Item 2. Summary of Internal Audit Activity in Partner Organisations - 1 May 2026 to 30 June 2026
Renfrewshire Council · 17 August 2026
Back to Audit, Risk and Scrutiny Board — 17 August 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 17 August 2026 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Activity in Partner Organisations - 1 May 2026 to 30 June 2026 ___________________________________________________________________ 1. Summary 1.1 This report provides members with a summary of the internal audit activity within each partner body from 1 May 2026 to 30 June 2026. 1.2 Renfrewshire Valuation Joint Board –The summary of the internal audit engagement reviewing Purchasing Processes and the 2025/26 Internal Audit Annual Report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered by the Board on 22 May 2026 and is attached in Appendices 1 and 2. 1.3 Scotland Excel Joint Committee – A summary of internal audit engagement reviewing Contract Delivery Plan Processes and the 2025/26 Internal Audit Annual Report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered, by the Executive Sub- Committee on 19 June 2026 and is attached in Appendices 3 and 4. 1.4 Renfrewshire Integration Joint Board - The engagement summary for reviewing the processes in operation for preparing their Strategic Plan and the 2025/26 Internal Audit Annual Report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered, by their Audit, Risk and Scrutiny Committee on 12 June 2026 and is attached in Appendices 5 and 6. 1.5 Glasgow City Region– Internal audit services are provided by Glasgow City Council Internal Audit Services, finalised reports for each completed audit engagement are reported to the Glasgow City Region Cabinet and the
Page 2
reports are shared with member Councils. During the reporting period, the internal audit reviews of Fair Work First Compliance and Clyde Mission Heat Decarbonisation Fund Governance – Phase One were finalised and the reports are attached at Appendices 7 and 8. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to note the content of the audit reports and audit summaries that have been considered by the partner bodies. __________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plans for the partner bodies 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights – None. ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor
Page 3
PUBLIC RENFREWSHIRE VALUATION JOINT BOARD To: Renfrewshire Valuation Joint Board On: 22 May 2026 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Engagement – Purchasing Processes ___________________________________________________________________ 1. Summary 1.1 In line with the Global Internal Audit Standards in the UK Public Sector, Internal Audit must communicate the results of each engagement to the Board. 1.2 The Chief Auditor will report summaries of completed audit engagements to the Joint Board on the conclusion of each engagement for formal consideration by member in line with the best practice referred to above. 1.3 This report provides detail of the audit engagement completed in February 2026 with the overall assurance rating and the number of recommendations in each risk category. The detailed board summary for the report is also attached. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the summary for the internal audit review of the purchasing processes in operation within the Joint Board. _________________________________________________________ For further information please contact Karen Campbell on 0141 487 0678 Or via e-mail at karen.campbell@renfrewshire.gov.uk
Page 4
No embedded text on this page.
Page 5
PUBLIC Renfrewshire Council Internal Audit Service Update for Renfrewshire Valuation Joint Board on the Audit Engagement concluded in February 2026 Category Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Purchasing Processes Limited 1 2 1 0 Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk. • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 6
Internal Audit Report Valuation Joint Board RVJB - Purchasing Processes (A0011/2026/001) Date: February 2026 BOARD SUMMARY Audit Objectives The audit review was included in the 2025/26 audit plan at the request of the Assessor & Electoral Registration Officer to highlight any disparities in alignment between their current purchasing processes and those being introduced within Renfrewshire Council during the implementation of the Purchase to Pay Policy. The objectives of the audit were to ensure that:- 1. Purchasing processes comply with relevant legislation and internal policies and procedures, including Standing Orders and Scheme of Delegation. 2. There is an adequate process in place for selecting, evaluating, and monitoring suppliers. 3. There is an adequate separation of duties within purchasing processes. 4. Purchase orders, invoices, and payments are properly authorised and accurately recorded. 5. Budgetary controls are in place and monitored throughout the procurement cycle. Audit Scope 1. Interviewed relevant officers to obtain the system in place regarding purchasing processes. 2. Prepared a series of tests to meet the above objectives. Key Audit Assurances 1. Purchase Orders in the sample tested were appropriately approved. 2. There is adequate budget monitoring throughout the purchase order and invoice payment process whereby each budget line is reviewed each period by RVJB management and accountants. Key Risks 1. In the absence of documented operational purchasing guidance, officers may lack clarity on their roles and responsibilities, increasing the risk of non-compliance with governance requirements. 2. There is a lack of controls in relation to the use of credit cards which could lead to a risk of fraud and lack of accountability. 3. Where goods and services are purchased without an official purchase order, this increases the risk of unauthorised, non-compliant, or unnecessary spending. Overall Audit Opinion At the time of the audit review, there was no documented operational guidance covering the current RVJB purchasing process. While purchase orders are used for many transactions, and budgets are closely monitored each period, some purchases tested lacked an official purchase order, which is not considered to be good practice. Additionally, although it is acknowledged that credit card expenditure is low, processes followed in relation to credit card usage were found to be unsatisfactory and these were ended immediately by management. Recommendations have been made within this report to address the control weaknesses.
Page 7
Internal Audit Report Valuation Joint Board RVJB - Purchasing Processes (A0011/2026/001) Date: February 2026 Management Commentary Management are actively in the process of implementing the audit recommendations. New procedures have been drawn up and approved by management for the use of credit cards and sent to all the relevant staff. We are now preparing guidance for all the other purchasing processes and an official order form will now be completed and sent to the Supplier for any goods and services required
Page 8
RENFREWSHIRE VALUATION JOINT BOARD ___________________________________________________________________ To: Renfrewshire Valuation Joint Board On: 22 May 2026 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: INTERNAL AUDIT ANNUAL REPORT 2025/26 ___________________________________________________________________ 1. SUMMARY 1.1 The Global Internal Audit Standards in the UK Public Sector require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of the Renfrewshire Valuation Joint Board’s internal control environment. 1.3 The Annual Report for Renfrewshire Valuation Joint Board is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the Internal Audit Team, the main findings from the internal audit work undertaken in 2025/26 and contains an audit assurance statement. 2. RECOMMENDATIONS 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report.
Page 9
Appendix 1 Renfrewshire Valuation Joint Board Internal Audit Annual Report 2025/2026 Renfrewshire Council Internal Audit
Page 10
Renfrewshire Valuation Joint Board Internal Audit Annual Report 2025/2026 Contents Page 1. Introduction 1 2. Global Internal Audit Standards in the UK Public Sector 1 3. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2025/26 2 4. Internal Audit Performance 4 5. Planned Audit Work for 2026/27 5 6. Audit Assurance Statement 5
Page 11
- 1 - Renfrewshire Valuation Joint Board Internal Audit Annual Report 1 April 2025– 31 March 2026 1. Introduction 1.1 Renfrewshire Council provides an internal audit service to Renfrewshire Valuation Joint Board. This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Assessor and Electoral Registration Officer, Renfrewshire Valuation Joint Board. • Delivery of the planned audit assignments. • Follow up of previous audit recommendations. • Provision of any ongoing advice and support on audit and risk management related matters. • Provision of an Annual Report and Assurance Statement, and presentation to elected members at the board of Renfrewshire Valuation Joint Board. 1.2 The Internal Audit Section is an independent and objective assurance and advisory service designed to add value and improve the operations of Renfrewshire Council and its Partners. It assists the RVJB in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organisation's risk management, control, and governance processes and enhances the RVJB’s decision making and oversight arrangements. 1.3 The purpose of this Annual Report is to report on: • The outcome of the planned Internal Audit reviews 2025/26 relating to Renfrewshire Valuation Joint Board. • The outcome of Internal Audit reviews of supporting Renfrewshire Council corporate systems. • Internal audit performance. • Planned audit work for 2026/27. • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the Board’s internal control environment. 2. Global Internal Audit Standards in the UK Public Sector 2.1 At the start of 2025/26, new Public Sector Internal Audit Standards “Global Internal Audit Standards in the UK Public Sector” came into force. These Standards require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include ongoing monitoring of compliance with the standards, periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation.
