Internal Audit Annual Report 2024 - 2025 combined
Renfrewshire Council · 19 May 2025
Back to Audit, Risk and Scrutiny Board — 19 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 19 May 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Annual Report 2024 - 2025 ___________________________________________________________________ 1. Summary 1.1 The Public Sector Internal Audit Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of the Council’s internal control environment and include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters that can be used to inform the governance statement. 1.3 The Annual Report for 2024-25 is attached and outlines the role of Internal Audit, the performance of Internal Audit, the strategic and operational issues which influenced the nature of the work carried out, the key audit findings, and contains the annual audit assurance statement. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report. ___________________________________________________________________
Page 2
Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights - None ________________________________________________________________ Author Karen Campbell, Interim Chief Auditor
Page 3
Annual Report 2024-2025 Renfrewshire Council Internal Audit May 2025
Page 4
Renfrewshire Council Internal Audit Annual Report 2024/2025 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2024/25 2 4. Summary of Internal Audit Work 4 5. Internal Audit Resources 5 6. Review of Internal Audit Activity • Table 1 – Analysis by category of audit 6 7. Quality Assurance and Improvement Activity • Table 2 – Internal Audit Performance 7 8. Implementation of Audit Recommendations • Table 3 – Implementation of Audit Recommendations 8 9. Performance of Non-Audit Activities • Table 4 – Corporate Counter Fraud Performance 8 10. Audit Assurance Statement 10 Appendix 1 – Summary of Assurances
Page 5
1 Renfrewshire Council Internal Audit Annual Report 1 April 2024 – 31 March 2025 1. Introduction 1.1 Internal Audit is an independent and objective assurance and consulting activity designed to add value and improve the operations of Renfrewshire Council. It assists Renfrewshire Council in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organisation's risk management, control, and governance processes. 1.2 The Chief Auditor reports functionally to the Audit, Risk and Scrutiny Board and administratively (i.e. day to day operations) to the Director of Finance and Resources. In accordance with the principles of good corporate governance, regular reports on internal audit work and performance are presented to the Audit, Risk and Scrutiny Board. 1.3 The purpose, authority and responsibility of the internal audit activity is defined in the internal audit charter, approved by the Audit, Risk and Scrutiny Board; and provides that the Chief Auditor has independent responsibility for the conduct, format and reporting of all internal audit activity and findings. 1.4 The service operated in accordance with the Public Sector Internal Audit Standards (PSIAS) for 2024/25. The Standards define the basic principles for carrying out internal audit. They establish the framework for providing internal audit services, which add value to the organisation, leading to improved organisational processes and operations. 1.5 The Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. The annual report must also provide an annual audit opinion, on the overall adequacy and effectiveness of the Council’s internal control environment. It must include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters that can be used to inform the governance statement. 1.6 The aim of this report is to provide an opinion on the overall adequacy and effectiveness of the council’s framework of governance, risk management and control and provide a summary of the work undertaken during the year to support that opinion. The report also provides details of the performance of the internal audit service during the past year, and the results of the quality assurance and improvement programme. 1.7 In addition to the work carried out in relation to council services, we also provide an internal audit service to the following organisations: • OneRen
Page 6
2 • Renfrewshire Valuation Joint Board • Scotland Excel • Renfrewshire Health and Social Care Partnership – Integration Joint Board 1.8 The outcome of the audit assignments undertaken for these organisations is reported separately as part of their annual report which also contains an assurance statement to their Boards. 1.9 Summaries of internal audit assignments within partner organisations are also submitted to members of the Audit, Risk and Scrutiny Board for their information. 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of the Council’s managers to ensure that the management of the areas under their control is adequate and effective and that their services have a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3. Internal Audit Activity during 2024/2025 3.1 The internal audit plan for 2024/2025 was approved by the Audit, Risk and Scrutiny Board on 18 March 2024. The plan was risk-based and took into account the outcomes of the service and corporate risk evaluation processes, any significant changes in council operations over the period, and the impact of developments in national policy and regulation. The plan also took into account key external audit reports including their Annual Audit Report for the council. 3.2 The audit plan is kept under continuous review throughout the year, to ensure we are flexible in reacting to changes in the internal and external environment or to any changing risk profile for the council. The reduction in resource due to the retiral of the Chief Auditor on 30 June 2024 was partly taken into account when the audit plan was being finalised. We also experienced a further reduction in resource due to unplanned absence. Although, amendments were made to the 2024/25 plan there has been a slight delay in the completion of some audit assignments due to this resource issue and also the level of investigative/contingency work which has been undertaken. 3.3 All planned assignments as detailed in the 2024/2025 audit plan have been undertaken or commenced and those assignments not finalised by 31 March 2025 have been prioritised in the first quarter of the current year.
