Summary of IA Partner Activity complete

Renfrewshire Council · 19 August 2024
Back to Audit, Risk and Scrutiny Board — 19 August 2024 and its agenda

Text extracted from the council's PDF. Layout and reading order may differ from the original.

Original council PDF · Download plain text

Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.

Page 1

___________________________________________________________________
To: Audit, Risk and Scrutiny Board
On: 19 August 2024
___________________________________________________________________
Report by: Chief Auditor
___________________________________________________________________
Heading: Summary of Internal Audit Activity in Partner Organisations May
2024 to June 2024
___________________________________________________________________
1. Summary 
1.1 Members of the Audit, Risk and Scrutiny Committee expressed an interest in
the outcomes of audits undertaken in partner organisations. A proposed
revision to the Audit, Risk and Scrutiny Board’s Terms of Reference, to
facilitate this, was agreed at Council on 4 May 2024. 
1.2 This report provides members with a summary of the internal audit activity
within each partner body from 1 May 2024 to 30 June 2024. 
1.3 Renfrewshire Valuation Joint Board –The 2023/24 Internal Audit annual
report, summarising the audit activity for the year and providing the Chief
Auditor’s annual opinion was considered by the Board on 24 May 2024 and
is attached in Appendix 1. 
1.4 Scotland Excel Joint Committee - The 2023/24 Internal Audit annual report,
summarising the audit activity for the year and providing the Chief Auditor’s
annual opinion was considered, by the Executive Sub-Committee on 17 May
2024 and is attached in Appendix 2. One audit is currently in progress in
relation to contract monitoring (implementation of collaborative
procurement), this is nearing completion and will be reported to their
Executive Sub-Committee once finalised. 
1.5 Renfrewshire Integration Joint Board - The 2023/24 Internal Audit annual
report, summarising the audit activity for the year and providing the Chief
Auditor’s annual opinion was considered, by their Audit, Risk and Scrutiny
Committee. on 21 June 2024 and is attached in Appendix 3. During the

Page 2

reporting period, one audit review was finalised in relation to compliance with
the Local Code of Corporate Governance and is attached in Appendix 4. 
1.6 Glasgow & the Clyde Valley Strategic Development Planning Authority Joint
Committee - The 2023/24 Internal Audit annual report, summarising the audit
activity for the year and providing the Chief Auditor’s annual opinion was
considered by the Joint Committee on 10 June 2024 and is attached in
Appendix 5. 
1.7 Glasgow City Region City Deal – Internal audit services are provided by
Glasgow City Council Internal Audit Services, finalised reports for each
completed audit engagement are reported to the Glasgow City Region
Cabinet and the reports are shared with member Council’s. The Chief
Auditor for Renfrewshire Council meets regularly with the City Region
Auditors and provides them with an annual assurance statement to support
the Glasgow City Region annual governance statement. During the reporting
period, no audit reviews were finalised. 
___________________________________________________________________ 
2. Recommendations
2.1 All of these Audit Reports and Summaries have been submitted and
considered by the partner organisations’ audit committees.  Members are
therefore invited to note the content of the audit reports and audit summaries.
__________________________________________________________________
Implications of the Report
1. Financial - None 
2. HR & Organisational Development - None 
3. Community Planning – 
Safer and Stronger - effective internal audit is an important element of good
corporate governance. 
4. Legal - None 
5. Property/Assets - None 
6. Information Technology - None 
7.  Equality & Human Rights – None 
8. Health & Safety – None

Page 3

9. Procurement - None 
10.  Risk - The summary reported relates to the delivery of the risk-based internal
audit plans for the partner bodies 
11. Privacy Impact – None 
12. COSLA Implications – None 
13. Climate Risk - None 
________________________________________________________________
Author:           Karen Campbell, Interim Chief Auditor

Page 4

Appendix 1 
Renfrewshire Valuation Joint Board
Internal Audit Annual Report 
2023-2024 
Renfrewshire Council
Internal Audit 
May 2024

Page 5

No embedded text on this page.

Page 6

Renfrewshire Valuation Joint Board 
Internal Audit Annual Report 2023/2024 
Contents 
Page 
1.    Introduction  1 
2.  Responsibilities of Management and Internal Audit  2 
3.    Internal Audit Activity in 2023/24  2 
4.      Internal Audit Performance    4 
5.  Planned Audit Work for 2024/25  5 
6.  Audit Assurance Statement  5

Page 7

- 1 -
Renfrewshire Valuation Joint Board
Internal Audit Annual Report   
1 April 2023 – 31 March 2024 
1. Introduction 
1.1 Renfrewshire Council provides an internal audit service to Renfrewshire
Valuation Joint Board.  This includes: 
• The compilation of an annual audit plan following consideration and
evaluation of those areas of greatest risk in the organisation’s
operation, and consultation with the Assessor and Electoral
Registration Officer, Renfrewshire Valuation Joint Board; 
• Delivery of the planned audit assignments;
• Follow up of previous audit recommendations;
• Provision of any ongoing advice and support on audit and risk
management related matters;
• Provision of an Annual Report and Assurance Statement, and
presentation to elected members at the board of Renfrewshire
Valuation Joint Board. 
1.2 The Service operates in accordance with the Public Sector Internal Audit
Standards which defines Internal Audit’s role as: 
“......an independent, objective assurance and consulting activity designed to
add value and improve an organisation’s operations. It helps an organisation
accomplish its objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management, control and
governance processes.” 
1.3 In line with the Standards, the purpose of this Annual Report is to report on: 
• The outcome of the planned Internal Audit reviews 2023/24 relating to  
Renfrewshire Valuation Joint Board;
• The outcome of Internal Audit reviews of supporting Renfrewshire
Council corporate systems;
• Internal audit performance;
• Planned audit work for 2024/25;
• The annual assurance statement which provides an opinion on the
overall adequacy and effectiveness of the Board’s internal control
environment.

