Internal Audit Report - 25-04 - Health and Safety
Perth and Kinross Council · 29 June 2026
Back to Audit and Risk Committee — 29 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 Internal Audit Report Strategic Planning, People and Performance 25-04 Health & Safety June 2026 Final Report (Report No. 26/194) Legal and Governance Perth & Kinross Council Council Offices 2 High Street Perth PH1 5PH
Page 2
2 25-04 Health & Safety Contents by Section 1. Introduction 2. Audit Background Information 3. Scope and Limitations 4. Assessment of the Control Environment 5. Summary of Findings 6. Conclusions 7. Acknowledgement 8. Action Implementation & Follow Up 9. Management Action Plan 10. Authorisation 11. Distribution 12. Assessment Definitions
Page 3
3 1. Introduction 1.1 This assignment forms part of the Internal Audit plan for 2025/26, approved by the Audit Committee on 25 June 2025. The period under review for the purposes of the audit exercise was financial years 2024/25 and 2025/26. 1.2 The indicative scope for the audit was to review arrangements in place for the corporate oversight of health and safety within the Council. 1.3 This audit is linked to the Strategic Risk Register SR011 – The health and safety of staff and the public is not adequately protected which was reported to be Priority 1, High in May 2025. 2. Executive Summary 2.1 The audit has found that reasonable assurance can be placed on the Council’s internal controls in relation to the review arrangements in place for the corporate oversight of Health and Safety within the Council. 2.2 There are twenty-three actions arising from the findings in Section 6. An action plan is included in Section 10. Once these actions are completed, Internal Audit should be able to place substantial assurance on the arrangements in place. 3. Audit Background Information 3.1 Local authorities have a fundamental responsibility to ensure the health, safety and welfare of their employees, service users, contractors, and members of the public who may be affected by council activities. This duty is underpinned by a comprehensive framework of UK Health & Safety legislation, primarily the Health and Safety at Work etc. Act 1974 (HASWA) and associated legislation, which places a statutory obligation on employers to provide a safe working environment and manage risks effectively. 3.2 The section 2(2) of the Act, states that without prejudice to the generality of an employer’s duty under the subsection 1, the matters to which that duty extends include in particular (a) the provision and maintenance of plant and systems of work that are, so far as is reasonably practicable, safe and without risks to health; (b) arrangements for ensuring, so far as is reasonably practicable, safety and absence of risks to health in connection with the use, handling, storage and transport of articles and substances; (c) the provision of such information, instruction, training and supervision as is necessary to ensure, so far as is reasonably practicable, the health and safety at work of his employees; (d) so far as is reasonably practicable as regards any place of work under the employer’s control, the maintenance of it in a condition that is safe and without
Page 4
4 risks to health and the provision and maintenance of means of access to and egress from it that are safe and without such risks; (e) the provision and maintenance of a working environment for his employees that is, so far as is reasonably practicable, safe, without risks to health, and adequate as regards facilities and arrangements for their welfare at work. 3.3 In the local council context, compliance is especially important due to the diverse nature of services delivered such as housing, social care, waste management, roads, education, parks, and public spaces. Each service area carries unique operational risks, requiring tailored controls, risk assessments, training, and monitoring arrangements. Councils must also comply with supporting regulations such as the Management of Health and Safety at Work Regulations 1999, Control of Substances Hazardous to Health (COSHH), Manual Handling Operations Regulations, and Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR). 3.4 According to the Health and Safety Executive (HSE), any organisation as a minimum has a duty to have the processes and procedures required to meet the legal requirements, including: • a written health and safety policy; if they employ 5 or more people • assessments of the risks to employees, contractors, customers, partners, and any other people who could be affected by your activities and record the significant findings in writing. Any risk assessment must be ‘suitable and sufficient’, • arrangements for the effective planning, organisation, control, monitoring and review of the preventive and protective measures that come from risk assessment; • access to competent health and safety advice; • providing employees with information about the risks in their workplace and how they are protected; • instruction and training for employees in how to deal with the risks; • ensuring there is adequate and appropriate supervision in place; • consulting with employees about their risks at work and current preventive and protective measures. 4. Scope and Limitations 4.1 The audit has reviewed the relevant legislation and governance requirements in fulfilling corporate health and safety (H&S) of the Council. 4.2 To arrive at an opinion on the achievement of the control objective, the review included, • Document reviews concerning H&S policies and procedures, • Interviews with key staff who are responsible for the H&S of the different services, • Reviews of any third-party documents, audit reports and arrangements with independent audits.