Page 7
3 3.4 Set out below are the significant risks which influenced the content of the plan and the nature of the work undertaken in recognition of these. (1) Financial Challenges Our organisation faces an ongoing financial challenge to make significant savings after many years of already delivering substantial efficiencies and reduction in our spending. Alongside this, our communities continue to experience cost-of-living pressures and the demand for our services continues to grow. Therefore, the financial outlook continues to be subject to significant and regular scrutiny. The 2024/25 audit plan included time for reviewing: • financial planning (nearing completion); • non-domestic rates ; and • payroll. (2) Learning from Dargavel The Council has been subject to criticism regarding errors made during planning and delivery of Dargavel Primary School. As a result, there has been significant scrutiny of our arrangements arising from the independent review (Bowles Report), from our external auditors and from the Accounts Commission under s102 (1) of the Local Government (Scotland) Act 1973. The Council has developed an action plan to address the recommendations made which was subject to regular reporting to the Audit, Risk and Scrutiny Board. The 2024/25 audit plan included time for reviewing: • governance of the learning estate development programme (ongoing); • project and programme management (ongoing); and • risk management As the Risk Manager reports to the Chief Auditor, to ensure the Chief Auditor’s independence was not impaired, the review of the Council’s Risk Management processes was undertaken by an External Consultancy firm. (3) Tackling Inequalities The Council plays a key role in tackling inequalities and providing the best possible services to our communities, particularly those who are experiencing the poorest outcomes. The current cost of living crisis impacts disproportionately on particular groups in society. The Council is committed to supporting people on low incomes to maximise income and seek advice with income and debt management. The 2024/25 audit plan included time for reviewing: • council tax reduction; and • community grants
Page 8
4 (4) Public Protection Public protection is a wide-ranging agenda relating to the protection of vulnerable people, communities, businesses and organisations. The 2024/25 audit plan included time for reviewing: • child protection (nearing completion); • housing adaptations (Ongoing); • fostering and adoption; and • Eclipse system. 3.5 There are a number of significant risks, arising from the external and internal environment, which could impact on the council’s ability to achieve its objectives. The most significant risks and the risk control measures to manage these risks, are identified through the council’s corporate risk management process. Subject to the overall flexibility of the Audit Plan, priority will be given to audit engagements which impact on the council’s strategic and corporate risks. 3.6 In line with the council’s procedures, instances of suspected theft, fraud or other irregularity are reported to internal audit. Depending on the nature of the allegations, they are investigated either by the internal audit service or by the Corporate Counter Fraud service. All referrals were evaluated and investigated as appropriate. 3.7 During 2024/25, Internal Audit conducted a number of investigations mainly in relation to employee conduct and service management has undertaken disciplinary procedures and strengthened internal controls where necessary. 3.8 The outcomes of all internal investigation reviews undertaken by internal audit are reported to the Audit, Risk and Scrutiny Board after any disciplinary action has been completed. 4. Summary of Internal Audit Work 4.1 The internal audit team has been working on a hybrid basis. The team also provided advice and support where necessary to council services. 4.2 Appendix 1 details the assurances arising from the internal audit work carried out in line with the 2024/25 audit plan and from those 2023/24 assignments which were finalised during this year which supports the annual assurance statement. These include the conclusions in relation to the overall system of internal control, risk management and governance arrangements. 5. Internal Audit Resources 5.1 For the year to 31 March 2025, the audit plan was based on 856 operational days. However, the actual staffing complement was slightly reduced due to the retiral of the Chief Auditor and higher than anticipated unplanned absence in both Internal Audit and Counter Fraud.