Page 8

- 2 -
2. Responsibilities of Management and Internal Audit 
2.1 It is the responsibility of management to ensure that the areas under their
control are adequate and effective and that there is a sound system of internal
control which facilitates the effective exercise of the organisation’s functions
and which includes arrangements for the management of risk. 
2.2 Internal Audit is not a substitute for effective control exercised by
management as part of their responsibilities. Internal Audit’s role is to
independently assess the adequacy of the risk management, internal controls
and governance arrangements put in place by management and to undertake
sufficient work to evaluate and conclude on the adequacy of those controls for
the period under review. 
2.3 The internal audit team will ensure that independence and objectivity are
maintained in line with the PSIAS including where non-audit work is
undertaken. Internal auditors will have no operational responsibilities. There
have been no impairments impacting on the Chief Auditor’s independence
and the team has been adequately resourced during the year. 
3. Internal Audit Activity during 2023/2024 
3.1 One specific engagement was undertaken during 2023/24, which related to
risk management. A summary of the report was considered by the Board on
17 November 2023, the conclusion this review is summarised in table 1
below: 
Table 1 
Audit Area Conclusion
Information Governance • Substantial Assurance 
The review identified that satisfactory
arrangements in place for the handling of personal
information within Renfrewshire Valuation Joint
Board. The systems in place for the Electoral
Register, Valuation Roll and Council Tax dwellings
are well controlled and regularly reviewed. Staff are
regularly trained and made aware of their
responsibilities for handling personal data.
As a result, there were no audit findings identified
during this review and the auditor has made a
provision of substantial assurance for the areas
tested. 
3.2 The Annual Report for 2022/2023 was submitted to the Authority on 26 May
2023.

Page 9

- 3 -
3.5 The implementation rate of audit recommendations is a measure of
operational culture and effectiveness.  During 2023/24, there were no
recommendations that required to be followed up. 
3.5 Internal Audit also carried out reviews of the main corporate systems
operating within Renfrewshire Council which support the Board’s activity. The
main findings in relation to these are summarised in Table 2 below and
Renfrewshire Council management have agreed to implement the audit
recommendations made in relation to each review: 
Table 2 
Audit Area Conclusion
Debt Management Reasonable Assurance 
Minor improvements have been
recommended in relation to timeous
raising of invoices and documenting the
strategy for debt management. 
Disaster Recovery Limited Assurance
The audit identified scope for
improvement in the existing
arrangements. Recommendations were
made to enhance and strengthen
controls; including development of a
central register of critical systems,
formalizing ICT procurement guidance,
and seeking assurance from software as
a service providers regarding their ability
to meet disaster recovery requirements.
Payroll Overpayment Process Reasonable Assurance 
Improvements in processes and
increased awareness over recent years
has resulted in the value of
overpayments being significantly
reduced. By far, the main reason for
overpayments occurring is late
notification of changes by managers
within the employing service. The auditor
has recommended that clear and
accessible guidance should be made
available to service management, along
with regular communications to ensure
that newer managers are aware of the
deadlines and where they can access
relevant guidance.   
4. Review of Internal Audit Performance 
4.1 Internal Audit produces regular reports on its performance during the year to
the Renfrewshire Council, Audit, Risk and Scrutiny Board, against a range of
measures set annually by the Director of Finance and Resources. These

Page 10

- 4 -
targets are set for all internal audit engagements and include Renfrewshire
Council and other associated bodies, for which the team provides internal
audit services. Table 3 shows the actual performance against targeted
performance for the year.
Table 3
Internal Audit Performance 2023/24
Performance measure Target 2023/24 Actual 2023/24
% of audit assignments
completed by target date
95% 92%
% of audit assignments completed
within time budget
95% 98.5%
% completion of audit plan for the
year*
95% 98.5%
* this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the
finalisation of the outstanding elements in the new financial year.
4.2 The percentage completion of the audit plan is slightly below the target set for
the year. This was due to the level of unplanned leave and the additional time
attributed to unplanned work. It should be noted that this had no effect on the
planned reviews for the RVJB for 2023/24 which are 100% complete. The
actual performance for the year for the two other indicators, is above the
target performance level.
4.3 The PSIAS require the Chief Auditor to develop and maintain a quality
assurance and improvement programme (QAIP) that covers all aspects of the
internal audit activity. The QAIP must include both periodic internal self-
assessments and five-yearly external assessments, carried out by a qualified,
independent assessor from outwith the organisation.
4.4 We continued to participate in the Scottish Local Authorities Chief Internal
Auditors’ Group peer review process. Our most recent external assessment
was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and
included 7 recommendations for improvement, all recommendations have now
been completed. The annual internal self-assessment process has concluded
that the internal audit service fully complies with the PSIAS.
Risk Management
4.6 The internal audit service through the Risk Manager, provides advice and
support to the RVJB officers, as required.
5. Planned Work for 2024/25
5.1 Following a risk based assessment of the activities of the Renfrewshire
Valuation Joint Board, the audit plan for 2024/2025 provides for a review of
the valuation system for non-domestic rates and ad-hoc internal control