Page 5
5 • Ensuring lessons learned from previous non-compliance and reported incidents/accidents are incorporated into future planning. 4.3 There were no limitations identified that would impact the Audit. 4.4 The details of the control objectives reviewed and the Internal Audit’s assessment of their strength of control in each area are contained within Section 5 of this report. 5. Assessment of the Control Environment 5.1 The table below contains a summary of the number of findings and their ratings, as detailed in Section 12, against each control objective, along with Internal Audit’s assessment of the adequacy and effectiveness of the controls in place to meet each of the objectives agreed for this audit. Further details, including any improvement actions, are set out in the Management Action Plan. No. Control Objective Action Rating Control Objective Assessment 5 4 3 2 1 1 To ensure that the Council complies with all H&S legislation and statutory requirements. 2 4 Reasonable Assurance 2 To ensure that adequate steps are taken to protect employees, service users, contractors, and the public from harm. 2 4 1 1 Reasonable Assurance 3 To ensure H&S training, incident reporting, and risk assessments are robust and effective. 4 3 2 Reasonable Assurance 5.2 The auditor has assessed that reasonable assurance can be placed on controls overall in relation to the arrangements in place for the corporate oversight of Health and Safety within the Council. Meaning: “There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited.” 5.2 A summary of the key findings and actions is provided in section 6. Please note, however, the following areas of good practice which have been highlighted during the audit: 5.2.1 The Chief Executive and the Executive Leadership Team providing leadership on Health and Safety matters at Council, and this is discharged by setting a policy, ensuring that business plans are in place, that regular consultation with employees and trade unions take place, and that the Council’s overall approach is thoroughly monitored and reviewed. We have noticed a clear organisation structure for reporting and managing H&S in place. Council website has details
Page 6
6 of the recognised Trade Unions with names and contact details of their representatives and those who cooperatively work with the Council. 5.2.2 The Strategic Health and Safety Consultative Committee has approved the Occupational Health and Safety Policy on 21 January 2026, signed by the Chief Executive and the Strategic Lead of Strategic Planning, People and Performance. This has replaced the old policy prepared and approved in 2018 and is readily available on ERIC, uploaded on 9 February 2026. 5.2.3 The strategic objective of the new policy is in line with the legal requirements and HSE guidance (HSG65) provided. The guidance explains the Plan, Do, Check, Act approach and shows how it can help to achieve a balance between the systems and behavioural aspects of management. The Policy provides clarity on Health and Safety responsibilities of both the employer and the employees. 5.2.4 As per Section 7 of the Management of Health & Safety at Work Regulations 1999, Council has appointed a dedicated H&S Team within the Council, and the Team comprises highly competent and qualified professionals to meet the legal requirement for competent advice. In addition, they provide consistent training, advice and support to managers and staff, to ensure they meet their legal obligations in relation to Health and Safety at work. Also, there are various groups of stakeholders and committees, such as Trade unions, Employee Joint Consultative Committee and Strategic H&S Consultative Committee that input their feedback for the planning, doing and monitoring of H&S within the Council. 5.2.5 In accordance with the Occupational Health & Safety Policy, where specialist technical advice cannot be provided internally within the Council, competent external specialist advice must be obtained. We noted that technical specialists have been engaged in certain areas to support preventive maintenance activities. These services remain subject to third-party audit requirements and the instructions of external agencies and regulators such as the Health and Safety Executive (HSE), Scottish Fire and Rescue Service (SFRS), Scottish Environmental Protection Agency (SEPA), and the Care Inspectorate etc. In most of the cases their advice and instructions have been followed to ensure full statutory compliance. 5.2.6 The auditor attended the Strategic Health and Safety Consultative Committee meetings held on 12 March 2026 and 01 June 2026 and was satisfied that there was evidence of employee representative participation and active involvement of service managers and team leaders on the H&S matters considered and discussed. 5.2.7 Audit has reviewed last year’s Employee Joint Consultative Committee (EJCC) minutes and is satisfied with the content of the recorded minutes, participation and decision making. During these meetings, H&S and Fire safety performance has been discussed. This includes details of incident reporting and training figures.
Page 7
7 5.2.8 Audit has observed the certificate of employers’ liability insurance which is a compulsory insurance required under the Employers’ Liability (Compulsory Insurance) Act 1969 and associated regulations, which mandates employers to obtain insurance to cover liability for employee injury or illness arising from work. This has been obtained and renewed for the current year (until 30 September 2026) from Zurich Insurance Company Ltd. All fleet vehicles have been insured under Motor insurance and other relevant insurances have been obtained by Council including public liability insurance. 5.2.9 We appreciate the efforts taken by the H&S Team to move from an expensive external system for the incident reporting to an in-house system. Currently, all the incidents are reported through the MyPKC platform and those are monitored by H&S Team. Most of the services have confirmed that they use the current system. The auditor participated in a pilot training session on incident investigation conducted by the H&S Team on 29April 2026 and satisfied with the content and delivery. 5.2.10 The auditor has checked the arrangement of H&S of the fleet employees and is satisfied with overall risk assessment procedures, vehicle maintenance, drivers’ assessments (based on the point system), incident reporting, follow up with insurance team and performance monitoring. Specially, recent implementation of random eye test of the drivers is welcomed. 5.2.11 The auditor has checked the arrangements for H&S of the HART team and observed that clearly defined H&S responsibilities, including the completion and adherence to risk assessments, infection control measures, safe systems of work, and established reporting procedures are in place. All the risk assessments have been reviewed on 18 March 2026, are maintained, up to date, and are subject to annual review. 5.2.12 Justice services operate across multiple sites in Perth within a higher risk environment and demonstrate good practice, through clear identification and management of key risks to the employees. As per the team leader, all risk assessments are up to date and mandatory H&S training is in place for all staff. Incidents are formally reported and reviewed, lone working is supported by policy and personal alert systems, and staff wellbeing is promoted through regular supervision, absence management, and access to counselling, with overall compliance overseen by the Justice Services Health & Safety Meetings. 5.2.13 In Communities Repair & Improvement Services, a strong and proactive approach to H&S through comprehensive risk assessments, regular mandatory training, and consistent communication is in place. Safety is embedded into daily operations through toolbox talks, monthly meetings, standing H&S agenda items, and unannounced site checks carried out by both compliance officers and trade coordinators. The use of corporate systems for incident reporting, lone-working monitoring, and job management ensures risks are tracked effectively, while quarterly meetings with the Health & Safety Team help the service stay aligned with legislative updates and best practice. Staff wellbeing is also prioritised through one-to-one meetings, an open-door policy, and proactive support via Occupational Health.
