Annual Ia Plan Complete
Renfrewshire Council · 13 March 2023
Back to Audit, Risk and Scrutiny Board — 13 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 13 March 2023 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Annual Internal Audit Plan 2023/2024 ___________________________________________________________________ 1. Summary 1.1 In line with the requirements of the Public Sector Internal Audit Standards, a risk based internal audit plan for 2023/24 has been developed. The audit plan takes into account the outcomes of the internal corporate and service risk identification and evaluation processes, and the current business environment. In addition to undertaking work which will provide assurance on the robustness on key internal controls, the plan seeks to reflect the key priorities and challenges for the council. 1.2 A number of methods have been employed to facilitate production of the risk based audit plan for 2023/24: • Consultation with all Directors and their Senior Management Teams, • Consultation with Senior management from the associate bodies; • Benchmarking with other Local Authorities; • Review of strategic, corporate and service risk registers; • Cumulative audit knowledge and experience; • Review of key external audit and inspection reports. 1.3 The total available resource is 1184 days, the operational audit time available for 2023/24 has been identified as 940 days (79%). The remaining 244 days (21%) relates to training, service development, administration and management. Coverage of the plan is achieved through the use of in-house staff and where relevant, commissions from other providers.
Page 2
1.5 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. Non-operational time includes provision for training, performance management and service development. In addition to the internal audit assurance function the Chief Auditor has managerial responsibility for risk management, insurance and corporate counter fraud which are excluded from the calculation of available operational audit resources. 1.6 Delivery of the risk based annual audit plan supports effective member scrutiny of the council’s internal financial and other control mechanisms. ___________________________________________________________________ 2. Recommendations 2.1 Members are asked to approve the content of the risk based audit plan for 2022/24. 2.2 Members are asked to note that the progress of the 2023/24 annual audit plan and summaries of the findings from each audit assignment will be reported to the Board on a quarterly basis. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - The subject matter of this report is the risk based Audit Plan for 2023 –2024
Page 3
11. Privacy Impact – None 12. COSLA Implications - None ________________________________________________________________ Author Andrea McMahon, Chief Auditor
Page 4
No embedded text on this page.
Page 5
Date March 2023 Annual Internal Audit Plan 2023/24 Finance & Resources Internal Audit
Page 6
Page 3 of 13 Renfrewshire Council Annual Internal Audit Plan 2023/24 Contents Page Audit Plan Overview 4 - 8 Supporting Appendices 1 Annual Council Internal Audit Plan 2023/24 9 – 10 2 Annual Other Bodies Internal Audit Plan 2023/25 11 3 Analysis of plan by service 12 4 Annual Audit Plan 2023/24 – Integration Joint Board 13
Page 7
Page 4 of 13 Audit Plan Overview 1. Introduction 1.1 In line with the requirements of the Public Sector Internal Audit Standards, a risk based internal audit plan for 2023/24 has been developed. In formulating the audit plan a risk assessment has been undertaken, giving consideration to the following sources of information: Risk assessment (1) Risk assessment and prioritisation of all auditable activities (audit universe). (2) Strategic and Corporate Risk Register. (3) Service Risk Registers. Consultation (4) The Chief Auditor has met with each member of the CMT and their senior management teams to ascertain any changes to operational practice and national policy and to determine their priorities and risks. (5) Senior Management from the associate bodies and One Ren have been consulted to ascertain their priorities and risks. (6) The Chief Executive has been consulted on what he sees as the council’s priority and risk areas for the forthcoming year. (7) Feedback from, and the expectations of, the Audit, Risk and Scrutiny Board are identified through the regular meetings with the members of the board. (8) The Chief Auditor has met with Audit Scotland to ascertain their approach to the statutory audit where assurance on key internal controls could be provided to avoid any duplication of effort. Benchmarking (9) Other Local Authority internal audit plans. (10) Discussion with other Chief Auditors through the Scottish Local Authority Chief Auditors Group. Review of key internal reports (11) Creating a fairer Renfrewshire built on innovation, wellbeing and opportunity – Renfrewshire’s Council Plan (12) The results of internal audit work in 2022/23 and in previous years. Review of key external reports (13) Audit Scotland: Renfrewshire Council - Report to Members and the Controller of Audit on the 2021/22 Audit. (14) Audit Scotland: Best Value reports issued during 2022/23. 1.2 On the basis of the above, the audit engagements planned for 2023/24 are set out in Appendix 1, 2 and 4, for the Council, Associate Bodies and the Integration Joint Board in the following categories of audit activity: • Assurance, • Governance, • Contingency, • Planning and Reporting 1.3 It is the responsibility of management to ensure that they have good governance, risk management and internal control arrangements over the functions they are responsible for. It is internal audit’s role to provide an independent, objective assurance and consulting activity. The scope of the internal audit plan encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation's governance, risk management, and internal control processes; as well as the quality of performance in carrying out assigned responsibilities to achieve the organisation’s stated goals and objectives. Delivery of the internal audit plan supports the requirement for the Chief Auditor to provide an annual opinion which is used to inform the annual governance statement.