Page 11

- 5 -
advice, reactive investigative work, follow-up of previous audits and risk
management advice. 
6. Audit Assurance Statement 
6.1 Internal Audit has performed its work in accordance with the role defined in
paragraph 1.2.  The audit work performed has been reported to the Assessor
and Electoral Registration Officer, and to the Board. Where areas for
improvement in internal control have been identified appropriate
recommendations have been made and accepted for action by management.  
6.2 In view of the continued challenges common to all public bodies, there will be
a requirement for the council and the bodies for which it is host authority to
exercise very close scrutiny over expenditure over financial management and
compliance with overarching governance arrangements, and this area will
continue to receive due internal audit attention.  
6.3 It is not feasible for the system of internal control to be without any weakness. 
It is important to balance the risks involved in accepting systems limitations
with the consequences if a problem emerges. Internal Audit recognises this
and assesses this in its reporting mechanism.   
6.4 There are corporate systems and processes within Renfrewshire Council that
the Renfrewshire Valuation Joint Board rely upon. It can be seen from Table 2
above that some of these processes require to be improved to provide a
reasonable level of assurance. Renfrewshire Council management has
agreed to implement the recommendation made by internal audit, in relation
to these reviews. In this context, it is considered that reasonable assurance
can be placed upon the adequacy and effectiveness of the Renfrewshire
Valuation Joint Board’s internal control, risk management and governance
arrangements, as evidenced by:- 
• The results of the audit work in 2023/24 in relation to the corporate      
systems which supported the Renfrewshire Valuation Joint Board’s
activities, and to specific work carried out in relation to those activities. 
• Management action in response to audit recommendations. 
• Management’s self-assessment of internal control, risk management
and governance arrangements. 
• The regular review and updating of the Local Code of Corporate
Governance by the Council in accordance with the CIPFA/SOLACE
framework for corporate governance requirements, and of the
corporate governance arrangements within Renfrewshire Valuation
Joint Board.

Page 12

- 6 -   
Signed     
Chief Auditor     
Date          24 May 2024

Page 13

Scotland Excel
Internal Audit Annual Report 
2023-2024 
Renfrewshire Council
Internal Audit 
May 2024

Page 14

Scotland Excel 
Internal Audit Annual Report 2023/2024 
Contents 
Page 
1.    Introduction  1 
2.  Responsibilities of Management and Internal Audit  2 
3.    Internal Audit Activity during 2023/24  2 
4.      Review of Internal Audit Performance    3 
5.  Planned Audit Work for 2024/25  4 
6.  Audit Assurance Statement  5

Page 15

- 1 -
Scotland Excel 
Internal Audit Annual Report   
1 April 2023 – 31 March 2024 
1. Introduction 
1.1 As host Authority, Renfrewshire Council provides an internal audit service to
Scotland Excel.  This includes: 
• The compilation of an annual audit plan following consideration and
evaluation of those areas of greatest risk in the organisation’s
operation, and consultation with the Chief Executive; 
• Delivery of the planned audit assignments;
• Follow up of previous audit recommendations;
• Provision of any ongoing advice and support on audit and risk
management related matters;
• Provision of an Annual Report and Assurance Statement, and
presentation to elected members of Scotland Excel. 
1.2 The Service operates in accordance with the Public Sector Internal Audit
Standards (PSIAS) which defines Internal Audit’s role as: 
“......an independent, objective assurance and consulting activity designed to
add value and improve an organisation’s operations. It helps an organisation
accomplish its objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management, control and
governance processes.” 
1.3 In line with the Standards, the purpose of this Annual Report is to report on: 
• The status/outcome of the planned Internal Audit reviews 202324
relating to Scotland Excel; 
• The outcome of Internal Audit reviews of supporting Renfrewshire
Council corporate systems;
• Internal audit performance; 
• Planned audit work for 2024/25;
• The annual assurance statement which provides an opinion on the
overall adequacy and effectiveness of the organisation’s internal control
environment.

Page 16

- 2 -
2. Responsibilities of Management and Internal Audit 
2.1 It is the responsibility of management to ensure that for the areas under their
control there is an adequate and effective system of internal control which
facilitates the effective exercise of the organisation’s functions and which
includes arrangements for the management of risk. 
2.2 Internal Audit is not a substitute for effective control exercised by
management as part of their responsibilities. Internal Audit’s role is to
independently assess the adequacy of the risk management, internal controls
and governance arrangements put in place by management and to undertake
sufficient work to evaluate and conclude on the adequacy of those controls for
the period under review. 
2.3 The internal audit team will ensure that independence and objectivity are
maintained in line with the PSIAS including where non-audit work is
undertaken. Internal auditors will have no operational responsibilities. There
have been no impairments impacting on the Chief Auditor’s independence
and the team has been adequately resourced during the year. 
3. Internal Audit Activity during 2023/2024 
3.1 One specific engagement on the contract monitoring – implementing
collaborative procurement is nearing completion and will be reported to
management as soon as possible. The 2022/23 review of contract
management of Social Care Contracts was completed during the year and
reported to the Executive Sub-Committee on 17 November 2023. The main
findings in relation to this review is summarised in table 1 below: 
Table 1 
Audit Area Conclusion
Contract Management –
Social Care Contracts
Substantial Assurance 
• The audit has identified that satisfactory
arrangements were in place to develop
social care framework contracts and 
there were no recommendations made
during the review. 
3.2 The Annual Report for 2022/2023 was submitted to the Executive Sub-
committee on 19 May 2023. 
3.3 The implementation rate of audit recommendations is a measure of
operational culture and effectiveness.  During 2023/24, one recommendation
was followed up and found to be completed.

Page 17

- 3 -
3.4 Internal Audit also carried out reviews of the main corporate systems
operating within Renfrewshire Council which support Scotland Excel’s activity.
The main findings in relation to these are summarised in Table 2 below and
Renfrewshire Council management have agreed to implement the audit
recommendations made in relation to each review: 
Table 2 
Audit Area Conclusion
Debt Management Reasonable Assurance 
Minor improvements have been
recommended in relation to timeous
raising of invoices and documenting
the strategy for debt management. 
Disaster Recovery Limited Assurance
The audit identified scope for
improvement in the existing
arrangements. Recommendations
were made to enhance and
strengthen controls; including
development of a central register of
critical systems, formalizing ICT
procurement guidance, and seeking
assurance from software as a service
providers regarding their ability to
meet disaster recovery requirements.
Payroll Overpayment Process Reasonable Assurance 
Improvements in processes and
increased awareness over recent
years has resulted in the value of
overpayments being significantly
reduced. By far, the main reason for
overpayments occurring is late
notification of changes by managers
within the employing service. The
auditor has recommended that clear
and accessible guidance should be
made available to service
management, along with regular
communications to ensure that newer
managers are aware of the deadlines
and where they can access relevant
guidance.
Health and Safety Limited Assurance 
The corporate arrangements for
health and safety require to be
improved. It was identified that
procedures require to be reviewed
and updated.  Improvements are
required in terms of corporate
oversight, compliance and
performance reporting.  
Purchasing Processes (Corporate Limited Assurance 
The review focused on corporate

Page 18

- 4 -
Purchase Cards) purchase card procedures. The main
areas for improvement identified
relates to purchasing goods outwith
the agreed procurement routes and
the authorisation of goods ordered.
There was also a lack of evidence
relating to the authorisation of the
increase of PCard spend limits.
4. Review of Internal Audit Performance
4.1 Internal Audit produces regular reports on its performance during the year to
the Renfrewshire Council, Audit, Risk and Scrutiny Board, against a range of
measures set annually by the Director of Finance and Resources. These
targets are set for all internal audit engagements and include Renfrewshire
Council and other associated bodies, for which the team provides internal
audit services. Table 3 shows the actual performance against targeted
performance for the year.
Table 3
Internal Audit Performance 2023/24
Performance measure Target 2023/24 Actual 2023/24
% of audit assignments
completed by target date
95% 92%
% of audit assignments completed
within time budget
95% 98.5%
% completion of audit plan for the
year*
95% 98.5%
* this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered
through the finalisation of the outstanding elements in the new financial year.
4.2 The percentage completion of the audit plan is slightly below the target set for
the year. This was due to the level of unplanned leave and the additional time
attributed to unplanned work. It should be noted that this had no effect on the
planned reviews for Scotland Excel for 2023/24. The actual performance for
the year for the two other indicators, is above the target performance level.
4.3 The PSIAS require the Chief Auditor to develop and maintain a quality
assurance and improvement programme (QAIP) that covers all aspects of the
internal audit activity. The QAIP must include both periodic internal self-
assessments and five-yearly external assessments, carried out by a qualified,
independent assessor from outwith the organisation.
4.4 We continued to participate in the Scottish Local Authorities Chief Internal
Auditors’ Group peer review process. Our most recent external assessment
was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and

Page 19

- 5 -
included 7 recommendations for improvement, all recommendations have now
been completed. The annual internal self-assessment process has concluded
that the internal audit service fully complies with the PSIAS. 
Risk Management 
4.6 The internal audit service through the Risk Manager, provides advice and
support to Scotland Excel officers, as required. 
5. Planned Audit Work for 2024/25 
5.1 Following a risk based assessment of the activities of Scotland Excel and
consultation with the Chief Executive, the following internal audit work has
been agreed for 20243/25: 
• A review of contract monitoring – contract delivery plan; 
• Follow up of previous audit work;
• Ad-hoc internal audit and risk management advice. 
6. Audit Assurance Statement 
6.1 Internal Audit has performed its work in accordance with the role defined in
paragraph 1.2.  The audit work performed and completed has been reported
to the Chief Executive, and to the Executive Sub Committee in this annual
report. Where areas for improvement in internal control have been identified
appropriate recommendations have been made and accepted for action by
management.   
6.2 In view of the continued challenges common to all public bodies, there will be
a requirement for the council and the bodies for which it is host authority to
exercise very close scrutiny over revenue spending over financial
management and compliance with overarching governance arrangements,
and this will continue to receive due internal audit attention.  
6.3 It is not feasible for the system of internal control to be without any weakness. 
It is important to balance the risks involved in accepting systems limitations
with the consequences if a problem emerges. Internal Audit recognises this
and assesses this in its reporting mechanism.   
6.4 There are corporate systems and processes within Renfrewshire Council that
Scotland Excel rely upon. It can be seen from Table 2 above that some of
these processes require to be improved to provide a reasonable level of
assurance. Renfrewshire Council management has agreed to implement the
recommendation made by internal audit, in relation to these reviews. In this
context, it is considered that reasonable assurance can be placed upon the
adequacy and effectiveness of Scotland Excel Joint Committee’s internal
control, risk management and governance arrangements, as evidenced by:-  
• The results of the audit work in 2023/24 in relation to the corporate      
systems which supported Scotland Excel’s activities.

Page 20

- 6 - 
• Management action in response to audit recommendations. 
• Management self assessment of internal control, risk management and
governance arrangements. 
• The regular review and updating of the Local Code of Corporate
Governance by the Council in accordance with the Chartered Institute
of Public Finance and Accountancy and Society of Local Authority
Chief Executives framework for corporate governance requirements,
and of the corporate governance arrangements within Scotland Excel. 
Signed.                 
Chief Auditor     
Date        17 May 2024

Page 21

Renfrewshire Health and Social
Care Integration Joint Board 
Internal Audit Annual Report 
2023-2024 
June 2024

Page 22

No embedded text on this page.

Page 23

Renfrewshire Health and Social Care Integration Joint Board 
Internal Audit Annual Report 2023/2024 
Contents 
Page 
1.    Introduction  1
2. Responsibilities of Management and Internal Audit 2 
3.    Internal Audit Activity in 2023/24  2 
4.      Review of Internal Audit Performance    2 
5.  Planned Audit Work for 2024/25  3 
6.  Audit Assurance Statement  4 
Appendix 1 – Summary of Assurances  5

Page 24

- 1 -
Renfrewshire Health and Social Care Integration Joint Board 
Internal Audit Annual Report   
1 April 2023 – 31 March 2024 
1. Introduction 
1.1 Renfrewshire Council provides an internal audit service to the Renfrewshire
Health and Social Care Integration Joint Board (IJB).  This includes: 
• The compilation of an annual audit plan following consideration 
and evaluation of those areas of greatest risk in the organisation’s
operation, and consultation with the Chief Officer and Senior
Management;
• Delivery of the planned audit assignments;
• Follow up of previous audit recommendations;
• Provision of any ongoing advice support and training on audit and
risk related matters;
• Provision of an Annual Report and Assurance Statement to the IJB. 
1.2 The Service operates in accordance with the Public Sector Internal Audit
Standards which defines Internal Audit’s role as: 
“......an independent, objective assurance and consulting activity designed to
add value and improve an organisation’s operations. It helps an organisation
accomplish its objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management, control and
governance processes.” 
1.3 In line with the Standards, the purpose of this Annual Report is to report on: 
• The outcome of the planned Internal Audit reviews 2023/24 relating to
the IJB;
• The outcome of Internal Audit reviews undertaken by partner bodies;
• Internal audit performance; 
• Planned audit work for 2024/25;
• The annual assurance statement which provides an opinion on the
overall adequacy and effectiveness of the IJB’s internal control
environment. 
1.4 The operational delivery of services within the Health Board and Local Authority
on behalf of the Integration Joint Board will be covered by their respective
internal audit arrangements. In concluding on the overall opinion, the Chief
Internal Auditor has conducted a review of the internal audit reports issued to
the IJB in the year, the internal audit annual report from Renfrewshire Council
and progress summaries from NHS Greater Glasgow and Clyde. (Appendix 1)

Page 25

- 2 -
2. Responsibilities of Management and Internal Audit 
2.1 It is the responsibility of management to ensure that the areas under their
control are adequate and effective and that there is a sound system of internal
control which facilitates the effective exercise of the organisation’s functions
and which includes arrangements for the management of risk. 
2.2 Internal Audit is not a substitute for effective control exercised by management
as part of their responsibilities. Internal Audit’s role is to independently assess
the adequacy of the risk management, internal controls and governance
arrangements put in place by management and to undertake sufficient work to
evaluate and conclude on the adequacy of those controls for the period under
review. 
3. Internal Audit Activity during 2023/2024 
3.1 The Internal Audit Plan for the IJB for 2023/2024 provided for a review of
performance management and the annual review of the adequacy and
compliance with the Local Code of Corporate Governance. The review of
performance management was reported to the IJB Audit, Risk and Scrutiny
Committee on 15 March 2024. The review of compliance with the Local Code
of Corporate Governance is included on today’s agenda. 
3.2 The Annual Report for 2022/2023 was submitted to the Integration Joint Board
on 23 June 2023. 
3.3 The implementation rate of audit recommendations is a measure of operational
culture and effectiveness.  During 2023/24, 3 recommendations were followed
up and all have been fully implemented. 
4. Review of Internal Audit Performance 
4.1 Internal Audit produces regular reports on its performance during the year to
Renfrewshire Council’s Audit, Risk and Scrutiny Board, against a range of
measures set annually by Renfrewshire Council’s Director of Finance and
Resources. These targets are set for all internal audit engagements and include
Renfrewshire Council and other associated bodies, for which the team provides
internal audit services. Table 1 shows the actual performance against targeted
performance for the year. 
Table 1 
Internal Audit Performance 2023/24 
Performance measure  Target 2023/24 Actual 2023/24
% completion of audit plan for the year* 95% 92%
% engagements completed by target
date
95% 98.5%
% engagements completed within time
budget
95% 98.5%

Page 26

- 3 -
* this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the
finalisation of the outstanding elements in the new financial year.
4.2 The percentage completion of the audit plan is slightly below the target set for
the year. This was due to the level of unplanned leave and the additional time
attributed to unplanned work. It should be noted that this had no effect on the
planned reviews for the IJB for 2023/24 which are 100% complete. The actual
performance for the year for the two other indicators, is above the target
performance level.
4.3 The PSIAS require the Chief Auditor to develop and maintain a quality
assurance and improvement programme (QAIP) that covers all aspects of the
internal audit activity. The QAIP must include both periodic internal self-
assessments and five-yearly external assessments, carried out by a qualified,
independent assessor from outwith the organisation.
4.4 We continued to participate in the Scottish Local Authorities Chief Internal
Auditors’ Group peer review process. Our most recent external assessment
was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and
included 7 recommendations for improvement, all recommendations have now
been completed. The annual internal self-assessment process has concluded
that the internal audit service fully complies with the PSIAS.
5. Planned Work for 2024/25
5.1 Following a risk-based assessment of the activities of the IJB and consultation
with the senior management team, the Internal Audit Plan for 2024/2025
provides for 40 days of Internal Audit resource to undertake:
• A review of financial planning; and
• The annual review of the adequacy and effectiveness of the Local Code
of Corporate Governance.
The plan also provides time for planning and reporting, follow up on previous
recommendations, the annual self-assessment of the Audit Committee
arrangements, ad-hoc advice, consultancy and training. The Internal Audit Plan
for 2024/2025 was approved by the IJB Audit, Risk and Scrutiny Committee on
15 March 2024.
6. Audit Assurance Statement
6.1 The audit work performed in relation to the 2023/24 internal audit plan has been
reported to the Chief Officer. Relevant audit work undertaken by partner
organisations is reported to the Audit, Risk and Scrutiny Committee. Where
areas for improvement in internal control have been identified, appropriate
recommendations have been made and accepted for action by management.
6.2 There are no significant matters arising in relation to those audit engagements
specific to the IJB and there have been no impairments impacting on the Chief

Page 27

- 4 -
Auditor’s independence and the team has been adequately resourced during
the year. 
6.3 It is not feasible for the system of internal control to be without any weakness. 
It is important to balance the risks involved in accepting systems limitations with
the consequences if a problem emerges. Internal Audit recognises this and
assesses this in its reporting mechanism.  
6.4 There are corporate systems and processes within Renfrewshire Council and
NHS Greater Glasgow and Clyde that the IJB rely upon. It can be seen from
Appendix 1, that some of these processes require to be improved to provide a
reasonable level of assurance. 
6.5 In this context, it is considered that a reasonable level of assurance can be
placed upon the adequacy and effectiveness of the Integration Joint Board’s
internal control, risk management and governance arrangements, as evidenced
by:- 
• The results of the audit work in 2023/24 and the opinion’s contained in
the Internal Audit Annual Reports of the Local Authority and progress
reports from the Health Board. 
• Management self-assessment of internal control, risk management and
governance arrangements. 
• Management action to respond to audit recommendations. 
Chief Internal Auditor     
21 June 2024

Page 28

- 5 -
Appendix 1 
Summary of Internal Audit Assurances for the IJB and Partner Organisations,
Renfrewshire Council and NHS Greater Glasgow and Clyde 
Integration Joint Board
Audit Engagement Assurance
Level
Significant Matters
Local Code of Corporate
Governance
Substantial • None
Performance Management Substantial • None
Renfrewshire Council
Audit Engagement Assurance
Level
Significant Matters
Cyber Security Reasonable • None
Information Asset Register Limited • There was a requirement to
improve accountability by services
for the upkeep of the Information
Asset Register and oversight of
the completeness of the register
could be improved. All
recommendations have now been
implemented.
Disaster Recovery Limited • There is scope to improve the
existing arrangements.
Recommendations were made to
enhance and strengthen controls;
including development of a central
register of critical systems,
formalising ICT procurement
guidance, and seeking assurance
from software as a service
providers regarding their ability to
meet disaster recovery
requirements.
Care at Home Processes Substantial • None
Debt Management Reasonable • None
Payroll Overpayment
Process
Reasonable • None
Health and Safety Limited • The corporate arrangements for
health and safety require to be
improved. It was identified that
procedures require to be reviewed
and updated.  Improvements are
required in terms of corporate
oversight, compliance and
performance reporting.  
Purchasing Processes
(Corporate Purchase
Cards)
Limited • The review focused on corporate
purchase card procedures. The
main areas for improvement
identified relates to purchasing
goods outwith the agreed

Page 29

- 6 -
procurement routes and the
authorisation of goods ordered. 
There was also a lack of evidence
relating to the authorisation of the
increase of PCard spend limits.  
NHS Greater Glasgow and Clyde
Audit Engagement Overall Audit
Rating
Significant Matters
Public Protection
Arrangements
Substantial
Improvement
Required
• Improvements were required in
relation to guidance documents
and training. 
Use of Agency Staff Substantial
Improvement
Required
• The use of agency staff in some
area could not be explained by
increased vacancy levels.
Moving Forward Together
Implementation
High risk  • The risk reflects the ability to
progress with transformational
activity within an extremely
challenging operating environment,
with increased pressure on
services and both resourcing and
financial constraints, remains an
area of significant uncertainty. 
Infection Prevention and
Control
Minor
improvement
required
• None
Consultant Job Planning Substantial
improvement
required
• Improvements are required in
relation to job planning and
monitoring the delivery of these
plans.
eHealth Application Access
Management
Minor
improvement
required
• None
Public Health Screening  Minor
improvement
required
• None
Managing Staff Attendance  Minor
improvement
required
• None