Page 8
8 5.2.14 H&S of Direct Services is clearly positioned as providing a foundation to all operational activities, with responsibilities embedded through training, supervision, and monitoring. This takes place across refuse collection, waste management, grounds maintenance, and Burials. There is statutory training for all staff (in Key2 system), and specialist training needs (e.g. machinery use, manual handling, driver competence) are clearly identified and delivered as per Lifting Operations and Lifting Equipment Regulations 1998 (LOLER) and Provision and Use of Work Equipment Regulations 1998 (PUWER). Incidents and near misses are effectively managed through a learning-focused investigation framework, while controls for lone working, wellbeing support, and clear communication channels further strengthen safety culture. Ongoing monitoring, engagement with the Health & Safety Team, and external reviews provide assurance of compliance and continuous improvement. 5.2.15 Based on the Local Government Benchmarking Framework (LGBF) data and internal information, sickness absence has shown a slight year on year reduction from 2023/24 to 2024/25, with the overall time lost for all employees decreasing from 5.38% to 5.31% at the Council. However, some areas continue to experience high levels of sickness absence, particularly Integrated Healthcare for Older People and Environment & Infrastructure, both of which remain high risk service areas. People & Culture have introduced several supportive measures to help reduce H&S related sickness absence. For example, new managers can access direct case handling support from the Employee Relations & Wellbeing team, and the Erica chatbot enables managers to book appointments for advice. In addition, targeted work in Education & Learning, including a dedicated resource reviewing absence trends and a working group focused on reducing challenging behaviour in schools, aims to reduce Violence and Aggression(V&A) incidents related sickness levels. All managers also have access to a Power BI dashboard, allowing them to monitor sickness absence trends within their teams. 6. Summary of Findings 6.1 Below is a summary of key findings and actions, which are reflected in the Management Action Plan, detailed in section 10. 6.2 To ensure that the Council complies with all Health & Safety legislation and statutory requirements 6.2.1 As per HSG65, all large public and private sector organisations are required to maintain formal procedures for auditing and reporting health and safety performance. As per the Corporate Occupational Health & Safety Policy section 4.1.4 on Auditing “Strategic Lead areas will be required to audit their own practices and record these details (inspection etc) in line with their own Action Plan. In conjunction, the H&S Team will also audit following a H&S audit plan which will identify compliance and good practice. Audit reports will be reported into the Employee Joint Consultative Committee and Executive Leadership Team for discussion and comment.”
Page 9
9 6.2.2 Our review identified that the H&S Team does not currently have an established audit plan in place, despite this being a policy requirement. Although this issue has been acknowledged within the Corporate Risk Register (with an initial completion target of 31 December 2025), the deadline has since been deferred. During our discussions, the Team Leader confirmed that the audit process is expected to be implemented in the Team Plan 2026/27. [Action point 01] 6.2.3 Our review noted that, in relation to Risk Register entry SR011, “the implementation of a robust corporate Health and Safety policy and the associated topic-specific arrangements” has not yet been fully completed. However, we found that no formal approval had been granted for the following guidance documents: • Alcohol and Drug Use Guidance (HR Guides) • First Aid Guidance • Infection Control Guidance • General Risk Assessment Guidelines In addition, no guidance has yet been developed for the Provision and Use of Work Equipment (PUWER). [Action point 02] 6.2.4 Our review of H&S practices within Fleet Management identified that there is currently no comprehensive policy in place to prevent drivers from operating vehicles while under the influence of Alcohol or Drugs. Although a memo referencing an Alcohol and Drug Policy was issued to all staff by the Direct Service Manager on 14 March 2025, this communication alone is insufficient to ensure consistent understanding and enforcement. Internal audit opinion’s is that there should be a robust, council wide Drug and Alcohol policy. [Action point 03] 6.2.5 Section 2.3 in the Occupational Health and Safety Policy, clearly states that H&S Team (under People & Culture) must work in synergy with a range of other services including, IT, Insurance, Facilities Management, Estates, Property Services, Housing Repairs, Education & Learning, and Direct Services to ensure an integrated and cohesive approach to risk management. 6.2.6 During our review we have noticed many insurance claims due to various reasons including fire at properties, trip/ fall and driver errors. However, there is a lack of effective coordination between the H&S Team and the Insurance Team, despite the clear importance of this collaboration and explicit requirement within organisational policies. [Action point 04] 6.2.7 Audit acknowledges that employees working directly with the public may face increasing risks of Violence and Aggression (V&A), stemming from the nature of certain frontline services and interactions. As part of its commitment to safeguarding staff, the Council identifies these behaviours ranging from verbal abuse to physical assault as significant organisational risks requiring proactive management and continuous improvement. We observed that established
Page 10
10 systems including MOSAIC, Northgate (Housing management information system’ person alerts) facilitate the sharing specific information among Housing and Social Work Teams. These systems support staff and contractors’ awareness of potential risks and enable informed decision-making when engaging with service users. 6.2.8 Despite recognising the seriousness of the V&A, there are gaps in adequacy of planning, monitoring, and control measures in place by management to protect a minority of staff. These gaps are especially evident for teams such as Licensing, Environmental Health, and Food Health and Safety, where staff may attend locations or interact with individuals without full visibility of potential risks. The absence of consistent and accessible risk information limits the ability of manager and staff to undertake appropriate precautionary measures, such as conducting visits in pairs rather than individually. [Action point 05] 6.2.9 The Employment Right Act 2025, effective from April 2026, increases employer’s responsibility and liability for preventing harassment, including sexual harassment. Employers now need to take “all reasonable steps” to prevent sexual harassment in the workplace. In our inquiry from the service manager, it was highlighted challenges in managing this duty due to third party involvement such as parents, contractors, agency workers etc. In our observation, it indicates that appropriate preventive arrangements to address these risks have not yet been fully established. [Action point 06] 6.3 To ensure that adequate steps are taken to protect employees, service users, contractors, and the public from harm 6.3.1 Several external contractors have been engaged by the Council to deliver a range of property related services, including janitorial support, cleaning services, school catering, school crossing patrols, and facilities management to various Heads of Establishment (HoE). With respect to H&S, each contractor is fully responsible for ensuring the safety of their own employees as well as any other individuals present within the premises while carrying out the contracted activities. The extracts from the relevant parts from the sample contracts have been reviewed during the audit. 6.3.2 Although the services are provided directly to HoE, overall oversight and performance monitoring of all contracted services should be carried out by the Property Services Team. The responsible person for the management of HoE Property Services has been appointed recently, and monitoring activities are still under development stage. It is recognised this as key role since monitoring is essential in parallel with external audit actions to be implemented. [Action point 07]
