Summary of Internal Audit Reports for period 1 January to 25 April 2025 complete
Renfrewshire Council · 19 May 2025
Back to Audit, Risk and Scrutiny Board — 19 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 19 May 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 1 January to 25 April 2025 ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement, Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details of audit engagements completed during the period 1 January to 25 April 2025 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to OneRen and Renfrewshire Health and Social Care Integrated Joint Board; • Co-ordination of the Council’s corporate risk management activity;
Page 2
• Management of the counter fraud team; • Management of the risk management and insurance team. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 1 January to 25 April 2025. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights - None ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor– 07768354651
Page 3
Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 1 January – 25 April 2025 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Adult Services Eclipse Application Review Substantial 0 0 2 0 Chief Executives Greenspaces & Villages Investment Fund Grants Limited 1 4 0 0 Children’s Services Fostering Arrangements - Short Term & Permanency Planning Reasonable 0 1 1 0 Finance & Resources ERP Utilisation Reasonable 0 0 10 0 WTW Independent Risk Management Review Reasonable 0 3 7 1 Payroll Reasonable 0 3 1 1
Page 4
Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk. • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report Adult Services Eclipse Application Review (A0074/2025/001) Date: March 2025 EXECUTIVE SUMMARY Audit Objectives The objectives of the audit are to ascertain that:- • Appropriate guidance is in place regarding user access controls for administrators. • Administrator access is kept to a minimum. • Password controls are adequate and are in line with best practice. • User access profiles have been created and are suitable for predefined user roles. • User access is approved and reasons provided for any deviations from the standard profile access are recorded. • Evidence is available that users are aware of their responsibilities in relation to data access and protection. • There are adequate audit trails in operation which record user access. • Processes are in place to ensure that users are removed when access is no longer required. Audit Scope 1. Interviewed the relevant officers and ascertained the procedures in place relating to user access controls for the Eclipse Case Management System. 2. Prepared a series of tests to meet the detailed audit objectives. Key Audit Assurances 1. Appropriate guidance is in place from the system provider regarding user access controls for administrators. 2. Administrator access is kept to a minimum and restricted to members of the Quality and Assurance team. 3. Password controls are adequate and are in line with best practice e.g. single sign on (SSO) for council network users and separate password controls for non-network users. 4. User access profiles have been created and are suitable for predefined user roles e.g. for job roles in particular services or departments. 5. User access approval processes were satisfactory. 6. There are adequate audit trails in operation which record user access i.e. the information that users have accessed and also who has accessed specific client records. Key Risks No key risks were identified during this audit. Overall Audit Opinion The audit has identified that there is appropriate guidance for user administrators and that administrator access is restricted to Quality and Assurance team members. In addition it was found that password controls are adequate and user access permitted was suitable for job roles. There were also adequate audit trails of user access. We have made recommendations to enhance completeness of training records and strengthen controls regarding user accounts that have not been logged into recently.
Page 6
Internal Audit Report Adult Services Eclipse Application Review (A0074/2025/001) Date: March 2025 Management Commentary We welcome the internal audit findings and are pleased that no key risks have been identified with the Eclipse Case Management System. It’s reassuring to see the audit confirmed that administrator access is tightly controlled, password security is robust, and user access profiles are appropriate for each role. Working with corporate colleagues, we are already acting on the recommendations to improve oversight of training record completeness and tightening controls on accounts that haven’t been used recently. We are absolutely committed to ensuring that our governance and information security is as tight as it possibly can be and that personal and sensitive data is rigorously managed and properly controlled.