Page 8
Page 5 of 13 1.4 The Chief Auditor shares information and coordinates activities with other internal and external providers of assurance and consulting services, as appropriate, to ensure proper coverage and minimise duplication of effort. Internal audit may place reliance on the work of other providers of assurance and the ability to do so will be considered during each audit engagement. 1.5 The plan also includes provision for managing and developing the internal audit activity including audit planning, reporting, periodic quality assessments and for following up on previous recommendations and reactive investigative work. The plan includes contingency time to allow for completion of work carried forward from 2022/23 and provides for consultancy engagements to be undertaken where these can improve the council’s operations, add value and improve the management of risks. Contingency time also provides for sufficient flexibility to accommodate changing risks and priorities during the course of the year. More detail on each of these elements is set out in sections 4 to 7 of this plan. 1.6 The internal audit service is delivered and developed in accordance with its purpose which, as set out in the Internal Audit Charter, is to provide assurance by independently reviewing the council’s risk management, control and governance processes. 2. The current business environment and key risk areas 2.1 The audit plan detailed in Appendix 1 has been development to support the achievement of the council’s objectives and the challenges we face in achieving those objectives. The key challenges included in the planned audit work are detailed below. (1) Financial Challenges Our organisation faces an unprecedented financial challenge to make significant savings after many years of already delivering substantial efficiencies and reduction in our spending. Alongside this, our communities are experiencing a cost-of-living crisis and the demand for our services is higher than ever before. Therefore, the financial outlook continues to be subject to significant and regular scrutiny. The 2023/24 audit plan includes time for reviewing: • the procurement of goods and services; • treasury management; • non-domestic rates; • hardship and other discretionary payments. (2) Supporting organisational development The Council is fundamentally remodelling how and where we work as part of our recovery from the COVID-19 pandemic. We seek to have a skilled and well supported workforce with access to modern technologies that support our organisation and it’s employees to deliver on our priorities. The 2023/24 audit plan includes time for reviewing: • health and safety arrangements; • recruitment processes; • project management; • asset management to support hybrid working; and • ERP Utilisation. (3) Contract management The Council spends significant sums of money on contracts with external suppliers of goods and services. Good contract management will ensure the outcomes envisaged at the inception of the contract are delivered in practice and ensure best value for money. Poor contract management can impact reputation, contractual relationships and incur additional costs. The 2023/24 audit plan includes time for reviewing the: • roads plant and labour contract; and • vehicle hire contracts.
Page 9
Page 6 of 13 2.2 There are a number of significant risks, arising from the external and internal environment, which could impact on the council’s ability to achieve its objectives. The most significant risks and the risk control measures to manage these risks, are identified through the council’s corporate risk management process. Subject to the overall flexibility of the Audit Plan, priority will be given to audit engagements which impact on the council’s strategic and corporate risks. 3. Allocation of Resources 3.1 In addition to the internal audit assurance function the Chief Auditor has managerial responsibility for risk management, insurance and counter fraud which are excluded from the calculation of available operational audit resources. 3.2 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. The calculation of operational staff time has been based on 6 full time equivalent employees plus 60 days to be provided from other service providers. The internal audit team is appropriately resourced with 4 qualified and 2 non-qualified staff. Non- operational time includes provision for training, performance management and service development. 3.3 Resources from any unfilled elements of posts and other available audit resource will be used flexibly to ensure that the audit plan commitments are met, through the engagement of temporary staff and other audit service providers where appropriate. Where engagements are undertaken by the other audit service providers, these can provide an opportunity for benchmarking and training and development. Sufficient resources are available to engage specialist contractors where necessary to address any specific risks faced by the council. 3.4 The total available resource is 1184 days; the operational audit time available for 2023/24 has been identified as 940 days (79%). The remaining 244 (21%) days relates to training, service development, administration and management. Resources are assessed as being sufficient to provide an evidenced based opinion. 3.5 The following paragraphs provide an overview of how the audit time has been allocated to audit categories for the Council and the Associated Bodies we provide services to. A summary of the operational time by audit category is detailed in table 1 below. The analysis of non- operational audit activity is detailed in the table 2 below. The planned operational/non- operational time for 2022/23 is given for comparative purposes. 2022/23 2023/24 Category of audit Planned Days % of Operational Time Planned Days % of Operational Time GOVERNANCE 112 12% 96 10% ASSURANCE 381 40% 391 42% CONTINGENCY note 1 314 34% 319 34% AUDIT PLANNING / REPORTING 134 14% 134 14% TOTAL OPERATIONAL TIME 941 100% 940 100% Table 1 Notes 1. This category includes time for the finalisation of the previous year’s audits, corporate exercises and groups, investigations, significant project consultancy activities and emerging priorities.
Page 10
Page 7 of 13 2022/23 2023/24 Activity Planned Days % of Non - operational Time Planned Days % of Non - operational Time TRAINING 57 23% 63 26% STRATEGIC MANAGEMENT 20 8% 16 7% TEAM ADMINISTRATION 96 38% 96 39% DEVELOPMENT note 1 79 31% 69 28% TOTAL NON-OPERATIONAL TIME 252 100% 244 100% Table 2 Notes 1. This category includes time allocated to development activities to support continuous improvement activities. 4. Governance (10% of operational time) 4.1 Internal Audit must evaluate the risk exposures relating to the council’s and associate bodies governance arrangements. The engagements within this category form the basis for the Chief Auditor’s annual audit opinions and support the annual governance statements. 4.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part A in respect of the current year, with a total of 96 days being allocated to these engagements for 2023/24. 5. Assurance (42% of operational time) 5.1 A risk based assessment has been undertaken of all auditable areas taking into account the risk management framework and the expectation of senior management and the Audit, Risk and Scrutiny Board. The engagements within this category also form the basis for the Chief Auditor’s annual opinions and support the annual governance statements. For each engagement internal audit will consider whether there are any available external sources of assurance can be relied upon to deliver the plan. Time is also allocated to following up on the implementation of prior year audit recommendations. 5.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part B in respect of the current year, with a total of 391 days being allocated to these engagements for 2023/24. 6. Contingency (34% of operational time) 6.1 This category includes time allocations for finalisation of the 2022/23 audit plan, undertaking reactive investigations of theft, fraud or other malpractice and provides for post-report work which includes attending disciplinary or appeal hearings, employment tribunals and court, as required. 6.2 The council is also undergoing a significant period of change and although these changes represent significant priorities and risks for the council, the arrangements may not be sufficiently well established to be suitable for evidence based audit reviews. In recognition of this, the 2023/24 audit plan includes provision for the on-going and anticipated involvement in significant project consultancy activities, optimisation of the Business World product, participation in corporate groups, as well as smaller scale internal control reassessment by services. 6.3 The allocation of time for this category is an estimate based on prior experience and available resources. However, this will be monitored during the course of the year to ensure that internal audit continue to be in a position to respond to other priority areas which emerge during the course of the year, and, if necessary, revise the audit plan accordingly. Appendix 1 and 2, Part C details the indicative time of 319 days allocated across the contingency heading.
Page 11
Page 8 of 13 7. Audit Planning / Reporting (14% of operational time) 7.1 This category includes annual planning activity and reporting arrangements to the Corporate Management Team and the Audit, Risk and Scrutiny Board, the Integration Joint Board Audit, Risk and Scrutiny Board and the Boards of the other bodies we provide internal audit services to under a service level agreement. Appendix 1 and 2, Part D details the time of 134 days allocated to planning and reporting activities. 8. Analysis of Plan by Service 8.1 Appendix 3 shows the amount of operational audit time allocated to individual services in 2023/24 and compares it to the planned days for 2022/23. 8.2 The planned days allocated to all services relates to work which is cross-cutting rather than service specific as well as time which is allocated out to services as the year progresses, such as contingency and investigations. 9. Conclusion 9.1 The annual internal audit plan for 2023/24, based on the strategic risk assessment, reflects the current priorities and challenges for the council, and demonstrates that the internal audit service continues to deliver added value while continuing to improve the service in line with best practice. 9.2 The allocation of internal audit resources is sufficient to allow for flexibility to deal with emerging priorities and provide adequate coverage of governance, risk management and internal control to inform the annual assurance statement. 9.3 The plan may be subject to amendment during the course of the year due to the emergence of issues of greater priority, or other unforeseen circumstances. The Audit, Risk and Scrutiny Board will be requested to approve any necessary changes. Chief Auditor March 2023