Page 11
11 6.3.3 A new Head of Establishment Premises Handbook was published in May 2025, replacing the old handbook from June 2015, following the consultation with representative Service Managers, Heads of Establishment and Head of Establishment Steering Group. The new handbook has not yet been uploaded to ERIC, meaning Heads of Establishment do not have access to the current version, specifically the new Summary of Tasks is required to be accessed by everyone. At present, only the previous version remains available on the system. [Action point 08] 6.3.4 Training on the newly issued Head of Establishment Premises Handbook has not yet been fully completed at the time of the audit. Our inquiries confirmed that several school HoE and non-school HoE have to be trained, indicating that the rollout remains incomplete. [Action point 09] 6.3.5 In Property Services, multiple suppliers have been appointed based on their respective areas of expertise to undertake Planned Preventive Maintenance (PPM) activities across different sites. When upcoming maintenance is identified, the Property Team raises the relevant work orders within the Concerto system. All work orders are subject to authorisation by the appropriate manager through the system. Suppliers are also granted access to the Concerto system, enabling them to view and manage upcoming maintenance tasks assigned to them. Notifications are generated through the system to ensure suppliers are aware of scheduled PPM activities. 6.3.6 During the Concerto walkthrough testing, a significant number of overdue PPM tasks were identified. These included statutory, non-statutory, and asset register based maintenance tasks. Among the overdue statutory tasks, primary and secondary school properties were included. In our inquiry, management advised that the backlog was primarily attributable to a single supplier experiencing resourcing pressures. In addition, the KPI of the supplier reported for the period October to December 2025 indicates an overall downward trend in performance. October November December Statutory completion rate 61.54% 17.39% 28.07% Non-statutory completion rate 42.7% 41.38% 29.63% Overall completion rate 46.96% 36.36% 28.83% [Action point 10] 6.3.7 In the Concerto system, HoE module is newly embedded to check the duties done by relevant Business Managers (HoE) and it only includes the schools. Since there are many other establishments that require proper maintenance and Compliance Team or Business Manager’s attention, those should be included in the module soon. Our inquiry has not provided any targeted date on completion of this. [Action point 11]
Page 12
12 6.3.8 The Properties Team confirmed that electrical and mechanical inspections have been carried out in some of the buildings. However, Structural Survey has not been carried out along with that. In our inquiry, it was mentioned to us Building Condition Surveys operate on a five-year rolling programme, managed by a dedicated Condition Survey Team. These surveys are not recorded within the PPM system, and the schedule of upcoming surveys must be obtained directly from the team. We have not yet received this schedule for our review. [Action point 12] 6.3.9 In our discussion with the Service Manager Corporate Landlord, it was mentioned that Council is following SFG20 (the industry standard for building maintenance). However, this SFG20 system is still in development stage and not yet fully integrated to the Concerto system. In our opinion for the compliance this integration is highly important. [Action point 13] 6.3.10 Regarding suggested remedial action in the Concerto Remedial Action Bar, it appears quick actions have not been taken and followed up by the Compliance Team. For example, regarding Perth Grammar Schools Sports Grammar pitch servicing have been highlighted as high priority in November 2025 which require structural engineers work due to movement on column base. However, it has not yet been completed on our audit date. This section should be cleared by a responsible person in timely manner. [Action point 14] 6.4 To ensure H&S training, incident reporting, and risk assessments are robust and effective 6.4.1 There is currently no formal mechanism in place to ensure that all required training is completed by all employees. Although all mandatory modules are available through the e-learning platform, there is no effective cross-checking or oversight. Managers can request a report of their staff to check the training completions and there is no current direct access for managers to do this via the PKC Learn system. [Action point 15] 6.4.1 During our review on HART team’s H&S, it was notified to us that the staff of the HART team have been unable to complete e-learning due to lack of protected time. [Action point 16] 6.4.2 In our inquiry in relation to mandatory H&S training of HART teams it was noticed that provided mandatory training compliance has significant gaps. Several training courses are well below expected compliance levels: • Violence & Aggression Awareness – 25% • DSE Training – 45% • Infection Control e-learning – 28% (though the workshop is higher at 87%)
Page 13
13 • Moving with Dignity – 75% Out of the 40 mandatory training categories, only 14 have achieved a completion rate above 50%, which is a significant concern given the high number of medication errors recorded in Q2 25–26. The auditor is of the opinion that training compliance must be monitored more rigorously to ensure staff are equipped with the necessary knowledge and skills to reduce errors and maintain safe service delivery. [Action point 17] 6.4.3 In accordance with the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR), the Council must ensure that all reportable incidents are notified to the HSE within the statutory timeframes. Serious incidents (including fatalities, specified major injuries, hospital treatment of non-workers, and dangerous occurrences) must be reported immediately and without delay, reflecting the requirement for urgent regulatory notification. All other reportable events must be followed by a full written submission to the HSE within 10 days, ensuring timely and accurate compliance with the regulatory process. In cases where an employee is incapacitated for more than seven consecutive days, the incident must be formally reported within 15 days of the accident date, consistent with the statutory reporting thresholds for over 7-day injuries. The H&S Team is responsible for determining RIDDOR applicability. 6.4.4 We noted that, on several occasions, RIDDOR reportable incidents were not submitted within the statutory timelines required by the HSE. In certain cases, reports were submitted several months after the incident occurred. However, adherence to these timeframes is essential to maintain compliance and support effective oversight of workplace health and safety. [Action point 18] 6.4.5 The H&S Team has made renewed efforts to address incidents, however, the lack of reduction in reportable incidents observed by the auditor has highlighted the need for stronger support and understanding from all managers. Without proper safety measures in place, employees remain at risk, insurance costs may rise due to increased claims, and the Council faces potential harm to the public as well as reputational damage. It is therefore essential that managers actively contribute to targeted actions aimed at reducing reportable incidents across the organisation. [Action point 19] 6.4.6 The manager of Direct Services confirmed that approximately 300 Risk Assessments and Safe Systems of Work are currently in place in his service. We identified that the volume and complexity of these documents present challenges in terms of effective management and oversight of H&S. However, efforts are underway to reduce this complexity, and a substantial review has been conducted by the H&S Team. A designated responsible officer has been appointed to oversee and follow up on the review outcomes. Several improvement actions have been identified within the action plan, and work is underway to implement them.