Page 7
Internal Audit Report Adult Services Eclipse Application Review (A0074/2025/001) Date: March 2025
Page 8
Internal Audit Report Chief Executives Greenspaces & Villages Investment Fund Grants (A0060/2025/001) Date: February 2025 COMMITTEE SUMMARY Audit Objectives Following the change of responsibility of the fund from Communities & Housing across to Chief Executives Service in 2023, a review of the processes now in place within Chief Executives was requested to ensure they were satisfactory. The objectives of the audit were to ensure that: 1. There are appropriate criteria for determining eligibility for grant assistance 2. Applications are appropriately completed by the claimant, include relevant supporting evidence and are signed 3. Grant applications are approved by an authorised officer 4. Conditions of grant are clear and there is evidence of acceptance 5. Payments are only made on receipt of appropriate evidence of the expenditure incurred 6. Arrangements are in place to monitor that grant conditions are complied with and any clawback arrangements are instigated when required. Audit Scope 1. Interviewed the appropriate officers and ascertained the processes in place for the administration of Community Grants for Greenspaces Funding and the Villages Investment Fund. 2. Prepared a series of tests to ensure that the processes in place for the administration of Community Grants for Greenspaces Funding and the Villages Investment Fund were operating effectively and as described. Key Audit Assurances 1. For Greenspaces Funding and the Villages Investment Fund there is appropriate criteria for determining eligibility for grant assistance in order to meet the funds objectives. 2. For the sample of grant applications tested, these were all approved by an authorised officer or at Board depending on the grant value. 3. For the sample of grant applications tested, conditions of grant were clear and there was evidence of acceptance by grant applicants, where appropriate. Key Risks 1. Where reconciliations are not carried out between the budget and spend in the ledger and the independent calculations carried out by the grant administrator, there is the possibility of unplanned overspends. 2. Eligibility for those grants cannot be demonstrated if there is no evidence that all of the required supporting documentation has been provided for some grant applicants,. 3. If, there is no evidence that grant works are being checked after the grant payment, there is a risk that grant funds may not be appropriately spent. Overall Audit Opinion
Page 9
Internal Audit Report Chief Executives Greenspaces & Villages Investment Fund Grants (A0060/2025/001) Date: February 2025 The audit identified that there are appropriate criteria for determining eligibility for grant assistance for Greenspaces Funding and the Villages Investment Fund. All applications are approved by an authorised officer or Board after acceptance of grant conditions by the applicants. Grant payments are made before expenditure is incurred. There was a lack of appropriate budget monitoring resulting in delays in identifying overspends. In regard to the supporting documentation provided by grant applicants this was not always held in a single location and on some occasions part of this documentation could not be located. We have made recommendations to improve controls in relation to budget monitoring, record keeping and retaining evidence of checks carried out by council staff after grants are paid. Management Commentary The Policy and Partnerships service is implementing all recommendations relevant to the service, including working with Finance to implement recommendations relating to budget reconciliations and financial monitoring. The guidance for the Villages Investment Fund was reviewed as part of a scheduled process in December 2024 and January 2025, and approved by Leadership Board in February 2025. Going forward, all processes in relation to these grants will align to existing processes in relation to existing funding streams such as the Sustainable Communities Fund / Local Partnerships etc. This includes checklists, record keeping, filing, and grants monitoring processes.
Page 10
Internal Audit Report Childrens Services Fostering Arrangements - Short Term & Permanency Planning (A0098/2025/001) Date: March 2025 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: • There is appropriate tracking of the completion of core training for foster carers; Children and young people have timely moves to permanent care and this is monitored robustly and continuously; • The fostering service advocates on behalf of children, young people and carers, through attendance at reviews and evaluation of plans, to progress plans within timeframes. These objectives were agreed with Children’s Services management to assess progress in implementing areas for improvement set out in the Care Inspectorate Inspection of Renfrewshire’s Fostering Service March 2023 report. Audit Scope Following discussions with the appropriate officers to ascertain the processes in place, prepared a series of tests to meet the above objectives. Key Audit Assurances 1. For the sample of foster children records tested, children and young people were continuously monitored through regularly held looked after reviews where the priority was always to move the child towards permanent care in as timely a fashion as possible. Where these reviews took longer than expected a Children’s Services officer was able to demonstrate that this was a result of other monitoring/interventions that caused the next review to be delayed. 2. For the sample of foster children tested, their reviews had adequate attendance by council staff at review meetings and an in-depth evaluation of their plan to ensure they achieved permanency and so demonstrated advocacy. Each evaluation tested included an appraisal of the current placement, a discussion of the foster child’s health, a detailed update from Social Work and any external agencies present and also a dialogue regarding the path to permanent care for the child. Key Risks Where reasons for foster carers not being up to date on their training are not recorded, it cannot be demonstrated that tracking of the completion of core training is adequate.