Page 9
5 5.2 The internal audit team will ensure that independence and objectivity are maintained in line with the PSIAS including where non-audit work is undertaken. Internal auditors will have no operational responsibilities. There have been no impairments impacting on the Interim Chief Auditor’s independence and the team has been sufficiently resourced during the year to undertake operational work. 5.3 Since the retiral of the Chief Auditor, the Asst Chief Auditor has been covering this post on an interim basis. Given that it was recognised that there may be resilience issues regarding internal audit and counter fraud staff in the future, discussions were undertaken with the Chief Financial Officers of two neighbouring councils which resulted in a considerable piece of work being undertaken during the year to explore a potential shared delivery model. It should be noted that the delivery of financial savings was not an objective of this exercise, and Renfrewshire Council’s Chief Financial Officer was committed to maintaining the current level of resource. 5.4 This work has been completed and it was concluded that it would not represent value for money to progress with the shared service proposal at this point due to the complexities of servicing a number of public bodies (Councils, Partners and Associated Bodies) under a single operational management structure with different systems, processes and working practices in place. This decision was agreed by members of the Finance, Resources and Customer Services Policy Board on 3 April 2025. The exercise has however been useful in reaching a shared understanding of the challenges each audit team faces; and there is the potential for a more informal resource sharing arrangement being put in place. 5.5 Further service changes were also approved in the Finance, Resources and Customer Services Policy Board with regard to Risk Management. The responsibility for the management of the corporate risk function is transferring to come under the wider business services management arrangements with the Chief Auditor role being focussed on delivery of internal audit and fraud services for the Council and associated bodies. The two functions would however continue to work closely together through their governance and reporting arrangements to the Audit, Risk and Scrutiny Board. 5.6 The revised operating and management arrangements outlined above in the coming months, including formal job evaluation of new or revised roles will take place in the coming months. This will allow the Council to then progress to recruit a Chief Auditor on a permanent basis. 6. Review of Internal Audit Activity 6.1 The Audit Plan for 2024/25 set out our risk-based plans across a range of audit categories, the results of which have been reported quarterly to Audit, Risk and Scrutiny Board. Table 1 below compares the actual days spent on each category of audit work against that planned for the year.
Page 10
6 Table 1 Type of Audit Planned Days Actual Days Variance Days % Governance 51 45 (6) 12% Assurance 374 320 (54) 14% Contingency 293 295 2 1% Audit Planning & Reporting 138 140 2 1% Total Operational Days 856 800 (56) 7% Training 56 41 (15) 26% Strategic Management 16 16 (0) 0% Team Administration 89 88 (1) 1% Development 69 43 (26) 37% Total Non-operational Days 230 188 (42) 18% Gross Available Days 1086 988 Operational % 79% 81% Non-Audit – Including Management of Risk Management and Insurance and Corporate Counter Fraud including the co-ordination of NFI 71 74 3 4% 6.2 Material differences (over 20% and over 20 days) from the plan are explained below: 1) Assurance Due to unplanned absence and the amount of time spent on investigative work, completion of some of the assurance work has been delayed and consequently a number of the budgeted days have been deferred into 2025/26. 2) Training As a result of the unplanned absences, some of the Counter Fraud work, including coordination of the National Fraud Initiative data collection exercise had to be transferred to a member of Internal Audit Staff. In addition to this, the Internal Audit staff’s main priority was to focus on operational work and therefore the training budget was under utilised for this year. 3) Development Development time was planned to look at alternative system options and also to encompass the new Global Internal Audit Standards into our working
Page 11
