Item 2 Combined
Renfrewshire Council · 18 August 2025
Back to Audit, Risk and Scrutiny Board — 18 August 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 August 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Activity in Partner Organisations - 26 April 2025 to 30 June 2025 ___________________________________________________________________ 1. Summary 1.1 This report provides members with a summary of the internal audit activity within each partner body from 26 April 2025 to 30 June 2025. 1.2 Renfrewshire Valuation Joint Board –The summary of the internal audit engagement Non-Domestic Rates Valuation System and 2024/25 Internal Audit annual report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered by the Board on 23 May 2025 and is attached in Appendices 1 and 2. 1.3 Scotland Excel Joint Committee - The 2024/25 Internal Audit annual report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered, by the Executive Sub-Committee on 20 June 2025 and is attached in Appendix 3. One audit is currently being finalised on the Contract Delivery Plan process will be reported to their Executive Sub-Committee upon completion. 1.4 Renfrewshire Integration Joint Board - The 2023/24 Internal Audit annual report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered, by their Audit, Risk and Scrutiny Committee on 20 June 2025 and is attached in Appendix 4. 1.5 Glasgow City Region City Deal – Internal audit services are provided by Glasgow City Council Internal Audit Services, finalised reports for each completed audit engagement are reported to the Glasgow City Region Cabinet and the reports are shared with member Council’s. The Interim
Page 2
Chief Auditor for Renfrewshire Council meets regularly with the City Region Auditors and provides them with an annual assurance statement to support the Glasgow City Region annual governance statement. During the reporting period, the internal audit review of Financial Monitoring Phase 2 was finalised and the report is attached at Appendix 5. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to note the content of the audit reports and audit summaries that have been considered by the partner bodies. __________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plans for the partner bodies 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights – None. ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor
Page 3
RENFREWSHIRE VALUATION JOINT BOARD To: Renfrewshire Valuation Joint Board On: 23 May 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Engagement – Non-Domestic Rates Valuation System ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. 1.2 The Chief Auditor will report summaries of completed audit engagements to the Joint Board on the conclusion of each engagement for formal consideration by member in line with the best practice referred to above. 1.3 This report provides detail of the audit engagement completed in February 2025 with the overall assurance rating and the number of recommendations in each risk category. The detailed board summary for the report is also attached. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the summary for the internal audit review of the non-domestic rates valuation system. _________________________________________________________ For further information please contact Karen Campbell on 0141 487 0678 Or via e-mail at karen.campbell@renfrewshire.gov.uk
Page 4
Renfrewshire Council Internal Audit Service Update for Renfrewshire Valuation Joint Board on the Audit Engagement concluded in February 2025 Category Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Non-Domestic Rates Valuation System Substantial 0 0 1 0 Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk. • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report Valuation Joint Board RVJB - Non domestic Rates Valuation System (A0012/2025/001) Date: February 2025 EXECUTIVE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. There are adequate documented procedures in place which are up to date and comply with current legislation. 2. The valuation system is updated accurately and within a reasonable time period. 3. Non-Domestic Rates teams receive regular updates in relation to amendments made. 4. Data is held securely in compliance with the relevant legislation. Audit Scope 1. Interviewed the appropriate staff, evaluated the controls in place for the non-domestic rates valuation system and identified any possible improvements to the system. 2. Prepared a series of tests to ensure the non-domestic rates valuation system was operating effectively and as described. Key Audit Assurances 1. Documented procedures are in place which are up to date and comply with current legislation. 2. Regular and timeous updates in relation to amendments are provided to the Non-Domestic Rates teams. 3. Data relating to non-domestic rates is held securely. Key Risks The auditor did not identify any key risks in this area. Overall Audit Opinion Documented procedures and data security in relation to the non-domestic rates valuation system were found the be satisfactory. Updates to the Non-Domestic teams were found to be completed timeously. However, confirmation could not be given that all updates to the valuation list were carried timeously as the supporting records maintained could no longer be accessed following the update to the valuation list. A recommendation has been made to improve this area. Management Commentary Management have reviewed the system settings and permissions to enable access to the required information.
Page 6
RENFREWSHIRE VALUATION JOINT BOARD ___________________________________________________________________ To: Renfrewshire Valuation Joint Board On: 23 May 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: INTERNAL AUDIT ANNUAL REPORT 2024/25 ___________________________________________________________________ 1. SUMMARY 1.1 The Public Sector Internal Audit Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of the Renfrewshire Valuation Joint Board’s internal control environment. 1.3 The Annual Report for Renfrewshire Valuation Joint Board is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the Internal Audit Team, the main findings from the internal audit work undertaken in 2024/25 and contains an audit assurance statement. 2. RECOMMENDATIONS 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report.
