Annual IA Plan complete
Renfrewshire Council · 17 March 2025
Back to Audit, Risk and Scrutiny Board — 17 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 17 March 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Annual Internal Audit Plan 2025/2026 ___________________________________________________________________ 1. Summary 1.1 In line with the requirements of the Global Internal Audit Standards in the Public Sector, a risk based internal audit plan for 2025/26 has been developed. The audit plan takes into account the outcomes of internal corporate and service risk identification and evaluation processes, and the current business environment. In addition to undertaking work which will provide assurance on the robustness of key internal controls, the plan seeks to reflect the key priorities and challenges for the council. 1.2 A number of methods have been employed to facilitate production of the risk based audit plan for 2025/26: • Consultation with all Directors and their Senior Management Teams. • Consultation with senior management from the associate bodies. • Benchmarking with other Local Authorities. • Review of strategic, corporate and service risk registers. • Cumulative audit knowledge and experience. • Review of key external audit and inspection reports. 1.3 The total available resource is 1100 days, the operational audit time available for 2025/26 has been identified as 869 days (79%). The remaining 231 days (21%) relates to training, service development, administration and management. Coverage of the plan is achieved through the use of in-house staff and where relevant, commissions from other providers.
Page 2
1.5 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. Non-operational time includes provision for training, performance management and service development. In addition to the internal audit assurance function the Interim Chief Auditor has managerial responsibility for risk management, insurance and corporate counter fraud which are excluded from the calculation of available operational audit resources. 1.6 Delivery of the risk based annual audit plan supports effective member scrutiny of the council’s internal financial and other control mechanisms. ___________________________________________________________________ 2. Recommendations 2.1 Members are asked to approve the content of the risk based audit plan for 2025/26. 2.2 Members are asked to note that the progress of the 2025/26 annual audit plan and summaries of the findings from each audit assignment will be reported to the Board on a quarterly basis. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - The subject matter of this report is the risk based Internal Audit Plan for 2025 –2026
Page 3
11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights - None ________________________________________________________________ Author : Karen Campbell, Interim Chief Auditor – 0141 487 0678
Page 4
Date March 2025 Annual Internal Audit Plan 2025/26 Finance & Resources Internal Audit
Page 5
Page 2 of 14
Page 6
Page 3 of 14 Renfrewshire Council Annual Internal Audit Plan 2025/26 Contents Page Audit Plan Overview 4 - 9 Supporting Appendices 1 Annual Council Internal Audit Plan 2025/26 10 – 11 2 Annual Other Bodies Internal Audit Plan 2025/26 12 3 Analysis of plan by service 13 4 Annual Audit Plan 2025/26 – Integration Joint Board 14
Page 7
Page 4 of 14 Audit Plan Overview 1. Introduction 1.1 In line with the requirements of the Global Internal Audit Standards in the Public Sector and the Internal Audit Charter, a risk based internal audit plan for 2025/26 has been developed. In formulating the audit plan a risk assessment has been undertaken, giving consideration to the following sources of information: Risk assessment (1) Risk assessment and prioritisation of all auditable activities (audit universe). (2) Strategic and Corporate Risk Register. Consultation (3) The Interim Chief Auditor has met with each member of the CMT and their senior management teams to ascertain any changes to operational practice and national policy and to determine their priorities and risks. (4) Senior Management from the Associate Bodies and One Ren have been consulted to ascertain their priorities and risks. (5) The Chief Executive has been consulted on what he sees as the council’s priority and risk areas for the forthcoming year. (6) Feedback from, and the expectations of, the Audit, Risk and Scrutiny Board are identified through the regular meetings with the members of the board. (7) The Interim Chief Auditor has met with the local External Audit team to ascertain their approach to the statutory audit where assurance on key internal controls could be provided to avoid any duplication of effort. Benchmarking (8) Other Local Authority internal audit plans. (9) Discussion with other Chief Auditors through the Scottish Local Authority Chief Auditors Group. Review of key internal reports (10) Renfrewshire’s Council Plan 2022 -2027 (11) The results of internal audit work in 2024/25 and in previous years. (12) Review of the results of the Business as Usual risk assurance modules. Review of key external reports (13) External Audit’s - Report to Members and the Controller of Audit on the 2024/25 Audit. (14) Audit Scotland: Best Value reports issued during 2024/25 (15) Review of other relevant Reports issued by External Inspection Agencies during 2024/25 . 1.2 On the basis of the above, the audit engagements planned for 2025/26 are set out in Appendix 1, 2 and 4, for the Council, Associate Bodies and the Integration Joint Board in the following categories of audit activity: • Assurance • Governance • Contingency • Planning and Reporting 1.3 It is the responsibility of management to ensure that they have good governance, risk management and internal control arrangements over the functions they are responsible for. It is internal audit’s role to provide an independent, objective assurance and consulting activity. The scope of the internal audit plan encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation's governance, risk management, and internal control processes; as well as the quality of performance in carrying out assigned responsibilities to achieve the organisation’s stated goals and objectives.
Page 8
Page 5 of 14 1.4 Internal Audit has authorised full, free unrestricted access to any and all of Renfrewshire Council’s records, physical properties, systems and personnel pertinent to carrying out any audit engagement. 1.5 Delivery of the internal audit plan supports the requirement for the Chief Auditor to provide an annual opinion which is used to inform the annual governance statement. 1.6 The Chief Auditor shares information and coordinates activities with other internal and external providers of assurance and consulting services, as appropriate, to ensure proper coverage and minimise duplication of effort. Internal audit may place reliance on the work of other providers of assurance and the ability to do so will be considered during each audit engagement. 1.7 The plan also includes provision for managing and developing the internal audit activity including audit planning, reporting, periodic quality assessments and for following up on previous recommendations and reactive investigative work. The plan includes contingency time to allow for completion of work carried forward from 2024/25 and provides for consultancy engagements to be undertaken where these can improve the council’s operations, add value and improve the management of risks. Contingency time also provides for sufficient flexibility to accommodate changing risks and priorities during the course of the year. More detail on each of these elements is set out in sections 4 to 7 of this plan. 1.8 The internal audit service is delivered and developed in accordance with its purpose which, as set out in the Internal Audit Charter, is to provide assurance by independently reviewing the council’s risk management, control and governance processes. 2. The current business environment and key risk areas 2.1 The audit plan detailed in Appendix 1 has been development to support the achievement of the council’s objectives and the challenges we face in achieving those objectives. The key challenges included in the planned audit work are detailed below. (1) Asset Management Effective governance and management of the council’s property assets is essential, otherwise there is a significant risk of harm to employees and citizens and financial loss, and service disruption within the Council. The 2025/26 audit plan includes time for:- • Reviewing the adequacy of the arrangements for securing our buildings including empty properties. • Conducting a compliance check on the evidence being submitted to the Housing Regulator to support the Housing Assurance Statement. • Reviewing the processes in place for obtaining vehicle road fund licences to ensure they are adequate and adhere to the regulations of the scheme. (2) Financial Challenges Our organisation continues to face a significant financial challenge to make significant savings after many years of already delivering substantial efficiencies and reduction in our spending. Alongside this, our communities are experiencing a cost-of-living crisis and the demand for our services is higher than ever before. Therefore, the financial outlook continues to be subject to significant and regular scrutiny. The 2025/26 audit plan includes time for compliance reviews of : • Non-domestic rates processes to ensure they are adequate. • The procedures in place for allocating school transport to ensure they are in line with Council guidance and, in order to ensure best value is being achieved for the Council in terms of financial and staff resource, whilst adhering to the procurement regulations.
Page 9
Page 6 of 14 • Service processes for arranging contracts for goods and services below the £24999.99 threshold. • The procuring of ICT Systems. (3) Governance Arrangements The Council governance framework ensures that its business is conducted in accordance with the law and proper standards, and that public money is safeguarded. It comprises the systems and processes, and culture and values, by which the Council is directed and controlled. These arrangements should be subject to regular review whilst undertaking transformation change programmes. During 2025/26 Internal Audit will undertake the following engagements:- • A compliance review of the Local Code of Corporate Governance to ensure there is adequate supporting evidence to support the code elements. • An operational review of the process in place for authorising transactions to ensure they are efficient and effective. (4) Fraud and Error Attempts at undertaking fraudulent activity against individuals and organisations are rapidly increasing. The Council is committed to minimising the risk of fraud and error occurring within the operation of its services by internal and external parties. . To assist in achieving this aim, it is important that that the Council review the adequacy of the internal controls in any areas where fraudulent activity has occurred in other organisations. The 2025/26 Audit Plan includes time for : • Reviewing the adequacy of the Council Tax Refund Processes. • Undertaking a Compliance Review of the key internal controls within our main financial systems. (5) Tackling Inequalities The Council plays a key role in tackling inequalities and providing the best possible services to our communities, particularly those who are experiencing the poorest outcomes. The current cost of living crisis impacts disproportionately on particular groups in society. The Council is committed to supporting people by assisting those on low incomes and increasing employment opportunities. The 2025/26 audit plan includes time for reviewing: • Scottish Welfare Fund payments to ensure the fund allocation is utilised in a fair and consistent manner. • The Employability Programme within the Council to ensure the processes in operation are adequate and meet the requirements of the funding allocation. (6) Public Protection Public protection is a wide-ranging agenda relating to the protection of vulnerable people, communities, businesses and organisations. During 2025/26, internal audit will review: • The arrangements for handling and the security of paper documentation containing personal information when working in a hybrid basis and undertaking client visits. • The procedures in place for vehicle inspections to ensure they are adequate. (7) Strategic Sustainable Planning for People and Assets
Page 10
Page 7 of 14 When major transformation is ongoing to deliver the best services possible, it is inevitable that job roles and service processes will change throughout the Council. This plan includes time for operational reviews of: • The Job Evaluation Scheme to ensure it is fit for purpose and applied in a consistent manner. • Customer Service Processes to ensure there are adequate internal controls in place and they meet customer requirements. 2.2 There are a number of significant risks, arising from the external and internal environment, which could impact on the council’s ability to achieve its objectives. The most significant risks and the risk control measures to manage these risks, are identified through the council’s corporate risk management process. Subject to the overall flexibility of the Audit Plan, priority will be given to audit engagements which impact on the council’s strategic and corporate risks. 3. Allocation of Resources 3.1 In addition to the internal audit assurance function the Chief Auditor has managerial responsibility for risk management, insurance and counter fraud which are excluded from the calculation of available operational audit resources. 3.2 The Internal Audit Service is a small team with a permanent establishment of 6 Full Time Equivalents and is considered to be appropriately resourced. It was recognised that Internal Audit teams across many councils carry resilience risks owing to their small size, composition and difficulty recruiting experienced staff. On the retiral of the Chief Auditor during 2024/25, a decision was taken to conduct a review with neighbouring councils with regards to improving resilience within internal audit and counter fraud services. This review is nearing completion and the outcomes will be reported in the near future to the Finance, Resources and Customer Services Policy Board. This post is currently being covered by the Assistant Chief Auditor on an interim basis and the team has operated with a vacant position. 3.3 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. The calculation of operational staff time has been based on the permanent establishment of 6 full time equivalent employees (4 qualified and 2 non-qualified) and with a vacancy factor built into the calculation. 3.4 The vacancy is a qualified post but resources from any unfilled elements of posts and other available audit resource will be used flexibly to ensure that the audit plan commitments are met, through the engagement of temporary staff and other audit service providers where appropriate. Currently 40 days are planned to be provided from other service providers. The Interim Chief Auditor is responsible for managing the Internal Audit budget. 3.5 Non-operational time includes provision for training, performance management and service development. Where engagements are undertaken by the other audit service providers, these can provide an opportunity for benchmarking, training and development. Sufficient resources are available to engage specialist contractors where necessary to address any specific risks faced by the council. 3.6 The total available resource is 1100 days; the operational audit time available for 2025/26 has been identified as 869 days (79%). The remaining 231 days (21%) relates to training, service development, administration and management. Resources are assessed as being sufficient to provide an evidenced based opinion. 3.7 The following paragraphs provide an overview of how the audit time has been allocated to audit categories for the Council and the Associated Bodies we provide services to. A summary of the operational time by audit category is detailed in table 1 below. The analysis of non- operational audit activity is detailed in the table 2 below. The planned operational/non- operational time for 2024/25 is given for comparative purposes.
Page 11
Page 8 of 14 2024/25 2025/26 Category of audit Planned Days % of Operational Time Planned Days % of Operational Time GOVERNANCE 51 6% 76 9% ASSURANCE 374 44% 360 41% CONTINGENCY note 1 293 34% 295 34% AUDIT PLANNING / REPORTING 138 16% 138 16% TOTAL OPERATIONAL TIME 856 100% 869 100% Table 1 Notes 1. This category includes time for the finalisation of the previous year’s audits, corporate exercises and groups, investigations, significant project consultancy activities and emerging priorities. 2024/25 2025/26 Activity Planned Days % of Non - operational Time Planned Days % of Non - operational Time TRAINING 56 24% 51 22% STRATEGIC MANAGEMENT 16 7% 16 7% TEAM ADMINISTRATION 89 39% 91 39% DEVELOPMENT note 1 69 30% 73 32% TOTAL NON-OPERATIONAL TIME 230 100% 231 100% Table 2 Notes 1. This category includes time allocated to development activities to support continuous improvement activities. 4. Governance (9% of operational time) 4.1 Internal Audit must evaluate the risk exposures relating to the council’s and associate bodies governance arrangements. The engagements within this category form the basis for the Chief Auditor’s annual audit opinions and support the annual governance statements. 4.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part A in respect of the current year, with a total of 76 days being allocated to these engagements for 2025/26. 5. Assurance (41% of operational time) 5.1 A risk based assessment has been undertaken of all auditable areas taking into account the risk management framework and the expectation of senior management and the Audit, Risk and Scrutiny Board. The engagements within this category also form the basis for the Chief Auditor’s annual opinions and support the annual governance statements. For each engagement internal audit will consider whether there are any available external sources of assurance that can be relied upon to deliver the plan. Time is also allocated to following up on the implementation of prior years audit recommendations.
Page 12
Page 9 of 14 5.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part B in respect of the current year, with a total of 360 days being allocated to these engagements for 2025/26. 6. Contingency (34% of operational time) 6.1 This category includes time allocations for finalisation of the 2024/25 audit plan, undertaking reactive investigations of theft, fraud or other malpractice and provides for post-report work which includes attending disciplinary or appeal hearings, employment tribunals and court, as required. 6.2 The allocation of time for this category is an estimate based on prior experience and available resources. However, this will be monitored during the course of the year to ensure that internal audit continue to be in a position to respond to other priority areas which emerge during the course of the year, and, if necessary, revise the audit plan accordingly. Appendix 1 and 2, Part C details the indicative time of 295 days allocated across the contingency heading. 6.3 Should more time be available this will be added to the contingency budget and will be used to deliver audit reviews from the reserve list detailed on Appendix 1, Part E. 7. Audit Planning / Reporting (16% of operational time) 7.1 This category includes annual planning activity and reporting arrangements to the Corporate Management Team and the Audit, Risk and Scrutiny Board, the Integration Joint Board Audit, Risk and Scrutiny Board and the Boards of the other bodies we provide internal audit services to under a service level agreement. Appendix 1 and 2, Part D details the time of 138 days allocated to planning and reporting activities. 8. Analysis of Plan by Service 8.1 Appendix 3 shows the amount of operational audit time allocated to individual services in 2025/26 and compares it to the planned days for 2024/25. 8.2 The planned days allocated to all services relates to work which is cross-cutting rather than service specific as well as time which is allocated out to services as the year progresses, such as contingency and investigations. 9. Conclusion 9.1 The annual internal audit plan for 2025/26, based on the strategic risk assessment, reflects the current priorities and challenges for the council, and demonstrates that the internal audit service continues to deliver added value while continuing to improve the service in line with best practice. 9.2 The allocation of internal audit resources is sufficient to allow for flexibility to deal with emerging priorities and provide adequate coverage of governance, risk management and internal control to inform the annual assurance statement. 9.3 In order to continue to focus on areas of greatest priority or emerging risks and other unforeseen circumstances, the plan will be subject to regular review during the course of the year. The Audit, Risk and Scrutiny Board will be requested to approve any necessary changes. Interim Chief Auditor March 2025
Page 13
Page 10 of 14 Appendix 1 Renfrewshire Council Internal Audit Annual Plan 2025/26 Entity Engagement Title Service Days Allocated Risk Category Council Plan Theme Part A – Governance 71 Corporate Governance Corporate Governance Framework Corporate - All Services 6 N/A Living Our Values Information Governance Security of Paper Documentation Adult Services 20 Strategic/BAU Fair Authorisation Controls Authorisation Controls Review Corporate – All Services 25 Strategic/BAU Living Our Values Policies & Procedures Job Evaluation Corporate – All Services 20 Strategic Fair Part B – Assurance 277 Follow Up Follow Up Corporate - All Services 39 N/A N/A Procurement Purchase of ICT Systems Corporate – All Services 20 Strategic/BAU Living Our Values Procurement Procurement Processes Corporate – All Services 20 Strategic/BAU Living Our Values Regeneration & Investment Employability Partnerships Chief Executive’s 20 Strategic Place Education Support Services School Transport Children’s Services 20 Living Our Values Building Security General Security including Empty Buildings Environment, Housing & Infrastructure 20 Strategic Place Transportation & Fleet Vehicle Testing Processes Environment, Housing & Infrastructure 20 Service Living Our Values Transportation & Fleet Roads Fund Licence Renewal Environment, Housing & Infrastructure 20 Service Living Our Values Housing Assurance Statement Housing Assurance Statement Environment, Housing & Infrastructure 8 Place Customer Services Customer Services Operations Finance & Resources 20 N/A Living Our Values Scottish Welfare Fund Scottish Welfare Fund Finance & Resources 20 Strategic Fair Council Tax Council Tax Refunds Finance & Resources 15 Strategic Living Our Values Internal Compliance Main Financial Systems – Key Controls Finance & Resources 20 BAU Living Our Values Non-Domestic Rates Non-Domestic Rates Finance & Resources 15 N/A Part C – Contingency 288 Contingency Contingency Corporate - All Services 116
