Internal Audit - 25-10 Payroll - Additional Payments
Perth and Kinross Council · 21 September 2026
Back to Audit and Risk Committee — 21 September 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 1 PKC - GENERAL Internal Audit Report Strategic Planning, People and Performance and All Services 25-10 Payroll – Additional Payments July 2026 Final Report (Report No. 26/256) Legal and Governance Perth & Kinross Council Council Offices 2 High Street Perth PH1 5PH
Page 2
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 2 PKC - GENERAL 25-10 Payroll – Additional Payments Contents by Section 1. Introduction 2. Executive Summary 3. Audit Background Information 4. Scope and Limitations 5. Assessment of the Control Environment 6. Summary of Findings 7. Conclusions 8. Acknowledgement 9. Action Implementation & Follow Up 10. Management Action Plan 11. Authorisation 12. Distribution 13. Assessment Definitions
Page 3
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 3 PKC - GENERAL 1. Introduction 1.1 The audit of Payroll was undertaken as part of the Internal Audit Plan for 2025- 26, which was approved by the Audit & Risk Committee on 25 June 2025. The period under review for the purposes of the audit exercise was April 2025 to September 2025 (financial year 2025-26). 1.2 The indicative scope for the audit was to review whether controls are designed appropriately and operating effectively to ensure that additional payments are properly authorised, accurate and compliant. 1.3 The audit included reviewing the processes in place for the planning, recording and authorising of additional payment claims by managers and of the payments made through Payroll. 1.4 The audit is not directly linked to any particular risk on the Strategic Risk Register. 2. Executive Summary 2.1 The audit has found that limited assurance can be placed on the Council’s internal controls in relation to the additional payments. 2.2 There are thirty-three actions arising from the findings documented in Section 10. Once these actions are completed, Internal Audit should be able to place substantial assurance on the arrangements in place. Further four areas for consideration for improvement were highlighted in Section 6 (paragraph 6.6). 2.3 It is noted that, whilst the processing of additional payments is subject to controls within People and Culture, the responsibility for the proper planning, recording and authorising of additional payment claims lies with managers. 3. Audit Background Information 3.1 As per the Perth and Kinross Council’s (PKC’s) Financial Regulations 2024-27, the Corporate Human Resource Manager is responsible for the prompt and accurate payment to employees, and elected members, of additional payments/deductions and other allowances such as the payment of travel, overtime, sickness, maternity, paternity, adoption and other allowances in accordance with statutory and Council policy requirements (the post title for Corporate Human Resource Manager has now changed to People and Culture Manager). 3.2 Strategic Leads are responsible for ensuring the prompt submission of accurate claims for processing, within their area of responsibility, in accordance with statutory requirements and Council policy.
Page 4
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 4 PKC - GENERAL 3.3 The People and Culture Manager ensures that adequate procedures are in place for checking claims for additional payments/deductions and other allowances, to ensure compliance with statutory provisions and Council policy. 3.4 The People and Culture Manager informs Strategic Leads of any change to the approved allowances/deductions, or any other factor that may affect the payment/deductions made. 3.5 The People and Culture Manager issues additional guidance on the submission of payroll input for additional payments/deductions and other allowances, specifying the form of each document, the process required, the timescale to be adhered to, and the required level of authorisation. 3.6 The Working Time Regulations 1998 were introduced into domestic UK legislation on 1 October 1998. The Regulations provide basic entitlements to all workers regarding hours of work, night working, rest breaks, daily and weekly rest and annual leave entitlements. The Regulations have been introduced under Health and Safety and will be monitored and enforced under the relevant employment legislation. 3.7 The standard weekly hours for full-time Single Status employees are 36 hours per week. However, as it is considered essential to maintain the current staffing levels in certain areas to guarantee service delivery, contracted hours for some employees may vary. Starting and finishing times will be directed by Strategic Leads (formerly known as Heads of Service). 3.8 As for Craft employees, they generally work a 37-hour week as outlined in the Local Agreement approved by both the Council and the appropriate Trade Unions. 3.9 As per the PKC’s Overtime, Standby and Callout Policy, “work in excess of the normal hours of duty should be discouraged, and employees should not be required to consistently work overtime”. Where overtime working is unavoidable, payment shall be calculated and paid in accordance with the policy, subject to prior approval by an employee’s line manager who should be an authorised signatory in accordance with the Council’s Financial Regulations. As an alternative to payment, compensatory time off in lieu (TOIL) may be granted. 3.10 In accordance with the Council’s approved Flexi Time Scheme, overtime hours must be recorded separately from flexible working hours. Overtime and flexi time cannot be claimed for the same period. 3.11 Other additional payments include standby, disturbance, sleep in, callout, temporary higher duty payments (THDP), additional responsibility, night and shift working allowances. 4. Scope and Limitations 4.1 The Audit has reviewed whether controls are designed appropriately and operating effectively to ensure that additional payments are properly authorised, accurate and compliant. In addition, we have evaluated how Payroll contributes to the commitment to delivering best value in staff costs.
Page 5
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 5 PKC - GENERAL 4.2 The review consisted of interviews with relevant officers, document reviews and sample walk-through tests of the payment process from start to finish. 4.3 There were no limitations identified that would impact the Audit. However, we did not review additional payments for Teachers. 4.4 The details of the control objectives reviewed and Internal Audit’s assessment of their strength of control in each area is contained within Section 5 of this report. 5. Assessment of the Control Environment 5.1 The table below contains a summary of the number of findings and their ratings, as detailed in Section 12, against each control objective, along with Internal Audit’s assessment of the adequacy and effectiveness of the controls in place to meet each of the objectives agreed for this audit. Further details, including any improvement actions, are set out in the Management Action Plan. No. Control Objective Action Rating Control Objective Assessment 5 4 3 2 1 1 To ensure effectiveness of the arrangements in place to support accurate, timely and appropriately authorised additional payments to General employees (Single Status and Craft). 9 3 5 8 Limited assurance 2 To confirm that additional payments comply with relevant regulations. 1 5 Limited assurance 3 To determine whether Payroll function supports management in achieving best value in terms of staff costs. 1 1 Reasonable assurance 5.2 The auditor has assessed that limited assurance can be placed on controls overall in relation to additional payments from the audit. Meaning: “Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited”. 5.3 A summary of the key findings and actions are provided in section 6, please note however, the following areas of good practice which have been highlighted during the audit: 5.3.1 HR pay policies and supporting guidance on the completion of Single Status claim forms are available online and accessible to relevant staff. 5.3.2 All claims tested were approved by the appropriate signatories in accordance with the Authorised Signatory Database. No instances of approval outside of
Page 6
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 6 PKC - GENERAL the database were identified within the sample tested. Annual reviews of the Authorised Signatory Database are undertaken to ensure that access remains accurate and up to date. 5.3.3 In the cases tested, overtime was evidenced as having been approved before the work was undertaken and appeared to be driven by legitimate operational requirements rather than ad hoc requests. 5.3.4 There is a strong Payroll commitment to ensuring that payments are processed in a timely manner without delays. Payments are consistently made on the final working day of each month, demonstrating Payroll’s adherence to established processing timelines. 5.3.5 The majority of payroll deadlines are communicated to staff through published guidance documents and, where appropriate, through internal news pages on ERIC, and Microsoft Teams channels. This multi-channel approach increases the visibility of key deadlines and encourages the timely submission of claims and supporting payroll-related documentation. 5.3.6 Key officer are professionally qualified and hold membership with the Chartered Institute of Payroll Professionals. They also ensure their knowledge is up to date through subscriptions to HMRC emails and newsletters. 5.3.7 The Payroll function operates a structured monthly payroll control process, which incorporates a range of control activities designed to support the accuracy of payroll outputs. Exception reports are used and may help identify payment amounts exceeding expected thresholds, which could include some instances of overlapping claims. Reconciliation activities are also performed as part of each payroll cycle, including review of HMRC Gateway statements. 5.3.8 The application of pay rates is automated within the system. Access to update pay rates is restricted to authorised staff, with appropriate segregation of duties in place, to prevent a single individual from overriding or manually changing approved pay rates. Validation and checking processes are performed following updates to pay tables, including post-update spot checks, to help ensure accuracy and completeness of changes. 5.3.9 Tax and National Insurance deductions are calculated automatically in line with HMRC requirements through compliant system configuration. Whenever government tax rates or thresholds change, the payroll software is automatically updated to reflect the revised settings. This supports ongoing compliance with statutory requirements and reduces reliance on manual intervention. 5.3.10 At the start of each new financial year, Payroll staff perform gross-to-net pay calculations to validate compliance with HMRC requirements. The test checks are also performed following legislative changes, upgrades impacting statutory tables, and on an ad hoc basis, supporting the retention of manual calculation knowledge within the team. 5.3.11 When a new pay element is created, it is first implemented in the test environment to ensure that relevant statutory deductions are applied correctly before being deployed to the live system.
