Summary of Internal Audit Reports for period 01 January to 13 complete
Renfrewshire Council · 20 May 2024
Back to Audit, Risk and Scrutiny Board — 20 May 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 20 May 2024 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 01 January to 13 May 2024 ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement, Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details those audit engagements completed during the period 1 January to 13 May 2024 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to OneRen and Renfrewshire Health and Social Care Integrated Joint Board;
Page 2
• Co-ordination of the Council’s corporate risk management activity; • Management of the counter fraud team; • Management of the risk management and insurance team. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 1 January to 13 May 2024. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Karen Campbell – 07768354651
Page 3
Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 1 January – 30 April 2024 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Chief Executives Commercial and Industrial Rents No Assurance 3 4 0 0 Children’s Services/Finance & Resources Supply Teachers Reasonable 0 0 3 1 Corporate Procurement – Service Controls - Purchasing Processes Limited 3 4 5 0 Finance & Resources Hardship and Discretionary Funds Reasonable 0 1 3 0 ICT Asset Management Limited 2 9 0 1 Health & Safety Limited 2 5 1 0 Environment, Housing & Infrastructure Building Services - Stores Limited 2 2 2 0 Note – No assurance rating can be given in respect of investigation assignments
Page 4
Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report Chief Executives Commercial & Industrial Rents (A0048/2024/001) Date: January 2024 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. A record of all commercial and industrial properties for rental is maintained which is accurate and up to date. 2. There is a clearly defined letting policy for commercial and industrial properties, which is comprehensive and supported by appropriate documented guidance. 3. Terms of tenancy (including reletting) are established and formally recorded and agreed. 4. Rents are regularly reviewed, reflect current market rates and are collected in full. 5. Enforcement action is taken to recover unpaid rents. 6. Void properties are actively managed to minimise loss of rental income. Audit Scope 1. Interviewed the appropriate staff, evaluated the system in place for allocation and reletting commercial and industrial properties and identified any possible improvements to the system. 2. Undertook a series of tests to ensure the processes for allocation and reletting of commercial and industrial properties are operating effectively and as described. Key Audit Assurances No assurances can be given in relation to this audit review. Key Audit Risks 1. In the absence of a formalised letting policy, the process for letting commercial properties may lack clear direction and the fragmented nature of record keeping can make it more difficult to effectively manage these properties. 2. When physical inspections to check that the correct tenants are occupying leased commercial properties are not regularly carried out, there is an increased risk that subletting will not be identified. 3. Where letting agreements are not reviewed, errors or changes required to the leases will not be reflected and could lead to inappropriate contract terms and rental income not being maximised. 4. Where rents arrears are not followed up timeously, the council could fail to maximise the income generated from the let of commercial properties. 5. Where tenants responsible for insurance are not recharged from council insurance payments, there are increased costs to the council.
Page 6
Internal Audit Report Chief Executives Commercial & Industrial Rents (A0048/2024/001) Date: January 2024 6. When void properties are not identified for repair as soon as possible, this will delay the release of properties and reduced rental income will be received. Overall Audit Opinion The audit highlighted significant weaknesses in the system of internal control. Specifically, there are a number of tasks that are not being completed or are behind schedule, including physically inspecting leased properties, following up arrears and sending void properties for repair quickly so that they can be re-let. There is no systematic review of lease terms or rents charged and most rents have not been changed for several years. The auditor was unable to provide any positive assurance over the objectives being reviewed and recommendations were made to address these areas. At the time of the review, the team had a number of vacancies for a prolonged period of time, so progressing the desired improvements to the processes had been held back. Management Commentary The Head of Economy and Development will lead on a strategic review of the Council’s commercial property portfolio and function. We agreed a number of actions to address the audit recommendations and improve the current operating processes for the letting and managing of commercial properties and are currently working on their implementation.
Page 7
Internal Audit Report CHILDREN'S SERVICES/FINANCE & RESOURCES Supply Teachers (A0063/2023/001) Date: January 2024 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to: - 1. Review and evaluate the process for the recruitment of teachers to the Supply Register. 2. Examine and assess for adequacy the processes followed for the deployment of Supply Teachers to schools ensuring that the distribution of hours is fair and equitable. 3. Ensure that hours worked are appropriately recorded, authorised and paid correctly. 4. Identify any areas for improvement and outline actions to address these. Audit Scope 1. Obtained copies of appropriate guidance relating to the recruitment and deployment of Supply Teachers. 2. Interviewed relevant officers to obtain the required information relating to the Supply Teachers processes. 3. Prepared a series of tests to meet the detailed audit objectives. Key Audit Assurances 1. There are satisfactory processes in place in relation to the recruitment of supply teachers. 2. The hours worked by supply teachers are appropriately recorded, authorised and paid correctly. Key Audit Risks There are no key risks to report. Overall Audit Opinion The deployment and payment of supply teachers is labour intensive and there is duplication of effort. These processes are currently under review by management in both Children’s Services and Finance and Resources to establish if there are any opportunities to streamline the process. The auditor has made recommendations mainly in relation to the payment process which will improve efficiency in this area.
Page 8
Internal Audit Report CHILDREN'S SERVICES/FINANCE & RESOURCES Supply Teachers (A0063/2023/001) Date: January 2024 Management Commentary It has been agreed to progress the recommendations made in the audit report.
Page 9
Internal Audit Report Corporate Procurement - Service Controls - Purchasing Processes (A0032/2024/001) Date: February 2024 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to: - 1. Review any Amazon Prime Memberships across the Council and analyse Amazon purchases to ensure that the correct procurement route has been utilised. 2. Identify the level of purchase cards held within Services and establish their Purchase Card ordering processes. 3. Ensure that purchase card purchase requests have been appropriately authorised. 4. Ascertain the role performed by the Purchase to Pay Team in terms of ordering goods and services on behalf of other services and subsequent payment and ensure that there is adequate segregation of duties. 5. Ascertain the controls in place surrounding purchase card transaction and monthly limits. Audit Scope 1. Interviewed the relevant officers and obtained the required information and documentation relating to the specified purchasing processes. 2. Prepared and carried out a series of tests on appropriate sample groups to meet the detailed audit objectives. Key Audit Assurances 1. The segregation of duties relating to orders placed by the Purchase to Pay Team are satisfactory. 2. A new corporate process for ordering from Amazon has been introduced. This has reduced costs relating to Amazon Prime memberships. Furthermore, the new process provides more control over purchases and increased oversight of goods ordered from this supplier. Key Audit Risks 1. Contract agreements are not maintained, and benefits are not realised when purchase cards are used with non-contract suppliers for goods where there is already a contract in place. 2. Unauthorised purchases could be made, if the stipulated procedures are not followed for authorising the order of goods or where an electronic signature has been used with no backup. 3. Increased limits to monthly expenditure or individual transactions could be in place for longer than necessary if there is inadequate management oversight in place.
Page 10
Internal Audit Report Corporate Procurement - Service Controls - Purchasing Processes (A0032/2024/001) Date: February 2024 Overall Audit Opinion The main weaknesses identified were in relation to purchasing goods outwith the agreed procurement routes and the authorisation of goods ordered. There was also a lack of evidence relating to the authorisation of the increase of purchase card spend limits. A number of other housekeeping issues were also identified. For these reasons, assurance within this area was found to be limited. Recommendations have been made which, if implemented, will improve controls over purchase card purchases. Management Commentary All purchase card holders and approvers have been formally reminded of the purchasing procedures they must follow when acquiring goods and services in terms of the correct routes to purchases and the authorisation process for purchases/transactions. Supporting guidance has also been update. Reports on card usage will now be run more regularly and queries raised with the appropriate service management, to determine if the card is still required.
