Agenda Document Pack - Audit and Risk Committee - 21/09/2026
Perth and Kinross Council · 21 September 2026
Back to Audit and Risk Committee — 21 September 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Ambition | Compassion | Integrity Our vision is for a Perth and Kinross where everyone can live life well, free from poverty and inequality Council Building 2 High Street Perth PH1 5PH 15/09/2026 A hybrid meeting of the Audit and Risk Committee will be held in the Council Chamber on Monday, 21 September 2026 at 13:00. If you have any queries please contact Democratic Services on (01738) 475000 or email Committee@pkc.gov.uk. THOMAS GLEN Chief Executive Those attending the meeting are requested to ensure that all notifications are silent on their device and other devices are in silent mode. Please note that the meeting will be broadcast online and recorded. The recording will be publicly available on the Council’s website following the meeting. Members: Councillor David Illingworth (Convener) Councillor Bob Brawn (Vice-Convener) Councillor Liz Barrett Councillor Andy Chan Councillor Ken Harvey Councillor Iain MacPherson Councillor Grant Stewart Page 1 of 92
Page 2
Page 2 of 92
Page 3
Audit and Risk Committee Monday, 21 September 2026 Agenda Members are reminded of their obligation to declare any financial or non- financial interest which they may have in any item on this agenda in accordance with the councillors’ code of conduct. 1 WELCOME AND APOLOGIES 2 DECLARATIONS OF INTEREST 3 MINUTE OF MEETING OF AUDIT AND RISK COMMITTEE OF 29 JUNE 2026 FOR APPROVAL (copy herwith) 5 - 14 4 INTERNAL AUDIT FOLLOW UP Report by Chief Internal Auditor (copy herewith 26/253) 15 - 18 5 INTERNAL AUDIT UPDATE Report by Chief Internal Auditor (copy herewith 26/254) 19 - 22 6 INTERNAL AUDIT - 25-11 ASSESSMENT AND CHARGING (copy herewith 26/255) 23 - 32 7 INTERNAL AUDIT - 25-10 PAYROLL - ADDITIONAL PAYMENTS (copy herewith 26/256) 33 - 86 8 NATIONAL FRAUD INITIATIVE OUTCOMES 2025/26 AND PREPARATIONS 2026/27 Report by Chief Internal Auditor (copy herewith 26/257) 87 - 92 Page 3 of 92
Page 4
Page 4 of 92
Page 5
Audit and Risk Committee Minute of hybrid meeting of the Audit and Risk Committee held in the Council Chambers on Monday 29 June 2026 at 1.00pm. Present: Councillors D Illingworth, B Brawn, L Barrett, M Frampton (substituting for K Harvey), G Laing (substituting for A Chan), I MacPherson and G Stewart. In Attendance: L Simpson, Strategic Lead – Legal and Governance; S Walker, Strategic Lead – Finance and Business Support; A O’Brien, J Sailsbury and G Walker (Finance and Business Support); P Johnstone and L Hamilton (Strategic Planning, People and Performance), N Lennon (Housing and Communities); S Thompson (Health and Social Care Partnership); J Clark, K Molley, E Ferguson and M Pasternak (all Legal and Governance). Also in Attendance: P Bryan (Audit Scotland). Apologies: Councillors A Chan and K Harvey Councillor D Illingworth, Convener, Presiding. 1. Welcome and Apologies/Substitutions The Convener welcomed everyone to the meeting and apologies and substitutes were noted as above. 2. Declarations of Interest There were no declarations of interest made in terms of the Councillors’ Code of Conduct. 3. Minute of Meeting of the Audit and Risk Committee of 23 March 2026 for Approval The minute of meeting of the Audit and Risk Committee of 23 March 2026 was submitted and approved as a correct record apart from a typo under item 6. 25-09 - Petty Cash where the sentence to be corrected to ‘consolidation of finance’. 4. Outstanding Business Statement Resolved: (i) The contents of the Outstanding Business Statement, be noted. (ii) It be agreed that completed actions would be removed from the Outstanding Business Statement. 3 Page 5 of 92
Page 6
5. Unaudited 2025/26 Annual Accounts (Draft) There was submitted a report by Chief Finance Officer (26/190) presenting the Council’s unaudited 2025/26 Annual Accounts (draft) in accordance with the Local Authority Accounts (Scotland) Regulations 2014. Councillor G Laing queried how confident the Chief Finance Officer was that Audit Scotland would produce the audited accounts by 30 November 2026. S Walker confirmed that the Council have had positive conversations with Audit Scotland and that they are on track to deliver the accounts by 30 November. S Walker added that they are hoping to be able to bring the accounts even earlier for consideration, however, do not want to make any commitment at this stage. In response to a question from Councillor G Stewart regarding support to the Proper Officer, S Walker referred to a recent publication by CIPFA which set out what the Chief Finance Officer should expect in terms of being able to deliver a professional finance team that are competent and capable to produce the information required by the Council. S Walker highlighted the positive work being carried out by the finance team in Perth and Kinross Council, including the work to deliver the unaudited accounts to Audit Scotland on time. S Walker confirmed that he was comfortable with the abilities of the finance team but advised there are opportunities for him to raise any issues with Elected Members or Senior Officers if he felt that it was necessary. In response to a supplementary question from Councillor G Stewart regarding resilience, S Walker advised that there are several young people going through CIFPA courses to gain qualifications and confirmed that the Council are in a better position over recent years in relation to succession planning. Councillor B Brawn queried how confident the Chief Finance Officer was that Audit Scotland would concur with his view that the Council is fit for purpose. S Walker expressed that he was very confident that the Council would receive a clean audit certificate. S Walker added that officers have regular conversations with Audit Scotland around any issues or matters arising and confirmed that work was being carried out with Audit Scotland all year round. In response to a supplementary question from Councillor B Brawn, S Walker confirmed that the Council does have financial challenges ahead. S Walker advised that he was confident that the organisation would continue to deliver essential services, however, those services may need to be delivered differently. S Walker added that the Strategic and Executive Leadership teams are starting to look at the budget setting process for 2027/28 to see what can be brought forward, which would then be reported through the budget review groups. Councillor G Laing quired if the Council are looking to set aside more to maintain and improve the Council’s capital assets, S Walker advised that as part of the budget process, money had been invested into bridges and roads, however there would not be enough finance due to the size of Perth and Kinross. S Walker added that teams involved are applying a risk-based approach and continue to monitor sites, especially throughout bad weather events. S Walker confirmed that through conversations at the Corporate Investment Group and the Asset Management Page 6 of 92
Page 7
Group, colleagues are doing what they can to keep on top of the Council’s key assets. Members thanked the finance team for their work in preparing the draft accounts and highlighted that the narratives in the management commentary are more user friendly. Resolved: (i) The Chief Finance Officer, be authorised to sign the unaudited 2025/26 Annual Accounts. (ii) It be noted that it is anticipated that the unsigned audited 2025/26 Annual Accounts will be considered by the Audit & Risk Committee on 30 November 2026. 6. Perth and Kinross Council Best Value Thematic Work – Asset Management There was submitted a report by Audit Scotland (26/191) (1) setting out the findings and four recommendations for improvement contained in the Perth & Kinross Council Best Value Thematic Work on Asset Management; and (2) providing a response and details actions that will be progressed in respect of the recommendations. P Bryan, Audit Scotland, provided a summary of the report. Councillor L Barrett referred to the first key message that states the Council’s asset challenge process provides a good model to inform decision making, however, data to fully implement the process for property assets is lacking, limiting its effectiveness and queried how the issue would be addressed. S Walker confirmed that the Council does hold a lot of data, but that data was not currently held for all assets. G Walker added that the key message was referring to utilisation data which the Council currently holds for Perth and Kinross school estate. G Walker confirmed that once an area of review had been undertaken, the utilisation data would be captured for assets at that time. Councillor G Laing queried the definition of capital project and asked if it be due to a project being over a certain numerical value or due to strategic importance in a specific area of Perth and Kinross. P Bryan confirmed that there was not a clear definition in place and that Audit Scotland are working with the Council on criteria. S Walker added that officers have assessed projects which they think Elected Members would be interested in, which could be a mixture of high and low monetary values. S Walker added that words would be included in the next capital monitoring report to the Finance and Resources Committee to say that projects would continue to be assessed on an individual basis. In response to a question from the Convener regarding the four recommendations of the report, P Bryan confirmed that the recommendations are largely administrative points but advised that the most significant one to address Page 7 of 92
Page 8
would be recommendation two as this would be a larger piece of work for the Council in terms of creating the performance measures and being clear on what and how often information should be reported. P Bryan confirmed that overall the report was positive and that the recommendations outlined are more suggestions going forward to ensure that good practice remains in place. Members thanked officers and Audit Scotland for the positive report. Resolved: The Contents of Audit Scotland’s Best Value Thematic Work, be noted. 7. Internal Audit Follow Up There was submitted a report by Chief Internal Auditor (26/192) presenting current summary of Internal Audit’s ‘follow up’ work relating to actions due for completion up to April 2026. Councillor L Barrett referred to the actions on business continuity plans and queried how confident the Chief Internal Auditor was that the next set of deadlines would be achieved. J Clark confirmed that for the remaining two BCPs, one service are currently awaiting a test on their BCP to take place and in the other service, there are significant areas which have their own standalone business continuity arrangements which are regularly being tested, however, the information had not yet been consolidated into one plan for that strategic area. J Clark added that she had been advised that the actions would meet the September deadline. Resolved: The current position in respect of the agreed actions arising from Internal Audit’s work, be noted. 8. Internal Audit Update There was submitted a report by Chief Internal Auditor (26/193) presenting a summary of Internal Audit’s work undertaken as part of the Internal Audit Plans for 2024/25 and 2025/26. Resolved: The progress with Internal Audit activity, be noted. 9. Internal Audit – 25-04 Health and Safety There was submitted a report by Chief Internal Auditor (26/194) presenting an audit undertaken on Health and Safety as part of the Internal Audit Plan for 2025-26, which was approved by the Audit & Risk Committee in June 2025. Page 8 of 92
Page 9
Councillor G Laing asked for further information about the role of the health and safety team. L Hamilton confirmed that the health and safety team sits in People and Culture Services within the Council, and the role of the team would be to support managers in discharging their responsibilities. L Hamiton added that in areas such as Friarton or housing repairs, there are many staff with higher risk activities. L Hamilton added that someone from the health and safety team works closely with the senior managers in those areas to provide support in terms of health and safety. L Hamiton advised the Council does not use external consultants for health and safety. Councillor L Barrett raised concerns over the 23 actions detailed in the audit and queried if the timescales in the management plan are sufficiently robust to address the risk and if the deadlines would be achieved. P Johnstone confirmed that management are responsible for health and safety in their own area of work, for ensuring robust risk assessments and safe systems of work are in place and that staff that are undertaking certain activities have been fully trained. P Johnstone added that conversations had been held with internal audit and services in preparation of the report and advised that she felt the timescales included were realistic and meet with the risk level placed against them. Councillor L Barrett asked if members concern could be passed to services given the seriousness with some of the actions. Members thanked J Clark, her team and other relevant officers for their work on the audit. Resolved: The contents of Report 26/194, be noted. 10. Internal Audit – 25-07 Insurance There was submitted a report by Chief Internal Auditor (26/195) presenting an audit undertaken on Perth and Kinross Insurance as part of the Internal Audit Plan for 2025-26, which was approved by the Audit & Risk Committee in June 2025. Members thanked J Clark, her team and other relevant officers for their work on the audit. Resolved: The contents of Report 26/195, be noted. 11. Internal Audit – 24-04 Affordable Housing There was submitted a report by Chief Internal Auditor (26/196) presenting an audit undertaken on Perth and Kinross Affordable Housing as part of the Internal Audit Plan for 2024-25, which was approved by the Audit & Risk Committee in June 2024. Councillor G Stewart referred to the relationship between the property team and the paralegals and queried if shared access had been put in place for buybacks to enhance efficiency and communication, instead of having standalone records. N Page 9 of 92
Page 10
Lennon advised that two record keeping systems were still in place, however, confirmed that the paralegals now have access to the documentation raised by the buyback officer. N Lennon added that there has been agreement to meet twice a year to raise any issues. In response to a question from the Vice-Convener regarding the nature of the audit, J Clark confirmed that the audit was undertaken on the delivery of affordable housing provision and that a specific reference to buybacks had been included due to the high numbers that had exceeded annual targets. J Clark confirmed that across the board the arrangements are satisfactory, however, the actions have been put in place so the Chief Internal Auditor can be able to place substantial assurance over the Council’s achievements on affordable housing. In response to a question from the Convener, J Clark confirmed that good progress has been made and anticipated that she would be able to place substantial assurance once all actions are completed. Members thanked J Clark, her team and other relevant officers for their work on the audit. Resolved: The contents of Report 26/196, be noted. 12. Internal Audit Annual Report & Internal Audit Opinion 2025/26 There was submitted a report by Chief Internal Auditor (26/197) presenting the year-end report and audit opinion of the Chief Internal Auditor for 2025/26. In response to a question from Councillor G Laing regarding the Global Internal Audit Standards, J Clark advised that with the new standards there had been little difference shown in the way that internal audit carry out their audits, however, confirmed that the GIAS have created greater emphasis on the governance around internal audit and the requirements for evidencing. The Vice-Convener referred to whistleblowing and queried if internal audit receives many requests through the email or telephone line from employees with concerns at work. J Clark confirmed that internal audit does not receive many requests through the helpline which was positive. J Clark added that for issues to reach this level, it would imply there had been a failing or breakdown in communication earlier in the process. An employee should be able to raise a concern with their line manager or Strategic Lead, and the issue should be sufficiently dealt with at that point. Resolved: The contents of this report, be noted, specifically the conclusion of the Chief Internal Auditor, which states that reasonable reliance can be placed on the Council’s risk management and governance arrangements, and systems of internal control for 2025/26. Page 10 of 92