Page 7
Appendix 1 Renfrewshire Valuation Joint Board Internal Audit Annual Report 2024/2025 Renfrewshire Council Internal Audit
Page 8
No embedded text on this page.
Page 9
Renfrewshire Valuation Joint Board Internal Audit Annual Report 2024/2025 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2024/25 2 4. Internal Audit Performance 4 5. Planned Audit Work for 2025/26 6 6. Audit Assurance Statement 6
Page 10
- 1 - Renfrewshire Valuation Joint Board Internal Audit Annual Report 1 April 2024 – 31 March 2025 1. Introduction 1.1 Renfrewshire Council provides an internal audit service to Renfrewshire Valuation Joint Board. This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Assessor and Electoral Registration Officer, Renfrewshire Valuation Joint Board; • Delivery of the planned audit assignments; • Follow up of previous audit recommendations; • Provision of any ongoing advice and support on audit and risk management related matters; • Provision of an Annual Report and Assurance Statement, and presentation to elected members at the board of Renfrewshire Valuation Joint Board. 1.2 The Service operated in accordance with the Public Sector Internal Audit Standards for 2024/25 which defines Internal Audit’s role as: “......an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” 1.3 In line with the Standards, the purpose of this Annual Report is to report on: • The outcome of the planned Internal Audit reviews 2024/25 relating to Renfrewshire Valuation Joint Board; • The outcome of Internal Audit reviews of supporting Renfrewshire Council corporate systems; • Internal audit performance; • Planned audit work for 2025/26; • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the Board’s internal control environment.
Page 11
- 2 - 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of management to ensure that the areas under their control are adequate and effective and that there is a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 2.3 The internal audit team will ensure that independence and objectivity are maintained in line with the PSIAS including where non-audit work is undertaken. Internal auditors will have no operational responsibilities. There have been no impairments impacting on the Chief Auditor’s independence and the team has been adequately resourced during the year. 3. Internal Audit Activity during 2024/2025 3.1 One specific engagement was undertaken during 2024/25, which related to the Non-Domestic Rates Valuation System. A summary of the report was considered by the Board on 23 May 2025 and the conclusion of this review is summarised in Table 1 below: Table 1 Audit Area Conclusion Non-domestic Rates Valuation System Substantial Assurance Documented procedures and data security in relation to the non-domestic rates valuation system were found the be satisfactory. Updates to the Non-Domestic teams were found to be completed timeously. However, confirmation could not be given that all updates to the valuation list were carried timeously as the supporting records maintained could no longer be accessed following the update to the valuation list. A recommendation has been made to improve this area which Management agreed to address and the auditor has made a provision of substantial assurance for the areas tested. 3.2 The Annual Report for 2023/2024 was submitted to the Joint Board on 24 May 2024.
Page 12
- 3 - 3.5 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2024/25, there were no recommendations that required to be followed up. 3.5 Internal Audit also carried out reviews of the main corporate systems operating within Renfrewshire Council which support the Board’s activity. The main findings in relation to these are summarised in Table 2 below and Renfrewshire Council management have agreed to implement the audit recommendations made in relation to each review: Table 2 Audit Area Conclusion Corporate Risk Management Reasonable Assurance This review was undertaken by an independent Consultant. They concluded that Renfrewshire Council has a well- established approach to risk management with many positive features, especially in terms of strong governance and a positive cultural attitude towards risk management at a corporate level. The overall risk maturity score was identified as 3.2 against a score of 4 which in the external consultant’s opinion would, in general, be the maximum realistic level they would expect to see for an organisation in the Council’s sector except in exceptional circumstances. The BAURAM (Business- as-usual risk assurance model © Renfrewshire Council) is an innovative and powerful approach which has been designed well and, like many other elements of Renfrewshire Council’s risk approach, is evidently subject to continuous improvement. To continue to grow risk management maturity, some opportunities were identified for further development and Renfrewshire Council may wish to focus on ensuring sufficient resources – both in terms of personnel and systems - are available to ensure risks are identified promptly, recorded consistently and therefore managed appropriately. Payroll Reasonable Assurance Payroll Run Processing procedures set out each stage of payroll process to be carried out by Payroll team members.
