Unaudited Annual Governance Statement 2023 - 2024 complete
Renfrewshire Council · 20 May 2024
Back to Audit, Risk and Scrutiny Board — 20 May 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 20 May 2024 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Unaudited Annual Governance Statement 2023 - 2024 ___________________________________________________________________ 1. Summary 1.1 The Local Authority Accounting Regulations require that an Annual Governance Statement is prepared and included in the Annual Accounts for the council. The Annual Governance Statement should be prepared in accordance with the CIPFA / Solace guidance “Delivering good governance in Local Government”. 1.2 The Annual Governance Statement for 2023-24 is attached and has been prepared in accordance with the relevant regulation and guidance taking account of the Internal Audit Annual Report and Director’s evaluation of the operation of the governance arrangements within each service area. 1.3 The Governance Statement is subject to statutory audit by the Council’s External Auditors as part of their review of the annual accounts. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to note the Annual Governance Statement which will be included in the Unaudited Accounts for 2023/24. ___________________________________________________________________
Page 2
Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – The application of sound governance arrangements supports the Council to deliver on its key objectives and priorities. 4. Legal - subject to approval by Council, the Accounts will be released for audit by the statutory deadline of 30 June 2024. 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk – Specific risks identified from the Chief Auditor’s Annual Report and the assessments of service Directors are disclosed in the statement. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Andrea McMahon
Page 3
Annual Governance Statement Scope of responsibility Renfrewshire Council is responsible for ensuring that its business is conducted in accordance with the law and proper standards, and that public money is safeguarded, properly accounted for, and used economically, efficiently and effectively. The Council also has a statutory duty to make arrangements to secure best value under the Local Government in Scotland Act 2003. In discharging this overall responsibility, the Council’s members and the corporate management team are responsible for putting in place proper arrangements for its affairs and facilitating the effective exercise of its functions, which includes arrangements for the management of risk. The Council has approved and adopted a Local Code of Corporate Governance, which is consistent with the principles of the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Society of Local Authority Chief Executives (SOLACE) framework, Delivering Good Governance in Local Government. A copy of the Local Code is available on our website Local Code of Corporate Governance - Renfrewshire Website. This statement explains how Renfrewshire Council has complied with the Local Code and also meets the Code of Practice on Local Authority Accounting in the UK, which details the requirements for an annual Governance Statement. The purpose of the governance framework The governance framework comprises the systems and processes, and culture and values, by which the Council is directed and controlled and through which it accounts to, engages with and leads the community. It enables the Council to monitor the achievement of its strategic objectives set out in the Council plan. The system of internal control is a significant part of that framework and is designed to manage risk to a reasonable level. Internal control cannot eliminate all risk of failure to achieve policies, aims and objectives and can therefore only provide reasonable and not absolute assurance of effectiveness. The system of internal control is based on an ongoing process designed to identify and prioritise the risks to the achievement of the Council’s policies aims and objectives, to evaluate the likelihood of those risks being realised and the impact should they be realised, and to manage them efficiently, effectively and economically. The governance framework The main features of our governance arrangements are described in the Local Code but are summarised below: The overarching strategic priorities and vision of the Council are set out in the Council Plan 2022-2027 and the Renfrewshire Community Plan 2017-2027. The Council Plan is aligned to the Community Plan and sets out 5 strategic outcomes that the organisation will work to achieve over a 5-year period with specific priorities relating to tackling inequality, promoting economic and cultural regeneration, attainment and sustainability. Renfrewshire’s Community Plan (which also acts as Renfrewshire’s Local Outcome Improvement Plan as required by the Community Empowerment (Scotland) Act 2015) details how community planning partners will work together to achieve the key priorities identified for Renfrewshire. A mid- term review of the Community Plan was also undertaken in 2022 in tandem with the development of the new Council Plan, which identified three key areas of focus which would be progressed by partners. • The key outcomes the Council is committed to delivering with its partners, are set out in the Community Plan; • The Council operates within an established governance framework which incorporates a scheme of delegated functions, financial regulations, standing orders relating to contracts and procedural standing orders. These elements of the framework are kept under regular review by the Council;
