Internal Audit Annual Report 2023 - 2024 complete
Renfrewshire Council · 20 May 2024
Back to Audit, Risk and Scrutiny Board — 20 May 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 20 May 2024 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Annual Report 2023 - 2024 ___________________________________________________________________ 1. Summary 1.1 The Public Sector Internal Audit Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of the Council’s internal control environment and include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters that can be used to inform the governance statement. 1.3 The Annual Report for 2023-24 is attached and outlines the role of Internal Audit, the performance of Internal Audit, the strategic and operational issues which influenced the nature of the work carried out, the key audit findings, and contains the annual audit assurance statement. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report. ___________________________________________________________________
Page 2
Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author Andrea McMahon
Page 3
Annual Report 2023-2024 Renfrewshire Council Internal Audit May 2024
Page 4
No embedded text on this page.
Page 5
Renfrewshire Council Internal Audit Annual Report 2023/2024 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2023/24 2 4. Summary of Internal Audit Work 4 5. Internal Audit Resources 4 6. Review of Internal Audit Activity • Table 1 – Analysis by category of audit 5 7. Quality Assurance and Improvement Activity • Table 2 – Internal Audit Performance 6 8. Implementation of Audit Recommendations • Table 3 – Implementation of Audit Recommendations 6 9. Performance of Non-Audit Activities • Table 4 – Corporate Counter Fraud Performance 7 10. Audit Assurance Statement 9 Appendix 1 – Summary of Assurances
Page 6
No embedded text on this page.
Page 7
1 Renfrewshire Council Internal Audit Annual Report 1 April 2023 – 31 March 2024 1. Introduction 1.1 Internal Audit is an independent and objective assurance and consulting activity designed to add value and improve the operations of Renfrewshire Council. It assists Renfrewshire Council in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organisation's risk management, control, and governance processes. 1.2 The Chief Auditor reports functionally to the Audit, Risk and Scrutiny Board and administratively (i.e. day to day operations) to the Director of Finance and Resources. In accordance with the principles of good corporate governance, regular reports on internal audit work and performance are presented to the Audit, Risk and Scrutiny Board. 1.3 The purpose, authority and responsibility of the internal audit activity is defined in the internal audit charter, approved by the Audit, Risk and Scrutiny Board; and provides that the Chief Auditor has independent responsibility for the conduct, format and reporting of all internal audit activity and findings. 1.4 The service operates in accordance with the Public Sector Internal Audit Standards (PSIAS). The Standards define the basic principles for carrying out internal audit. They establish the framework for providing internal audit services, which add value to the organisation, leading to improved organisational processes and operations. 1.5 The Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. The annual report must also provide an annual audit opinion, on the overall adequacy and effectiveness of the Council’s internal control environment. It must include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters that can be used to inform the governance statement. 1.6 The aim of this report is to provide an opinion on the overall adequacy and effectiveness of the council’s framework of governance, risk management and control and provide a summary of the work undertaken during the year to support that opinion. The report also provides details of the performance of the internal audit service during the past year, and the results of the quality assurance and improvement programme. 1.7 In addition to the work carried out in relation to council services, we also provide an internal audit service to the following organisations:
Page 8
2 • OneRen • Renfrewshire Valuation Joint Board • Scotland Excel • Clydeplan • Renfrewshire Health and Social Care Partnership – Integration Joint Board 1.8 The outcome of the audit assignments undertaken for these organisations is reported separately as part of their annual report which also contains an assurance statement to their Boards. 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of the Council’s managers to ensure that the management of the areas under their control is adequate and effective and that their services have a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3. Internal Audit Activity during 2023/2024 3.1 The internal audit plan for 2023/2024 was approved by the Audit, Risk and Scrutiny Board on 13 March 2023. The plan was risk-based and took into account the outcomes of the service and corporate risk evaluation processes, any significant changes in council operations over the period, and the impact of developments in national policy and regulation. The plan also took into account key external audit reports including their Annual Audit Report for the council. 3.2 The audit plan is kept under continuous review throughout the year, to ensure we are flexible in reacting to changes in the internal and external environment or to any changing risk profile for the council. We also experienced a reduction in resource for the team for part of the year due to unplanned absence. The Audit, Risk and Scrutiny Board approved the following amendments to the plan: • Administration of medicines in schools has been deferred until 2024/25, to allow for the revised policy to be approved and embedded. 3.3 All other planned work as detailed in the 2023/2024 audit plan has been undertaken or commenced and those assignments not finalised by 31 March 2024 have been prioritised in the first quarter of the current year. 3.4 Set out below are the significant risks which influenced the content of the plan and the nature of the work undertaken in recognition of these.