Page 11
Internal Audit Report FINANCE & RESOURCES Other Financial Assistance Payments - Hardship and Discretionary Funds (A0051/2024/001) Date: April 2024 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ascertain that: 1. There are documented processes in place for payments from the Scottish Welfare Fund and the Discretionary Housing Payments Fund. 2. Roles and responsibilities are clear in relation to decision making, escalation and dispute resolution. 3. Grants and payments have been made in line with the documented procedures, applicants confirmed as eligible and all relevant documentation has been provided, or other explanation recorded. 4. Each case has been treated strictly on its merits and all applicants have received fair and equal treatment within any agreed flexibility guidelines. 5. Reasons for rejected applications are confirmed to applicants. 6. The costs associated with grants and payments are being tracked, monitored and reported on as required. Audit Scope 1. Interviewed the relevant officers and obtained the required information and documentation relating to the processes surrounding the Scottish Welfare Fund and the Discretionary Housing Payments Fund. 2. Prepared and carried out a series of tests on appropriate sample groups to meet the detailed audit objectives. Key Audit Assurances 1. The processes in place for payments from the Scottish Welfare Fund and the Discretionary Housing Payments Fund are documented. 2. Grants and payments are made in line with the documented procedures. 3. Each case is treated strictly on its merits and all applicants have received fair and equal treatment within any agreed flexibility guidelines. 4. Grants and payments are being tracked, monitored and reported on as required. Key Audit Risks No key risks identified.
Page 12
Internal Audit Report FINANCE & RESOURCES Other Financial Assistance Payments - Hardship and Discretionary Funds (A0051/2024/001) Date: April 2024 Overall Audit Opinion In the main the processes surrounding payments made from the Scottish Welfare Fund (SWF) and the Discretionary Housing Payment (DHP) funds were found to be satisfactory. Weaknesses were found relating to verification of awards and ensuring that customers are advised of the reasons why their application has been declined. Recommendations have been made to strengthen the controls in these areas. Management Commentary We are in the process of actioning the internal audit recommendations and staff will be reminded of the information that should included in client correspondence.
Page 13
Internal Audit Report FINANCE & RESOURCES ICT Planning and Organisation - Asset Management (A0072/2024/001) Date: April 2024 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: 1. Documented procedures, which includes any necessary provisions for the current mix of office based and home working arrangements, are in place covering the use of physical IT assets and the procedures are easily accessible to all users to ensure they are aware of their responsibilities in relation to the policy. 2. Standard IT equipment asset lists have been created for predefined user roles and deviations from the standard equipment is appropriately approved. 3. All IT assets are procured through the ICT Service, and equipment purchased is stored centrally and securely until they have been issued to end users. 4. All IT assets must be assigned to individual users or to a department who will be held responsible for them and there is a mechanism for recording the physical location for all ICT assets that have been issued. 5. All IT assets that are no longer in use must be returned to the ICT Service for redeployment. 6. All receipts and issues from the centralised ICT store are appropriately documented and approved and stock is held securely until issued. 7. End of life disposal of ICT assets are co-ordinated by the ICT Service and procedures are in place to ensure that confidential information is removed prior to disposal. Audit Scope 1. Obtained copies of appropriate policies and procedures relating to IT asset procurement, deployment, assignation and disposal. 2. Interviewed relevant officers to obtain the required information relating to the above processes. 3. Prepared a series of tests to meet the detailed audit objectives. Key Audit Assurances 1. Documented procedures are in place covering the use of physical IT assets and the procedures are easily accessible to all users to ensure they are aware of their responsibilities in relation to the policy. 2. Orders for equipment which deviate from standard equipment are appropriately approved.