Page 4
• The Council facilitates policy and decision making through a policy board structure; • Services are able to demonstrate how their own activities link to the Council’s vision and priorities through their service improvement plans. Performance management and monitoring of service delivery is reported through policy boards regularly including six monthly updates to the Leadership Board on progress against the implementation of the Council Plan; • The Corporate Management Team has agreed a new refreshed approach to its performance monitoring and the Council Plan scorecard will be considered alongside other performance information each quarter and followed up with an in-depth look at performance in one service particular area of interest at regular intervals. Performance scrutiny sessions between the Chief Executive and Directorate teams are also being re-established, supported by a cross organisation panel; • An annual report on the Local Government Benchmarking Framework, which includes data for over 100 indicators for all 32 local authorities, is provided to the Audit, Risk and Scrutiny Board each year; • The Council makes a range of performance information available on its website, including the publication of its public performance report " How are we doing?", in line with statutory requirements. • The Council has adopted a code of conduct for its employees. Elected members adhere to the nationally prescribed Code of Conduct for Members. In addition, the Council has in place a protocol for Relationships between Political Groups, Elected Members and Officers; • The Council’s approach to risk management is set out in the combined risk management policy and strategy and is well embedded. Risks are reported 6 monthly to the Audit, Risk and Scrutiny Board and a Risk Management Annual Report is also provided to Board in respect of corporate risk management arrangements. In 2023/24 the council launched its self- developed Business as Usual Risk Assurance Model. All Heads of Service self-assessed their levels of assurance in relation to implementing risk controls covering various aspects of governance, risk and internal control. The Corporate Management Team are required to confirm the overall assurances for their service areas. • The Director of Finance and Resources is the Council’s Senior Information Risk Owner and information risk is monitored through the Information Management and Governance Group and its sub-groups. The Managing Solicitor (DPO) is the statutory Data Protection Officer; • Comprehensive arrangements are in place to ensure members and officers are supported by appropriate training and development; • Registers of interests for elected members and senior officers are maintained and published on the Council’s website; • The Council complies with the CIPFA Code of Practice on Managing the Risk of Fraud and Corruption and the Council’s arrangements for fraud prevention, detection and investigation are managed through the corporate counter fraud service; • The Council’s approach to ‘whistleblowing’ is outlined in the whistleblowing policy. • Cyber-attacks are both increasing and becoming more sophisticated and while no system of internal control can provide absolute assurance the Council has a range of multi layered Cyber Security controls in place that are tested annually to check standards are in line with Government guidance. Industry cyber security standards are followed and explicitly those belonging to Public Sector Network (PSN), National Cyber Security Centre (NCSC) guidance, Scottish Government Public Sector Cyber Resilience Plan and Payment Card Industry (PCI) data security standards. The O365 security and compliance toolset provides a wide range of protection against cyber-attacks including identity theft and phishing. The Council holds a current Certificate of Compliance for PSN standards. ICT network and digital services are monitored monthly through our cyber security partner. These are all monitored and managed through the Cyber Security team which is headed up by a CISM qualified Cyber Security Architect (Cyber Information Security Manager). Events and alerts are monitored 24 x 7 by our cyber security partner who are authorised to take emergency preventative action where necessary; • Clear and independent governance arrangements are in place with One Ren and the Renfrewshire Health and Social Care Partnership with oversight from the Head of Policy and Partnerships and the Head of Corporate Governance respectively and the Council’s Leadership Board.
Page 5
• Seven Local Partnerships have been established and have identified initial local priorities. Decision making including that relating to relevant grants is delegated to each Local Partnership through a Lead Officer appointed by the Council, through the Chief Executive. This governance framework has been in place at Renfrewshire Council for the year ended 31 March 2024. The system of internal financial control The system of internal financial control is based on a framework of regular management information, financial regulations, administrative procedures (including segregation of duties), management and supervision, and a system of delegation and accountability. Development and maintenance of the system is undertaken by managers within the Council. The system includes: • Guidance on financial management supported by comprehensive financial regulations and codes; • Comprehensive budgeting systems, and detailed guidance for budget holders; • Regular reviews of periodic and annual financial reports which indicate financial performance against forecasts; • Setting targets to measure financial and other performance; • Clearly defined capital expenditure guidelines; • As appropriate, formal project management principles; • The Chief Finance Officer is the Director of Finance and Resources who complies with the CIPFA Statement on the Role of The CFO in Public Services. The role and responsibilities of the Audit Committee and the Chief Auditor The role of the audit committee is under the remit of the Audit, Risk and Scrutiny Board which is chaired by an independent elected member; its role includes: • to approve the internal audit charter and annual internal audit plans; • to review internal and external audit reports and the main issues arising, including those relating to the annual accounts and seek assurance that action has been taken and make recommendations to the Council where appropriate; • to receive and consider the Chief Auditor’s annual report, summarising internal audit activity and the level of assurance this provides over the arrangements for internal control, risk management and governance within the Council; • to monitor the performance of internal audit; • to consider the annual review of the Local Code of Corporate Governance. The internal audit service operates in accordance with Public Sector Internal Audit Standards and reports to the Audit, Risk and Scrutiny Board. Internal audit undertakes an annual programme of work, approved by the Board, based on a strategic risk assessment. The Council’s Chief Auditor provides an independent opinion on the adequacy and effectiveness of the governance framework, risk management and internal control. The Council conforms to the requirements of the CIPFA Statement on the Role of the Head of Internal Audit (2019). Members and officers of the Council are committed to the concept of sound governance and the effective delivery of Council services. The Audit, Risk and Scrutiny Committee self-assessed against the CIPFA guidance, Audit Committees: Practical Guidance for Local Authorities and Police. The Committee is compliant in all material respects, with some minor improvements required to improve clarity of roles. The Council’s Chief Auditor has responsibility to review independently and report to the Audit, Risk and Scrutiny Board annually, to provide assurance on the adequacy and effectiveness of the Local Code and the extent of compliance with it. The Audit, Risk and Scrutiny Board performs a scrutiny role in relation to the application of the Local Code of Corporate Governance and regularly monitors the performance of the Council’s internal audit service. Internal Audit reporting arrangements include communication of finalised audit engagements, monitoring the progress of agreed management actions and communication of any unacceptable risk identified to the Board. Review of effectiveness and continuous improvement
Page 6
Renfrewshire Council has responsibility for conducting, at least annually, a review of the effectiveness of its governance framework including the system of internal control. The review of effectiveness of the framework is informed by the work of the Corporate Management Team who have responsibility for the development and maintenance of the governance environment, the Chief Auditor’s annual report, and reports from the external auditors and other review agencies and inspectorates. The effectiveness of the governance framework and how the organisation manages its risks is reviewed annually by the Corporate Management Team, including the use of the recently introduced business as usual risk assurance model, which is an annually updated self-assessment tool covering 12 key areas of governance, internal control and risk as follows: • Asset Management • Complaints, Comments and Claims • Financial Control and Governance • Health and Safety, and managing adverse events • Information Handling • Organisational Resilience • Partnership Management • People, Wellbeing and Development • Programme Management • Service Performance • Community and Public Safety This self-assessment indicated the governance framework is being complied with in all material respects. In addition, the review of the effectiveness of the governance arrangements and the systems of internal control within the group entities places reliance upon the individual bodies’ management assurances in relation to the soundness of their systems of internal control. The Council’s approach to continuous improvement has a number of strands. Our Council Plan and Service Improvement Planning processes drive much of this and allow for elected member scrutiny of improvement activity. Services also undertake improvement work linked to their core duties and to statutory requirements. Registered services in education, housing, social work and social care regularly undertake self-assessment activity as part of their regulatory framework and inspection process. Services within Environment, Housing and Infrastructure maintain their ISO 9001 accreditation as one means of demonstrating quality. The Council has recently developed its own model of corporate self- assessment based on the Public Service Improvement Framework. The Corporate Management Team introduced an updated programme of corporate self-assessment in 2023 linked to the previous EFQM/PSIF model used across the public sector. All Chief Officers participated in this programme initially before it was further extended to a wider group of senior leaders across the Council. The outputs from this are informing an improvement plan to be led by the Corporate Management Team. The Council continues to recognise the need to exercise strong financial management arrangements to manage the financial pressures common to all local authorities and has robust financial control and financial planning processes in place. The CIPFA Financial Management (FM) Code was first adopted by the Council in June 2021, and the resulting action plan contains 59 improvement actions with target dates ranging from 2023 until 2025. Work to refresh the initial engagement will be undertaken by the end of 2025 to ensure that improvement work continues to be focused, relevant and effective. The Council continues to manage a number of very significant challenges and is operating within a context of new and emerging challenges which require the Council to respond very flexibly to the changing needs of local businesses, communities and citizens. These factors include: • Ongoing economic uncertainty, which has significantly increased costs and impacted supply chains utilized by the Council and its partners. The linked cost of living crisis has also required the Council to respond in new ways with partners to meet the needs of those most vulnerable across Renfrewshire through our Fairer Renfrewshire Programme.