Page 11
Internal Audit Report Childrens Services Fostering Arrangements - Short Term & Permanency Planning (A0098/2025/001) Date: March 2025 Overall Audit Opinion The Care Inspectorate Inspection of Renfrewshire’s Fostering Service March 2023 report stated that tracking of the completion of core training needs to be further developed; tracking of permanency needs to be improved to ensure consistency of experience and outcomes for all children and young people; and the role of staff in advocating on behalf of carers and young people, through attendance at reviews, and the evaluation of plans could be improved. The audit identified that foster children’s reviews and other monitoring interventions are held regularly and include an in-depth evaluation of their care plan and so demonstrate advocacy. However, audit testing identified some carers who had not completed their required core training. Whilst there can be valid reasons for this, no reasons were recorded. Therefore, Children’s Services staff should further develop systems to demonstrate that tracking of completion of foster carers core training is adequate. We have made recommendations to address this issue. Management Commentary Management are currently devising processes to ensure Foster Carers core training needs are identified, recorded and monitored. Remedial plans will also be put in place for any training which is outstanding.
Page 12
Internal Audit Report Finance & Resources ERP Utilisation (A074 2024 001) April 2025 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that:- 1. For, those self-service modules that have been rolled out to all services, the required functionality is being utilised, with no manual work arounds or duplicate processes. 2. Where there are any manual work arounds or duplicate processes in operation, explanations were sought and considered in terms of validity. The processes were reviewed in areas within the following services :- a) Renfrewshire Health & Social Care Partnership b) Environment, Housing & Infrastructure c) Childrens’ Services 3. There is adequate visibility of the extent of utilisation of the ERP system at both a service and corporate level. 4. For those modules that have been purchased, but yet to be rolled out, ascertain the future work plans for roll out and consider the adequacy of those plans. Audit Scope 1. Interviewed appropriate officers to understand the arrangements in place for ERP utilisation and the reasons for any additional manual processes in place. 2. The current modules discussed with officers were planned leave (annual leave), unplanned leave (sick leave) and overtime/expenses. 3. Discussed with the relevant officers the progress of modules not yet rolled out - Learning Management and Purchase to Pay. Key Audit Assurances 1. The ERP team have provided Business World training for planned leave, unplanned leave, overtime and expenses to the majority of service departments. 2. At the time of the review, a project had been established to ensure all unplanned absences were being recorded on Business World by Service Managers. A Project Manager has met the relevant service supervisors/ managers as part of a project to have all service managers recording unplanned absences on Business World, with outstanding issues remaining in a small number of service departments. 3. At the time of the audit, work plans for ERP modules for Learning Management and Purchase to Pay had not yet been rolled out but were progressing.
Page 13
Internal Audit Report Finance & Resources ERP Utilisation (A074 2024 001) April 2025 4. At the time of the review, the ERP Senior Responsible Officer reports monthly to Finance & Resources senior management (including corporate People and OD management) as to progress in deploying overtime and expenses, planned leave and unplanned leave, in Business World. Key Audit Risks 1. Where service departments are not fully utilising Business World, especially for unplanned leave (sickness absence), they are using manual workarounds and duplicate processes which are mainly reliant on spreadsheets that are not suitable for the volume of data required and may result in inaccurate absence data. 2. Where service departments are using Supporting Attendance teams and proxy users, they are not fully using the self-service functions of Business World and may not be maximising savings in terms of time and cost. Overall Audit Opinion There has been a gradual increase in service departments using Business World to record overtime and expenses, planned leave and unplanned leave including Return to Work interviews and Formal meetings on Business World. The Project Manager, for the project to improve self-service for unplanned leave, has met with relevant service supervisors/ managers during 2024 and reported improvements. Although the ERP System is a Corporate Resource, and in our opinion, a system which all services are responsible for embedding into their operations, our review indicated that this view was not always concurred with within parts of services. We have therefore recommended that People and OD Management, as owners of the Managing Absence Policy, should continue to liaise with the Project Team, ERP team as well as services management to decide if the current processes in place as an alternative to self-serving in Business World (proxy users) for unplanned leave are the best work around options to enable the tasks to be undertaken. It is recognised that the additional work as a result of the Business World projects will require resources from People and OD and therefore will have to prioritised and built into their staff workplans. Management Commentary Discussions are being arranged by People and OD service with appropriate officers including ERP management and relevant service Managers to plan how to progress the internal audit recommendations. We plan to have the recommendations actioned by 30 September 2025.