Page 14
14 6.4.7 In accordance with section 53 of the Fire (Scotland) Act 2005 and regulation 9 of the Fire Safety (Scotland) Regulations 2006, fire risk assessments must be carried out and kept under review regularly. In general practice, this includes annual review (as adopted across councils, schools, offices and care environments) and review following any significant change or where the assessment is no longer valid. 6.4.8 Scottish Fire and Rescue Service (SFRS) carried out 4 audits at Council premises during 2025/26. The SFRS also carried out 21 operational visits to domestic high-rise properties. In our inquiry, it is mentioned that H&S Team does not monitor outstanding actions from SFRS audit. They mentioned that this information will be available to the Head of Establishment from each audited property or to the Housing and Repairs Team for domestic premises. With the development of Concerto these outstanding actions will be signed off when the task is completed. However, there is no evidence on the completion of any actions just now and there is no one responsible person from the H&S Team to follow up. [Action point 20] 6.4.9 The auditor was informed that the H&S Team carry out an annual FRA review of all buildings with sleeping accommodation such as care homes and other buildings with significant fire risks such as Friarton Depot. And re-assess existing FRAs at 24 months, 36 months, 48 months or 60 months frequencies depending on many factors. However, the fire risk assessment schedule provided is not completed and the re assessment frequencies have not been set up properly for the many of the properties. [Action point 21] 6.4.10 In relation to the Council Headquarters at 2 High Street, a new FRA was completed on 27 May 2026 following the significant changes in layout and occupancy during 2025. However, the assessment identified that although the overall fire risk is considered tolerable, few high-priority actions remain and several recommendations from the previous FRA (August 2023) have still not been implemented. Although fire drills were carried out in March and May 2026, the existence of outstanding and newly identified issues indicates that fire safety arrangements require further strengthening to ensure full compliance and effective risk management. [Action point 22] 6.4.11 Regarding the Pullar house building, the ownership has changed in September 2025, and the last FRA was dated 24 July 2024. In the FRA schedule it has mentioned that the next FRA is due in July 2026 and in our inquiry, it is mentioned that there is ongoing discussion with other users of the building regarding next FRA. However, the FRA is yet to be done. [Action point 23]
Page 15
15 7. Conclusion 7.1 The Internal Audit review is able to place reasonable assurance on the overall control environment for arrangements for the compilation of the annual submissions to the Housing Regulator. The agreed actions, once implemented, should enable the Internal Audit to place substantial assurance on these. 8. Acknowledgements 8.1 Internal Audit would like to thank all officers who were involved in this audit, G Boland, Strategic Lead – Strategic Planning, People & Performance P Johnstone, People & Culture Manager L Hamilton, Team Leader- Health & Safety M Young, Fire Safety Advisor F Gamlen, Systems Officer G Key, Principal Officer – Energy & Engineering A Cook, Service Manager – Contracts & Facilities L Peoples, Team Leader -Contracts & Facilities A Brown, Assistant Fleet Manager C Shepherd, Team Leader Communities - Repairs & Improvements N Gibson, Team Leader (HART) R Ross, Team Leader – Justice N Taylor, Direct Services Manager E Bayne, HR Team Leader S Burke, PA to Strategic Lead Strategic Planning, People & Performance 9. Action Implementation & Follow up 9.1 Responsibility for the maintenance of adequate and effective controls rests with management. Where the audit has identified areas for management action, these are identified in the Management Action Plan. Where a decision is taken by management not to act in response to findings from this review, it is the responsibility of management to assess and accept the risk arising from non- implementation. 9.2 Achievement of the agreed actions is monitored through Internal Audit’s ‘follow up’ arrangements.
Page 16
16 10. Management Action Plan Action Point Para. No Finding Risk Rating Agreed Action & Evidence Action Owner Target Completion Date 1 6.2.2 Our review identified that the H&S Team does not currently have an established audit plan in place, despite this being a statutory requirement. Although this issue has been acknowledged within the Corporate Risk Register (with an initial completion target of 31 December 2025), the deadline has since been deferred. During our discussions, the Team Leader confirmed that the audit process is expected to be implemented in the Team Plan 2026/27. 4 Agreed action: An audit process and programme for Health and Safety performance will be piloted and subsequently implemented as part of Team Plan 26/27. Agreed evidence: Approved audit plan L Hamilton Team Leader- Health & Safety March 2027 2 6.2.3 Our review noted that, in relation to Risk Register entry SR011, “the implementation of a robust corporate Health and Safety policy and the associated topic-specific arrangements” has not yet been fully completed. However, we found that no formal approval had been granted for the following guidance documents: 3 Agreed action: Continue review of supporting documentation, to align with updated Corporate Health and Safety Policy. This is part of Team Plan 26/27. Agreed evidence: Approved guidance documents L Hamilton Team Leader- Health & Safety March 2027
Page 17
17 • Alcohol and Drug Use Guidance (HR Guides) • First Aid Guidance • Infection Control Guidance • General Risk Assessment Guidelines In addition, no guidance has yet been developed for the Provision and Use of Work Equipment (PUWER). 3 6.2.4 Our review of H&S practices within Fleet Management identified that there is currently no comprehensive policy in place to prevent drivers from operating vehicles while under the influence of Alcohol or Drugs. Although a memo referencing an Alcohol and Drug Policy was issued to all staff by the Direct Service Manager on 14 March 2025, this communication alone is insufficient. Internal audit opinion’s is that there should be a robust, council wide Drug and Alcohol policy. 3 Agreed action: There are a Management Arrangement and Guidance in place. Even though there is no control sheet on documents, they have all been through Employee Joint Consultative Committee (EJCC). Managers should identify this and put in place suitable and sufficient control measures to address risks from drugs and alcohol. The People & Culture Manager will explore approaches adopted by other local authorities to understand potential options available and agreed to take further discussions with trade unions. Agreed evidence: P Johnstone People & Culture Manager January 2027
Page 18