Page 12
Page 9 of 13 Appendix 1 Council Internal Audit Annual Plan 2023/24 Entity Engagement Title Service Days Allocated Part A – Governance 51 Corporate Governance Corporate Governance Framework Corporate - All Services 6 Policies & Procedures Recruitment Corporate - All Services 25 Schools Procedures Administration of Medicines Children’s Services 20 Part B – Assurance 343 Follow Up Follow Up Corporate - All Services 40 Health & Safety Health & Safety Corporate - All Services 20 Programme Management Project Management Corporate - All Services 25 Procurement Purchasing processes Corporate - All Services 30 ICT Planning & Organisation Asset Management (hybrid working) Corporate - All Services 20 ICT Delivery & Support ERP Utilisation Corporate - All Services 20 Non Domestic Rates Non Domestic Rates Finance & Resources 15 Treasury Management Treasury Management Finance & Resources 20 Other Financial Assistance Hardship and Discretionary Funds Finance & Resources 20 Housing Assurance Statement Housing Assurance Framework Environment & Infrastructure 8 Commercial & Industrial Rents Commercial & Industrial Rents Chief Executive’s 20 Waste Management Waste Management Environment & Infrastructure 25 Building Services Operations Building Services Stores Environment & Infrastructure 20 Contract Management Roads Labour & Plant Contract Environment & Infrastructure 20 Transportation & Fleet External vehicle hire Environment & Infrastructure 20 Criminal Justice Services Unpaid work procedures Children’s Services 20 Part C – Contingency 311 Contingency Contingency Corporate - All Services 124 Contingency Corporate Groups Corporate - All Services 50 Contingency Investigations Corporate - All Services 137
Page 13
Page 10 of 13 Part D – Planning & Reporting 115 Planning & Reporting Planning & Reporting Corporate - All Services 115
Page 14
Page 11 of 13 Appendix 2 Other Bodies Internal Audit Annual Plan 2023/24 Entity Engagement Title Service Days Allocated Part A – Governance 45 Integration Joint Board – Governance Arrangements Corporate Governance Framework Integration Joint Board 5 Integration Joint Board – Governance Arrangements Performance Management Integration Joint Board 20 RVJB - Governance Information Governance Valuation Joint Board 20 Part B – Assurance 48 SE – Contract Monitoring Implementing collaborative procurement Scotland Excel 25 OneRen – Other Systems Payroll Processes OneRen 23 Part C – Contingency 8 Contingency Contingency All Associate Bodies 8 Part D – Planning & Reporting 19 Planning & Reporting Planning & Reporting All Associate Bodies 19
Page 15
Page 12 of 13 2022/23 2023/24 Service Planned Days % of Operation al Time Planned Days % of Operational Time All Services note 1 512 55% 612 65% Chief Executive’s Service 60 6% 20 2% Finance & Resources 95 10% 55 6% Children’s Services 40 4% 40 4% Adult Services 20 2% 0 0% Environment & Infrastructure 50 5% 93 10% Community & Housing 28 3% N/A N/A COUNCIL TOTAL 805 85% 820 87% Scotland Excel 25 3% 30 3% Clydeplan 10 1% 4 0% Renfrewshire Valuation Joint Board 20 2% 25 3% Renfrewshire Health & Social Care Integration Joint Board (Appendix 4) 55 6% 35 4% OneRen 26 3% 26 3% TOTAL 941 100% 940 100% Notes 1 Planned time includes, Follow up Audit, Contingency, Planning and Reporting and an element of Cross cutting Assurance and Governance Audits and is allocated against services during the course of the year Appendix 3 Analysis by Service
Page 16
Page 13 of 13 Audit Category Engagement Title No. of days Detailed work Governance Local Code of Corporate Governance 5 Annual review of the adequacy and compliance with the Local Code of Corporate Governance to inform the governance statement. Governance Performance Management 20 The purpose of the audit is to review the arrangements in place for managing and monitoring organisational performance. Planning & Reporting Annual Plan, Annual Report and Audit Committee reporting & Training 7 The Chief Internal Auditor is required to prepare an annual plan and annual report for the Audit Committee, summarising the work undertaken by Internal Audit during the year and using this to form an opinion on the adequacy of the control environment of the IJB. Contingency Ad-hoc advice and Consultancy 3 Time for advice and consultancy on relevant priorities and risks or change related projects and following up on the implementation of internal audit recommendations. Appendix 4 Annual Audit Plan 2023/24– Integration Joint Board