Summary of Internal Audit Reports for period 14 May to 30 June complete
Renfrewshire Council · 19 August 2024
Back to Audit, Risk and Scrutiny Board — 19 August 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 19 August 2024 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 14 May to 30 June 2024 ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement, Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details those audit engagements completed during the period 14 May to 30 June 2024 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to OneRen and Renfrewshire Health and Social Care Integrated Joint Board;
Page 2
• Co-ordination of the Council’s corporate risk management activity; • Management of the counter fraud team; • Management of the risk management and insurance team. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 14 May to 30 June 2024. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor– 07768354651
Page 3
Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 14 May – 30 June 2024 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Finance & Resources Treasury Management Reasonable Assurance 0 2 4 0 Project Management Substantial Assurance 0 0 0 0 Note – No assurance rating can be given in respect of investigation assignments Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed.
Page 4
• Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report FINANCE & RESOURCES Treasury Management (A0089/2024/001) Date: June 2024 COMMITTEE SUMMARY Audit Objectives A review was undertaken of the arrangements for making payments through the Treasury team. The objectives of the review were to ensure that: 1. Payments are only processed by the Treasury team where there is no other suitable alternative method. 2. There are documented processes in place for the payment function within the Treasury team. 3. Requests for payments are supported by properly completed documentation and appropriately authorised by Service requesting them. 4. Payments are appropriately authorised prior to payment. 5. There is adequate separation of duties within the payment processes. Audit Scope 1. Interviewed the appropriate officers to ascertain the system in place in relation to payment processes within the Treasury team. 2. Undertook a series of tests to ensure the system is adequate and operating as intended. Key Audit Assurances 1. In the sample of payments made tested, requests for payments were supported by properly completed documentation. 2. For the payments tested, there was adequate separation of duties in the Treasury team between the officer who put forward each payment request and the officer who approved the payments. Key Audit Risks 1. Where payment requests are not checked by Treasury officers to ensure they are approved by an authorised signatory, there is a risk that payment requests from services are not appropriately authorised. 2. When a manager with single authorisation access requests a payment and also has the ability to authorise that payment, there is a risk of fraud or error. Overall Audit Opinion Discussions are ongoing between Treasury supervisors and Purchase to Pay supervisors as to which payment categories that would be more suitable for the Purchase to Pay team to administer and where it is more appropriate for payments to be administered by the Purchase to Pay team, they should be transferred across as soon as possible.
Page 6
Internal Audit Report FINANCE & RESOURCES Treasury Management (A0089/2024/001) Date: June 2024 In order to improve the segregation of duties and approval controls in the payment processes, recommendations were made in relation to the Corporate Administrator user’s access to the banking system and the approval request process for payments to be made. Management Commentary Work is ongoing to transfer several categories of regular scheduled payments from Treasury to the Creditors section to ensure they are processed through our main purchasing/payment system. We have also strengthened the approval checking processes for payment requests received from Services by the Treasury Section and work is ongoing to implement the other audit recommendations.
Page 7
Internal Audit Report FINANCE & RESOURCES Project Management (A0087/2024/001) Date: June 2024 COMMITTEE SUMMARY Audit Objectives In response to the concerns highlighted in the independent review of the provision of Dargavel Primary School, the Council committed to undertake a health check assessment on major capital programmes to provide reassurance in respect to all aspects of governance, control, reporting and management of programmes. Internal Audit have undertaken a review of the health check assessments carried out for the City Deal & Infrastructure and the Housing Led Regeneration & Renewal Programmes to provide a level of independent assurance. The objectives of the review were to ensure that: 1. The health check assessment process is robust and covers all the expected elements of good project governance. 2. The reviews have been completed within a reasonable timescale. 3. There are plans for the assessment process to be rolled out across other projects/programmes. 4. Actions arising from the assessment have been implemented or are planned to be implemented. Audit Scope 1. Interviewed the relevant officers to obtain the required information and documentation relating to the health checks undertaken on the City Deal & Infrastructure and the Housing Led Regeneration & Renewal programmes. 2. Prepared and carried out a series of tests to meet the detailed audit objectives. Key Audit Assurances 1. The health check assessment process is robust and covers all the expected elements of good project governance. 2. The health check assessments were completed and results presented to the Corporate Management Team within a reasonable timescale. 3. Plans to roll out the health check assessment process across other major projects / programmes, specifically the school estate programme, will be considered once the governance arrangements which are currently being refreshed are established. 4. The actions arising from the assessments have been implemented with twice yearly reports being prepared for the Corporate Management Team and the relevant policy board appropriately scheduled. Key Audit Risks There are no key risks to report.
Page 8
Internal Audit Report FINANCE & RESOURCES Project Management (A0087/2024/001) Date: June 2024 Overall Audit Opinion The health check assessments carried out on the City Deal & Infrastructure and the Housing Led Regeneration & Renewal Programmes were found to be robust with actions arising from the presentations to the Corporate Management Team being addressed. The auditor has no recommendations to make in this regard and has therefore provided a substantial assurance rating in this area. Management Commentary N/A as no key risks identified.