Page 14
Internal Audit Report FINANCE & RESOURCES ICT Planning and Organisation - Asset Management (A0072/2024/001) Date: April 2024 Key Audit Risks 1. Given that the physical location and user details for all ICT assets could not be fully verified as the systems used to record assets are not fit for purpose in their current format, there is a risk that council assets are not protected. 2. Without evidence of disposals, there is a risk that all disposal processes may not have been followed. Overall Audit Opinion The Auditor was advised that the ICT Support Team have only recently taken responsibility for the area of ICT asset management under review. The main weakness identified was that the mechanism in place to record the physical location for all ICT assets was not fit for purpose in its current format as the asset information is not held centrally but is held on a number of documents and inaccuracies were found in the recorded data. Although there is a disposals process in place, there was also a lack of evidence in some cases to support that this process had been followed. Furthermore, officers within the ICT team do not proactively contact line managers for the return of leavers equipment despite there being a process in place to facilitate this. In addition, there is no requirement for users to sign for assets upon receipt. For these reasons identified, assurance within this area was found to be limited. Recommendations were made which, if implemented, will improve controls in these areas. Management Commentary The new ICT Support team was formed during 2023/24 and a lot of work has since been undertaken or is in progress in this area. We have completed a data cleanse of our records and now have an accurate stock record of ICT Assets. A new process for managing the PC/Laptop refresh process has also been introduced which strengthens the controls in this area. Longer term. a service desk system which has full asset management capability is being procured which will automate many of the manual processes currently in place and therefore reduce the likelihood of errors/omissions occurring.
Page 15
Internal Audit Report Finance & Resources Health & Safety (A0091/2024/001) Date: May 2024 COMMITTEE SUMMARY Audit Objectives The objectives of the audit are to ensure that:- 1. There are clearly defined and understood roles and responsibilities for health and safety, including risk identification. 2. There are adequate and up to date policies and procedures in place which are readily available to those who need them. 3. There is regular engagement with other service areas to ensure compliance with legislative requirements. 4. There is a programme of health and safety audits and these are followed up adequately. 5. There are adequate arrangements in place for reporting, accidents, incidents and near misses and these are adequately followed up. 6. Performance monitoring and reporting arrangements are appropriate. Audit Scope 1. Interviewed the appropriate staff to obtain the required information and documentation to evaluate the system in place for corporate health and safety. 2. Prepared a series of tests to ensure the processes relating to corporate Health & Safety are operating effectively and as described. Key Audit Assurances 1. There are clearly defined roles and responsibilities for health and safety, including risk identification documented in the Council’s Policy on Health, Safety & Welfare. 2. There is regular engagement between members of the Health & Safety team with other service areas which includes weekly, monthly and quarterly meetings as well as ad hoc conversations and emails. 3. There are adequate arrangements in place for reporting, accidents, incidents and near misses which are followed up as and when required. Key Audit Risks 1. There are a number of policies and procedures which have not been refreshed or reviewed timeously. In some cases, guidance that has been updated is not accessible to all staff. There is a risk that staff may not be aware of, or be following, the correct processes and procedures. 2. Whilst there is evidence of programmed physical inspections being undertaken on a number of premises. There was no evidence of a programme of health and safety audits being undertaken of the health and safety management systems within Services of the by the Health & Safety team. There is, therefore, there is no oversight
Page 16
Internal Audit Report Finance & Resources Health & Safety (A0091/2024/001) Date: May 2024 of the level of compliance within services with the requirements documented in the Council’s Policy on Health, Safety & Welfare. 3. The performance reporting currently in place does not include target levels which means that trends may not be identified and addressed appropriately and performance is not suitably scrutinised. 4. In line with Management of Health and Safety at Work Regulations, the council must be able to demonstrate that it operates effective planning, organisation, control, monitoring and review of health and safety. Given the key risks arising from the audit, it is a matter of concern that current practices may be deemed insufficient should an incident occur which could leave the council open to adverse consequences. Overall Audit Opinion Although the Principal HR & OD Adviser has explained future implementation plans regarding health and safety audits and performance monitoring and reporting, these processes are not in place at the moment. Furthermore, it was noted that three findings detailed in this report, had previously been reported to Finance & Resources management in a prior audit report issued in March 2018. It is the auditor’s opinion that it is imperative that the recommendations made in this report are addressed to ensure compliance with regulations and to demonstrate the council’s commitment to the health, safety and wellbeing of its stakeholders. The auditor has therefore provided a limited assurance rating for corporate health & safety based on the current arrangements. Management Commentary The Director of Finance and Resources will seek to engage an appropriately qualified external consultant to review and make recommendation on the strategic governance and operational arrangements for health and safety. This review is intended to go wider than the recommendations included in this report to ensure that governance and operational procedures and processes are aligned to the needs of the organisation. Management has also agreed to implement the recommendations made in the internal audit report and an action plan is in place to ensure this.