Page 13
- 4 - However, we identified a lack of evidence of some payroll checks and incomplete control account reconciliations which required management action. Treasury Management Reasonable Assurance Discussions are ongoing between Treasury supervisors and Purchase to Pay supervisors as to payment categories that would be more suitable for the Purchase to Pay team to administer instead of the Treasury team and it was recognised that these should be transferred across as soon as possible. In addition, a lack of segregation of duties was identified in that all users with Corporate Administrator and single authorisation access can currently request a payment and also authorise that payment themselves which required to be addressed. Other recommendations in relation to the authorisation of payments were made. Recruitment Reasonable Assurance Audit testing in the areas of the recruitment process after a preferred candidate has been chosen noted that generally target timescales were met for each part of the process and that where targets had not been met, these were followed up through management checking processes. It was also noted that although there are good monitoring and oversight arrangements in place, these could be improved by establishing Key Performance Indicators that could be reported at a higher level than the current processes dictate. 4. Review of Internal Audit Performance 4.1 Internal Audit produces regular reports on its performance during the year to the Renfrewshire Council, Audit, Risk and Scrutiny Board, against a range of measures set annually by the Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal
Page 14
- 5 - audit services. Table 3 shows the actual performance against targeted performance for the year. Table 3 Internal Audit Performance 2024/25 Performance measure Target 2024/25 Actual 2024/25 % of audit assignments completed by target date 95% 96.7% % of audit assignments completed within time budget 95% 98.4% % completion of audit plan for the year* 90% 93.6% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 4.2 The percentage completion of the audit plan was ahead of the target set for the year. It should be noted that the planned reviews for the RVJB for 2024/25 are 100% complete. The actual performance for the year for the two other indicators, is above the target performance level. 4.3 Since the retiral of the Chief Auditor in June 2024, the Asst Chief Auditor has been covering this post on an interim basis. Given that it was recognised that there may be resilience issues regarding internal audit and counter fraud staff in the future, discussions were undertaken with the Chief Financial Officers of two neighbouring councils which resulted in a considerable piece of work being undertaken during the year to explore a potential shared delivery model. It should be noted that the delivery of financial savings was not an objective of this exercise, and Renfrewshire Council’s Chief Financial Officer was committed to maintaining the current level of resource. 4.4 This work has been completed and it was concluded that it would not represent value for money to progress with the shared service proposal at this point due to the complexities of servicing a number of public bodies (Councils, Partners and Associated Bodies) under a single operational management structure with different systems, processes and working practices in place. This decision was agreed by members of Renfrewshire Council’s Finance, Resources and Customer Services Policy Board on 3 April 2025. The Council is now progressing to recruit a Chief Auditor on a permanent basis. 4.5 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 4.6 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process. Our most recent external assessment
Page 15
- 6 - was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and included 7 recommendations for improvement, all recommendations have now been completed. The annual internal self-assessment process has concluded that the internal audit service fully complies with the PSIAS during 2024/25. 4.7 We have commenced a self-assessment exercise against the new Global Internal Audit Standards in the Public Sector. Any actions identified will be implemented to ensure compliance. 4.8 The internal audit service through the Risk Manager, provides risk management advice and support to the RVJB officers, as required. 5. Planned Work for 2025/26 5.1 Following a risk-based assessment of the activities of the Renfrewshire Valuation Joint Board, the audit plan for 2025/2026 provides for a review of purchasing processes, preparation of an annual report, ad-hoc internal control advice, reactive investigative work and a follow-up of previous audits recommendations. 6. Audit Assurance Statement 6.1 Internal Audit has performed its work in accordance with the role defined in paragraph 1.2. The audit work performed has been reported to the Assessor and Electoral Registration Officer, and to the Board. Where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 6.2 In view of the continued challenges common to all public bodies, there will be a requirement for the council and the bodies for which it is host authority to exercise very close scrutiny over expenditure, over financial management and compliance with overarching governance arrangements, and this area will continue to receive due internal audit attention. 6.3 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 6.4 There are corporate systems and processes within Renfrewshire Council that the Renfrewshire Valuation Joint Board rely upon. It can be seen from Table 2 above that some actions were recommended to improve the processes in operation. Renfrewshire Council management has agreed to implement the recommendations made by internal audit, in relation to these reviews. In this context, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Renfrewshire Valuation Joint Board’s internal control, risk management and governance arrangements, as evidenced by: -
Page 16
- 7 - • The results of the audit work in 2024/25 in relation to the corporate systems which supported the Renfrewshire Valuation Joint Board’s activities, and to specific work carried out in relation to those activities. • Management action in response to audit recommendations. • Management’s self-assessment of internal control, risk management and governance arrangements. • The regular review and updating of the Local Code of Corporate Governance by the Council in accordance with the CIPFA/SOLACE framework for corporate governance requirements, and of the corporate governance arrangements within Renfrewshire Valuation Joint Board.
Page 17
AGENDA ITEM NO..... Scotland Excel To: Executive Sub-Committee On: 20 June 2025 Report by Chief Auditor INTERNAL AUDIT ANNUAL REPORT 2024/25 1. Summary 1.1 The Public Sector Internal Audit Standards in operation within 2024/25 require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of Scotland Excel’s internal control environment. 1.3 The Annual Report for Scotland Excel is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the Internal Audit Team, the main findings from the internal audit work undertaken in 2024/25 and contains an audit assurance statement. 2. Recommendations 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report.