Page 7
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 7 PKC - GENERAL 5.3.12 Power BI tool has been introduced and is used to provide useful data to support more informed decision-making across different levels of management. Learning sessions have been delivered to help users understand and apply its functionality effectively. The tool continues to be improved, with additional elements being regularly added. A further tool (Power Automate) has been developed, with planned enhancements including additional alerts and data elements. Together, these developments demonstrate an ongoing focus on improving monitoring arrangements and strengthening oversight. 5.3.13 Relevant teams have access to the payroll information needed to perform their roles effectively. This supports transparency and enables informed review and oversight. 5.3.14 Payroll performs monthly escalations in relation to excessive additional payments identified for management attention. It was observed that, in some cases, Payroll also suggests or recommends actions to be taken. This provides additional support to management in addressing payroll-related issues. 5.3.15 Regular reports on overtime expenditure and related trends are provided to Executive Leadership Team, supporting senior-level oversight of workforce costs. 5.3.16 A reduction in employee overtime costs was observed compared with the same period in the prior year. In addition, the rate of growth in agency costs appears to have slowed, indicating that the reduction in overtime has not been matched by a proportionate increase in agency expenditure. 5.3.17 Based on the sample reviewed, the order of overtime allocation indicated that agency staff were used as a last resort. This supports cost control by prioritising internal resources where possible. 5.3.18 Work undertaken by Organisational and Workforce Change Team supports the achievement of better value for money. This includes tailored workforce planning carried and meetings with budget holders to support more efficient allocation of resources. 5.3.19 The Workforce Planning Themed Board and the Framework for Managing Workforce Changes provide structure and oversight for decision-making, implementation activities and coordination across relevant stakeholders. 6. Summary of Findings 6.1 Below is a summary of key findings and actions, which are reflected in the Management Action Plan, detailed in Section 10. It is noted that, whilst the processing of additional payments is subject to controls within People and Culture, the responsibility for the proper planning, recording and authorising of additional payment claims lies with managers.
Page 8
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 8 PKC - GENERAL 6.2 To ensure effectiveness of the arrangements in place to support accurate, timely and appropriately authorised additional payments to General employees (Single Status and Craft): 6.2.1 There is no formally coordinated training for managers on claim authorisation processes or on compliance with pay policies. Guidelines on managerial checks are not a formal part of managers’ induction programmes. The control operates with significant reliance on managers’ understanding of the policies and guidelines and on informal knowledge transfer from colleagues. [Action Point 1] 6.2.2 The majority of additional payment claims are submitted and authorised in paper format outside the payroll system. As a result, authorisations must be verified manually before claims are processed. This approach is time- consuming and increases the risk of fraud or error. Opportunities to introduce a system-based managerial approval workflow and greater automation of the claim process should be further explored to strengthen controls and improve operational efficiency. [Action Point 2] 6.2.3 Current arrangements place significant reliance on managerial review and authorisation. Testing identified instances where timesheets contained inaccuracies and calculation errors that were not identified or corrected during authorisation process. This indicates that the level of verification performed by authorising managers may not always be sufficient to identify errors. Managerial authorisation should therefore include explicit verification of claim accuracy, including calculations, day types, dates, times and reasons.  [Action Point 3] 6.2.4 Not all managers contacted during testing maintained records or supporting documentation that could be used to verify the accuracy of claims. Managers should ensure that they retain sufficient records to support the effective review and authorisation of claims, particularly where claims are authorised in the line manager’s absence. [Action Point 4] 6.2.5 It was observed that required information was not consistently captured in claim forms, despite completeness being a requirement of the guidance (“Date, Day Type, From, Break Taken, To, Hours Claimed, Reason columns must be completed in all cases”). Managerial authorisation should therefore include completeness checks. In addition, one manager was observed to have added missing working pattern details that appeared to be incorrect in a number of instances. Where incomplete information is identified, managers should ensure that any missing details are completed accurately.
Page 9
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 9 PKC - GENERAL [Action Point 5] 6.2.6 Some sampled claim forms were signed and dated by employees at various stages of the claimed period, including before all claimed time had been worked and, in other cases, weeks or months after the work had been completed. Timekeeping practices should be improved to support the timely and accurate recording of time worked. Employees should complete claim forms as work is performed and sign them at the end of the relevant period, rather than in advance or significantly after the event. [Action Point 6] 6.2.7 Older versions of Single Status claim forms (for part-time additional hours, overtime hours and sleep-in payments, as well as for standby and disturbance allowances), which are not aligned with the current forms used in the PKC, were found to be in use by some teams. These forms did not include key fields such as break length, overtime reason, working pattern day types or employee declaration, and some also contained outdated pre-populated pay rates. This creates a risk of inaccurate or inconsistent claim completion and may result in incorrect payments. [Action Point 7] 6.2.8 Where claim forms are pre-completed, there is an increased risk that outdated or inaccurate information may be carried forward into claims, potentially affecting the accuracy of payment processing. [Action Point 8] 6.2.9 We identified some inconsistencies in the forms used for the same type of payment, including across comparable roles within the same service area. This increases the risk that required information may not be captured consistently. Managers should ensure that employees are aware which claim form to use for each type of payment. [Action Point 9] 6.2.10 Despite the guidance explaining which post title should be entered in the relevant field of the claim form, this requirement still appears to be either misunderstood or misinterpreted by employees and managers. For example, during the sample testing we identified an instance where employee, on a number of occasions across several pay periods, recorded their substantive post on the claim forms, rather than the lower-graded post being covered. As a result, for few months overtime was paid at a higher rate than
Page 10
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 10 PKC - GENERAL appropriate, despite the claim reasons indicating that the work was related to covering a vacancy and a sickness for a different post. According to Payroll, employees should be paid based on the post being covered rather than their substantive post. Payments are processed based on the post title recorded on the claim form and authorised by the manager, rather than on the analysis of the reason for the additional work. This highlights a weakness in overtime approval controls and increases the risk of payments being processed at an incorrect rate. Managers should ensure that the post title recorded on the claim form reflects the duties undertaken, rather than the employee’s substantive role. It should be considered whether claim forms could be amended to distinguish between an employee’s substantive post and the post for which the claim is submitted. Separate fields for each would help to reduce the risk of claims being processed at an incorrect rate. [Action Point 10] 6.2.11 Payroll staff do not routinely validate claim form inputs, including calculations, eligibility or alignment with supporting timekeeping records such as rotas. System validation is limited to confirming that employee and post numbers exist and does not verify that they relate to the correct employee. Manual validation is also limited and generally focuses on contracted hours and post details. As a result, significant reliance is placed on managerial approval, except where issues are sufficiently obvious to be identified during payroll processing. This control weakness increases the risk of error, fraud and incorrect payments. [Action Point 11] 6.2.12 Overtime rates depend on employees’ work patterns and day types, however, these are not routinely validated during payroll processing due to the time required to complete them, including where day type information is missing from claim forms. While working pattern information is available within the payroll system, it does not clearly distinguish between non-working and rest days. As a result, where day type information is unavailable on the claim forms or cannot be readily verified, Payroll staff default to applying straight time for initial overtime hours. This increases the risk of incorrect pay elements, overtime rates and multipliers being applied, potentially resulting in underpayments. [Action Point 12] 6.2.13 Pay elements are allocated manually by payroll staff before being entered into the payroll system. Testing identified occasional instances where inappropriate
Page 11
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 11 PKC - GENERAL pay elements or incorrect unit quantities were applied, resulting in payment errors. Reliance on manual allocation increases the risk of mistakes. Opportunities to automate the allocation of pay elements should be explored to reduce reliance on manual intervention and improve the accuracy and consistency of payroll processing. [Action Point 13] 6.2.14 While monthly payroll submission deadlines are in place for Single Status employees, there is no formally defined time limit for the submission of claim forms relating to previous periods. As a result, claims may be submitted several months after the work was performed, increasing the risk of delayed processing and inaccuracies where claim details are completed or approved after the event. The absence of a formal cut-off date also reduces visibility of outstanding historical claims and assurance that all claims relating to a period have been identified and processed. Late submissions may affect the accuracy of budget monitoring and alter the payroll period in which pensionable pay and National Insurance contributions are calculated. Consideration should be given to introducing a formal cut-off date for retrospective claims and strengthening proactive follow-up by managers, including timely enquiries where claim forms are not submitted within expected timeframes. [Action Point 14] 6.2.15 No formal claim submission deadlines have been established for Craft employees. This results in inconsistent submission practices and reduces assurance that claims are submitted in a timely manner. In the absence of defined deadlines, delayed submissions may not be identified and followed up promptly by managers. [Action Point 15] 6.2.16 Manual and system-based (MyView) claims are processed through separate arrangements and are not routinely reconciled against one another. Payroll does not routinely perform checks to identify overlapping or incompatible claims across different sources, including manual claim forms, system-generated claims and flexi time records (Optimum). Employees may submit additional payment claims that overlap with other recorded absences (for example, annual leave or sick leave), payments, flexi time records or standby commitments, contrary to the requirements of the Overtime, Standby and Callout and the Flexi Scheme policies, which outline
Page 12
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 12 PKC - GENERAL that overtime and flexitime cannot be claimed for the same period. This increases the risk of duplicate or incompatible claims being processed and paid. While managerial authorisation and exception reporting provide key level of control, these arrangements may not identify all conflicts between claims, particularly where managers oversee large teams or do not maintain supporting records to validate claims. Managers should ensure that claims do not conflict with each other prior to authorising them. Consideration should be given to introducing automated validation or reconciliation controls to identify overlapping claims and reduce reliance on manual checks where applicable. [Action Point 16] 6.2.17 We identified that there are no automated controls in place to prevent employees from exceeding the maximum permitted flexi time debit balance or taking more flexi leave than allowed under the Flexi Scheme Policy. The system also permits flexi leave to be booked where an employee has already exceeded the permitted debit balance. Responsibility for monitoring compliance with the Flexi Scheme Policy rests with managers. Although managers have access to employees’ flexi time balances, there are currently no alerts or exception reports to proactively notify them of potential breaches or excessive debit balances, as was previously the case. As a result, identification of non-compliance with the policy requirements relies on managers carrying out regular manual reviews and may not occur in a timely manner. In addition, the system automatically deducts thirty minutes where lunch breaks are not recorded. While this provides a default control, it may not always reflect actual break durations and could affect the accuracy of flexi time balances. Collectively, these control weaknesses increase the risk of inaccurate flexi time records, excessive debit balances and unauthorised flexi leave. They may also result in financial loss to the PKC, particularly where employees with significant debit balances terminate their employment and Payroll is required to recover the overpaid amount, which may not always be fully recoverable. [Action Point 17] 6.3 To confirm that additional payments comply with relevant regulations: 6.3.1 No formal schedule is in place for the periodic review of policies and guidance. As a result, number of documents have not been reviewed for over five years (the Flexi Scheme Policy was last revised in February 2019; Time Off for
Page 13
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 13 PKC - GENERAL Medical Appointments Policy in December 2018; Guidance on Personal Breaks in December 2018). This increases the risk that policies and guidance become outdated and that employees and managers may rely on inaccurate or obsolete information. For example, the Flexi Scheme Policy continues to reference the use of flexi cards and flexi machines for clocking in and out, despite these arrangements no longer being in use. [Action Point 18] 6.3.2 Pay guidelines are not consistently updated following annual changes to pay and related arrangements. Some reference links within the guidelines have not been maintained and are no longer functional, including links to the Scheduled Pay Periods document. Examples were identified within the Which Timesheet Guidance, the Guide for Completion of Payment Claim Single Status and the Payroll FAQ document (last reviewed in July 2022). In addition, two guidance documents reviewed (the Guide for Completion of Payment Claim Form Single Status and the Guide for Completion of Casual Worker Claim Form SS) continue to refer to superseded service names: ESC and CDS. This may reduce the effectiveness of the guidance, limit access to supporting information and undermine confidence that users are referring to accurate and up-to-date information, even where the refenced document remains available elsewhere on ERIC. [Action Point 19] 6.3.3 Policy and guidance reviews do not consistently identify all content requiring amendment or removal. As a result, outdated information may remain within published documentation despite reviews having been undertaken. For example, although the Overtime, Standby and Callout Policy was reviewed on several occasions following changes to the vehicle workshop employees’ terms and conditions (arising from the transition from Craft to Single Status), it was not fully updated to reflect those changes. In particular, the Craft Local Agreement 2011 (Vehicle Workshop) that had been discontinued in 2022 continued to be referenced within the policy until December 2025. Furthermore, the same obsolete agreement remained published within the Pay Policies section of the PKC’s website until that date and continues to be available within the Craft Employees section. This increases the risk of employees relying on superseded documentation and may create confusion regarding current terms, conditions and related arrangements.
Page 14
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 14 PKC - GENERAL [Action Point 20] 6.3.4 During interviews and testing, we were unable to identify a designated officer or team with overall responsibility for monitoring compliance with the Working Time Regulations and overseeing related activities. As a result, there appeared to be limited central oversight of working hours, opt-out agreements and associated regulatory requirements. No opt-out agreements were identified within the Resourcelink records reviewed during testing. This included an employee whose average working hours over a seventeen-week period were 61 hours per week. Under the Working Time Regulations, a documented opt-out agreement should be in place where working patterns have the potential to exceed an average of 48 hours per week over the relevant reference period (seventeen weeks). Evidence of such an arrangement was not available within the record examined. However, we acknowledge that, subsequently to the audit testing period, steps were taken by People and Culture Team to strengthen the controls. In April 2026, an online opt-out form was introduced, and communication was issued to employees regarding completion and renewal requirements. Managers were also separately reminded of their responsibilities. We further noted that MyView reminders are now expected to support annual renewal of opt-out forms and that working patterns will be reviewed where an employee without an opt-out agreement is identified as exceeding the 48-hour average limit. In addition, we were advised that the updated arrangements include a dedicated reporting solution to proactively identify such employees. [Action Point 21] 6.3.5 Payroll reconciliations are performed as part of each pay cycle and include consistency checks between payroll reports, review of HMRC Gateway statements, confirmation of payments made, and spot checks of PAYE and National Insurance values reported through Full Payment Submission (FPS) and Employer Payment Summary (EPS) submissions. However, while individual review activities are performed, there is no routine documented end-to-end numerical reconciliation of the total PAYE and National Insurance amounts across all sources - payroll reports, FPS and EPS submissions (as applicable), HMRC statements and payments made to HMRC. In our inquiry, we were advised that review of HMRC statements is considered sufficient to identify any outstanding amounts or discrepancies and that any variances arising would be captured through existing processes, for example, through the HMRC Annual Return spreadsheet. However, assurance over the completeness and accuracy of reported amounts relies on a combination of
Page 15
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 15 PKC - GENERAL separate review activities, rather than a single documented reconciliation across all key stages of the payroll reporting and payment process. The control framework could be strengthened by introducing a documented monthly end-to-end numerical reconciliation of the total PAYE and National Insurance amounts across these sources, with any variances identified, investigated, documented and resolved. This would provide clear evidence that reported amounts are complete, accurate and consistent. [Action Point 22] 6.3.6 An overpayment recovery process is in place, and a draft policy has been developed to formalise the process. However, as the policy has not yet been approved, there is a risk that the process may not be applied consistently. [Action Point 23] 6.4 To determine whether Payroll function supports management in achieving best value in terms of staff costs: 6.4.1 In certain services, there appears to be a continued reliance on overtime to support routine operations. This is inconsistent with the Overtime, Standby and Callout Policy, which states that employees should not be required to consistently work overtime. The pattern of overtime usage suggests that it is being used to address workforce resourcing pressures. Audit testing identified examples where overtime was used over extended periods to maintain service delivery while vacancies remained unfilled for prolonged periods, indicating resourcing pressures in certain areas. Consideration should be given to identifying further opportunities to reduce reliance on overtime in areas where it is routinely used to support service delivery, including through measures aimed at reducing the duration of vacancies where appropriate. [Action Point 24] 6.5 Please note that there are nine other minor actions for the improvement in the control environment which are included within the management action plan. [Action Points 25-33] 6.6 In addition, the following improvement opportunities have been identified for consideration to further support the achievement of best value in terms of staff costs: 6.6.1 We have noted instances where overtime claims submitted by employees participating in the Flexi Scheme related to work carried out during the
Page 16
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 16 PKC - GENERAL qualifying flexi time band (typically, between 17:00 and 21:00, and between 07:00 and 08:45). While this is not inconsistent with the council’s policies, providing managers with guidance to consistently consider available flexi time arrangements, where operationally appropriate, before approving additional payments for hours worked within the qualifying flexi time band, may support consistent decision-making and help achieve best value in relation to staff costs. Wider promotion of TOIL arrangements, where appropriate, may also support better value for money by reducing reliance on additional payments. 6.6.2 Periodic communication and reminders may help improve managers’ awareness of Power BI functionality and encourage its regular use. As the tool supports the monitoring of staff costs, including overtime, its greater utilisation may contribute to achieving best value in relation to staff costs. 6.6.3 Consideration could be given to further developing Power BI to include benchmarking functionality, enabling budget holders to compare overtime levels with comparable services or teams. In addition, enhancing Power BI interface to provide the Organisational and Workforce Change team with a council-wide view of data may improve oversight and reduce the need to review individual teams separately. 6.6.4 Managers may wish to maintain records of overtime decisions, including the rationale for approval and allocation order. This would provide evidence of prior authorisation, support transparency in decision-making, and help evidence that overtime decisions were made with due regard to achieving best value in staff costs. 7. Conclusion 7.1 The Internal Audit review is able to place limited assurance on the overall control environment for the additional payments. The agreed actions, once implemented, should enable Internal Audit to place substantial assurance on these. 8. Acknowledgements 8.1 Internal Audit would like to thank all officers who were involved in this audit, particularly: L Byrne, HR Team Leader – Payroll and Reward A Craik, MyView and People Analytics Team Leader R Cassels, HR Officer - Payroll G McCaw, Organisational and Workforce Change Team Leader
Page 17
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 17 PKC - GENERAL E Bayne, Employee Relations and Wellbeing Team Leader M Fyfe-Loudon, Senior HR Assistant – MyView and People Analytics Team J Newman, HR Payroll Assistant A Craig, Financial Systems Team Leader. 9. Action Implementation & Follow up 9.1 Responsibility for the maintenance of adequate and effective controls rests with management. Where the audit has identified areas for management action, these are identified in the Management Action Plan. Where a decision is taken by management not to act in response to finding from this review, it is the responsibility of management to assess and accept the risk arising from non- implementation. 9.2 Achievement of the agreed actions is monitored through Internal Audit’s ‘follow up’ arrangements.
Page 18
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 18 PKC - GENERAL 10. Management Action Plan Action Point Para. No Finding Risk Rating Agreed Action & Evidence Action Owner Target Completion Date 1 6.2.1 There is no formally coordinated training for managers on claim authorisation processes or on compliance with pay policies. Guidelines on managerial checks are not a formal part of managers’ induction programmes. The control operates with significant reliance on managers’ understanding of the policies and guidelines and on informal knowledge transfer from colleagues. 2 - Low Agreed action: Cross-team action involving: Organisational Development team - incorporate requirements into manager induction. Policy team - provide input for the training video to ensure overtime policy is adequately covered. Payroll team - provide input on claim processes, completion requirements and common errors. Agreed evidence: Manager learning materials published and incorporated into manager induction programme. C Judge, Organisational Development Team Leader Dec 2026 2 6.2.2 The majority of additional payment claims are submitted and authorised in paper format 4 - High Agreed action: Explore the feasibility of automating Single Status claim submission and approval A Craik, MyView and People Analytics Team Leader Jun 2027
Page 19
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 19 PKC - GENERAL outside the payroll system. As a result, authorisations must be verified manually before claims are processed. This approach is time-consuming and increases the risk of fraud or error. Opportunities to introduce a system-based managerial approval workflow and greater automation of the claim process should be further explored to strengthen controls and improve operational efficiency. through the MyView Irregular Claims Module to reduce reliance on manual verification of authorised signatories against the Authorised Signatory Database (ASD). Agreed evidence: Evidence of engagement with Zellis regarding MyView Irregular Claims functionality and a documented specification to handle self-service claims within the General Payroll. L Byrne, HR Team Leader – Payroll and Reward 3 6.2.3 Current arrangements place significant reliance on managerial review and authorisation. Testing identified instances where timesheets contained inaccuracies and calculation errors that were not identified or corrected during authorisation process. This indicates that the level of verification performed by authorising managers may not 4 - High Agreed action: Develop and publish a Manager Authorisation Checklist and support guidance for overtime/additional payments. The guidance will set out the checks expected before authorising claims. Agreed evidence: Published Manager Authorisation Checklist and supporting guidance available L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 20
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 20 PKC - GENERAL always be sufficient to identify errors. Managerial authorisation should therefore include explicit verification of claim accuracy, including calculations, day types, dates, times and reasons. on Eric and communicated to managers. 4 6.2.4 Not all managers contacted during testing maintained records or supporting documentation that could be used to verify the accuracy of claims. Managers should ensure that they retain sufficient records to support the effective review and authorisation of claims, particularly where claims are authorised in the line manager’s absence. 4 - High Agreed action: Record retention requirements for authorising managers will be incorporated within the checklist and guidance under Action 3. Agreed evidence: Evidence as detailed under Action Point 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 5 6.2.5 It was observed that required information was not consistently captured in claim forms, despite completeness 3 - Medium Agreed action: Requirement for managers to verify that claim forms are complete and accurately L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 21
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 21 PKC - GENERAL being a requirement of the guidance (“Date, Day Type, From, Break Taken, To, Hours Claimed, Reason columns must be completed in all cases”). Managerial authorisation should therefore include completeness checks. In addition, one manager was observed to have added missing working pattern details that appeared to be incorrect in a number of instances. Where incomplete information is identified, managers should ensure that any missing details are completed accurately. completed before authorisation will be included in the guidance. Agreed evidence: Evidence as detailed under Action Point 3 – published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. 6 6.2.6 Some sampled claim forms were signed and dated by employees at various stages of the claimed period, including before all claimed time had been worked and, in other cases, weeks or months after the work had been completed. 3 - Medium Agreed action: The Manager Authorisation Checklist and supporting guidance developed under Action 3 will reinforce expectations regarding the timely completion, submission and authorisation of claims. Agreed evidence: L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 22
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 22 PKC - GENERAL Timekeeping practices should be improved to support the timely and accurate recording of time worked. Employees should complete claim forms as work is performed and sign them at the end of the relevant period, rather than in advance or significantly after the event. Evidence as detailed under Action Point 3 – published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. 7 6.2.7 Older versions of Single Status claim forms (for part-time additional hours, overtime hours and sleep-in payments, as well as for standby and disturbance allowances), which are not aligned with the current forms used in the PKC, were found to be in use by some teams. These forms did not include key fields such as break length, overtime reason, working pattern day types or employee declaration, and some also contained outdated pre-populated pay rates. 3 - Medium Agreed action: The issue raised in this finding has now been partially addressed through the introduction of updated Payment Claim Form for the teams referred above (covering part-time hours, overtime hours and sleep-in payments). However, the action remains partially complete, as the effectiveness of the revised forms depends on employees consistently using the current approved versions rather than any previous forms. Payroll will email the relevant service confirming the requirement to use only current approved version of the forms. L Byrne, HR Team Leader – Payroll and Reward Sep 2026
Page 23
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 23 PKC - GENERAL This creates a risk of inaccurate or inconsistent claim completion and may result in incorrect payments. Where outdated forms are identified during payroll processing, these will be returned for resubmission using the current approved version. Agreed evidence: Payroll will retain copy of the email to the relevant service confirming the requirement to use the current approved published form. 8 6.2.8 Where claim forms are pre- completed, there is an increased risk that outdated or inaccurate information may be carried forward into claims, potentially affecting the accuracy of payment processing. 2 - Low Agreed action: The Manager Authorisation Checklist and supporting guidance developed under Action 3 will remind managers to verify the accuracy and relevance of any pre-populated information prior to authorisation. Agreed evidence: Evidence as detailed under Action Point 3 – published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 24
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 24 PKC - GENERAL 9 6.2.9 We identified some inconsistencies in the forms used for the same type of payment, including across comparable roles within the same service area. This increases the risk that required information may not be captured consistently. Managers should ensure that employees are aware which claim form to use for each type of payment. 2 - Low Agreed action: Payroll will review and rationalise guidance relating to additional payment claim forms and will communicate the approved forms to be used for each claim type. The Manager Authorisation Guidance developed under Action 3 will also reinforce managers' responsibilities for ensuring the correct claim form is used prior to authorisation. Where non- approved forms are received, they will be returned for resubmission using the appropriate approved form. Agreed evidence: Updated payroll guidance and communication issued to managers and employees confirming the approved claim forms for each payment type. Evidence of the Manager Authorisation Guidance published under Action 3. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 10 6.2.10 Despite the guidance explaining which post title should be entered in the 4 - High Agreed action: The overtime claim form and guidance will be updated to clarify that where additional L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 25
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 25 PKC - GENERAL relevant field of the claim form, this requirement still appears to be either misunderstood or misinterpreted by employees and managers. According to Payroll, employees should be paid based on the post being covered, rather than their substantive post. Payments are processed based on the post title recorded on the claim form and authorised by the manager, rather than on the analysis of the reason for the additional work. This highlights a weakness in overtime approval controls and increases the risk of payments being processed at an incorrect rate. Managers should ensure that the post title recorded on the claim form reflects the duties work is undertaken outside an employee's substantive post, the appropriate claim process must be used. Guidance will be provided to managers and employees to support correct completion and authorisation of claims. This requirement will also be incorporated into the Manager Authorisation Guidance developed under Action 3. Agreed evidence: Updated overtime claim form, supporting guidance and Manager Authorisation Guidance issued to managers.
Page 26
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 26 PKC - GENERAL undertaken, rather than the employee’s substantive role. It should be considered whether claim forms could be amended to distinguish between an employee’s substantive post and the post for which the claim is submitted. Separate fields for each would help to reduce the risk of claims being processed at an incorrect rate. 11 6.2.11 Payroll staff do not routinely validate claim form inputs, including calculations, eligibility or alignment with supporting timekeeping records such as rotas. System validation is limited to confirming that employee and post numbers exist and does not verify that they relate to the correct employee. Manual validation is also limited and generally focuses on contracted hours and post details. 4 - High Agreed action: The Manager Authorisation Checklist and supporting guidance developed under Action 3 will clarify managers' responsibilities for verifying claim accuracy, eligibility and supporting information before authorisation. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 27
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 27 PKC - GENERAL As a result, the reliance is placed on managerial approval, except where issues are sufficiently obvious to be identified during payroll processing. This control weakness increases the risk of error, fraud and incorrect payments. 12 6.2.12 Overtime rates depend on employees’ work patterns and day types, however, these are not routinely validated during payroll processing due to the time required to complete them, including where day type information is missing from claim forms. While working pattern information is available within the payroll system, it does not clearly distinguish between non-working and rest days. As a result, where day type information is unavailable on the claim forms or cannot be 4 - High Agreed action: The Manager checklist and guidance will incorporate that day types must be detailed on the claim form. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 28
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 28 PKC - GENERAL readily verified, Payroll staff default to applying straight time for initial overtime hours. This increases the risk of incorrect pay elements, overtime rates and multipliers being applied, potentially resulting in underpayments. 13 6.2.13 Pay elements are allocated manually by Payroll staff before being entered into the payroll system. Testing identified occasional instances where inappropriate pay elements or incorrect unit quantities were applied, resulting in payment errors. Reliance on manual allocation increases the risk of mistakes. Opportunities to automate the allocation of pay elements should be explored to reduce reliance on manual intervention and improve the accuracy and 4 - High Agreed action: Payroll will strengthen quality assurance arrangements by introducing periodic spot checks across the end-to-end process to verify that: • claims have been prepared correctly; • information has been accurately transferred to payroll upload documentation; • the correct pay elements and values have been uploaded; and • payments have been processed correctly through to employee payslips. L Byrne, HR Team Leader – Payroll and Reward Mar 2027
Page 29
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 29 PKC - GENERAL consistency of payroll processing. Whilst opportunities for automation will continue to be explored, the complexity of the current overtime and additional payments framework means that full automation is not currently feasible. Payroll will therefore continue to strengthen validation and assurance checks to mitigate the risk of processing or upload- related errors and will consider further improvements as part of future payroll system developments and any wider review of overtime arrangements. Agreed evidence A documented programme of payroll spot checks covering authorised claim forms, payroll upload documentation, payroll system records and employee payslips. Records of spot checks undertaken, findings identified, corrective action taken and lessons learned communicated to the payroll team.
Page 30
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 30 PKC - GENERAL 14 6.2.14 While monthly payroll submission deadlines are in place for Single Status employees, there is no formally defined time limit for the submission of claim forms relating to previous periods. As a result, claims may be submitted several months after the work was performed, increasing the risk of delayed processing and inaccuracies where claim details are completed or approved after the event. The absence of a formal cut-off date also reduces visibility of outstanding historical claims and assurance that all claims relating to a period have been identified and processed. Late submissions may affect the accuracy of budget monitoring and alter the payroll period in which pensionable pay and 2 - Low Agreed action: Will reflect a 3-month cut-off date within the Manager’s guidance and on claim forms. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 31
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 31 PKC - GENERAL National Insurance contributions are calculated. Consideration should be given to introducing a formal cut-off date for retrospective claims and strengthening proactive follow-up by managers, including timely enquiries where claim forms are not submitted within expected timeframes. 15 6.2.15 No formal claim submission deadlines have been established for Craft employees. This results in inconsistent submission practices and reduces assurance that claims are submitted in a timely manner. In the absence of defined deadlines, delayed submissions may not be identified and followed up promptly by managers. 2 - Low Agreed action: A formal submission deadline document will be created for Craft employees. Agreed evidence: Updated submission deadlines on Eric. L Byrne, HR Team Leader – Payroll and Reward Completed
Page 32
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 32 PKC - GENERAL 16 6.2.16 Manual and system-based (MyView) claims are processed through separate arrangements and are not routinely reconciled against one another. Payroll does not routinely perform checks to identify overlapping or incompatible claims across different sources, including manual claim forms, system- generated claims and flexi time records (Optimum). Employees may submit additional payment claims that overlap with other recorded absences (for example, annual leave or sick leave), payments, flexi time records or standby commitments, contrary to the requirements of the Overtime, Standby and Callout and the Flexi Scheme policies, which outline that overtime and flexitime cannot be claimed for the same period. This increases the risk of duplicate 4 - High Agreed action: The Manager Authorisation Checklist and supporting guidance developed under Action 3 will include guidance on verifying that claims do not conflict with annual leave, sickness absence, flexi arrangements, standby commitments or other working arrangements. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 33
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 33 PKC - GENERAL or incompatible claims being processed and paid. While managerial authorisation and exception reporting provide key level of control, these arrangements may not identify all conflicts between claims, particularly where managers oversee large teams or do not maintain supporting records to validate claims. Managers should ensure that claims do not conflict with each other prior to authorising them. Consideration should be given to introducing automated validation or reconciliation controls to identify overlapping claims and reduce reliance on manual checks where applicable. 17 6.2.17 We identified that there are no automated controls in place to prevent employees from exceeding the maximum 4 - High Agreed action: Reinforce flexi time rules to managers, as responsibility for spot checking flexi balances lies A Craik, MyView and People Analytics Team Leader Mar 2027
Page 34
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 34 PKC - GENERAL permitted flexi time debit balance or taking more flexi leave than allowed under the Flexi Scheme Policy. The system also permits flexi leave to be booked where an employee has already exceeded the permitted debit balance. Responsibility for monitoring compliance with the Flexi Scheme Policy rests with managers. Although managers have access to employees’ flexi time balances, there are currently no alerts or exception reports to proactively notify them of potential breaches or excessive debit balances, as was previously the case. As a result, identification of non- compliance with the policy requirements relies on managers carrying out regular manual reviews and may not occur in a timely manner. with them, through guidance and communications. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers.
Page 35
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 35 PKC - GENERAL In addition, the system automatically deducts thirty minutes where lunch breaks are not recorded. While this provides a default control, it may not always reflect actual break durations and could affect the accuracy of flexi time balances. Collectively, these control weaknesses increase the risk of inaccurate flexi time records, excessive debit balances and unauthorised flexi leave. They may also result in financial loss to the PKC, particularly where employees with significant debit balances terminate their employment and Payroll is required to recover the overpaid amount, which may not always be fully recoverable. 18 6.3.1 No formal schedule is in place for the periodic review of policies and guidance. As a result, number of documents 2 - Low Agreed action: An HR Policy Register is already in place; however, the process will be strengthened and formalised to ensure S Lawson, Employment Equality and Policy Team Leader Mar 2027
Page 36
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 36 PKC - GENERAL have not been reviewed for over five years. This increases the risk that policies and guidance become outdated and that employees and managers may rely on inaccurate or obsolete information. policies and supporting guidance are subject to regular review and monitoring. Policy review status will be monitored through the People & Culture Team Leaders' meetings as a standing agenda item. Agreed evidence: Updated HR Policy Register. 19 6.3.2 Pay guidelines are not consistently updated following annual changes to pay and related arrangements. Some reference links within the guidelines have not been maintained and are no longer functional, including links to the Scheduled Pay Periods document. In addition, two guidance documents reviewed continue to refer to superseded service names: ESC and CDS. This may reduce the effectiveness of the guidance, limit access to supporting information and undermine 2 - Low Agreed action: A review will be undertaken of the Overtime, Standby and Callout Policy, Payroll FAQ and associated payroll guidance documents to remove outdated references, correct broken links and ensure links are made to centrally maintained documents where appropriate. This will reduce the need for multiple documents to be updated following routine pay changes. Agreed evidence: Evidence of review including correction of broken or outdated links. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 37
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 37 PKC - GENERAL confidence that users are referring to accurate and up-to- date information, even where the refenced document remains available elsewhere on ERIC. 20 6.3.3 Policy and guidance reviews do not consistently identify all content requiring amendment or removal. As a result, outdated information may remain within published documentation despite reviews having been undertaken. This increases the risk of employees relying on superseded documentation and may create confusion regarding current terms, conditions and related arrangements. 2 - Low Agreed action: Strengthen review checks. Agreed evidence: Removal of obsolete references and superseded documents. S Lawson, Employment Equality and Policy Team Leader Dec 2026 21 6.3.4 During interviews and testing, we were unable to identify a designated officer or team with overall responsibility for monitoring compliance with the Working Time Regulations and overseeing related activities. As 4 - High Agreed action: Subsequent to the audit testing period, a number of controls have been introduced to strengthen compliance with the Working Time Regulations. These include an online opt-out process, annual renewal L Byrne, HR Team Leader – Payroll and Reward Mar 2027
Page 38
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 38 PKC - GENERAL a result, there appeared to be limited central oversight of working hours, opt-out agreements and associated regulatory requirements. No opt-out agreements were identified within the Resourcelink records reviewed during testing. This included an employee whose average working hours over a seventeen-week period were 61 hours per week. Under the Working Time Regulations, a documented opt-out agreement should be in place where working patterns have the potential to exceed an average of 48 hours per week over the relevant reference period (seventeen weeks). Evidence of such an arrangement was not available within the record examined. However, we acknowledge that, subsequently to the audit reminders via MyView, manager communications clarifying responsibilities for monitoring working hours, and development of a reporting mechanism to identify employees whose average working hours exceed the 48- hour limit over the 17-week reference period. The Working Time Regulations monitoring process will be documented to formalise ownership, reporting arrangements and follow-up activity where potential non- compliance is identified. Agreed evidence: Copy of Manager communication issued regarding Working Time Regulations responsibilities. Email triggers for annual renewal. Working hours monitoring report has been developed covering the 17-week reference period. Evidence of its ongoing use.
Page 39
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 39 PKC - GENERAL testing period, steps were taken by People and Culture Team to strengthen the controls. In April 2026, an online opt-out form was introduced, and communication was issued to employees regarding completion and renewal requirements. Managers were also separately reminded of their responsibilities. We further noted that MyView reminders are now expected to support annual renewal of opt- out forms and that working patterns will be reviewed where an employee without an opt-out agreement is identified as exceeding the 48-hour average limit. In addition, we were advised that the updated arrangements include a dedicated reporting solution to proactively identify such employees. The Working Time Regulations monitoring process documented.
Page 40
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 40 PKC - GENERAL 22 6.3.5 Payroll reconciliations are performed as part of each pay cycle and include consistency checks between payroll reports, review of HMRC Gateway statements, confirmation of payments made, and spot checks of PAYE and National Insurance values reported through Full Payment Submission (FPS) and Employer Payment Summary (EPS) submissions. However, while individual review activities are performed, there is no routine documented end-to-end numerical reconciliation of the total PAYE and National Insurance amounts across all sources - payroll reports, FPS and EPS submissions (as applicable), HMRC statements and payments made to HMRC. In our inquiry, we were advised that review of HMRC 2 - Low Agreed action: Develop and implement a documented monthly PAYE and National Insurance reconciliation process to reconcile payroll reports, FPS/EPS submissions, HMRC Gateway statements and payments made to HMRC. Any variances identified will be investigated, documented and resolved as part of the reconciliation process. Agreed evidence: Completed monthly PAYE and National Insurance reconciliation records, including evidence of review, investigation of variances (where applicable) and sign-off. A Craik, MyView and People Analytics Team Leader Mar 2027
Page 41
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 41 PKC - GENERAL statements is considered sufficient to identify any outstanding amounts or discrepancies and that any variances arising would be captured through existing processes, for example, through the HMRC Annual Return spreadsheet. However, assurance over the completeness and accuracy of reported amounts relies on a combination of separate review activities, rather than a single documented reconciliation across all key stages of the payroll reporting and payment process. The control framework could be strengthened by introducing a documented monthly end-to- end numerical reconciliation of the total PAYE and National Insurance amounts across these sources, with any variances identified, investigated, documented and
Page 42
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 42 PKC - GENERAL resolved. This would provide clear evidence that reported amounts are complete, accurate and consistent. 23 6.3.6 An overpayment recovery process is in place, and a draft policy has been developed to formalise the process. However, as the policy has not yet been approved, there is a risk that the process may not be applied consistently. 2 - Low Agreed action: Finalise and approve the Overpayment Recovery Policy to formally document existing overpayment recovery arrangements, responsibilities and controls. Agreed evidence: Publication of approved Overpayment Policy. L Byrne, HR Team Leader – Payroll and Reward Mar 2027 24 6.4.1 In certain services, there appears to be a continued reliance on overtime to support routine operations. This is inconsistent with the Overtime, Standby and Callout Policy, which states that employees should not be required to consistently work overtime. The pattern of overtime usage suggests that it is being used to address workforce resourcing pressures. Audit testing 3 - Medium Agreed action one: Improve access to overtime data and budget ownership information. Explored with Payroll how the Organisation and Workforce Change Team can directly access additional payment information and supporting documentation to identify budget holders and service areas, recognising that overtime costs are not always G McCaw, Organisational and Workforce Change Team Leader Completed
Page 43
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 43 PKC - GENERAL identified examples where overtime was used over extended periods to maintain service delivery while vacancies remained unfilled for prolonged periods, indicating resourcing pressures in certain areas. Consideration should be given to identifying further opportunities to reduce reliance on overtime in areas where it is routinely used to support service delivery, including through measures aimed at reducing the duration of vacancies where appropriate. incurred within an employee's substantive service. Agreed evidence one: Payroll Team Leader will provide links to appropriate payroll source folders by 07/08/2026. Agreed action two: Develop enhanced corporate reporting on additional payments. Systems Team are developing a Power BI report which will provide a consolidated view of both overtime and casual hours, improving transparency and supporting management oversight. Agreed evidence two: Demonstration and implementation of Power BI reporting solution to highlight total additional hours. Agreed action three: Consider development of a G McCaw, Organisational and Workforce Change Team Leader G McCaw, Dec 2026 Dec 2026
Page 44
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 44 PKC - GENERAL forum to discuss supplementary hours. We will consider developing a forum to discuss supplementary hours if there is a sensible alignment across services. Agreed evidence three: Evidence of overtime and supplementary hours being reviewed through operational workforce discussions at the new dedicated forum (or of consideration of its development). Agreed action four: Introduce monthly reviews of longer-term solutions to reduction of overtime/supplementary hours. The Health and Social Care Workforce Planning Manager, Service Manager Brian Kinnear and Organisational and Workforce Change Team Leader met to discuss longer- term solutions to reduction of overtime/supplementary hours using the new early Power BI Organisational and Workforce Change Team Leader G McCaw, Organisational and Workforce Change Team Leader B Kinnear, Service Manager HSCP Z Musembya, Health and Social Care Workforce Planning Programme Manager HSCP Dec 2026
Page 45
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 45 PKC - GENERAL data and will review monthly when data is available to share from the Systems Team. Agreed evidence four: Evidence of monthly reviews of longer-term solutions to reduction of overtime/supplementary hours using the new early Power BI data. Agreed action five: Consider replication of a Health workforce model in Social Care. We will consider a model being developed in Health around a nursing pipeline to see if it could be replicated in Social Care. This will be considered when the SBAR to HSCP SMT is approved (no date planned yet). Agreed evidence five: Evidence of replication of a Health workforce model in Social Care (or of consideration of its replication). G McCaw, Organisational and Workforce Change Team Leader B Kinnear, Service Manager HSCP Z Musembya, Health and Social Care Workforce Planning Programme Manager HSCP Dec 2026
Page 46
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 46 PKC - GENERAL 25 6.5 Not all relevant supporting documents and correspondence are consistently retained within the appropriate payroll EDMS folders (for example, rotas, authorising emails), reducing the effectiveness of document retention arrangements. However, the records requested during the audit were subsequently made available. 1 - Minor Agreed action: Payroll Team Leader will remind colleagues of the requirement to transfer supporting documentation and correspondence (authorising emails and rotas) from generic inbox to EDMS. Whilst supporting records are retained and made available during the audit, it is recognised that due to the volume of payroll transactions and the short timescales involved, this can lead to documents not being transferred to EDMS. Automation and digital process improvements will remove the need for authorised emails. Agreed evidence: Reminder of document retention raised at the Payroll Team Meeting (06/07/26). Any actions for Payroll will be followed up in writing to the Team once the Audit Report is finalised. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 47
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 47 PKC - GENERAL 26 6.5 Inconsistent specimen signature documentation was identified for some sampled authorisers. This included one form that did not capture personal details and a previously completed form that appeared to have been reused, with previous details crossed out and amended. This reduces consistency in documentation supporting authorisation arrangements. 1 - Minor Agreed action: Guidance will be issued to managers reminding them of their responsibilities regarding authorised signatory arrangements and the need to ensure records remain up to date. In parallel, Payroll and MyView and People Analytics (MVPA) will continue exploring system-based authorisation through MyView, which would replace reliance on manual signature verification and provide a more sustainable control environment. Agreed evidence: Evidence as detailed under Action Point 3 (published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers) and evidence of exploration of MyView claim approval functionality as detailed under Action 2. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 48
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 48 PKC - GENERAL 27 6.5 Craft Worker Overtime and Standby Payment Claim Form is not published online, whereas forms for other employee groups are available online (Single Status and Teachers). Access to forms and supporting documents should be standardised and consistent across all employee groups, regardless of size. Publishing the form would improve transparency and help reduce delays in claim submissions. Any risk of employees using an incorrect form could be mitigated through clear labelling and guidance, particularly as a dedicated Craft employees’ website section already exists. 1 - Minor Agreed action: Publish the Craft Worker Overtime and Standby Payment Claim Form within the existing Craft employee guidance section. Agreed evidence: Relevant documents on Eric under Craft Workers Section. L Byrne, HR Team Leader – Payroll and Reward Completed 28 6.5 The overtime approval requirements within the Overtime, Standby and Callout Policy are not clearly defined. In particular, it is not clear whether references to approval relate to prior authorisation of overtime working, approval of claims for payment, or both. 1 - Minor Agreed action: The Overtime, Standby and Callout Policy will be updated to clarify the requirements for both the authorisation of overtime working and approval of overtime claims for payment. Agreed evidence: Revised policy published. L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 49
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 49 PKC - GENERAL 29 6.5 The Overtime, Standby and Callout Policy does not clearly state how “non-working days” should be treated for overtime payment purposes. Claim forms distinguish between “normal working days”, “rest/free days” and “non- working days”, however, the policy refers only to the first two categories. Clarifying this within the policy would support managerial understanding and promote more consistent authorisation of claims. 1 - Minor Agreed action: Policy will be updated and will be included in Manager Guidance. Agreed evidence: Published Policy and Manager Guidance as per Action Point 3. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 30 6.5 We were advised that documented procedures are not considered necessary, as additional payments are processed in accordance with the relevant policies, and applicable pay elements are configured within the Resourcelink to apply the appropriate enhancements. Payroll staff apply these arrangements based on claim 1 - Minor Agreed action: The Payroll Team will create a “how to guide” for each service area to flag key points that are not necessarily recorded in policy documents (internal points only). Agreed evidence: Payroll processing guidance notes and "how to" documents L Byrne, HR Team Leader – Payroll and Reward Dec 2026
Page 50
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 50 PKC - GENERAL form submissions and the relevant policy criteria. However, consideration should be given to documenting key processing procedures to support consistency, knowledge retention, and a common understanding of claim processing requirements across the team. completed and made available to relevant payroll staff. 31 6.5 We noted that, despite the existence of the Craft Callout pay element, no Craft callout payments were identified within the additional payments reports during the period under review. Payroll confirmed that the pay element remains available for use. Consideration should be given to reviewing the ongoing use of this pay element with the relevant service. 1 - Minor Agreed action: Will seek confirmation from the service whether this pay element is required in future. Agreed evidence: Email communication between Payroll and the Service. R Cassels, HR Officer - Payroll Aug 2026 32 6.5 We identified instances where work patterns recorded within the Resourcelink did not align with those reflected in claim forms reviewed during testing. The accuracy of these records is the responsibility of 1 - Minor Agreed action: Introduce periodic communications and guidance to managers reminding them of their responsibility to notify HR/Payroll promptly of A Craik, MyView and People Analytics Team Leader Dec 2026
Page 51
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 51 PKC - GENERAL managers, who should ensure that any relevant changes are notified to HR on a timely basis. Periodic verification of work pattern information could also be considered. contractual and working pattern changes. Agreed evidence: Evidence as detailed under Action Point 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. 33 6.5 Delays by managers in notifying Payroll of contractual changes and leavers increase the risk of payroll overpayments. 1 - Minor Agreed action: Introduce periodic communications and guidance to managers reminding them of their responsibility to notify HR/Payroll promptly of contractual and working pattern changes. Agreed evidence: Evidence as detailed under Action Point 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. A Craik, MyView and People Analytics Team Leader Dec 2026
Page 52
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 52 PKC - GENERAL 11. Authorisation 11.1 The auditor for this assignment was K Tarnowska. The supervising auditor was D Arachchilage. This report is authorised for issue:............. 12. Distribution 12.1 This report has been distributed to: T Glen, Chief Executive C Mailer, Depute Chief Executive G Boland, Strategic Lead, Strategic Planning, People and Performance P Johnstone, People and Culture Manager, Human Resources L Byrne, HR Team Leader – Payroll and Reward, Human Resources A Craik, HR Systems Team Leader, Human Resources All Strategic Leads Committee Services External Audit.
Page 53
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 53 PKC - GENERAL 13. Assessment Definitions 13.1 The following table contains the definitions of the control objective assessment. Control Objective Assessment Level of assurance Definition Substantial Assurance A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. 13.2 The following table contains the definitions applied by Internal Audit in rating audit findings/actions. Risk Rating for Individual Findings Rating Rating description Definition 5 Critical Significant observations/ major concerns which require immediate action. Management will need to add these to the appropriate Service risk register. Issue represents a control weakness which could cause, or is causing, severe disruption of the process or severe adverse effect on the ability to achieve process objectives 4 High Significant observations regarding the absence / failure of key controls requiring urgent action. Management should consider adding these to the appropriate Service/ divisional risk register Issue represents a control weakness which could have, or is having, major adverse effect on the ability to achieve process objectives 3 Medium Observations regarding the effectiveness of key controls requiring reasonably urgent action. Management should consider these when updating any divisional / team risk registers.
Page 54
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 54 PKC - GENERAL Issue represents a control weakness which could have, or is having, significant adverse effect on the ability to achieve process objectives 2 Low Minor observations regarding the adequacy of controls which require action to improve the efficiency, effectiveness, or economy of operations or which otherwise require to be brought to the attention of Senior Management Issue represents a minor control weakness with minimal but reportable impact on the ability to achieve process objectives 1 Trivial / Minor Very minor observations which will be raised during the audit and may not be included within the final report Issue represents a very minor control weakness with negligible impact on the ability to achieve process objectives. The issue will be raised during the audit and may not be included within the final report.