Page 17
Internal Audit Report ENVIRONMENT, HOUSING AND INFRASTRUCTURE Building Services Stores (A0047/2024/001) Date: April 2024 COMMITTEE SUMMARY Audit Objectives A new building services management system went live in April 2022 has not been fully operational since it was introduced, partly due to the loss of key staff by the external developer. In relation to the stores element, the subject of this audit review, there are a number of temporary manual processes that have been put in place to compensate for the lack of current functionality within the system. The audit review sought to confirm that the manual processes that have been put in place are sufficient in relation to the objectives below. The objectives of the audit were to ensure that: 1. There are adequate checks of the quantity, quality and price of stock received and receipts are correctly recorded on the stock system; 2. Stock issues are controlled to ensure that they are only for approved work requirements and are correctly recorded on the stock system; 3. Stock is held securely and access is appropriately restricted; 4. Stock counts are regularly carried out and reconciled to stock records and differences identified are investigated; 5. Stock is regularly checked to identify obsolete/slow moving items and appropriate actions are taken for items identified; 6. Stock write offs/ disposals are appropriately authorised. Audit Scope 1. Interviewed the appropriate officers to understand the arrangements in place for the control of stock. 2. Examined the relevant procedures and assessed their adequacy. 3. Carried out sample testing to confirm the adequacy of the controls in place over the stock records. Key Audit Assurances 1. The manual processes put in place to record receipts and issues of stock were found to be accurately recorded into the system. 2. There are adequate checks of the quantity, quality and price of stock received. 3. Stock issues are controlled to ensure that they are only for approved work requirements. 4. Stock counts are regularly carried out and reconciled to stock records and differences identified are investigated
Page 18
Internal Audit Report ENVIRONMENT, HOUSING AND INFRASTRUCTURE Building Services Stores (A0047/2024/001) Date: April 2024 Key Audit Risks • The Workhub system does not currently have the required functionality to operate efficiently as a stores system or a job costing system, development work on the system has been on hold due to contractor issues and has only operationally re-started. As a result, manual processes have been introduced which are resource intensive and inherently at risk of error. The costs associated with Workhub are around £100,000 per annum and there are additional, currently unquantified, costs associated with the manual processes. However, it should be noted that Workhub and the associated packages (and costs) relate to systems wider than just stores e.g. job scheduling, operative workload and financial costings. Overall Audit Opinion The sample testing undertaken indicates that the manual processes in place are sufficient to meet operational needs and were found to be accurate. However, it is a concern that the Workhub system is currently not fit for purpose and development has only recently recommenced. The Auditor has provided a limited level of assurance in this regard and has recommended that management continue to undertake a review of the continued economic viability of the Workhub system. The auditor notes that both the Director of Environment, Housing and Infrastructure and the Director of Finance and Resources have been kept fully briefed on the on-going challenges around Workhub. Management Commentary Facilities and Property Services have committed a lot of resource (both financially and staff resource) since early 2022 into the repairs and maintenance management system (WorkHub). This was needed due to the old system being removed and with approximately 85,000 jobs per year by Building Services, an electronic system is essential. There remain on-going challenges with the system and contractor, however, Senior Management including the Directors of both Finance and Resources and Environment, Housing and Infrastructure have been kept up to date with the system and next steps. The manual processes for the Building Services stores have been found to be working, however, certain processes have been tightened following the outcome of the internal audit. The actions will be monitored over the coming months to ensure compliance and improvements wherever possible.