Page 12
- 2 - 2.2 With regards to the ongoing monitoring to ensure compliance, the work undertaken during an assignment is reviewed by a senior audit team member. 2.3 The Chief Auditor undertook a self-assessment exercise to determine what actions were required to ensure compliance. The conclusion of this exercise was that in the main, Internal Audit complied with the spirit of the standards but required to undertake some actions throughout the year to achieve full compliance or enhance the processes already in place. The main actions were to update the Internal Audit Charter and Mandate and ensure staff were fully trained as to the requirements of the new standards. 2.4 These actions have been completed. Staff training sessions were held during the year and a revised Internal Charter and Mandate was prepared and is attached at Appendix 1. A further formal self-assessment is planned for the forthcoming year. 3. Responsibilities of Management and Internal Audit 3.1 It is the responsibility of management to ensure that the areas under their control are adequate and effective and that there is a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 3.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3.3 The internal audit team will ensure that independence and objectivity are maintained in line with the Global Internal Audit Standards in the UK Public Sector including where non-audit work is undertaken. Internal auditors will have no operational responsibilities. There have been no impairments impacting on the Chief Auditor’s independence. 4. Internal Audit Activity during 2025/2026 4.1 One specific engagement was undertaken during 2025/26, which related to the arrangements for purchasing goods and services in operation within the Board. A summary of the report was considered by the Board on 22 May 2026 and the conclusion of this review is summarised in Table 1 below:
Page 13
- 3 - Table 1 Audit Area Conclusion Purchasing Processes Limited Assurance At the time of the audit review, there was no documented operational guidance covering the RVJB purchasing process. While purchase orders are used for many transactions, and budgets are closely monitored each period, some purchases tested lacked an official purchase order, which is not considered to be good practice. Additionally, although it is acknowledged that credit card expenditure is low, processes followed in relation to credit card usage were found to be unsatisfactory and these were ended immediately by management. Recommendations were made to address the control weaknesses identified. 4.2 The Annual Report for 2024/2025 was submitted to the Joint Board on 23 May 2025. 4.3 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2025/26, there was one recommendation that required to be followed up and it was fully implemented. 4.4 Internal Audit also carried out reviews of the main corporate systems operating within Renfrewshire Council which support the Board’s activity. The main findings in relation to these are summarised in Table 2 below and Renfrewshire Council management have agreed to implement the audit recommendations made in relation to each review: Table 2 Audit Area Conclusion Financial Planning Substantial Assurance The arrangements in place for financial planning were found to be robust. Assumptions and financial risks related to cost pressures were reported to the Council.
Page 14
- 4 - Main Financial Systems – Key Controls Limited Assurance The audit identified that satisfactory controls are in place for system documentation and budget monitoring across the main financial systems. Some control weaknesses were identified in relation to segregation of duties and in relation to reconciliation of feeder systems. In addition, there was a substantial backlog of unresolved Accounts Receivable transactions in the ERP system, with systemic workflow and error-handling issues which required management attention. Petty Cash Reasonable Assurance Whilst there are some establishments that would continue to require petty cash imprests, we identified some other imprests that could be closed as they have not been used for some time and others could be decreased as their use seems to have declined. 5. Review of Internal Audit Performance 5.1 Internal Audit produces regular reports on its performance during the year to Renfrewshire Council’s, Audit, Risk and Scrutiny Board, against a range of measures set annually by the Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal audit services. Table 3 shows the actual performance against targeted performance for the year. Table 3 Internal Audit Performance 2025/26 Performance measure Target 2025/26 Actual 2025/26 % of audit assignments completed by target date 95% 98.3% % of audit assignments completed within time budget 95% 98.3% % completion of audit plan for the year* 90% 90.1% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 5.2 The percentage completion of the audit plan met target set for the year. It should be noted that the planned review for the RVJB for 2025/26 is 100% complete. The actual performance for the year for the two other indicators is above the target performance level.
Page 15
- 5 - 5.3 The Assistant Chief Auditor was appointed permanently to the post of Chief Auditor in August 2025 and one of the Senior Auditors is covering the Assistant Chief Auditors post on an interim basis. In addition, the Senior Counter Fraud Officer post is currently vacant due to the retiral of the previous post holder. 5.4 It was recognised that there have been difficulties in recruiting Internal Auditors recently within some other Local Authorities and it was agreed that as the opportunity has arisen, the Chief Auditor in conjunction with the Director of Finance and Resources would carry out a review to determine the staffing and skillset required to deliver an adequate and efficient Internal Audit and Counter Fraud Service, taking into consideration future corporate plans and priorities and workforce and resilience planning issues. 5.5 This revised structure has been agreed upon and we are currently in the process of implementing this revised structure with the assistance of HR staff. It has been designed to give current and new staff the opportunity to further develop their skills and study for a professional qualification. The number of staff will remain unchanged and it is planned to recruit a trainee internal auditor. 5.6 Due to the vacancies being carried, this has been a challenging year for the Internal Audit Service and some of our developmental and administration work has been carried forward into 2026/27 to enable priority to be given to operational reviews. Some of the available resources have also been used to cover some counter fraud tasks. The service had adequate financial resources which can be used flexibly and was utilised for some staff overtime to ensure adequate operational work was undertaken to enable the Chief Auditor to provide their assurance opinion on the internal control environment in operation. It is therefore considered that the team has been sufficiently resourced during the year to undertake the operational work required. 6. Planned Work for 2026/27 6.1 Following a risk-based assessment of the activities of the Renfrewshire Valuation Joint Board, the audit plan for 2026/2027 provides for a review of payroll processes, preparation of an annual report, ad-hoc internal control advice, reactive investigative work and a follow-up of previous audits recommendations. 7. Audit Assurance Statement 7.1 Internal Audit has performed its work in accordance with the role defined in paragraph 1.2. The audit work performed has been reported to the Assessor and Electoral Registration Officer, and to the Board. Where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 7.2 In view of the continued challenges common to all public bodies, there will be a requirement for the council and the bodies for which it is host authority to exercise very close scrutiny over expenditure, financial management and compliance with overarching governance arrangements, and these areas will continue to receive due internal audit attention.
Page 16
- 6 - 7.3 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 7.4 There are corporate systems and processes within Renfrewshire Council that the Renfrewshire Valuation Joint Board relies upon. It can be seen from Table 1 & 2 above that some actions were recommended to improve the processes in operation. Renfrewshire Valuation Joint Board and Renfrewshire Council management have agreed to implement the recommendations made by internal audit, in relation to these reviews. 7.5 In this context, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Renfrewshire Valuation Joint Board’s internal control, risk management and governance arrangements, as evidenced by: - • The results of the audit work in 2025/26 in relation to the corporate systems which supported the Renfrewshire Valuation Joint Board’s activities, and to specific work carried out in relation to those activities. • Management action in response to audit recommendations. • Management’s self-assessment of internal control, risk management and governance arrangements. • The regular review and updating of the Local Code of Corporate Governance by the Council in accordance with the CIPFA/SOLACE framework for corporate governance requirements, and of the corporate governance arrangements within Renfrewshire Valuation Joint Board.
Page 17
PUBLIC AGENDA ITEM NO..... Scotland Excel To: Executive Sub-committee On: 19 June 2026 Report by Chief Auditor Internal Audit Engagement – Contract Delivery Plan 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. 1.2 The Chief Auditor will report summaries of completed audit engagements to the Executive Sub Committee on the conclusion of each engagement for formal consideration by members in line with the best practice referred to above. 1.3 This report provides detail of the audit engagement completed in 2025/26 with the overall assurance rating and the number of recommendations in each risk category. The detailed committee summary for the engagement is also attached. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the summary for the Internal Audit engagement reviewing the governance arrangements in terms of the contract delivery planning process to ensure defined milestones are adhered to when contracts are being established. ___________________________________________________________________
Page 18
PUBLIC Appendix 1 Scotland Excel Internal Audit Service Summary of Internal Audit Reports issued Category Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Contract Delivery Plan Substantial 0 0 1 0 . Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 19
PUBLIC Internal Audit Report Scotland Excel Contract Delivery Plan (A0008/2025/010) July 2025 Audit Objectives A review of the governance arrangements in terms of the contract delivery plan was undertaken to ensure it was being progressed as planned. The objective of the review was to ensure that there are adequate governance arrangements in place for a sample of defined milestones in the procurement process to ensure they are achieved and appropriate evidence is maintained to support these arrangements. Audit Scope 1. Interviewed the appropriate officers to obtain the required information relating to relevant procedures and guidance. 2. Selected a sample of milestones for review to ensure that adequate governance arrangements are in place. The auditor selected the following milestones, that are required to be approved by the Contract Steering Group, from the Governance Gateways and Contract Steering Group Approval Policy and Process: a) Approval for Participation and Benchmarking and Sustainable Procurement Duty; b) Evaluation Methodology and Weightings Approved; c) Recommendation and Benchmarking Approved; d) Executive Sub Committee Report Approved 3. The auditor tested whether there was evidence to demonstrate that these milestones were achieved and approved by the Contract Steeing Group SG for a sample of contracts selected from the Contract Delivery Plan. Key Audit Assurances For the sample of milestones and contracts tested, adequate governance arrangements were in place and there was evidence that each milestone had been achieved. Key Risks No key risks were identified during the audit. Overall Audit Opinion There were adequate governance arrangements in place for the sample of governance gateway milestones and contracts tested. However, minor improvements could be made regarding recording confirmation that all other prior Gateway approvals by relevant officers have been received. Management Commentary The recommendation made was implemented. Checklists have been developed and form part of the contract documentation to evidence that all required approvals have been obtained. In
Page 20
PUBLIC addition, a process to track action agreed at the Contact Steering Group has been introduced. This Referral Form tracks actions and approvals from defined signatories at each gateway.
Page 21
AGENDA ITEM NO..... Scotland Excel To: Executive Sub-Committee On: 19 June 2026 Report by Chief Auditor INTERNAL AUDIT ANNUAL REPORT 2025/26 1. Summary 1.1 The Global Internal Audit Standards in the UK Public Sector require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of Scotland Excel’s internal control environment. 1.3 The Annual Report for Scotland Excel is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the Internal Audit Team, the main findings from the internal audit work undertaken in 2025/26 and contains an audit assurance statement. 2. Recommendations 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report.
Page 22
No embedded text on this page.
Page 23
PUBLIC Scotland Excel Internal Audit Annual Report 2025/2026 Renfrewshire Council Internal Audit
Page 24
PUBLIC Scotland Excel Internal Audit Annual Report 2025/2026 Contents Page 1. Introduction 1 2. Global Internal Audit Standards in the UK Public Sector 1 3. Responsibilities of Management and Internal Audit 2 4. Internal Audit Activity during 2025/26 2 5. Review of Internal Audit Performance 4 6. Planned Audit Work for 2026/27 5 7. Audit Assurance Statement 5
Page 25
- 1 - PUBLIC Scotland Excel Internal Audit Annual Report 1 April 2025 – 31 March 2026 1. Introduction 1.1 As host Authority, Renfrewshire Council provides an internal audit service to Scotland Excel. This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Chief Executive and other Senior Management Team Members; • Delivery of the planned audit assignments; • Follow up of previous audit recommendations; • Provision of any ongoing advice and support on audit and risk management related matters; • Provision of an Annual Report and Assurance Statement, and presentation to elected members of Scotland Excel. 1.2 The Internal Audit Section is an independent and objective assurance and advisory service designed to add value and improve the operations of Renfrewshire Council and its Partners. It assists Scotland Excel in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organisation's risk management, control, and governance processes and enhances Scotland Excel’s decision making and oversight arrangements. 1.3 In line with the Standards, the purpose of this Annual Report is to report on: • The status/outcome of the completed Internal Audit reviews 2025/26 relating to Scotland Excel; • The outcome of Internal Audit reviews of supporting Renfrewshire Council corporate systems; • Internal audit performance; • Planned audit work for 2026/27; • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the organisation’s internal control environment. 2. Global Internal Audit Standards in the UK Public Sector 2.1 At the start of 2025/26, new Public Sector Internal Audit Standards “Global Internal Audit Standards in the UK Public Sector” came into force. These Standards require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the
Page 26
- 2 - PUBLIC internal audit activity. The QAIP must include ongoing monitoring of compliance with the standards, periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 2.2 With regards to the ongoing monitoring to ensure compliance, the work undertaken during an assignment is reviewed by a senior audit team member. 2.3 The Chief Auditor undertook a self-assessment exercise to determine what actions were required to ensure compliance. The conclusion of this exercise was that in the main, Internal Audit complied with the spirit of the standards but required to undertake some actions throughout the year to achieve full compliance or enhance the processes already in place. The main actions were to update the Internal Audit Charter and Mandate and ensure staff were fully trained as to the requirements of the new standards. 2.4 These actions have been completed. Staff training sessions were held during the year and a revised Internal Charter and Mandate was prepared and is attached at Appendix 1. A further formal self-assessment is planned for the forthcoming year. 3. Responsibilities of Management and Internal Audit 3.1 It is the responsibility of management to ensure that for the areas under their control there is an adequate and effective system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 3.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3.3 The internal audit team ensured that independence and objectivity are maintained in line with the Global Internal Audit Standards in the UK Public Sector including where non-audit work is undertaken. Internal auditors have no operational responsibilities. There have been no impairments impacting on the Chief Auditor’s independence. 4 Internal Audit Activity during 2025/26 4.1 An engagement reviewing the methodoloy employed by Scotland Excel to identify, calculate, measure and report the value it provides to members in the Annual Value Report has been completed and is currently being reviewed by Internal Audit Management prior to a draft report being issued to Scotland Excel’s Senior Management.
Page 27
- 3 - PUBLIC 4.2 The internal audit engagement reviewing the governance arrangements surrounding the Contract Delivery Plan was completed. A summary of this report was considered by the Executive Sub-Committee on 19 June 2026. And the conclusion of this review is summarised in Table 1 below. Table 1 Audit Area Conclusion Contract Delivery Plan Substantial Assurance There were adequate governance arrangements in place for the sample of governance gateway milestones and contracts tested. However, minor improvements could be made regarding recording confirmation that all other prior Gateway approvals by relevant officers have been received. 4.3 The Annual Report for 2024/25 was submitted to the Executive Sub-committee on 20 June 2025. 4.4 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2025/26, there was one recommendation that required to be followed up and it was fully implemented. 4.5 Internal Audit also carried out reviews of the main corporate systems operating within Renfrewshire Council which support Scotland Excel’s activity. The main findings in relation to these are summarised in Table 2 below and Renfrewshire Council management have agreed to implement the audit recommendations made in relation to each review: Table 2 Audit Area Conclusion Financial Planning Substantial Assurance The arrangements in place for financial planning were found to be robust. Assumptions and financial risks related to cost pressures were reported to the Council. Main Financial Systems – Key Controls Limited Assurance The audit identified that satisfactory controls are in place for system documentation and budget monitoring across the main financial systems. Some control weaknesses were identified in relation to segregation of duties and in relation to reconciliation of feeder
Page 28
- 4 - PUBLIC systems. In addition, there was a substantial backlog of unresolved Accounts Receivable transactions in the ERP system, with systemic workflow and error-handling issues which required management attention. 5. Review of Internal Audit Performance 5.1 Internal Audit produces regular reports on its performance during the year to the Renfrewshire Council, Audit, Risk and Scrutiny Board, against a range of measures set annually by the Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal audit services. Table 3 shows the actual performance against targeted performance for the year. Table 3 Internal Audit Performance 2025/26 Performance measure Target 2025/26 Actual 2025/26 % completion of audit plan for the year* 90% 90.1% % of audit assignments completed within time budget 95% 98.3% % of audit assignments completed by target date 95% 98.3% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 5.2 The percentage completion of the audit plan met target set for the year. It should be noted that the planned reviews for Scotland Excel for 2025/26 will be fully completed by 30 June 2026. The actual performance for the year for the two other indicators is above the target performance level. 5.3 The Assistant Chief Auditor was appointed permanently to the post of Chief Auditor in August 2025 and one of the Senior Auditors is covering the Assistant Chief Auditors post on an interim basis. In addition, the Senior Counter Fraud Officer post is currently vacant due to the retiral of the previous post holder. 5.4 It was recognised that there have been difficulties in recruiting Internal Auditors recently within some other Local Authorities and it was agreed that as the opportunity has arisen, the Chief Auditor in conjunction with the Director of Finance and Resources would carry out a review to determine the staffing and skillset required to deliver an adequate and efficient Internal Audit and Counter
Page 29
- 5 - PUBLIC Fraud Service, taking into consideration future corporate plans and priorities and workforce and resilience planning issues. 5.5 This revised structure has been agreed upon and we are currently in the process of implementing this revised structure with the assistance of HR staff. It has been designed to give current and new staff the opportunity to further develop their skills and study for a professional qualification. The number of staff will remain unchanged and it is planned to recruit a trainee internal auditor. 5.6 Due to the vacancies being carried, this has been a challenging year for the Internal Audit Service and some of our developmental and administration work has been carried forward into 2026/27 to enable priority to be given to operational reviews. Some of the available resources have also been used to cover some counter fraud tasks. The service had adequate financial resources which can be used flexibly and was utilised for some staff overtime to ensure adequate operational work was undertaken to enable the Chief Auditor to provide their assurance opinion on the internal control environment in operation. It is therefore considered that the team has been sufficiently resourced during the year to undertake the operational work required. 5.7 The Counter Fraud Section of the team have mainly been working on referrals received from various internal and external sources and investigation of National Fraud Initiative Data Matches received from the Cabinet Office 6. Planned Audit Work for 2026/27 6.1 Following a risk-based assessment of the activities of Scotland Excel and consultation with the Chief Executive and other Senior Management Team Members, the following internal audit work has been agreed for 2026/27: • A review of the governance arrangements for services provided to external organisations; • Follow up of previous audit work; • Ad-hoc internal audit and risk management advice • Annual Reporting. 7. Audit Assurance Statement 7.1 Internal Audit has performed its work in accordance with the role defined in paragraph 1.2. The audit work performed and completed has been reported to the Chief Executive and to the Executive Sub Committee. Where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 7.2 In view of the continued challenges common to all public bodies, there will be a requirement for the council and the bodies for which it is host authority to exercise very close scrutiny over revenue spending, over financial management and compliance with overarching governance arrangements, and this will continue to receive due internal audit attention.
Page 30
- 6 - PUBLIC 7.3 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 7.4 There are corporate systems and processes within Renfrewshire Council that Scotland Excel rely upon. It can be seen from Table 2 above that some actions were recommended to improve the processes in operation. Renfrewshire Council management has agreed to implement the recommendations made by internal audit, in relation to these reviews. In this context, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of Scotland Excel Joint Committee’s internal control, risk management and governance arrangements, as evidenced by: - • The results of the audit work in 2025/26 in relation to the corporate systems which supported Scotland Excel’s activities and to specific work carried out in relation to those activities. • Management action in response to audit recommendations. • Management self-assessment of internal control, risk management and governance arrangements. • The regular review and updating of the Local Code of Corporate Governance by the Council in accordance with the Chartered Institute of Public Finance and Accountancy and Society of Local Authority Chief Executives framework for corporate governance requirements, and of the corporate governance arrangements within Scotland Excel. Chief Auditor 19 June 2026
Page 31
PUBLIC To: Renfrewshire Integration Joint Board Audit, Risk and Scrutiny Committee On: 12 June 2026 Report by: Chief Internal Auditor Heading: Summary of Internal Audit Reports 1. Summary 1.1 A risk based Internal Audit Plan for 2025/26 was approved by the IJB Audit Committee on 14 March 2025. In line with the Global Internal Audit Standards in the UK Public Sector, Internal Audit must communicate the results of each engagement to the Board. 1.2 Appendix 1 provides details of the completed audit engagement reviewing the Strategic Plan process along with the overall assurance rating and the number of recommendations in each risk category. The committee summary is also attached at Appendix 2. 2. Recommendations 2.1 That the Integration Joint Board Audit, Risk and Scrutiny Committee are asked to note the content of the report. Implications of the Report 1. Financial - none. 2. HR & Organisational Development - none. 3. Community Planning - none. 4. Legal - none.
Page 32
PUBLIC 5. Property/Assets - none. 6. Information Technology - none. 7. Equality & Human Rights - none 8. Health & Safety - none. 9. Procurement - none. 10. Risk - The subject matter of this report related to the delivery of the risk-based Audit Plan for the IJB. 11. Privacy Impact - none. List of Background Papers – none. Author: Karen Campbell, Chief Internal Auditor
Page 33
PUBLIC Appendix 1 Integration Joint Board Audit, Risk and Scrutiny Committee Internal Audit Service Summary of Final Audit Reports Issued Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Review of the Strategic Plan Process Reasonable 0 1 2 1 . Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk. • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 34
PUBLIC Appendix 2 Internal Audit Report IJB Review of the Strategic Plan Process (A0114/2026/001) Date: March 2026 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to: - 1. Determine the arrangements in place for refreshing the Strategic Plan and assess for adequacy. 2. Confirm that the Strategic Plan has been refreshed in line with legislative requirements. 3. Ensure that stakeholders were sufficiently engaged during the preparation, publication and review stages of the refresh and this is reflected in the Plan. 4. Ascertain the monitoring and reporting arrangements in place for the delivery of the Plan’s objectives and review these for adequacy. Audit Scope 1. Interviewed the appropriate officers to ascertain the arrangements in place for the Strategic Plan refresh and to establish available evidence. 2. Prepared and carried out a programme of tests to enable the audit objectives to be met. Key Audit Assurances 1. The Strategic Plan refresh process was supported by documented action plans and active oversight through Strategic Planning Group meetings. 2. Consultation activity was robust, using multiple engagement methods, and feedback was clearly documented and incorporated into the final Strategic Plan. 3. Performance monitoring arrangements were in place, with management oversight at regular operational team meetings. Performance Managers plan to provide the first 6 monthly update relating to the refreshed Strategic Plan, supported by dashboards, to the SMT in the near future as well as annual reporting to the Integration Joint Board. Key Audit Risks By not complying with the Statutory Guidance in relation to locality arrangements and publishing a Consultation Statement, stakeholders may not have sufficient information to fully challenge Strategic Plan outcomes. Overall Audit Opinion The audit found that the Strategic Plan refresh process was well-governed, supported by effective consultation, had established performance monitoring arrangements, and was broadly aligned with statutory guidance. The main areas identified for improvement relate to
Page 35
PUBLIC the inclusion of localities, publication of a Consultation Statement and production of a Joint Strategic Needs Assessment (JSNA). Recommendations were also made to enhance the monitoring arrangements. Management Commentary These areas are being addressed. IJB Officers are working with Renfrewshire Council and Community Planning colleagues to develop a joint approach to locality planning. These discussions are underway and may result in a change to the number of localities reflected within the next Strategic Plan. IJB Management will also work with partners to develop an updated Joint Strategic Needs Assessment aligning with development of the IJB’s Strategic Plan, the Council Plan and Community Plan Whilst, the contents of a consultation statement were included in both the refreshed Strategic Plan 2025-27 and the supporting cover paper considered by the IJB, the HSCP will publish a separate consultation statement alongside the next Strategic Plan.
Page 36
No embedded text on this page.
Page 37
PUBLIC To: Renfrewshire Health and Social Care Integration Joint Board Audit, Risk and Scrutiny Committee On: 12 June 2026 Report by: Chief Internal Auditor Heading: Internal Audit Annual Report 2025/2026 1. Summary 1.1 The Global Internal Audit Standards in the UK Public Sector which were in operation during 2025/26 requires that the Chief Internal Auditor must deliver an annual internal audit opinion, on the overall adequacy and effectiveness of the governance, risk management and internal control framework, that can be used by the organisation to inform its governance statement. 1.2 The purpose of this report is to advise the Committee of the Internal Audit Annual Report including the annual opinion. The Internal Audit Annual Report also outlines the internal audit work we have carried out for the year ended 31 March 2026 and provides details of the performance of Internal Audit. 1.3 The report attached, includes the Chief Internal Auditor’s independent and objective opinion as to the adequacy and effectiveness of the internal control environment. In forming the opinion, the Chief Internal Auditor has conducted a review of the Internal Audit reports issued to the IJB in the year and the internal audit annual report from Renfrewshire Council and internal audit progress reports from NHS Greater Glasgow and Clyde. 2. Recommendations 2.1 Members are asked to consider and note the contents of the IJB’s Internal Audit Annual Report for 2025/26.
Page 38
PUBLIC Implications of the Report 1. Financial - none 2. HR & Organisational Development - none. 3. Community Planning - none. 4. Legal - none. 5. Property/Assets - none. 6. Information Technology - none. 7. Equality & Human Rights - none 8. Health & Safety - none. 9. Procurement - none. 10. Risk - The report provides an opinion on the overall internal control environment including governance and risk management of the Integration Joint Board. 11. Privacy Impact - none. List of Background Papers – none. Author: Karen Campbell, Chief Internal Auditor
Page 39
PUBLIC Renfrewshire Integration Joint Board Internal Audit Annual Report 2025-2026 June 2026
Page 40
PUBLIC
Page 41
PUBLIC Renfrewshire Integration Joint Board Internal Audit Annual Report 2025/2026 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2025/26 2 4. Review of Internal Audit Performance and Improvement Activity 2 5. Planned Audit Work for 2026/27 4 6. Audit Assurance Statement 4 Appendix 1 – Summary of Assurances 6
Page 42
- 1 - PUBLIC Renfrewshire Integration Joint Board Internal Audit Annual Report 1 April 2025 – 31 March 2026 1. Introduction 1.1 Renfrewshire Council provides an internal audit service to the Renfrewshire Health and Social Care Integration Joint Board (IJB). This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Chief Officer and Senior Management; • Delivery of the planned audit assignments; • Follow up of previous audit recommendations; • Provision of any ongoing advice support and training on audit and risk related matters; • Provision of an Annual Report and Assurance Statement to the IJB. 1.2 The Service operates in accordance with the Global Internal Audit Standards in the UK Public Sector for 2025/26. Internal Audit’s is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It assists an organisation in accomplishing its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of the organisation’s risk management, control and governance processes. 1.3 In line with the Standards, the purpose of this Annual Report is to report on: • The outcome of the planned Internal Audit reviews 2025/26 relating to the IJB; • The outcome of Internal Audit reviews undertaken by partner bodies; • Internal audit performance; • Planned audit work for 2026/27; • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the IJB’s internal control environment. 1.4 The operational delivery of services within the Health Board and Local Authority on behalf of the Integration Joint Board will be covered by their respective internal audit arrangements. In concluding on the overall opinion, the Chief Internal Auditor has conducted a review of the internal audit reports issued to the IJB in the year, the internal audit annual report from Renfrewshire Council and progress summaries from NHS Greater Glasgow and Clyde. (Appendix 1).
Page 43
- 2 - PUBLIC 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of IJB management to ensure that the areas under their control are adequate and effective and that there is a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3. Internal Audit Activity during 2025/2026 3.1 The Internal Audit Plan for the IJB for 2025/2026 provided for a review of the strategic planning arrangements and the annual review of the adequacy and compliance with the Local Code of Corporate Governance. (Appendix 1). The Corporate Governance review was reported to the IJB Audit, Risk and Scrutiny Committee in March 2026 and the Strategic Planning review was reported in June 2026. 3.2 The Annual Report for 2024/2025 was submitted to the Integration Joint Board on 20 June 2025. 3.3 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2025/26, one recommendation was followed up and found to be fully implemented. 4. Review of Internal Audit Performance and Improvement Activity 4.1 Internal Audit produces regular reports on its performance during the year to Renfrewshire Council’s Audit, Risk and Scrutiny Board, against a range of measures set annually by Renfrewshire Council’s Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal audit services. Table 1 shows the actual performance against targeted performance for the year. Table 1 Internal Audit Performance 2025/26 Performance measure Target 2025/26 Actual 2025/26 % completion of audit plan for the year* 90% 90.1% % engagements completed by target date 95% 98.3% % engagements completed within time budget 95% 98.3%
Page 44
- 3 - PUBLIC * This measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 4.2 The percentage completion of the audit plan met the target set for the year. In addition, the actual performance for the year for the two other indicators is above the target performance level. It should be noted that the Internal Audit Plan for the IJB for 2025/26 is 100% complete. 4.3 The Assistant Chief Auditor was appointed permanently to the post of Chief Auditor in August 2025 and one of the Senior Auditors is covering the Assistant Chief Auditors post on an interim basis. In addition, the Senior Counter Fraud Officer post is currently vacant due to the retiral of the previous post holder. 4.4 It was recognised that there have been difficulties in recruiting Internal Auditors recently within some other Local Authorities and it was agreed that as the opportunity has arisen, the Chief Auditor in conjunction with the Director of Finance and Resources would carry out a review to determine the staffing and skillset required to deliver an adequate and efficient Internal Audit and Counter Fraud Service, taking into consideration future corporate plans and priorities and workforce and resilience planning issues. 4.5 This revised structure has been agreed upon and we are currently in the process of implementing this revised structure with the assistance of HR staff. It has been designed to give current and new staff the opportunity to further develop their skills and study for a professional qualification. The number of staff will remain unchanged and it is planned to recruit a trainee internal auditor. 4.6 Due to the vacancies being carried, this has been a challenging year for the Internal Audit Service and some of our developmental and administration work has been carried forward into 2026/27 to enable priority to be given to operational reviews. Some of the available resources have also been used to cover some counter fraud tasks. The service had adequate financial resources which can be used flexibly and was utilised for some staff overtime to ensure adequate operational work was undertaken to enable the Chief Auditor to provide their assurance opinion on the internal control environment in operation. It is therefore considered that the team has been sufficiently resourced during the year to undertake the operational work required. 4.7 The Global Internal Audit Standards in the UK Public Sector require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include ongoing monitoring of compliance with the standards, periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 4.8 With regards to the ongoing monitoring to ensure compliance, the work undertaken during an assignment is reviewed by a senior audit team member. 4.9 We undertook a self-assessment against these new standards and reported the results and required actions to the Audit, Risk and Scrutiny Committee in
Page 45
- 4 - PUBLIC September 2025. An updated Charter and Mandate was approved by the Committee in November 2025 and staff training on the revised standards has also been undertaken. It is now considered that Internal Audit comply with the standards. A further formal self-assessment is planned for the forthcoming year and the outcomes will be reported to the Audit, Risk and Scrutiny Committee. 4.10 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process and our next external assessment is not due until 2028/29. 5. Planned Work for 2026/27 5.1 Following a risk-based assessment of the activities of the IJB and consultation with the senior management team, the Internal Audit Plan for 2026/27 provides for 42 days of Internal Audit resource to undertake: • A review of Clinical Governance; and • The annual review of the adequacy and effectiveness of the Local Code of Corporate Governance. 5.2 The plan also provides time for planning and reporting, follow up on previous recommendations, the annual self-assessment of the Audit Committee arrangements, ad-hoc advice, consultancy and training. The Internal Audit Plan for 2026/27 was approved by the IJB Audit, Risk and Scrutiny Committee on 20 March 2026. 6. Audit Assurance Statement 6.1 The audit work performed in relation to the 2025/26 internal audit plan has been reported to the Chief Officer and the Audit, Risk and Scrutiny Committee. Relevant audit work undertaken by partner organisations is reported to their respective Audit Committees. Where areas for improvement in internal control have been identified, appropriate recommendations have been made and accepted for action by management. 6.2 There are no significant matters arising in relation to those audit engagements specific to the IJB and there have been no impairments impacting on the Chief Auditor’s independence and the team has been sufficiently resourced during the year to undertake the planned assignments. 6.3 In view of the continued challenges common to all public bodies, there will be a requirement for the council and the bodies for which it is host authority to exercise very close scrutiny over expenditure, over financial management and compliance with overarching governance arrangements, and this area will continue to receive due internal audit attention. 6.4 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with
Page 46
- 5 - PUBLIC the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 6.5 There are corporate systems and processes within Renfrewshire Council and NHS Greater Glasgow and Clyde that the IJB rely upon. It can be seen from Appendix 1 that some of these processes require to be improved to provide a reasonable level of assurance. 6.6 In this context, it is considered that a reasonable level of assurance can be placed upon the adequacy and effectiveness of the Integration Joint Board’s internal control, risk management and governance arrangements, as evidenced by:- • The results of the audit work in 2025/26 and the opinions contained in the Internal Audit Annual Reports of the Local Authority and progress reports from the Health Board. • Management self-assessment of internal control, risk management and governance arrangements. • Management action to respond to audit recommendations. Karen Campbell Chief Internal Auditor 12 June 2026.
Page 47
- 6 - PUBLIC Appendix 1 Summary of Internal Audit Assurances for the IJB and Partner Organisations, Renfrewshire Council and NHS Greater Glasgow and Clyde Integration Joint Board Audit Engagement Assurance Level Significant Matters Local Code of Corporate Governance Substantial • None Strategic Planning Reasonable • The audit found that the Strategic Plan refresh process was well-governed, supported by effective consultation, had established performance monitoring arrangements, and was broadly aligned with statutory guidance. The main areas identified for improvement relate to the inclusion of localities, publication of a separate Consultation Statement and production of a Joint Strategic Needs Assessment (JSNA) to full comply with the guidance. Renfrewshire Council Audit Engagement Assurance Level Significant Matters Housing Adaptation Grants Reasonable • Some grants had been awarded by an officer where the value of the grant was in excess of that officer’s authority expenditure limit. • There was no monitoring process in place to ensure owners adhere to the grant conditions. Surplus Building Security Limited • There was no formal, standardised procedure relating to the closedown and management of the surplus buildings and roles and responsibilities were not clear. • The insurance conditions for unoccupied buildings regarding property inspections were not being met for one of the properties tested. There was no evidence of risk assessments being completed. Main Financial Systems – Key Controls Limited • A substantial backlog of unresolved Accounts Receivable transactions in the ERP system, with systemic workflow and error-handling issues. • In addition, one of the feeder ordering systems lacks appropriate segregation of duties. Review of Petty Cash Imprests N/A • Whilst there are some establishments that would continue to require petty cash
Page 48
- 7 - PUBLIC imprests, there were some other imprests that could be closed as they have not been used for some time and others could be decreased as their use seems to have declined. Management agreed to review the necessity and value of their imprests. NHS Greater Glasgow and Clyde Audit Engagement Overall Audit Rating Significant Matters Strategic and Operational Planning Minor Improvement Required • There was not an estates strategy in place supporting priorities. Staff Training and Development Substantial Improvement Required • Role-specific training for all job families had not been clearly outlined, agreed and communicated to both managers and employees. Staff training was also not being adequately monitored. Freedom of Information Minor Improvement Required • The quality review process for responses required to be improved and consideration should be given to a case management system. Property Transaction Monitoring Effective • None Waiting List Management Minor improvement required • Staff had not been made aware that parts of the Access and Waiting Times Policy could not yet be implemented at the time of the review. • On some occasions, patients’ waiting list priority had not been vetted per the guidance Risk Management Substantial Improvement Required • Certain aspects of the risk improvement project required to be formalised. • The recording and monitoring of risks required to be standardised. Whistleblowing Substantial improvement required • Guidance documents and training required update and version control and triage decisions could be documented more clearly. • Better protocols and proactive controls/records over sharing personal and special category data should be implemented. • Aspects of Action tracking and reporting could be improved upon. Internal Communications Strategy Minor Improvement Required • Management should establish a formal process for gathering and documenting progress against actions more regularly than annually Workforce Planning Minor Improvement Required • None
Page 49
- 8 - PUBLIC Information Governance Minor Improvement Required • The recording of Subject Access Requests required to be amended to fully comply with the guidance
Page 50
No embedded text on this page.
Page 51
0 Introduction Audit Opinion Main Findings Action Plan Glasgow City Region Fair Work First Compliance Final Report April 2026 FS 57095
Page 52
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Fair Work First Compliance 1 Introduction Audit Opinion Main Findings Action Plan 1 Introduction 1.1 As part of the agreed Internal Audit plan, we have carried out a review of compliance with the Scottish Government’s Fair Work First (FWF) policy across the City Deal Programme. 1.2 FWF is a Scottish Government policy for promoting fair work, and workforce diversity by applying a criteria to grants, other funding and public contracts being awarded across the public sector. The conditions came into effect for public sector grants awarded after 1st July 2023 and must be met by the Glasgow City Region Project Management Office (PMO) and the eight member authorities (MAs) when allocating City Deal funding. 1.3 For the PMO, FWF is applicable to their role as the distributers of the City Deal grant funding to the MAs. It is the PMO’s responsibility to act in accordance with both the terms and conditions of the Scottish Government, as set out in the Grant Offer Letter and with the financial section of the GCR City Deal Assurance, Governance and Programme Management Framework (the Assurance Framework). 1.4 As grant recipients, the MAs are required to comply with the terms and conditions set out in the Scottish Government’s Grant Offer letter, which requires them to pay at least the real living wage (RLW) and demonstrate that all workers, including agency staff, have access to appropriate channels for effective workers’ voice channel(s), such as trade union recognition. 1.5 When MAs are awarding contracts related to City Deal projects or are passing the grant to a third-party organisation, they are required to follow the Scottish Government’s guidance on FWF requirements in public sector procurement and grant awards. 1.6 The scope of the audit was to ensure there are sufficient and appropriate arrangements in place covering the PMO and MAs. The scope of the audit included: • Awareness of the FWF requirements at both PMO and MA level. • Documented guidance and roles and responsibilities, developed by the PMO. • Internal documented procedures within member authorities, including arrangements and approval processes for all payments associated with the delivery of City Deal projects. • The reporting arrangements both internally within member authorities and to the Region PMO regarding compliance with the FWF requirements. • Record keeping arrangements to maintain an audit trail and ensure compliance with Scottish Government requirements.
Page 53
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Fair Work First Compliance 2 Introduction Audit Opinion Main Findings Action Plan 2 Audit Opinion 2.1 Based on the work carried out a reasonable level of assurance can be placed upon the control environment. The audit has identified some scope for improvement in the existing arrangements and two recommendations which management should address. 3 Main Findings 3.1 Through discussion we found that officers within the PMO demonstrated awareness and understanding of the FWF policy and how it applies to their role as distributor of City Deal grant funding to MAs. 3.2 Furthermore, from discussion with Lead Officers across the eight MAs we found an awareness of FWF requirements and how it applies to the MA as both a grant recipient and as a contracting authority. 3.3 In accordance with the Assurance Framework, the PMO is supported by the GCR City Deal Procurement Support Group (PSG), whose membership includes a procurement officer from each MA. The PSG has developed a Buyer’s Guide, to provide operational guidance to MAs on how to apply the FWF policy when carrying out procurement exercises relating to City Deal projects. From discussions with procurement officers from the MAs, we were advised that they are aware of the guide and that it is applied when carrying out procurement exercises. 3.4 As FWF should be considered in all public sector procurement exercises, we were advised that MAs will follow their own standing orders and corporate procedures, including the payment of contractors/suppliers, which will be made in accordance with the conditions of the contracts awarded. We confirmed via discussion and review of documents that FWF is considered at the tendering stage and as part of the ongoing contract management for City Deal projects at the MAs. 3.5 Sample testing was performed on 14 contracts awarded since the introduction of FWF in July 2023, across seven of the MAs, to ensure that FWF had been adequately considered when tendering for contracts relating to City Deal projects. The remaining MA had not awarded any contracts in the applicable timeframe. We found evidence that in all 14 cases that FWF had been suitably considered and applied at the tender and evaluation stage as expected. Where MAs have used an existing framework agreement, we noted that the FWF checks have already been carried out as part of the
Page 54
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Fair Work First Compliance 3 Introduction Audit Opinion Main Findings Action Plan supplier selection when establishing the framework and MAs are not required to reperform these checks. 3.6 We found that there are no specific reporting requirements regarding compliance with FWF at either a PMO to Scottish Government level, or at an MA to PMO level, however the requirement for compliance is outlined in the grant offer letter issued to all MAs. 3.7 In addition, there are no specific FWF record keeping requirements for either the PMO or MAs. The PMO must retain adequate records of all grant monies received and distributed for the GCR City Deal programme overall, in accordance with the Scottish Government’s Grant Offer. We were advised by procurement officers from each MA that City Deal procurement records are held in line with their own authority’s Record Retention and Disposal policy. 3.8 However, we did identify some areas for improvement in existing arrangements. We were advised through discussion with officers from all eight MAs that they are all compliant with FWF and we were provided with public statements detailing their compliance. It was noted through discussion and review of the FWF statement for one MA that they are not currently an accredited RLW employer. We were advised that the MA pay the Scottish Local Government Living Wage which is currently higher than the current RLW and therefore meet the FWF Requirements. However, as the RLW is adjusted in the future there is a risk that the MA may not continue to meet this requirement. The MA noted in a committee report in August 2025 to continue to monitor the RLW and their compliance with this requirement. 3.9 Furthermore, from review of Scottish Government guidance we identified that if an MA uses a third-party organisation to deliver the grant funded activity the organisation must be a RLW employer in order to meet FWF requirements. Through examination of evidence and discussions with the eight MAs, we identified three instances where third-party agreements were established after the introduction of FWF requirements. In all three cases, the original grant agreements did not reference the FWF condition; however, each third-party organisation was already an accredited RLW employer and therefore met the required standard. 3.10 Furthermore, the Scottish Government guidance specifies that where a grant agreement was established prior to the introduction of Fair Work First (FWF) requirements and spans multiple years, the FWF condition should be incorporated at an appropriate break point in the agreement. Through our review of performance reports and discussion with Lead Officers, we identified one MA with such an arrangement which is progressing to stage two of the project. FWF requirements should therefore be considered before the project progresses to phase two; through discussion with the Lead Officer we were advised that this will be included in the agreement. 3.11 An action plan is provided at section four outlining our observations, risks and recommendations. We have made two recommendations for improvement. The priority of each is noted below:
Page 55
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Fair Work First Compliance 4 Introduction Audit Opinion Main Findings Action Plan Priority Definition Total High Key controls absent, not being operated as designed or could be improved. Urgent attention required. 0 Medium Less critically important controls absent, not being operated as designed or could be improved. 1 Low Lower level controls absent, not being operated as designed or could be improved. 1 Service Improvement Opportunities for business improvement and/or efficiencies have been identified. 0 3.12 The audit has been undertaken in accordance with the Global Internal Audit Standards in the UK public sector. 3.13 We would like to thank officers involved in this audit for their cooperation and assistance. 3.14 It is recommended that the Head of Audit and Inspection submits a further report to Committee on the implementation of the actions contained in the attached Action Plan.
Page 56
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Fair Work First Compliance 5 Introduction Audit Opinion Main Findings Action Plan 4 Action Plan No. Observation and Risk Recommendation Priority Management Response Key Control: Arrangements are in place across all Member Authorities to ensure compliance with all Fair Work First Requirements 1 From review of Scottish Government guidance documents, we confirmed that when a grant recipient uses a third-party organisation to carry out the grant funded activity, that organisation must pay at least the RLW to workers directly engaged in the delivery of the funded activity in order to comply with FWF requirements. it is the responsibility of the MA to seek confirmation that the third-party organisation pays at least the RLW by including this in the agreement between the two parties. We found three instances where an agreement had been in place between and MA and a third party and FWF was not included in the initial agreement. in one case a phase two agreement was put in place which did include FWF, the MA obtained evidence to support this. In the other two cases the third party is an PMO Management should ensure that the requirement for third-party organisations to comply with FWF is included in the appraisal table which is used when assessing business cases. In addition, the PMO should remind MAs of the requirement to add FWF conditions to project agreements where a pause or future phase allows. Medium Response: Accepted Recommendation will be implemented. Reminder to Lead Officers to add FWF conditions where a pause/future phase allows – to be issued by end of April 2026 Officer Responsible for Implementation: Head of Glasgow City Region Programme Management Office Timescales for Implementation: 30 April 2026
Page 57
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Fair Work First Compliance 6 Introduction Audit Opinion Main Findings Action Plan No. Observation and Risk Recommendation Priority Management Response accredited RLW employer and therefore met FWF requirements. We also noted one MA had entered into a joint venture with a third-party organisation prior to the introduction of FWF. Scottish Government guidance states that where multi-year funding arrangements include a suitable review point, FWF conditionality should be incorporated into grant agreements for subsequent years. Through discussion the MA advised that this will now be included in the phase two agreement. Without the inclusion of FWF requirements for third party grant agreements there is an increased risk that Scottish Government conditions of funding are not being met.
Page 58
7 Introduction Audit Opinion Main Findings Action Plan No. Observation and Risk Recommendation Priority Management Response Key Control: Arrangements are in place across all Member Authorities to ensure compliance with all Fair Work First Requirements 2 As grant recipients, MAs are required to comply with the terms and conditions set out in the Scottish Government’s Grant Offer letter, which requires them to pay at least the real living wage (RLW). Through discussion and review of documents we were advised that seven of the MAs are accredited RLW employers and therefore reliance can be placed on the accreditation that this requirement is being met. One MA advised that they are not an accredited RLW employer which is recognised in their FWF statement. We were advised by Officers and provided with committee papers that state the authority currently pay the Scottish Local Government Living Wage which is higher than the RLW. Without the additional assurance of a grant recipient being an accredited RLW employer there is an increased risk that in the future FWF requirements are not met. The PMO should obtain confirmation of compliance with the RLW requirement of FWF from the non-accredited member authority in the form of an anonymised pay band report. This should be provided on an annual basis while the MA is non-accredited before the pass down letter is agreed, to ensure alignment with the Grant Offer Letter conditions. Low Response: Accpeted Recommendations accepted and to be implemented When issuing 2026/27 Pass Down Grant Letter (estimated July 2026) Officer Responsible for Implementation: Glasgow City Region Finance Manager Timescales for Implementation: 30 July 2026
Page 59
Internal Audit | Education Services | Gateway Shared Services 0 Introduction Audit Opinion Main Findings Action Plan Glasgow City Region Clyde Mission Heat Decarbonisation Fund Governance – Phase One Final Report April 2026 FS 57095
Page 60
Glasgow City Council Internal Audit | Glasgow City Region | Clyde Mission and Heat Decarbonisation Governance -Phase one 1 Introduction Audit Opinion Main Findings Action Plan 1 Introduction 1.1 As part of the agreed Internal Audit plan, we have carried out a review of the Clyde Mission Heat Decarbonisation Fund (CM-HDF) Governance arrangements within the Glasgow City Region (GCR). 1.2 CM-HDF is a three-year investment programme being administered by GCR and funded by The Scottish Government (SG). Its purpose is to accelerate the replacement of fossil fuel heating systems with low and zero carbon alternatives across the Clyde Mission corridor, in line with local, regional and national policy objectives. 1.3 The scheme was launched on 10 December 2025 after gaining approval at cabinet on 18 November 2025. The application process is underway for eligible projects to apply for funding. At least one element of project infrastructure (e.g. generation, storage, distribution, use) must be located within the Clyde Mission corridor. 1.4 The scope of the audit was to ensure there are sufficient and appropriate arrangements in place covering the CM-HDF. The scope of the audit included a review of: • The documented policies and procedures, roles and responsibilities. • The governance and operational management arrangements. • The reporting activities to track progress and adherence to the Assurance Framework. • Reporting to the Scottish Government • Monitoring Arrangements • Risk Management • Record keeping arrangements to maintain an audit trail and ensure compliance with retention requirements. 1.5 A second phase of this review is included in the 2026/27 audit plan to consider the operational activities and ensure they comply with the governance arrangements. Commented [CM1]: Quarterly Reporting and Annual Reporting
Page 61
Glasgow City Council Internal Audit | Glasgow City Region | Clyde Mission and Heat Decarbonisation Governance -Phase one 2 Introduction Audit Opinion Main Findings Action Plan 2 Audit Opinion 2.1 Based on the audit work carried out, assurance can be taken that the control environment is satisfactory. 3 Main Findings 3.1 We are pleased to report that key controls are in place in relation to the governance arrangements for the CM-HDF Through discussion and review of documentation we found that key officers are aware their roles and responsibilities. 3.2 From review of documentation and discussion with the Programme Manager, we found that there is a clear governance structure in place with regards to the CM-HDF. We confirmed that there are planned reporting arrangements in place to comply with the governance structure once the projects are approved and progress. Additionally, we found that the governance arrangements are provided to the applicants via an application guidance document, these are publicly available through the GCR website. 3.3 Through review of documentation and discussion, we found that there are clear and reasonable monitoring and reporting arrangements in place for projects and GCR. These requirements are set out in the application guidance and in the grant offer letter which will be issued to approved projects. In addition, internal documentation is in place that details the monthly monitoring and reporting arrangements and the roles and responsibilities required for both the approved projects and relevant GCR officers. 3.4 Through discussion with the Programme Manager and review of Internal documentation we found that arrangements are in place for consistent reporting to SG regarding CM-HDF. This includes quarterly grant claims which will be provided to the SG by GCR based on the grant claims provided by projects. 3.5 We were advised that there is a document retention policy of 6 years in place in line with SG requirements. All documentation relating to projects is saved in a secured drive which is only accessible by relevant officers and will be disposed of at the end of the retention period. The retention period is also in alignment with the council’s data retention policy. 3.6 We were advised through discussion that there are risk management arrangements in place; this includes a monthly review of the risk register. However, through review of documentation we found a discrepancy in the frequency of how often the risk register would be reviewed. This has since been addressed by the Programme Manager and updated to
Page 62
Glasgow City Council Internal Audit | Glasgow City Region | Clyde Mission and Heat Decarbonisation Governance -Phase one 3 Introduction Audit Opinion Main Findings Action Plan reflect the monthly review. We found that all other internal documentation was accurate to the intended working practices. 3.7 In addition, we found through review of the application guidance document that applicants are not made aware of the change control process. We were able to confirm through review of internal documentation that there is a change control process in place. We have been advised that this was an oversight and that the Programme Manager has updated the application guidance to include the change control process. 3.8 The audit has been undertaken in accordance with the Global Internal Audit Standards in the UK public sector. 3.9 We would like to thank officers involved in this audit for their cooperation and assistance. 3.10 It is recommended that the Committee notes the contents of this report.