Page 18
No embedded text on this page.
Page 19
Scotland Excel Internal Audit Annual Report 2024/2025 Renfrewshire Council Internal Audit
Page 20
Scotland Excel Internal Audit Annual Report 2024/2025 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity during 2024/25 2 4. Review of Internal Audit Performance 3 5. Planned Audit Work for 2025/26 4 6. Audit Assurance Statement 6
Page 21
- 1 - Scotland Excel Internal Audit Annual Report 1 April 2024 – 31 March 2025 1. Introduction 1.1 As host Authority, Renfrewshire Council provides an internal audit service to Scotland Excel. This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Chief Executive; • Delivery of the planned audit assignments; • Follow up of previous audit recommendations; • Provision of any ongoing advice and support on audit and risk management related matters; • Provision of an Annual Report and Assurance Statement, and presentation to elected members of Scotland Excel. 1.2 The Service operates in accordance with the Public Sector Internal Audit Standards (PSIAS) which were in place during 2024/25 and which defines Internal Audit’s role as: “......an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” 1.3 In line with the Standards, the purpose of this Annual Report is to report on: • The status/outcome of the planned Internal Audit reviews 2024/25 relating to Scotland Excel; • The outcome of Internal Audit reviews of supporting Renfrewshire Council corporate systems; • Internal audit performance; • Planned audit work for 2025/26; • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the organisation’s internal control environment.
Page 22
- 2 - 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of management to ensure that for the areas under their control there is an adequate and effective system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 2.3 The internal audit team ensured that independence and objectivity were maintained in line with the PSIAS which was in operation during 2024/25 including where non-audit work is undertaken. Internal auditors have no operational responsibilities. There have been no impairments impacting on the Chief Auditor’s independence and the team has been adequately resourced during the year. 3. Internal Audit Activity during 2024/25 3.1 The internal audit engagement reviewing the governance arrangements surrounding the Contract Delivery Plan is nearing completion and will be reported to management as soon as possible. The Contract Monitoring – Implementing Collaborative Procurement engagement was completed during the year and reported to the Executive Sub-Committee on 23 August 2024. The main finding in relation to this review is summarised in table 1 below: Table 1 Audit Area Conclusion Implementing Collaborative Procurement Substantial Assurance The audit identified that satisfactory arrangements are in place for member visibility of forthcoming Scotland Excel frameworks. Scotland Excel staff and processes encourage member participation in framework development to maximise usage and deliver benefits for all members. As a result, there were no audit findings identified during this review. 3.2 The Annual Report for 2024/25 was submitted to the Executive Sub-committee on 17 May 2025.
Page 23
- 3 - 3.3 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2024/25, there were no recommendations that required to be followed up. 3.4 Internal Audit also carried out reviews of the main corporate systems operating within Renfrewshire Council which support Scotland Excel’s activity. The main findings in relation to these are summarised in Table 2 below and Renfrewshire Council management have agreed to implement the audit recommendations made in relation to each review: Table 2 Audit Area Conclusion Payroll Reasonable Assurance Payroll Run Processing procedures set out each stage of the payroll process to be carried out by Payroll team members. However, we identified a lack of evidence of some payroll checks and incomplete control account reconciliations which required management action. Treasury Management Reasonable Assurance Discussions are ongoing between Treasury supervisors and Purchase to Pay supervisors as to payment categories that would be more suitable for the Purchase to Pay team to administer instead of the Treasury team and it was recognised that these should be transferred across as soon as possible. In addition, a lack of segregation of duties was identified in that all users with Corporate Administrator and single authorisation access can currently request a payment and also authorise that payment themselves which required to be addressed. Other recommendations in relation to the authorisation of payments were made. 4. Review of Internal Audit Performance 4.1 Internal Audit produces regular reports on its performance during the year to the Renfrewshire Council, Audit, Risk and Scrutiny Board, against a range of measures set annually by the Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal audit
Page 24