Page 9
3 (1) Financial Challenges Our organisation faces an unprecedented financial challenge to make significant savings after many years of already delivering substantial efficiencies and reduction in our spending. Alongside this, our communities are experiencing a cost-of-living crisis and the demand for our services is higher than ever before. Therefore, the financial outlook continues to be subject to significant and regular scrutiny. The 2023/24 audit plan included time for reviewing: • the procurement of goods and services; • treasury management; • non-domestic rates; • hardship and other discretionary payments. (2) Supporting organisational development The Council is remodelling how and where we work, we seek to have a skilled and well supported workforce with access to modern technologies that support our organisation and its employees to deliver on our priorities. The 2023/24 audit plan included time for reviewing: • health and safety arrangements; • recruitment processes; • project management; • asset management to support hybrid working; and • ERP utilisation. (3) Contract management The Council spends significant sums of money on contracts with external suppliers of goods and services. Good contract management will ensure the outcomes envisaged at the inception of the contract are delivered in practice and ensure best value for money. Poor contract management can impact reputation, contractual relationships and incur additional costs. The 2023/24 audit plan included time for reviewing the: • roads plant and labour contract; and • vehicle hire contracts. 3.5 In line with the council’s procedures, instances of suspected theft, fraud or other irregularity are reported to internal audit. Depending on the nature of the allegations, they are investigated either by the internal audit service or by the Corporate Counter Fraud service. All referrals were evaluated and investigated as appropriate. 3.6 During 2023/24, Internal Audit conducted a number of investigations mainly in relation to employee conduct and service management has undertaken disciplinary procedures and strengthened internal controls where necessary. 3.7 The outcomes of all internal investigation reviews undertaken by internal audit are reported to the Audit, Risk and Scrutiny Board.
Page 10
4 4. Summary of Internal Audit Work 4.1 The internal audit team has been working on a hybrid basis, mainly from home. The team also provided advice and support where necessary to council services. 4.2 Appendix 1 details the assurances arising from the internal audit work carried out in line with the 2023/24 audit plan and from those 2022/23 assignments which were finalised during this year which supports the annual assurance statement. These include the conclusions in relation to the overall system of internal control, risk management and governance arrangements. 5. Internal Audit Resources 5.1 For the year to 31 March 2024, the audit plan was based on 940 operational days. However, the actual staffing complement was reduced due to higher than anticipated unplanned absence. 5.2 The internal audit team will ensure that independence and objectivity are maintained in line with the PSIAS including where non-audit work is undertaken. Internal auditors will have no operational responsibilities. There have been no impairments impacting on the Chief Auditor’s independence and the team has been adequately resourced during the year. 6. Review of Internal Audit Activity 6.1 The Audit Plan for 2023/24 set out our risk-based plans across a range of audit categories, the results of which have been reported quarterly to Audit, Risk and Scrutiny Board. Table 1 below compares the actual days spent on each category of audit work against that planned for the year. Table 1 Type of Audit Planned Days Actual Days Variance Days % Governance 96 57 (39) 41% Assurance 391 319 (72) 18% Contingency 319 330 11 3% Audit Planning & Reporting 134 140 6 4% Total Operational Days 940 846 (94) 10% Training 63 80 17 27% Strategic Management 16 13 (3) 19% Team Administration 96 75 (21) 22% Development 69 56 (13) 19% Total Non-operational Days 244 224 (20) 8%
Page 11
5 Gross Available Days 1184 1070 Operational % 79% 79% Non-Audit – Including Management of Risk Management and Insurance and Corporate Counter Fraud including the co-ordination of NFI 81 62 (19) 23% 6.2 Material differences (over 20% and over 20 days) from the plan are explained below: 1) Governance The planned review of administration of medicines in schools was deferred until 2024/25 due to the planned implementation of a revised policy. Due to unplanned absence completion of the review of recruitment procedures was delayed and consequently part of the budgeted days are deferred into 2024/25. 2) Team Administration Less time than anticipated was spent on general administration, team meetings and preparation of timesheets. 7. Quality Assurance and Improvement Activity 7.1 Internal audit measures performance against a range of measures set annually by the Director of Finance and Resources. The Audit, Risk and Scrutiny Board received quarterly reports on progress and performance during the year. Table 2 shows the actual performance against targeted performance for the year. Table 2 Internal Audit Performance 2023/24 Performance measure Target 2023/24 Actual 2023/24 % completion of audit plan for the year* 95% 92% % engagements completed by target date 95% 98.5% % engagements completed within time budget 95% 98.5% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 7.3 The percentage completion of the audit plan is slightly below the target set for the year. This was due to the level of unplanned leave and the additional time