Page 30

Appendix 4
Internal Audit Report
IJB - Governance Arrangements (B0017/2024/001)
Date:  May 2024
COMMITTEE SUMMARY
Audit Objectives
The Renfrewshire Integrated Joint Board (IJB) have developed local governance
arrangements that are designed to ensure compliance with, ‘Delivering Good Governance
in Local Government: Framework,’ published by CIPFA. The objectives of this audit were
to review independently and report annually to the IJB Audit, Risk and Scrutiny Committee: 
• To provide assurance on the adequacy and effectiveness of the Local Code of
Corporate Governance and the extent of compliance with it. 
• To support the Chief Internal Auditor’s annual opinion included in the Internal Audit
Annual Report and the Governance Statement included in the Annual Accounts. 
Audit Scope
1. Obtained an up-to-date copy of the IJB’s Local Code of Corporate Governance and
selected a sample of elements for compliance testing. 
2. Obtained the appropriate evidence to confirm compliance with the Code.here was
adequate management oversight for the selected performance indicators. 
Key Audit Assurances
1. The Local Code and Sources of Assurance for Governance Arrangements was
updated and submitted to the Renfrewshire Integration Joint Board on the 23rd of June
2023. 
2. Based on our sample check of the evidence used to demonstrate compliance, we
would confirm that the IJB complies with the requirements of the Local Code of
Corporate Governance. 
Key Risks
• No key risks were identified as a result of this audit.

Page 31

Overall Audit Opinion
Internal Audit has reviewed the adequacy and effectiveness of the revised Code which was
presented to the Renfrewshire Integration Joint Board on the 23rd of June 2023. Based on our
sample check of the evidence used to demonstrate compliance, we would confirm that the IJB
complies with the requirements of the Local Code of Corporate Governance. In addition, it is
evident that the Local Code has been subject to regular review and updating in line with
developments in best practice. 
Management Commentary
N/A as no key risks identified.

Page 32

Glasgow and Clyde Valley Strategic
Development Planning Authority 
Annual Report 
2023-2024 
Renfrewshire Council
Internal Audit 
June 2024

Page 33

Glasgow and Clyde Valley Strategic Development Planning Authority 
Internal Audit Annual Report 2023/2024 
Contents 
Page 
1.    Introduction  1
2. Responsibilities of Management and Internal Audit 2 
3.    Internal Audit Activity in 2023/24  2 
4.      Internal Audit Performance    4 
5.  Planned Audit Work for 2024/25  5 
6.  Audit Assurance Statement  5

Page 34

- 1 -
Glasgow and Clyde Valley Strategic Development Planning Authority 
Internal Audit Annual Report   
1 April 2023 – 31 March 2024 
1. Introduction 
1.1 As host Authority, Renfrewshire Council provides an internal audit service to
Glasgow and Clyde Valley Strategic Development Planning Authority.  This
includes: 
• The compilation of an annual audit plan following consideration 
and evaluation of those areas of greatest risk in the organisation’s
operation, and consultation with the Strategic Development Plan
Manager;
• Delivery of the planned audit assignments;
• Follow up of previous audit recommendations;
• Provision of any ongoing advice and support on audit and risk
management related matters;
• Provision of an Annual Report and Assurance Statement, and
presentation to elected members at the Glasgow and Clyde Valley
Strategic Development Planning Authority. 
1.2 The Service operates in accordance with the Public Sector Internal Audit
Standards which defines Internal Audit’s role as: 
“......an independent, objective assurance and consulting activity designed to
add value and improve an organisation’s operations. It helps an organisation
accomplish its objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management, control and
governance processes.” 
1.3 In line with the Standards, the purpose of this Annual Report is to report on: 
• The outcome of any planned Internal Audit reviews in 2023/24 relating
to the Glasgow and the Clyde Valley Strategic Development Planning
Authority;
• The outcome of Internal Audit reviews of supporting Renfrewshire
Council corporate systems;
• Internal audit performance; 
• Planned audit work for 2024/25;
• The annual assurance statement which provides an opinion on the
overall adequacy and effectiveness of the Planning Authority’s internal
control environment.

Page 35

- 2 -
2. Responsibilities of Management and Internal Audit 
2.1 It is the responsibility of management to ensure that the areas under their
control are adequate and effective and that there is a sound system of internal
control which facilitates the effective exercise of the organisation’s functions
and which includes arrangements for the management of risk. 
2.2 Internal Audit is not a substitute for effective control exercised by
management as part of their responsibilities. Internal Audit’s role is to
independently assess the adequacy of the risk management, internal controls
and governance arrangements put in place by management and to undertake
sufficient work to evaluate and conclude on the adequacy of those controls for
the period under review. 
2.3 The internal audit team will ensure that independence and objectivity are
maintained in line with the PSIAS including where non-audit work is
undertaken. Internal auditors will have no operational responsibilities. There
have been no impairments impacting on the Chief Auditor’s independence
and the team has been adequately resourced during the year. 
3. Internal Audit Activity during 2023/2024 
3.1 The Annual Report for 2022/2023 was submitted to the Joint Board on 12
June 2023. 
3.2 There were no outstanding audit recommendations which required to be
followed up as part of the 2023/24 annual follow up exercise. 
3.3 Internal Audit also conduct reviews of the main corporate systems operating
within Renfrewshire Council which support the Committee’s activity. The main
findings in relation to these are summarised in Table 1 below and
Renfrewshire Council management have agreed to implement the audit
recommendations made in relation to each review:
Table 1 
Audit Area Conclusion
Debt Management Reasonable Assurance 
Minor improvements have been
recommended in relation to timeous
raising of invoices and documenting
the strategy for debt management. 
Disaster Recovery • Limited Assurance
The audit identified scope for
improvement in the existing
arrangements. Recommendations
were made to enhance and
strengthen controls; including
development of a central register of
critical systems, formalizing ICT
procurement guidance, and seeking

