Agenda Document Pack - Audit, Risk and Scrutiny Board - 18/08/2025
Renfrewshire Council · 18 August 2025
Back to Audit, Risk and Scrutiny Board — 18 August 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Notice of Meeting and Agenda Audit, Risk and Scrutiny Board Date Time Venue Monday, 18 August 2025 15:00 Council Chambers (Renfrewshire), Council Headquarters, Renfrewshire House, Cotton Street, Paisley, PA1 1AN MARK CONAGHAN Head of Corporate Governance Membership Councillor Andy Doig (Convener): Councillor Janis McDonald (Depute Convener): Councillor Jennifer Adam: Councillor Gillian Graham: Councillor Lisa-Marie Hughes: Councillor Robert Innes: Councillor James MacLaren: Councillor Will Mylet: Councillor Ben Smith: Members of the Press and Public Members of the press and public wishing to attend the meeting should report to the customer service centre where they will be met and directed to the meeting. Further Information This is a meeting which is open to members of the public. A copy of the agenda and reports for this meeting will be available for inspection prior to the meeting at the Customer Service Centre, Renfrewshire House, Cotton Street, Paisley and online at http://renfrewshire.cmis.uk.com/renfrewshire/CouncilandBoards.aspx For further information, please email democratic-services@renfrewshire.gov.uk Published: 12/8/25
Page 2
Hybrid Meeting Please note that this meeting is scheduled to be held in the Council Chambers. However, it is a hybrid meeting and arrangements have been made for members to join the meeting remotely should they wish. Webcasting of Meeting This meeting will be filmed for live or subsequent broadcast via the Council’s internet site – at the start of the meeting the Convener will confirm if all or part of the meeting is being filmed. To find the webcast please navigate to https://renfrewshire.public-i.tv/core/portal/home Apologies Apologies from members. Declarations of Interest and Transparency Statements Members are asked to declare an interest or make a transparency statement in any item(s) on the agenda and to provide a brief explanation of the nature of the interest or the transparency statement. AUDIT 1 Summary of Internal Audit Reports 26 April – 30 June 2025 Report by Chief Auditor. 1 - 10 2 Summary of Internal Audit Activity in Partner Organisations 26 April – 30 June 2025 Report by Chief Auditor. 11 - 52
Page 3
3 Internal Audit and Counter Fraud Progress and Performance for Period to 30 June 2025 Report by Chief Auditor. 53 - 66 4 Global Internal Audit Standards in the Public Sector Report by Chief Auditor. 67 - 86 5 The National Fraud Initiative 2024-2028 Strategy Report by Chief Auditor. 87 - 108 MONITORING & REVIEWING SERVICE DELIVERY PERFORMANCE POLICIES AND PRACTICE 6 Audit Scotland Briefing: Additional Support for Learning Report by Director of Children's Services. 109 - 114 7 Audit Scotland: Local Government Budgets 2025/26 Report by Director of Finance & Resources. 115 - 120 AUDIT EXEMPT Exempt Item Exempt documents are no longer available in print format. You will require to log in to Audit, Risk & Scrutiny Exempt Items to access documents. Please note that access to exempt documents is now restricted. EXCLUSION OF PRESS AND PUBLIC The Board may by resolution exclude the press and public from the meeting during consideration of the following items of business as it is likely, in view of the nature of the business to be transacted, that if members of the press and public are present, there could be disclosure to them of exempt information as defined in paragraph 1 of Part I of Schedule 7A of the Local Government (Scotland) Act, 1973.
Page 4
8 Summary of Internal Audit Investigation/Review Reports for period 26 April to 30 June 2025 Report by Chief Auditor.
Page 5
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 August 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 26 April to 30 June 2025 ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement, Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details of audit engagements completed during the period 26 April to 30 June 2025 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to OneRen and Renfrewshire Integration Joint Board; • Co-ordination of the Council’s corporate risk management activity; • Management of the counter fraud team; Item 1 Page 1 of 120
Page 6
• Management of the risk management and insurance team. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 26 April to 30 June 2025. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights - None ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor– 07768354651 Page 2 of 120
Page 7
Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 26 April – 30 June 2025 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Environment, Housing and Infrastructure Household Waste Recycling Limited 0 3 1 2 Finance & Resources Council Tax Reductions Substantial 0 0 1 0 Children’s Services Child Protection – Learning Reviews Substantial 0 0 0 0 Page 3 of 120
Page 8
Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk. • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review. Page 4 of 120
Page 9
Internal Audit Report Environment, Housing & Infrastructure Household Waste Recycling (A0028/2025/001) Date: June 2025 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. Staff have access to the Household Waste Recycling Staff Guide, have signed to acknowledge receipt of the guide and there are records of staff training on the guide’s procedures; 2. Job descriptions for recycling staff are up to date; 3. There is an adequate level of oversight at recycling centres including a supervisor on duty for all shifts who checks that records are appropriately maintained 4. There are appropriate checks in place for cars and other vehicles visiting the recycling centres, including permits for larger vehicles at the relevant centres; 5. There are registers of people/ groups (e.g. charities) that are allowed to remove items from recycling centres showing what items they can remove and forms are completed by those removing items; 6. There is an authorised contractors list and associated documentation is completed and retained. Audit Scope 1. Interviewed the appropriate officers to ascertain the systems in place at Renfrewshire’s Recycling Centres and the extent to which they were in line with the Household Waste Recycling Centre Staff Guide. 2. Visited 2 of the 5 Renfrewshire Recycling Centres to ascertain whether or not the processes in place were in line with the Household Waste Recycling Centre Staff Guide. Key Audit Assurances 1. All recycling staff have received and acknowledged receipt of the Household Waste Recycling Staff Guide. 2. The auditor examined the site diaries for 2 sites for 5 dates in January 2025 and noted that there were 4 staff members and a supervisor on duty to assist vehicle drivers recycle waste and noted that expected entries such as collections were in the site diaries on those days. 3. The auditor was provided with a copy of the list of contractors used to remove and accept the different types of waste and ensured that each one was authorised through agreements which satisfied the Council’s Contract Standing Orders. Key Risks 1. There is a risk that non-Renfrewshire residents are using Household Waste Recycling Centres as there is no evidence held that random residency checks have been undertaken. 2. Unauthorised vans and pickup trucks could be discarding waste at the Linwood Recycling Centre on some occasions. 3. The Council may not have made clear that it is no longer responsible for any items removed by Charities for re use/sale. Overall Audit Opinion All current staff have been provided with the appropriate guidance detailing the processes for the operation of the Recycling Centre. The sample of site diary entries checked by the auditor at the Page 5 of 120
Page 10
Internal Audit Report Environment, Housing & Infrastructure Household Waste Recycling (A0028/2025/001) Date: June 2025 Paisley and Linwood Recycling Centres highlighted that sufficient staff were on duty and site diaries were being adequately maintained. However, during the audit visits to the centres, the auditor did not observe any proof of residency checks being undertaken, nor was any evidence provided that these checks are being undertaken. In addition, due to staff not being available, the auditor was also informed that there are occasions when van permits were unable to be checked. Whilst there are formal agreements in place, in line with the council’s Contract Standing Orders, with contractors who receive or remove waste from waste recycling centres and dispose of that waste, no such agreements are in place with charities who remove items from the recycling centres for re use/sale. We have made recommendations to improve the controls in these areas. Management Commentary We are progressing the audit recommendations. Random checks will be conducted on those visiting the recycling centres to ensure they are Renfrewshire residents and we are investigating the possibility of introducing a specialist booking system across all sites which will assist in addressing the issues raised. Page 6 of 120
Page 11
Internal Audit Report Finance & Resources Council Tax Reductions (A071 2025 001) May 2025 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. Documented procedures are in place for the administration of the Council Tax Reduction scheme; 2. Reductions are only applied to eligible individuals; 3. Applications for reductions and supporting evidence are adequately checked and authorised; 4. Reductions have been applied correctly to accounts; 5. Checks are undertaken periodically to confirm reductions are still valid and 6. Arrangements are in place to promote the council tax reduction scheme to the community. Audit Scope 1. Interviewed relevant staff to ascertain and document the system currently in place. 2. Selected a sample of council tax reduction cases and undertook a programme of tests to evaluate the effectiveness of controls. Key Audit Assurances • There are adequate documented procedures in place for the administration of the council tax reduction scheme. • For the sample of council tax reduction cases tested, reductions were applied to the eligible individual’s council tax accounts. • There was evidence that the applications and supporting evidence were checked by a benefit assessor and there were processes in place to check the accuracy of the amount of council tax reduction awarded. • Targeted reviews to ensure the Council Tax Reduction award remains valid are undertaken for customers who receive both Housing Benefit and Council Tax Reduction. • Arrangements are in place to promote the council tax reduction scheme to the community and monitoring arrangements of take up are in place. Key Audit Risks There were no key risks identified during the audit. Page 7 of 120
Page 12
Internal Audit Report Finance & Resources Council Tax Reductions (A071 2025 001) May 2025 Overall Audit Opinion The audit has identified that satisfactory arrangements are in place for administering the Council Tax Reduction scheme. For the sample of Council Tax Reduction applications tested, reductions were only applied to eligible individuals and there was evidence of appropriate checks on each application by a Benefits Assessor. However, management action is required as cyclical reviews of Council Tax Reduction only cases are not undertaken to ensure the amount of reduction remains valid. Management Commentary N/A as no key risks were identified. Page 8 of 120
Page 13
Internal Audit Report Children’s Services Child Protection – Learning Reviews (A0104/2025/001) Date: June 2025 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. There is a process in place for initiating and approving Learning Reviews and the decisions taken are recorded in line with National Guidance for Child Protection Committees Undertaking Learning Reviews (2024). 2. Learning Reviews are carried out in line with National Guidance for Child Protection Committees Undertaking Learning Reviews (2024) and appropriate evidence is available to support that these processes have been followed including sharing of information between council officers and partner agencies. Audit Scope 1. Obtained details of relevant procedural guidance. 2. Prepared a series of tests to meet the above objectives. Key Audit Assurances 1. For the cases tested, the learning reviews were found to be being initiated, approved and carried out in accordance with the National Guidance for Child Protection Committees Undertaking Learning Reviews (2024). 2. Appropriate evidence was available to support the fact that all correct documentation was being used and information was being shared between council officers and partner agencies as required. 3. All decisions made were recorded and documented, and an adequate action plan was put in place to disseminate any relevant learning from the process. Key Risks • There were no key risks identified during the audit. Overall Audit Opinion The audit identified that satisfactory arrangements are in place for the initiating, approving and undertaking of Learning Reviews, that the decisions taken are recorded in line with National Guidance for Child Protection Committees Undertaking Learning Reviews (2024) and appropriate evidence is available to support that these processes have been followed. For the Learning Review cases tested, there were delays in starting the reviews. The Renfrewshire Child Protection Committee Lead Officer reported to the Committee that Child Protection Committees across Scotland are facing difficulties appointing external reviewers due to a lack of reviewers available to undertake reviews and this is resulting in delays in starting reviews. This is out with the control of Children’s Services and Child Protection Committees Scotland are working with the Scottish Government on options to address this. Page 9 of 120
Page 14
Internal Audit Report Children’s Services Child Protection – Learning Reviews (A0104/2025/001) Date: June 2025 There were no audit findings identified during this review and the auditor has made a provision of substantial assurance for the areas tested. Management Commentary N/A as no key risks were identified. Page 10 of 120
Page 15
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 August 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Activity in Partner Organisations - 26 April 2025 to 30 June 2025 ___________________________________________________________________ 1. Summary 1.1 This report provides members with a summary of the internal audit activity within each partner body from 26 April 2025 to 30 June 2025. 1.2 Renfrewshire Valuation Joint Board –The summary of the internal audit engagement Non-Domestic Rates Valuation System and 2024/25 Internal Audit annual report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered by the Board on 23 May 2025 and is attached in Appendices 1 and 2. 1.3 Scotland Excel Joint Committee - The 2024/25 Internal Audit annual report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered, by the Executive Sub-Committee on 20 June 2025 and is attached in Appendix 3. One audit is currently being finalised on the Contract Delivery Plan process will be reported to their Executive Sub-Committee upon completion. 1.4 Renfrewshire Integration Joint Board - The 2023/24 Internal Audit annual report, summarising the audit activity for the year and providing the Chief Auditor’s annual opinion was considered, by their Audit, Risk and Scrutiny Committee on 20 June 2025 and is attached in Appendix 4. 1.5 Glasgow City Region City Deal – Internal audit services are provided by Glasgow City Council Internal Audit Services, finalised reports for each completed audit engagement are reported to the Glasgow City Region Cabinet and the reports are shared with member Council’s. The Interim Item 2 Page 11 of 120
Page 16
Chief Auditor for Renfrewshire Council meets regularly with the City Region Auditors and provides them with an annual assurance statement to support the Glasgow City Region annual governance statement. During the reporting period, the internal audit review of Financial Monitoring Phase 2 was finalised and the report is attached at Appendix 5. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to note the content of the audit reports and audit summaries that have been considered by the partner bodies. __________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plans for the partner bodies 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights – None. ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor Page 12 of 120
Page 17
RENFREWSHIRE VALUATION JOINT BOARD To: Renfrewshire Valuation Joint Board On: 23 May 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Engagement – Non-Domestic Rates Valuation System ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. 1.2 The Chief Auditor will report summaries of completed audit engagements to the Joint Board on the conclusion of each engagement for formal consideration by member in line with the best practice referred to above. 1.3 This report provides detail of the audit engagement completed in February 2025 with the overall assurance rating and the number of recommendations in each risk category. The detailed board summary for the report is also attached. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the summary for the internal audit review of the non-domestic rates valuation system. _________________________________________________________ For further information please contact Karen Campbell on 0141 487 0678 Or via e-mail at karen.campbell@renfrewshire.gov.uk Page 13 of 120
Page 18
Renfrewshire Council Internal Audit Service Update for Renfrewshire Valuation Joint Board on the Audit Engagement concluded in February 2025 Category Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Non-Domestic Rates Valuation System Substantial 0 0 1 0 Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk. • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review. Page 14 of 120
Page 19
Internal Audit Report Valuation Joint Board RVJB - Non domestic Rates Valuation System (A0012/2025/001) Date: February 2025 EXECUTIVE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. There are adequate documented procedures in place which are up to date and comply with current legislation. 2. The valuation system is updated accurately and within a reasonable time period. 3. Non-Domestic Rates teams receive regular updates in relation to amendments made. 4. Data is held securely in compliance with the relevant legislation. Audit Scope 1. Interviewed the appropriate staff, evaluated the controls in place for the non-domestic rates valuation system and identified any possible improvements to the system. 2. Prepared a series of tests to ensure the non-domestic rates valuation system was operating effectively and as described. Key Audit Assurances 1. Documented procedures are in place which are up to date and comply with current legislation. 2. Regular and timeous updates in relation to amendments are provided to the Non-Domestic Rates teams. 3. Data relating to non-domestic rates is held securely. Key Risks The auditor did not identify any key risks in this area. Overall Audit Opinion Documented procedures and data security in relation to the non-domestic rates valuation system were found the be satisfactory. Updates to the Non-Domestic teams were found to be completed timeously. However, confirmation could not be given that all updates to the valuation list were carried timeously as the supporting records maintained could no longer be accessed following the update to the valuation list. A recommendation has been made to improve this area. Management Commentary Management have reviewed the system settings and permissions to enable access to the required information. Page 15 of 120
Page 20
RENFREWSHIRE VALUATION JOINT BOARD ___________________________________________________________________ To: Renfrewshire Valuation Joint Board On: 23 May 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: INTERNAL AUDIT ANNUAL REPORT 2024/25 ___________________________________________________________________ 1. SUMMARY 1.1 The Public Sector Internal Audit Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of the Renfrewshire Valuation Joint Board’s internal control environment. 1.3 The Annual Report for Renfrewshire Valuation Joint Board is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the Internal Audit Team, the main findings from the internal audit work undertaken in 2024/25 and contains an audit assurance statement. 2. RECOMMENDATIONS 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report. Page 16 of 120
Page 21
Appendix 1 Renfrewshire Valuation Joint Board Internal Audit Annual Report 2024/2025 Renfrewshire Council Internal Audit Page 17 of 120
Page 22
Page 18 of 120
Page 23
Renfrewshire Valuation Joint Board Internal Audit Annual Report 2024/2025 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2024/25 2 4. Internal Audit Performance 4 5. Planned Audit Work for 2025/26 6 6. Audit Assurance Statement 6 Page 19 of 120
Page 24
- 1 - Renfrewshire Valuation Joint Board Internal Audit Annual Report 1 April 2024 – 31 March 2025 1. Introduction 1.1 Renfrewshire Council provides an internal audit service to Renfrewshire Valuation Joint Board. This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Assessor and Electoral Registration Officer, Renfrewshire Valuation Joint Board; • Delivery of the planned audit assignments; • Follow up of previous audit recommendations; • Provision of any ongoing advice and support on audit and risk management related matters; • Provision of an Annual Report and Assurance Statement, and presentation to elected members at the board of Renfrewshire Valuation Joint Board. 1.2 The Service operated in accordance with the Public Sector Internal Audit Standards for 2024/25 which defines Internal Audit’s role as: “......an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” 1.3 In line with the Standards, the purpose of this Annual Report is to report on: • The outcome of the planned Internal Audit reviews 2024/25 relating to Renfrewshire Valuation Joint Board; • The outcome of Internal Audit reviews of supporting Renfrewshire Council corporate systems; • Internal audit performance; • Planned audit work for 2025/26; • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the Board’s internal control environment. Page 20 of 120
Page 25
- 2 - 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of management to ensure that the areas under their control are adequate and effective and that there is a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 2.3 The internal audit team will ensure that independence and objectivity are maintained in line with the PSIAS including where non-audit work is undertaken. Internal auditors will have no operational responsibilities. There have been no impairments impacting on the Chief Auditor’s independence and the team has been adequately resourced during the year. 3. Internal Audit Activity during 2024/2025 3.1 One specific engagement was undertaken during 2024/25, which related to the Non-Domestic Rates Valuation System. A summary of the report was considered by the Board on 23 May 2025 and the conclusion of this review is summarised in Table 1 below: Table 1 Audit Area Conclusion Non-domestic Rates Valuation System Substantial Assurance Documented procedures and data security in relation to the non-domestic rates valuation system were found the be satisfactory. Updates to the Non-Domestic teams were found to be completed timeously. However, confirmation could not be given that all updates to the valuation list were carried timeously as the supporting records maintained could no longer be accessed following the update to the valuation list. A recommendation has been made to improve this area which Management agreed to address and the auditor has made a provision of substantial assurance for the areas tested. 3.2 The Annual Report for 2023/2024 was submitted to the Joint Board on 24 May 2024. Page 21 of 120