Page 12
6 attributed to unplanned work. The actual performance for the year for the two other indicators, is above the target performance level. 7.4 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 7.5 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process. Our most recent external assessment was reported to the Audit, Risk and Scrutiny Board in May 2023 and included 7 recommendations for improvement, all recommendations have now been completed. The annual internal self-assessment process has concluded that the internal audit service fully complies with the PSIAS. 8. Implementation of Audit Recommendations 8.1 During 2023/24, 176 recommendations were followed up, with 88% of all recommendations being completed. The implementation status of the recommendations across each service area is detailed in Table 3 below. Table 3 Implementation of Audit Recommendations 2023/24 Service No. Followed up Complete Partially Complete (new date) Not Implemented (new date) Redundant Adult Services 7 6 (86%) 1 (14%) 0 0 Chief Executive’s 7 6 (86%) 1 (14%) 0 0 Children’s Services 8 8 (100%) 0 0 0 Environment, Housing & Infrastructure 83 77 (93%) 4 (5%) 1 (1%) 1 (1%) Finance & Resources 71 58 (82%) 8 (11%) 3 (4%) 2 (3%) Total 176 155 (88%) 14 (9%) 4 (2%) 3 (1%) 9. Performance of Non-Audit Activities 9.1 Risk Management The responsibility for co-ordinating risk management and insurance activity across the council lies with internal audit. Risk management performance is detailed in the risk management annual report. 9.2 Corporate Counter Fraud
Page 13
7 The Corporate Counter Fraud Team reports to the Chief Auditor; during the period 2023/2024, the team has worked on a hybrid basis. The Corporate Counter Fraud Team works to raise awareness of fraud, and to encourage and promote an anti-fraud culture. Where a suspicion of fraud arises, the team investigate and report their findings to management. Where appropriate, follow-on action is taken, such as reporting the matter to Police Scotland for further investigation, or directly to the Procurator Fiscal. The team works to protect Council resources, investigating frauds against the Council, such as: council tax reduction, tenancy, housing application, Scottish Welfare Fund, school placements, blue badge; and any other potentially fraudulent matter arising. Where appropriate, customers are contacted by telephone or e-mail. This process is convenient for customers and staff alike and enables investigations to be conducted quickly and efficiently. Where necessary, and for more serious cases, visits and interviews under caution are conducted. The team continue to work with the DWP, undertaking joint investigations, which can result in the identification of overpayments of Single Person Discount, Council Tax Reduction, Council Tax Benefit, Housing Benefit, Universal Credit, Child and Working Tax Credits, and other DWP benefits. A Counter Fraud training course has been developed and is available to staff on iLearn and is promoted across the Council. Table 4 Corporate Counter Fraud Performance 2023/24 Financial Outcomes 2023/24 (£) Cash savings directly attributable to preventative counter fraud intervention (e.g business grants) 5,409 Cash recoveries in progress directly attributable to counter fraud investigations 88,599 Notional savings identified through counter fraud investigation, (e.g. housing tenancy and future council tax) 375,411 Housing Benefit Savings identified through other counter fraud work or through joint working with the DWP 27,094 Other DWP Benefit or Tax Credit Savings Savings identified through other counter fraud work or 27,990
Page 14
8 through joint working with the DWP Non-Financial Outcomes 2023/24 Housing properties recovered 4 Housing applications amended/cancelled 6 Housing Allocation Priority Changed 1 Blue badge misuse warning letters issued 16 Blue Badges Cancelled 2 Supplier/Contractor Checks Undertaken 250 9.3 The National Fraud Initiative The National Fraud Initiative (NFI) in Scotland is a counter-fraud exercise led by Audit Scotland and overseen by the Cabinet Office for the UK. It uses data matching techniques to compare information about individuals held by different public bodies, and on different financial systems that might suggest the existence of fraud or error. Internal audit is responsible for the co-ordination of the exercise which is undertaken every second year. The Council’s data, as required by the NFI, was submitted in October 2022, the resulting matches were received from January 2023 and investigation of those matches is substantially complete. The final outcomes arising from the exercise will be subject to a separate report to the Audit, Risk and Scrutiny Board during 2024/25. 10. Audit Assurance Statement 10.1 Internal audit has performed its work in accordance with the role defined in paragraph 1.4. The audit work performed has been reported to senior managers and where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 10.2 In view of the continued challenges common to all local authorities, the Council recognises the need to exercise very close scrutiny over financial management and compliance with overarching governance arrangements and will continue to take appropriate action to further strengthen control in these areas. 10.3 Internal audit contributes to the promotion of sound corporate governance in the Council. The scrutiny function within the council performed by the Audit, Risk and Scrutiny Board further demonstrates strong commitment in this area. 10.4 It is not feasible for the system of internal control in the Council to be without any weakness. It is important to balance the risks involved in accepting