Page 14
Page 11 of 14 Entity Engagement Title Service Days Allocated Risk Category Council Plan Theme Contingency Corporate Groups Corporate - All Services 27 Contingency Investigations Corporate - All Services 145 Part D – Planning & Reporting 115 Planning & Reporting Planning & Reporting Corporate - All Services 115 Part E – Prioritised Reserve List 120 Regeneration & Investment Levelling Up Fund Chief Executive’s 20 Strategic Place Business Continuity Schools Digital Readiness Children’s Services 20 Service Fair Pupil Registration System SEEMIS Children’s Services 20 N/A Living Our Values Parking Charges & Penalties Parking Income Processes Environment, Housing & Infrastructure 20 Strategic Living Our Values Homeless Services Homeless Service Processes Environment, Housing & Infrastructure 20 Strategic Living Our Values Common Good Fund Common Good Fund Governance Finance & Resources 15 N/A Living Our Values
Page 15
Page 12 of 14 Appendix 2 Other Bodies Internal Audit Annual Plan 2025/26 Entity Engagement Title Service Days Allocated Part A – Governance 5 Integration Joint Board – Governance Arrangements Corporate Governance Framework Integration Joint Board 5 Part B – Assurance 83 SE – Other Systems Delivering Value Scotland Excel 20 OneRen – Other Systems Spot Checks / Regularity Checks OneRen 15 OneRen – Other Systems Debt Management Arrangements OneRen 8 IJB – Strategic Planning Review of Strategic Plan Process Integration Joint Board 20 RVJB – Valuation System Purchasing Processes RVJB 20 Part C – Contingency 7 Contingency Contingency All Associate Bodies 7 Part D – Planning & Reporting 23 Planning & Reporting Planning & Reporting All Associate Bodies 23
Page 16
Page 13 of 14 2024/25 2025/26 Service Planned Days % of Operation al Time Planned Days % of Operational Time All Services note 1 465 54% 535 62% Chief Executive’s Service 20 2% 20 2% Finance & Resources 100 12% 90 10% Children’s Services 60 7% 20 2% Adult Services 20 2% 20 2% Environment, Housing & Infrastructure 73 9% 68 8% COUNCIL TOTAL 738 86% 753 87% Scotland Excel 25 3% 25 3% Clydeplan 2 0% 0 0% Renfrewshire Valuation Joint Board 25 3% 25 3% Renfrewshire Health & Social Care Integration Joint Board (Appendix 4) 40 5% 40 4% OneRen 26 3% 26 3% TOTAL 856 100% 869 100% Notes 1 Planned time includes, Follow up Audit, Contingency, Planning and Reporting and an element of Cross cutting Assurance and Governance Audits and is allocated against services during the course of the year Appendix 3 Analysis by Service
Page 17
Page 14 of 14 Audit Category Engagement Title No. of days Detailed work Governance Local Code of Corporate Governance 5 Annual review of the adequacy and compliance with the Local Code of Corporate Governance to inform the governance statement. Assurance Strategic Planning 20 The purpose of the audit is to provide assurance over the arrangements in place for updating the Strategic Plan. This key document is also utilised to evidence actions taken or planned to mitigate several risks recorded in the IJB’s Risk Register. Planning & Reporting Annual Plan, Annual Report and Audit Committee annual assessment, reporting & Training 12 The Chief Internal Auditor is required to prepare an annual plan and annual report for the Audit Committee, summarising the work undertaken by Internal Audit during the year and using this to form an opinion on the adequacy of the control environment of the IJB. Time is also available to assist in the annual assessment against the CIPFA position statement on Audit Committees. Contingency Ad-hoc advice and Consultancy 3 Time for advice and consultancy on relevant priorities and risks or change related projects and following up on the implementation of internal audit recommendations. Appendix 4 Annual Audit Plan 2025/26 – Integration Joint Board