Page 26
- 3 - 3.5 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2024/25, there were no recommendations that required to be followed up. 3.5 Internal Audit also carried out reviews of the main corporate systems operating within Renfrewshire Council which support the Board’s activity. The main findings in relation to these are summarised in Table 2 below and Renfrewshire Council management have agreed to implement the audit recommendations made in relation to each review: Table 2 Audit Area Conclusion Corporate Risk Management Reasonable Assurance This review was undertaken by an independent Consultant. They concluded that Renfrewshire Council has a well- established approach to risk management with many positive features, especially in terms of strong governance and a positive cultural attitude towards risk management at a corporate level. The overall risk maturity score was identified as 3.2 against a score of 4 which in the external consultant’s opinion would, in general, be the maximum realistic level they would expect to see for an organisation in the Council’s sector except in exceptional circumstances. The BAURAM (Business- as-usual risk assurance model © Renfrewshire Council) is an innovative and powerful approach which has been designed well and, like many other elements of Renfrewshire Council’s risk approach, is evidently subject to continuous improvement. To continue to grow risk management maturity, some opportunities were identified for further development and Renfrewshire Council may wish to focus on ensuring sufficient resources – both in terms of personnel and systems - are available to ensure risks are identified promptly, recorded consistently and therefore managed appropriately. Payroll Reasonable Assurance Payroll Run Processing procedures set out each stage of payroll process to be carried out by Payroll team members. Page 22 of 120
Page 27
- 4 - However, we identified a lack of evidence of some payroll checks and incomplete control account reconciliations which required management action. Treasury Management Reasonable Assurance Discussions are ongoing between Treasury supervisors and Purchase to Pay supervisors as to payment categories that would be more suitable for the Purchase to Pay team to administer instead of the Treasury team and it was recognised that these should be transferred across as soon as possible. In addition, a lack of segregation of duties was identified in that all users with Corporate Administrator and single authorisation access can currently request a payment and also authorise that payment themselves which required to be addressed. Other recommendations in relation to the authorisation of payments were made. Recruitment Reasonable Assurance Audit testing in the areas of the recruitment process after a preferred candidate has been chosen noted that generally target timescales were met for each part of the process and that where targets had not been met, these were followed up through management checking processes. It was also noted that although there are good monitoring and oversight arrangements in place, these could be improved by establishing Key Performance Indicators that could be reported at a higher level than the current processes dictate. 4. Review of Internal Audit Performance 4.1 Internal Audit produces regular reports on its performance during the year to the Renfrewshire Council, Audit, Risk and Scrutiny Board, against a range of measures set annually by the Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal Page 23 of 120
Page 28
- 5 - audit services. Table 3 shows the actual performance against targeted performance for the year. Table 3 Internal Audit Performance 2024/25 Performance measure Target 2024/25 Actual 2024/25 % of audit assignments completed by target date 95% 96.7% % of audit assignments completed within time budget 95% 98.4% % completion of audit plan for the year* 90% 93.6% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 4.2 The percentage completion of the audit plan was ahead of the target set for the year. It should be noted that the planned reviews for the RVJB for 2024/25 are 100% complete. The actual performance for the year for the two other indicators, is above the target performance level. 4.3 Since the retiral of the Chief Auditor in June 2024, the Asst Chief Auditor has been covering this post on an interim basis. Given that it was recognised that there may be resilience issues regarding internal audit and counter fraud staff in the future, discussions were undertaken with the Chief Financial Officers of two neighbouring councils which resulted in a considerable piece of work being undertaken during the year to explore a potential shared delivery model. It should be noted that the delivery of financial savings was not an objective of this exercise, and Renfrewshire Council’s Chief Financial Officer was committed to maintaining the current level of resource. 4.4 This work has been completed and it was concluded that it would not represent value for money to progress with the shared service proposal at this point due to the complexities of servicing a number of public bodies (Councils, Partners and Associated Bodies) under a single operational management structure with different systems, processes and working practices in place. This decision was agreed by members of Renfrewshire Council’s Finance, Resources and Customer Services Policy Board on 3 April 2025. The Council is now progressing to recruit a Chief Auditor on a permanent basis. 4.5 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 4.6 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process. Our most recent external assessment Page 24 of 120
Page 29
- 6 - was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and included 7 recommendations for improvement, all recommendations have now been completed. The annual internal self-assessment process has concluded that the internal audit service fully complies with the PSIAS during 2024/25. 4.7 We have commenced a self-assessment exercise against the new Global Internal Audit Standards in the Public Sector. Any actions identified will be implemented to ensure compliance. 4.8 The internal audit service through the Risk Manager, provides risk management advice and support to the RVJB officers, as required. 5. Planned Work for 2025/26 5.1 Following a risk-based assessment of the activities of the Renfrewshire Valuation Joint Board, the audit plan for 2025/2026 provides for a review of purchasing processes, preparation of an annual report, ad-hoc internal control advice, reactive investigative work and a follow-up of previous audits recommendations. 6. Audit Assurance Statement 6.1 Internal Audit has performed its work in accordance with the role defined in paragraph 1.2. The audit work performed has been reported to the Assessor and Electoral Registration Officer, and to the Board. Where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 6.2 In view of the continued challenges common to all public bodies, there will be a requirement for the council and the bodies for which it is host authority to exercise very close scrutiny over expenditure, over financial management and compliance with overarching governance arrangements, and this area will continue to receive due internal audit attention. 6.3 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 6.4 There are corporate systems and processes within Renfrewshire Council that the Renfrewshire Valuation Joint Board rely upon. It can be seen from Table 2 above that some actions were recommended to improve the processes in operation. Renfrewshire Council management has agreed to implement the recommendations made by internal audit, in relation to these reviews. In this context, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Renfrewshire Valuation Joint Board’s internal control, risk management and governance arrangements, as evidenced by: - Page 25 of 120
Page 30
- 7 - • The results of the audit work in 2024/25 in relation to the corporate systems which supported the Renfrewshire Valuation Joint Board’s activities, and to specific work carried out in relation to those activities. • Management action in response to audit recommendations. • Management’s self-assessment of internal control, risk management and governance arrangements. • The regular review and updating of the Local Code of Corporate Governance by the Council in accordance with the CIPFA/SOLACE framework for corporate governance requirements, and of the corporate governance arrangements within Renfrewshire Valuation Joint Board. Page 26 of 120
Page 31
AGENDA ITEM NO..... Scotland Excel To: Executive Sub-Committee On: 20 June 2025 Report by Chief Auditor INTERNAL AUDIT ANNUAL REPORT 2024/25 1. Summary 1.1 The Public Sector Internal Audit Standards in operation within 2024/25 require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of Scotland Excel’s internal control environment. 1.3 The Annual Report for Scotland Excel is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the Internal Audit Team, the main findings from the internal audit work undertaken in 2024/25 and contains an audit assurance statement. 2. Recommendations 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report. Page 27 of 120
Page 32
Page 28 of 120
Page 33
Scotland Excel Internal Audit Annual Report 2024/2025 Renfrewshire Council Internal Audit Page 29 of 120
Page 34
Scotland Excel Internal Audit Annual Report 2024/2025 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity during 2024/25 2 4. Review of Internal Audit Performance 3 5. Planned Audit Work for 2025/26 4 6. Audit Assurance Statement 6 Page 30 of 120
Page 35
- 1 - Scotland Excel Internal Audit Annual Report 1 April 2024 – 31 March 2025 1. Introduction 1.1 As host Authority, Renfrewshire Council provides an internal audit service to Scotland Excel. This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Chief Executive; • Delivery of the planned audit assignments; • Follow up of previous audit recommendations; • Provision of any ongoing advice and support on audit and risk management related matters; • Provision of an Annual Report and Assurance Statement, and presentation to elected members of Scotland Excel. 1.2 The Service operates in accordance with the Public Sector Internal Audit Standards (PSIAS) which were in place during 2024/25 and which defines Internal Audit’s role as: “......an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” 1.3 In line with the Standards, the purpose of this Annual Report is to report on: • The status/outcome of the planned Internal Audit reviews 2024/25 relating to Scotland Excel; • The outcome of Internal Audit reviews of supporting Renfrewshire Council corporate systems; • Internal audit performance; • Planned audit work for 2025/26; • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the organisation’s internal control environment. Page 31 of 120
Page 36
- 2 - 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of management to ensure that for the areas under their control there is an adequate and effective system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 2.3 The internal audit team ensured that independence and objectivity were maintained in line with the PSIAS which was in operation during 2024/25 including where non-audit work is undertaken. Internal auditors have no operational responsibilities. There have been no impairments impacting on the Chief Auditor’s independence and the team has been adequately resourced during the year. 3. Internal Audit Activity during 2024/25 3.1 The internal audit engagement reviewing the governance arrangements surrounding the Contract Delivery Plan is nearing completion and will be reported to management as soon as possible. The Contract Monitoring – Implementing Collaborative Procurement engagement was completed during the year and reported to the Executive Sub-Committee on 23 August 2024. The main finding in relation to this review is summarised in table 1 below: Table 1 Audit Area Conclusion Implementing Collaborative Procurement Substantial Assurance The audit identified that satisfactory arrangements are in place for member visibility of forthcoming Scotland Excel frameworks. Scotland Excel staff and processes encourage member participation in framework development to maximise usage and deliver benefits for all members. As a result, there were no audit findings identified during this review. 3.2 The Annual Report for 2024/25 was submitted to the Executive Sub-committee on 17 May 2025. Page 32 of 120
Page 37
- 3 - 3.3 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2024/25, there were no recommendations that required to be followed up. 3.4 Internal Audit also carried out reviews of the main corporate systems operating within Renfrewshire Council which support Scotland Excel’s activity. The main findings in relation to these are summarised in Table 2 below and Renfrewshire Council management have agreed to implement the audit recommendations made in relation to each review: Table 2 Audit Area Conclusion Payroll Reasonable Assurance Payroll Run Processing procedures set out each stage of the payroll process to be carried out by Payroll team members. However, we identified a lack of evidence of some payroll checks and incomplete control account reconciliations which required management action. Treasury Management Reasonable Assurance Discussions are ongoing between Treasury supervisors and Purchase to Pay supervisors as to payment categories that would be more suitable for the Purchase to Pay team to administer instead of the Treasury team and it was recognised that these should be transferred across as soon as possible. In addition, a lack of segregation of duties was identified in that all users with Corporate Administrator and single authorisation access can currently request a payment and also authorise that payment themselves which required to be addressed. Other recommendations in relation to the authorisation of payments were made. 4. Review of Internal Audit Performance 4.1 Internal Audit produces regular reports on its performance during the year to the Renfrewshire Council, Audit, Risk and Scrutiny Board, against a range of measures set annually by the Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal audit Page 33 of 120
Page 38
- 4 - services. Table 3 shows the actual performance against targeted performance for the year. Table 3 Internal Audit Performance 2024/25 Performance measure Target 2024/25 Actual 2024/25 % completion of audit plan for the year* 90% 93.6% % of audit assignments completed within time budget 95% 98.4%% % of audit assignments completed by target date 95% 96.7%% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 4.2 The percentage completion of the audit plan was ahead of the target set for the year. It should be noted that the planned reviews for Scotland Excel for 2024/25 are 100% complete. The actual performance for the year for the two other indicators, is above the target performance level. 4.3 Since the retiral of the Chief Auditor in June 2024, the Asst Chief Auditor has been covering this post on an interim basis. Given that it was recognised that there may be resilience issues regarding internal audit and counter fraud staff in the future, discussions were undertaken with the Chief Financial Officers of two neighbouring councils which resulted in a considerable piece of work being undertaken during the year to explore a potential shared delivery model. It should be noted that the delivery of financial savings was not an objective of this exercise, and Renfrewshire Council’s Chief Financial Officer was committed to maintaining the current level of resource. 4.4 This work has been completed and it was concluded that it would not represent value for money to progress with the shared service proposal at this point due to the complexities of servicing a number of public bodies (Councils, Partners and Associated Bodies) under a single operational management structure with different systems, processes and working practices in place. This decision was agreed by members of Renfrewshire Council’s Finance, Resources and Customer Services Policy Board on 3 April 2025. The Council is now progressing to recruit a Chief Auditor on a permanent basis. 4.5 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 4.6 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process. Our most recent external assessment was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and included 7 recommendations for improvement, all recommendations have been Page 34 of 120
Page 39
- 5 - completed. The annual internal self-assessment process has concluded that the internal audit service fully complies with the PSIAS. 4.7 We have commenced a self-assessment exercise against the new Global Internal Audit Standards in the Public Sector. Any actions identified will be implemented to ensure compliance. Risk Management 4.8 The internal audit service through the Risk Manager, provides advice and support to Scotland Excel officers, as required. 5. Planned Audit Work for 2025/26 5.1 Following a risk-based assessment of the activities of Scotland Excel and consultation with the Chief Executive, the following internal audit work has been agreed for 2025/26: • A review of the arrangements for delivering value to local government; • Follow up of previous audit work; • Ad-hoc internal audit and risk management advice. 6. Audit Assurance Statement 6.1 Internal Audit has performed its work in accordance with the role defined in paragraph 1.2. The audit work performed and completed has been reported to the Chief Executive and to the Executive Sub Committee. Where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 6.2 In view of the continued challenges common to all public bodies, there will be a requirement for the council and the bodies for which it is host authority to exercise very close scrutiny over revenue spending, over financial management and compliance with overarching governance arrangements, and this will continue to receive due internal audit attention. 6.3 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 6.4 There are corporate systems and processes within Renfrewshire Council that Scotland Excel rely upon. It can be seen from Table 2 above that some actions were recommended to improve the processes in operation. Renfrewshire Council management has agreed to implement the recommendations made by internal audit, in relation to these reviews. In this context, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of Scotland Excel Joint Committee’s internal control, risk management and governance arrangements, as evidenced by: - Page 35 of 120
Page 40
- 6 - • The results of the audit work in 2024/25 in relation to the corporate systems which supported Scotland Excel’s activities and to specific work carried out in relation to those activities. • Management action in response to audit recommendations. • Management self-assessment of internal control, risk management and governance arrangements. • The regular review and updating of the Local Code of Corporate Governance by the Council in accordance with the Chartered Institute of Public Finance and Accountancy and Society of Local Authority Chief Executives framework for corporate governance requirements, and of the corporate governance arrangements within Scotland Excel. Signed Interim Chief Auditor Date 20 June 2025 Page 36 of 120
Page 41
To: Renfrewshire Health and Social Care Integration Joint Board Audit, Risk and Scrutiny Committee On: 20 June 2025 Report by: Chief Internal Auditor Heading: Internal Audit Annual Report 2024/2025 1. Summary 1.1 The Public Sector Internal Audit Standards (PSIAS) which were in operation during 2024/25 requires that the Chief Internal Auditor must deliver an annual internal audit opinion, on the overall adequacy and effectiveness of the governance, risk management and internal control framework, that can be used by the organisation to inform its governance statement. 1.2 The purpose of this report is to advise the Committee of the Internal Audit Annual Report including the annual opinion. The Internal Audit Annual Report also outlines the internal audit work we have carried out for the year ended 31 March 2025 and provides details of the performance of Internal Audit. 1.3 The report attached, includes the Interim Chief Internal Auditor’s independent and objective opinion as to the adequacy and effectiveness of the internal control environment. In forming the opinion, the Interim Chief Internal Auditor has conducted a review of the Internal Audit reports issued to the IJB in the year and the internal audit annual report from Renfrewshire Council and internal audit progress reports from NHS Greater Glasgow and Clyde. 2. Recommendations 2.1 Members are asked to consider and note the contents of the IJB’s Internal Audit Annual Report for 2024/25. Page 37 of 120
Page 42
Implications of the Report 1. Financial - none 2. HR & Organisational Development - none. 3. Community Planning - none. 4. Legal - none. 5. Property/Assets - none. 6. Information Technology - none. 7. Equality & Human Rights - none 8. Health & Safety - none. 9. Procurement - none. 10. Risk - The report provides an opinion on the overall internal control environment including governance and risk management of the Integration Joint Board. 11. Privacy Impact - none. List of Background Papers – none. Author: Karen Campbell, Interim Chief Internal Auditor Page 38 of 120
Page 43
Renfrewshire Integration Joint Board Internal Audit Annual Report 2024-2025 June 2025 Page 39 of 120
Page 44
Page 40 of 120
Page 45
Renfrewshire Integration Joint Board Internal Audit Annual Report 2024/2025 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2024/25 2 4. Review of Internal Audit Performance 2 5. Planned Audit Work for 2025/26 3 6. Audit Assurance Statement 4 Appendix 1 – Summary of Assurances 6 Page 41 of 120
Page 46
- 1 - Renfrewshire Integration Joint Board Internal Audit Annual Report 1 April 2024 – 31 March 2025 1. Introduction 1.1 Renfrewshire Council provides an internal audit service to the Renfrewshire Integration Joint Board (IJB). This includes: • The compilation of an annual audit plan following consideration and evaluation of those areas of greatest risk in the organisation’s operation, and consultation with the Chief Officer and Senior Management; • Delivery of the planned audit assignments; • Follow up of previous audit recommendations; • Provision of any ongoing advice support and training on audit and risk related matters; • Provision of an Annual Report and Assurance Statement to the IJB. 1.2 The Service operates in accordance with the Public Sector Internal Audit Standards for 2024/25 which defines Internal Audit’s role as: “......an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” 1.3 In line with the Standards, the purpose of this Annual Report is to report on: • The outcome of the planned Internal Audit reviews 2024/25 relating to the IJB; • The outcome of Internal Audit reviews undertaken by partner bodies; • Internal audit performance; • Planned audit work for 2025/26; • The annual assurance statement which provides an opinion on the overall adequacy and effectiveness of the IJB’s internal control environment. 1.4 The operational delivery of services within the Health Board and Local Authority on behalf of the Integration Joint Board will be covered by their respective internal audit arrangements. In concluding on the overall opinion, the Interim Chief Internal Auditor has conducted a review of the internal audit reports issued to the IJB in the year, the internal audit annual report from Renfrewshire Council and progress summaries from NHS Greater Glasgow and Clyde. (Appendix 1) Page 42 of 120
Page 47
- 2 - 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of management to ensure that the areas under their control are adequate and effective and that there is a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal Audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal Audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3. Internal Audit Activity during 2024/2025 3.1 The Internal Audit Plan for the IJB for 2024/2025 provided for a review of the financial planning arrangements and the annual review of the adequacy and compliance with the Local Code of Corporate Governance. Both of these reviews were reported to the IJB Audit, Risk and Scrutiny Committee in March 2025. 3.2 The Annual Report for 2023/2024 was submitted to the Integration Joint Board on 21 June 2024. 3.3 The implementation rate of audit recommendations is a measure of operational culture and effectiveness. During 2024/25, seven recommendations were followed up, six recommendations have been fully implemented and 1 was superseded as a result of a process change. 4. Review of Internal Audit Performance 4.1 Internal Audit produces regular reports on its performance during the year to Renfrewshire Council’s Audit, Risk and Scrutiny Board, against a range of measures set annually by Renfrewshire Council’s Director of Finance and Resources. These targets are set for all internal audit engagements and include Renfrewshire Council and other associated bodies, for which the team provides internal audit services. Table 1 shows the actual performance against targeted performance for the year. Table 1 Internal Audit Performance 2024/25 Performance measure Target 2024/25 Actual 2024/25 % completion of audit plan for the year* 90% 93.6% % engagements completed by target date 95% 96.7% % engagements completed within time budget 95% 98.4% Page 43 of 120
Page 48
- 3 - * This measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 4.2 The percentage completion of the audit plan is ahead of the target set for the year. In addition, the actual performance for the year for the two other indicators, is above the target performance level. It should be noted that the Internal Audit Plan for the IJB for 2024/25 is 100% complete. 4.3 Since the retiral of the Chief Auditor in June 2024, the Asst Chief Auditor has been covering this post on an interim basis. Given that it was recognised that there may be resilience issues regarding internal audit and counter fraud staff in the future, discussions were undertaken with the Chief Financial Officers of two neighbouring councils which resulted in a considerable piece of work being undertaken during the year to explore a potential shared delivery model. It should be noted that the delivery of financial savings was not an objective of this exercise, and Renfrewshire Council’s Chief Financial Officer was committed to maintaining the current level of resource. 4.4 This work has been completed and it was concluded that it would not represent value for money to progress with the shared service proposal at this point due to the complexities of servicing a number of public bodies (Councils, Partners and Associated Bodies) under a single operational management structure with different systems, processes and working practices in place. This decision was agreed by members of Renfrewshire Council’s Finance, Resources and Customer Services Policy Board on 3 April 2025. The Council is now progressing to recruit a Chief Auditor on a permanent basis. 4.5 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 4.6 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process. Our most recent external assessment was reported to the Council’s Audit, Risk and Scrutiny Board in May 2023 and included 7 recommendations for improvement, all recommendations have been completed. The annual internal self-assessment process has concluded that the internal audit service fully complied with the PSIAS during 2024/25. 4.5 A self-assessment exercise against the new Global Internal Audit Standards is nearing completion. Any actions identified will be implemented to ensure compliance. 5. Planned Work for 2025/26 5.1 Following a risk-based assessment of the activities of the IJB and consultation with the senior management team, the Internal Audit Plan for 2025/26 provides for 40 days of Internal Audit resource to undertake: • A review of strategic planning; and • The annual review of the adequacy and effectiveness of the Local Code of Corporate Governance. Page 44 of 120
Page 49
- 4 - 5.2 The plan also provides time for planning and reporting, follow up on previous recommendations, the annual self-assessment of the Audit Committee arrangements, ad-hoc advice, consultancy and training. The Internal Audit Plan for 2025/26 was approved by the IJB Audit, Risk and Scrutiny Committee on 14 March 2025. 6. Audit Assurance Statement 6.1 The audit work performed in relation to the 2024/25 internal audit plan has been reported to the Chief Officer and the Audit, Risk and Scrutiny Committee. Relevant audit work undertaken by partner organisations is reported to their respective Audit Committees. Where areas for improvement in internal control have been identified, appropriate recommendations have been made and accepted for action by management. 6.2 There are no significant matters arising in relation to those audit engagements specific to the IJB and there have been no impairments impacting on the Chief Auditor’s independence and the team has been sufficiently resourced during the year to undertake the planned assignments. 6.3 In view of the continued challenges common to all public bodies, there will be a requirement for the IJB and its partners to exercise close scrutiny over expenditure, over financial management and compliance with overarching governance arrangements, and this area will continue to receive due internal audit attention. 6.4 It is not realistic for the system of internal control to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal Audit recognises this and assesses this in its reporting mechanism. 6.5 There are corporate systems and processes within Renfrewshire Council and NHS Greater Glasgow and Clyde that the IJB rely upon. It can be seen from Appendix 1, that some of these processes require to be improved to provide a reasonable level of assurance. 6.6 In this context, it is considered that a reasonable level of assurance can be placed upon the adequacy and effectiveness of the Integration Joint Board’s internal control, risk management and governance arrangements, as evidenced by:- • The results of the audit work in 2024/25 and the opinion’s contained in the Internal Audit Annual Reports of the Local Authority and progress reports from the Health Board. • Management self-assessment of internal control, risk management and governance arrangements. • Management action to respond to audit recommendations. Page 45 of 120
Page 50
- 5 - Karen Campbell Interim Chief Internal Auditor 20 June 2025 - Page 46 of 120
Page 51
- 6 - Appendix 1 Summary of Internal Audit Assurances for the IJB and Partner Organisations, Renfrewshire Council and NHS Greater Glasgow and Clyde Integration Joint Board Audit Engagement Assurance Level Significant Matters Local Code of Corporate Governance Substantial • None Financial Planning Reasonable • The arrangements in place in Renfrewshire Integrated Joint Board for financial planning were found to be robust and regular in-depth monitoring processes are in operation. At the time of the review, the updated medium term financial plan had not been finalised. This has now been approved in March 2025. Renfrewshire Council Audit Engagement Assurance Level Significant Matters Transportation and Fleet – External Vehicle Hire Processes Limited • No documented guidance was available to follow when requesting a vehicle and the ordering process for obtaining vehicles from Suppliers was unsatisfactory. Management agreed to action the audit recommendations. Recruitment – Processes after Interview Reasonable • None Eclipse Application Review Substantial • None ERP Utilisation Reasonable • None Corporate Risk Management Reasonable • To continue to grow risk management maturity, Renfrewshire Council may wish to focus on ensuring sufficient resources – both in terms of personnel and systems - are available to ensure risks are identified promptly, recorded consistently and therefore managed appropriately. Management are currently implementing the recommendations. Payroll Reasonable • There was a lack of evidence of some payroll checks and incomplete control account reconciliations which require management action. This is being addressed by Management Treasury Management Reasonable • Segregation of duties for banking transactions and checking processes for payment requests required to be reviewed. This has now been addressed. NHS Greater Glasgow and Clyde Page 47 of 120
Page 52
- 7 - Audit Engagement Overall Audit Rating Significant Matters Performance Monitoring Minor Improvement Required • None Financial Management and Reporting Minor Improvement Required • None Waiting List Management Minor Improvement Required • None Digital Health & Care Strategy Effective • None Discharge Planning Minor Improvement Required • There was a need to ensure that oversight and governance arrangements are strengthened to support prompt identification and resolution of issues of non-compliance with the Discharge Policy. Management agreed to incorporate this action into their improvement plans. Property Transaction Monitoring Effective • None Sustainability and Value Programme Substantial improvement required • Action was required to reduce the level of unallocated savings and variable working practices were identified for action planning how identified savings were going to be achieved. Management agreed to implement the audit recommendations Hospital Discharges (Patients Requiring Social Work Support) Substantial improvement required • The Discharge Policy was being inconsistently applied which was increasing the likelihood of delays in referrals to HSCPs, Social Work and Home Care. Management agreed to take action and monitor its implementation. Cyber Security Remote Access Minor improvement required • None Waiting List Management (Psychological Therapy and Drug and Alcohol teams) Minor improvement required • There was not a Board-wide policy in place that sets out the expected arrangements for management and reporting of ADRS waiting lists across NHSGGC as these are currently managed separately in each HSCP area. Management agreed to address this issue Page 48 of 120
Page 53
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring 0 Introduction Audit Opinion Main Findings Action Plan Will Glasgow City Region City Deal Financial Monitoring Phase 2 Final Report May 2025 FS 57095 Page 49 of 120
Page 54
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring Phase 2 1 Introduction Audit Opinion Main Findings Action Plan 1 Introduction 1.1 As part of the agreed Internal Audit plan, we have carried out a review of the financial monitoring arrangements in place across the Glasgow City Region City Deal Programme. 1.2 The Glasgow City Region Project Management Office (PMO) is responsible for the financial monitoring and reporting for the overall City Deal programme. The role of the PMO includes collating the project status updates from all member authorities and reporting to various senior officer groups and the Cabinet. Given the current financial pressures faced by all member authorities and the external factors that may impact the progression of City Deal projects, it is essential to ensure that financial monitoring and reporting are conducted effectively and in line with expected timescales. This remains crucial for highlighting any key issues as soon as possible. 1.3 The purpose of the audit was to gain assurance that there are adequate controls in place covering financial monitoring and reporting carried out by the PMO and member authorities, and that these are operating effectively. The scope of the audit included: • Documented procedures, roles and responsibilities. • The financial monitoring process and reporting to Cabinet. • The process for identifying variances. • The arrangements and approval processes for the amendments of budgets. • The year-end processes. • The internal monitoring processes and arrangements for reporting to the PMO. • The escalation processes in place. 1.4 This report outlines the findings from the second phase of the review, which focused on the financial monitoring arrangements of the remaining four member authorities: • Glasgow City Council • Renfrewshire Council • West Dunbartonshire Council • South Lanarkshire Council The other four member authorities were reviewed as part of Phase 1 of this audit, undertaken in 2023/24. Page 50 of 120
Page 55
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring Phase 2 2 Introduction Audit Opinion Main Findings Action Plan 2 Audit Opinion 2.1 Based on the audit work carried out, assurance can be taken that the control environment is satisfactory. 3 Main Findings 3.1 We are pleased to report that key controls are in place and operating effectively. Guidance on the financial monitoring requirements for City Deal projects is available to the member authorities included in the Phase 2 review. This is through the ‘Assurance Governance and Programme Management Framework’ (the Framework) and the supporting Project Management Toolkit. The PMO continues to hold responsibility for updating both documents, and an annual schedule for reviewing and approving changes has been established. We were advised by senior officers within the PMO, that a full review of both documents is planned to be finalised and submitted to Cabinet for approval in May 2025. 3.2 The PMO has appropriate arrangements for the development and approval of the annual PMO budget, as confirmed during the Phase 1 review. For Phase 2, we verified that there have been no changes to these arrangements and were provided with up-to-date evidence to ensure that these remain satisfactory. Regular budget monitoring continues to be conducted as expected, with the overall financial position reported to Cabinet as part of the Quarterly Programme Report. 3.3 In accordance with the Framework, we found that, consistent with the findings from the Phase 1 review, the four remaining member authorities also provide the PMO with the expected quarterly updates. These are in the form of Project Status Reports, which detail progress of their projects, including financial information regarding expenditure, claims and projected cashflows. We found satisfactory budget monitoring processes are in place, to identify budget variances and allow adequate review of their project(s) financial positions through established reporting arrangements. 3.4 Adequate arrangements are in place to ensure that scrutiny by relevant senior management and committees is conducted in line with the agreed timescales. We found that there are adequate processes for collating financial data for reporting to the PMO, and we noted a positive working relationship between the PMO and member authorities, which includes regular meetings prior to the submission of the quarterly returns. 3.5 The four member authorities included in Phase 2 adhere to the established change control process for budget amendments. Each member authority has satisfactory Page 51 of 120
Page 56
Glasgow City Council Internal Audit | Glasgow City Region City Deal | Financial Monitoring Phase 2 3 Introduction Audit Opinion Main Findings Action Plan arrangements in place regarding the escalation and approval routes of internal change control requests, as well as for submissions to the PMO as part of the quarterly Project Status Report. This ensures that any changes are approved or rejected at the appropriate programme level. The PMO continues to maintain a central register of all approved change control requests across the Region. 3.6 The audit has been undertaken in accordance with the Public Sector Internal Audit Standards. 3.7 We would like to thank officers involved in this audit for their cooperation and assistance. 3.8 It is recommended that the Cabinet note the content of this report. Page 52 of 120
Page 57
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 August 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit and Counter Fraud Progress and Performance for Period to 30 June 2025 ___________________________________________________________________ 1. Summary 1.1 The Internal Audit Annual Plan was approved by the Audit, Risk and Scrutiny Board on 17 March 2025. Internal Audit measures the progress and performance of the team on a regular basis using a range of performance indicators. This report monitors progress from 1 April 2025 to 30 June 2025, in terms of the delivery of the Audit Plan for the year and compares actual performance against targets set by the Director of Finance and Resources. 1.2 In terms of Counter Fraud, no formal performance targets for fraud investigation have been established for the following reasons. Part of their work involves being the single point of contact (SPOC) for the Department for Work and Pension’s (DWP) Single Fraud Investigation Service and the Service Level Agreement for this work contains time targets for completing this work. The types of fraud referrals received to date are wide ranging and the team’s objective is to concentrate on investigating those referrals considered to contain the greatest fraud risk. They are also involved in promoting fraud awareness and assisting with the implementation of adequate fraud prevention measures within the Council. 1.3 We also provide advice and support where necessary to council services. Item 3 Page 53 of 120
Page 58
1.4 The report details progress against local and national initiatives involving Internal Audit and the Counter Fraud Team from 1 April 2025 to 30 June 2025. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to note the Internal Audit and Counter Fraud Team progress and performance to 30 June 2025. _________________________________________________________ 3. Background 3.1 The progress and performance of the Internal Audit Team is subject to regular monitoring using a number of performance measures. The Director of Finance and Resources has set annual targets for the team to demonstrate continuous improvement. In terms of the Counter Fraud team, there are time targets in place for responding to requests from the DWP’s Single Fraud Investigation Service. Due to the diverse nature of fraud referrals no formal performance targets have been established and the outcomes from investigations are regularly monitored by management. In addition, the Counter Fraud Team are heavily involved in fraud prevention measures within the Council. 3.2 Internal Audit and the Counter Fraud Team support a variety of local and national initiatives through participation in professional practitioner groups and co-ordination of national initiatives such as the National Fraud Initiative. 3.3 This report measures the progress and performance of both the Internal Audit and Counter Fraud Team for the period from 1 April 2025 to 30 June 2025. 4. Internal Audit Resource 4.1 The Risk Management and Insurance Service are in the process of moving to Business Services. On 06/08/25, the recruitment process for a permanent Chief Auditor was completed and the Assistant Chief Auditor has been offered the post. 5. Internal Audit Team Performance (a) Percentage of audit plan completed as at 30 June 2025 This measures the degree to which the Audit Plan has been completed. Page 54 of 120
Page 59
Actual 2024/25 Annual Target 2025/26 Audit Plan Completion Target to 30 June 2025 Audit Plan Completion Actual 30 June 2025 93.6% 90.0% 18% 17.6% The current audit plan completion indicator is slightly below target as a result of a vacancy in the team and also as a result of additional counter fraud duties due to vacancy in this team. These vacancies will be addressed when a permanent Chief Auditor is appointed. (b) Percentage of assignments complete by target date This measures the degree with which target dates for audit work have been met. Target 2025/26 Actual to 30 June 2025 95.0% 100% Actual performance is ahead of the target set for the year. (c) Percentage of audit assignments completed within time budget This measures how well the time budget for individual assignments has been adhered to. Target 2025/65 Actual to 30 June 2025 95.0% 100% Actual performance is ahead of the target set for the year, although this could reduce over the remainder of the year. (d) Percentage of audit reports issued within 6 weeks of completion of audit field work This measures how quickly draft audit reports are issued after the audit fieldwork has been completed. Target 2025/26 Actual to 30 June 2025 95.0% 100% Actual performance is ahead of the target set for the year, although this is likely to reduce over the remainder of the year. 6. Review of the 2025/26 Internal Audit Plan 6.1 Our main focus this quarter has been on the completion of last years audits which were carried forward. It is planned to have these fully completed by 30 September 2025. 6.2 We have commenced our 2025/26 Audit Plan and this is subject to ongoing review in light of any organisational risks arising, and also to Page 55 of 120
Page 60
determine whether any assignments will have to be amended or cancelled as result of us being unable, for any reason, to undertake the work planned. At this stage we are not recommending any further amendments to the plan. 6.3 Although a vacancy factor was built into the Audit Plan, this may result in assignments being completed later than planned and therefore progress will continue to be closely scrutinised by management. 6.4 Any proposed amendments to the audit plan will be brought to this Board for approval. 7 Counter Fraud Team Progress and Performance 7.1 In line with the Service Level Agreement, the Counter Fraud Team act as the Single Point of Contact (SPOC) to route potential housing benefit fraud referrals to the DWP, liaise with the Council’s Housing Benefit Team and DWP Fraud Officers and retrieve the necessary evidence for the DWP Fraud Officers from the Housing Benefit System. Where a suspicion of fraud arises, the team investigate and report their findings to management. Where appropriate, follow-on action is taken, such as reporting the matter to Police Scotland for further investigation, or directly to the Procurator Fiscal. In addition, they also work jointly with DWP Fraud Officers on criminal fraud investigations which focuses on the investigation and prosecution of the Local Authority administered Council Tax Reduction Scheme and Social Security benefit fraud. In addition to investigation work the team also undertake fraud prevention work. 7.2 During this quarter, we still have a member of staff on long term unplanned leave. As a result, some of the supervisory duties have been allocated to the Internal Audit team. We have been working on the various fraud referrals and continuing to process the National Fraud Initiative matches which have been received. In June 2025, additional matches were received that includes data from HMRC and we have commenced risk assessing these. A full report on the results of the National Fraud Exercise will be brought to this Board for information at a later date. 7.3 As part of our fraud prevention work, we are continuing to validate the numerous bank account or remittance contact changes received from the Council’s suppliers and contractors and the details supplied by new Housing Applicants. 7.4 The financial and non-financial results for the period (April 2025 to June 2026) are noted in the table below. Page 56 of 120
Page 61
Financial Outcomes Period to 30 June 2025 (£) Cash savings directly attributable to preventative counter fraud intervention 1,300 Cash recoveries in progress directly attributable to counter fraud investigations 25,696 Notional savings identified through counter fraud investigation, (e.g. housing tenancy and future council tax) 117,702 Housing Benefit Savings Attributable to Joint Working by Counter Fraud and DWP Counter Fraud Officers 0 Other DWP Benefit or Tax Credit Savings identified through other Counter Fraud work or through joint working with DWP 3,731 Non-Financial Outcomes Period to 30 June 2025 Housing properties recovered 1 Housing applications amended/cancelled 2 Housing Allocation Priority Changed 0 Blue badge misuse warning letters issued 7 Blue Badges Cancelled 2 Supplier/Contractor Checks Undertaken 80 7.5 Our notional savings are based on the methodology prepared by the Cabinet Office. 8. Local and National Initiatives Scottish Local Authorities Chief Internal Auditors Group 8.1 The Local Authorities Chief Internal Auditors Group conference, ‘Connections, Collaborations, Catalysts’ was held in June 2025 and was well attended. Various presentations by external parties and workshops were given, covering a range of topics such as the Important Role of Internal Audit in challenging times and building a sustainable workforce, overview of Organisations Assurance Frameworks, Cyber Security and Artificial Intelligence. 8.2 The Annual Report of this group is attached at Appendix 1. The Vision of SLACIAG is set out in the Introduction and the remainder of the report provides an overview of its work throughout the year. Page 57 of 120
Page 62
Scottish Local Authorities Investigation Sub-Group 8.3 The Local Authorities Investigation Sub-Group also met in June and there was a presentation and discussion on employment fraud which appears to be on the increase throughout the public sector. National Fraud Exercise 8.4 Counter Fraud and Service Staff are working on the matches received from this data matching exercise A full report on the results of the National Fraud Exercise will be brought to this Board for information at a later date. Information Security Group 8.5 The Information Security Group, chaired by the Chief Auditor and attended by the Senior Managers from Information Governance, information Management and Cyber Security teams met in April 2025 and discussed current topical issues such as information security incidents, artificial intelligence applications risk and cyber security. _________________________________________________________ Implications of the Report 1. Financial - The Council has in place arrangements to recover the any overpayments identified from the work of the Counter Fraud Team and the National Fraud Initiative. 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None Page 58 of 120
Page 63
10. Risk - The progress and performance reported relates to the delivery of the risk-based internal audit plan and the mitigation of the risk of fraud and error. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights - None ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor – 07768354651 Page 59 of 120
Page 64
Appendix 1 1 ANNUAL REPORT FROM THE CHAIR – 2024 “WORKING TOGETHER TO SUPPORT THE KEY ROLE OF INTERNAL AUDIT” 1. INTRODUCTION 1.1 Membership of the CIPFA Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG) is open to the chief internal auditor from each Scottish local authority and the Strathclyde Partnership for Transport (SPT). SLACIAG is a Special Interest Group of CIPFA in Scotland, with operational arrangements, vision, and objectives set out in a formal Constitution. 1.2 SLACIAG’s Vision is to be the voice of internal audit across Scottish local authorities and a driving force for best practice in respect of local authority and public transport bodies internal audit, governance, and operations. 1.3 In support of that Vision, SLACIAG has the following objectives: • Secure a quality and responsive service for members of the group. • Develop the influence of the group with key decision makers and institutions in Scotland, as the key representative body for internal audit in local government with a particular emphasis on governance, risk, control and assurance matters. • Strengthen links and build long term relationships across the internal audit community within the public service. • Provide an effective group for the discussion of issues of common concern, sharing of good practice and commissioner of work to develop advanced practice. • Consider the development and training needs of our people as a collective to ensure that the best available products are procured at the best price. • Uphold the group’s key values, including: respect; openness and honesty; adding value; professional team working; sharing best practice; integrity; continuous improvement. 1.4 The purpose of this annual report to key stakeholders is to provide an update on SLACIAG’s activities and achievements over the course of 2024 and to recognise actions required to achieve its Vision. 1.5 SLACIAG has two long-established sub-groups whose activity is reflected in this report: • the Computer Audit Sub-Group (CASG); and • the Scottish Local Authorities Investigators’ Group (SLAIG). 1.6 Further sub-groups were established by SLACIAG in 2023 to lead on development actions arising from the SLACIAG Conference held in June 2023 within specific themes, including risk, data analytics, resourcing, and sustainability/climate change. Their activity in 2024 is also reflected in this report. Page 60 of 120
Page 65
2. MANAGEMENT COMMITTEE 2.1 I, Jill Stacey, Scottish Borders Council, was appointed as Chair of SLACIAG at the AGM in March 2024, continuing as Chair following a 2-year term during 2022-2023 to facilitate succession planning within the Management Committee. I previously served as Chair of SLACIAG during 2014-2015. In accordance with SLACIAG’s Constitution, my term of office will expire after serving 2 years at the SLACIAG AGM in March 2026. The Chair of SLACIAG joins the meetings of the CIPFA Scotland Branch Executive Committee, as SLACIAG is a special interest group of CIPFA in Scotland. 2.2 Yvonne Douglas, South Lanarkshire Council, was re-elected as Treasurer of SLACIAG at the AGM March 2024 having initially been appointed to the role in June 2020. Yvonne provided regular updates on the financial position of SLACIAG to enable the Management Committee to plan activity. 2.3 The appointments to the SLACIAG Management Committee were approved at the AGM March 2024. New members were welcomed to the Management Committee, including each sub-group Lead to ensure all sub-groups were represented. The Chairs of both CASG and SLAIG participate in the Management Committee meetings to derive benefits from their sectoral expertise and to ensure synergy when forward planning the regular meetings. 2.4 The same membership has continued during 2024, as follows: SLACIAG MANAGEMENT COMMITTEE 2024 Jill Stacey Scottish Borders Council Chair SLACIAG Yvonne Douglas South Lanarkshire Council Treasurer SLACIAG Pamela Redpath Fife Council Member; Lead for EQA and Risk Sub-Groups Gillian McConnachie East Dunbartonshire Council Member Duncan Stainbank East Lothian Council Member; Lead for Sustainability/ Climate Change Sub-Group Duncan Black Glasgow City and Shetland Islands Councils Member; Lead for Data Analytics Sub-Group Gordon O’Connor Stirling Council Member; EQA Moderation Panel Jamie Dale Aberdeenshire and Aberdeen City Councils Member Laura Calder City of Edinburgh Council Member; Lead for Resourcing Sub-Group Paul Brown East Dunbartonshire Council Chair CASG Barry Moncur East Dunbartonshire Council Chair SLAIG 2.5 There were Management Committee virtual meetings held in April, May, August and October 2024. The purpose of these meetings was to forward plan SLACIAG and Sub-Group meetings, considering topics, setting dates and arranging speakers. 2.6 The Management Committee also oversees the External Quality Assessment (EQA) process, which is a peer review process established by SLACIAG to enable external validation of compliance with the Public Sector Internal Audit Standards (PSIAS). The Management Committee monitors progress with completion against a recommended programme of reviews each year to ensure that all participating organisations comply with the requirement to undertake an EQA once every 5 years. Page 61 of 120
Page 66
3. SCOTTISH LOCAL AUTHORITIES’ CHIEF INTERNAL AUDITORS GROUP (SLACIAG) SLACIAG Meetings 2024 3.1 There were four SLACIAG virtual meetings in 2024 with topics/speakers set out in the table below in addition to core business. The network continues to be strongly supported by members with a focus on significant and current issues. Date Topics / Speakers 15 March 2024 AGM • SLACIAG Annual Report 2023 (Chair) • SLACIAG Constitution (Chair) • SLACIAG Annual Accounts 2023 (Treasurer) • SLACIAG Subscriptions • Election of Officers Bearers CIPFA Technical Update • Naomi Whitmore, Public Finance Technical Adviser, CIPFA Assurance arrangements on Housing Benefit Subsidy Claims in Scotland • John Cornett, Audit Scotland Fraud Benchmarking in Scotland - SLAIG • Barry Moncur, East Dunbartonshire Council, Chair of SLAIG, and Carol Cleland, Renfrewshire Council 07 June 2024 Director of Finance perspective on Financial Sustainability and the role of Internal Audit • Jamie Robertson, Executive Officer for Finance & Digital Services, East Dunbartonshire Council (Chair of CIPFA Directors of Finance forum) 20 September 2024 Strategic Workforce Risks – Best Value area of focus Workforce Innovation • John Cornett and Blyth Deans, Audit Scotland Financial Sustainability indicators within LGBF • Website demo by Emily Lynch, Improvement Service New Global Internal Audit Standards • Andrew Paterson, EQA Sub-Group and Orkney Islands Council on behalf of Pamela Redpath, EQA Sub-Group Lead and Fife Council 6 December 2024 Strategic Workforce Risks – ‘Building a Sustainable Scottish Local Government Workforce for the Future’ and overview of the Improvement Service “Local Government Workforce Report 2024” • Amanda Spark, Improvement Service New CIIA Global Internal Audit Standards (GIAS), IASAB Application Note for GIAS in UK Public Sector, and CIPFA Code of Practice for Governance of Internal Audit in Local Government • Jill Stacey, SLACIAG Chair and Scottish Borders Council, and Pamela Redpath, EQA Sub-Group Lead and Fife Council Page 62 of 120
Page 67
3.2 The Treasurer produced the 2023 annual accounts, which were considered in draft by the Group at the AGM in March 2024. Thanks to those at South Ayrshire Council for completing the independent audit of the 2023 Accounts. Thanks to Yvonne for her professionalism in fulfilling the Treasurer role and providing regular updates during 2024 on the financial position of SLACIAG which is important to ensure the Group remains financially sustainable. 3.3 A report on behalf of the Management Committee was issued to members containing an analysis of the benefits of SLACIAG membership, benchmarking with some other professional bodies’ subscription fees, and a proposal on subscriptions for 2025 which was approved. External Quality Assessment (EQA) 3.4 There continued to be challenges for the completion of the EQA2 schedule including staff resourcing issues in Councils, knock-on effect of delays during the pandemic response and recovery periods, and conflicts of interest arising from increased Internal Audit shared services arrangements. Responsibility is on the reviewee Council CAE to meet EQA requirements and to keep their Audit Committee informed of any delays in meeting the 5-year timeframe. 3.5 The EQA Sub-Group members set out below have been active in 2024 to oversee the completion of the EQA2 schedule and to plan the EQA3 schedule. The draft schedule of EQA3 peer reviews (involves 29 Councils with 21 CAEs due to shared services arrangements) was approved. The vacancy on the Moderation Panel is not deemed to be a significant resourcing issue currently. EQA Sub-Group Moderation Panel Pamela Redpath Fife Council Paul MacAskill Argyll & Bute Council Andrew Paterson Orkney Islands Council Gordon O’Connor Stirling Council Cecilia McGhee South Ayrshire Council vacancy 3.6 The new Global Internal Audit Standards in the UK Public Sector (GIAS), which incorporate the CIIA Global Internal Audit Standards, IASAB Application Note for the UK Public Sector, and CIPFA Code of Practice for the Governance of Internal Audit in Local Government, will have implications for the SLACIAG EQA3 Peer Review Process and Templates. These will be updated by the EQA Sub-Group. Sub-Groups 3.7 At each of the quarterly SLACIAG meetings during 2024 updates were received from the Sub-Groups in accordance with their respective terms of reference to derive significant benefits from them. 3.8 The Data Analytics Group has had four virtual workshops during 2024 coordinated by GCC team. There has been good participation as an opportunity to share practices, insights, data set examples, data analytics strategies, etc. to improve our Digital Skills within our Internal Audit teams and beyond. 3.9 The Resourcing Group met virtually three times in 2024 to discuss all matters on resourcing our teams including recruitment, succession planning, training, soft skills, ways of working, and mentoring. 3.10 The Sustainability / Climate Change Group shared the Internal Audit Programme on Climate Change Strategy that it had developed, linked to new statutory guidance that is being developed by Sustainable Scotland Network in collaboration with SLACIAG and Audit Scotland on the Role of Audit. 3.11 The Risk Group expanded its small membership to share practice within its approved Terms of Reference and to progress risk benchmarking through use of risk management maturity models. SLACIAG Knowledge Hub 3.12 All Agendas, Minutes, and Presentations of SLACIAG meetings, Conference, EQA Framework Guidance, and other relevant documents are uploaded to the SLACIAG Knowledge Hub to enable access by all members in a secure way. New Members have been registered on the SLACIAG Knowledge Hub, including new starts from within audit teams of Councils, thus enabling greater participation. Page 63 of 120
Page 68
4. COMPUTER AUDIT SUB-GROUP 4.1 The main aim of the Computer Audit Sub-Group (CASG), which is a permanent sub-group of SLACIAG, is to provide a forum to share and discuss computer audit practices and developments. This includes raising awareness of new standards, updates to legislation, new and current topics of interest, and computer audit developments, resources, and techniques. 4.2 The Computer Audit Sub-Group (CASG) met two times in 2024, all meetings were virtual, with topics/speakers as follows in addition to core business: Date Topics / Speakers 29 May 2024 Cyber Threats and the Role of a Security Operation Centre (SOC) - A presentation of the current threats that organisations are facing and the importance of having a SOC in mitigating the effects of such attacks. • Paul Cullimore, Quorum Cyber Business Continuity Audit – A summary of issues noted as part of a recently completed audit. • Yvonne Trundle, North Ayrshire Council 09 October 2024 Power BI – A presentation and walkthrough of examples of the uses of Power BI in a Local Authority. • Hunter Dallas, South Lanarkshire Council Ransomware Attack, Western Isles Council – Presentation to provide an overview of the attack that occurred in 2023, and any lessons learned. • Malcolm Nicol, Western Isles Council 4.3 This year has seen a change in the constitution of the Group, with a new Chair and Secretary taking up their roles in the second half of the year, to ensure the sustainability of the sub-group. The participation in the group remains good. 4.4 Within the SLACIAG Annual Report 2023 reference was made to expanding the role and outputs of CASG to cover, for example, Digital Transformation, Artificial Intelligence (AI), and IT/Cyber Security, in addition to core Computer Audit work. This is still under consideration and would involve a change to the Terms of Reference of the Group. In the first instance, 3 topics were suggested: · Shared Learning from the Western Isles Council from a ransomware attack · Cyber Security Maturity Assessment – tools and role of Internal Audit · Contracts via the Local Authority IT Security Group 4.5 The first topic has been covered with an informative presentation given to the group by the Western Isles Council in October 2024. The Group has had discussions with respect to the maturity assessment and further work is planned in 2025, as is increasing communication with the Local Authority IT Security Group. Furthermore, a presentation covering Artificial Intelligence is planned for April 2025. 4.6 Due to the changes in the constitution of the group some Agendas, Minutes, and Presentations for CASG meetings 2024 are still to be uploaded to the SLACIAG Knowledge Hub (CASG sub-folder) to enable access by all members in a secure way. This will be updated in the coming months as well as improving oversight of each Council’s ICT audit plans during 2025. Page 64 of 120
Page 69
5. SCOTTISH LOCAL AUTHORITY INVESTIGATORS GROUP (SLAIG) 5.1 The main aim of the Scottish Local Authority Investigators Group (SLAIG), which is a permanent sub- group of SLACIAG, is to provide a forum to share and discuss counter fraud practices and developments. This includes raising awareness of updates to legislation, new and current topics of interest, and developments in counter fraud activities. 5.2 The Scottish Local Authority Investigators Group (SLAIG) met four times in 2024, all meetings bar one were virtual, with topics/speakers as follows in addition to core business: Date Topics / Speakers 20 March 2024 Presentation on Scotland Excel information sharing, artificial intelligence, and cyber security issues. Shared training opportunities discussed and progressed. • Danielle Pettigrew, Governance and Performance Manager, Scotland Excel 20 June 2024 Presentation on the 2022/23 National Fraud Initiative, the forthcoming 2024/25 exercise, in particular data quality issues and how LA’s could increase outcomes. • Tim Bridle, Audit Scotland 18 September 2024 Presentation and overview of the Investigatory Powers Act, and outline of the services, particular to the Act, that NAFN could provide. • Paul Choudry, National Anti-Fraud Network (NAFN) Case Study - Sharing lessons learned from a case study relating to the evasion of Council Tax with the provision of fictitious details. • Bobbi Irvine, West Lothian Council 11 December 2024 Presentation on the services available to local authorities from Transunion with regards credit reference data. • Lydia Johnson and Greg Flewitt, Transunion Case Study - Sharing lessons learned from a case study relating to a recent embezzlement case which resulted in a successful prosecution. Control weaknesses and red flags were discussed and good practice shared. • Matthew Dickson, Aberdeen City Council 5.3 One specific task assigned to SLAIG was the Benchmarking on fraud activity and resources to align with the vison and objectives of SLACIAG and SLAIG’s Terms of Reference. The proposal was agreed in March 2024 that all local authorities will participate in a benchmarking exercise. The core content of the exercise will include resources, training, and outcomes. 5.4 One of the SLACIAG Management Committee members is assigned as Senior Sponsor of SLAIG to provide direction re Group’s meetings and agendas. 5.5 All Agendas, Minutes, and Presentations of SLAIG meetings, and other relevant documents are uploaded to the SLAIG Knowledge Hub to enable access by all members in a secure way. Page 65 of 120
Page 70
6. CONCLUSION 6.1 Notwithstanding the challenges that continue to affect our organisations, SLACIAG and its Sub-Groups have had another successful year, as evidenced by the participation in our virtual meetings and the range of topics discussed. 6.2 During the year Chief Audit Executives considered significant matters facing our organisations such as Financial Sustainability Risks and Strategic Workforce Risks, engaged in the consultation of new Global Internal Audit Standards and assessed their impact on the provision of assurance and advisory services, and discussed other key issues and shared approaches being taken to address these. In line with their remits, the CASG and SLAIG Sub-Groups respectively focussed on computer audit and counter fraud matters that are affecting our organisations and our functions/individuals. The Data Analytics, Resourcing, Sustainability/Climate Change and Risk Sub-Groups are excelling in their exploration of specific matters. I give thanks to those who volunteer their time to achieve this. 6.3 I would like to thank the Management Committee and the Leads of our Sub-Groups for their work in organising meetings and responding to the challenges that have arisen. I would also like to thank our speakers for giving up their time to join us at our virtual meetings during 2024 and assist us in enhancing our effectiveness as providers of assurance and compliance services. 6.4 My thanks are also extended to our members for their support, as evidenced by engaging in our virtual meetings during 2024, but also by the generous advice and assistance provided in relation to the myriad of audit, risk and governance questions which have arisen within our membership during the year. SLACIAG relies on the dedicated and hard-working public sector professionals within its membership and look forward to our biennial 2-day in-person Conference on 5 and 6 June 2025. Jill Stacey Chief Officer Audit & Risk, Scottish Borders Council Chair of SLACIAG 14 March 2025 Page 66 of 120
Page 71
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 August 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Global Internal Audit Standards in the UK Public Sector ________________________________________________________ 1. Summary 1.1 The Institute of Internal Auditors (IIA) introduced new Global Internal Audit Standards (GIAS) which came into force in January 2025. The Chartered Institute of Public Finance and Accountancy (CIPFA) who are the local government internal audit standard setters, recognised that there may be difficulties for Local Authorities to fully comply with these standards and have published an Application Note, effective from the 1 April 2025. 1.2 Auditors working in the UK public sector must follow the requirements of the Global Internal Audit Standards and the additional requirements set out in the Application Note and refer to this professional framework as Global Internal Audit Standards in the UK Public Sector. (GIAS in the UKPS) 1.3 Whilst this framework came in force on the 1 April 2025, it is not expected that Internal Audit Teams will be able to demonstrate full compliance with these standards on that date. They must work in accordance with the new standards from 1 April in order to build up their conformance. 1.4 This report seeks to provide members with an overview of the gap analysis undertaken to determine what actions are required to ensure compliance with the new standards. The outcomes of self-assessment gap analysis exercise by the Interim Chief Auditor and improvement actions identified are detailed in Appendix 1 of this Report. 1.5 As can be seen from Appendix 1, in the main Internal Audit currently comply with the spirit of the standards but require to undertake some actions throughout Item 4 Page 67 of 120
Page 72
the year to achieve full compliance or enhance the processes already in place. In order to keep members informed of progress, an updated action plan will be submitted to this Board in March 2025 – 6?. __________________________________________________________________ 2. Recommendations 2.1 It is recommended that members of the Audit, Risk and Scrutiny Board note the: • results of the self-assessment exercise undertaken to ensure compliance with the Global Internal Audit Standards in the UK Public Sector • actions to be undertaken to ensure full compliance with the framework. ___________________________________________________________________ 3. Background 3.1 Local government bodies have a requirement for internal audit as set out in national regulations. New standards, Global Internal Audit Standards in the UK public sector, have been introduced from 1 April 2025, which Local Authority Internal Audit teams must follow, consisting of the Global Internal Audit Standards (GIAS) of the Institute of Internal Auditors (IIA) and the CIPFA Application Note: Global Internal Audit Standards in the UK public sector. 3.2 In addition, the Code of Practice on the Governance of Internal Audit in the UK Public Sector, should also be used to interpret some of the essential conditions in the new standards. Compliance with this Code was previously reported upon to members of the ARSB in May 2025. 3.3 The Standards consist of five domains: • Domain I: Purpose of Internal Auditing. • Domain II: Ethics and Professionalism. • Domain III: Governing the Internal Audit Function. • Domain IV: Managing the Internal Audit Function. • Domain V: Performing Internal Audit Services. 3.4 In addition, the GIAS also recognise that internal auditors in the public sector work in a political environment under governance, organisational, and funding structures that may differ from those of the private sector. To assist in conformance with these standards, they contain a section “Applying the Global Internal Audit Standards in the Public Sector” which describes strategies for conformance amid the circumstances and conditions unique to internal auditing in the public sector. 3.5 All Internal Audit Staff have read the GIAS in the UKPS and training is going to be provided on certain elements . With regards to Domain 5 – Performing the Internal Audit Services, it is worthwhile noting that all internal audit staff have Page 68 of 120
Page 73
undertaken a self-assessment gap analysis to assist in identifying the most significant training areas. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development – None 3. Community Planning – Safer and Stronger - None 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - The report addresses the risk of non-compliance against the revised professional framework for internal audit. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk – None 14. Children’s Rights – None. ________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor Page 69 of 120
Page 74
Appendix 1 Compliance with the Global internal Audit Standards in the UK Public Sector Domain/Standard Compliance Assessment (1) Planned Actions Planned Completion Date I Purpose of internal auditing Internal auditing strengthens the organisation’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight to help the board and senior management to protect the assets, reputation and sustainability of the organisation. . Generally conforms – In practice these are the aims of the work undertaken by Internal Audit The Internal Audit Charter and Mandate will be updated to include this definition and will be brought to the ARSB for approval. November 2025 II Ethics and Professionalism Principle 1 – Demonstrate Integrity Standard 1.1 – Honesty and Professional Courage Internal auditors must perform their work with honesty and professional courage. They must be truthful, accurate clear, open and respectful in all professional relationships and communications and disclose all material facts. They must exhibit professional courage by communicating truthfully and taking appropriate action when facing difficult situations and communicating favourable and unfavourable results. Generally conforms – This has always been an essential requirement when carrying out Internal Audit Work. Internal Audit Staff are bound by the Council’s Employee’s Code of Conduct which includes the Nolan 7 Principles of Public Life, one of which is Integrity. Refresher training is being provided to Staff from August onwards and the Internal Audit Competency Framework will be amended to explicitly include this principle. Formal Training Records will be introduced. December 2025 Standard 1.2 – Organisation’s Ethical Expectations Internal auditors must understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and must be able to recognise conduct that is contrary to those expectations. Any concerns must be reported in accordance with Council’s policies and procedures. Generally conforms – This need for ethical behaviour is especially relevant in the UK public sector where those delivering public services are both servants of the public and stewards of public As Above December 2025 Page 70 of 120
Page 75
Appendix 1 resources. Internal Audit Staff must adhere to the Nolan Principles of Public Life Standard 1.3 – Legal and Ethical Behaviour Internal auditors must not engage in or be a party to any activity that is illegal or discreditable to the organisation or the profession of internal auditing or that may harm the organisation or its employees. If they identify any violations, they must report such incidents to those who have authority to take the appropriate action. Generally conforms – this is an essential characteristic of an Internal Auditor and they conduct investigations into suspected irregularities involving employees within the course of their duties. N/A Principle 2 – Maintain Objectivity Standard 2.1 – Individual Objectivity Internal auditors must maintain professional objectivity when performing all aspects of internal audit services by applying an impartial and unbiased mindset and make judgments based on balanced assessments of all relevant circumstances. They must manage potential biases. Generally conforms – this is another essential characteristic and one of the Nolan principles outlined in the Employee’s Code of Conduct. N/A Standard 2.2 – Safeguarding Objectivity Internal Auditors must recognise and avoid or mitigate actual, potential, and perceived impairments to objectivity. They must not accept any gifts or favours for undertaking their role, avoid all conflicts of interests and not be unduly influenced by their own interests or interests of others including senior management or the political environment. In addition methodologies to address impairments to objectivity must be established. Generally conforms – The Employee’s Code of Conduct which employees have signed for contains a section on Conflicts of Interest and the Council has a Gifts and Hospitality Policy in place. . Staff to be provided with refresher training in this area and a Conflict of Potential Interest form will be reintroduced to formalise this process. December 2025 Standard 2.2 – Disclosing Impairments to Objectivity If Internal Auditors become aware of an impairment that has or may affect their objectivity, they must disclose the impairment to the Chief Audit Executive or a designated supervisor as soon as it is known. Generally conforms – Internal Auditors are aware to disclose any potential conflicts to the Chief Auditor as soon as they are known. A Conflict of Potential Interest form will be reintroduced to formalise this process. December 2025 Page 71 of 120
Page 76
Appendix 1 The Chief Audit Executive (CAE) determines that an impairment is affecting an Internal Auditor’s ability to perform duties objectively or is discovered after the engagement is completed, the Chief Audit Executive must discuss the impairment with the management of the activity under review, and/or senior management and determine the appropriate actions to resolve the situation. If the objectivity of the CAE is impaired in fact or appearance, the Chief Audit Executive must disclose the impairment to the Board/Manager. Generally conforms – The Chief Auditor completes a declaration of interest form annually and would flag any impairments to the Director of Finance and Resources/Head of Corporate Governance. N/A Principle 3 – Demonstrate Competency Standard 3.1 – Competency Internal Auditors must possess or obtain the required competencies to perform their responsibilities successfully including the knowledge, skills, and abilities suitable for one’s job position and responsibilities commensurate with their level of experience and possess knowledge of the GIAS in the UKPS. Generally conforms – the Internal Audit Service has a competency framework in place for Auditors to self-assess their competencies periodically and agree training plans with their Line Manager. The Internal Audit Team have familiarised themselves with the requirements of the GIAS in the UKPS. All mandatory training required by the Council is undertaken Formal training sessions have been arranged, commencing in August 2025 to ensure Internal Audit Staff have a full understanding of the requirements of the GIAS in the UKPS March 2026 Standard 3.1 – Continuing Professional Development Internal Auditors must maintain and continually develop their competencies to improve the effectiveness and quality of internal audit services, pursue continuing professional development including education and training and follow the Generally conforms – External and internal training opportunities are provided to staff in accordance with need. In addition, the Council is an Accredited Employer for the professional accountancy bodies and Formal Training Records will be established to record all training undertaken. March 2026 Page 72 of 120
Page 77
Appendix 1 continuing professional development requirements of their professional body. run training sessions which is attended by Internal Audit staff. Principle 4 - Exercise Due Professional Care Standard 4.1 – Conformance with Global Internal Audit Standards The internal audit function’s methodologies must be established, documented, and maintained in alignment with the GIAS in the UKPS. Internal auditors must follow the Standards and the internal audit function’s methodologies when undertaking internal audit engagements. When internal auditors are unable to conform with a requirement, the chief audit executive must document and communicate a description of the circumstance, alternative actions taken, the impact of the actions, and the rationale. Generally conforms – This Gap Analysis exercise identified that our current methodologies comply in the main with these standards. Any amendments which have been identified will be introduced, including documenting any areas where it is not possible to adhere to the standards. Revised methodologies, where required, will be introduced into our working practices during 2025/26 and the Internal Audit Manual will be updated to reflect the changes. March 2026 Standard 4.2 – Due Professional Care Internal auditors must exercise due professional care by assessing the nature, circumstances, and requirements of the services to be provided, including the organisations objectives, clients and other stakeholders interests, adequacy of governance, risk management and control processes, scope, complexity, cost and timeliness of work. Generally conforms – This is taken into consideration when the objective and scope of the audit engagement are being prepared on the engagement plan which is agreed with client senior management prior to commencement of the audit. N/A Standard 4.2 – Professional Scepticism Internal auditors must exercise professional scepticism when planning and performing internal audit services by maintaining an attitude that includes inquisitiveness, critically assessing the reliability of information, be straightforward and honest when raising concerns and asking questions about inconsistent information and seek additional evidence to make a judgment about information and statements that might be incomplete, inconsistent, false, or misleading. Generally conforms – this is essential when carrying out internal audit engagements including employee investigations and our evidence and judgements are recorded in our evidence files and engagement report. Further training will be provided in this area to ensure all elements of this standard are undertaken. September 2025 Page 73 of 120
Page 78
Appendix 1 Principle 5 – Maintain Confidentiality Standard 5.1 – Use of information Internal auditors must follow the relevant policies, procedures, laws, and regulations when using information. The information must not be used for personal gain or in a manner contrary or detrimental to the organization’s legitimate and ethical objectives. Generally conforms - All staff have completed the Councils Mandatory Training Courses on Information Governance and Cyber Security and are fully aware of Information Handling Policies. They are also aware of the restrictions in place for sharing internal audit information. N/A Standard 5.2 – Protection of information Internal auditors must be aware of their responsibilities for protecting information and demonstrate respect for the confidentiality, privacy, and ownership of information acquired when performing internal audit services or as the result of professional relationships. Generally conforms - All staff are fully aware of how to protect internal audit information. The Audit Manual has a section on confidentiality of information and there is a Report Protocol in place for issuing reports. A clear desk policy is in place. N/A III Governing the Internal Audit Section The CAE must discuss this domain with the board and senior management. The discussions are needed to inform the board and senior management about the importance of the essential conditions and to gain alignment among their respective responsibilities. Generally conforms – A report of the Code of Practice for the Governance of Internal Audit was submitted to the ARSB members in May 2025. This self-assessment will also further enhance members and senior management awareness of the requirements of this domain If agreed, a briefing could be provided to members to assure members that we are complying with this domain and the code of practice as far as possible. December 2025 Principle 6 – Authorised by the Board Standard 6.1 – Internal Audit Mandate The chief audit executive must provide the board and senior management with the information necessary to establish the internal audit mandate and this mandate detailing authority, legal requirements, role Generally conforms – the Internal Audit Charter is approved by the ARSB which contains a section on Authority. The Authority is also set The Internal Audit Charter will be updated to make it clearer that the Charter is also the Mandate and submitted to the ARSB for approval. November 2025 Page 74 of 120
Page 79
Appendix 1 and responsibilities must be included in the charter approved by Board. out in the Council’s Financial Regulations and Codes Standard 6.2 – Internal Audit Charter The chief audit executive must develop and maintain an internal audit charter that specifies, at a minimum, the internal audit function’s: Purpose of Internal Auditing, Commitment to adhering to the GIAS, Mandate and Organisational position and reporting relationships. Generally conforms – the Internal Audit Charter contains most of these requirements The Internal Audit Charter will be updated to include the commitment to adhere to the GIAS in the UKPS. This will be submitted to the CMT and then to the ARSB for approval. November 2025 Standard 6.3 – Board and Senior Management Support The chief audit executive must provide the board and senior management with the information needed to support and promote recognition of the internal audit function throughout the organisation and coordinate the internal audit function’s board communications with senior management to support the board’s ability to fulfil its requirements. Generally conforms – the Chief Auditor reports to the Director of Finance and Resources, who agrees the budget for the Internal Audit Service and meets quarterly with the Chief Executive and Head of Corporate Governance. They are also a member of the Finance and Resource Senior Management Team. Internal Audit staff have unrestricted access to personnel, records and premises included the Chair of the ARSB. ARSB members have agreed the type of internal audit information submitted to Board. N/A Principle 7 Positioned Independently Standard 7.1 – Organisational Independence The chief audit executive must confirm to the board the organisational independence of the internal audit function at least annually and includes communicating incidents where independence may have been impaired. The Charter must state the reporting relationships and organisational position of Internal Audit. Any roles or responsibilities that have Generally conforms - The annual confirmation of independence is included in the Internal Audit Annual Report and the position of Internal Audit is stated in the Charter. The Chief Auditor reports directly to the ARSB. Any reviews of other teams N/A Page 75 of 120
Page 80
Appendix 1 the potential to impair the internal audit function’s independence, either in fact or appearance must be disclosed who are managed by the Chief Auditor are undertaken by an External Consultant. The Chief Auditor meets privately at least annually with the ARSB. Standard 7.2 – Chief Audit Executive Qualifications Chief audit executives in the public sector must hold appropriate professional CMIIA OR CCAB qualifications alongside relevant internal audit experience Generally conforms – these are a specification of the Chief Auditor’s post. N/A Principle 8 Overseen by the Board Standard 8.1 – Board Interaction The chief audit executive must provide the board with the information needed to conduct its oversight responsibilities. This information may be specifically requested by the board or may be, in the judgment of the chief audit executive, valuable for the board to exercise its oversight responsibilities. Generally conforms – The reports submitted to the ARSB are discussed annually at the Board. Both the Charter and Internal Audit Plan are approved by the ARSB. A summary of each Internal Audit Engagement and Internal Audit Performance Reports are submitted to the ARSB quarterly. N/A Standard 8.2 - Resources The chief audit executive must evaluate whether internal audit resources are sufficient to fulfil the internal audit mandate and achieve the internal audit plan. If not, the chief audit executive must develop a strategy to obtain sufficient resources and inform the board about the impact of insufficient resources and how any resource shortfalls will be addressed. Generally conforms - The Annual Internal Audit Plan states the resources available and whether they are sufficient to give adequate assurance. The Internal Audit annual report gives details of the actual resources utilised. If during the year, additional resource was required, this would be sent for approval to the Director of Finance & Resources and the ARSB would be informed of the outcome. N/A Page 76 of 120
Page 81
Appendix 1 Standard 8.3 - Quality The chief audit executive must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. Partially conforms – Since the last External Quality Assessment reported in September 2023, a formal internal assessment has not been undertaken due to the new standards coming into force and the recently completed review of how internal audit services are provided. Annual internal quality and assurance assessments will recommence during 2026/27 when all the amendments to working practices as a result of the GIAS in the UKPS are in place. March 2027 Standard 8.4 - External Quality Assessment The chief audit executive must develop a plan for an external quality assessment and discuss the plan with the board. The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team. The requirement for an external quality assessment may also be met through a self-assessment with independent validation. Generally conforms – The Scottish Local Authority Chief Internal Auditors Group have a process in place for undertaking external assessments and this will continue to be followed and the results reported to the ARSB. N/A IV Managing the Internal Audit Function Principle 9 Plan Strategically Standard 9.1 - Understanding Governance, Risk Management and Control Processes To develop an effective internal audit strategy and plan, the chief audit executive must understand the organization’s governance, risk management, and control processes and the importance of value for money. Generally conforms – The Councils Code of Corporate Governance is reviewed by Internal Audit annually and the Chief Auditor is a member of the Corporate Risk Management Group. These processes are also reviewed during the annual audit planning process. The Annual planning protocol in the Audit Manual will be updated to incorporate all documents reviewed. All audit staff have undertaken risk management training and refresher training will be given on the Council’s governance arrangements March 2026 Standard 9.2 - Internal Audit Strategy Page 77 of 120
Page 82
Appendix 1 The chief audit executive must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organisation and aligns with the expectations of the board, senior management, and other key stakeholders. This strategy must include a vision stating the desired future of the internal audit service in the next 3-5 years and aide continuous improvement, Partially conforms – many requirements of the strategy are included in the Charter and Audit Manual and these require to be formalised into an Internal Audit Strategy Document. A formal strategy will be prepared including evidence of information and analysis that informs the strategy and submitted to Senior Management and the ARSB. Arrangements will be put in place to review the strategy as part of our internal quality assessment. November 2025 Standard 9.3 - Methodologies The chief audit executive must establish methodologies to guide the internal audit function in a systematic and disciplined manner to implement the internal audit strategy, develop the internal audit plan, and conform with the Standards. The methodologies must be evaluated, updated and training provided to staff. Generally conforms – Our methodologies for undertaking engagements are built into our audit management system files and the information obtained during the engagement is reviewed independently to ensure the methodology are followed. These methodologies are discussed at team meetings, amended when necessary and training provided as required. N/A Standard 9.4 – Internal Audit Plan The chief audit executive must create an internal audit plan that supports the achievement of the organisation’s objectives and based on the organisation’s strategy and evaluation of governance, risks and control processes with input from senior management and the Board. The plan must identify the resources required to undertake the plan and revised as necessary. The plan should be approved Generally conforms – an audit universe which has been risk assessed and is reviewed annually as part of the planning process is incorporated into our audit management system. Part of our Planning Protocol is to meet with all Senior Management teams to enable them to input into the plan. Planning Protocol to be updated within the Audit Manual. March 2026 Page 78 of 120
Page 83
Appendix 1 by the Board and the Board should be notified of any changes. The plan is approved by the ARSB and they also approve any changes. Standard 9.5 – Coordination and Reliance The chief audit executive must coordinate with internal and external providers of assurance services and consider relying upon their work. Coordination of services minimises duplication of efforts, highlights gaps in coverage of key risks, and enhances the overall value added by providers. Partially conforms – We share information and meet regularly with GGCHB and City Deal Internal Auditors. We also share information with External Audit. Planning Meetings with Council Senior Management teams also inform us of areas regulated by external bodies This will be discussed in detail with Senior Management Teams to enable us to document more formally other relevant providers of assurance and request their reports where applicable March 2026 Principle 10 Manage Resources Standards 10.1 -10.3 Financial/Human/Technological Resource Management UK Public Sector Application Note The chief audit executive may have no ability to develop resource management approaches distinct from their organisation and tailored to the needs of the internal audit function. The chief audit executive’s ability to develop a strategy to obtain sufficient resources and address shortfalls may also be constrained by their organisation’s legal or regulatory obligations. Under these circumstances the chief audit executive will not be expected to follow the requirements of GIAS 10.1 to 10.3 (Manage Resources) if they cannot develop approaches that achieve the objectives of those standards. Instead, a chief audit executive must set out in the Charter what alternative approaches apply to the internal audit service, and then seek to manage financial, human and IT resources within those constraints. Generally conforms – The Chief Auditor is the Budget Holder for the Internal Audit Services and manages all these resources in accordance with the Council Policies. The arrangements to manage Financial/Human/Technological Resources will be included in the revised Charter and Mandate November 2025 Principle 11 - Communicate Effectively Page 79 of 120
Page 84
Appendix 1 Standard 11.1 – Building Relationships and Communicating with Stakeholders The chief audit executive must develop an approach for the internal audit function to build relationships and trust with key stakeholders, including the board, senior management, operational management, regulators, and internal and external assurance providers and other consultants. Generally conforms – 6 Monthly meeting with the Council Senior Management Teams take place. In addition, approved templates are in place for commencing an audit, reporting and associated processes in place that help build relationships and communication with stakeholders. N/A Standard 11.2 - Effective Communication The chief audit executive must establish and implement methodologies to promote accurate, objective, clear, concise, constructive, complete, and timely internal audit communications. Generally conforms – Report templates are in place for communicating the outcomes from audit engagements and reports are reviewed by Chief Auditor prior to issue. Performance indicators are in place to ensure engagements are undertaken in a timely manner. N/A Standard 11.3 – Communicating Results The chief audit executive must review, approve and communicate the results of internal audit services (including conclusions and root cause of findings) to the board and senior management periodically and for each engagement as appropriate. In addition, this standard references the possibility that a chief audit executive may be required to make a conclusion at the level of the organisation about the effectiveness of governance, risk management and/or control. In the UK public sector, a chief audit executive must prepare such an overall conclusion at least annually in support of wider governance reporting, mindful of any specific sector obligations or processes. This Generally conforms - All reports follow a template standard to ensure consistency and each recommendation and the outcome are rated. All reports are reviewed by the Chief or Assistant Chief Auditor prior to issue. Annually the Chief Auditor must provide an opinion as to whether the governance, risk and internal control measures throughout the Council are satisfactory in their Annual Report which is submitted to the Root cause analysis will be further developed and included in reports and staff training will also be provided in this area. September 2025 Page 80 of 120
Page 85
Appendix 1 overall conclusion must encompass governance, risk management and control. Corporate Management Team and the ARSB. Standard 11.4 Errors and Omissions If a final engagement communication contains a significant error or omission, the chief audit executive must communicate corrected information promptly to all parties who received the original communication. Generally conforms – If this occurred the report would be recalled and an amended report issued. Standard 11.5 Communicating the Acceptance of Risks The chief audit executive must communicate unacceptable levels of risk to Senior Management and if it is not resolved, the matter must be reported to Board. Generally conforms - It would be noted on the final report that is sent to the Service Director that the service is carrying the risk by not implementing the audit recommendation and this would be noted on the ARSB summary of findings report. N/A Principle 12 Enhance Quality Standard 12.1 - Internal Quality Assessment The chief audit executive must develop and conduct internal assessments of the internal audit function’s conformance with the Global Internal Audit Standards and progress toward performance objectives. Generally conforms - There is a self- assessment tool which will be used annually for this and improvements will be action planned and reported to the ARSB. Standard 12.2 - Performance Measurement The chief audit executive must develop objectives to evaluate the internal audit function’s performance. Generally conforms - We have a suite of monthly performance indicators with targets, the results of which and the reasons for underachieving, if required, are reported to the Director of Finance and Resources and quarterly to the ARSB. Page 81 of 120
Page 86
Appendix 1 Standard 12.3 - Oversee and Improve Engagement Performance The chief audit executive must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies. Generally conforms - Weekly progress reviews are undertaken by the Supervisor for all audit engagements and formally reviewed upon completion. Review notes are prepared, answered and approved on the audit management system and the Report is then agreed upon before passing the file to the Chief or Assistant Chief Auditor for further review and to issue the draft report to management. V - Performing Internal Audit Services Principle 13 Plan Engagements Effectively Standard 13.1 - Engagement Communication Internal auditors must communicate effectively throughout the engagement including communicating the engagement plan and timing. At the end of the engagement, the findings must be agreed with service management. Generally conforms – An engagement plan is sent to the appropriate Head of Service prior to engagement and an exit meeting is held upon completion with the relevant service manager to agree the report findings. N/A Standard 13.2 - Engagement Risk Assessment Internal auditors must develop an understanding of the activity under review and gain an understanding as to how the processes are intended to operate in order to assess the relevant risks in terms of significance and likelihood of fraud Generally conforms – At the commencement of the engagement, relevant policies and procedures will be reviewed and service officers interviewed to document the system in operation. Control weaknesses and risks will be identified from the system notes and audit testing. Refresher training on identifying risks and their significance will be provided. September 2025 Page 82 of 120
Page 87
Appendix 1 Standard 13.3 - Engagement Objectives and Scope Internal auditors must establish and document the objectives and scope for each engagement and be approved by the Chief Audit Executive. The scope must establish the engagement’s focus and boundaries by specifying the activities, locations, processes, systems, components, time period to be covered in the engagement, and other elements to be reviewed, and be sufficient to achieve the engagement objectives. Generally conforms – An engagement plan, detailing this information, is prepared and then approved by the Chief Auditor or Assistant Chief Auditor. It is also agreed with the relevant Head of Service prior to commencement of the engagement. N/A Standard 13.4 - Evaluation Criteria Internal auditors must identify the most relevant criteria to be used to evaluate the aspects of the activity under review defined in the engagement objectives and scope, including value for money. Generally conforms – Once we ascertain the processes in place, these are evaluated for control weaknesses and risks to enable a testing strategy to be formulated. N/A Standard 13.5 - Engagement Resources When planning an engagement, internal auditors must identify the types and quantity of resources necessary to achieve the engagement objectives. Generally conforms – The resources required are approved by the Chief Auditor and professional expert advice arranged if required. N/A Standard 13.6 - Work Program Internal auditors must develop and document an engagement work program to achieve the engagement objectives documenting the criteria to be used, tasks to be undertaken and the methodologies. This should be approved by the Chief Audit Executive Generally conforms – The system notes and work programme are recorded on our audit management system. The Engagement Supervisor reviews the work programme prior to commencement and throughout the engagement. Refresher training to be given to staff and the Engagement Supervisor will formally sign off the system notes and work programme prior to commencement. September 2025 Principle 14 Conduct Engagement Work Standard 14.1 - Gathering Information for Analyses and Evaluation To perform analyses and evaluations, internal auditors must gather information that is relevant, Generally conforms – this is detailed in our audit management system N/A Page 83 of 120
Page 88
Appendix 1 reliable and sufficient and if unable to obtain such evidence, this must be documented and any documentation obtained as evidence is also attached. Standard 14.2 - Analyses and Potential Engagement Findings Internal auditors must analyse relevant, reliable, and sufficient information and determine the condition to develop potential engagement findings. If initial analyses do not provide sufficient evidence to support a potential engagement finding, internal auditors must exercise due professional care to determine whether additional analyses are required. If internal auditors determine that no additional analyses are required and there is no difference between the criteria and the condition, the internal auditors must provide assurance in the engagement conclusion regarding the effectiveness of the activity’s governance, risk management, and control processes. Generally conforms - findings that have arisen are documented on the audit management system and the test program conclusion assessed. Further training to be carried out to emphasise the necessity to determine the root cause of differences between actual and expected and its materiality in relation to the control system. This must be recorded in the finding. September 2025 Standard 14.3 Evaluation of Findings Internal auditors must evaluate each potential engagement finding to determine its significance and where possible, collaborate with management to identify the root causes when possible, determine the potential effects, and evaluate the significance of the issue. Generally conforms - risk matrix and working papers include criteria used. Recommendation ratings in place for findings and also assurance levels for overall audits with descriptions of the risks and controls associated with each. Engagement Report template to be updated to show risk ratings. August 2025 Standard 14.4 Recommendations and Action Plans Internal auditors must determine whether to develop recommendations, request action plans from management, or collaborate with management to agree on actions to resolve the findings, address the root cause and mitigate identified risks to an acceptable level. Generally conforms – recommendation action plans are forwarded to management and they record the action they are going to take. If the Chief Auditor feels the action is insufficient, this will be Methodology to resolve disagreements to be added to Audit Manual. March 2026 Page 84 of 120
Page 89
Appendix 1 further discussed and the outcome recorded on the final report. Standard 14.5 - Engagement Conclusions Internal auditors must develop an engagement conclusion that summarises the engagement results relative to the engagement objectives and management’s objectives and includes the auditors’ professional judgment about the overall significance of the aggregated engagement findings. Generally conforms – there is an overall conclusion section in the report. N/A Standard 14.6 - Engagement Documentation Internal auditors must document information and evidence to support the engagement results and this must be reviewed by the Supervisor. All documentation must be retained in accordance with policy. Generally conforms – all work is documented and any evidence obtained attached to the file which is formally reviewed by a Supervisor. All files are retained in accordance with our retention policy. N/A Principle 15 Communicate Engagement Results and Monitor Action Plans Standard 15.1 - Final Engagement Communication For each engagement, internal auditors must develop a final communication, must be reviewed by Chief Audit Executive, that includes the engagement’s objectives, scope, recommendations and conclusions regarding the effectiveness of the governance, risk management, and control processes of the activity reviewed. The actions must identify specific owners and target completion dates, as well as acknowledgement in the report of actions initiated or completed during the engagement. Generally conforms – this information is included in our engagement report. N/A Standard 15.2 - Confirming the Implementation of Recommendations or Action Plans Internal auditors must confirm that management has implemented internal auditors’ recommendations or management’s action plans following an established methodology Generally conforms – we have a follow up process in place and the results are communicated to Senior Management. N/A Page 85 of 120
Page 90
Appendix 1 Note 1:- Assessment Descriptions Assessment Opinion Assessment Description Generally Conforms The relevant structures, policies, and procedures of the function, as well as the processes by which they are applied, conform with the requirements of the Global Internal Audit Standards in the UK Public Sector (GIAS – UKPS) in all material respects. For the Domains and Principles, this means that there is general conformance to a majority of the Standards (Requirements). There may be significant opportunities for improvement, but these must not represent situations where the function has not implemented the Principles and/or Standards (Requirements), has not applied them effectively, or has not achieved their stated objectives. As indicated above, general conformance does not require complete/perfect conformance, the ideal situation, successful practice, etc. Partially Conforms The function is making good-faith efforts to conform with the overarching requirements of the GIAS – UKPS i.e. Principles and Standards (Requirements) but falls short of achieving some major objectives. These will usually represent significant opportunities for improvement in effectively applying the elements of the GIAS – UKPS i.e. the Principles and Standards (Requirements) and achieving their objectives. Some deficiencies may be beyond the control of the function and may result in recommendations to senior management or the board of the organisation. Does not Conform The function is neither aware of nor making good-faith efforts to conform, with, or is failing to achieve many/all of the objectives of the GIAS – UKPS which includes the Principles and the Standards (Requirements). These deficiencies will usually have a significant negative impact on the function’s effectiveness and its potential to add value to the organisation. These may also represent significant opportunities for improvement, including actions by senior management or the board. Not Applicable The function is unable to comply with the requirements of the GIAS – UKPS due to circumstances outside of its control, such as internal audit team size and/or regulatory/legal requirements. Page 86 of 120
Page 91
1 ___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 August 2025 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ The National Fraud Initiative 2024-2028 Strategy. ___________________________________________________________________ 1. Summary 1.1 The National Fraud Initiative (NFI) is a counter-fraud exercise overseen by the Cabinet Office for the UK as a whole. It is part of a range of measures in place across the public sector which aim to prevent and detect fraud 1.2 The National Fraud Initiative 2024-2028 Strategy was published in February 2025 by the Public Sector Fraud Authority and is attached at Appendix 1. This strategy aims to enhance the NFI through innovation, increased data access and insight, whilst maintaining the highest standards of service quality and data security. By improving training and support for participants and fostering greater engagement, it will maximise fraud detection outcomes and build new counter fraud partnerships across sectors. ___________________________________________________________________ 2. Recommendations 2.1 It is recommended that the Audit, Risk and Scrutiny Board note the National Fraud Strategy _________________________________________________________ Item 5 Page 87 of 120
Page 92
2 3. Background 3.1 Fraudsters relentlessly target public services, diverting vital resources away from those who need them most. Public sector fraud and error losses are estimated to be at least £55 billion annually and it is necessary to be commited to tackling fraud to ensure that services reach those who need them, particularly in areas like housing, benefits and social support. 3.2 The NFI aims to detect and prevent fraud and error through a national data matching exercise across public bodies carried out by the Cabinet Office and overseen, in Scotland, by Audit Scotland, with the aim of identifying instances of possible fraud or error. Overpayments that are identified through the initiative allow public bodies to take appropriate action to recover the money. 3.3 This strategy is published to demonstrate the commitment to focussing on maximising fraud detection outcomes, building new counter-fraud partnerships across sectors, and harnessing innovation, data access, and insights over the next four years. This is to protect public services and ensure that public funds are spent where they are needed most on supporting communities, protecting vulnerable families, and delivering homes and local services to those who deserve them. __________________________________________________________________ Implications of the Report 1. Financial - The Council has in place arrangements to recover any financial overpayments identified through the National Fraud Initiative. 2. HR & Organisational Development - None 3. Community Planning – Wealthier and fairer – The National Fraud Initiative (NFI) exercises make a significant contribution to the security of public sector finances by confirming that services are provided to the correct people and by eliminating fraud and error. 4. Legal – None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None Page 88 of 120
Page 93
3 8. Health & Safety - None 9. Procurement - None 10. Risk – Priority is given to investigating matches with a higher risk of fraud and error. 11. Privacy Impact – There is a requirement to take best reasonable attempts to notify people of the NFI exercise as part of the preparation for the national exercise. This requirement has been complied with. 12. Cosla Policy Position – None 13. Climate Risk – None 14. Children’s Rights - None ___________________________________________________________________ Author: Karen Campbell, Interim Chief Auditor Page 89 of 120
Page 94
February 2025 National Fraud Initiative 2024 - 2028 Strategy Page 90 of 120
Page 95
Public Sector Fraud Authority Publication date: February 2025 © Crown copyright February 2025 Produced by the Public Sector Fraud Authority. You may re-use this information (excluding logos) free of charge in any format or medium, under the terms of the Open Government Licence. To view this licence, visit https://www. nationalarchives.gov.uk/doc/open- government-licence/version/3/ or email: psi@nationalarchives.gsi.gov.uk Where we have identified any third party copyright material you will need to obtain permission from the copyright holders concerned. Alternative format versions of the report are available on request from the Public Sector Fraud Authority: PSFA@cabinetoffice.gov.uk Page 91 of 120
Page 96
Contents Foreword 4 Executive Summary 6 Introduction 7 Context 7 National Fraud Initiative - a profile 7 Performance and impact 8 Growth of outcomes since 2015 9 Challenges and opportunities 9 Anticipating the future landscape 11 Creating the strategy 12 NFI Partnerships 13 Overview of the Strategy 14 Our vision statement 14 Our five objectives to achieve our vision 14 Working towards our objectives 14 Implementation and governance 16 Strategic alignment with the government fraud landscape 17 Contact 17 National Fraud Initiative, 2024 - 2028 Strategy 3 Page 92 of 120
Page 97
Foreword Fraudsters relentlessly target public services, diverting vital resources away from those who need them most. In doing so, they undermine fairness and trust, often denying families access to the housing and local services support they rightfully deserve. Public sector fraud and error losses are estimated to be at least £55 billion annually — a staggering figure that reflects the urgent need to protect public resources. Reducing fraud is not just a financial imperative, but a matter of social justice. The government is committed to tackling fraud to ensure that services reach those who need them, particularly in areas like housing, benefits and social support. It is for this reason the Public Sector Fraud Authority is launching a National Fraud Initiative (NFI) strategy for the next four years. This strategy is published to demonstrate our commitment to focussing on maximising fraud detection outcomes, building new counter-fraud partnerships across sectors, and harnessing innovation, data access, and insights over the next four years. These efforts will be underpinned by a continued commitment to the highest standards of service quality and data security. We will also work closely with the NFI community to provide training, support, and greater engagement, identifying new opportunities to uncover fraud. By strengthening our collective ability to protect public services, we will ensure that public funds are spent where they are needed most on supporting communities, protecting vulnerable families, and delivering homes and local services to those who deserve them. Alongside this strategy, the Public Sector Fraud Authority is publishing its report on the National Fraud Initiative results for 1 April 2022 to 31 March 2024. Participating organisations have been able to prevent and detect £510 million of fraud and error during this period. This represents the highest ever outcome for the NFI, surpassing the previous record of £443 million in 2022, thanks to increased collaboration with private sector partners. Since its inception, the NFI has helped detect and prevent nearly £3 billion of fraud and error. This work has highlighted a wide range of cases including where fraudsters have misrepresented their income, assets or existing residency to access housing they are not entitled to, this ensures social housing homes are made available for those truly in need. This would not have been possible without the tenacity and dedication of staff across public and private sector organisations. By exposing fraudulent housing, blue badge, council tax claims, their work ensures that resources go to those most in need, restoring fairness and trust in our systems. Georgia Gould MP Parliamentary Secretary, Cabinet Office 4 National Fraud Initiative, 2024 - 2028 Strategy Page 93 of 120
Page 98
Public sector fraud and error losses are estimated to be at least £55 billion annually We will ensure that public funds are spent where they are needed most National Fraud Initiative, 2024 - 2028 Strategy 5 Page 94 of 120
Page 99
Executive Summary The NFI Vision Statement: “To better detect and prevent fraud by utilising data and technology from the public and private sector”. 1 As of March 2024. 1. The National Fraud Initiative (NFI) is a key data service of the Public Sector Fraud Authority. The NFI compares datasets to identify inconsistencies that are indicators of potential fraud. The results are released securely through a web-based application to 1,100 public and private sector organisations that provide data for further investigation. 2. The NFI has enabled these organisations collectively to deliver cumulative savings of £2.9bn1. Between April 2022 and March 2024 alone, £510m was prevented and detected/recovered across the UK and performance is increasing with each two-year cycle. 3. With fraud and error against the public sector an ever-evolving threat, all those working to fight fraud must respond and adapt. The NFI strategy is firmly committed to building on the success of its history and through evolution and innovation, ensuring it is fit for the future too. 4. This strategy details how the NFI plans to achieve this over the next four years with a focus on: • Evolve Our Products Through Innovation • Increase Data Access and Insights • Uphold the Highest Standards of Service Quality and Data Security • Improve Training and Support • Enhance Engagement to Maximise Outcomes 5. Crucial to the delivery of this strategy are the continuation and development of strong collaborative partnerships across sectors and across central, local, and devolved governments which will be at the heart of the NFI’s approach. All those working to fight fraud must respond and adapt 6 National Fraud Initiative, 2024 - 2028 Strategy Page 95 of 120
Page 100
Introduction 2 Economic Crime Plan 2 2023-26 3 An Overview of the impact of fraud and error on public funds for the new Parliament 2023-24 November 2024. Context 6. The Government is focussed on delivering technology-enabled, mission- driven and efficiency-focused projects to realise its strategic ambitions to kickstart economic growth and to lay strong national security foundations. 7. Fighting fraud is key to this success as it accounts for 41% of all crime in England and Wales2. Fraud is a drain on the economy, undermines public services and is a threat to national security - the government is firmly committed to tackling it. 8. Public sector fraud and error loss is estimated to be at least £55bn a year3. Therefore, every pound of taxpayers’ money that can be saved by fighting public sector fraud is a pound invested in our public services, and a pound less in the pocket of fraudsters. 9. The Public Sector Fraud Authority (PSFA) works with departments and public bodies to better understand and reduce the impact of fraud against the public sector. The PSFA data and analytics service is a cornerstone of how we achieve this. 10. The National Fraud Initiative (NFI) is a key part of the service and has a well- established and proven track record of success. We want to go even further, so we are committed to continuing to evolve the NFI informed by user feedback and through regular reviews of the NFI products. We will also explore opportunities to exploit and adopt new and innovative technologies, tools and data sources to ensure we maximise our counter fraud impact. National Fraud Initiative - a profile 11. The NFI utilises data matching tools and techniques to help in the prevention and detection of fraud and error. 12. The NFI’s reach has evolved to support over 1,100 public and private sector organisations in enhancing their fraud response through the use of data and analytics. 13. The NFI’s data matching activities involve comparing sets of data electronically, such as the payroll records of a body, against other records held by the same or another body, to see to what extent they match. The matching identifies inconsistencies for investigation, allowing potentially fraudulent claims and payments to be identified. 14. Investigation by those receiving the matches is crucial. No assumption can be made as to whether there is fraud, error or another explanation for those matches until an investigation process is completed, and an organisation can then take the appropriate action. This may be to prosecute cases of fraud, recover overpayments, correct underpayments and update records as appropriate. 15. The NFI provides multiple solutions, ranging from real time point-of-application fraud prevention checks, through to the national batch data matching exercise, which helps those that take part detect active fraud cases within systems. Page 96 of 120
Page 101
Performance and impact 16. The NFI has an unparalleled track record of delivering measurable outcomes in response to emerging fraud and error risks. This strategy commits us to evolve from and build on this record, most crucially on how we use data analytics to identify and recover more fraud. 17. Since its creation, the NFI has delivered cumulative savings of £2.9bn. Between April 2022 and March 2024 alone, £510m was prevented and detected/ recovered across the UK of which £477.5m was in England - the NFI’s best ever result. Savings into context £477.5m would contribute to 18.8% of Local Authority budgeted expenditure on Housing services4 4 Based on Local Authority budgeted expenditure on Housing services (excluding Housing Revenue Account) in the year of 2024/5. Examples of outcomes from the 2022-2024 National Exercise Fraud-risk area Impact Pensions For pensions, the NFI’s data matching identifies instances where individuals obtaining pension payments relating to a deceased person (known as mortality srceening). In the 2022/24 reporting period, in England alone, 6,194 pension cases were identified totalling £179.4m. Council Tax (Single Person Discount) The NFI’s data matching identifies instances where an individual falsely claims they live alone, in order to receive Single Person Discount (SPD), despite cohabiting with another individual. In England alone, the outcomes from both previous two National Exercises (2022/23 and 2023/24) were £51.9m in detected and prevented fraud. Private Sector The NFI works with a number of private sector bodies to facilitate use of NFI data to help them prevent and detect fraud. Car rental businesses, insurance companies and the water industry have utilised insights from the NFI data in this way as part of their normal business processes. Between 2022/24, this resulted in £137.8m of fraud being prevented or detected. This includes highlighting where applicants for services misrepresented their identity, or their residency. 8 National Fraud Initiative, 2024 - 2028 Strategy Page 97 of 120
Page 102
NFI 2022/23 £510m NFI 2020/21 £443m NFI 2018/19 £245m NFI 2016/17 £292m NFI 2014/15 £222m 5 Local Audit and Accountability Act 2014 6 Code of Data Matching Practice for the National Fraud Initiative 7 Economic Crime Plan 2, 2023-26 - pg.4 Growth of outcomes since 2015 18. The NFI is, and continuously aims to be, cost neutral to central government, funding its activities (including pay) through fees levied on participants and charged-for services. This represents strong value for money for not just the taxpayer but also for the NFI’s participants through nationally coordinated data matching exercises and providing a data analytics solution that multiple organisations can benefit from. 19. Data security and the proportionality of data usage is a priority for the NFI. The collection of data is mandated under the Local Audit and Accountability Act 20145, which is underpinned by a Code of Data Matching Practice6. The Code’s purpose is to explain the NFI’s data matching activities, give guidance to those involved in data matching and to promote good practice in data matching. Challenges and opportunities The current landscape 20. Economic crime is ever-evolving and, as set out in the government’s most recent Economic Crime Plan7, it is a rapidly growing and increasingly complex threat to UK national security and prosperity. It is because of this reality that we are focused on greater fraud prevention, identification of potential fraud and consistent collaboration, in order to tackle fraud at the first possible opportunity. 21. Access to, and utilisation of, data analytic tools and products that can identify potential fraud and help prevent it are critical in moving towards this preventative future. We are committed to evolving the NFI in a way that best harnesses data and analytics to better detect and prevent fraud. 22. User feedback from NFI national surveys has consistently highlighted that NFI participants are seeking faster technology-based and data-driven solutions, which can be embedded into their internal controls and processes. Participants want to be able to use a more bespoke solution that can be tailored to meet their local needs and is reflective of potential resourcing pressures. National Fraud Initiative, 2024 - 2028 Strategy 9 Page 98 of 120
Page 103
Acknowledging current opportunities and challenges 23. It is important to consider the following opportunities, and challenges, that are present in the current landscape to help inform the NFI’s future direction: • One of the NFI’s greatest strengths is that its data provides a ‘point in time snapshot’, matching data from over 1,100 organisations. This both generates economies of scale and addresses risks for a majority of organisations. However, it also presents challenges in that it is only refreshed on a periodic basis. So, whilst this approach allows for robust fraud and error detection, it limits the effectiveness of fraud and error prevention work in real-time. The frequency and quality of NFI data will be key for us to consider moving forward; • The NFI has the existing technology to access, match and share data on a more automated basis using Application Programming Interfaces or Secure File Transfer Protocols. Where possible, the NFI will explore how this technology can be embedded with NFI participants. However, a large proportion of participants do not have the IT infrastructure to accommodate such forms of data sharing. We will work to pilot and demonstrate the effectiveness of a more automated approach with organisations who can facilitate this technology, and promote it where possible; 8 NFI - Public Sector Case Studies • The NFI has developed innovative products, such as FraudHub, that enables participants to tailor their approach to ongoing and emerging fraud risks and provides more real- time data matching. The NFI will further enhance these products to enable them to be at the forefront in offering accessible data matching in real-time; and • The NFI currently maintains a cost- neutral financial model, meaning that all expenditure in running the NFI’s services is recharged through the fees paid by NFI participants. This represents strong value for money for not just the taxpayer but also for the NFI’s participants, who see a strong return on their investment8. For example, in the last National Exercise (2020-22), the NFI generated £443m in outcomes against £3m in operational costs, representing a return on investment of 1:147 - a large increase on the previous reporting period (2018-20) which was 1:87 (£245m in outcomes against £2.8m in costs). We are committed to maintaining significant return on investments and aim to go even further. The NFI currently maintains a cost-neutral financial model 10 National Fraud Initiative, 2024 - 2028 Strategy Page 99 of 120
Page 104
Anticipating the future landscape Exploring the opportunities and challenges 24. This strategy will demonstrate how we can evolve and build upon what the NFI has already delivered. We also know that in order to evolve, we cannot simply do more of the same, and must anticipate how emerging fraud risks will evolve. 25. As a result, the NFI has considered what the future landscape of fraud could look like, and therefore the role data matching can have in addressing it. The strategy has been designed with a focus on addressing these challenges in order to mitigate their impact, whilst aiming to maximise the outcomes we can achieve: a. Artificial Intelligence (AI) and other technological developments - The role AI and technology will play in the prevention and detection of fraud will undoubtedly be significant. The NFI is committed to identifying how to best utilise AI methodologies. The NFI will further explore existing tools, such as Predictive Analytics, and new technologies to assist in the early identification of fraud and error and enable more efficient data matching (for example, reducing false positives and better prioritising matches for review); b. Private sector collaboration - The Economic Crime Plan 2 (2023-26)9 emphasises the continued importance of partnerships between public and private sector actors, so that they can address the same priorities in tackling economic crime. The NFI endorses and is committed to following this approach and will continue to pursue more data-sharing pilots with private sector partners, 9 Economic Crime Plan 2, 2023-26 - pg.57-62 subject to compliance with the necessary legal and governance requirements, and build upon our already proven track-record of working in this sector to detect and prevent fraud. c. NFI public sector engagement and capability - Although technology is critical, the NFI’s success in identifying potential fraud is reliant on human intervention and the need for capable, informed counter fraud specialists in public organisations, particularly local authorities and NHS bodies. It is because of this, the NFI will launch a new engagement strategy across 2024-28. We will work with the wider PSFA to identify ways in which counter fraud capacity and capability for public sector organisations can be better supported. National Fraud Initiative, 2024 - 2028 Strategy 11 Page 100 of 120
Page 105
Creating the strategy 26. Acknowledging both the current fraud landscape, and exploring the future one, are integral as to how the NFI has developed this strategy. 27. The NFI’s 2022 Survey asked a series of questions to understand the views, and therefore needs of our customers. The survey sought views on several thematic areas, such as overall satisfaction, the NFI product functionality, value for money and both current and future strategic direction. The survey was completed by 346 individuals, with the majority of responses (68%) being from local government. 28. The feedback from the survey highlights that several areas of good progress have been made in recent years, for example: a. Customer satisfaction has continued to increase, with 76% of respondents agreeing10 that the NFI supports delivery of their organisation’s anti-fraud strategy. This builds on an average of 67% from previous surveys; b. Confidence in the NFI’s services has also continued to increase, with 69% agreeing the NFI is a valuable tool to demonstrate that an organisations’ controls and compliance are robust with 67% supporting the frequency of the National Exercise; and for c. Risk management and scoring, 65% of respondents said they regularly use the NFI’s risk scores to prioritise their work for the purpose of data-matching. 10 ‘Agree’ categories include “somewhat agree, agree, strongly agree”. 11 Over 40 Local Authorities that are active members of the NFI’s FraudHub and the strategy’s vision and objectives were shared with all NFI participants for their views. 29. Although positive, and shows that the NFI’s evolving approach and improvements has support, there is still much more that we can do to improve participant satisfaction, value for money and user confidence. As a result, these themes have informed the basis for the strategy’s objectives and the actions underpinning them. 30. Input to develop the strategy has been sought from a range of local authorities11 and counter fraud experts in Audit Wales and the Northern Ireland Audit Office. This provides confidence that the NFI’s 2024-28 strategy represents the views of the NFI’s users. 31. The strategy has been signed-off and endorsed by the Chief Executive of the PSFA, Mark Cheeseman OBE. The feedback from the survey highlights that several areas of good progress have been made in recent years 12 National Fraud Initiative, 2024 - 2028 Strategy Page 101 of 120
Page 106
NFI Partnerships 32. The NFI has developed a collaborative partnership with its data-matching services IT Supplier, Synectics Solutions. Together, we have created bespoke solutions to highlight potentially fraudulent activity where citizens falsify residency or other relevant personal information. 33. The partnership places innovation and collaboration at the forefront, with both committed to developing the NFI and associated products to maximise the benefits for participants. It also enables the NFI to continue to benefit from the expertise and understanding Synectics Solutions has gained from working with clients across the finance, insurance, automotive, public sector and private sectors. 34. Data for the NFI is provided by some 1,100 participating organisations from the public and private sectors including local authorities, government departments, private registered providers of social housing (also known as housing associations) and pension schemes. 35. As voluntary participants, private sector organisations are able to match against data within the NFI secure environment. This allows them to gain insight that helps them target their fraud risks, for example, declaring false information to access a product, service, benefit, etc. 36. The NFI works with public audit agencies in all parts of the UK. The NFI also brings together data on behalf of devolved governments in Northern Ireland, Scotland and Wales. As a result, the NFI is ideally placed to be a UK leader in the matching of data to detect, prevent and recover fraud and error and is keen to work with more organisations to help deliver this. National Fraud Initiative, 2024 - 2028 Strategy 13 Page 102 of 120
Page 107
Overview of the Strategy 37. The intention of this strategy is to commit to and set out the NFI’s agenda for the next four years, giving a clear vision for both new and existing users. It is also intended that this strategy provides a holistic approach to data matching built upon public and private partnerships. Our vision statement 38. Our vision statement aims to articulate the NFI’s ambition to tackle fraud and error through improved access to data and analytics techniques via sophisticated fraud prevention and detection solutions. In turn, this will help ensure the right outcomes for taxpayers across the UK. Vision Statement: “To better detect and prevent fraud by utilising data and technology from the public and private sector”. Our five objectives to achieve our vision 39. The strategy sets out five ambitious objectives which, over the next four years, will put the NFI on its strongest footing to help deliver benefits to public sector bodies in their fight against fraud. Evolve Our Products Through Innovation Maximise the Use and Insight of Data Uphold the Highest Standards of Service Quality and Data Security Improve Training and Support Enhance Engagement to Maximise Outcomes 1 2 3 4 5 Working towards our objectives 40. Each objective is underpinned by a series of specific, measurable actions to help ensure that the relevant objective can be delivered in a practical way. 41. Each objective is supported by specific actions that articulate how we will enhance our services, products and data matching techniques 14 National Fraud Initiative, 2024 - 2028 Strategy Page 103 of 120
Page 108
1 Objective One: Evolve Our Products Through Innovation • We will develop and deliver high impact biennial National Exercises that achieve significant counter fraud outcomes for taxpayers and participants; • We will evaluate and integrate new tools and advanced technologies into our products, including AI and machine learning, making them easy to use and meeting the future needs of our participants; and • We will provide increased opportunities for voluntary participation and the use of the NFI’s products to help maximise fraud outcomes across the public and private sector. 2 Objective Two: Increase Data Access and Insight • We will ensure that the highest-value NFI datasets are refreshed more regularly to improve the accuracy and effectiveness of data matches; • We will deliver a pipeline of data-matching pilots that will identify and evaluate new data sources that demonstrate clear counter fraud potential and address the new and evolving fraud risks of NFI participants before wider implementation; and • We will improve our matching techniques to reduce false positives and improve the prioritisation of data matches by refining matching rules, and risk scoring through predictive analytics. 3 Objective Three: Uphold the Highest Standards of Service Quality and Data Security • We will undertake an annual review with our stakeholders and the technology sector to identify opportunities for service and product improvement and seek regular feedback; and • We will prioritise our internal and external data security, policy and governance mechanisms to protect and safeguard the data we are trusted to hold. 4 Objective Four: Improve Training and Support • We will expand the NFI’s participant training programme to provide bespoke learning and a full induction for all new contacts within six months of appointment; • We will provide a dedicated support service and provide quality guidance for participants; and • We will deepen the NFI Team’s counter fraud and data analytics expertise through targeted training and development opportunities, allowing us to better support participants. 5 Objective Five: Enhance Engagement to Maximise Outcomes • We will deliver an engagement plan and programme for our participants to co-design our products and pilots, enhance collaboration and maximise outcomes; and • We will engage and share best practices on the matching of data with national and international public sector organisations in order to create new partnerships and collaboration opportunities. National Fraud Initiative, 2024 - 2028 Strategy 15 Page 104 of 120
Page 109
Implementation and governance 42. The NFI will be accountable for the delivery of the strategy. The NFI will publish annual targets, where applicable, for the five objectives in a PSFA annual delivery plan. Progress against the delivery of each action in the strategy will be overseen by a governance process within the NFI and PSFA. This has been set out below: • Progress will be formally reviewed by the Head of the NFI on a bi-annual basis. This be done using a bespoke monitoring log, which will include specific, internal targets to ensure delivery is on-track; • Any issues or blockers will be escalated to the NFI Governance Board, which is chaired by the Head of Data and Intelligence of the PSFA; • The NFI will publish an update on the delivery of the strategy as part of its biennial NFI National Reports. This will provide a public opportunity to highlight the significant achievements of our participants, share best practice through case studies, and be transparent about where further action is required. • The first update on progress against this 2024-2028 strategy will be published in the 2026 National Report and then in 2028, at both the mid and end stages of the strategy’s lifecycle. Progress will be formally reviewed by the Head of the NFI on a bi-annual basis 16 National Fraud Initiative, 2024 - 2028 Strategy Page 105 of 120
Page 110
Strategic alignment with the government fraud landscape 43. This strategy aligns with the government’s commitment to ensuring that public resources are used efficiently and that public services are delivered effectively. Combating fraud and corruption will assist in the mission to kickstart economic growth and reduce the national security threat. 44. This strategy will also enable the PSFA to meet its commitments within the Economic Crime Plan (ECP) and the recommendations of the Fighting Fraud Corruption Locally Strategy for the 2020s, by modernising the fraud and error response, widening access to tools and technology and increasing public- private data sharing. 45. The PSFA has also published several external strategies and policy documents, such as its mandate, the Government Counter Fraud Profession Strategy and 2023/24 Delivery Plan - the totality of which sets out the PSFA’s role, responsibilities and strategic direction. 46. In doing so, the NFI has ensured that its vision, objectives and actions are mutually compatible with PSFA’s macro- level mission statements to: a. Modernise the fraud and error response by widening access, and use of, leading practices, tools and technology - better protecting taxpayers money; b. Build expert led services that collaborate with experts in Departments and Public Bodies to better fight fraud and error through risk, prevention, data and enforcement techniques; c. Develop capability in the public sector to find, prevent and respond to fraud and error - both organisationally and individually; d. Put performance at the heart of the public sector fraud conversation - focusing on investments and outcomes; and e. We will aim to be seen as a beacon of fraud and error expertise and a destination for those wanting to make a difference in fighting public sector fraud. Contact For more information, or if you have any questions, please contact the National Fraud Initiative at nfiqueries@cabinetoffice.gov.uk. We also invite you to browse through the NFI’s publications on GOV.UK, including our national reports, press releases and information about our operation and services. National Fraud Initiative, 2024 - 2028 Strategy 17 Page 106 of 120
Page 111
Page 107 of 120
Page 112
Page 108 of 120
Page 113
To: Audit, Risk, and Scrutiny Board On: 18 August 2025 Report by: Director of Children’s Services Heading: Audit Scotland Briefing: Additional Support for Learning 1. Summary 1.1. Audit Scotland publishes regular national reports covering matters related to local and national government. In February 2025 Audit Scotland published ‘Additional Support for Learning’. 1.2. The report summarises the status of Additional Support for Learning (ASL) in Scotland and the challenges facing the sector. The report builds on previous papers such as the Morgan Review. 1.3. The Audit Scotland report calls on the Scottish Government to make fundamental changes to how they resource and measure ASL. 2. Recommendations 2.1. It is recommended that members of the Audit, Risk, and Scrutiny Board note the content of the Audit Scotland report and the implications for ASL within Renfrewshire Council. 3. Background 3.1. The number of pupils recorded as having additional support needs has increased by 768% since the introduction of the Additional Support for Learning (ASL) Scotland Act in 2004. As of 2024, 40% of pupils in schools receive ASL. The report suggests that an improved awareness of ASL and the long-term impact of the Covid-19 pandemic may have contributed to this increase. 3.2. The Audit Scotland report states that the significant rise in children and young people receiving ASL is in part due to the Scottish Government adopting a wider, more inclusive definition of additional support needs which include: Item 6 Page 109 of 120
Page 114
- Children requiring any provisions that are considered different from what would be received by the majority of children. - Those receiving temporary support. - For many categories there does not need to be a formal diagnosis. - All children and young people who have been looked after are presumed to require additional support unless determined otherwise. ASL- Data Framework 3.3. Audit Scotland highlights that there are likely to be gaps in understanding the scale and nature of the ASL figures due to inconsistent record keeping between councils and limitations arising from the SEEMiS reporting system. The Scottish Government aims to develop a new system for recording ASL data by 2028. As an interim measure, Renfrewshire Council has issued guidance on the recording of additional support needs related to the Staged Intervention Framework. 3.4. The report acknowledges that there are wider barriers to children accessing additional support, such as children waiting on an appointment for diagnosis. In August 2024, a CAMHS Education Advisor was appointed as a single point of contact to address this issue locally. 3.5. Audit Scotland states that while the current data framework highlights some groups who make up a greater proportion of ASL children and young people, it does not provide enough detail to comprehensively plan for ASL provision. 3.6. According to the report, key statistics relating to ASL are: - Boys are 22% more likely to receive ASL than girls. - 46% of children from the most deprived areas have ASL compared to 27% of children from the least deprived areas. - Secondary school children are more likely to have ASL than primary school students. However, Audit Scotland suggest that this could be due to additional needs becoming more prominent with age. In Renfrewshire, 40% of secondary pupils are recorded as having additional support needs, compared with 29% in primary. 3.7. The report identifies that children with ASL have a significantly lower attainment outcomes than those without, with there being a 20-percentage point gap in those achieving the expected Curriculum for Excellence level. In Renfrewshire, the size of the primary gap in literacy was 31-percentage points and in 23-percentage points in numeracy. Page 110 of 120
Page 115
3.8. Audit Scotland advocates for greater progress in the creation of a new framework for measuring the attainment of children with ASL to ensure that they can fully develop to their full potential. This is a move that has received significant support from Inclusion Ambassadors, secondary school aged children with additional support needs. The report highlights that there has been insufficient progress in addressing the challenges raised by the Morgan Review in 2020. ASL - Resources 3.9. Audit Scotland criticises the Scottish Government for not planning for the potential impact of the more inclusive definition for ASL. The report says that this can reflected in the lack of resources and training available to schools. 3.10. The report highlights that while the Scottish Government has provided funding for ASL through both the general resource grant and various specialist grants, the funding has not been able to keep up with the increased demand. 3.11. Audit Scotland highlights the increased use of Additional Support Needs Tribunals since the Covid-19 pandemic as an example of pressures on councils. While the tribunals are intended as the final recourse for parents to dispute a decision not to allow a placing request, the legislation does not specify that other routes need to be pursued first. This has resulted in parents applying to tribunals as the first recourse which has a significant financial and resource costs to councils. The report calls for better communication with parents to direct them towards other routes for resolution. In order to improve communication, Renfrewshire has trained both in- house and independent mediators. 3.12. While figures show that councils spend on average 12% of their education budget on ASL, Audit Scotland believes this figure under-estimates the amount spent. This discrepancy is due to most ASL provision being provided within mainstream settings where resources are not recorded separately. The reported figures also do not include any council funding that is outwith the education budget, e.g. social work funding. 3.13. Audit Scotland’s own research into funding and found that councils spent an average of over 50% of ASL funding on staffing, with a further 14% being spent on additional support schools or enhanced provision units within mainstream schools. During 2024-25, Renfrewshire Council spent 74.51% on ASL staffing, including units within mainstream schools with a further 5.65% on ASN schools. 3.14. According to Audit Scotland’s research, classroom teachers provide the majority of ASL within schools, with support from teachers increasing by 347% since 2019. Page 111 of 120
Page 116
However, the report cautions that this increase may be the result of improved record keeping rather than a real terms increase in support. Within Renfrewshire a Staged Intervention Framework has been implemented to ensure the most appropriate support is applied at the right time with a relentless focus on early intervention. 4. Key Messages 4.1. Audit Scotland encourages the Scottish Government and the ASL Project Board to implement a new national data framework for recording ASL provision across all Local Authorities. 4.2. The report argues that through improving its understanding of ASL demand, the Scottish Government would be in better position to understand how to comprehensively resource the ASL needs of children and young people. 4.3. Audit Scotland advocates for a new framework for measuring attainment outcomes to ensure that all children’s needs are met. 4.4. Audit Scotland suggests that there may need to be a fundamental change to how ASL is funded to ensure that teachers and specialist staff are appropriately supported to provide ASL. 4.5. Audit Scotland highlights that since the UNCRC (Scotland) Act was adopted into Scots law in July 2024, there is a greater statutory duty for public organisations to ensure that children’s needs are met. 5. Implications of the Report 1. Financial – While Renfrewshire is not directly mentioned in the report reference is made to the need to reform local authority funding for additional support for learning. 2. HR & Organisational Development – While not directly mentioned in the report, Audit Scotland do highlight the need for more support for staff providing ASL. 3. Community/Council Planning – None 4. Legal - None 5. Property/Assets – None 6. Information Technology – None 7. Equality & Human Rights – None: an equality impact assessment is not required for this report as it is a summary of a national report for noting only. 8. Health & Safety – None 9. Procurement – None 10. Risk – None 11. Privacy Impact – None 12. Climate Risk – None Page 112 of 120
Page 117
13. Children’s Rights – While not directly mentioned in the report reference is made to the UNCRC and the additional responsibilities it places on councils. 14. Cosla Policy Position – None List of Background Papers Audit Scotland report: Additional Support for Learning Inclusion Update to Education and Children’s Services Policy Board 15 May 2025 Author: Andrew Voysey, Assistant Policy Officer, andrew.voysey@renfrewshire.gov.uk Page 113 of 120
Page 118
Page 114 of 120
Page 119
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 August 2025 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Audit Scotland: Local Government Budgets 2025/26 ___________________________________________________________________ 1. Summary 1.1 In May 2025, Audit Scotland published "Local Government Budgets 2025/26”, on behalf of the Accounts Commission. The budget briefing summarises key issues arising from analysis of the 2025/26 budgets recently agreed by Scotland’s 32 councils. This paper provides an overview of the Audit Scotland briefing. ___________________________________________________________________ 2. Recommendations 2.1 It is recommended that members of the Audit, Risk and Scrutiny Board: • Note the contents of this report; • Note that this report has previously been considered by the IJB Audit, Risk and Scrutiny Committee on 20 June 2025. _________________________________________________________ 3. Background 3.1 Audit Scotland published a similar briefing in 2024, providing analysis of council budgets across Scotland, as well as how councils are addressing the challenges faced in achieving a balanced budget and longer-term financial sustainability. Item 7 Page 115 of 120
Page 120
3.2 This 2025/26 briefing provides analysis of council budgets set for 2025/26, considers how councils are addressing the financial challenges, and also how councils have consulted with communities on budget priorities, including the measures agreed to achieve financial savings. 4. Key Findings of the Local Government Budgets 2025/26 Briefing Council Funding and Budgets 4.1 The briefing provides details of financial settlements in recent years, and notes that the 2025/26 initial funding to councils is higher than last year, with revenue and capital funding both increasing by 6% in real terms, to £15.2 billion. However, the briefing highlights that councils continue to face recurring pressures such as inflation, annual pay deals, and growing demand for services, and that most of the increase will be used to deliver previously agreed national commitments. In addition, the briefing notes that councils face additional costs related to the increase in employer’s National Insurance contribution rates, and that investing in new buildings and assets is increasingly expensive. 4.2 The briefing highlights that, at the time of setting 2025/26 budgets, councils identified a combined revenue gap of around £647million, which represents a budget gap in the range of 3.4% of councils’ total combined revenue budgets for 2025/26. Compared with 2024/25, the total budget gap identified by councils has increased by £52million. At a council level, budget gaps ranged from £70.3million in the City of Edinburgh Council, to £4.4 million in Eilean Siar. Renfrewshire Council’s 2025/26 budget gap (prior to decisions taken by Council in setting the 25/26 budget) was £17.2million. Decisions taken by Council in setting the 25/26 General Fund revenue budget have brought the Council back to recurring financial balance. 4.4 The briefing highlights actions that councils have been taking to close their 2025/26 budget gaps, by generating additional income or by reducing expenditure. This includes all councils raising council tax rates, by between 6% and 15.6%, identifying savings, drawing on reserves, and increasing or introducing charges for accessing some services. 4.5 The briefing notes that councils are introducing new and innovative measures to reduce costs, and provides the example of Renfrewshire Council introducing its new digital advisor (Millie), available 24/7 to support any individuals with routine or transactional requests. Page 116 of 120
Page 121
4.6 The Accounts Commission briefing notes that across all councils, most savings are planned within corporate services (£68million), followed by children’s services (£58million). The briefing highlights that actions to tackle climate have the lowest level of saving measures planned, with £0.4 million of savings planned in 2025/26. 4.7 Despite taking these measures, the briefing notes that councils are still forecasting that more will need to be done in future years to achieve financial sustainability, given the projected increases in both costs and level of service demand. Social Care Budgets 4.8 In their analysis, the Accounts Commission note that, of the £18billion revenue budget in 2025/26, councils reported £4billion related specifically to social care services, equating to almost 23% of councils’ total revenue budget. The briefing highlights the financial pressures and risks experienced by Integration Joint Boards (IJBs), including, they note, “reliance on non-recurring sources of income, such as reserves and one-off savings, and reserve levels falling below individually agreed minimum reserve policy levels”. The briefing states that these have a strong impact on council budgets, and collaborative working and planning is needed across IJB partners in the budget- setting process. 4.9 The Accounts Commission refers to its IJB Finance Bulletin 2023/24 in the briefing, and notes that the agreement of savings plans and NHS partner funding were the most common reasons for balanced budgets not being agreed at the start of the financial year. The Accounts Commission asserts that this “misalignment” in budget processes presents a challenge as councils look to identify savings, and transform how they deliver services, given the significant proportion of council budgets dedicated to providing social care services. Consulting with Communities 4.10 The Accounts Commission briefing highlights that as councils continue to make difficult decisions, it is more important than ever that local communities are involved in the decisions that impact their services. 4.11 The briefing notes that 31 councils completed Equality Impact Assessments (EIAs), as part of the 2025/26 budget setting process. In the Accounts Commission analysis, 30 councils provided evidence of Page 117 of 120
Page 122
how they engaged with residents while identifying saving measures and wider proposals within their 2025/26 budgets. However, the Accounts Commission highlights that approaches taken varied in terms of depth and level of how councils engaged with communities in budget setting. 4.12 The briefing notes that budget setting processes vary across councils, and that it is challenging for the Accounts Commission to compare information across the sector. They note that within individual councils, the way in which budget information is presented could be improved. To improve accessibility, the briefing notes that with more transparent reporting of agreed budgets, the budget gaps faced, and how to make use of reserves, councils can inform and better include their local communities in making the choices still needed to address ongoing financial challenges. 5. Accounts Commission Expectations 5.1 The briefing sets out the expectations the Accounts Commission has for councils to encourage more active participation in the budget setting process, summarised below: • budget papers and financial monitoring reports provided to elected members include clear and understandable headline figures, that state the impact of specific budget decisions on the overall financial position of the council • budgets should link back to the council’s corporate plan to allow elected members to make spending choices better informed by, and based upon, the council’s priorities • fundamental information, such as the forecast budget gap, is clearly presented as part of the consultation process with residents • estimated costings of how specific proposals will contribute to managing the budget gap are made available to residents, including the potential contribution of any proposed increase to council tax, and the anticipated impact on levels of service delivery • general public consultations are supplemented by targeted consultations with groups most impacted by changes to specific services, and that consideration is given to how to encourage participation Page 118 of 120
Page 123
• the ongoing impact of budget decisions are fully assessed, including through Equality Impact Assessments, to enable elected members to make informed decisions. ___________________________________________________________________ Implications of the Report 1. Financial – none, though the report references national trends in relation to local government finance 2. HR & Organisational Development - none 3. Community/Council Planning – none 4. Legal - none 5. Property/Assets – none 6. Information Technology – none 7. Equality & Human Rights - the recommendations within this report have not been assessed in relation to their impact on equalities and human rights as the report concerns a national briefing on local government finance and is for noting only. 8. Health & Safety – none 9. Procurement – none 10. Risk – none 11. Privacy Impact – none 12. Climate Risk –not applicable 13. Children’s Rights –not applicable. 14. COSLA Policy Position –not applicable. _______________________________________________________ List of Background Papers None Page 119 of 120
Page 124
___________________________________________________________________ Page 120 of 120