Item 1. Summary of Internal Audit Reports for period 01 May to 30 June 2026
Renfrewshire Council · 17 August 2026
Back to Audit, Risk and Scrutiny Board — 17 August 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
PUBLIC ___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 17 August 2026 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 01 May to 30 June 2026 ___________________________________________________________________ 1. Summary 1.1 In line with the Global Internal Audit Standards in the UK Public Sector, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement, Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details of audit engagements completed during the period 01 May to 30 June 2026 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to OneRen and Renfrewshire Integration Joint Board; • Co-ordination of the Council’s corporate risk management activity; • Management of the counter fraud team;
Page 2
PUBLIC ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 01 May to 30 June 2026. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights - None ________________________________________________________________ Author: Karen Campbell, Chief Auditor– 07768354651
Page 3
PUBLIC Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 01 May – 30 June 2026 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Children’s Services School Transport Reasonable 0 2 1 0 Finance & Resources Programme Management Reasonable 0 1 3 0 Governance Adult Services Security of Paper Documentation Reasonable 0 1 4 1
Page 4
PUBLIC Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk. • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report Children’s Services School Transport (A0058/2026/001) Date: May 2026 PUBLIC COMMITTEE SUMMARY Audit Objectives The audit objectives were to: - 1. Assess whether school transport policies are up-to-date, clearly documented, and aligned with national guidance and meet any legal obligations. 2. Verify that transport is only provided for pupils who are entitled to it based upon relevant criteria as outlined in the policies. 3. Ascertain that the appropriate provider and mode of transport have been selected for non-mainstream pupils. 4. Ensure payments to transport providers are timely, accurate and appropriately authorised. 5. Ensure quarterly and annual reports are received from Strathclyde Passenger Transport in relation to contract monitoring which highlight any issues that have arisen and ensure that appropriate actions have been taken in these instances. Audit Scope 1. Through discussions with relevant officers, documented the processes followed in relation to school transport. 2. Prepared a series of tests to enable appropriate sample testing to be undertaking to meet the above objectives. Key Audit Assurances 1. Transport arrangements for all pupils were appropriately aligned with their assessed needs, with suitable provisions put in place that were matched to requirements and operated effectively in practice. 2. Audit testing confirmed that payments to transport providers were calculated accurately, aligned with contract rates, were properly authorised, and supported by adequate documentation, demonstrating that financial controls were operating effectively. 3. Quarterly and annual contract‑monitoring reports are received from Strathclyde Passenger Transport, providing appropriate oversight of contractor performance and any issues arising through this monitoring are identified, reported, and addressed through the Council’s established processes. Key Audit Risks 1. A lack of documented policy reviews, when national guidance is updated, and absence of version control creates a risk that school transport policies are out of date or non‑compliant with national standards.
Page 6
Internal Audit Report Children’s Services School Transport (A0058/2026/001) Date: May 2026 PUBLIC 2. Not retaining evidence of transport assessments undertaken and inconsistently evidencing that the assessments have been reviewed by a second officer increases the risk of errors, inconsistent decisions, and potential challenge. Overall Audit Opinion The audit concluded that controls operating across policy governance, eligibility assessment, transport mode selection, provider payments, and contract monitoring were generally effective in supporting the delivery of school transport services. It was found that the Council does not have a formal mechanism to ensure that all school transport policies are reviewed and updated whenever national guidance, statutory requirements, or relevant legislation changes. Evidence of assessment of eligibility checks is not retained, and secondary review procedures are applied inconsistently. In addition, the Transport Eligibility Address List is not routinely updated to reflect new routes or infrastructure changes. Recommendations have been made in the report to address these issues. Management Commentary Children’s Services are currently working with a Contractor to review all school walking routes to ensure they are acceptable and this task should be undertaken by Autumn 2026. Following completion, the Home to School Transport Policy will be reviewed and updated as necessary. With regards to evidencing quality assurance checks, we are investigating ways of carrying out quality assurance checks on digital forms.
Page 7
Internal Audit Report Finance and Resources Programme Management (A0087/2025/001) Date: June 2026 PUBLIC COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to:- 1. Determine the availability and accessibility of information/tools and support which may be obtained by Services when initiating service led projects/programmes, assess for adequacy and ascertain the level of uptake of those resources. 2. Ensure that authorised Options Appraisals and Business Cases have been appropriately prepared which take into account value for money and that these have included consultation with relevant stakeholders and subject matter experts and are aligned with the Council’s strategic objectives. 3. Ensure that there is clear senior management ownership of projects and that robust governance arrangements are in place over service led projects. Audit Scope 1. Through discussion with officers within Services and the Project Management Unit (PMU) and review of available documentation, established what projects/programmes were running in Services that do not have PMU involvement. 2. Selected a sample of three service led projects for review and prepared a series of tests that enabled the objectives of the audit to be met. Key Audit Assurances 1. Governance arrangements for sampled projects were generally satisfactory, with clear ownership and regular reporting to service oversight groups. 2. Business cases for the projects reviewed demonstrated alignment with strategic objectives, considered value for money, consulted with stakeholders and subject matter experts where necessary. 3. Further audit assurance was obtained through review of Heads of Services responses to the Business As Usual Risk Assessment Module relating to Programme and Project Management. Key Audit Risks There were no key risks identified in the audit.
Page 8
Internal Audit Report Finance and Resources Programme Management (A0087/2025/001) Date: June 2026 PUBLIC Overall Audit Opinion Based on the work undertaken, Internal Audit concludes that the processes in relation to service led project management are generally adequate and operating effectively. There is clear ownership and regular service oversight, and business cases reviewed were aligned with strategic objectives and demonstrated consideration of value for money and stakeholder engagement. While opportunities for enhancement have been identified, such as formally documenting the remit of the Transformation Board and updating the guidance available on the intranet, the current process provides a reasonable level of assurance that projects are managed in a controlled and transparent manner. Management Commentary The Terms of Reference of the Transformation Board has been shared with Board Members and will be made available to all Managers. Arrangements are currently being made to update the Programme Management Unit pages on the Intranet to assist staff undertaking projects.
Page 9
Internal Audit Report Adult Services Security of Paper Documentation (B0010/2026/001) Date: May 2026 PUBLIC COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. Paper documentation is handled in line with legislation and council policies when working on and off site, including at home and on client visits, and stored securely when not being used. 2. Paper documentation is not left unattended in vehicles during the day or overnight, and secure alternatives are used where transportation or temporary storage is required. 3. Officers involved in handling paper documentation have received adequate training and there is supporting evidence to ensure that there is management oversight of training records. 4. Any loss, theft or unauthorised access to documentation is reported in line with council procedures. 5. • Confidential paper documentation is disposed of in line with council procedures. Audit Scope 1. Interviewed the appropriate officers to ascertain the systems in place for security of paper documentation. 2. For a sample of four Adult Services locations, prepared and carried out a programme of tests to enable the audit objectives to be met. Key Audit Assurances 1. Managers at each location visited stated that although they are aware of the Information Security incident procedure, there had not been any loss, theft or unauthorised access to documentation that required to be reported to the council’s Information Governance team. 2. Discussions with staff and review of documentation, at each location visited, showed that confidential paper documentation is generally disposed of in line with the council’s Confidential Waste policy. Key Risks 1. For service departments where paper records are left unattended in vehicles, there is a risk that sensitive service user data could be subject to unauthorised access. Overall Audit Opinion The audit highlighted a weakness in the system of internal control at some of the locations visited with regard to the storage of paper documentation containing personal data when visiting service users. In addition, there were some staff who have not completed their Information Governance refresher training.
Page 10
Internal Audit Report Adult Services Security of Paper Documentation (B0010/2026/001) Date: May 2026 PUBLIC Management Commentary We are currently implementing an electronic system for responding to calls within one of the services visited by the Auditors and this will eliminate the need for paper documentation to be taken out on visits. For other services, deed boxes have now been fitted to vehicles and paperwork will be locked away when visits are being undertaken. In addition all services have been directed to ensure all staff have completed their refresher training.