- 4 - services. Table 3 shows the actual performance against targeted performance for the year. Table 3 Internal Audit Performance 2024/25 Performance measure Target 2024/25 Actual 2024/25 % completion of audit plan for the year* 90% 93.6% % of audit assignments completed within time budget 95% 98.4%% % of audit assignments completed by target date 95% 96.7%% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 4.2 The percentage completion of the audit plan was ahead of the target set for the year. It should be noted that the planned reviews for Scotland Excel for 2024/25 are 100% complete. The actual performance for the year for the two other indicators, is above the target performance level. 4.3 Since the retiral of the Chief Auditor in June 2024, the Asst Chief Auditor has been covering this post on an interim basis. Given that it was recognised that there may be resilience issues regarding internal audit and counter fraud staff in the future, discussions were undertaken with the Chief Financial Officers of two neighbouring councils which resulted in a considerable piece of work being undertaken during the year to explore a potential shared delivery model. It should be noted that the delivery of financial savings was not an objective of this exercise, and Renfrewshire Council’s Chief Financial Officer was committed to maintaining the current level of resource. 4.4 This work has been completed and it was concluded that it would not represent value for money to progress with the shared service proposal at this point due to the complexities of servicing a number of public bodies (Councils, Partners and Associated Bodies) under a single operational management structure with different systems, processes and working practices in place. This decision was agreed by members of Renfrewshire Council’s Finance, Resources and Customer Services Policy Board on 3 April 2025. The Council is now progressing to recruit a Chief Auditor on a permanent basis. 4.5 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 4.6 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process. Our most recent external assessment was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and included 7 recommendations for improvement, all recommendations have been
Page 25
- 5 - completed. The annual internal self-assessment process has concluded that the internal audit service fully complies with the PSIAS. 4.7 We have commenced a self-assessment exercise against the new Global Internal Audit Standards in the Public Sector. Any actions identified will be implemented to ensure compliance. Risk Management 4.8 The internal audit service through the Risk Manager, provides advice and support to Scotland Excel officers, as required. 5. Planned Audit Work for 2025/26 5.1 Following a risk-based assessment of the activities of Scotland Excel and consultation with the Chief Executive, the following internal audit work has been agreed for 2025/26: • A review of the arrangements for delivering value to local government; • Follow up of previous audit work; • Ad-hoc internal audit and risk management advice. 6. Audit Assurance Statement 6.1 Internal Audit has performed its work in accordance with the role defined in paragraph 1.2. The audit work performed and completed has been reported to the Chief Executive and to the Executive Sub Committee. Where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 6.2 In view of the continued challenges common to all public bodies, there will be a requirement for the council and the bodies for which it is host authority to exercise very close scrutiny over revenue spending, over financial management and compliance with overarching governance arrangements, and this will continue to receive due internal audit attention. 6.3 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 6.4 There are corporate systems and processes within Renfrewshire Council that Scotland Excel rely upon. It can be seen from Table 2 above that some actions were recommended to improve the processes in operation. Renfrewshire Council management has agreed to implement the recommendations made by internal audit, in relation to these reviews. In this context, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of Scotland Excel Joint Committee’s internal control, risk management and governance arrangements, as evidenced by: -
Page 26
- 6 - • The results of the audit work in 2024/25 in relation to the corporate systems which supported Scotland Excel’s activities and to specific work carried out in relation to those activities. • Management action in response to audit recommendations. • Management self-assessment of internal control, risk management and governance arrangements. • The regular review and updating of the Local Code of Corporate Governance by the Council in accordance with the Chartered Institute of Public Finance and Accountancy and Society of Local Authority Chief Executives framework for corporate governance requirements, and of the corporate governance arrangements within Scotland Excel. Signed Interim Chief Auditor Date 20 June 2025
Page 27
To: Renfrewshire Health and Social Care Integration Joint Board Audit, Risk and Scrutiny Committee On: 20 June 2025 Report by: Chief Internal Auditor Heading: Internal Audit Annual Report 2024/2025 1. Summary 1.1 The Public Sector Internal Audit Standards (PSIAS) which were in operation during 2024/25 requires that the Chief Internal Auditor must deliver an annual internal audit opinion, on the overall adequacy and effectiveness of the governance, risk management and internal control framework, that can be used by the organisation to inform its governance statement. 1.2 The purpose of this report is to advise the Committee of the Internal Audit Annual Report including the annual opinion. The Internal Audit Annual Report also outlines the internal audit work we have carried out for the year ended 31 March 2025 and provides details of the performance of Internal Audit. 1.3 The report attached, includes the Interim Chief Internal Auditor’s independent and objective opinion as to the adequacy and effectiveness of the internal control environment. In forming the opinion, the Interim Chief Internal Auditor has conducted a review of the Internal Audit reports issued to the IJB in the year and the internal audit annual report from Renfrewshire Council and internal audit progress reports from NHS Greater Glasgow and Clyde. 2. Recommendations 2.1 Members are asked to consider and note the contents of the IJB’s Internal Audit Annual Report for 2024/25.