Page 15
9 systems limitations with the consequences if a problem emerges. Internal audit recognises this and assesses this in its reporting mechanism. 10.5 The Council’s governance arrangements have been substantially reviewed during the year, including a comprehensive assessment of the Audit, Risk and Scrutiny Board arrangements against the CIPFA practical guidance for Audit Committees which has made a positive impact on the scrutiny arrangements. In addition, the extended Corporate Management Team participated in comprehensive leadership development programme and training was delivered to senior managers on governance and internal control. 10.6 A new business as usual risk management assurance framework was developed and Heads of Service across the organisation completed 12 modules during the year to self-assess their own levels of assurance against those risk areas. 10.7 Substantial improvements have been made on the previous year, in relation to the implementation of recommendations for improvement, with 88% of all recommendations made being implemented by the due date. 10.8 Therefore, subject to management addressing the critical and important recommendations made within those reports where limited and no assurance could be provided, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s internal control, risk management and governance arrangements, as evidenced by: (i) the results of the planned audit work in 2023/24; (ii) the results of investigative work in 2023/24; (iii) management self-assessment business as usual risks; (iv) management action to respond to audit recommendations to mitigate the risks areas highlighted in this report; (v) the regular review of the Local Code of Corporate Governance. Signed Chief Auditor Date 20 May 2024
Page 16
Appendix 1 1 Audit Engagement Risk Area Assurance Level Conclusion Rental Income Assurance Substantial • The controls in place for rent collection from council housing tenants were found to be satisfactory. Rent collection and arrears levels are appropriately reported to management. Gross Rent Arrears as a % of rent due has increased in the last few years as a result of the covid 19 pandemic and cost of living pressures. To address this management have increased the level of advice and support to tenants and targeted arrears at the earliest possible stage to stop escalation of debt. Debt Management Assurance Reasonable • Although there are Business World procedures for administering debts, the council does not have a Debt Management Strategy setting out a high-level approach to preventing the accumulation of debt over time for sundry debts and procedures for each stage of the debt management process. To assist in this process, we were informed that the team dealing complex debt within Business Services will provide management information regarding debt trends and patterns of problem debt. Invoices and credit notes are only issued upon appropriate authorisation, but some invoices tested were not raised timeously and some reminders tested were not issued in line with the prescribed timescales. Non Domestic Rates Assurance Reasonable • The audit identified that satisfactory controls are in place for the billing and collection of NDR. Reviews of NDR reliefs, granted on the basis of a prior year's applications, have now recommenced after having not being carried out for a number of years. However, many actions that management stated would be put in place after previous audit recommendations are not fully implemented. Primarily, evidence of some rates relief applications and refund authorisations were not available. It was also noted that staff changes have
Page 17
Appendix 1 2 resulted in income and refund reconciliations not being carried out timeously. Disaster Recovery Assurance Limited • The audit has identified scope for improvement in the existing arrangements. Recommendations were made to enhance and strengthen controls; including development of a central register of critical systems, formalising ICT procurement guidance, and seeking assurance from software as a service providers regarding their ability to meet disaster recovery requirements. Care at Home Processes Assurance Substantial • The current processes and controls in place relating to the Totalmobile system are adequate and efficient in the scheduling of home care visits with the current staffing establishment. The Totalmobile system has provided the service with improved higher quality management information which is being used to increase the efficiency of the service provided. Cultural Grants Assurance Reasonable • Although there is policy and guidance documentation in place to support grant funds, there was a lack of supporting evidence to confirm that some grant conditions were met and that projects were being adequately monitored. Energy Management Assurance Reasonable • At the time of the audit, the Net Zero plan was at an early stage, and it was recommended that an Energy Management plan should be prepared as soon as possible to ensure the required actions are delivered. In addition, whilst checks are in place to investigate energy consumption variances, we found that there is a lack of evidence held to show that these have been undertaken timeously. The invoices checking procedure in place before payments were made was found to be satisfactory. Payroll Overpayment Processes Assurance Reasonable • Improvements in processes and increased awareness over recent years has resulted in the value of overpayments being significantly reduced. By far, the
Page 18
