Internal Audit Report - 25-07 - Insurance
Perth and Kinross Council · 29 June 2026
Back to Audit and Risk Committee — 29 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 Internal Audit Report All Services 25-07 Insurance June 2026 Final Report (Report No. 26/195) Legal and Governance Perth & Kinross Council Council Offices 2 High Street Perth PH1 5PH
Page 2
2 Contents by Section 1. Introduction 2. Executive Summary 3. Audit Background Information 4. Scope and Limitations 5. Assessment of the Control Environment 6. Summary of Findings 7. Conclusions 8. Acknowledgement 9. Action Implementation & Follow Up 10. Management Action Plan 11. Authorisation 12. Distribution 13. Assessment Definitions
Page 3
3 1. Introduction 1.1 The audit of Insurance was undertaken as part of the Internal Audit Plan for 25/26, which was approved by the Audit & Performance Committee on 25 June 2025. The period under review for the purposes of the audit exercise was financial years 2024/25 and 2025/26, however we used some data since 2022 for trend analyses and wider claims overview. 1.2 The indicative scope for the audit was to ensure the effectiveness and compliance of insurance within the council. 1.3 This audit is not linked to any particular risk on the Strategic Risk Register, however, forms the basis for internal assurance in accordance with the Global Internal Audit Standards in the UK Public Sector. 2. Executive Summary 2.1 The audit has found that Substantial Assurance can be placed on the Council’s internal controls in relation to the review of Councils’ Insurance arrangements. Areas of good practice have been highlighted within Section 5 of this report. 2.2 There are 6 actions arising from the findings in Section 6. We note that the service was aware of these and were taking action to address the issues, where possible. These actions are suggested areas for improvement, where collaboration with other services may further strengthen the insurance arrangements. The action plan in Section 10 includes these actions which are currently on-going to address the issues raised. 3. Audit Background Information 3.1 Insurance is required as part of the Council’s statutory responsibility to safeguard public funds and ensure continuity of services. Under the Local Government (Scotland) Act 1973, Councils are entrusted with managing assets, employees, and public services, which exposes them to financial and operational risks. To meet these obligations and comply with sound financial governance, Councils must maintain adequate insurance to protect against liabilities such as property damage, employee injury, and third-party claims. The Local Government (Scotland) Act 1973 requires the Council to have proper arrangements in place for the administration of its financial affairs. 3.2 Council have the authority to plan the need for statutory and additional insurance protection based on the legal requirements, the risk exposures and the level of insurance required to cover those risks that the Council cannot self-finance. 3.3 The Council’s insurance service is managed by Zurich Municipal PLC. The Council must ensure that it has appropriate insurance in place to cover key risks associated with its activities and responsibilities. Insurance is one of the
Page 4
4 main methods of transferring financial risk and is therefore likely to play a significant role in the Council’s risk mitigation. If there is an inadequate insurance coverage it can lead to significant losses and therefore highlights the requirement to be included in the Annual Audit Plan. 3.4 Insurance premiums are unlike any other item of Council expenditure, in that they are governed by the state of the insurance market which, in turn, is governed by the effects of claims, national events and natural activities. Council has statutory obligation as part of its internal activities to take Public Liability (PL), Employer’s Liability (EL) Insurance and Motor insurance. Furthermore, as part of additional services, provided by Council there are Property, Travel (cover for schools and teachers for UK and abroad), Community Insurance and Fidelity Guarantee Insurance cover. 3.5 As per our review, the Council has chosen to manage the risk by obtaining insurance protection, where possible, with variable insurance excess policies, depending on type of policy and risk. Additionally, and often seen as a widespread practice among other authorities, Council manages an internal insurance fund. The insurance fund still pays the excess amounts and covers smaller claims, which overall, creates a balanced, cost-efficient risk strategy. The total value of the insurance premiums payable for policies held for the period 24/25 was £1,837,026 and for 25/26 is £2,179,332. 3.6 Assessing insurance risk and market conditions is complex and, in most cases, requires specialist expertise to enable the Council to form an opinion. As a result, this activity is outsourced to an external insurance broker, arranging tailored insurance cover and act as a liaison between the Council and insurers. The Council’s current broker is Gallagher. Gallagher also provides claims handling support, which is a fee-based service charged in addition to the insurance premiums. The appointment of the broker and insurance provider is undertaken through a joint procurement exercise, with contracts awarded for a three-year period and subject to annual review. The current contract period covers 2024 – 2027. 3.7 Furthermore, the internal insurance team in Council is a team of two officers and a management leadership team, which manage all transactional affairs, communications between brokers and insurance providers. The team has recently adopted a small transformation, aligning more closely operationally with corporate asset management, which lays more closely with insurance team’s tasks and work responsibilities. The team, monitors and coordinates all claims, inputs the details to internal Figtree system (claims software) and communicates between Council, Brokers and has full access to Zurich Municipal PLC Council claims database. 3.8 The strategy for Internal Audit is to deliver a risk based Internal Audit service by designing planned activity around the key risks to the Insurance Management and Operational Controls.