7 practices. In 2023/24, our Audit Management System supplier informed us they were unlikely to continue to support this system but this decision has since been withdrawn. In addition CIPFA, (Public Sector Accounting Body) have stated that it is acceptable to amend working practices to ensure compliance with the Global Internal Standards during 2025/26. Therefore, as a result of the reasons detailed above this work has been delayed but is a priority for 2025/26. 7. Quality Assurance and Improvement Activity 7.1 Internal audit measures performance against a range of measures set annually by the Director of Finance and Resources. The Audit, Risk and Scrutiny Board received quarterly reports on progress and performance during the year. Table 2 shows the actual performance against targeted performance for the year. Table 2 Internal Audit Performance 2024/25 Performance measure Target 2024/25 Actual 2024/25 % completion of audit plan for the year* 90% 93.6% % engagements completed by target date 95% 96.7% % engagements completed within time budget 95% 98.4% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 7.2 The percentage completion of the audit plan is ahead of the target set for the year. In addition, the actual performance for the year for the two other indicators, is above the target performance level. 7.3 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 7.4 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process. Our most recent external assessment was reported to the Audit, Risk and Scrutiny Board in May 2023 and included 7 recommendations for improvement, all recommendations have now been completed. The annual internal self-assessment process has concluded that the internal audit service fully complies with the PSIAS during 2024/25. 7.5 We have commenced a self assessment exercise against the new Global Internal Audit Standards. Any actions identified will be implemented to ensure compliance.
Page 12
8 8. Implementation of Audit Recommendations 8.1 During 2024/25, 106 recommendations were followed up, with 76% of all recommendations being completed. The implementation status of the recommendations across each service area is detailed in Table 3 below. Table 3 Implementation of Audit Recommendations 2024/25 Service No. Followed up Complete Partially Complete (new date) Not Implemented (new date) Redundant Adult Services 1 1 (100%) 0 0 0 Chief Executive’s 14 12 (86%) 1 (7%) 1 (7%) 0 Children’s Services 8 3 (38%) 0 2 (25%) 3 (38%) Environment, Housing & Infrastructure 21 14(67%) 4 (19%) 3 (14%) 0 Finance & Resources 62 51 (82%) 8 (13%) 2 (3%) 1 (2%) Total 106 81 (76%) 13 (12%) 8 (8%) 4 (4%) 9. Performance of Non-Audit Activities 9.1 Risk Management The responsibility for co-ordinating risk management and insurance activity across the council was with internal audit during 2024/25. Risk management performance is detailed in the risk management annual report. 9.2 Corporate Counter Fraud The Corporate Counter Fraud Team reports to the Chief Auditor; during the period 2024/2025, the team has worked on a hybrid basis. The Corporate Counter Fraud Team works to raise awareness of fraud, and to encourage and promote an anti-fraud culture. Where a suspicion of fraud arises, the team investigate and report their findings to management. Where appropriate, follow-on action is taken, such as reporting the matter to Police Scotland for further investigation, or directly to the Procurator Fiscal. The team works to protect Council resources, investigating frauds against the Council, such as: council tax reduction, tenancy, housing application, Scottish Welfare Fund, school placements, blue badge; and any other potentially fraudulent matter arising. Where appropriate, customers are contacted by telephone or e-mail. This process is convenient for customers and staff alike and enables investigations
Page 13
9 to be conducted quickly and efficiently. Where necessary, and for more serious cases, visits and interviews under caution are conducted. The team continue to work with the DWP, undertaking joint investigations, which can result in the identification of overpayments of Single Person Discount, Council Tax Reduction, Council Tax Benefit, Housing Benefit, Universal Credit, Child and Working Tax Credits, and other DWP benefits. A Counter Fraud training course has been developed and is available to staff on iLearn and is promoted across the Council. Table 4 Corporate Counter Fraud Performance 2024/25 Financial Outcomes 2024/25 (£) Cash savings directly attributable to preventative counter fraud intervention (e.g business grants) 2,719 Cash recoveries in progress directly attributable to counter fraud investigations 83,037 Notional savings identified through counter fraud investigation, (e.g. housing tenancy and future council tax) 474,955 Housing Benefit Savings identified through other counter fraud work or through joint working with the DWP 68,002 Other DWP Benefit or Tax Credit Savings Savings identified through other counter fraud work or through joint working with the DWP 63,385 Non-Financial Outcomes 2024/25 Housing properties recovered 5 Housing applications amended/cancelled 8 Housing Allocation Priority Changed 1 Blue badge misuse warning letters issued 32 Blue Badges Cancelled 5 Supplier/Contractor Checks Undertaken 226 9.3 The National Fraud Initiative
Page 14