Appendix 1 3 main reason for overpayments occurring is late notification of changes by managers within the employing service. The auditor has recommended that clear and accessible guidance should be made available to service management, along with regular communications to ensure that newer managers are aware of the deadlines and where they can access relevant guidance. Planning Processes Assurance Reasonable • The audit identified that a satisfactory system is in place for administering building warrants and planning applications. However, the timescales for completing both building warrants and planning applications are regularly substantially longer than targets, which can result in delays and potentially additional costs for clients undertaking building projects. Housing Assurance Framework – Compliance Checks Assurance Substantial • Based on a sample check of the evidence used to demonstrate compliance, we would confirm that the Council complies with the requirements of the Housing Assurance Statement. Roads, Labour and Plant Contract Assurance Limited • Issues were identified in relation to the hire of operatives without machinery, paying for hire when the equipment had been returned and also paying an inflated price for fuel. Furthermore, concerns were identified in relation to the lack of contract management. Performance Management Governance Reasonable • Some issues were noted with some of the information held on the recording system, Pentana. Some of the information held requires to be updated and also any improvement actions being undertaken requires to be recorded on this system for each performance indicator to strengthen the performance monitoring arrangements in place. Building Services Stores Assurance Limited • The sample testing undertaken indicates that the manual processes in place are sufficient to meet operational needs and were found to be accurate. However, it is a concern that the Workhub system is
Page 19
Appendix 1 4 currently not fit for purpose and development has only recently recommenced. Health and Safety Assurance Limited • The current arrangements were found to require improvements in several areas, particularly the absence of a programme of health and safety audits, and the lack overarching system to facilitate corporate oversight of all health and safety risks identified within each of the Services. Improvements are also required in relation to performance monitoring, the availability of up to date guidance and reporting arrangements. Hardship and Discretionary Funds Assurance Reasonable • In the main the processes surrounding payments made from the Scottish Welfare Fund (SWF) and the Discretionary Housing Payment (DHP) funds were found to be satisfactory. Areas for improvement were identified in relation to verification of awards and ensuring that customers are advised of the reasons why their application has been declined. External Vehicle Hire Assurance Limited • The current processes being carried out in relation to external vehicle hires require to be improved in several areas, particularly in relation to procedures, the ordering process, appropriate authorisation, and record keeping. Asset Management (Hybrid Working) Assurance Limited • The main area for improvement identified was that the mechanism in place to record the physical location for all ICT assets was not fit for purpose in its current format as the asset information is not held centrally but is held on a number of documents and inaccuracies were found in the recorded data. Although there is a disposals process in place, there was also a lack of evidence in some cases to support that this process had been followed. Furthermore, officers within the ICT team do not proactively contact line managers for the return of leavers equipment despite there being a process in place to facilitate this. In addition, there is no requirement for users to sign for assets upon receipt.
Page 20
Appendix 1 5 Commercial & Industrial Rents Assurance No Assurance • The audit highlighted significant areas for improvement in the system of internal control. Specifically, there are a number of tasks that are not being completed or are behind schedule, including physically inspecting leased properties, following up arrears and sending void properties for repair quickly so that they can be relet. There is no systematic review of lease terms or rents charged and most rents have not been changed for several years. The auditor was unable to provide any positive assurance over the objectives being reviewed and recommendations have been made in the detailed report to address these areas. Supply Teachers Assurance Reasonable • The deployment and payment of supply teachers is labour intensive and there is duplication of effort. These processes are currently under review by management in both Children’s Services and Finance and Resources to establish if there are any opportunities to streamline the process. Purchasing Processes Assurance Limited • The review focused on corporate purchase card procedures. The main areas for improvement identified relates to purchasing goods outwith the agreed procurement routes and the authorisation of goods ordered. There was also a lack of evidence relating to the authorisation of the increase of PCard spend limits. A number of other housekeeping issues were also identified. Corporate Governance Framework Governance Substantial • Based a sample check of the evidence used to demonstrate compliance, it was confirmed that the Council complies with the requirements of the Local Code of Corporate Governance. In addition, it was evident that the Local Code has been subject to review and updating in line with developments in best practice and any revised Council Policies.
Page 21
Appendix 1 6 Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse.