Summary of Internal Audit Activity in Partner Organisations complete
Renfrewshire Council · 20 May 2024
Back to Audit, Risk and Scrutiny Board — 20 May 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 20 May 2024 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Activity in Partner Organisations April 2023 to April 2024 ___________________________________________________________________ 1. Summary 1.1 Members of the Audit, Risk and Scrutiny Committee expressed an interest in the outcomes of audits undertaken in partner organisations. A proposed revision to the Audit, Risk and Scrutiny Board’s Terms of Reference, to facilitate this, was agreed at Council on 4 May 2024. 1.2 This report provides members with a summary of the internal audit arrangements within each partner body and a summary of the internal audit activity from April 2023 to April 2024. 1.3 Renfrewshire Valuation Joint Board – Internal audit services are provided by Renfrewshire Council’s Internal Audit Service A summary of each completed audit engagement is reported to the Board, An annual report is also provided to the Board, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion. The 2023/24 annual report will be considered by the Board on 24 May 2024. During the reporting period, one audit review was finalised in relation to information governance, a summary of this audit engagement is included at appendix 1 of this report. 1.4 Scotland Excel Joint Committee - Internal audit services are provided by Renfrewshire Council’s Internal Audit Service A summary of each completed audit engagement is reported to the Executive Sub-Committee. An annual report is also provided to the Executive Sub-Committee, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion. The 2023/24 annual report will be considered by the Sub-Committee on 17 May 2024. During the reporting period, one audit review was finalised in
Page 2
relation to contract management for social care contracts, a summary of this audit engagement is included at appendix 2 of this report. One further audit is currently in progress in relation to contract monitoring (implementation of collaborative procurement), this is nearing completion and will be reported to the Executive Sub-Committee once finalised. 1.5 Renfrewshire Integration Joint Board - Internal audit services are provided by Renfrewshire Council’s Internal Audit Service A summary of each completed audit engagement is reported to their Audit, Risk and Scrutiny Committee. An annual report is also provided to the Committee, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion. The 2023/24 annual report will be considered by the Sub-Committee on 21 June 2024. During the reporting period, one audit review was finalised in relation to performance management, a summary of this audit engagement is included at appendix 3 of this report. The annual review of compliance with the Local Code of Corporate Governance is nearing completion and will be reported to their Audit, Risk and Scrutiny Committee once finalised. 1.6 Glasgow & the Clyde Valley Strategic Development Planning Authority Joint Committee - Internal audit services are provided by Renfrewshire Council’s Internal Audit Service A summary of each completed audit engagement is reported to their Audit, Risk and Scrutiny Committee. An annual report is also provided to the Committee, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion. The 2023/24 annual report will be considered by the Joint Committee on 10 June 2024. No specific audit engagements were planned during the reporting period. 1.7 Glasgow City Region City Deal – Internal audit services are provided by Glasgow City Council Internal Audit Services, finalised reports for each completed audit engagement are reported to the Glasgow City Region Cabinet and the reports are shared with member Council’s. The Chief Auditor for Renfrewshire Council meets regularly with the City Region Auditors and provides them with an annual assurance statement to support the Glasgow City Region annual governance statement. During the reporting period, three audit reviews were completed and have been included at appendices 4-6. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to note the audit arrangements for each partner organisation. 2.2 Members are invited to note the content of the audit reports and audit summaries that have been considered by the partner bodies. __________________________________________________________________ Implications of the Report
Page 3
1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plans for the partner bodies 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Andrea McMahon
Page 4
Appendix 1 Internal Audit Report Renfrewshire Valuation Joint Board Governance Arrangements - Information Governance (B0005/2024/001) Date: September 2023 BOARD SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. Personal information is kept secure, accurate and up to date. 2. Appropriate measures and records are in place to demonstrate compliance with key Data Protection Principles. 3. Arrangements are in place to ensure that Data Privacy Impact Assessments are undertaken when required. 4. Arrangements are in place to provide training on GDPR to relevant employees. 5. Procedures are in place to identify data breaches and report them to Renfrewshire Valuation Joint Board’s (RVJB) Data Protection Officer. Audit Scope 1. Ascertained the information that RVJB holds, how sensitive the information is and how it is stored. 2. Discussed with appropriate staff the arrangements in place to demonstrate compliance with information security good practice. 3. Reviewed and assessed the evidence to support compliance and identified any possible improvements. Key Audit Assurances 1. Personal information is kept secure through physical access controls and passwords; and is kept accurate and up to date through regular reviews. 2. Appropriate measures and records are in place to demonstrate compliance with key Data Protection Principles, including application of the Data Protection and Information Handing policies. 3. Arrangements are in place to ensure that Data Privacy Impact Assessments are undertaken for new initiatives or change of business practices involving personal data. 4. Arrangements are in place to provide training on GDPR to relevant employees through annual refresher training, regular bulletins and awareness emails. 5. An Information Security Incident Log is in place but there have been no recorded data breaches. Key Risks There were no key risks identified during the audit.
Page 5
Appendix 1 Internal Audit Report Renfrewshire Valuation Joint Board Governance Arrangements - Information Governance (B0005/2024/001) Date: September 2023 Overall Audit Opinion The audit identified that satisfactory arrangements in place for the handling of personal information within the RVJB. The systems in place for the Electoral Register, Valuation Roll and Council Tax dwellings are well controlled and regularly reviewed. Staff are regularly trained and made aware of their responsibilities for handling personal data.
Page 6
Appendix 2 Internal Audit Report Scotland Excel Social Care Contracts (A0008/2023/001) Date: September 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to: - 1. Evaluate the extent to which Scotland Excel's care contracts support the principles relevant to commissioning and procurement as set out in the recommendations detailed in the Feeley Review. 2. Identify any areas for improvement and outline actions to address these. Audit Scope 1. Obtained a copy of the publication, 'An Independent Review of Adult Social Care in Scotland', by Derek Feeley. 2. Interviewed relevant officers within Scotland Excel and obtained information relating to social care contracts. 3. Prepared a series of tests to meet the detailed audit objectives. Key Audit Assurances 1. Scotland Excel were able to evidence that for the contracts selected for testing, work has been undertaken to ensure that, where possible, the commissioning and procurement recommendations as set out in the Feeley Review have been or will be implemented. 2. Stakeholder engagement and market research, including service users and people with lived experience has been carried out to ensure that there has been a collaborative, rights based and participative approach. 3. The Procurement Strategy and Service Specifications documentation also include ethical and fair work requirements as set out in the Feeley Review recommendations. Key Risks There were no key risks arising from the audit review. Overall Audit Opinion In the care frameworks currently being created by Scotland Excel, the commissioning and procurement recommendations set out in the Feeley Review have been incorporated, where possible, to include areas such as a collaborative, rights based and participative approach and ethical and fair work requirements. Work has been undertaken to ensure that the additional processes outlined in the Feeley Review will be included in future frameworks.
Page 7
Appendix 3 Internal Audit Report INTEGRATION JOINT BOARD IJB – Performance Management (B0017/2024/002) Date: January 2024 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: • Roles and responsibilities for performance management are clear and understood. • A performance management strategy / framework is in place and details the key performance indicators. • Key performance indicators set are SMART and are aligned to organisational objectives. • Performance is reviewed regularly by management and the Board. • Arrangements are in place to ensure that where targets are not being achieved there are mechanisms to review and improve performance. Audit Scope 1. Checked that an adequate system was in place to record the required performance information for each indicator selected and evaluated for adequacy. 2. For a sample of underperforming indicators, ascertained the review process, what actions were being taken to address these and if the actions taken were sufficient, 3. Checked that there was adequate management oversight for the selected performance indicators. Key Audit Assurances 1. Roles and responsibilities for performance management within the Planning and Performance team are clear and understood. 2. A performance management strategy / framework is in place through strategic plans and performance reports that detail the key performance indicators. 3. Key performance indicators tested from the Annual Performance Report were SMART and were aligned to organisational objectives in the strategic plan. 4. Performance scorecards are reviewed annually by management to ensure the indicators are meaningful with realistic and achievable targets and are reported to Board.