Page 7
• Inflationary cost pressures, including those linked to pay, continue to significantly impact the Council’s financial position. The Council has developed a financial sustainability programme which will drive a range of service improvements and financial savings across the organisation over the next three years. • New and developing demand pressures continue to impact the Council, including in relation to issues such as migration and asylum, in relation to support for Ukrainian Displaced Persons, Unaccompanied Asylum Seeking Children and Young People and more recently the widening out of the asylum dispersal programme. • In the post-pandemic period, the Council has had a strong focus on recovering from Covid-19 and continuing to mitigate some of the impacts on our communities, including those relating to rapidly increasing living costs. As an organisation, the Council has continued to adopt new ways of working, building on the strong approach developed during the pandemic in areas such as digital access for customers, and embracing hybrid working. Whilst this is still a recovery phase, much of the business-as-usual work has fully resumed, including: • the work on social renewal, which began during the pandemic, is now part of the wider Fairer Renfrewshire programme, which is overseen by a sub-committee of the Leadership Board. Services have returned to the regular programme of reporting performance to elected members through policy boards, with service improvement plans submitted for approval in spring 2024 and regular progress updates provided. • the Right for Renfrewshire programme recommenced over 2022, and the service redesigns progressed were in those areas where it was anticipated that there would be potentially less direct impact from the pandemic recovery process and where the greatest opportunity exists for appropriate management and service capacity to be directed towards the Right for Renfrewshire agenda; • the Council commenced planning for Brexit during 2019/20 and identified risks have been incorporated into the Strategic and Corporate Risk Registers. Some of these risks will be further exacerbated by the ongoing conflict in Ukraine and the associated sanctions on Russia which will place additional cost and supply pressures on some products and materials that are likely to increase and continue into 2023/24. Audit Scotland have introduced a new approach to auditing Best Value in local government which has commenced this year as part of the next 5-year Best Value Audit programme. This approach involves thematic areas of focus each year which will be considered for all local authorities within the same snapshot in time rather than the previous rolling programme of deep dive audits which inspect each local authority across a five-year programme. This is significant shift in approach and in year one (2023), this examined the effectiveness of leadership within Councils across Scotland, with a separate thematic report published for Renfrewshire Council in September 2023 alongside the Annual Audit Report. For 2024, the national theme will be Workforce Innovation. Alongside the ongoing Best Value auditing and this new approach with annual themes, there will also be further external audit activity as requested by the Accounts Commission following the Section 102 report instructed in response to the Dargavel School pupil roll forecast error. It is expected a Best Value report will be produced by the end of 2024 for Renfrewshire Council. The action plan arising from the Independent Review of the Dargavel School Project is reported to and monitored by the Audit, Risk and Scrutiny Board. The Council undertook a comprehensive review of its governance arrangements through a member led cross party working group, the recommendations arising were reported to and approved by the Council on 29 February 2024. A separate self-assessment against the CIPFA guidance for effective Audit Committees was undertaken with the members of the Audit, Risk and Scrutiny Board and actions for improvement were identified and have been progressed. A leadership development programme was also delivered to support senior managers and comprehensive financial governance training was undertaken across the council’s senior and middle managers. The external auditors, Azets, provided an unqualified and unmodified audit opinion on the 2022/23 annual accounts.
Page 8
Regular reviews of the Council’s governance arrangements are undertaken by internal audit. Two specific area were identified in the 2022/23 governance statement as impacting on the overall internal control, risk management and governance arrangements. These were: • Business continuity plans – All services now have up-to-date business continuity plans, with a programme of quality assurance being undertaken. • Manual creditor payments – A corporate project to address this area is currently underway. The programme of work undertaken by internal audit in 2023/2024 identified 8 occasions where a limited or no assurance level was provided in relation to the internal control, risk management and governance objectives for the specific areas of each audit review. Of these, 6 were specific to individual service areas and although these areas require to be addressed there is no significant impact on the Council’s overall system of internal control and action plans are in place to address the risk identified. The remaining 3 areas identified as impacting on the overall internal control, risk management and governance arrangements are: Disaster recovery – The Council’s critical systems are increasingly moving to a SaaS operating model and, as these systems are externally hosted, the Council’s role in relation to disaster recovery differs from traditional, on-premises solutions, where IT would have a more active role. Nonetheless it is important that the Council has adequate arrangements in place for obtaining assurance from SaaS providers that disaster recovery will be handled in a timely manner, with minimum business impact, should an event occur. The review identified that improvements were required, including formal identification of critical systems and formalising the procurement guidance to ensure that services procured meet the required disaster recovery arrangement. An action plan is in place to ensure that the required actions are implemented. Health and Safety – The corporate arrangements for health and safety require to be improved. It was identified that procedures require to be reviewed and updated. Improvements are required in terms of corporate oversight, compliance and performance reporting. Purchasing processes (corporate credit cards) - Compliance against the corporate procedures requires to be improved, the main areas for improvement included eliminating off-contract spend and improving the authorisation process to ensure that all purchases are properly authorised. The corporate procurement unit has reminded all relevant employees of the requirement to comply with the established procedures. Internal audit undertakes an annual exercise to ensure that recommendations arising from internal audit engagements have been implemented by service management and the results are reported to the Audit, Risk and Scrutiny Board. This work highlighted that 88% of recommendations were implemented by the due date. 9% had passed their original due date and revised implementation dates have now been set and 3% were superseded. Of the 44 recommendations followed up that were deemed to be critical, 41 have been fully implemented and 3 have been partially implemented. Revised implementation dates have been agreed for each of these recommendations. It is our view that the Council has in place a sound for governance, risk management and internal control and that appropriate mechanisms are in place to identify any areas of weakness. This is corroborated by an Annual Report incorporating the Annual Assurance Statement prepared by the Council’s Chief Auditor stating that subject to management addressing the critical and important recommendations made the limited and no assurance reports, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s internal control, risk management and governance arrangements. Action Plan Following consideration of the review of adequacy and effectiveness the following action plan has been agreed to ensure continual improvement of the Council’s governance.
Page 9
Agreed action Responsible person Date Implement improvement plan arising from the Corporate Self-Assessment Exercise. Head of Policy and Partnerships December 2024 The recommendations arising for the review of the corporate health and safety internal audit report, will be considered and an action plan developed will be agreed for implementation. Director of Finance and Resources December 2024 The agreed actions will be subject to review to identify the progress being made in implementing these actions. Update on the 2022/23 Action Plan Agreed action Progress Update Responsible person Date All service level business continuity plans are to be updated to record all the ICT risks referred to in the council’s business continuity plan template for all service areas. All service areas have updated their business continuity plan templates. These plans are currently being externally quality assured. Service Directors December 2024 A review of the current manual payment process is under review with key stakeholders from the Corporate Procurement Unit and the Finance Business Partners, this will enable and introduce an exception policy to support the No Purchase Order No Payment. Once the review is conducted the exception policy will be implemented and the No Purchase Order No Payment approach will commence, this is anticipated to take up to 12 Months. A Strategic P2P Lead officer was appointed in November 2023. The programme’s Strategic and Operational Governance boards have now been established and meet on a monthly basis to discuss key decision points, with regular updates to the Corporate Management Team. Nine Project Workstreams have been established, with lead officers appointed to progress these and as part of this, the No PO No Payment initiative will be taken forward, it is now expected to be implemented by December 2024. Strategic Lead (P2P) December 2024 Assurance Subject to the above, and on the basis of the assurances provided, we consider the governance and internal control environment operating during 2023/24 provides reasonable and objective assurance that any significant risks impacting on the achievement of our principal objectives will be identified and actions taken to avoid or mitigate their impact. Systems are in place to continually review and improve the governance and internal control environment and action plans are in place to address identified areas for improvement.
Page 10
No embedded text on this page.