10 The National Fraud Initiative (NFI) in Scotland is a counter-fraud exercise led by Audit Scotland and overseen by the Cabinet Office for the UK. It uses data matching techniques to compare information about individuals held by different public bodies, and on different financial systems that might suggest the existence of fraud or error. Internal audit is responsible for the co-ordination of the exercise which is undertaken every second year. The Council’s data, as required by the NFI, was submitted in October 2024, the resulting matches were received from December 2024 and investigation of those matches is ongoing. The final outcomes arising from the exercise will be subject to a separate report to the Audit, Risk and Scrutiny Board during 2025/26. 9.4 Whistleblowing Policy Under the Council’s Whistleblowing Policy, the Chief Auditor should be informed of all whistleblowing referrals so they can be recorded. During this year 7 referrals were received and 6 were referred directly to the responsible service to review as they were management issues. The remaining referral was investigated by Internal Audit and the findings will be reported to the Audit, Risk and Scrutiny Board Members on completion of any disciplinary process which may be instigated. 10. Audit Assurance Statement 10.1 Internal audit has performed its work in accordance with the role defined in paragraph 1.4. The audit work performed has been reported to senior managers and where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 10.2 In view of the continued challenges common to all local authorities, the Council recognises the need to exercise very close scrutiny over financial management and compliance with overarching governance arrangements and will continue to take appropriate action to further strengthen control in these areas. 10.3 Internal audit contributes to the promotion of sound corporate governance in the Council. The scrutiny function within the council performed by the Audit, Risk and Scrutiny Board further demonstrates strong commitment in this area. 10.4 It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal audit recognises this and assesses this in its reporting mechanism. It is not realistic for the system of internal control in the Council to be without any weakness. 10.5 The Council’s governance arrangements have been substantially reviewed during the year, including fully implementing the comprehensive assessment of the Audit, Risk and Scrutiny Board arrangements against the CIPFA practical guidance for Audit Committees which has made a positive impact on scrutiny arrangements. In addition the recommendation arising from the Council’s
Page 15
11 comprehensive review of its governance arrangements by the member led cross party working group, which were reported to and approved by the Council on 29 February 2024 have been actioned. 10.6 Following the successful roll out of the bespoke Leadership Development Programme to the Chief Officers group, this was extended to the 3rd tier level and this has now been completed. This includes a governance module. 10.7 The 12 modules of the business as usual risk management assurance framework were completed by Heads of Service’s/Relevant Senior Managers during the year to self-assess their own levels of assurance against those risk areas. The 2024/25 outturn compares favourably with 2023/24, with all modules showing an improved position 10.8 The programme of work undertaken by internal audit in 2024/2025 identified 3 occasions where a limited assurance level was provided in relation to the internal control, risk management and governance objectives for the specific areas of each audit review which is an improved position from last year. 76% of all internal audit recommendations followed up during the year have been implemented by the due date. 10.9 Therefore, subject to management addressing the critical and important recommendations made and the limited assurance report findings, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s internal control, risk management and governance arrangements as evidenced by: (i) the results of the planned audit work in 2024/25; (ii) the results of investigative work in 2024/25; (iii) management self-assessment business as usual risks; (iv) management action to respond to audit recommendations to mitigate the risks areas highlighted in this report; (v) the regular review of the Local Code of Corporate Governance. Signed Interim Chief Auditor Date 19 May 2025
Page 16