Page 5
5 4. Scope and Limitations 4.1 The Audit has reviewed the appropriate use of the insurance policy and its renewal, including the adequacy of the cover, managing and recording of claims, prevention and monitoring, as well as third party cover. 4.2 To arrive at an opinion on the achievement of the control objectives, the review included: • Gathering information from published regulations and governance guidelines. • Validated the operational process against the published standard operating policy and internal procedures. • Interviews and review of documentary evidence. 4.3 There were no limitations identified that would impact the Audit, which concentrated on the control environment for managing insurance risk. We did not verify the accuracy of the detailed records of claims and the journal entries logged in the Figtree system, used for internal claims records management. 4.4 Furthermore, we have not duplicated work undertaken by External Audit as part of their annual audit. 4.5 The details of the control objectives reviewed and Internal Audit’s assessment of their strength of control in each area is contained within Section 5 of this report. 5. Assessment of the Control Environment 5.1 The table below contains a summary of the number of findings and their ratings, as detailed in Section 12, against each control objective, along with Internal Audit’s assessment of the adequacy and effectiveness of the controls in place to meet each of the objectives agreed for this audit. Further details, including any improvement actions, are set out in the Management Action Plan in Section 10. No. Control Objective Action Rating Control Objective Assessment 5 4 3 2 1 1 To ensure that there is adequate insurance in place for the council to cover its governance requirements. 1 3 Substantial Assurance 2 To ensure that the effectiveness and efficiency of the insurance process and that claims processes are dealt with promptly; including Trend analysis, improvement and preventative measures applied, where applicable 1 1 Substantial Assurance 3 To ensure that there is a sound coordination of services, guaranteeing 1 Substantial Assurance
Page 6
6 immediate risk areas are evaluated, covered and minimising the duplication of efforts. 5.2 The auditor has assessed that Substantial Assurance can be placed on controls overall in relation to the arrangements for Insurance Cover for Perth and Kinross Council. Meaning: “A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited”. 5.3 A summary of the key findings and actions is provided in section 6. Please note, however, the following areas of good practice which have been highlighted during the audit: 5.3.1 As part of the assurance process within the insurance team, we reviewed the team’s tasks and potential risk of claims being delayed, unpaid and unadministered, which could potentially cause not only reputational damage but also risk of financial losses. The auditor would like to highlight the positive collaboration and immediate response from the insurance team, during the review process. The officers were not only, fast and supportive in their areas of work but also shown full knowledge and awareness of each other’s responsibilities. 5.3.2 The Insurance team promptly and efficiently supports other Council functions, such as preparing detailed monthly reports to fleet for management review and regularly scheduled reports for Executive Leadership Teams (ELT) and responding swiftly to information requested under Freedom of Information (FOI) legislation. 5.3.3 All Policies (Public Liability, Employers Liability, Motor, Property, Business, School Travel and Fidelity) are in place and updated from July each year, to be active for 31 October. Auditors have reviewed that there is sufficient information gathered at the end of each financial year, to support all required decisions regarding any update to the renewal of policies. We can confirm that all Policies run concurrently ensuring no gaps in insurance. 5.3.4 It is a requirement for local authorities to take security against the infidelity of officers whose duties involve the custody and control of money. The Local Government Act from 2003 and Local Government Act 1973 reaffirms this, as part of the framework of duty to secure Best Value; this is the modern insurance equivalent of “security” and covers losses caused by employee fraud or dishonesty, which Policy runs and is in place at the same times as the rest of the Insurance covers. 5.3.5 The auditor has verified that monthly claims reviews, meetings, and communications between Council insurance team, brokers, and insurers have taken place. During the audit period (Nov’ 25- March ‘26) we took samples of public liability, motor, and employers’ liability claims, which represents a 10% from the annual volume. Each claim was processed, validated, and
Page 7
7 acknowledged in line with established procedures before being passed to the insurer. Insurance officers presented extremely detailed information being held on each claim throughout its lifecycle. During the timeframe validation, the auditor randomly selected examples of 3 claims from each policy and all were closed and completed within 3-4 months from the receiving date. 5.3.6 Council Insurance officers use Figtree system to record and manage all claim details. Figtree is a procured software that contributes to efficient claims management, as seen with recent improvements introduced to GDPR functionality designed to protect claimant data, improve the control environment and demonstrate wider compliance. The use of the Figtree system strengthens Councils Insurance Team arrangements and provides effective support and maximises data control over claims management. 5.3.7 Gallagher is an external insurance broker providing specialist expertise, access to wider insurance markets and competitive premiums. The broker provides recommendation to Council on insurance risks and current market trends. Brokers support tendering, gives independent advice on cover gaps, and supports the Council with claims handling and risk analysis. The externally outsourced broker is visibly beneficial for the Council Insurance team’s workload and not only reduces claims process pressure, it also helps to ensure the Council has appropriate, proportionate, good value insurance cover. Gallaghers position is advisory and does not carry the risk, this lays completely over the insurance provider Zurich. 5.3.8 Whilst Gallagher provides a brokerage cover, the auditor confirmed that the firm’s services has been tendered prior to contracting, to do Actuarial Valuation report. The report supports to reevaluate and affirm the size of Council Insurance’s Fund, using the Council’s data for the last 10 years. Obtaining the report prior to tendering for the 2024 insurance contract, improves the accuracy of premium calculations and strengthens data driven analysis. Additionally, our observations confirm that Gallagher have used two of the most used methodologies: chain ladder and Bornhuetter-Ferguson actuarial methods for assessment and provide Council leadership with accurate information in support their budget and risk management. 5.3.9 Property has the highest value of assets and therefore risks are highest in Premiums and excess cover. Our observations confirmed that Insurance officers add newly acquired properties promptly onto a monthly monitoring sheet, which is communicated directly with the insurer, Zurich M. The Auditor reviewed the inventory records across Motor, Property and IT and confirmed the total value cover held in each service corresponds to the information held from insurance team. Council officers have up to date information and there is no gap or misalignment between value of assets and insurance cover. A noticeable improvement was evidenced in ongoing work, where insurance officers can now directly access the database system of the property services, which saves time, improves accuracy and miscommunication between different departments.