Page 8
5. For underperforming indicators tested, arrangements were in place to ensure that where targets were not being achieved, there were mechanisms to review and improve performance. Key Risks • No key risks were identified as a result of this audit. Overall Audit Opinion The audit identified that satisfactory arrangements are in place for performance management within the Renfrewshire Health and Social Care Partnership. The systems in place for monitoring and reviewing key performance indicators are well controlled. As a result, there were no audit findings identified during this review and the auditor has made a provision of substantial assurance for the areas tested. Management Commentary N/A as no key risks identified.
Page 9
Internal Audit | Education Services | Gateway Shared Services 0 Introduction Audit Opinion Main Findings Action Plan Internal Audit Glasgow City Region City Deal Project Procurement Strategies Final Report April 2023 FS 57095
Page 10
Internal Audit | Glasgow City Region City Deal | Project Procurement Strategies 1 Introduction Audit Opinion Main Findings Action Plan 1 Introduction 1.1 As part of the agreed Internal Audit plan, we have undertaken a review across the Glasgow City Region Programme Management Office (the PMO) and member authorities in relation to Project Procurement Strategies. 1.2 The new Regional Sustainable Procurement Strategy was approved by the Cabinet on 1 June 2021. The Procurement Support Group (PSG), made up of representatives from each of the eight member authorities and the PMO is responsible for translating the Sustainable Procurement Strategy into action by monitoring performance of core elements of delivery and undertaking reviews. The group continues to provide guidance on best practice to the PMO and other stakeholders and assists member authorities in understanding the impact procurement will have on the City Deal Programme. 1.3 We have been advised that in recent times member authorities have found that construction and materials costs have significantly increased. This is because procurement exercises are attracting fewer bids than anticipated, and / or higher value bids are being submitted. 1.4 The purpose of the audit was to review the project procurement strategies in place. These strategies aim to achieve competitive bids and ensure value for money during procurement exercises. The audit also sought to gain assurance that there are sufficient and appropriate controls in place in relation to procurement and that these are being complied with. The scope of the audit included: • A review of documented procurement strategies in place. • Reviewing a sample of project procurement exercises to ensure a sufficient number of bids were obtained. • Ensuring that there is appropriate attendance at PSG meetings, workshops and sub-groups. • Ensuring regular communication takes place between officers from the different member authorities and the PMO. • Checking that due diligence arrangements are in place for suppliers. • Reviewing the arrangements in place to provide suitable management information to the appropriate groups for scrutiny. • Reviewing the arrangements in place for supplier chain risk management. 1.6 The sample of member authorities that were selected for this review were: • Glasgow City Council • Renfrewshire Council • South Lanarkshire Council
Page 11
Internal Audit | Glasgow City Region City Deal | Project Procurement Strategies 2 Introduction Audit Opinion Main Findings Action Plan 2 Audit Opinion 2.1 Based on the audit work carried out a reasonable level of assurance can be placed upon the control environment. The audit has identified some scope for improvement in the existing arrangements and two recommendations which management should address. 3 Main Findings 3.1 We are pleased to report that key controls are in place and generally operating effectively. We found that the Regional Sustainable Procurement Strategy aligns with member authorities’ needs and strategic drivers. The Action Plan is reviewed annually, and reasonable arrangements are in place to monitor tasks and report progress against actions outlined in the strategy. 