Appendix 1 1 Audit Engagement Risk Area Assurance Level Conclusion Non-domestic Rates Assurance Reasonable • The audit identified that satisfactory controls are in place for the billing and collection of NDR. Reviews of NDR reliefs, granted on the basis of a prior year's applications, have not been carried during 2023/24 because management needed to consider the impact of changes in legislation, specifically related to reliefs, which superseded the normal review process. Evidence for current year reliefs and refunds were available for the samples tested. However, some actions that management stated would be put in place after previous audit recommendations are not fully implemented. It was noted that staff changes have resulted in income and refund reconciliations not being carried out regularly. Also, a significant number of historic credit balances were found to still exist on the NDR system, for which no actions had been taken to identify if these should be cleared or result in refunds to customers. Corporate Governance Framework Governance Substantial • Based a sample check of the evidence used to demonstrate compliance, it was confirmed that the Council complies with the requirements of the Local Code of Corporate Governance. In addition, it was evident that the Local Code has been subject to review and updating in line with developments in best practice and any revised Council Policies. Corporate Risk Management Assurance Reasonable • Renfrewshire Council has a well-established approach to risk management with many positive features, especially in terms of strong governance and a positive cultural attitude towards risk management at a corporate level. The overall risk maturity score was identified as 3.2 against a score of 4 which in the external consultant’s opinion would, in general, be the maximum realistic level we would expect to see for an
Page 17
Appendix 1 2 organisation in the Council’s sector except in exceptional circumstances. The BAURAM (Business- as-usual risk assurance model © Renfrewshire Council) is an innovative and powerful approach which was been designed well and, like many other elements of Renfrewshire Council’s risk approach, is evidently subject to continuous improvement. To continue to grow risk management maturity, some opportunities were identified for further development and Renfrewshire Council may wish to focus on ensuring sufficient resources – both in terms of personnel and systems - are available to ensure risks are identified promptly, recorded consistently and therefore managed appropriately. Housing Assurance Statement Assurance Substantial Assurance • Based on a sample check of the evidence used to demonstrate compliance, we confirmed that the Council complies with the requirements of the Housing Assurance Statement. Payroll Assurance Reasonable • Payroll Run Processing procedures set out each stage of payroll process to be carried out by Payroll team members. However, we identified a lack of evidence of some payroll checks and incomplete control account reconciliations which required management action. Fostering Arrangements - Short term and Permanency planning Assurance Reasonable • The aim of this review was to assess progress in implementing areas for improvement set out in the Care Inspectorate Inspection of Renfrewshire’s Fostering Service March 2023 report. The audit identified that foster children’s reviews and other monitoring interventions are held regularly and include an in-depth evaluation of their care plan and so demonstrate advocacy. However, audit testing identified some carers who had not completed their required core training. Whilst there can be valid reasons for this, no reasons were recorded. Therefore, Children’s Services staff should further develop systems to demonstrate that
Page 18
Appendix 1 3 tracking of completion of foster carers core training is adequate. Adult Services - Eclipse Application Review Assurance Substantial • The audit has identified that there is appropriate guidance for user administrators, administrator access is restricted to Quality and Assurance team members, password controls are adequate, user access is suitable for job roles and there are adequate audit trails of user access. We made recommendations to enhance completeness of training records and strengthen controls regarding user accounts that have not been logged into recently. Council Tax Reductions Assurance Substantial • The audit has identified that satisfactory arrangements are in place for administering the Council Tax Reduction (CTR) scheme. For the sample of Council Tax Reduction applications tested, reductions were only applied to eligible individuals and there was evidence of appropriate checks on each application by a Benefits Assessor. However, management action is required as cyclical reviews of Council Tax Reduction only cases are not undertaken to ensure the amount of CTR remains valid. Greenspaces & Villages Investment Fund Grants Assurance Limited • The audit identified that there are appropriate criteria for determining eligibility for grant assistance for Greenspaces Funding and the Villages Investment Fund. All applications are approved by an authorised officer or Board after acceptance of grant conditions by the applicants. Grant payments are made before expenditure is incurred. There was a lack of appropriate budget monitoring resulting in delays in identifying overspends. In regard to the supporting documentation provided by grant applicants the supporting documentation was not always held in a single location and on some occasions part of this documentation could not be located.