Page 11
13. Internal Audit Mandate & Charter There was submitted a report by Chief Internal Auditor (26/198) presenting Internal Audit’s Mandate and Charter, in accordance with the Global Internal Audit Standards in the UK Public Sector (GIAS (UKPS)). Resolved: The Internal Audit Mandate & Charter which is aligned to the requirements of the Global Internal Audit Standards (GIAS) and their application in the UK Public Sector and the CIPFA Code of Practice for the Governance of Internal Audit in Local Government, be approved and it be confirmed it accurately reflects their understanding and expectations of the IA function. (There followed a short recess and the meeting reconvened at 2.27pm) 14. Internal Audit Strategy & Plan 2026/27 There was submitted a report by Chief Internal Auditor (26/199) presenting the Strategy for the delivery of Internal Audit services for Perth and Kinross Council, and the proposed approach for the direction of planned Internal Audit work for 2026/27. In response to a question from Councillor G Laing regarding elected member input into the plan, J Clark confirmed that the idea could be taken forward and that she would look to formally consult with members of the Audit and Risk Committee over the next plan. Resolved: The strategy and plan for 2026/27, be approved. 15. National Fraud Initiative 2024/25 Outcomes There was submitted a report by Chief Internal Auditor (26/200) outlining the action that has been taken by Perth & Kinross Council in response to the requirements of the National Fraud Initiative for 2024/25. Councillor G Laing asked for further information regarding the process of blue badges when someone has passed away and queried if there had been any cases of others using a blue badge when it does not belong to them. J Clark confirmed that the process Tell Us Once would be used in connection with blue badges so if a death has been registered in Perth and Kinross and badge was held, the badge would be cancelled. J Clark added that internal audit did not see any instances of fraud after someone had passed, however, J Clark agreed that majority of errors could be that blue badges have been disposed of or left somewhere not used. In response to a supplementary question from Councillor G Laing, J Clark confirmed that blue badges would need to be reapplied for every three years or they would become invalid. J Page 11 of 92
Page 12
Clark confirmed that internal audit did not receive any reapplications following the death of a holder. Resolved: (i) It be noted that Perth & Kinross Council takes seriously its obligations for taking part in the NFI exercise. (ii) The actions taken by Perth & Kinross Council in response to the requirements of the NFI, be noted. (iii) It be noted that the 2024/25 exercise is now complete, with financial outcomes for Perth & Kinross recorded as £131,236.42. 16. Strategic Risk Annual Report There was submitted a report by Strategic Lead – Legal and Governance (26/201) (1) providing assurance that the Council’s Risk Management Framework is adequate and effective and (2) advising the Committee of the current key strategic risks facing the organisation and how these risks are being mitigated and managed. Members thanked officers for their work in developing and monitoring the Strategic Risk Register. Resolved: (i) The contents of Report 26/201, be considered and appropriate and constructive challenge and comment, be provided. (ii) The current key strategic risks which have been identified through the application of the approved risk management process, be noted. (iii) The assurance as to adequacy and effectiveness of the risk management framework, be accepted. IT WAS AGREED THAT THE PUBLIC AND PRESS SHOULD BE EXCLUDED DURING CONSIDERATION OF THE FOLLOWING ITEM IN ORDER TO AVOID THE DISCLOSURE OF INFORMATION WHICH IS EXEMPT IN TERMS OF SCHEDULE 7A TO THE LOCAL GOVERNMENT (SCOTLAND) ACT 1973 P1. Strategic Risk Annual Report – Appendix 1 SR06 Resolved: The contents of the risk SR06 be noted and assurance be accepted. P2. Internal Audit Follow Up – Appendix 2 There was submitted a report by Chief Internal Auditor (26/192) presenting a current summary of Internal Audit’s ‘follow up’ work relating to actions due for completion up to April 2026 (Parkdale Care Home). Page 12 of 92
Page 13
Resolved: The current position in respect of the agreed actions arising from Internal Audit’s work, outlined in Appendix 2 to Report 26/192, be noted. P3 Parkdale Progress Update There was submitted a report by Chief Internal Auditor (26/202) providing the Audit & Risk Committee with a progress report on the control environment at Parkdale following the appointment of new management. This was as a result of the initial whistleblowing report considered by the Audit & Risk Committee in December 2025. Resolved: The progress of the Internal Audit activity, be noted. Page 13 of 92
Page 14
Page 14 of 92
Page 15
Our vision is a Perth and Kinross where everyone can live life well, free from poverty and inequality ___________________________________________________________________ Committee or Board: Audit & Risk Committee Date of Meeting: 21 September 2026 Report Title: Internal Audit Follow Up Report Number: 26/253 Report Author: Jackie Clark, Chief Internal Auditor Organisational Lead: Strategic Lead – Legal and Governance 1. Purpose 1.1 The purpose of this Report is to present current summary of Internal Audit’s ‘follow up’ work relating to actions due for completion up to July 2026. 1.2 Sections 1. Purpose 2. Recommendations 3. Background/Context 4. Follow Up Outcomes 5. Conclusion 6. Impact Value Assessment 7. Appendices 2. Recommendation It is recommended that the Committee: 2.1 notes the current position in respect of the agreed actions arising from Internal Audit’s work. 3. Background/Context 3.1 The Global Internal Audit Standards in the UK Public Sector (GIAS (UKPS)) and the Code of Practice for the Governance of Internal Audit in UK Local Government require that the Audit Committee should oversee the tracking and implementation of actions agreed following audits. 3.2 Internal Audit request evidence from Services which confirms that actions have been implemented and, therefore, controls have been improved. 4 Page 15 of 92
Page 16
4. Progress Update 4.1 There were 8 actions due to be completed up to July 2026. 6 actions have been verified by Internal Audit as having been satisfactorily completed. The remaining actions have revised completion dates, as detailed in Appendix 1. 5 Conclusion 5.1 Not applicable. 6. Impact Value Assessment 6.1 This report has been classified as being an operational report and as such does not require a full Impact and Value Assessment. 7. Appendices 7.1 Appendix 1 – Actions with a completion date of up to July 2026 which have yet to be completed Page 16 of 92
Page 17
Appendix 1 Actions with a completion date up to July 2026 which have yet to be completed Finding Action Action owner & Service Date(s) Current status Internal Audit Opinion A24-01 - Business Continuity Management (BCM) Planning Action Point : 1.2 Importance: High Audit Committee Date: June 2025 Our observation highlighted the need for Business Continuity Plans (BCPs) to be regularly updated, particularly regarding contact details and emergency actions. Despite the introduction of a new template, up to-date BCPs were not found across all services. The audit concluded without verifying signed BCPs for all services. Diarise annual reviews, with realistic spacing from 2026 onwards. All Strategic Leads, supported by EP&BC Officer June 2026 Following on from other associated actions being deferred, this action is now anticipated to be completed by December 2026. Accepted A24-01 - Business Continuity Management (BCM) Planning Diarise training and exercising following each annual review. All Strategic Leads, June 2026 Following on from other associated actions being deferred, Accepted 4 Page 17 of 92
Page 18
Action Point : 2.2 Importance: High Audit Committee Date: June 2025 Our observations revealed that the previous versions of the BCPs had not routinely been subject to adequate testing and communication (training and exercise) since prior to the Covid-19 pandemic. Furthermore, the latest Business Continuity Management (BCM) procedure has not been finalised, preventing us from providing any comments on its effectiveness at this stage supported by EP&BC Officer this action is now anticipated to be completed by December 2026. Page 18 of 92
Page 19
Our vision is a Perth and Kinross where everyone can live life well, free from poverty and inequality ___________________________________________________________________ Committee or Board: Audit & Risk Committee Date of Meeting: 21 September 2026 Report Title: Internal Audit Update Report Number: 26/254 Report Author: Jackie Clark, Chief Internal Auditor Organisational Lead: Strategic Lead – Legal and Governance ___________________________________________________________________ 1. Purpose 1.1 The purpose of this Report is to present a summary of Internal Audit’s work undertaken as part of the Internal Audit Plans for 2025/26 and 2026/27. 1.2 Sections 1. Purpose 2. Recommendations 3. Background/Context 4. Progress Update 5. Outcome from Consultancy Work 6. Conclusion 7. Impact Value Assessment 8. Appendices 2. Recommendation It is recommended that the Committee: 2.1 notes progress with Internal Audit activity. 3. Background/Context 3.1 The Global Internal Audit Standards in the UK Public Sector (GIAS (UKPS)) and the Code of Practice for the Governance of Internal Audit in UK Local Government require that the Audit Committee should receive regular engagement reporting for internal audit activity and on performance relative to the approved plan. 5 Page 19 of 92
Page 20
3.2 Work has continued on assignments from Perth & Kinross Council’s Internal Audit Plans. In addition, work has continued to be undertaken in connection with the Internal Audit provision for Perth & Kinross’ Integration Joint Board. 3.3 Internal Audit has commenced preparations for the 2026/27 exercise of the National Fraud Initiative to ensure that the Council is able to meet the expectations, in line with the timeline as laid down by Audit Scotland. A report on this is included on the agenda for this Committee. 4. Progress Update 4.1 Appendix 1 shows the status of audits arising from the Internal Audit Plans. 4.2 Internal Audit is currently involved with further areas of unplanned work. Where any control issues arise as a result of these, reports will be presented to the Audit & Risk Committee. 5. Conclusion 5.1 Not applicable. 6. Impact Value Assessment 6.1 This report has been classified as being an operational report and as such does not require a full Impact and Value Assessment. 7. Appendices 7.1 Appendix 1 – Internal Audit Activity Page 20 of 92
Page 21
Appendix 1 INTERNAL AUDIT UPDATE Internal Audit Activity Audit No. Title Lead Service(s) Status as at October 2025 Audit Committee 2025/26 A25-03 External Funding Multiple Services Ongoing September 2026 A25-10 Payroll Strategic Planning, People & Performance Completed September 2026 A25-11 Assessment & Charging Finance & Business Support Completed September 2026 2026/27 C26-01 Strategic Partnering – Environment & Infrastructure (C25/02 continued) Environment & Infrastructure Ongoing March 2027 A26-02 Risk Maturity Strategic Planning, People & Performance March 2027 A26-03 Forward Planning All Services March 2027 A26-04 Assurance Mapping All Services March 2027 A26-05 Throughcare & Aftercare Children, Families & Justice Ongoing December 2026 A26-06 Organisational Behaviour All Services Ongoing December 2026 A26-07 Complex Needs Project Children, Families & Justice June 2027 A26-08 Treasury Management Finance & Business Support Ongoing December 2026 A26-09 Customer Insights Customer & Digital / Finance & Business Support June 2027 A26-10 IT Incident Management Customer & Digital June 2027 A26-11 School Estate Management Property Services June 2027 A26-12 Tay Cities Deal Economy, Development & Planning June 2027 A26-13 Planning Applications Economy, Development & Planning Ongoing December 2026 5 Page 21 of 92
Page 22
A26-14 Public Accessibility Regulations Strategic Planning, People & Performance March 2027 A26-15 Transformation Delivery & Outcomes Programmes & Projects March 2027 Page 22 of 92
Page 23
1 PKC - GENERAL Internal Audit Report Finance & Business Support 25-11 Assessment & Charging September 2026 Final Report (Report No. 26/255) Legal and Governance Perth & Kinross Council Council Offices 2 High Street Perth PH1 5PH 6 Page 23 of 92
Page 24
2 PKC - GENERAL 25-11 Assessment & Charging Contents by Section 1. Introduction 2. Executive Summary 3. Audit Background Information 4. Scope and Limitations 5. Assessment of the Control Environment 6. Summary of Findings 7. Conclusions 8. Acknowledgement 9. Action Implementation & Follow Up 10. Authorisation 11. Distribution 12. Assessment Definitions Page 24 of 92
Page 25
3 PKC - GENERAL 1. Introduction 1.1 The audit of Assessment & Charging was undertaken as part of the Internal Audit plan for 2025/26, which was approved by the Audit & Performance Committee on 25 June 2025. The period under review for the purposes of the audit exercise was financial year 2025/26. 1.2 The indicative scope for the audit was to review progress with the improvement action plan. 1.3 This audit is not linked to the Strategic Risk Register; it is other assurance work. 1.4 Our review was limited to consideration of whether there is evidence that the controls documented on the Service’s ‘Audit - Risk’ spreadsheet have been implemented. 2. Executive Summary 2.1 The audit has found that there is Substantial Assurance that the controls documented on the Service’s ‘Audit - Risk’ spreadsheet have been implemented. 2.2 There are no actions arising from the findings in Section 6. 3. Audit Background Information 3.1 Areas of concern around assessment and charging for Council-placed residents in care homes and Council-supplied care at home were identified from a 2016 Internal Audit report and extended follow-ups reported to the then Audit Committee in 2018 and 2019, a 2018 Changing Point consultants’ report, along with subsequent Internal Audit advisory activity which took place in 2023. Responsibility for the Assessment and Charging function transferred from the Health and Social Care Partnership to the Council’s Finance and Business Support area in January 2024. 3.2 On transfer to Finance and Business Support, to ensure that all aspects highlighted historically by Internal Audit and by Changing Point are managed, a spreadsheet of the areas of concern was prepared detailing risks and actions. A review of the areas identified has been undertaken annually by the Service Manager and Team Leader to identify if they are still relevant, how the risk is being managed and if any areas have changed. Reviews were undertaken on 9 December 2024 and 24 October 2025 and recorded in the spreadsheet. Page 25 of 92
Page 26
4 PKC - GENERAL 4. Scope and Limitations 4.1 The audit has considered the actions recorded and form an opinion on whether the risks are being mitigated and/or managed. 4.2 The Internal Audit consisted of reviewing the spreadsheet, identifying actions and obtain evidence on a test basis of the actions being undertaken and sustained. 4.3 The audit was limited to the review of the actions documented on the spreadsheet and any questions arising from the review. This audit is not a whole-scale review of all activity within Assessment & Charging. 4.4 The details of the control objectives reviewed and the Internal Audit’s assessment of their strength of control in each area are contained within Section 5 of this report. 5. Assessment of the Control Environment 5.1 The table below contains a summary of the number of findings and their ratings, as detailed in Section 12, against each control objective, along with Internal Audit’s assessment of the adequacy and effectiveness of the controls in place to meet each of the objectives agreed for this audit. Further details, including any improvement actions, are set out in the Management Action Plan. No. Control Objective Action Rating Control Objective Assessment 5 4 3 2 1 1 To ensure that risks identified from the areas of concern identified from the report by Changing Point consultants and previous audits by the Internal Audit team have been mitigated. No actions arising Substantial Assurance 5.2 The auditor has assessed that Substantial Assurance can be placed on controls overall in relation to the progress with the improvement plan of Assessment and Charging from the audit. Meaning: A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. 5.3 A summary of the key findings are provided in section 6. Please note, however, the following areas of good practice which have been highlighted during the audit: Page 26 of 92
Page 27
5 PKC - GENERAL 5.4 The service has made substantial progress in completion of monthly reconciliations; with all historical reconciliations now completed and monthly reconciliations being maintained on an up-to-date basis. Regular reconciliations provide assurance that transactions are accurately recorded, balances are monitored, and any discrepancies are identified and investigated in a timely manner. This has significantly reduced the risk of mismanagement of client funds and strengthened the overall financial control environment. 5.5 The process for managing deceased client funds has improved with standard forms (Microsoft forms) and a more formal approach to obtaining information from next of kin or executors. This has helped ensure that deceased client cases are dealt with more quickly and efficiently, reducing the risk of funds being held by PKC for long periods and improving the timely return of deceased client monies. 5.6 With reconciliations now up to date and calendar reminders in place, outstanding bills can be identified quickly and paid on time. This helps ensure that all payments are monitored regularly and any issues are actioned promptly. 5.7 The Team Leader is content that an adequate team plan is in place and appropriate induction, and training arrangements are being delivered for staff. 5.8 We found that appropriate arrangements are in place to ensure care homes and care-at-home providers are paid on time, and no significant payment delays were identified during the audit. As per the Team Leader, care homes are paid through the Independent Sector Payment (ISP) process on a four-weekly basis using Mosaic and Integra systems, while care-at-home providers are paid based on invoices submitted. 5.9 The current arrangements for working with care homes and care-at-home providers are effective, with regular meetings helping to resolve issues promptly. Communication with social workers has also improved through regular drop-in sessions, training, and ongoing engagement, supporting better information sharing and joint working between teams. 5.10 There is clear guidance provided for the staff to follow proper policies and procedures. The audit did not identify any areas of non-compliance noticed through the audit. 5.11 Oversight and engagement from the Strategic Lead – Finance & Business Support, Finance Manager, and Team Leader have improved significantly, contributing to continued progress and improvement in this area. 5.12 Internal Audit is satisfied that all previously identified concerns have been effectively addressed and the team has implemented a range of improvements, including completing all outstanding reconciliations, strengthening management oversight, improving performance monitoring, reducing backlogs, enhancing staff training, and improving communication with key stakeholders. These actions have helped strengthen controls and improve the overall effectiveness of the service. Page 27 of 92
Page 28
6 PKC - GENERAL 6. Summary of Findings 6.1 Internal Audit has identified below areas where continues controls could be beneficial particularly in relation to better performance. 6.2 A reconciliation summary and action (checklists) are maintained and clearly records the relevant reconciliation period, with comments such as "No action required" or "No issues identified". We noted that reconciliations are being completed on a monthly basis and are currently up to date. To support ongoing effective control operation, management should continue this process consistently, as it helps to identify any gaps, delays, or recurring issues with client’s funds. 6.3 While client’s bills are being paid on time, there are reasonable steps taken for keeping supporting evidence for these payments. To improve transparency and provide a clear audit trail, the team should continue to follow the proper procedure to collect and retain as much supporting evidence as possible, such as invoices, receipts, and correspondence relating to client payments. This would help demonstrate that payments are accurate, appropriate, and properly supported and no further audit action is considered necessary at this time. 6.4 With diary alerts in place and reconciliations kept up to date, clients approaching State Pension age can be identified promptly and the necessary action taken to ensure they receive their pension when due. However, the diary alert control was not operating consistently for the sample tested and cannot be fully relied upon. Therefore, management should continue to implement robust reconciliation to ensure all eligible clients are identified, and State Pension applications are submitted promptly. No further audit action is considered necessary at this time. 6.5 Internal Audit also noted that resource pressures were historically a challenge for the team. Since the move to Finance and Business Support, action to address this through recruitment initiatives, including advertising and restructuring activities has been undertaken. Given the actions already taken, no further audit action is considered necessary at this time. 7. Conclusion 7.1 The Internal Audit review is able to place Substantial Assurance on the overall control environment for Assessment and Charging. The agreed actions, once implemented, should enable Internal Audit to place Substantial assurance on these. 8. Acknowledgements 8.1 Internal Audit would like to thank all officers who were involved in this audit, particularly officers within the Assessment and Charging team, C Fraser, Team Leader - Assessment & Charging. Page 28 of 92
Page 29
7 PKC - GENERAL 9. Action Implementation & Follow up 9.1 Responsibility for the maintenance of adequate and effective controls rests with management. Where the audit has identified areas for management action, these are identified in the Management Action Plan. Where a decision is taken by management not to act in response to finding from this review, it is the responsibility of management to assess and accept the risk arising from non- implementation. 9.2 Achievement of the agreed actions is monitored through Internal Audit’s ‘follow up’ arrangements. 10. Authorisation 10.1 The auditor for this assignment was M Stewart. The supervising auditor was D Arachchilage. This report is authorised for issue by J Clark 11. Distribution 11.1 This report has been distributed to: T Glen, Chief Executive C Mailer, Depute Chief Executive S Walker, Strategic Lead, Finance & Business Support C Robertson, Finance Manager/Business Partner L Simpson, Strategic Lead, Legal & Governance Committee Services External Audit Page 29 of 92
Page 30
8 PKC - GENERAL 12. Assessment Definitions 12.1 The following table contains the definitions of the control objective assessment. Control Objective Assessment Level of assurance Definition Substantial Assurance A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. 12.2 The following table contains the definitions applied by Internal Audit in rating audit findings/actions. Risk Rating for Individual Findings Rating Rating description Definition 5 Critical Significant observations/ major concerns which require immediate action. Management will need to add these to the appropriate Service risk register. Issue represents a control weakness which could cause, or is causing, severe disruption of the process or severe adverse effect on the ability to achieve process objectives 4 High Significant observations regarding the absence / failure of key controls requiring urgent action. Management should consider adding these to the appropriate Service/ divisional risk register Issue represents a control weakness which could have, or is having, major adverse effect on the ability to achieve process objectives 3 Medium Observations regarding the effectiveness of key controls requiring reasonably urgent action. Management should consider these when updating any divisional / team risk registers Page 30 of 92
Page 31
9 PKC - GENERAL Issue represents a control weakness which could have, or is having, significant adverse effect on the ability to achieve process objectives 2 Low Minor observations regarding the adequacy of controls which require action to improve the efficiency, effectiveness, or economy of operations or which otherwise require to be brought to the attention of Senior Management Issue represents a minor control weakness with minimal but reportable impact on the ability to achieve process objectives 1 Trivial / Minor Very minor observations which will be raised during the audit and may not be included within the final report Issue represents a very minor control weakness with negligible impact on the ability to achieve process objectives. The issue will be raised during the audit and may not be included within the final report. Page 31 of 92
Page 32
Page 32 of 92
Page 33
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 1 PKC - GENERAL Internal Audit Report Strategic Planning, People and Performance and All Services 25-10 Payroll – Additional Payments July 2026 Final Report (Report No. 26/256) Legal and Governance Perth & Kinross Council Council Offices 2 High Street Perth PH1 5PH 7 Page 33 of 92
Page 34
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 2 PKC - GENERAL 25-10 Payroll – Additional Payments Contents by Section 1. Introduction 2. Executive Summary 3. Audit Background Information 4. Scope and Limitations 5. Assessment of the Control Environment 6. Summary of Findings 7. Conclusions 8. Acknowledgement 9. Action Implementation & Follow Up 10. Management Action Plan 11. Authorisation 12. Distribution 13. Assessment Definitions Page 34 of 92
Page 35
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 3 PKC - GENERAL 1. Introduction 1.1 The audit of Payroll was undertaken as part of the Internal Audit Plan for 2025- 26, which was approved by the Audit & Risk Committee on 25 June 2025. The period under review for the purposes of the audit exercise was April 2025 to September 2025 (financial year 2025-26). 1.2 The indicative scope for the audit was to review whether controls are designed appropriately and operating effectively to ensure that additional payments are properly authorised, accurate and compliant. 1.3 The audit included reviewing the processes in place for the planning, recording and authorising of additional payment claims by managers and of the payments made through Payroll. 1.4 The audit is not directly linked to any particular risk on the Strategic Risk Register. 2. Executive Summary 2.1 The audit has found that limited assurance can be placed on the Council’s internal controls in relation to the additional payments. 2.2 There are thirty-three actions arising from the findings documented in Section 10. Once these actions are completed, Internal Audit should be able to place substantial assurance on the arrangements in place. Further four areas for consideration for improvement were highlighted in Section 6 (paragraph 6.6). 2.3 It is noted that, whilst the processing of additional payments is subject to controls within People and Culture, the responsibility for the proper planning, recording and authorising of additional payment claims lies with managers. 3. Audit Background Information 3.1 As per the Perth and Kinross Council’s (PKC’s) Financial Regulations 2024-27, the Corporate Human Resource Manager is responsible for the prompt and accurate payment to employees, and elected members, of additional payments/deductions and other allowances such as the payment of travel, overtime, sickness, maternity, paternity, adoption and other allowances in accordance with statutory and Council policy requirements (the post title for Corporate Human Resource Manager has now changed to People and Culture Manager). 3.2 Strategic Leads are responsible for ensuring the prompt submission of accurate claims for processing, within their area of responsibility, in accordance with statutory requirements and Council policy. Page 35 of 92
Page 36
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 4 PKC - GENERAL 3.3 The People and Culture Manager ensures that adequate procedures are in place for checking claims for additional payments/deductions and other allowances, to ensure compliance with statutory provisions and Council policy. 3.4 The People and Culture Manager informs Strategic Leads of any change to the approved allowances/deductions, or any other factor that may affect the payment/deductions made. 3.5 The People and Culture Manager issues additional guidance on the submission of payroll input for additional payments/deductions and other allowances, specifying the form of each document, the process required, the timescale to be adhered to, and the required level of authorisation. 3.6 The Working Time Regulations 1998 were introduced into domestic UK legislation on 1 October 1998. The Regulations provide basic entitlements to all workers regarding hours of work, night working, rest breaks, daily and weekly rest and annual leave entitlements. The Regulations have been introduced under Health and Safety and will be monitored and enforced under the relevant employment legislation. 3.7 The standard weekly hours for full-time Single Status employees are 36 hours per week. However, as it is considered essential to maintain the current staffing levels in certain areas to guarantee service delivery, contracted hours for some employees may vary. Starting and finishing times will be directed by Strategic Leads (formerly known as Heads of Service). 3.8 As for Craft employees, they generally work a 37-hour week as outlined in the Local Agreement approved by both the Council and the appropriate Trade Unions. 3.9 As per the PKC’s Overtime, Standby and Callout Policy, “work in excess of the normal hours of duty should be discouraged, and employees should not be required to consistently work overtime”. Where overtime working is unavoidable, payment shall be calculated and paid in accordance with the policy, subject to prior approval by an employee’s line manager who should be an authorised signatory in accordance with the Council’s Financial Regulations. As an alternative to payment, compensatory time off in lieu (TOIL) may be granted. 3.10 In accordance with the Council’s approved Flexi Time Scheme, overtime hours must be recorded separately from flexible working hours. Overtime and flexi time cannot be claimed for the same period. 3.11 Other additional payments include standby, disturbance, sleep in, callout, temporary higher duty payments (THDP), additional responsibility, night and shift working allowances. 4. Scope and Limitations 4.1 The Audit has reviewed whether controls are designed appropriately and operating effectively to ensure that additional payments are properly authorised, accurate and compliant. In addition, we have evaluated how Payroll contributes to the commitment to delivering best value in staff costs. Page 36 of 92
Page 37
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 5 PKC - GENERAL 4.2 The review consisted of interviews with relevant officers, document reviews and sample walk-through tests of the payment process from start to finish. 4.3 There were no limitations identified that would impact the Audit. However, we did not review additional payments for Teachers. 4.4 The details of the control objectives reviewed and Internal Audit’s assessment of their strength of control in each area is contained within Section 5 of this report. 5. Assessment of the Control Environment 5.1 The table below contains a summary of the number of findings and their ratings, as detailed in Section 12, against each control objective, along with Internal Audit’s assessment of the adequacy and effectiveness of the controls in place to meet each of the objectives agreed for this audit. Further details, including any improvement actions, are set out in the Management Action Plan. No. Control Objective Action Rating Control Objective Assessment 5 4 3 2 1 1 To ensure effectiveness of the arrangements in place to support accurate, timely and appropriately authorised additional payments to General employees (Single Status and Craft). 9 3 5 8 Limited assurance 2 To confirm that additional payments comply with relevant regulations. 1 5 Limited assurance 3 To determine whether Payroll function supports management in achieving best value in terms of staff costs. 1 1 Reasonable assurance 5.2 The auditor has assessed that limited assurance can be placed on controls overall in relation to additional payments from the audit. Meaning: “Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited”. 5.3 A summary of the key findings and actions are provided in section 6, please note however, the following areas of good practice which have been highlighted during the audit: 5.3.1 HR pay policies and supporting guidance on the completion of Single Status claim forms are available online and accessible to relevant staff. 5.3.2 All claims tested were approved by the appropriate signatories in accordance with the Authorised Signatory Database. No instances of approval outside of Page 37 of 92
Page 38
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 6 PKC - GENERAL the database were identified within the sample tested. Annual reviews of the Authorised Signatory Database are undertaken to ensure that access remains accurate and up to date. 5.3.3 In the cases tested, overtime was evidenced as having been approved before the work was undertaken and appeared to be driven by legitimate operational requirements rather than ad hoc requests. 5.3.4 There is a strong Payroll commitment to ensuring that payments are processed in a timely manner without delays. Payments are consistently made on the final working day of each month, demonstrating Payroll’s adherence to established processing timelines. 5.3.5 The majority of payroll deadlines are communicated to staff through published guidance documents and, where appropriate, through internal news pages on ERIC, and Microsoft Teams channels. This multi-channel approach increases the visibility of key deadlines and encourages the timely submission of claims and supporting payroll-related documentation. 5.3.6 Key officer are professionally qualified and hold membership with the Chartered Institute of Payroll Professionals. They also ensure their knowledge is up to date through subscriptions to HMRC emails and newsletters. 5.3.7 The Payroll function operates a structured monthly payroll control process, which incorporates a range of control activities designed to support the accuracy of payroll outputs. Exception reports are used and may help identify payment amounts exceeding expected thresholds, which could include some instances of overlapping claims. Reconciliation activities are also performed as part of each payroll cycle, including review of HMRC Gateway statements. 5.3.8 The application of pay rates is automated within the system. Access to update pay rates is restricted to authorised staff, with appropriate segregation of duties in place, to prevent a single individual from overriding or manually changing approved pay rates. Validation and checking processes are performed following updates to pay tables, including post-update spot checks, to help ensure accuracy and completeness of changes. 5.3.9 Tax and National Insurance deductions are calculated automatically in line with HMRC requirements through compliant system configuration. Whenever government tax rates or thresholds change, the payroll software is automatically updated to reflect the revised settings. This supports ongoing compliance with statutory requirements and reduces reliance on manual intervention. 5.3.10 At the start of each new financial year, Payroll staff perform gross-to-net pay calculations to validate compliance with HMRC requirements. The test checks are also performed following legislative changes, upgrades impacting statutory tables, and on an ad hoc basis, supporting the retention of manual calculation knowledge within the team. 5.3.11 When a new pay element is created, it is first implemented in the test environment to ensure that relevant statutory deductions are applied correctly before being deployed to the live system. Page 38 of 92
Page 39
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 7 PKC - GENERAL 5.3.12 Power BI tool has been introduced and is used to provide useful data to support more informed decision-making across different levels of management. Learning sessions have been delivered to help users understand and apply its functionality effectively. The tool continues to be improved, with additional elements being regularly added. A further tool (Power Automate) has been developed, with planned enhancements including additional alerts and data elements. Together, these developments demonstrate an ongoing focus on improving monitoring arrangements and strengthening oversight. 5.3.13 Relevant teams have access to the payroll information needed to perform their roles effectively. This supports transparency and enables informed review and oversight. 5.3.14 Payroll performs monthly escalations in relation to excessive additional payments identified for management attention. It was observed that, in some cases, Payroll also suggests or recommends actions to be taken. This provides additional support to management in addressing payroll-related issues. 5.3.15 Regular reports on overtime expenditure and related trends are provided to Executive Leadership Team, supporting senior-level oversight of workforce costs. 5.3.16 A reduction in employee overtime costs was observed compared with the same period in the prior year. In addition, the rate of growth in agency costs appears to have slowed, indicating that the reduction in overtime has not been matched by a proportionate increase in agency expenditure. 5.3.17 Based on the sample reviewed, the order of overtime allocation indicated that agency staff were used as a last resort. This supports cost control by prioritising internal resources where possible. 5.3.18 Work undertaken by Organisational and Workforce Change Team supports the achievement of better value for money. This includes tailored workforce planning carried and meetings with budget holders to support more efficient allocation of resources. 5.3.19 The Workforce Planning Themed Board and the Framework for Managing Workforce Changes provide structure and oversight for decision-making, implementation activities and coordination across relevant stakeholders. 6. Summary of Findings 6.1 Below is a summary of key findings and actions, which are reflected in the Management Action Plan, detailed in Section 10. It is noted that, whilst the processing of additional payments is subject to controls within People and Culture, the responsibility for the proper planning, recording and authorising of additional payment claims lies with managers. Page 39 of 92
Page 40
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 8 PKC - GENERAL 6.2 To ensure effectiveness of the arrangements in place to support accurate, timely and appropriately authorised additional payments to General employees (Single Status and Craft): 6.2.1 There is no formally coordinated training for managers on claim authorisation processes or on compliance with pay policies. Guidelines on managerial checks are not a formal part of managers’ induction programmes. The control operates with significant reliance on managers’ understanding of the policies and guidelines and on informal knowledge transfer from colleagues. [Action Point 1] 6.2.2 The majority of additional payment claims are submitted and authorised in paper format outside the payroll system. As a result, authorisations must be verified manually before claims are processed. This approach is time- consuming and increases the risk of fraud or error. Opportunities to introduce a system-based managerial approval workflow and greater automation of the claim process should be further explored to strengthen controls and improve operational efficiency. [Action Point 2] 6.2.3 Current arrangements place significant reliance on managerial review and authorisation. Testing identified instances where timesheets contained inaccuracies and calculation errors that were not identified or corrected during authorisation process. This indicates that the level of verification performed by authorising managers may not always be sufficient to identify errors. Managerial authorisation should therefore include explicit verification of claim accuracy, including calculations, day types, dates, times and reasons.  [Action Point 3] 6.2.4 Not all managers contacted during testing maintained records or supporting documentation that could be used to verify the accuracy of claims. Managers should ensure that they retain sufficient records to support the effective review and authorisation of claims, particularly where claims are authorised in the line manager’s absence. [Action Point 4] 6.2.5 It was observed that required information was not consistently captured in claim forms, despite completeness being a requirement of the guidance (“Date, Day Type, From, Break Taken, To, Hours Claimed, Reason columns must be completed in all cases”). Managerial authorisation should therefore include completeness checks. In addition, one manager was observed to have added missing working pattern details that appeared to be incorrect in a number of instances. Where incomplete information is identified, managers should ensure that any missing details are completed accurately. Page 40 of 92
Page 41
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 9 PKC - GENERAL [Action Point 5] 6.2.6 Some sampled claim forms were signed and dated by employees at various stages of the claimed period, including before all claimed time had been worked and, in other cases, weeks or months after the work had been completed. Timekeeping practices should be improved to support the timely and accurate recording of time worked. Employees should complete claim forms as work is performed and sign them at the end of the relevant period, rather than in advance or significantly after the event. [Action Point 6] 6.2.7 Older versions of Single Status claim forms (for part-time additional hours, overtime hours and sleep-in payments, as well as for standby and disturbance allowances), which are not aligned with the current forms used in the PKC, were found to be in use by some teams. These forms did not include key fields such as break length, overtime reason, working pattern day types or employee declaration, and some also contained outdated pre-populated pay rates. This creates a risk of inaccurate or inconsistent claim completion and may result in incorrect payments. [Action Point 7] 6.2.8 Where claim forms are pre-completed, there is an increased risk that outdated or inaccurate information may be carried forward into claims, potentially affecting the accuracy of payment processing. [Action Point 8] 6.2.9 We identified some inconsistencies in the forms used for the same type of payment, including across comparable roles within the same service area. This increases the risk that required information may not be captured consistently. Managers should ensure that employees are aware which claim form to use for each type of payment. [Action Point 9] 6.2.10 Despite the guidance explaining which post title should be entered in the relevant field of the claim form, this requirement still appears to be either misunderstood or misinterpreted by employees and managers. For example, during the sample testing we identified an instance where employee, on a number of occasions across several pay periods, recorded their substantive post on the claim forms, rather than the lower-graded post being covered. As a result, for few months overtime was paid at a higher rate than Page 41 of 92
Page 42
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 10 PKC - GENERAL appropriate, despite the claim reasons indicating that the work was related to covering a vacancy and a sickness for a different post. According to Payroll, employees should be paid based on the post being covered rather than their substantive post. Payments are processed based on the post title recorded on the claim form and authorised by the manager, rather than on the analysis of the reason for the additional work. This highlights a weakness in overtime approval controls and increases the risk of payments being processed at an incorrect rate. Managers should ensure that the post title recorded on the claim form reflects the duties undertaken, rather than the employee’s substantive role. It should be considered whether claim forms could be amended to distinguish between an employee’s substantive post and the post for which the claim is submitted. Separate fields for each would help to reduce the risk of claims being processed at an incorrect rate. [Action Point 10] 6.2.11 Payroll staff do not routinely validate claim form inputs, including calculations, eligibility or alignment with supporting timekeeping records such as rotas. System validation is limited to confirming that employee and post numbers exist and does not verify that they relate to the correct employee. Manual validation is also limited and generally focuses on contracted hours and post details. As a result, significant reliance is placed on managerial approval, except where issues are sufficiently obvious to be identified during payroll processing. This control weakness increases the risk of error, fraud and incorrect payments. [Action Point 11] 6.2.12 Overtime rates depend on employees’ work patterns and day types, however, these are not routinely validated during payroll processing due to the time required to complete them, including where day type information is missing from claim forms. While working pattern information is available within the payroll system, it does not clearly distinguish between non-working and rest days. As a result, where day type information is unavailable on the claim forms or cannot be readily verified, Payroll staff default to applying straight time for initial overtime hours. This increases the risk of incorrect pay elements, overtime rates and multipliers being applied, potentially resulting in underpayments. [Action Point 12] 6.2.13 Pay elements are allocated manually by payroll staff before being entered into the payroll system. Testing identified occasional instances where inappropriate Page 42 of 92
Page 43
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 11 PKC - GENERAL pay elements or incorrect unit quantities were applied, resulting in payment errors. Reliance on manual allocation increases the risk of mistakes. Opportunities to automate the allocation of pay elements should be explored to reduce reliance on manual intervention and improve the accuracy and consistency of payroll processing. [Action Point 13] 6.2.14 While monthly payroll submission deadlines are in place for Single Status employees, there is no formally defined time limit for the submission of claim forms relating to previous periods. As a result, claims may be submitted several months after the work was performed, increasing the risk of delayed processing and inaccuracies where claim details are completed or approved after the event. The absence of a formal cut-off date also reduces visibility of outstanding historical claims and assurance that all claims relating to a period have been identified and processed. Late submissions may affect the accuracy of budget monitoring and alter the payroll period in which pensionable pay and National Insurance contributions are calculated. Consideration should be given to introducing a formal cut-off date for retrospective claims and strengthening proactive follow-up by managers, including timely enquiries where claim forms are not submitted within expected timeframes. [Action Point 14] 6.2.15 No formal claim submission deadlines have been established for Craft employees. This results in inconsistent submission practices and reduces assurance that claims are submitted in a timely manner. In the absence of defined deadlines, delayed submissions may not be identified and followed up promptly by managers. [Action Point 15] 6.2.16 Manual and system-based (MyView) claims are processed through separate arrangements and are not routinely reconciled against one another. Payroll does not routinely perform checks to identify overlapping or incompatible claims across different sources, including manual claim forms, system-generated claims and flexi time records (Optimum). Employees may submit additional payment claims that overlap with other recorded absences (for example, annual leave or sick leave), payments, flexi time records or standby commitments, contrary to the requirements of the Overtime, Standby and Callout and the Flexi Scheme policies, which outline Page 43 of 92
Page 44
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 12 PKC - GENERAL that overtime and flexitime cannot be claimed for the same period. This increases the risk of duplicate or incompatible claims being processed and paid. While managerial authorisation and exception reporting provide key level of control, these arrangements may not identify all conflicts between claims, particularly where managers oversee large teams or do not maintain supporting records to validate claims. Managers should ensure that claims do not conflict with each other prior to authorising them. Consideration should be given to introducing automated validation or reconciliation controls to identify overlapping claims and reduce reliance on manual checks where applicable. [Action Point 16] 6.2.17 We identified that there are no automated controls in place to prevent employees from exceeding the maximum permitted flexi time debit balance or taking more flexi leave than allowed under the Flexi Scheme Policy. The system also permits flexi leave to be booked where an employee has already exceeded the permitted debit balance. Responsibility for monitoring compliance with the Flexi Scheme Policy rests with managers. Although managers have access to employees’ flexi time balances, there are currently no alerts or exception reports to proactively notify them of potential breaches or excessive debit balances, as was previously the case. As a result, identification of non-compliance with the policy requirements relies on managers carrying out regular manual reviews and may not occur in a timely manner. In addition, the system automatically deducts thirty minutes where lunch breaks are not recorded. While this provides a default control, it may not always reflect actual break durations and could affect the accuracy of flexi time balances. Collectively, these control weaknesses increase the risk of inaccurate flexi time records, excessive debit balances and unauthorised flexi leave. They may also result in financial loss to the PKC, particularly where employees with significant debit balances terminate their employment and Payroll is required to recover the overpaid amount, which may not always be fully recoverable. [Action Point 17] 6.3 To confirm that additional payments comply with relevant regulations: 6.3.1 No formal schedule is in place for the periodic review of policies and guidance. As a result, number of documents have not been reviewed for over five years (the Flexi Scheme Policy was last revised in February 2019; Time Off for Page 44 of 92
Page 45
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 13 PKC - GENERAL Medical Appointments Policy in December 2018; Guidance on Personal Breaks in December 2018). This increases the risk that policies and guidance become outdated and that employees and managers may rely on inaccurate or obsolete information. For example, the Flexi Scheme Policy continues to reference the use of flexi cards and flexi machines for clocking in and out, despite these arrangements no longer being in use. [Action Point 18] 6.3.2 Pay guidelines are not consistently updated following annual changes to pay and related arrangements. Some reference links within the guidelines have not been maintained and are no longer functional, including links to the Scheduled Pay Periods document. Examples were identified within the Which Timesheet Guidance, the Guide for Completion of Payment Claim Single Status and the Payroll FAQ document (last reviewed in July 2022). In addition, two guidance documents reviewed (the Guide for Completion of Payment Claim Form Single Status and the Guide for Completion of Casual Worker Claim Form SS) continue to refer to superseded service names: ESC and CDS. This may reduce the effectiveness of the guidance, limit access to supporting information and undermine confidence that users are referring to accurate and up-to-date information, even where the refenced document remains available elsewhere on ERIC. [Action Point 19] 6.3.3 Policy and guidance reviews do not consistently identify all content requiring amendment or removal. As a result, outdated information may remain within published documentation despite reviews having been undertaken. For example, although the Overtime, Standby and Callout Policy was reviewed on several occasions following changes to the vehicle workshop employees’ terms and conditions (arising from the transition from Craft to Single Status), it was not fully updated to reflect those changes. In particular, the Craft Local Agreement 2011 (Vehicle Workshop) that had been discontinued in 2022 continued to be referenced within the policy until December 2025. Furthermore, the same obsolete agreement remained published within the Pay Policies section of the PKC’s website until that date and continues to be available within the Craft Employees section. This increases the risk of employees relying on superseded documentation and may create confusion regarding current terms, conditions and related arrangements. Page 45 of 92
Page 46
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 14 PKC - GENERAL [Action Point 20] 6.3.4 During interviews and testing, we were unable to identify a designated officer or team with overall responsibility for monitoring compliance with the Working Time Regulations and overseeing related activities. As a result, there appeared to be limited central oversight of working hours, opt-out agreements and associated regulatory requirements. No opt-out agreements were identified within the Resourcelink records reviewed during testing. This included an employee whose average working hours over a seventeen-week period were 61 hours per week. Under the Working Time Regulations, a documented opt-out agreement should be in place where working patterns have the potential to exceed an average of 48 hours per week over the relevant reference period (seventeen weeks). Evidence of such an arrangement was not available within the record examined. However, we acknowledge that, subsequently to the audit testing period, steps were taken by People and Culture Team to strengthen the controls. In April 2026, an online opt-out form was introduced, and communication was issued to employees regarding completion and renewal requirements. Managers were also separately reminded of their responsibilities. We further noted that MyView reminders are now expected to support annual renewal of opt-out forms and that working patterns will be reviewed where an employee without an opt-out agreement is identified as exceeding the 48-hour average limit. In addition, we were advised that the updated arrangements include a dedicated reporting solution to proactively identify such employees. [Action Point 21] 6.3.5 Payroll reconciliations are performed as part of each pay cycle and include consistency checks between payroll reports, review of HMRC Gateway statements, confirmation of payments made, and spot checks of PAYE and National Insurance values reported through Full Payment Submission (FPS) and Employer Payment Summary (EPS) submissions. However, while individual review activities are performed, there is no routine documented end-to-end numerical reconciliation of the total PAYE and National Insurance amounts across all sources - payroll reports, FPS and EPS submissions (as applicable), HMRC statements and payments made to HMRC. In our inquiry, we were advised that review of HMRC statements is considered sufficient to identify any outstanding amounts or discrepancies and that any variances arising would be captured through existing processes, for example, through the HMRC Annual Return spreadsheet. However, assurance over the completeness and accuracy of reported amounts relies on a combination of Page 46 of 92
Page 47
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 15 PKC - GENERAL separate review activities, rather than a single documented reconciliation across all key stages of the payroll reporting and payment process. The control framework could be strengthened by introducing a documented monthly end-to-end numerical reconciliation of the total PAYE and National Insurance amounts across these sources, with any variances identified, investigated, documented and resolved. This would provide clear evidence that reported amounts are complete, accurate and consistent. [Action Point 22] 6.3.6 An overpayment recovery process is in place, and a draft policy has been developed to formalise the process. However, as the policy has not yet been approved, there is a risk that the process may not be applied consistently. [Action Point 23] 6.4 To determine whether Payroll function supports management in achieving best value in terms of staff costs: 6.4.1 In certain services, there appears to be a continued reliance on overtime to support routine operations. This is inconsistent with the Overtime, Standby and Callout Policy, which states that employees should not be required to consistently work overtime. The pattern of overtime usage suggests that it is being used to address workforce resourcing pressures. Audit testing identified examples where overtime was used over extended periods to maintain service delivery while vacancies remained unfilled for prolonged periods, indicating resourcing pressures in certain areas. Consideration should be given to identifying further opportunities to reduce reliance on overtime in areas where it is routinely used to support service delivery, including through measures aimed at reducing the duration of vacancies where appropriate. [Action Point 24] 6.5 Please note that there are nine other minor actions for the improvement in the control environment which are included within the management action plan. [Action Points 25-33] 6.6 In addition, the following improvement opportunities have been identified for consideration to further support the achievement of best value in terms of staff costs: 6.6.1 We have noted instances where overtime claims submitted by employees participating in the Flexi Scheme related to work carried out during the Page 47 of 92
Page 48
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 16 PKC - GENERAL qualifying flexi time band (typically, between 17:00 and 21:00, and between 07:00 and 08:45). While this is not inconsistent with the council’s policies, providing managers with guidance to consistently consider available flexi time arrangements, where operationally appropriate, before approving additional payments for hours worked within the qualifying flexi time band, may support consistent decision-making and help achieve best value in relation to staff costs. Wider promotion of TOIL arrangements, where appropriate, may also support better value for money by reducing reliance on additional payments. 6.6.2 Periodic communication and reminders may help improve managers’ awareness of Power BI functionality and encourage its regular use. As the tool supports the monitoring of staff costs, including overtime, its greater utilisation may contribute to achieving best value in relation to staff costs. 6.6.3 Consideration could be given to further developing Power BI to include benchmarking functionality, enabling budget holders to compare overtime levels with comparable services or teams. In addition, enhancing Power BI interface to provide the Organisational and Workforce Change team with a council-wide view of data may improve oversight and reduce the need to review individual teams separately. 6.6.4 Managers may wish to maintain records of overtime decisions, including the rationale for approval and allocation order. This would provide evidence of prior authorisation, support transparency in decision-making, and help evidence that overtime decisions were made with due regard to achieving best value in staff costs. 7. Conclusion 7.1 The Internal Audit review is able to place limited assurance on the overall control environment for the additional payments. The agreed actions, once implemented, should enable Internal Audit to place substantial assurance on these. 8. Acknowledgements 8.1 Internal Audit would like to thank all officers who were involved in this audit, particularly: L Byrne, HR Team Leader – Payroll and Reward A Craik, MyView and People Analytics Team Leader R Cassels, HR Officer - Payroll G McCaw, Organisational and Workforce Change Team Leader Page 48 of 92
Page 49
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 17 PKC - GENERAL E Bayne, Employee Relations and Wellbeing Team Leader M Fyfe-Loudon, Senior HR Assistant – MyView and People Analytics Team J Newman, HR Payroll Assistant A Craig, Financial Systems Team Leader. 9. Action Implementation & Follow up 9.1 Responsibility for the maintenance of adequate and effective controls rests with management. Where the audit has identified areas for management action, these are identified in the Management Action Plan. Where a decision is taken by management not to act in response to finding from this review, it is the responsibility of management to assess and accept the risk arising from non- implementation. 9.2 Achievement of the agreed actions is monitored through Internal Audit’s ‘follow up’ arrangements. Page 49 of 92
Page 50
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 18 PKC - GENERAL 10. Management Action Plan Action Point Para. No Finding Risk Rating Agreed Action & Evidence Action Owner Target Completion Date 1 6.2.1 There is no formally coordinated training for managers on claim authorisation processes or on compliance with pay policies. Guidelines on managerial checks are not a formal part of managers’ induction programmes. The control operates with significant reliance on managers’ understanding of the policies and guidelines and on informal knowledge transfer from colleagues. 2 - Low Agreed action: Cross-team action involving: Organisational Development team - incorporate requirements into manager induction. Policy team - provide input for the training video to ensure overtime policy is adequately covered. Payroll team - provide input on claim processes, completion requirements and common errors. Agreed evidence: Manager learning materials published and incorporated into manager induction programme. C Judge, Organisational Development Team Leader Dec 2026 2 6.2.2 The majority of additional payment claims are submitted and authorised in paper format 4 - High Agreed action: Explore the feasibility of automating Single Status claim submission and approval A Craik, MyView and People Analytics Team Leader Jun 2027 Page 50 of 92
Page 51
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 19 PKC - GENERAL outside the payroll system. As a result, authorisations must be verified manually before claims are processed. This approach is time-consuming and increases the risk of fraud or error. Opportunities to introduce a system-based managerial approval workflow and greater automation of the claim process should be further explored to strengthen controls and improve operational efficiency. through the MyView Irregular Claims Module to reduce reliance on manual verification of authorised signatories against the Authorised Signatory Database (ASD). Agreed evidence: Evidence of engagement with Zellis regarding MyView Irregular Claims functionality and a documented specification to handle self-service claims within the General Payroll. L Byrne, HR Team Leader – Payroll and Reward 3 6.2.3 Current arrangements place significant reliance on managerial review and authorisation. Testing identified instances where timesheets contained inaccuracies and calculation errors that were not identified or corrected during authorisation process. This indicates that the level of verification performed by authorising managers may not 4 - High Agreed action: Develop and publish a Manager Authorisation Checklist and support guidance for overtime/additional payments. The guidance will set out the checks expected before authorising claims. Agreed evidence: Published Manager Authorisation Checklist and supporting guidance available L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 51 of 92
Page 52
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 20 PKC - GENERAL always be sufficient to identify errors. Managerial authorisation should therefore include explicit verification of claim accuracy, including calculations, day types, dates, times and reasons. on Eric and communicated to managers. 4 6.2.4 Not all managers contacted during testing maintained records or supporting documentation that could be used to verify the accuracy of claims. Managers should ensure that they retain sufficient records to support the effective review and authorisation of claims, particularly where claims are authorised in the line manager’s absence. 4 - High Agreed action: Record retention requirements for authorising managers will be incorporated within the checklist and guidance under Action 3. Agreed evidence: Evidence as detailed under Action Point 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 5 6.2.5 It was observed that required information was not consistently captured in claim forms, despite completeness 3 - Medium Agreed action: Requirement for managers to verify that claim forms are complete and accurately L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 52 of 92
Page 53
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 21 PKC - GENERAL being a requirement of the guidance (“Date, Day Type, From, Break Taken, To, Hours Claimed, Reason columns must be completed in all cases”). Managerial authorisation should therefore include completeness checks. In addition, one manager was observed to have added missing working pattern details that appeared to be incorrect in a number of instances. Where incomplete information is identified, managers should ensure that any missing details are completed accurately. completed before authorisation will be included in the guidance. Agreed evidence: Evidence as detailed under Action Point 3 – published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. 6 6.2.6 Some sampled claim forms were signed and dated by employees at various stages of the claimed period, including before all claimed time had been worked and, in other cases, weeks or months after the work had been completed. 3 - Medium Agreed action: The Manager Authorisation Checklist and supporting guidance developed under Action 3 will reinforce expectations regarding the timely completion, submission and authorisation of claims. Agreed evidence: L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 53 of 92
Page 54
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 22 PKC - GENERAL Timekeeping practices should be improved to support the timely and accurate recording of time worked. Employees should complete claim forms as work is performed and sign them at the end of the relevant period, rather than in advance or significantly after the event. Evidence as detailed under Action Point 3 – published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. 7 6.2.7 Older versions of Single Status claim forms (for part-time additional hours, overtime hours and sleep-in payments, as well as for standby and disturbance allowances), which are not aligned with the current forms used in the PKC, were found to be in use by some teams. These forms did not include key fields such as break length, overtime reason, working pattern day types or employee declaration, and some also contained outdated pre-populated pay rates. 3 - Medium Agreed action: The issue raised in this finding has now been partially addressed through the introduction of updated Payment Claim Form for the teams referred above (covering part-time hours, overtime hours and sleep-in payments). However, the action remains partially complete, as the effectiveness of the revised forms depends on employees consistently using the current approved versions rather than any previous forms. Payroll will email the relevant service confirming the requirement to use only current approved version of the forms. L Byrne, HR Team Leader – Payroll and Reward Sep 2026 Page 54 of 92
Page 55
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 23 PKC - GENERAL This creates a risk of inaccurate or inconsistent claim completion and may result in incorrect payments. Where outdated forms are identified during payroll processing, these will be returned for resubmission using the current approved version. Agreed evidence: Payroll will retain copy of the email to the relevant service confirming the requirement to use the current approved published form. 8 6.2.8 Where claim forms are pre- completed, there is an increased risk that outdated or inaccurate information may be carried forward into claims, potentially affecting the accuracy of payment processing. 2 - Low Agreed action: The Manager Authorisation Checklist and supporting guidance developed under Action 3 will remind managers to verify the accuracy and relevance of any pre-populated information prior to authorisation. Agreed evidence: Evidence as detailed under Action Point 3 – published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 55 of 92
Page 56
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 24 PKC - GENERAL 9 6.2.9 We identified some inconsistencies in the forms used for the same type of payment, including across comparable roles within the same service area. This increases the risk that required information may not be captured consistently. Managers should ensure that employees are aware which claim form to use for each type of payment. 2 - Low Agreed action: Payroll will review and rationalise guidance relating to additional payment claim forms and will communicate the approved forms to be used for each claim type. The Manager Authorisation Guidance developed under Action 3 will also reinforce managers' responsibilities for ensuring the correct claim form is used prior to authorisation. Where non- approved forms are received, they will be returned for resubmission using the appropriate approved form. Agreed evidence: Updated payroll guidance and communication issued to managers and employees confirming the approved claim forms for each payment type. Evidence of the Manager Authorisation Guidance published under Action 3. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 10 6.2.10 Despite the guidance explaining which post title should be entered in the 4 - High Agreed action: The overtime claim form and guidance will be updated to clarify that where additional L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 56 of 92
Page 57
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 25 PKC - GENERAL relevant field of the claim form, this requirement still appears to be either misunderstood or misinterpreted by employees and managers. According to Payroll, employees should be paid based on the post being covered, rather than their substantive post. Payments are processed based on the post title recorded on the claim form and authorised by the manager, rather than on the analysis of the reason for the additional work. This highlights a weakness in overtime approval controls and increases the risk of payments being processed at an incorrect rate. Managers should ensure that the post title recorded on the claim form reflects the duties work is undertaken outside an employee's substantive post, the appropriate claim process must be used. Guidance will be provided to managers and employees to support correct completion and authorisation of claims. This requirement will also be incorporated into the Manager Authorisation Guidance developed under Action 3. Agreed evidence: Updated overtime claim form, supporting guidance and Manager Authorisation Guidance issued to managers. Page 57 of 92
Page 58
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 26 PKC - GENERAL undertaken, rather than the employee’s substantive role. It should be considered whether claim forms could be amended to distinguish between an employee’s substantive post and the post for which the claim is submitted. Separate fields for each would help to reduce the risk of claims being processed at an incorrect rate. 11 6.2.11 Payroll staff do not routinely validate claim form inputs, including calculations, eligibility or alignment with supporting timekeeping records such as rotas. System validation is limited to confirming that employee and post numbers exist and does not verify that they relate to the correct employee. Manual validation is also limited and generally focuses on contracted hours and post details. 4 - High Agreed action: The Manager Authorisation Checklist and supporting guidance developed under Action 3 will clarify managers' responsibilities for verifying claim accuracy, eligibility and supporting information before authorisation. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 58 of 92
Page 59
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 27 PKC - GENERAL As a result, the reliance is placed on managerial approval, except where issues are sufficiently obvious to be identified during payroll processing. This control weakness increases the risk of error, fraud and incorrect payments. 12 6.2.12 Overtime rates depend on employees’ work patterns and day types, however, these are not routinely validated during payroll processing due to the time required to complete them, including where day type information is missing from claim forms. While working pattern information is available within the payroll system, it does not clearly distinguish between non-working and rest days. As a result, where day type information is unavailable on the claim forms or cannot be 4 - High Agreed action: The Manager checklist and guidance will incorporate that day types must be detailed on the claim form. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 59 of 92
Page 60
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 28 PKC - GENERAL readily verified, Payroll staff default to applying straight time for initial overtime hours. This increases the risk of incorrect pay elements, overtime rates and multipliers being applied, potentially resulting in underpayments. 13 6.2.13 Pay elements are allocated manually by Payroll staff before being entered into the payroll system. Testing identified occasional instances where inappropriate pay elements or incorrect unit quantities were applied, resulting in payment errors. Reliance on manual allocation increases the risk of mistakes. Opportunities to automate the allocation of pay elements should be explored to reduce reliance on manual intervention and improve the accuracy and 4 - High Agreed action: Payroll will strengthen quality assurance arrangements by introducing periodic spot checks across the end-to-end process to verify that: • claims have been prepared correctly; • information has been accurately transferred to payroll upload documentation; • the correct pay elements and values have been uploaded; and • payments have been processed correctly through to employee payslips. L Byrne, HR Team Leader – Payroll and Reward Mar 2027 Page 60 of 92
Page 61
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 29 PKC - GENERAL consistency of payroll processing. Whilst opportunities for automation will continue to be explored, the complexity of the current overtime and additional payments framework means that full automation is not currently feasible. Payroll will therefore continue to strengthen validation and assurance checks to mitigate the risk of processing or upload- related errors and will consider further improvements as part of future payroll system developments and any wider review of overtime arrangements. Agreed evidence A documented programme of payroll spot checks covering authorised claim forms, payroll upload documentation, payroll system records and employee payslips. Records of spot checks undertaken, findings identified, corrective action taken and lessons learned communicated to the payroll team. Page 61 of 92
Page 62
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 30 PKC - GENERAL 14 6.2.14 While monthly payroll submission deadlines are in place for Single Status employees, there is no formally defined time limit for the submission of claim forms relating to previous periods. As a result, claims may be submitted several months after the work was performed, increasing the risk of delayed processing and inaccuracies where claim details are completed or approved after the event. The absence of a formal cut-off date also reduces visibility of outstanding historical claims and assurance that all claims relating to a period have been identified and processed. Late submissions may affect the accuracy of budget monitoring and alter the payroll period in which pensionable pay and 2 - Low Agreed action: Will reflect a 3-month cut-off date within the Manager’s guidance and on claim forms. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 62 of 92
Page 63
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 31 PKC - GENERAL National Insurance contributions are calculated. Consideration should be given to introducing a formal cut-off date for retrospective claims and strengthening proactive follow-up by managers, including timely enquiries where claim forms are not submitted within expected timeframes. 15 6.2.15 No formal claim submission deadlines have been established for Craft employees. This results in inconsistent submission practices and reduces assurance that claims are submitted in a timely manner. In the absence of defined deadlines, delayed submissions may not be identified and followed up promptly by managers. 2 - Low Agreed action: A formal submission deadline document will be created for Craft employees. Agreed evidence: Updated submission deadlines on Eric. L Byrne, HR Team Leader – Payroll and Reward Completed Page 63 of 92
Page 64
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 32 PKC - GENERAL 16 6.2.16 Manual and system-based (MyView) claims are processed through separate arrangements and are not routinely reconciled against one another. Payroll does not routinely perform checks to identify overlapping or incompatible claims across different sources, including manual claim forms, system- generated claims and flexi time records (Optimum). Employees may submit additional payment claims that overlap with other recorded absences (for example, annual leave or sick leave), payments, flexi time records or standby commitments, contrary to the requirements of the Overtime, Standby and Callout and the Flexi Scheme policies, which outline that overtime and flexitime cannot be claimed for the same period. This increases the risk of duplicate 4 - High Agreed action: The Manager Authorisation Checklist and supporting guidance developed under Action 3 will include guidance on verifying that claims do not conflict with annual leave, sickness absence, flexi arrangements, standby commitments or other working arrangements. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 64 of 92
Page 65
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 33 PKC - GENERAL or incompatible claims being processed and paid. While managerial authorisation and exception reporting provide key level of control, these arrangements may not identify all conflicts between claims, particularly where managers oversee large teams or do not maintain supporting records to validate claims. Managers should ensure that claims do not conflict with each other prior to authorising them. Consideration should be given to introducing automated validation or reconciliation controls to identify overlapping claims and reduce reliance on manual checks where applicable. 17 6.2.17 We identified that there are no automated controls in place to prevent employees from exceeding the maximum 4 - High Agreed action: Reinforce flexi time rules to managers, as responsibility for spot checking flexi balances lies A Craik, MyView and People Analytics Team Leader Mar 2027 Page 65 of 92
Page 66
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 34 PKC - GENERAL permitted flexi time debit balance or taking more flexi leave than allowed under the Flexi Scheme Policy. The system also permits flexi leave to be booked where an employee has already exceeded the permitted debit balance. Responsibility for monitoring compliance with the Flexi Scheme Policy rests with managers. Although managers have access to employees’ flexi time balances, there are currently no alerts or exception reports to proactively notify them of potential breaches or excessive debit balances, as was previously the case. As a result, identification of non- compliance with the policy requirements relies on managers carrying out regular manual reviews and may not occur in a timely manner. with them, through guidance and communications. Agreed evidence: Evidence as detailed under Action 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. Page 66 of 92
Page 67
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 35 PKC - GENERAL In addition, the system automatically deducts thirty minutes where lunch breaks are not recorded. While this provides a default control, it may not always reflect actual break durations and could affect the accuracy of flexi time balances. Collectively, these control weaknesses increase the risk of inaccurate flexi time records, excessive debit balances and unauthorised flexi leave. They may also result in financial loss to the PKC, particularly where employees with significant debit balances terminate their employment and Payroll is required to recover the overpaid amount, which may not always be fully recoverable. 18 6.3.1 No formal schedule is in place for the periodic review of policies and guidance. As a result, number of documents 2 - Low Agreed action: An HR Policy Register is already in place; however, the process will be strengthened and formalised to ensure S Lawson, Employment Equality and Policy Team Leader Mar 2027 Page 67 of 92
Page 68
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 36 PKC - GENERAL have not been reviewed for over five years. This increases the risk that policies and guidance become outdated and that employees and managers may rely on inaccurate or obsolete information. policies and supporting guidance are subject to regular review and monitoring. Policy review status will be monitored through the People & Culture Team Leaders' meetings as a standing agenda item. Agreed evidence: Updated HR Policy Register. 19 6.3.2 Pay guidelines are not consistently updated following annual changes to pay and related arrangements. Some reference links within the guidelines have not been maintained and are no longer functional, including links to the Scheduled Pay Periods document. In addition, two guidance documents reviewed continue to refer to superseded service names: ESC and CDS. This may reduce the effectiveness of the guidance, limit access to supporting information and undermine 2 - Low Agreed action: A review will be undertaken of the Overtime, Standby and Callout Policy, Payroll FAQ and associated payroll guidance documents to remove outdated references, correct broken links and ensure links are made to centrally maintained documents where appropriate. This will reduce the need for multiple documents to be updated following routine pay changes. Agreed evidence: Evidence of review including correction of broken or outdated links. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 68 of 92
Page 69
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 37 PKC - GENERAL confidence that users are referring to accurate and up-to- date information, even where the refenced document remains available elsewhere on ERIC. 20 6.3.3 Policy and guidance reviews do not consistently identify all content requiring amendment or removal. As a result, outdated information may remain within published documentation despite reviews having been undertaken. This increases the risk of employees relying on superseded documentation and may create confusion regarding current terms, conditions and related arrangements. 2 - Low Agreed action: Strengthen review checks. Agreed evidence: Removal of obsolete references and superseded documents. S Lawson, Employment Equality and Policy Team Leader Dec 2026 21 6.3.4 During interviews and testing, we were unable to identify a designated officer or team with overall responsibility for monitoring compliance with the Working Time Regulations and overseeing related activities. As 4 - High Agreed action: Subsequent to the audit testing period, a number of controls have been introduced to strengthen compliance with the Working Time Regulations. These include an online opt-out process, annual renewal L Byrne, HR Team Leader – Payroll and Reward Mar 2027 Page 69 of 92
Page 70
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 38 PKC - GENERAL a result, there appeared to be limited central oversight of working hours, opt-out agreements and associated regulatory requirements. No opt-out agreements were identified within the Resourcelink records reviewed during testing. This included an employee whose average working hours over a seventeen-week period were 61 hours per week. Under the Working Time Regulations, a documented opt-out agreement should be in place where working patterns have the potential to exceed an average of 48 hours per week over the relevant reference period (seventeen weeks). Evidence of such an arrangement was not available within the record examined. However, we acknowledge that, subsequently to the audit reminders via MyView, manager communications clarifying responsibilities for monitoring working hours, and development of a reporting mechanism to identify employees whose average working hours exceed the 48- hour limit over the 17-week reference period. The Working Time Regulations monitoring process will be documented to formalise ownership, reporting arrangements and follow-up activity where potential non- compliance is identified. Agreed evidence: Copy of Manager communication issued regarding Working Time Regulations responsibilities. Email triggers for annual renewal. Working hours monitoring report has been developed covering the 17-week reference period. Evidence of its ongoing use. Page 70 of 92
Page 71
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 39 PKC - GENERAL testing period, steps were taken by People and Culture Team to strengthen the controls. In April 2026, an online opt-out form was introduced, and communication was issued to employees regarding completion and renewal requirements. Managers were also separately reminded of their responsibilities. We further noted that MyView reminders are now expected to support annual renewal of opt- out forms and that working patterns will be reviewed where an employee without an opt-out agreement is identified as exceeding the 48-hour average limit. In addition, we were advised that the updated arrangements include a dedicated reporting solution to proactively identify such employees. The Working Time Regulations monitoring process documented. Page 71 of 92
Page 72
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 40 PKC - GENERAL 22 6.3.5 Payroll reconciliations are performed as part of each pay cycle and include consistency checks between payroll reports, review of HMRC Gateway statements, confirmation of payments made, and spot checks of PAYE and National Insurance values reported through Full Payment Submission (FPS) and Employer Payment Summary (EPS) submissions. However, while individual review activities are performed, there is no routine documented end-to-end numerical reconciliation of the total PAYE and National Insurance amounts across all sources - payroll reports, FPS and EPS submissions (as applicable), HMRC statements and payments made to HMRC. In our inquiry, we were advised that review of HMRC 2 - Low Agreed action: Develop and implement a documented monthly PAYE and National Insurance reconciliation process to reconcile payroll reports, FPS/EPS submissions, HMRC Gateway statements and payments made to HMRC. Any variances identified will be investigated, documented and resolved as part of the reconciliation process. Agreed evidence: Completed monthly PAYE and National Insurance reconciliation records, including evidence of review, investigation of variances (where applicable) and sign-off. A Craik, MyView and People Analytics Team Leader Mar 2027 Page 72 of 92
Page 73
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 41 PKC - GENERAL statements is considered sufficient to identify any outstanding amounts or discrepancies and that any variances arising would be captured through existing processes, for example, through the HMRC Annual Return spreadsheet. However, assurance over the completeness and accuracy of reported amounts relies on a combination of separate review activities, rather than a single documented reconciliation across all key stages of the payroll reporting and payment process. The control framework could be strengthened by introducing a documented monthly end-to- end numerical reconciliation of the total PAYE and National Insurance amounts across these sources, with any variances identified, investigated, documented and Page 73 of 92
Page 74
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 42 PKC - GENERAL resolved. This would provide clear evidence that reported amounts are complete, accurate and consistent. 23 6.3.6 An overpayment recovery process is in place, and a draft policy has been developed to formalise the process. However, as the policy has not yet been approved, there is a risk that the process may not be applied consistently. 2 - Low Agreed action: Finalise and approve the Overpayment Recovery Policy to formally document existing overpayment recovery arrangements, responsibilities and controls. Agreed evidence: Publication of approved Overpayment Policy. L Byrne, HR Team Leader – Payroll and Reward Mar 2027 24 6.4.1 In certain services, there appears to be a continued reliance on overtime to support routine operations. This is inconsistent with the Overtime, Standby and Callout Policy, which states that employees should not be required to consistently work overtime. The pattern of overtime usage suggests that it is being used to address workforce resourcing pressures. Audit testing 3 - Medium Agreed action one: Improve access to overtime data and budget ownership information. Explored with Payroll how the Organisation and Workforce Change Team can directly access additional payment information and supporting documentation to identify budget holders and service areas, recognising that overtime costs are not always G McCaw, Organisational and Workforce Change Team Leader Completed Page 74 of 92
Page 75
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 43 PKC - GENERAL identified examples where overtime was used over extended periods to maintain service delivery while vacancies remained unfilled for prolonged periods, indicating resourcing pressures in certain areas. Consideration should be given to identifying further opportunities to reduce reliance on overtime in areas where it is routinely used to support service delivery, including through measures aimed at reducing the duration of vacancies where appropriate. incurred within an employee's substantive service. Agreed evidence one: Payroll Team Leader will provide links to appropriate payroll source folders by 07/08/2026. Agreed action two: Develop enhanced corporate reporting on additional payments. Systems Team are developing a Power BI report which will provide a consolidated view of both overtime and casual hours, improving transparency and supporting management oversight. Agreed evidence two: Demonstration and implementation of Power BI reporting solution to highlight total additional hours. Agreed action three: Consider development of a G McCaw, Organisational and Workforce Change Team Leader G McCaw, Dec 2026 Dec 2026 Page 75 of 92
Page 76
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 44 PKC - GENERAL forum to discuss supplementary hours. We will consider developing a forum to discuss supplementary hours if there is a sensible alignment across services. Agreed evidence three: Evidence of overtime and supplementary hours being reviewed through operational workforce discussions at the new dedicated forum (or of consideration of its development). Agreed action four: Introduce monthly reviews of longer-term solutions to reduction of overtime/supplementary hours. The Health and Social Care Workforce Planning Manager, Service Manager Brian Kinnear and Organisational and Workforce Change Team Leader met to discuss longer- term solutions to reduction of overtime/supplementary hours using the new early Power BI Organisational and Workforce Change Team Leader G McCaw, Organisational and Workforce Change Team Leader B Kinnear, Service Manager HSCP Z Musembya, Health and Social Care Workforce Planning Programme Manager HSCP Dec 2026 Page 76 of 92
Page 77
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 45 PKC - GENERAL data and will review monthly when data is available to share from the Systems Team. Agreed evidence four: Evidence of monthly reviews of longer-term solutions to reduction of overtime/supplementary hours using the new early Power BI data. Agreed action five: Consider replication of a Health workforce model in Social Care. We will consider a model being developed in Health around a nursing pipeline to see if it could be replicated in Social Care. This will be considered when the SBAR to HSCP SMT is approved (no date planned yet). Agreed evidence five: Evidence of replication of a Health workforce model in Social Care (or of consideration of its replication). G McCaw, Organisational and Workforce Change Team Leader B Kinnear, Service Manager HSCP Z Musembya, Health and Social Care Workforce Planning Programme Manager HSCP Dec 2026 Page 77 of 92
Page 78
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 46 PKC - GENERAL 25 6.5 Not all relevant supporting documents and correspondence are consistently retained within the appropriate payroll EDMS folders (for example, rotas, authorising emails), reducing the effectiveness of document retention arrangements. However, the records requested during the audit were subsequently made available. 1 - Minor Agreed action: Payroll Team Leader will remind colleagues of the requirement to transfer supporting documentation and correspondence (authorising emails and rotas) from generic inbox to EDMS. Whilst supporting records are retained and made available during the audit, it is recognised that due to the volume of payroll transactions and the short timescales involved, this can lead to documents not being transferred to EDMS. Automation and digital process improvements will remove the need for authorised emails. Agreed evidence: Reminder of document retention raised at the Payroll Team Meeting (06/07/26). Any actions for Payroll will be followed up in writing to the Team once the Audit Report is finalised. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 78 of 92
Page 79
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 47 PKC - GENERAL 26 6.5 Inconsistent specimen signature documentation was identified for some sampled authorisers. This included one form that did not capture personal details and a previously completed form that appeared to have been reused, with previous details crossed out and amended. This reduces consistency in documentation supporting authorisation arrangements. 1 - Minor Agreed action: Guidance will be issued to managers reminding them of their responsibilities regarding authorised signatory arrangements and the need to ensure records remain up to date. In parallel, Payroll and MyView and People Analytics (MVPA) will continue exploring system-based authorisation through MyView, which would replace reliance on manual signature verification and provide a more sustainable control environment. Agreed evidence: Evidence as detailed under Action Point 3 (published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers) and evidence of exploration of MyView claim approval functionality as detailed under Action 2. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 79 of 92
Page 80
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 48 PKC - GENERAL 27 6.5 Craft Worker Overtime and Standby Payment Claim Form is not published online, whereas forms for other employee groups are available online (Single Status and Teachers). Access to forms and supporting documents should be standardised and consistent across all employee groups, regardless of size. Publishing the form would improve transparency and help reduce delays in claim submissions. Any risk of employees using an incorrect form could be mitigated through clear labelling and guidance, particularly as a dedicated Craft employees’ website section already exists. 1 - Minor Agreed action: Publish the Craft Worker Overtime and Standby Payment Claim Form within the existing Craft employee guidance section. Agreed evidence: Relevant documents on Eric under Craft Workers Section. L Byrne, HR Team Leader – Payroll and Reward Completed 28 6.5 The overtime approval requirements within the Overtime, Standby and Callout Policy are not clearly defined. In particular, it is not clear whether references to approval relate to prior authorisation of overtime working, approval of claims for payment, or both. 1 - Minor Agreed action: The Overtime, Standby and Callout Policy will be updated to clarify the requirements for both the authorisation of overtime working and approval of overtime claims for payment. Agreed evidence: Revised policy published. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 80 of 92
Page 81
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 49 PKC - GENERAL 29 6.5 The Overtime, Standby and Callout Policy does not clearly state how “non-working days” should be treated for overtime payment purposes. Claim forms distinguish between “normal working days”, “rest/free days” and “non- working days”, however, the policy refers only to the first two categories. Clarifying this within the policy would support managerial understanding and promote more consistent authorisation of claims. 1 - Minor Agreed action: Policy will be updated and will be included in Manager Guidance. Agreed evidence: Published Policy and Manager Guidance as per Action Point 3. L Byrne, HR Team Leader – Payroll and Reward Dec 2026 30 6.5 We were advised that documented procedures are not considered necessary, as additional payments are processed in accordance with the relevant policies, and applicable pay elements are configured within the Resourcelink to apply the appropriate enhancements. Payroll staff apply these arrangements based on claim 1 - Minor Agreed action: The Payroll Team will create a “how to guide” for each service area to flag key points that are not necessarily recorded in policy documents (internal points only). Agreed evidence: Payroll processing guidance notes and "how to" documents L Byrne, HR Team Leader – Payroll and Reward Dec 2026 Page 81 of 92
Page 82
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 50 PKC - GENERAL form submissions and the relevant policy criteria. However, consideration should be given to documenting key processing procedures to support consistency, knowledge retention, and a common understanding of claim processing requirements across the team. completed and made available to relevant payroll staff. 31 6.5 We noted that, despite the existence of the Craft Callout pay element, no Craft callout payments were identified within the additional payments reports during the period under review. Payroll confirmed that the pay element remains available for use. Consideration should be given to reviewing the ongoing use of this pay element with the relevant service. 1 - Minor Agreed action: Will seek confirmation from the service whether this pay element is required in future. Agreed evidence: Email communication between Payroll and the Service. R Cassels, HR Officer - Payroll Aug 2026 32 6.5 We identified instances where work patterns recorded within the Resourcelink did not align with those reflected in claim forms reviewed during testing. The accuracy of these records is the responsibility of 1 - Minor Agreed action: Introduce periodic communications and guidance to managers reminding them of their responsibility to notify HR/Payroll promptly of A Craik, MyView and People Analytics Team Leader Dec 2026 Page 82 of 92
Page 83
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 51 PKC - GENERAL managers, who should ensure that any relevant changes are notified to HR on a timely basis. Periodic verification of work pattern information could also be considered. contractual and working pattern changes. Agreed evidence: Evidence as detailed under Action Point 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. 33 6.5 Delays by managers in notifying Payroll of contractual changes and leavers increase the risk of payroll overpayments. 1 - Minor Agreed action: Introduce periodic communications and guidance to managers reminding them of their responsibility to notify HR/Payroll promptly of contractual and working pattern changes. Agreed evidence: Evidence as detailed under Action Point 3 - published Manager Authorisation Checklist and supporting guidance available on Eric and communicated to managers. A Craik, MyView and People Analytics Team Leader Dec 2026 Page 83 of 92
Page 84
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 52 PKC - GENERAL 11. Authorisation 11.1 The auditor for this assignment was K Tarnowska. The supervising auditor was D Arachchilage. This report is authorised for issue:............. 12. Distribution 12.1 This report has been distributed to: T Glen, Chief Executive C Mailer, Depute Chief Executive G Boland, Strategic Lead, Strategic Planning, People and Performance P Johnstone, People and Culture Manager, Human Resources L Byrne, HR Team Leader – Payroll and Reward, Human Resources A Craik, HR Systems Team Leader, Human Resources All Strategic Leads Committee Services External Audit. Page 84 of 92
Page 85
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 53 PKC - GENERAL 13. Assessment Definitions 13.1 The following table contains the definitions of the control objective assessment. Control Objective Assessment Level of assurance Definition Substantial Assurance A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. 13.2 The following table contains the definitions applied by Internal Audit in rating audit findings/actions. Risk Rating for Individual Findings Rating Rating description Definition 5 Critical Significant observations/ major concerns which require immediate action. Management will need to add these to the appropriate Service risk register. Issue represents a control weakness which could cause, or is causing, severe disruption of the process or severe adverse effect on the ability to achieve process objectives 4 High Significant observations regarding the absence / failure of key controls requiring urgent action. Management should consider adding these to the appropriate Service/ divisional risk register Issue represents a control weakness which could have, or is having, major adverse effect on the ability to achieve process objectives 3 Medium Observations regarding the effectiveness of key controls requiring reasonably urgent action. Management should consider these when updating any divisional / team risk registers. Page 85 of 92
Page 86
Fd7c5c68-15cf-4193-85f0-0816a20cc25f.Docx4 54 PKC - GENERAL Issue represents a control weakness which could have, or is having, significant adverse effect on the ability to achieve process objectives 2 Low Minor observations regarding the adequacy of controls which require action to improve the efficiency, effectiveness, or economy of operations or which otherwise require to be brought to the attention of Senior Management Issue represents a minor control weakness with minimal but reportable impact on the ability to achieve process objectives 1 Trivial / Minor Very minor observations which will be raised during the audit and may not be included within the final report Issue represents a very minor control weakness with negligible impact on the ability to achieve process objectives. The issue will be raised during the audit and may not be included within the final report. Page 86 of 92
Page 87
Our vision is a Perth and Kinross where everyone can live life well, free from poverty and inequality ___________________________________________________________________ Committee or Board: Audit & Risk Committee Date of Meeting: 21 September 2026 Report Title: National Fraud Initiative Outcomes 2024/25 and Preparations 2026/27 Report Number: 26/257 Report Author: Jackie Clark, Chief Internal Auditor Organisational Lead: Strategic Lead – Legal and Governance ___________________________________________________________________ 1. Purpose 1.1 The purpose of this Report is to present the reported findings of the 2024/25 National Fraud Initiative (NFI) exercise. It also outlines the preparations currently underway in respect of the 2026/27 exercise. 1.2 Sections 1. Purpose 2. Recommendations 3. Background/Context 4. Progress Update 5. Outcome from Consultancy Work 6. Conclusion 7. Impact Value Assessment 8. Appendices 2. Recommendation It is recommended that the Audit and Risk Committee: 2.1 notes the outcomes as reported within the national Audit Scotland report of the National Fraud Initiative 2024/25; and 2.2 notes the work undertaken within the Council in preparation for the 2026/27 exercise. 2.3 approves the section of Audit Scotland’s self-appraisal checklist relating to those charged with governance at Appendix A. 8 Page 87 of 92
Page 88
3. Background/Context 3.1 The National Fraud Initiative (NFI) constitutes a sophisticated data matching exercise matching electronic data within and between participating public bodies to assist in the prevention and detection of fraud. The Cabinet Office is responsible for the administration of the NFI in the UK. The NFI exercise in Scotland is Audit Scotland’s data matching exercise that runs every two years in line with the published timetable. The Cabinet Office processes the data for the NFI in Scotland on behalf of Audit Scotland. This 2022/23 exercise represents the eighth NFI data matching to be undertaken in Scotland. 3.2 The overall aims of the NFI are to serve the public interest by safeguarding public money against losses from fraud or misappropriation and to contribute towards the fight against fraud. It improves the use made of public resources by identifying anomalies in the data held by different authorities and by ensuring that these are highlighted for further investigation. Whilst it is designed to detect fraud, it may also identify instances of administration error or inaccurate data. 3.3 The NFI exercise helps participating bodies (such as Local Authorities, Police Scotland, Scottish Fire and Rescue and the other public sector bodies) to identify possible cases of fraud and detect and correct any consequential under or overpayments. The NFI also helps Auditors in assessing the Council’s arrangements for preventing, deterring and detecting fraud. 3.4 There are broadly three stages in the NFI process: 1. the submission of the required datasets by public authorities and other organisations; 2. the processing of the data (data matching) in order to identify anomalies; and 3. the investigation of the highlighted and reported anomalies 3.5 The Council is responsible for stages 1 and 3; processing of the data (stage 2) is carried out under arrangements put in place by the Cabinet Office. Reports on the Council’s involvement and responsibilities have previously been presented to the Audit & Risk Committee. More recently, a report highlighting the outcomes for Perth & Kinross was presented to the Audit & Risk Committee in June 2026 (report 26/200). 4. 2024/25 National Report 4.1 The “outcomes” arising directly from the 2024/25 investigations, as reported in Audit Scotland’s National Fraud Initiative in Scotland Report of August 2026, are £21.7m, which is broadly similar to the outcomes from the 2022/23 outcomes, which were £21.5 million. 4.2 The proportion of the figure attributable to Perth and Kinross Council is £131,236, as reported previously to Audit & Risk Committee (report 264/200). Page 88 of 92
Page 89
5. 2026/27 Preparations 5.1 Audit Scotland’s report provides a self-appraisal checklist which has been completed for 2024/25 and actions identified in order to improve arrangements are being taken forward. Part A of this checklist is entitled “for those charged with governance” and is attached at Appendix 1 for approval by the Audit & Risk Committee. 5.2 Internal Audit is currently liaising with relevant contacts within Services concerning 2026/27 requirements and will liaise with the Council’s external auditors in due course. As part of preparations, any learning from outcomes from previous NFI exercises will be considered. 5.3 It is anticipated for 2026/27 as in previous exercises, that additional datasets will be requested mid cycle e.g. Council Tax and Electoral Register data. 5.4 Data protection legislation requires that individuals whose personal information is to be provided for NFI purposes are informed. This is undertaken by the provision of privacy notices. Internal Audit will facilitate the processes whereby, where appropriate, data subjects are notified of the use of their personal data in the exercise for preventing and detecting fraud. 5.5 In addition, Internal Audit will support Services to ensure that the relevant datasets are submitted in accordance with the NFI timetable. 5.6 The proposed Council dataset submissions for 2026/27 are: Dataset Mandatory / Risk Based Privacy Notice required? Payroll Mandatory Yes Pensions (provided by Dundee City Council) Mandatory Yes Housing Tenants Mandatory Yes Housing Waiting Lists Mandatory Yes Licenses Mandatory Yes Blue badges resident parking (transport passes and permits) Mandatory Yes Trade Creditors (standing data) Mandatory No (not personal data) Trade Creditors (payments data) Mandatory No (Not personal data) Council Tax Mandatory Yes Council Tax Reduction Scheme Mandatory Yes Business Grants Mandatory No (not personal data) Personal Budget Mandatory Yes Private Supported Care Homes Mandatory Yes Page 89 of 92
Page 90
5.7 A further mandatory dataset is the Electoral Register, however the Committee has been informed previously that it is the opinion of the Strategic Lead for Legal and Governance that the Council is not permitted to share this information for the purposes of NFI. This opinion is being reviewed for the current exercise and any changes will be reported to the Committee. 5.8 A further update report will be presented to the Audit & Risk Committee in due course 6. Conclusion 6.1 Perth & Kinross Council takes seriously its obligations for taking part in the NFI exercise and the 2024/25 exercise is now fully complete. This report outlines the reported findings from the 2024/25 National Fraud Initiative exercise and the action being taken by Perth & Kinross Council in response to the requirements of the National Fraud Initiative for 2026/27. 7. Impact Value Assessment 7.1 This report has been classified as being an operational report and as such does not require a full Impact and Value Assessment. 8. Appendices 8.1 Appendix 1 - Part A of Audit Scotland’s Self-Assessment Checklist for those charged with governance Page 90 of 92
Page 91
Appendix 1 Prepared by Audit Scotland | August 2026 National Fraud Initiative in Scotland Self-appraisal checklist Part A: Is action Who by and For those charged with governance Yes/no/partly required? when? Leadership, commitment and communication 1. Are NFI participation and delivery arrangement considered as part of the wider fraud risk assessment process? Yes No 2. Is the NFI an integral part of our corporate policies and strategies for preventing and detecting fraud and error Yes No 3. Are we committed to NFI? Has the council/board, audit committee and senior management expressed support for the exercise and has this been communicated to relevant staff? 4. Partly Support for NFI requested of the Audit & Risk Committee in this paper Chief Internal Auditor September 2026 4. Does our Key Contact have sufficient authority and time to ensure that NFI is delivered effectively? Yes No 4. 5. Has the approach to follow up of different NFI match types been clearly set out and reported as part of the bodies NFI planning process? Yes No 5. 6. Does the approach to follow-up optimise the use of available resources to address risks and maximise savings? Yes No 6. 7. Are NFI progress and outcomes reported regularly to senior management and elected/board members (eg, the audit committee or equivalent)? Yes No 7. 8. Where we use a third-party provider for matching and follow-up of council tax single person discounts, and not the NFI, have we considered sharing the NFI matches with them? N/a N/a 8. 9. Do we review how frauds and errors arose and use this information to improve our internal controls? Yes No 8 Page 91 of 92
Page 92
9. 10. Do we have access to suitably qualified fraud investigation resources to ensure suspected frauds can be investigated thoroughly and promptly? Yes No 11. Do we publish, as a deterrent, internally and externally the achievements of our fraud investigators (eg, successful prosecutions)? 10. Not applicable 11. No 12. Source: Adapted from the Cabinet Office NFI web app Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN T: 0131 625 1500 E: info@audit.scot www.audit.scot Page 92 of 92