Page 14
Internal Audit Report Finance & Resources WTW Independent Risk Management Review (B0015/2025/001) Date: February 2025 COMMITTEE SUMMARY Audit Objectives As Corporate Risk Management is part of the Internal Audit Service, in order to gain assurance over the Council’s arrangements in place, it was agreed that a review would be undertaken by an external contractor to ensure that:- 1. An appropriate corporate risk management framework is in operation and is satisfactory 2. There is evidence to support that the corporate risk management arrangements are being complied with in practice across service areas 3. The BAU (business as usual) Risk Assurance Model is operating as intended. This engagement was undertaken by Willis Towers Watson (WTW), Risk Management Specialists. Audit Scope 1. To meet the objectives requested by Renfrewshire Council, WTW primarily utilised their Enterprise Risk Management (ERM) maturity model. This model considers eight ERM attributes and scores these according to five levels of maturity. WTW determined which maturity level is appropriate for each category based on the information provided and analysed during this review. 2. Prior to commencing fieldwork, WTW conducted a gap analysis between Renfrewshire Council’s requested scope and their ERM maturity model. 3. Where the model did not sufficiently cover elements of requested scope, additional analysis was conducted. Key Audit Assurances 1. Renfrewshire Council has established strong governance of risks across leadership and management. As well as a committee with overall accountability (Audit, Risk and Scrutiny), operational governance appears to be working effectively. This is partially due to an engaged community of risk representatives and subject-matter experts who take part in efficient, targeted and timely meetings on risk matters. This community has clearly defined roles and responsibilities and recognise the value and importance of their risk related activities. 2. The positive governance and cultural environment is driven by the Risk Manager, who has established innovative processes (in particular the BAU Risk Assurance Model or “BaURAM”), designed engaging training materials and is evidently committed to the continuous improvement of risk management at Renfrewshire Council. 3. Renfrewshire Council’s approach to risk analysis and evaluation is established and shows strength in certain areas. A particular strength in this area is the risk deep dive process utilised to analyse a particular risk in depth. 4. The risk information captured, analysed and evaluated is being used to drive the selection of risk responses in a relatively structured way 5. Although Renfrewshire Council does not have a software-based risk reporting system, the overall quality of reporting and monitoring is well established with regular reports being submitted to Senior Managers and Members. 6. The training documentation available for managing risks within projects is adequate.
Page 15
Internal Audit Report Finance & Resources WTW Independent Risk Management Review (B0015/2025/001) Date: February 2025 7. The BaURAM is an innovative and powerful approach which operates effectively and is subject to appropriate scrutiny and has the dual benefit of providing: 1. the organisation with a clear record, signed by the responsible individual, of how they get assurance over their risks or how they plan to develop that assurance. 2. protection to the responsible individual, who can evidence they have considered their risk(s) and implemented appropriate assurance. Risk Maturity Diagram WTW’s opinion is that a score of 4.0 overall would, in general, be the maximum realistic level we would expect to see for an organisation in Renfrewshire Council’s sector except in exceptional circumstances. Key Leading – Governance and Culture Established -Risk Reporting, Risk Response, Risk Analysis and Strategy Developing - Ongoing Control Environment and Risk Identification
Page 16
Internal Audit Report Finance & Resources WTW Independent Risk Management Review (B0015/2025/001) Date: February 2025 Key Risks / Development Opportunities 1. Risk Management Resource - If Renfrewshire Council wants to pursue enhanced Enterprise Risk Management maturity and further develop Risk Management operations the current level of resource allocated to risk management, in terms of staffing and electronic system is likely to place limitations on this work – the Risk Manager already has a wide range of responsibilities and Service Risk Representatives unanimously reported not having the time they would like to focus on risk duties. 2. Building the link between council/business strategy (the council plan) and risk. - A link between strategy and risk is established, especially at the “Strategic” and “Corporate” risk levels. The cultural attitude to risk management places appropriate focus on the need to take sufficient, appropriate, well-controlled risks – those which are “within appetite” – to achieve strategic objectives. This link could be stronger, however, and an option for Renfrewshire Council to continue to enhance ERM maturity is to develop the application and definition of risk appetite. In addition, more clearly aligning the analysis of risk impacts to strategy could further enhance this link. 3. Ensuring the capture and on-going control of risks - Whilst there is a toolkit of resources for individuals to use when identifying and analysing risks, the identification and capture of these risks into the risk management process is relatively informal. The process places a great deal of reliance on the Service Risk Representatives. Whilst highly engaged, those that we spoke to as part of this review unanimously reported wishing they had additional time to focus on their risk responsibilities alongside their primary roles. Should these individuals have insufficient capacity, or simply forget to pass on a risk that has been raised to them by a member of the service they represent, there is the potential for such risks to fail to enter the risk management process entirely. 4. On-going control of risks - Whilst some control information is captured (for example, the controls articulated against strategic and corporate risks in the Board report) there is limited observable information regarding the quality, effectiveness, frequency, importance etc. of the control(s). Whilst the delivery of Internal Audit reviews considering controls (amongst other elements) provides an additional layer of assurance for leadership in this respect, there is an opportunity to enhance the maturity of the risk management process itself by increasing consideration, capture and scrutiny of control measures. Overall Audit Opinion Renfrewshire Council has a well-established approach to risk management with many positive features, especially in terms of strong governance and a positive cultural attitude towards risk management at a corporate level. The overall risk maturity score was identified as 3.2, as shown in the Risk Maturity Diagram above. It should be noted that WTW’s opinion is that a score of 4.0 overall would, in general, be the maximum realistic level we would expect to see for an organisation in Renfrewshire Council’s sector except in exceptional circumstances. The BAURAM (Business-as-usual risk assurance model © Renfrewshire Council) is an innovative and powerful approach which was been designed well and, like many other elements of
Page 17
Internal Audit Report Finance & Resources WTW Independent Risk Management Review (B0015/2025/001) Date: February 2025 Renfrewshire Council’s risk approach, is evidently subject to continuous improvement. To continue to grow risk management maturity, some opportunities were identified for further development and Renfrewshire Council may wish to focus on ensuring sufficient resources – both in terms of personnel and systems - are available to ensure risks are identified promptly, recorded consistently and therefore managed appropriately. Management Commentary The Finance, Resources and Customer Services Policy Board approved a report in April 2025 to increase the Risk Management resource and this will be implemented as soon as possible. All other areas for further development have been included in the Strategic Risk Management Development Plan and will be implemented.
Page 18
Internal Audit Report Finance & Resources Payroll (A0084/2025/001) Date: April 2025 EXECUTIVE SUMMARY Audit Objectives The objectives of the review are to ensure that: 1. Documented procedures are in place for processing payroll. 2. Required checks are undertaken and evidenced, prior to the payroll being completed. 3. BACS payments are only released on proper authorisation. 4. Appropriate exception reports are obtained and reviewed to check for anomalies and action taken to investigate and correct if necessary. 5. Control accounts are reconciled and payments are processed to third parties timeously. 6. BACS rejects are investigated and subsequently corrected. Audit Scope 1. Interviewed the relevant officers and obtained the required information and documentation relating to payroll processing. 2. Prepared and carried out a series of tests on appropriate sample groups to meet the detailed audit objectives. Key Audit Assurances 1. Payroll Processing procedures set out step by step instructions for Payroll team members to follow when processing payroll. 2. For the sample of pay runs tested, there was evidence of checks undertaken e.g. tax refunds, pension overrides for each pay run as the checklist had been completed. 3. Payments to third parties tested were processed correctly and timeously. Key Risks 1. Where Payroll checklists and BACS transmission forms are completed by only one person for some pay runs, there is no evidence that a second person has checked that all tasks on the checklists have been satisfactorily completed or that the total BACS payments are correct. 2. Where control accounts are not reconciled timeously there is a risk that items are not coded correctly in the ledger and/or within the correct financial year. Overall Audit Opinion Payroll Run Processing procedures set out each stage of payroll process to be carried out by Payroll team members. However, we identified a lack of evidence of some payroll checks and incomplete control account reconciliations which require management action.
Page 19
Internal Audit Report Finance & Resources Payroll (A0084/2025/001) Date: April 2025 Management Commentary We are in the process of actioning the internal audit recommendations. Email reminders will be sent to the appropriate staff to ensure adequate segregation of duties is maintained when undertaking payroll checks and that sufficient evidence is retained of task/checks undertaken and by whom. With regards to Control Accounts we will endeavour to process these timeously.
Page 20
Internal Audit Report Finance & Resources Payroll (A0084/2025/001) Date: April 2025