18 • Board minutes • Approved new drug and Alcohol policy 4 6.2.6 During our review we have noticed many insurances claimed due to various reason including fire at properties, trip/ fall, driver errors etc. However, there is a lack of effective coordination between the H&S Team and the Insurance Team, despite the clear importance of this collaboration and explicit requirement within organisational policies. 3 Agreed action: • Agree with Insurance Team on quarterly updates. • Ask for Insurance Team input into Committee quarterly reporting. • Feedback on claims and legal rulings from Insurance Team to Health and Safety Team. • Incorporation of insurance team information in reporting and planning carried out by the Health and Safety Team. Agreed evidence: • Quarterly update reports from Insurance Team • Communication with Insurance Team L Hamilton Team Leader- Health & Safety G Walker Corporate Asset Management Officer December 2026 5 6.2.8 Despite recognising the seriousness of the V&A, there are gaps in adequacy of planning, monitoring, and control measures in place by management to protect a minority of staff. These gaps are especially evident for teams such 4 Agreed action: Develop and implement enhanced processes to enable appropriate access to existing risk information and systems, in compliance with relevant legal and data protection G Boland Strategic Lead – Strategic Planning, People & Performance June 2027
Page 19
19 as Licensing, Environmental Health, and Food Health and Safety, where staff may attend locations or interact with individuals without full visibility of potential risks. The absence of consistent and accessible risk information limits the ability of managers and staff to undertake appropriate precautionary measures, such as conducting visits in pairs rather than individually. requirements. This should include establishing a more coordinated and consistent approach to sharing V&A risk information across services. Agreed evidence: Documented procedures on new or revised processes for accessing and sharing V&A risk information. 6 6.2.9 The Employment Right Act 2025, effective from April 2026, increases employer’s responsibility and liability for preventing harassment, including sexual harassment. Employers now need to take “all reasonable steps” to prevent sexual harassment in the workplace. In our inquiry from the service manager, it was highlighted challenges in managing this duty due to third party involvement such as parents, contractors, agency workers etc. In our observation, it indicates that appropriate preventive arrangements to address these risks have not yet been fully established. 3 Agreed action: There are no final guidelines provided by the government yet specifically defining “all reasonable steps”. However, Sexual Harassment has been added to the General Risk Assessment for consideration. Further arrangements are under the development stage such as whistleblowing guidance for managers and employees and processes for complaints and grievances etc. Agreed evidence: Approved whistleblower guidance P Johnstone People & Culture Manager October 2026
Page 20
20 Approved new processes developed on Sexual Harassment 7 6.3.2 Although the services are provided directly to HoE, overall oversight and performance monitoring of specific contracted services should be carried out by the Property Services Team. The responsible person for the management of HoE Property Services has been appointed recently, and monitoring activities are still under development stage. It is recognised this as key role since monitoring is essential in parallel with external audit actions to be implemented. 4 Agreed action: All outsourced HoE tasks to be logged on the HoE Concerto system, and random sampling to be provided to support completion of these checks. All H&S issues in relation to relevant outsourced services to be discussed as part of relevant operational monitoring meetings as required, and all H&S incident reports to be provided upon request. Agreed evidence: HoE records on Concerto. Minutes of operational meetings. Copies of any relevant inspections and observations. Any relevant H&S incident reports and follow on actions A Cook Service Manager – Contracts & Facilities September 2026 8 6.3.3 A new Head of Establishment Premises Handbook was published in May 2025, replacing the previous version from June 2015, following consultation with representative 1 Agreed action: SharePoint site to be signed off, with updated Handbook available. Heads of Establishment who have been L Hamilton Team Leader - Health & Safety Completed
Page 21
21 Service Managers, Heads of Establishment and Head of Establishment Steering Group. The new handbook has not yet been uploaded to ERIC, meaning Head of Establishment do not have access to the current version, specifically the new Summary of Task is required to be access by everyone. At present, only the previous version remains available on the system. trained have been linked to the updated Handbook already. Agreed evidence: Link to the updated document 9 6.3.4 Training on the newly issued Head of Establishment Premises Handbook has not yet been fully completed at the time of the audit. Our inquiries confirmed that several school HoEs and non-school HoEs are still awaiting training, indicating that the rollout remains incomplete. 3 Agreed action: Final training session is on 2 June 2026 Agreed evidence: Updated training completion list L Hamilton Team Leader- Health & Safety Completed 10 6.3.6 During the Concerto walkthrough testing, a significant number of overdue PPM tasks were identified. These included statutory, non- statutory, and asset register based maintenance tasks. Among the overdue statutory tasks, primary and secondary school properties were included. In our inquiry, management advised that the 3 Agreed action: • To work with current supplier to improve performance during current contract which is due to expire in Apr 2027. • Contractor performance also improved during first quarter of 2026 and continues to improve. New contract will also be in place from Apr G Key Principal Officer – Energy & Engineering April 2027
Page 22
22 backlog was primarily attributable to a single supplier experiencing resourcing pressures. In addition, the KPI of the supplier reported for the period October to December 2025 indicates an overall downward trend in performance. 2027, and contractor may not be successful in winning new contract. Agreed evidence: • KPI for the first quarter 2026 • Contractor award document 2027 11 6.3.7 In the Concerto system, HoE module is newly embedded to check the duties done by relevant Business Managers (HoE) and it only includes the schools. Since there are so many other establishments that require proper maintenance and Compliance Team or Business Manager’s attention, those should be included in the module soon. Our inquiry has not provided any targeted date on completion of this. 3 Agreed action: All other relevant premises to be added to HoE Concerto Database. HoE to be identified and relevant records to be updated. Agreed evidence: Data base updated with all relevant HoE information. A Cook Service Manager – Contracts & Facilities October 2026 12 6.3.8 The Properties Team confirmed that electrical and mechanical inspections have been carried out some of the buildings. However, Structural Survey has not been carried out along with that. In our inquiry it was mentioned to us Building Condition Surveys operate 3 Agreed action: A programme for Building condition surveys for 2026/27 are currently being reviewed manually by the in-house building surveyor and will be issued to the supplier to undertake these. Further, development is also G Key Principal Officer – Energy & Engineering July 2026