Page 8
8 5.3.10 Moreover, during the audit, it was noted that the realignment of functions between strategic portfolios, with the Corporate Asset Management Officer having overall responsibility for the Insurance team, has been beneficial for the team. This change in position will enhance the development of asset management knowledge within the Insurance team’s operations. The role has already brought wider knowledge of internal asset management systems and improved understanding of data flows and communication across services. Overall, this development will support more streamlined control environment and contribute to improved operational efficiency within the Insurance function. 5.3.11 To affirm the up-to-date value of Council properties, the Central Service Manager completes an annual review of Index Linking the value of the properties in line with inflation. A positive observation was seen in addition to this; in 2024 the Insurance team has assigned a specific request to an in- house surveyor. A report was created for a specialist Valuation exercise to all Council buildings, to affirm the most accurate valuation, reflecting local market value of housing as well as tailored cost per building (Concert Halls, Schools etc.), to create a detailed knowledge and form the most accurate insurance cover. 5.3.12 During auditor’s assessment we included a sample test, against failure of service of areas or delay in informing the insurance office of new assets requiring insurance. Instead of insuring individual items for damage and accidental cover, 10% of the building’s insurance is allocated to contents. Our samples included a higher claim, with material value (over £5000), caused by a storm damage on Coupar Angus Primary School in January 2024. The review of documents and settlement of the claim confirmed that the insurance has been efficient to cover all the contents. 5.3.13 As part of the wider scope on high value dispute claims, such as the fire at the former Balhousie Primary School, we confirmed the involvement of loss adjustors in overseeing such claims. Loss adjusters are appointed by insurers for high‑value or complex claims to provide an independent, expert assessment that ensures accurate, fair, and efficient claim resolution. 5.3.14 Council insurance manual, forms and related policies are populated on the Council’s intranet widely and easily accessible from the employees, when necessary. Auditors have confirmed efficient flow of information and Fleet Management receives a monthly summary of driver reported claims. In addition to validating insurance requirements for fleet and leased vehicles, a monthly claim analysis is conducted to strengthen responsibility and reduce recurring incidents. Where necessary, this is reflected on disciplinary action log. 5.3.15 Accountability and monthly analysis are additionally evident in the ongoing work between Property Services and other departments. A shared monitoring project sheet is used to track actions aimed at preventing future claims, particularly through improved property maintenance feedback and their link to public liability claims.
Page 9
9 5.3.16 An analysis of the highest monthly claims is considered by Council Chief Finance Officer on regular basis, which additionally affirms control over future expenditure and awareness over Strategic Leadership Teams. 6. Summary of Findings 6.1 Below is a summary of key findings and actions, which are reflected in the Management Action Plan, detailed in section 10. 6.2 Inadequate Insurance Policies to cover Council’s requirements. 6.2.1 Although all Insurance policies run continuously, the review of the Internal Council documents shows that the new policies cover and excess cover are not reflected on the Insurance manual, and the contact’s name is not updated reflecting the newly assigned insurance team leader. There are out-of-date contact names on the internal procedure document. Additionally, publication and future review date is missing whatsoever. [Action Point 1] 6.2.2 Further to our review, there was a mismatch of the excess cover on the Zurich Insurance Certificate of £157,500 to the actual figure of £150,000, on the internal Council systems. [Action Point 2] 6.2.3 Council Strategic Risks are covered and considered, where possible to apply insurance cover, ensuring that management is responsible for insurance as part of Senior Leadership Team/ management budget meetings. As part of reviewing process and overall management understanding, it could be beneficial to have an up-to-date Risk mapping. Furthermore, including insurance as a control within the strategic and operational risk registers would provide clearer assurance on how the Council mitigates the financial impacts of key strategic risks, supporting a more accurate view of overall risk mitigation. As the Council already oversees these risks through existing insurance arrangements, incorporating insurance under the control section of the risk register would strengthen the completeness of the risk assessment documentation. [Action Point 3] 6.2.4 From our review of the insurance documents, we observed that assets are continuously updated throughout the year, where insurance team receives home report valuations from Housing Team, as additional properties come to Council ownership. However, for insurance purposes there is a requirement to have the reinstated value for each property, which is usually higher than the
Page 10
10 home report. Missing that detail of information, may affect the insurance protection and potential dispute on claims. Although, this observation has already been already highlighted from the broker, Gallagher to Council, we have not seen consistent incoming records, ensuring reinstated value for all properties is added from start. [Action Point 4] 6.3 To ensure that the effectiveness and efficiency of the insurance process and that claims processes are dealt with promptly; including Trend analysis, improvement and preventative measures applied, where applicable. 6.3.3 Internal software Figtree is an effective database system used to collect, manage and monitor claims. While all information is up to date, we have noticed that the new change and restructuring of services in the Council in 2024 has not been reflected. (E.g. Education and Children Services is now Education & Learning and Children, Families & Justice), could lead to incorrect future internal service analyses. [Action Point 5] 6.3.4 During the assessment process, we identified that Insurance team, prepares monthly and annual reports on high value claims, including high- cost open unsettled claims, which get submitted to Service Leaders, as well as Council Financial Officer. However, there was no evidence on trend analyses and oversight of how claims evolve over a period. Having a longer period analysis over claims graph-based patterns, values and root cases graphs can provide valuable overview that supports management to take stronger evidence-based decisions, implement actions plans and strengthen financial resilience.
Page 11
11 £0.00 £50,000.00 £100,000.00 £150,000.00 £200,000.00 £250,000.00 0 100 200 300 400 22/23 23/24 24/25 PL & El Trend Analysis 22-25 Council Insurace Financial Years Number of Claims received Number of claims paid 0 10000 20000 30000 40000 22/23 PL & El Settled Claims 0 5000 10000 15000 20000 25000 30000 35000 23/24 PL & El Settled Claims
Page 12
12 Above is a sample of visual graph suggestions, prepared by the auditor, representing the volume of incoming claims (Public and Employers Liability). By having a visual information, we can clearly monitor to number of claims coming to the team over the last 3 years, against the actual settled and closed claims. Although, insurance claims are inherently volatile and often event‑driven, trend analyses remain strategically valuable, providing support for informed governance, financial resilience and risk-based decision. Even where claims volumes can vary from year to year, we can highlight systematic exposure rather than isolated events. [Action Point 6] 6.4 To ensure that there is a sound coordination of services, guaranteeing immediate risk areas are evaluated, covered and minimising the duplication of efforts. 6.4.3 Even though, quarterly meetings take place between teams, there is scope for further improvement. The insurance team still requires access and training to use Housing Asset Management software. Having direct access and knowledge would reduce delays in response, confirm the improvements are made and what actions are currently being taken. [Action Point 7] 7. Conclusion 7.1 The Internal Audit review is able to place Substantial Assurance on the overall control environment for the Insurance arrangements in place. The agreed actions, once implemented, should enable Internal Audit to place Substantial assurance on these. 0 5000 10000 15000 20000 25000 30000 24/25 PL & El Settled Claims
Page 13
13 8. Acknowledgements 8.1 Internal Audit would like to thank all officers who were involved in this audit, particularly officers within the Insurance team in Asset management. 9. Action Implementation & Follow up 9.1 Responsibility for the maintenance of adequate and effective controls rests with management. Where the audit has identified areas for management action, these are identified in the Management Action Plan. Where a decision is taken by management not to act in response to finding from this review, it is the responsibility of management to assess and accept the risk arising from non-implementation. 9.2 Achievement of the agreed actions is monitored through Internal Audit’s ‘follow up’ arrangements.
Page 14
14 10. Management Action Plan Action Point Para. No Finding Risk Rating Agreed Action & Evidence Action Owner Completion Date 1 6.2.1 Although all Insurance policies run continuously, the review of the Internal Council documents shows that the new Policies cover and excess cover are not reflected on the Insurance manual, and the contact’s name is not updated reflecting the newly assigned insurance team leader. There are out-of-date contact names on the internal procedure document. Additionally, publication and future review date is missing whatsoever 1 Agreed action: Update designations and names on Council Insurance Manual Agreed evidence: Updated Insurance Manual G Walker Corporate Asset Management Officer Completed 2 6.2.2 Further to our review, there was a mismatch of the excess cover on the Zurich Insurance Certificate of £157,500 to the actual figure of £150,000, on the internal Council systems. 1 Agreed action: Update Zurich PLC to amend policy certificate accordingly. Agreed evidence: Updated Policy reflecting excess cover D McRobbie Insurance Officer L Hay Insurance Officer Completed.