3.2 Suitable arrangements are in place within the three member authorities reviewed to provide support and attendance at the PSG meetings. There are appointed representatives from each member authority in attendance at the PSG, whose role is to provide operational support & guidance within their own organisation and to feed information through at different levels and provide feedback to the PSG. 3.3 However, we identified some areas where improvements should be made. Within the sample of nine procurement activities reviewed, we identified one exercise where the Sourcing Strategy had not been appropriately approved. We also identified one procurement activity where initially no bids were received for the required works. Although we were advised there many factors had contributed to this, a lack of early engagement with potential suppliers and failing to utilise the Prior Information Notice (PIN) may have also played a factor. 3.4 An action plan is provided at section four outlining our observations, risks and recommendations. We have made three recommendations for improvement. The priority of each recommendation is: Priority Definition Total High Key controls absent, not being operated as designed or could be improved. Urgent attention required. 0 Medium Less critically important controls absent, not being operated as designed or could be improved. 2
Page 12
Internal Audit | Glasgow City Region City Deal | Project Procurement Strategies 3 Introduction Audit Opinion Main Findings Action Plan Low Lower level controls absent, not being operated as designed or could be improved. 0 Service Improvement Opportunities for business improvement and/or efficiencies have been identified. 0 3.5 The audit has been undertaken in accordance with the Public Sector Internal Audit Standards. 3.6 We would like to thank officers involved in this audit for their cooperation and assistance. 3.7 It is recommended that the Head of Audit and Inspection submits a further report to Cabinet on the implementation of the actions contained in the attached Action Plan.
Page 13
Internal Audit | Glasgow City Region City Deal | Project Procurement Strategies 4 Introduction Audit Opinion Main Findings Action Plan 4 Action Plan No. Observation and Risk Recommendation Priority Management Response Key Control: Procurement exercises are undertaken in compliance with the documented procedures. 1 Procurement policies and procedures require member authorities to develop a sourcing strategy and obtain appropriate approvals to agree the route to market. Through sample testing of nine procurement exercises, we identified that one sourcing strategy was not approved by the project lead, the procurement lead or the resource senior manager. For all other eight procurement exercises, the sourcing strategy had been completed and approved where required. If sourcing strategies are not correctly approved there is an increased risk that an appropriate procurement exercise may not be undertaken. The PMO should remind all member authorities that sourcing strategies should be appropriately approved, and details of this approval retained for audit purposes. Medium Response: Accepted. Reminder will be issued to Lead Officers and Procurement Support Group members. Officer Responsible for Implementation: Head of City Region Programme Management Office Timescales for Implementation: To be discussed at 24 April 2023 Lead Officer Group (LOG) meeting and 18 May 2023 Procurement Support Group meeting.
Page 14
Internal Audit | Glasgow City Region City Deal | Project Procurement Strategies 5 Introduction Audit Opinion Main Findings Action Plan No. Observation and Risk Recommendation Priority Management Response 2 Through discussions at PSG meetings, it was highlighted to member authority representatives that the current status of the construction market means that suppliers are generally in positions to be able to choose which contracts to bid for. Within the sample of nine procurement activities, we identified one case where no bids were initially received for required works. We were advised that a new tender exercise is currently underway and a Prior Information Notice (PIN) is now being utilised to assist in attracting bidders. Market saturation increases the risk of a lack of tender responses, which in turn may result in failed tender exercises. To ensure best practice, early engagement with the market and utilising PINs may improve tender exercises conducted. The PMO should raise the construction market issue at the PSG and ask members to consider utilising PINs where appropriate. Medium Response: Accepted. Reminder will be issued to Lead Officers and Procurement Support Group members. Officer Responsible for Implementation: Head of City Region Programme Management Office Timescales for Implementation: To be discussed at 24 April 2023 Lead Officer Group (LOG) meeting and 18 May 2023 Procurement Support Group meeting.