Page 23
23 on a five-year rolling programme, managed by a dedicated Condition Survey Team. These surveys are not recorded within the PPM system, and the schedule of upcoming surveys must be obtained directly from the team. We have not yet received this schedule for our review. required with Concerto to automate the programme for Building condition surveys which is currently being explored at present. Structural surveys are not carried out as standard only where identified by the building surveyors in accordance with Scottish Government core facts methodology. Agreed evidence: Programme of surveys 13 6.3.9 In our discussion with the Service Manager Corporate Landlord, it has mentioned that the Council is following SFG20 (the industry standard for building maintenance). However, this SFG20 system is still in development stage and not yet fully integrated to the Concerto system. In our opinion for the compliance this integration is highly important. 2 Agreed action: SFG20 is to be integrated into concerto for future contract. It is not required at present for current contract as robust and compliant specifications are in place already but for improvement and efficiency for the new contract this is to be automated using SFG20. Agreed evidence: Systems will be integrated in advance of new contract being awarded in Apr 2027. G Key Principal Officer – Energy & Engineering November 2026
Page 24
24 14 6.3.10 Regarding the suggested remedial actions recorded in the Concerto Remedial Action Bar, it appears that timely actions and follow-ups have not been carried out by the Compliance Team. However, it has been explained to us that the required work has in fact been completed, but the system has not been updated accordingly. This kind of outdated system information may result in inaccurate reporting, misrepresentation of compliance status, and the perception that critical actions are delayed or not performed. 4 Agreed action: Work is currently progressing with Concerto team and IT colleagues to investigate automating of some of the functions which will free up time for members of staff to review remedial tasks. A re-structure in Property services will also provide additional resources to dedicate to this function. Agreed evidence: • Confirmation from IT/Concerto team on fully automation • Reports run on remedial actions G Key Principal Officer – Energy & Engineering December 2026 15 6.4.1 There is currently no formal mechanism in place to ensure that all required training is completed by all employees. Although all mandatory modules are available through the e-learning platform, there is no effective cross-checking or oversight. Managers can request a report of their staff to check the training completions and there is no current direct access for managers to do this via the PKC Learn system. 4 Agreed action: • Training records will be part of the new audit process. • Ongoing discussion with the supplier of the platform and PKC IT to develop an API (Application Programming Interface) and potentially develop a dashboard to ensure effective tracking and completion of mandatory training. L Hamilton Team Leader- Health & Safety J Cassidy Employee Engagement Officer March 2027
Page 25
25 Agreed evidence: • Training completion records • New platform to track he is training completion 16 6.4.2 During our review on HART team’s H&S, it was notified to us that the staff of the HART team have been unable to complete e-learning due to lack of protected time. 3 Agreed action: Allocate protected time for staff to complete outstanding mandatory e-learning and monitor progress through locality co-ordinators. Agreed evidence: Training records showing completion rates, list of outstanding training, and periodic monitoring reports. N Gibson Team Leader - HART August 2026 17 6.4.3 Out of the 40 mandatory training categories, only 14 have achieved a completion rate above 50%, which is a significant concern given the high number of medication errors recorded in Q2 25–26. The audit is of the opinion that training compliance must be monitored more rigorously to ensure staff are equipped with the necessary knowledge and skills to reduce errors and maintain safe service delivery. 4 Agreed action: Continue to ensure all staff complete medication training and competency assessments and implement the medication checklist to reduce errors. Agreed evidence: Medication training and competency records, checklist implementation evidence, and reports demonstrating reduction in medication errors. N Gibson Team Leader - HART August 2026
Page 26
26 18 6.4.5 We noted that, on several occasions, RIDDOR reportable incidents were not submitted within the statutory timelines required by the HSE. In certain cases, reports were submitted several months after the incident occurred. However, adherence to these timeframes is essential to maintain compliance and support effective oversight of workplace health and safety. 4 Agreed action: • Reinforcement on Incident Reporting training • SHSCC reminded of importance • Health and Safety Team now check absence dates, as over 7-day absences have been the most problematic. Agreed evidence: • Summary of incident reports to HSE L Hamilton Team Leader - Health & Safety December 2026 19 6.4.6 Despite the continued efforts of the H&S Team, in the consistent level of reportable incidents observed has highlighted the need for stronger support and understanding from all managers. Without proper safety measures in place, employees remain at risk, insurance costs may rise due to increased claims, and the council faces potential harm to the public as well as reputational damage. It is therefore essential that managers actively contribute to targeted actions aimed at reducing reportable incidents across the organisation. 3 Agreed action: Reinforce through the Strategic Health and Safety Consultative Committee (SHSCC) framework and obtain active support from all Service Managers to reduce the number of reportable incidents. Agreed evidence: Quarterly reports on incidents G Boland Strategic Lead – Strategic Planning, People & Performance L Hamilton Team Leader - Health & Safety August 2026
Page 27