Page 28
Implications of the Report 1. Financial - none 2. HR & Organisational Development - none. 3. Community Planning - none. 4. Legal - none. 5. Property/Assets - none. 6. Information Technology - none. 7. Equality & Human Rights - none 8. Health & Safety - none. 9. Procurement - none. 10. Risk - The report provides an opinion on the overall internal control environment including governance and risk management of the Integration Joint Board. 11. Privacy Impact - none. List of Background Papers – none. Author: Karen Campbell, Interim Chief Internal Auditor
Page 29
Renfrewshire Integration Joint Board Internal Audit Annual Report 2024-2025 June 2025
Page 30
No embedded text on this page.
Page 31
Renfrewshire Integration Joint Board Internal Audit Annual Report 2024/2025 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2024/25 2 4. Review of Internal Audit Performance 2 5. Planned Audit Work for 2025/26 3 6. Audit Assurance Statement 4 Appendix 1 – Summary of Assurances 6
Page 32
- 1 - Renfrewshire Integration Joint Board Internal Audit Annual Report 1 April 2024 – 31 March 2025 1. Introduction 1.1 Renfrewshire Council provides an internal audit service to the Renfrewshire Integration Joint Board (IJB). This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Chief Officer and Senior Management; • Delivery of the planned audit assignments; • Follow up of previous audit recommendations; • Provision of any ongoing advice support and training on audit and risk related matters; • Provision of an Annual Report and Assurance Statement to the IJB. 1.2 The Service operates in accordance with the Public Sector Internal Audit Standards for 2024/25 which defines Internal Audit’s role as: “......an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” 1.3 In line with the Standards, the purpose of this Annual Report is to report on: • The outcome of the planned Internal Audit reviews 2024/25 relating to the IJB; • The outcome of Internal Audit reviews undertaken by partner bodies; • Internal audit performance; • Planned audit work for 2025/26; • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the IJB’s internal control environment. 1.4 The operational delivery of services within the Health Board and Local Authority on behalf of the Integration Joint Board will be covered by their respective internal audit arrangements. In concluding on the overall opinion, the Interim Chief Internal Auditor has conducted a review of the internal audit reports issued to the IJB in the year, the internal audit annual report from Renfrewshire Council and progress summaries from NHS Greater Glasgow and Clyde. (Appendix 1)
Page 33
- 2 - 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of management to ensure that the areas under their control are adequate and effective and that there is a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3. Internal Audit Activity during 2024/2025 3.1 The Internal Audit Plan for the IJB for 2024/2025 provided for a review of the financial planning arrangements and the annual review of the adequacy and compliance with the Local Code of Corporate Governance. Both of these reviews were reported to the IJB Audit, Risk and Scrutiny Committee in March 2025. 3.2 The Annual Report for 2023/2024 was submitted to the Integration Joint Board on 21 June 2024. 3.3 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2024/25, seven recommendations were followed up, six recommendations have been fully implemented and 1 was superseded as a result of a process change. 4. Review of Internal Audit Performance 4.1 Internal Audit produces regular reports on its performance during the year to Renfrewshire Council’s Audit, Risk and Scrutiny Board, against a range of measures set annually by Renfrewshire Council’s Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal audit services. Table 1 shows the actual performance against targeted performance for the year. Table 1 Internal Audit Performance 2024/25 Performance measure Target 2024/25 Actual 2024/25 % completion of audit plan for the year* 90% 93.6% % engagements completed by target date 95% 96.7% % engagements completed within time budget 95% 98.4%
Page 34
- 3 - * This measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 4.2 The percentage completion of the audit plan is ahead of the target set for the year. In addition, the actual performance for the year for the two other indicators, is above the target performance level. It should be noted that the Internal Audit Plan for the IJB for 2024/25 is 100% complete. 4.3 Since the retiral of the Chief Auditor in June 2024, the Asst Chief Auditor has been covering this post on an interim basis. Given that it was recognised that there may be resilience issues regarding internal audit and counter fraud staff in the future, discussions were undertaken with the Chief Financial Officers of two neighbouring councils which resulted in a considerable piece of work being undertaken during the year to explore a potential shared delivery model. It should be noted that the delivery of financial savings was not an objective of this exercise, and Renfrewshire Council’s Chief Financial Officer was committed to maintaining the current level of resource. 4.4 This work has been completed and it was concluded that it would not represent value for money to progress with the shared service proposal at this point due to the complexities of servicing a number of public bodies (Councils, Partners and Associated Bodies) under a single operational management structure with different systems, processes and working practices in place. This decision was agreed by members of Renfrewshire Council’s Finance, Resources and Customer Services Policy Board on 3 April 2025. The Council is now progressing to recruit a Chief Auditor on a permanent basis. 4.5 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 4.6 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process. Our most recent external assessment was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and included 7 recommendations for improvement, all recommendations have been completed. The annual internal self-assessment process has concluded that the internal audit service fully complied with the PSIAS during 2024/25. 4.5 A self-assessment exercise against the new Global Internal Audit Standards is nearing completion. Any actions identified will be implemented to ensure compliance. 5. Planned Work for 2025/26 5.1 Following a risk-based assessment of the activities of the IJB and consultation with the senior management team, the Internal Audit Plan for 2025/26 provides for 40 days of Internal Audit resource to undertake: • A review of strategic planning; and • The annual review of the adequacy and effectiveness of the Local Code of Corporate Governance.
Page 35
- 4 - 5.2 The plan also provides time for planning and reporting, follow up on previous recommendations, the annual self-assessment of the Audit Committee arrangements, ad-hoc advice, consultancy and training. The Internal Audit Plan for 2025/26 was approved by the IJB Audit, Risk and Scrutiny Committee on 14 March 2025. 6. Audit Assurance Statement 6.1 The audit work performed in relation to the 2024/25 internal audit plan has been reported to the Chief Officer and the Audit, Risk and Scrutiny Committee. Relevant audit work undertaken by partner organisations is reported to their respective Audit Committees. Where areas for improvement in internal control have been identified, appropriate recommendations have been made and accepted for action by management. 6.2 There are no significant matters arising in relation to those audit engagements specific to the IJB and there have been no impairments impacting on the Chief Auditor’s independence and the team has been sufficiently resourced during the year to undertake the planned assignments. 6.3 In view of the continued challenges common to all public bodies, there will be a requirement for the IJB and its partners to exercise close scrutiny over expenditure, over financial management and compliance with overarching governance arrangements, and this area will continue to receive due internal audit attention. 6.4 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 6.5 There are corporate systems and processes within Renfrewshire Council and NHS Greater Glasgow and Clyde that the IJB rely upon. It can be seen from Appendix 1, that some of these processes require to be improved to provide a reasonable level of assurance. 6.6 In this context, it is considered that a reasonable level of assurance can be placed upon the adequacy and effectiveness of the Integration Joint Board’s internal control, risk management and governance arrangements, as evidenced by:- • The results of the audit work in 2024/25 and the opinion’s contained in the Internal Audit Annual Reports of the Local Authority and progress reports from the Health Board. • Management self-assessment of internal control, risk management and governance arrangements. • Management action to respond to audit recommendations.
Page 36
- 5 - Karen Campbell Interim Chief Internal Auditor 20 June 2025 -
Page 37
- 6 - Appendix 1 Summary of Internal Audit Assurances for the IJB and Partner Organisations, Renfrewshire Council and NHS Greater Glasgow and Clyde Integration Joint Board Audit Engagement Assurance Level Significant Matters Local Code of Corporate Governance Substantial • None Financial Planning Reasonable • The arrangements in place in Renfrewshire Integrated Joint Board for financial planning were found to be robust and regular in-depth monitoring processes are in operation. At the time of the review, the updated medium term financial plan had not been finalised. This has now been approved in March 2025. Renfrewshire Council Audit Engagement Assurance Level Significant Matters Transportation and Fleet – External Vehicle Hire Processes Limited • No documented guidance was available to follow when requesting a vehicle and the ordering process for obtaining vehicles from Suppliers was unsatisfactory. Management agreed to action the audit recommendations. Recruitment – Processes after Interview Reasonable • None Eclipse Application Review Substantial • None ERP Utilisation Reasonable • None Corporate Risk Management Reasonable • To continue to grow risk management maturity, Renfrewshire Council may wish to focus on ensuring sufficient resources – both in terms of personnel and systems - are available to ensure risks are identified promptly, recorded consistently and therefore managed appropriately. Management are currently implementing the recommendations. Payroll Reasonable • There was a lack of evidence of some payroll checks and incomplete control account reconciliations which require management action. This is being addressed by Management Treasury Management Reasonable • Segregation of duties for banking transactions and checking processes for payment requests required to be reviewed. This has now been addressed. NHS Greater Glasgow and Clyde
Page 38
- 7 - Audit Engagement Overall Audit Rating Significant Matters Performance Monitoring Minor Improvement Required • None Financial Management and Reporting Minor Improvement Required • None Waiting List Management Minor Improvement Required • None Digital Health & Care Strategy Effective • None Discharge Planning Minor Improvement Required • There was a need to ensure that oversight and governance arrangements are strengthened to support prompt identification and resolution of issues of non-compliance with the Discharge Policy. Management agreed to incorporate this action into their improvement plans. Property Transaction Monitoring Effective • None Sustainability and Value Programme Substantial improvement required • Action was required to reduce the level of unallocated savings and variable working practices were identified for action planning how identified savings were going to be achieved. Management agreed to implement the audit recommendations Hospital Discharges (Patients Requiring Social Work Support) Substantial improvement required • The Discharge Policy was being inconsistently applied which was increasing the likelihood of delays in referrals to HSCPs, Social Work and Home Care. Management agreed to take action and monitor its implementation. Cyber Security Remote Access Minor improvement required • None Waiting List Management (Psychological Therapy and Drug and Alcohol teams) Minor improvement required • There was not a Board-wide policy in place that sets out the expected arrangements for management and reporting of ADRS waiting lists across NHSGGC as these are currently managed separately in each HSCP area. Management agreed to address this issue
Page 39
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring 0 Introduction Audit Opinion Main Findings Action Plan Will Glasgow City Region City Deal Financial Monitoring Phase 2 Final Report May 2025 FS 57095
Page 40
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring Phase 2 1 Introduction Audit Opinion Main Findings Action Plan 1 Introduction 1.1 As part of the agreed Internal Audit plan, we have carried out a review of the financial monitoring arrangements in place across the Glasgow City Region City Deal Programme. 1.2 The Glasgow City Region Project Management Office (PMO) is responsible for the financial monitoring and reporting for the overall City Deal programme. The role of the PMO includes collating the project status updates from all member authorities and reporting to various senior officer groups and the Cabinet. Given the current financial pressures faced by all member authorities and the external factors that may impact the progression of City Deal projects, it is essential to ensure that financial monitoring and reporting are conducted effectively and in line with expected timescales. This remains crucial for highlighting any key issues as soon as possible. 1.3 The purpose of the audit was to gain assurance that there are adequate controls in place covering financial monitoring and reporting carried out by the PMO and member authorities, and that these are operating effectively. The scope of the audit included: • Documented procedures, roles and responsibilities. • The financial monitoring process and reporting to Cabinet. • The process for identifying variances. • The arrangements and approval processes for the amendments of budgets. • The year-end processes. • The internal monitoring processes and arrangements for reporting to the PMO. • The escalation processes in place. 1.4 This report outlines the findings from the second phase of the review, which focused on the financial monitoring arrangements of the remaining four member authorities: • Glasgow City Council • Renfrewshire Council • West Dunbartonshire Council • South Lanarkshire Council The other four member authorities were reviewed as part of Phase 1 of this audit, undertaken in 2023/24.
Page 41
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring Phase 2 2 Introduction Audit Opinion Main Findings Action Plan 2 Audit Opinion 2.1 Based on the audit work carried out, assurance can be taken that the control environment is satisfactory. 3 Main Findings 3.1 We are pleased to report that key controls are in place and operating effectively. Guidance on the financial monitoring requirements for City Deal projects is available to the member authorities included in the Phase 2 review. This is through the ‘Assurance Governance and Programme Management Framework’ (the Framework) and the supporting Project Management Toolkit. The PMO continues to hold responsibility for updating both documents, and an annual schedule for reviewing and approving changes has been established. We were advised by senior officers within the PMO, that a full review of both documents is planned to be finalised and submitted to Cabinet for approval in May 2025. 3.2 The PMO has appropriate arrangements for the development and approval of the annual PMO budget, as confirmed during the Phase 1 review. For Phase 2, we verified that there have been no changes to these arrangements and were provided with up-to-date evidence to ensure that these remain satisfactory. Regular budget monitoring continues to be conducted as expected, with the overall financial position reported to Cabinet as part of the Quarterly Programme Report. 3.3 In accordance with the Framework, we found that, consistent with the findings from the Phase 1 review, the four remaining member authorities also provide the PMO with the expected quarterly updates. These are in the form of Project Status Reports, which detail progress of their projects, including financial information regarding expenditure, claims and projected cashflows. We found satisfactory budget monitoring processes are in place, to identify budget variances and allow adequate review of their project(s) financial positions through established reporting arrangements. 3.4 Adequate arrangements are in place to ensure that scrutiny by relevant senior management and committees is conducted in line with the agreed timescales. We found that there are adequate processes for collating financial data for reporting to the PMO, and we noted a positive working relationship between the PMO and member authorities, which includes regular meetings prior to the submission of the quarterly returns. 3.5 The four member authorities included in Phase 2 adhere to the established change control process for budget amendments. Each member authority has satisfactory
Page 42
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring Phase 2 3 Introduction Audit Opinion Main Findings Action Plan arrangements in place regarding the escalation and approval routes of internal change control requests, as well as for submissions to the PMO as part of the quarterly Project Status Report. This ensures that any changes are approved or rejected at the appropriate programme level. The PMO continues to maintain a central register of all approved change control requests across the Region. 3.6 The audit has been undertaken in accordance with the Public Sector Internal Audit Standards. 3.7 We would like to thank officers involved in this audit for their cooperation and assistance. 3.8 It is recommended that the Cabinet note the content of this report.