Page 15
Internal Audit | Glasgow City Region City Deal | Stakeholder Engagement & Managing Relationships 1 Introduction Audit Opinion Main Findings Action Plan Internal Audit Glasgow City Region City Deal Stakeholder Engagement and Managing Relationships Final Report December 2023 FS 57095
Page 16
Internal Audit | Glasgow City Region City Deal | Stakeholder Engagement & Managing Relationships 2 Introduction Audit Opinion Main Findings Action Plan 1 Introduction 1.1 The Glasgow City Region Local Authorities (Member Authorities) entered into a City Deal with the UK and Scottish Governments in August 2014 (the City Deal). All Projects within the City Deal programme are monitored, scrutinised and challenged by, and are accountable to, the Glasgow City Region Programme Management Office (PMO). 1.2 To successfully deliver the programme, member authority City Deal project teams are required to work closely with other parties, both internally and externally, therefore appropriate stakeholder engagement and relationship management arrangements are crucial. 1.3 The purpose of the audit was to gain assurance that these arrangements are in place across the City Region, and for individual City Deal projects. The scope of the audit included: • Arrangements between member authorities, the PMO and other parties involved in City Deal projects across the region. • Availability of documented guidance and awareness of City Deal stakeholder engagement requirements. • Roles & responsibilities of key officers and teams. • Identification of key stakeholders within business cases. • Stakeholder engagement, including consideration of dependencies/interdependencies and risk associated with each stakeholder. • Monitoring and management of associated risks and dependencies. • Confirming that engagement arrangements with other parties are working as expected. • Training or experience gaps. • The impact of project dependencies with other parties on a sample of City Deal projects. • Lessons learned arrangements. • Best practice arrangements. 1.4 The sample of projects that were selected for review were: • Glasgow City Council – Holland St/Pitt St and Windmillcroft Quay. • Renfrewshire Council – Glasgow Airport Investment Area. • South Lanarkshire Council – A72/M74 Signalisation and Jackton Primary School. • West Dunbartonshire Council – Exxon Site Development.
Page 17
Internal Audit | Glasgow City Region City Deal | Stakeholder Engagement & Managing Relationships 3 Introduction Audit Opinion Main Findings Action Plan 2 Audit Opinion 2.1 Based on the audit work carried out a reasonable level of assurance can be placed upon the control environment. The audit has identified some scope for improvement in the existing arrangements and two recommendations which management should address. 3 Main Findings 3.1 We are pleased to report that a number of key controls are in place and generally operating effectively. We found that all member authorities conduct stakeholder analysis, which is included within the business case for each City Deal project. The business case is subject to an appraisal by the PMO using a standardised set of questions, which includes confirming that the main stakeholder groups and dependencies on internal and external factors have been identified and details of how these will be managed. 3.2 We were advised that Project Managers and relevant Project Officers within member authorities are PRINCE2 certified and undertake the Better Business Case training course when this is offered by the PMO – this is an HM Treasury approach to public spending and includes aspects of relationship management and stakeholder engagement. We confirmed that the next round of Better Business Case training is being scheduled by the PMO for early 2024 and member authorities have been invited to elect City Deal Project Officers to attend this course. 3.3 Member authorities have adequate internal arrangements in place for monitoring the progress of City Deal projects and addressing issues as they arise – examples include a City Deal and Infrastructure Programme Board in Renfrewshire Council and a City Deal Infrastructure Group in South Lanarkshire Council. There are also adequate reporting and escalating processes in place to ensure that any issues relating to managing relationships and stakeholder engagement are scrutinised by the appropriate senior officers. 3.4 We confirmed that member authorities produce a quarterly Project Status Report for each City Deal project which is submitted to the PMO, providing key updates on the project progress including issues and actions, financial information and benefits tracking, change control requests and updates on projects risks. This report would also highlight any issues in relation to stakeholder engagement and relationship management. 3.5 We also found that there were adequate arrangements in place for member authorities to escalate issues to the PMO between Project Status Report reporting dates. This includes providing an update to the project commentary reported in the PMO Interim Performance Report on an exception basis, and
Page 18