27 20 6.4.9 Scottish Fire and Rescue Service (SFRS) carried out 4 audits at Council premises during 2025/26. The SFRS also carried out 21 operational visits to domestic high- rise properties. In our inquiry, it is mentioned that H&S Team does not monitor outstanding actions from SFRS audit. They mentioned that this information will be available to the Head of Establishment from each audited property or to the Housing and Repairs Team for domestic premises. With the development of Concerto these outstanding actions will be signed off when the task is completed. However, there is no evidence on the completion of any actions just now and there is no one responsible person from the H&S Team to follow up. 4 Agreed action: Write to all Heads of Establishment to remind them to let the Health and Safety Team know if they are being visited by SFRS, and to share actions with the Fire Safety Adviser. Email Heads of Establishment and ask them to update their action plans and report when actions are completed. Agreed evidence: • Email correspondence • Evidence on action completion L Hamilton Team Leader - Health & Safety December 2026 21 6.4.10 The auditor was informed that the H&S Team carry out an annual FRA review of all buildings with sleeping accommodation such as care homes and other buildings with significant fire risks such as Friarton Depot. Other premises have their FRAs re-assessed at 24 months, 36 months, 48 months or 3 Agreed action: Check the work schedule to ensure it is up to date. Agreed evidence: Updated work schedule L Hamilton Team Leader - Health & Safety August 2026
Page 28
28 60 months frequencies depending on many factors. However, the fire risk assessment schedule provided is not completed and the re- assessment frequencies have not been set up properly for the many of the properties. 22 6.4.11 In relation to the Council Headquarters at 2 High Street, a new FRA was completed on 27 May 2026 following the significant changes in layout and occupancy during 2025. However, the assessment identified that although the overall fire risk is considered tolerable, few high-priority actions remain and several recommendations from the previous FRA (August 2023) have still not been implemented. Although fire drills were carried out in March and May 2026, the existence of outstanding and newly identified issues indicates that fire safety arrangements require further strengthening to ensure full compliance and effective risk management. 2 Agreed action: Property action: • Awaiting costs from supplier to undertake surveys for fire doors throughout the building. It should be noted the building was fully refurbished and all fire doors were replaced as part of refurbishment. • Other outstanding actions which relate to fire stopping will be reviewed by internal architectural resources following meeting on 8 June 2026 and a contractor will be engaged in due course to carry out necessary remedial works. HoE action: • Coordinate with Property Service Team to ensure all fire safety matters are addressed collaboratively. G Key Principal Officer – Energy & Engineering S Walker HoE, 2 High Street, Perth December 2026 January 2027
Page 29
29 • Complete the mandatory fire safety self-assessment • Remove fire hazards such as portable heaters, insecure storage and poor housekeeping practices within the building. • Strengthening the fire safety management through frequent checks, training and record keeping • Ensure high-risk areas are secured and enforcing safe working practices Agreed evidence: • Completed Annual Self- Assessment and schedule • Next FRA to ensure previous actions have been fully completed 23 6.4.12 Regarding the Pullar house building, the ownership has changed in September 2025, and the last FRA was dated 24 July 2024. In the FRA schedule it has mentioned that the next FRA is due in July 2026 and in our inquiry, it is mentioned that there is ongoing discussion with other users of the building regarding next FRA. 2 Agreed action: On completion of the revised Fire Strategy an updated FRA will be put in place. Any actions arising from the revised FRA will be addressed by the HoE for Pullar House. Agreed evidence: Updated FRA in place L Hamilton Team Leader - Health & Safety A Cook Service Manager – Contracts & Facilities August 2026
Page 30
30 However, the FRA is yet to be done.
Page 31
31 11. Authorisation 11.1 The auditor for this assignment was D. Arachchilage. The supervising auditor was J Clark. This report is authorised for issue: 12. Distribution 12.1 This report has been distributed to: T Glen, Chief Executive C Mailer, Depute Chief Executive Z Robertson, Director/Chief Officer Perth & Kinross Health & Social care Partnership L Simpson, Strategic Lead - Legal & Governance S Walker, Strategic Lead - Finance and Business Support E Ritchie, Strategic Lead - Housing & Communities F Crofts, Strategic Lead - Environment and Infrastructure A Singh, Strategic Lead - Children, Families and Justice J Beveridge, Strategic Lead - Property Services A Taylor, Strategic Lead - Customer and Digital Services S Merone, Strategic Lead - Economy, Development and Planning D Macluskey, Strategic Lead - Education and Learning C Guild, Strategic Lead - Projects and Programmes G Boland, Strategic Lead – Strategic Planning, People & Performance P Johnstone, People & Culture Manager L Hamilton, Team Leader- Health & Safety G Key, Principal Officer – Energy & Engineering A Cook, Service Manager – Contracts & Facilities A Brown, Assistant Fleet Manager N Gibson, Team Leader - HART J McColl, Service Manager - Repairs & Improvements N Taylor, Direct Services Manager J Cassidy, Employee Engagement Officer G Walker, Corporate Asset Management Officer Committee Services External Audit
Page 32
32 13. Assessment Definitions 13.1 The following table contains the definitions of the control objective assessment. Control Objective Assessment Level of assurance Definition Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non- compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. 13.2 The following table contains the definitions applied by Internal Audit in rating audit findings/actions. Risk Rating for Individual Findings Rating Rating description Definition 5 Critical Significant observations / major concerns which require immediate action. Management will need to add these to the appropriate Service risk register Issue represents a control weakness which could cause, or is causing, severe disruption of the process or severe adverse effect on the ability to achieve process objectives 4 High Significant observations regarding the absence / failure of key controls requiring urgent action. Management should consider adding these to the appropriate Service / divisional risk register Issue represents a control weakness which could have, or is having, major adverse effect on the ability to achieve process objectives 3 Medium Observations regarding the effectiveness of key controls requiring reasonably urgent action. Management should consider these when updating any divisional / team risk registers Issue represents a control weakness which could have, or is having, significant adverse effect on the ability to achieve process objectives
Page 33
33 2 Low Minor observations regarding the adequacy of controls which require action to improve the efficiency, effectiveness, or economy of operations or which otherwise require to be brought to the attention of Senior Management Issue represents a minor control weakness with minimal but reportable impact on the ability to achieve process objectives 1 Trivial / Minor Very minor observations which will be raised during the audit and may not be included within the final report Issue represents a very minor control weakness with negligible impact on the ability to achieve process objectives. The issue will be raised during the audit and may not be included within the final report.