Page 15
15 3 6.2.3 Furthermore, including insurance as a control within the strategic and operational risk registers would provide clearer assurance on how the Council mitigates the financial impacts of key strategic risks, supporting a more accurate view of overall risk mitigation. As the Council already oversees these risks through existing insurance arrangements, incorporating insurance under the control section of the risk register would strengthen the completeness of the risk assessment documentation. 2 Agreed action: Include Insurance in Internal Controls for Annual Strategic Heatmap Report. Agreed evidence: 1. Meeting Minutes 2. Heatmap Report G Walker Corporate Asset Management Officer Service Managers S Walker Chief Financial Officer December 2026 4 6.2.4 However, for insurance purposes there is a requirement to have the reinstated value for each property, which is usually higher than the home report. Missing that detail of information, may affect the insurance protection and potential dispute on claims. Although, this observation has already been already highlighted from the broker, Gallagher to Council, we have not seen consistent incoming 1 Agreed action: Include reinstated value of properties at the time of purchase. Agreed evidence: Council Insurance team Property sheets completed with reinstated value at time of purchase. Property Services Buyback Team H Hatfield Project Officer Communities N Sworowski Place Strategies Completed
Page 16
16 records, ensuring reinstated value for all properties is added from start. Manager & Chief Planning Officer 5 6.3.3 While all information is up to date, we have noticed that the new change and restructuring of services in the Council in 2024 has not been reflected. (E.g. Education and Children Services is now Education & Learning and Children, Families & Justice), could lead to incorrect future internal service analyses. 1 Agreed action: Populate Figtree software with the up-to-date names of services accordingly. Agreed evidence: Reports, showing current department names D McRobbie Insurance Officer L Hay Insurance Officer G Walker Corporate Asset Management Officer April 2027 6 6.3.4 There was no evidence of trend analyses and oversight of how claims evolve over a period. Having a longer period analysis over claims graph-based patterns, values and root cases graphs can provide valuable overview that supports management to take stronger evidence-based decisions, implement actions plans and strengthen financial resilience. 3 Agreed action: Consider monthly/ annual trend analyses reports submitted to ELT & SLT. Agreed evidence: D McRobbie Insurance Officer L Hay Insurance Officer July 2026
Page 17
17 7 6.4.3 Even though, quarterly meetings take place between teams, there is scope for further improvement. The insurance team still requires access and training to use asset management software. Having direct access and knowledge would reduce delays in response, confirm the improvements are made and what actions are currently being taken. 1 Agreed action: • Training of Housing System (NEC). • Allow Access of Insurance Team for visibility of Property Software. Agreed evidence: • Insurance Team access and knowledge of accessing NEC Housing System. • New member agreed training. A Magee Systems Development Officer September 2026
Page 18
18 11. Authorisation 11.1 The auditor for this assignment was T Philip. The supervising auditor was D Arachchilage. This report is authorised for issue: 12. Distribution 12.1 This report has been distributed to: T Glen, Chief Executive C Mailer, Depute Chief Executive E Ritchie, Strategic Lead – Housing & Communities S Marone, Strategic Lead – Economy, Development & Planning S Walker, Strategic Lead – Finance & Business Support J Beveridge, Strategic Lead – Property Services A O'Brien, Finance Manager/Business Partner G Walker, Corporate Asset Management Officer, Communities - Capital Investment & Asset Management L Hay, Corporate Insurance & Claims Officer D McRobbie, Corporate Insurance & Claims Officer Committee Services External Audit
Page 19
19 13. Assessment Definitions 13.1 The following table contains the definitions of the control objective assessment Control Objective Assessment Level of assurance Definition Substantial Assurance A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. 13.2 The following table contains the definitions applied by Internal Audit in rating audit findings/actions. Risk Rating for Individual Findings Rating Rating description Definition 5 Critical Significant observations/ major concerns which require immediate action. Management will need to add these to the appropriate Service risk register. Issue represents a control weakness which could cause, or is causing, severe disruption of the process or severe adverse effect on the ability to achieve process objectives 4 High Significant observations regarding the absence / failure of key controls requiring urgent action. Management should consider adding these to the appropriate Service/ divisional risk register Issue represents a control weakness which could have, or is having, major adverse effect on the ability to achieve process objectives 3 Medium Observations regarding the effectiveness of key controls requiring reasonably urgent action. Management should consider these when updating any divisional / team risk registers
Page 20
20 Issue represents a control weakness which could have, or is having, significant adverse effect on the ability to achieve process objectives 2 Low Minor observations regarding the adequacy of controls which require action to improve the efficiency, effectiveness, or economy of operations or which otherwise require to be brought to the attention of Senior Management Issue represents a minor control weakness with minimal but reportable impact on the ability to achieve process objectives 1 Trivial / Minor Very minor observations which will be raised during the audit and may not be included within the final report Issue represents a very minor control weakness with negligible impact on the ability to achieve process objectives. The issue will be raised during the audit and may not be included within the final report.