Internal Audit | Glasgow City Region City Deal | Stakeholder Engagement & Managing Relationships 4 Introduction Audit Opinion Main Findings Action Plan individual quarterly meetings with the PMO in which member authorities provide an update for each project including any risks or issues that may have arisen. 3.6 We confirmed that best practice arrangements are shared between the PMO and member authorities at Lead Officer Group meetings. 3.7 However, we noted that there are some areas where improvements could be made. Although member authorities conduct stakeholder analysis and consultations as part of the business case formulation, and while a Programme Management Toolkit is maintained by the PMO and made available to member authorities, there is no specific guidance notes or documentation in place to assist member authorities with stakeholder analysis requirements and in the production of a stakeholder matrix which maps a stakeholder’s relationship/role with the project and their ability to impact it. 3.8 We also found that lessons learned exercises are conducted by member authorities at the end of a project or at key milestones during a project’s lifespan. However, we found that two of the member authorities did not maintain a lessons learned log throughout the duration of the projects reviewed. 3.9 An action plan is provided at section four outlining our observations, risks and recommendations. We have made two recommendations for improvement. The priority of each recommendation is: Priority Definition Total High Key controls absent, not being operated as designed or could be improved. Urgent attention required. 0 Medium Less critically important controls absent, not being operated as designed or could be improved. 1 Low Lower level controls absent, not being operated as designed or could be improved. 1 Service Improvement Opportunities for business improvement and/or efficiencies have been identified. 0 3.10 The audit has been undertaken in accordance with the Public Sector Internal Audit Standards. 3.11 We would like to thank officers involved in this audit for their cooperation and assistance. 3.12 It is recommended that the Head of Audit and Inspection submits a further report to Cabinet on the implementation of the actions contained in the attached Action Plan.
Page 19
Internal Audit | Glasgow City Region City Deal | Stakeholder Engagement & Managing Relationships 5 Introduction Audit Opinion Main Findings Action Plan 4 Action Plan No. Observation and Risk Recommendation Priority Management Response Key Control: Stakeholder engagement procedures and guidance are kept up to date to ensure they accurately reflect current working practices. 1 Member authorities conduct stakeholder analysis which is included within the business case for each City Deal Project. A Programme Management Toolkit and business case appraisal template are available to member authorities to assist in the production of business cases. However, there is no formal guidance on the actions required, or the considerations that should be given in completion of a stakeholder analysis including the production of a stakeholder matrix and the development of a communication and engagement plan for each stakeholder group. This increases the risk that stakeholders may not be identified in a timely manner and appropriate arrangements are not put in place to manage the expectations of, and relationship with, key stakeholder groups including those where project dependencies exist. The PMO should update the Programme Management Toolkit to assist member authorities with stakeholder engagement and relationship management. The Toolkit should outline the expectations of member authorities and provide assistance with the production of a stakeholder matrix and a communication and engagement plan for key stakeholder groups. Once the Toolkit has been updated this should be shared with City Deal member authorities. Medium Response: Recommendation accepted. Toolkit will be updated as per recommendation. Officer Responsible for Implementation: Communication and Marketing Manager Timescales for Implementation: April 2024
Page 20
Internal Audit | Glasgow City Region City Deal | Stakeholder Engagement & Managing Relationships 6 Introduction Audit Opinion Main Findings Action Plan No. Observation and Risk Recommendation Priority Management Response Key Control: Adequate arrangements are in place to capture and record lessons learned. 2 We found that lessons learned exercises are conducted by member authorities at the end of a project or at key milestones during a project’s lifespan. However, we found that two of the member authorities do not maintain a lessons learned log throughout the project. The City Deal Project Management Toolkit requires that a lessons learned log is maintained. This is particularly important for long term projects and those with a high volume of sub-projects. Without documenting these at key milestones and recording in a log, there is an increased risk that key points or factors that could be classed as a lesson learned are missed. The PMO should remind all member authorities of the requirement to record and maintain a lessons learned log throughout the duration of a project. Low Response: Recommendation accepted. Reminder will be issued to Lead Officers, Will be discussed at 29 January 2024 Lead Officer Group (LOG) meeting. Officer Responsible for Implementation: City Deal Programme Manager Timescales for Implementation: January 2024
Page 21
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring 0 Introduction Audit Opinion Main Findings Action Plan Will Glasgow City Region City Deal Financial Monitoring Final Report April 2024 FS 57095
Page 22
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring 1 Introduction Audit Opinion Main Findings Action Plan 1 Introduction 1.1 As part of the agreed Internal Audit plan, we have carried out a review of the financial monitoring arrangements in place across the Glasgow City Region City Deal Programme. 1.2 The Glasgow City Region Project Management Office (PMO) is responsible for the financial monitoring and reporting for the overall City Deal programme. The role of the PMO includes collating the project status updates from all member authorities and reporting to various senior officer groups and the Cabinet. The current financial pressures being experienced by all member authorities along with external factors which may affect the progression of City Deal projects, makes it even more vital to ensure that financial monitoring and reporting is being carried out effectively and in line with expected timescales in order to highlight any key issues as soon as possible. 1.3 The purpose of the audit was to gain assurance that there are adequate controls in place covering financial monitoring and reporting carried out by the PMO and member authorities, and that these are operating effectively. The scope of the audit included: • Documented procedures, roles and responsibilities. • The financial monitoring process and reporting to Cabinet. • The process for identifying variances. • The arrangements and approval processes for the amendments of budgets. • The PMO budget monitoring processes. • The year-end processes. • The internal monitoring processes and arrangements for reporting to the PMO. • The escalation processes in place. 1.4 Four member authorities were selected for review were: • Inverclyde Council • East Renfrewshire Council • East Dunbartonshire Council • North Lanarkshire Council The remaining four member authorities will be reviewed in the second phase of this audit in 2024/25.
Page 23
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring 2 Introduction Audit Opinion Main Findings Action Plan 2 Audit Opinion 2.1 Based on the audit work carried out, assurance can be taken that the control environment is satisfactory. 3 Main Findings 3.1 We are pleased to report that key controls are in place and operating effectively. Guidance on the financial monitoring requirements for City Deal projects is available to member authorities through the ‘Assurance Governance and Programme Management Framework’ (the Framework) and the supporting Project Management Toolkit. The PMO is responsible for updating both documents and an annual schedule of review and approval routes for changes to the documents is in place. We were advised by senior officers within the PMO, that a full review of both documents is planned upon conclusion of Phase 2 of the Glasgow City Region Governance Review. 3.2 The PMO has satisfactory arrangements in place surrounding the development and approval of the annual PMO Budget. Regular budget monitoring is undertaken as expected, with the overall position being reported to Cabinet as part of the Quarterly Programme Report. 3.3 In accordance with the Framework, we found that member authorities provide the PMO with the expected quarterly updates, detailing progress of their projects, which includes financial information regarding expenditure, claims and projected cashflows, in the form of Project Status Reports. We found satisfactory budget monitoring processes are in place within the four sampled member authorities, to identify budget variances and allow adequate review of all their project financial positions through established reporting arrangements. Adequate arrangements are in place to ensure that scrutiny by relevant senior management and committees is conducted in line with the agreed timescales. We found that there are adequate processes for collating financial data for reporting to the PMO and that there is a good working relationship between the PMO and member authorities, which includes regular meetings prior to the submission of the quarterly returns. 3.4 We found that the four sampled member authorities are compliant with the established change control process in respect of budget amendments. Satisfactory arrangements are also in place across each member authority in respect of the escalation and approval routes of internal change control requests, as well as to the PMO as part of the quarterly Project Status Report. This is to ensure that changes are also approved or rejected at the appropriate programme level. A
Page 24
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring 3 Introduction Audit Opinion Main Findings Action Plan central register of all approved change control requests across the Region is adequately maintained by the PMO. 3.5 The audit has been undertaken in accordance with the Public Sector Internal Audit Standards. 3.6 We would like to thank officers involved in this audit for their cooperation and assistance. 3.7 It is recommended that Cabinet note the content of this report.