Page 19
Appendix 1 4 Management of Allergens in Schools Assurance Limited • Although there are procedures and guidelines available regarding food allergies and food safety, improvements could be made regarding implementation of these. Furthermore, the uptake of training relating to food allergies and food safety is unsatisfactory among employees who undertake catering roles. ERP Utilisation Assurance Reasonable • There has been a gradual increase in service departments using Business World to record overtime and expenses, planned leave and unplanned leave including Return to Work interviews and Formal meetings on Business World. The Project Manager, for the project to improve self-service for unplanned leave, has met with relevant service supervisors/ managers during 2024 and reported improvements. Although the ERP System is a Corporate Resource, and in our opinion, a system which all services are responsible for embedding into their operations, our review indicated that this view was not always concurred with within parts of services. We have therefore recommended that People and OD Management, as owners of the Managing Absence Policy, should continue to liaise with the Project Team, ERP team as well as services management to decide if the current processes in place as an alternative to self-serving in Business World (proxy users) for unplanned leave are the best work around options to enable the tasks to be undertaken. It is recognised that the additional work as a result of the Business World projects will require resources from People and OD and therefore will have to prioritised and built into their staff workplans. Waste Management Assurance Limited Assurance • Although roles and responsibilities relating to the provision of the commercial waste service are clearly defined and processes are in place in relation to providing this service, issues were identified in relation to the invoicing of customers for the uplift of commercial
Page 20
Appendix 1 5 waste. Furthermore, concerns were identified in relation to the level of outstanding debts for the uplift of commercial waste. Although work has commenced by the Waste Service to determine the information available on clients not paying their invoices, there was no formal policy in place for staff to follow regarding the continued provision of the service for clients with outstanding debts and this needs to be addressed as soon as possible. Treasury Management Assurance Reasonable • Discussions are ongoing between Treasury supervisors and Purchase to Pay supervisors as to payment categories that would be more suitable for the Purchase to Pay team to administer instead of the Treasury team and it was recognised that these should be transferred across as soon as possible. In addition, a lack of segregation of duties was identified in that all users with Corporate Administrator and single authorisation access can currently request a payment and also authorise that payment themselves which required to be addressed. Other recommendations in relation to the authorisation of payments were made. Programme Management - Project Health Checks Assurance Substantial Assurance • The health check assessments carried out on the City Deal & Infrastructure and the Housing Led Regeneration & Renewal Programmes were found to be robust with actions arising from the presentations to the Corporate Management Team being addressed. Unpaid work Assurance Reasonable • The sample testing undertaken indicates that unpaid work orders are adequately monitored. The courts are notified on completion of unpaid work orders or in cases on non – compliance. There are still some ongoing issues with recording unpaid work orders and other community service order information on the Eclipse system and work was ongoing with the developer to fix these. This has resulted in manual processes and
Page 21
Appendix 1 6 spreadsheets being prepared to meet operational needs. Recruitment Assurance Reasonable • Audit testing in the areas of the recruitment process after a preferred candidate has been chosen noted that generally target timescales were met for each part of the process and that where targets had not been met, these were followed up through management checking processes. It was also noted that although there are good monitoring and oversight arrangements in place, these could be improved by establishing Key Performance Indicators that could be reported at a higher level than the current processes dictate. Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse.