions with timescales, progress with these and how effective they are; • greater use of benchmarking with other IJBs and trend information; and • incorporating reporting by locality. Category: Amber Areas for improvement identified within the performance framework are now reported to the Performance, Finance and Audit Committee, together with proposed actions and progress. The reports do not, however, specifically reference timescales. The annual performance report was submitted to the Performance, Finance and Audit Committee in February 2023 together with a performance update report which included key performance indicators and measures. This report demonstrated that there has been a greater use of benchmarking with other IJBs and trend information. In August 2022, the IJB’s Performance, Audit and Finance Committee endorsed the development of a revised whole system performance framework for the partnership. This will address all outstanding points raised in the finding and will include whole system performance reports that will allow Committee members to exercise effective oversight, scrutiny and challenge. The range of associated performance measures within both the national outcome indicators and the local performance framework will be refreshed alongside the development of the Strategic Commissioning Plan 2023-26 and the continued development of the Programme of Work. Original timescale: October 2019 Revised timescales: March 2022 September 2023 We were pleased to note that significant action has been taken in this area, or is planned for the coming months, to fully implement the recommendations made, We acknowledge that delays in implementation were initially due to the pandemic but were further impacted by the Performance Manager post being vacant for approximately 18 months. This post has now been filled, with the post holder taking up their position mid-April 2023 and work is progressing to meet the revised timescales. Given that action is required to further improve the control environment we assess the residual risk as ‘Medium’ and consider it important that the agreed revised timescale of September 2023 is achieved. We suggest that the Board may wish to consider noting the progress made to date and to monitor implementation going forward. 7
Page 8
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/IJB/2022-23/0500_2023_003 IJB Follow Up/A - Findings and Reporting/A04a 20230606 IJB Follow-Up Final Report v1.0 as issued.docx 5 Appendix 1 (continued) Management actions assessed as ‘not yet complete’ Report Details Details from original recommendation Current position per management update Original and revised timescales Internal Audit comment INTERNAL AUDIT REPORT Risk maturity assessment (August 2019) Risk: Decisions may not fully reflect risk management considerations. The Risk Register may not reflect issues highlighted within performance management and other assurance reports. Recommendation: IJB and Performance, Finance and Audit Committee papers should contain a section on risk which considers whether issues raised should be included within the risk register and overtly reflect the impact on any existing strategic risks. Performance reports should reference relevant strategic risks and assess whether scores are accurate and whether actions intended to reduce risk to target level are on track. Category: Amber There are still a number of reports being submitted to the IJB and Performance, Finance and Audit Committee where the Risk Management section has either not been completed (i.e. it is blank) or has been omitted completely from the implications section of the report. A new IJB Reporting Template has been developed as part of the IJB Governance Documents update and this template now has a greater focus on EQIAs, Risk, Participation and Engagement, National Outcomes and Directions. IJB Reporting Template Guidance has also been developed to support authors when completing the reporting template. Original timescale: March 2020 Revised timescales: June 2021 June 2022 September 2023 We were pleased to note that there is now a higher percentage of reports presented to the IJB and Performance, Finance and Audit Committee which contain a section on risk. We acknowledge that further steps are planned to increase compliance and fully address this recommendation. We consider the revised timescale to be reasonable and have assessed the residual risk for this recommendation as ‘Low’. Accordingly, we would suggest that the Board may wish to consider agreeing to note the progress made and the revised completion date. ANNUAL GOVERNANCE STATEMENT Continuous improvement actions for 2021/22 Risk: N/A Recommendation: To develop a sound understanding of the impact for the North Lanarkshire Health and Social Care Partnership (NLHSCP) of the outputs of the National Care Service legislation. Category: N/A Due to the uncertainty and lack of detail currently available, this will be revisited once further clarity has been obtained. At the time of writing this report, the Scottish Government had delayed further discussion and consultation in respect of the National Care Service legislation until after the Summer recess. Original timescale: March 2023 Revised timescale: To be determined once further clarity obtained regarding National Care Service proposals We acknowledge that implementation of the recommendation has been delayed as a result of the uncertainty and lack of detail available in respect of the new National Care Service. Given the delay in implementation and that action is required to further improve the control environment, we have assessed the residual risk as 'Medium' and consider it important that, once further clarity has been obtained, management consider and agree an appropriate revised timescale. 8
Page 9
Https://nlcgov.sharepoint.com/sites/AUR-INTERNALAUDITFILES/Shared Documents/Recurring/IJB/2022-23/0500_2023_003 IJB Follow Up/A - Findings and Reporting/A04a 20230606 IJB Follow-Up Final Report v1.0 as issued.docx 6 Appendix 2 Residual risk rating definition Internal Audit Assessment of Residual Risk from non-implementation High Non-implementation of actions has the potential to significantly undermine the relevant control environment. Medium Non-implementation of actions has the potential to impact upon the achievement of the control environment. Low Other issues which require management attention but which pose less significant or less immediate impacts to the control environment. 9