Page 36

- 3 -
assurance from software as a service
providers regarding their ability to
meet disaster recovery requirements.
Payroll Overpayment Process • Reasonable Assurance
Improvements in processes and
increased awareness over recent
years has resulted in the value of
overpayments being significantly
reduced. By far, the main reason for
overpayments occurring is late
notification of changes by managers
within the employing service. The
auditor has recommended that clear
and accessible guidance should be
made available to service
management, along with regular
communications to ensure that newer
managers are aware of the deadlines
and where they can access relevant
guidance.
4. Review of Internal Audit Performance
4.1 Internal Audit produces regular reports on its performance during the year to
the Renfrewshire Council, Audit, Risk and Scrutiny Board, against a range of
measures set annually by the Director of Finance and Resources. These
targets are set for all internal audit engagements and include Renfrewshire
Council and other associated bodies, for which the team provides internal
audit services. Table 2 shows the actual performance against targeted
performance for the year.
Table 2
Internal Audit Performance 2023/24
Performance measure Target 2023/24 Actual 2023/24
% completion of audit plan for the
year*
95% 92%
% of audit assignments completed
within time budget
95% 98.5%
% of audit assignments
completed by target date
95% 98.5%
* this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the
finalisation of the outstanding elements in the new financial year.

Page 37

- 4 -  
4.2 The percentage completion of the audit plan is slightly below the target set for
the year.  This was due, in the main, to a higher than anticipated level of
unplanned leave and the additional time attributed to unplanned work. It
should be noted that the planned internal audit activity within the planning
authority is 100% complete. The actual performance for the year for the two
other indicators, is above the target performance level. 
4.3 The PSIAS require the Chief Auditor to develop and maintain a quality
assurance and improvement programme (QAIP) that covers all aspects of the
internal audit activity. The QAIP must include both periodic internal self-
assessments and five-yearly external assessments, carried out by a qualified,
independent assessor from outwith the organisation. 
4.4 We continued to participate in the Scottish Local Authorities Chief Internal
Auditors’ Group peer review process. Our most recent external assessment
was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and
included 7 recommendations for improvement, all recommendations have now
been completed. The annual internal self-assessment process has concluded
that the internal audit service fully complies with the PSIAS. 
External Audit 
Risk Management 
4.6 The internal audit service through the Risk Manager, provides advice and
support to the GCVSDPA officers, as required. 
5. Planned Work for 2023/24 
5.1 Following a risk based assessment of the activities of the Glasgow and Clyde
Valley Strategic Development Planning Authority and consultation with the
Head of Economy and Development the following internal audit work has
been agreed for 2023/24: 
• Ad-hoc internal audit and risk management advice;
• Annual report to support the Governance Statement. 
6. Audit Assurance Statement 
6.1 Internal Audit has performed its work in accordance with the role defined in
paragraph 1.2.  The audit work performed has been reported to the Strategic
Development Plan Manager, and to the Joint Committee in this annual report.
Where areas for improvement in internal control have been identified,
appropriate recommendations have been made and accepted for action by
management.   
6.2 In view of the continued challenges common to all public bodies, there will be
a requirement for the council and the bodies for which it is host authority to

Page 38

- 5 -
exercise very close scrutiny over expenditure, and both areas will continue to
receive due internal audit attention.  
6.3 It is not feasible for the system of internal control to be without any weakness. 
It is important to balance the risks involved in accepting systems limitations
with the consequences if a problem emerges. Internal Audit recognises this
and assesses this in its reporting mechanism.   
6.4 There are corporate systems and processes within Renfrewshire Council that
the Planning Authority rely upon. It can be seen from Table 2 above that some
of these processes require to be improved to provide a reasonable level of
assurance. Renfrewshire Council management has agreed to implement the
recommendation made by internal audit, in relation to these reviews. In this
context, it is considered that a reasonable level of assurance can be placed
upon the adequacy and effectiveness of the Glasgow and Clyde Valley
Strategic Development Planning Authority’s internal control, risk management
and governance arrangements, as evidenced by:-  
• The results of the audit work in 2023/24 in relation to the corporate
systems which supported the Glasgow and Clyde Valley Strategic
Development Planning Authority’s activities. 
• Management action in response to audit recommendations. 
• Management self assessment of internal control, risk management and
governance arrangements. 
• The regular review and updating of the Local Code of Corporate
Governance by the Council in accordance with the CIPFA/SOLACE
framework for corporate governance requirements and of the corporate
governance arrangements within the Glasgow and Clyde Valley
Strategic Development Planning Authority. 
Signed           
Chief Auditor     
Date          10 June 2024