1. ARSB - Unaudited Annual Governance Statement 2023-2023
Renfrewshire Council · 22 May 2023
Back to Audit, Risk and Scrutiny Board — 22 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 22 May 2023 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Unaudited Annual Governance Statement 2022 - 2023 ___________________________________________________________________ 1. Summary 1.1 The Local Authority Accounting Regulations require that an Annual Governance Statement is prepared and included in the Annual Accounts for the council. The Annual Governance Statement should be prepared in accordance with the CIPFA / Solace guidance “Delivering good governance in Local Government”. 1.2 The Annual Governance Statement for 2022-23 is attached and has been prepared in accordance with the relevant regulation and guidance taking account of the Internal Audit Annual Report and Director’s evaluation of the operation of the governance arrangements within each service area. 1.3 The Governance Statement is subject to statutory audit by the Council’s External Auditors as part of their review of the annual accounts. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to note the Annual Governance Statement which will be included in the Unaudited Accounts for 2022/23. ___________________________________________________________________
Page 2
Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – The application of sound governance arrangements supports the Council to deliver on its key objectives and priorities. 4. Legal - subject to approval by Council, the Accounts will be released for audit by the statutory deadline of 30 June 2023. 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk – Specific risks identified from the Chief Auditor’s Annual Report and the assessments of service Directors are disclosed in the statement. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Andrea McMahon
Page 3
Annual Governance Statement Scope of responsibility Renfrewshire Council is responsible for ensuring that its business is conducted in accordance with the law and proper standards, and that public money is safeguarded, properly accounted for, and used economically, efficiently and effectively. The Council also has a statutory duty to make arrangements to secure best value under the Local Government in Scotland Act 2003. In discharging this overall responsibility, the Council’s members and the corporate management team are responsible for putting in place proper arrangements for its affairs and facilitating the effective exercise of its functions, which includes arrangements for the management of risk. The Council has approved and adopted a Local Code of Corporate Governance, which is consistent with the principles of the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Society of Local Authority Chief Executives (SOLACE) framework; Delivering Good Governance in Local Government. A copy of the Local Code is available on our website Local Code of Corporate Governance - Renfrewshire Website. This statement explains how Renfrewshire Council has complied with the Local Code and also meets the Code of Practice on Local Authority Accounting in the UK, which details the requirements for an annual Governance Statement. The purpose of the governance framework The governance framework comprises the systems and processes, and culture and values, by which the Council is directed and controlled and through which it accounts to, engages with and leads the community. It enables the Council to monitor the achievement of its strategic objectives set out in the Council plan. The system of internal control is a significant part of that framework and is designed to manage risk to a reasonable level. Internal control cannot eliminate all risk of failure to achieve policies, aims and objectives and can therefore only provide reasonable and not absolute assurance of effectiveness. The system of internal control is based on an ongoing process designed to identify and prioritise the risks to the achievement of the Council’s policies aims and objectives, to evaluate the likelihood of those risks being realised and the impact should they be realised, and to manage them efficiently, effectively and economically. The governance framework The main features of our governance arrangements are described in the Local Code but are summarised below: The overarching strategic priorities and vision of the Council are set out in the Council Plan 2022-2027 and the Renfrewshire Community Plan 2017-2027. The Council Plan is aligned to the Community Plan and sets out 5 strategic outcomes that the organisation will work to achieve over a 5-year period with specific priorities relating to tackling inequality, promoting economic and cultural regeneration, attainment and sustainability. Renfrewshire’s Community Plan (which also acts as Renfrewshire’s Local Outcome Improvement Plan as required by the Community Empowerment (Scotland) Act 2015) details how community planning partners will work together to achieve the key priorities identified for Renfrewshire. • The key outcomes the Council is committed to delivering with its partners, are set out in the Community Plan; • The Council operates within an established governance framework which incorporates a scheme of delegated functions, financial regulations, standing orders relating to contracts and procedural standing orders. These elements of the framework are kept under regular review by the Council; • The Council facilitates policy and decision making through a policy board structure; • Services are able to demonstrate how their own activities link to the Council’s vision and priorities through their service improvement plans. Performance management and monitoring of service delivery is reported through policy boards regularly including six monthly updates to the Leadership Board on progress against the implementation of the Council Plan; • The Corporate Management Team has agreed a new refreshed approach to its performance monitoring and the Council Plan scorecard will be considered alongside other performance information each quarter and followed up with an in-depth look at performance in one service particular area of interest at regular intervals.
Page 4
• An annual report on the Local Government Benchmarking Framework, which includes data for over 100 indicators for all 32 local authorities, is provided to the Audit, Risk and Scrutiny Board each year. • The Council has adopted a code of conduct for its employees. Elected members adhere to the nationally prescribed Code of Conduct for Members. In addition, the Council has in place a protocol for Relationships between Political Groups, Elected Members and Officers; • The Council’s approach to risk management is set out in the risk management strategy and is well embedded. Risks are reported regularly to the Audit, Risk and Scrutiny Board. During the year development work was completed on a new assurance model for managing business as usual risk, which involves senior managers working through a series of modules to ascertain their levels of assurance in how these risks are being managed within their services. A further development includes the Corporate Risk Management Group undertaking “control deep dive” exercises which involves detailed investigation of specific risk controls known to be in place to ascertain if the risk is over/under or well controlled; • The Director of Finance and Resources is the Council’s Senior Information Risk Owner and information risk is monitored through the Information Management and Governance Group and its sub-groups. The Managing Solicitor (DPO) is the statutory Data Protection Officer; • Comprehensive arrangements are in place to ensure members and officers are supported by appropriate training and development; • Registers of interests for elected members and senior officers are maintained and published on the Council’s website; • The Council complies with the CIPFA Code of Practice on Managing the Risk of Fraud and Corruption and the Council’s arrangements for fraud prevention, detection and investigation are managed through the corporate counter fraud service; • The Council’s approach to ‘whistleblowing’ is outlined in the whistleblowing policy. • Cyber-attacks are both increasing and becoming more sophisticated and while no system of internal control can provide absolute assurance the Council has a range of multi layered Cyber Security controls are in place and are tested annually to check standards in line with Government guidance. Industry cyber security standards are followed and explicitly those belonging to Public Sector Network (PSN), National Cyber Security Centre (NCSC) guidance, Scottish Government Public Sector Cyber Resilience Plan and Payment Card Industry (PCI) data security standards. The O365 security and compliance toolset provides a wide range of protection against cyber-attacks including identity theft and phishing. The Council holds a current Certificate of Compliance for PSN standards. ICT network and digital services are monitored monthly through our cyber security partner. These are all monitored and managed through the Cyber Security team which is headed up by a CISM qualified Cyber Security Architect (Cyber Information Security Manager). Events and alerts are monitored 24 x 7 by our cyber security partner who are authorised to take emergency preventative action where necessary; • Clear and independent governance arrangements are in place with One Ren and the Renfrewshire Health and Social Care Partnership with oversight from the Head of Policy and Commissioning and the Head of Corporate Governance respectively and the Council’s Leadership Board. • Seven Local Partnerships have been established and have identified initial local priorities. Decision making including that relating to relevant grants is delegated to each Local Partnership through a Lead Officer appointed by the Council. This governance framework has been in place at Renfrewshire Council for the year ended 31 March 2023. Within the 2021/22 report, Audit Scotland concluded that the Council’s governance arrangements, including during the COVID-19 pandemic, were “appropriate and operated effectively”. The system of internal financial control The system of internal financial control is based on a framework of regular management information, financial regulations, administrative procedures (including segregation of duties), management and supervision, and a system of delegation and accountability. Development and maintenance of the system is undertaken by managers within the Council. The system includes: • Guidance on financial management supported by comprehensive financial regulations and codes; • Comprehensive budgeting systems, and detailed guidance for budget holders; • Regular reviews of periodic and annual financial reports which indicate financial performance against the forecasts;
Page 5
• Setting targets to measure financial and other performance; • The preparation of regular financial reports that indicate actual expenditure against the forecasts; • Clearly defined capital expenditure guidelines; • As appropriate, formal project management principles; • The Chief Finance Officer is the Director of Finance and Resources who complies with the CIPFA Statement on the Role of The CFO in Public Services. The role and responsibilities of the Audit Committee and the Chief Auditor The role of the audit committee is under the remit of the Audit, Risk and Scrutiny Board which is chaired by an independent elected member; its role includes: • to approve the internal audit charter and annual internal audit plans; • to review internal and external audit reports and the main issues arising, including those relating to the annual accounts and seek assurance that action has been taken and make recommendations to the Council where appropriate; • to receive and consider the Chief Auditor’s annual report, summarising internal audit activity and the level of assurance this provides over the arrangements for internal control, risk management and governance within the Council; • to monitor the performance of internal audit; • to consider the annual review of the Local Code of Corporate Governance. The internal audit service operates in accordance with the Public Sector Internal Audit Standards and reports to the Audit, Risk and Scrutiny Board. Internal audit undertakes an annual programme of work, approved by the Board, based on a strategic risk assessment. The Council’s Chief Auditor provides an independent opinion on the adequacy and effectiveness of the governance framework, risk management and internal control. The Council conforms to the requirements of the CIPFA Statement on the Role of the Head of Internal Audit (2019). Members and officers of the Council are committed to the concept of sound governance and the effective delivery of Council services. The Audit, Risk and Scrutiny Committee complies with the CIPFA guidance Audit Committees: Practical Guidance for Local Authorities and Police. The Council’s Chief Auditor has responsibility to review independently and report to the Audit, Risk and Scrutiny Board annually, to provide assurance on the adequacy and effectiveness of the Local Code and the extent of compliance with it. The Audit, Risk and Scrutiny Board performs a scrutiny role in relation to the application of the Local Code of Corporate Governance and regularly monitors the performance of the Council’s internal audit service. Internal Audit reporting arrangements include communication of finalised audit engagements, monitoring the progress of agreed management actions and communication of any unacceptable risk identified to the Board. Review of effectiveness and continuous improvement Renfrewshire Council has responsibility for conducting, at least annually, a review of the effectiveness of its governance framework including the system of internal control. The review of effectiveness of the framework is informed by the work of the Corporate Management Team who have responsibility for the development and maintenance of the governance environment, the Chief Auditor’s annual report, and reports from the external auditors and other review agencies and inspectorates. The effectiveness of the governance framework is reviewed annually by the Corporate Management Team, including the use of an annually updated self-assessment tool covering five key areas of governance, as follows: • Business Planning and Performance Management • Internal Control Environment • Budgeting, Accounting and Financial Control • Risk Management and Business Continuity • Conflicts of Interest, Whistleblowing and Gifts and Hospitality This self-assessment indicated the governance framework is being complied with in all material respects. In addition, the review of the effectiveness of the governance arrangements and the systems of internal control
Page 6
within the group entities places reliance upon the individual bodies’ management assurances in relation to the soundness of their systems of internal control. The Council’s approach to continuous improvement has a number of strands. Our Council Plan and Service Improvement Planning processes drive much of this and allow for elected member scrutiny of improvement activity. Services also undertake improvement work linked to their core duties and to statutory requirements. Registered services in education, housing, social work and social care regularly undertake self-assessment activity as part of their regulatory framework and inspection process. Services within Environment, Housing and Infrastructure maintain their ISO 9001 accreditation as one means of demonstrating quality. The Council has recently developed its own model of corporate self- assessment based on the Public Service Improvement Framework. The Council continues to recognise the need to exercise strong financial management arrangements to manage the financial pressures common to all local authorities and has robust financial control and financial planning processes in place. The CIPFA Financial Management (FM) Code was adopted by the Council in June 2021. An Action Plan has been established following wide engagement with senior managers, service users and Finance staff. It contains 59 improvement actions with target dates ranging from 2023 until 2025. Work to refresh the initial engagement will be undertaken over the next 1-2 years to ensure that improvement work continues to be relevant and effective. • In the post-pandemic period, the Council has had a strong focus on recovering from Covid-19 and continuing to mitigate some of the impacts on our communities, including those relating to rapidly increasing living costs. As an organisation, the Council has adopted continues to adopt new ways of working, building on the strong approach developed during the pandemic in areas such as digital access for customers, and embracing hybrid working. Whilst this is still a recovery phase, much of the business-as-usual work has fully resumed, including: • the work on social renewal, which began during the pandemic, is now part of the wider Fairer Renfrewshire programme, which is overseen by a sub-committee of the Leadership Board services hare returned to the regular programme of reporting performance to elected members through policy boards, with service improvement plans submitted for approval in spring 2022 and regular progress updates provided. • the Right for Renfrewshire programme recommenced over 2022, and the service redesigns progressed were in those areas where it was anticipated that there would be potentially less direct impact from the pandemic recovery process and where the greatest opportunity exists for appropriate management and service capacity to be directed towards the Right for Renfrewshire agenda; • the ongoing impact of the pandemic on service delivery continue to be monitored as part of service recovery arrangements There have been no significant changes to internal controls although significant numbers of new and amended processes; • the Council commenced planning for Brexit during 2019/20 and identified risks have been incorporated into the Strategic and Corporate Risk Registers. Some of these risks will be further exacerbated by the ongoing conflict in Ukraine and the associated sanctions on Russia which will place additional cost and supply pressures on some products and materials that are likely to increase and continue into 2023/24. Audit Scotland have introduced a new approach to auditing Best Value in local government which has commenced this year as part of the next 5-year Best Value Audit programme. This approach involves thematic areas of focus each year which will be considered for all local authorities within the same snapshot in time rather than the previous rolling programme of deep dive audits which inspect each local authority across a five-year programme. This is significant shift in approach and for year one, will examine the effectiveness of leadership in developing new local strategic priorities. Audit Scotland have also indicated they will be looking at Councils’ approaches to climate change, cyber security (both will be looked at in year one) reducing inequalities and demonstrating improved outcomes for communities (ongoing). Alongside the ongoing Best Value auditing and this new approach with annual themes, there will also be a Section 102 Audit carried out and a report produced at some point within the 5-year programme. Unlike the new annual thematic reviews, this is anticipated to involve a deeper dive across all Best Value themes
Page 7
collated into a lengthier report specifically for Renfrewshire Council. The first year of this will run from October 2023 to August 2024 and Renfrewshire Council has not been included for this round. Another change for Renfrewshire Council sees the appointment of a new team of external auditors, Azets. More information about Azets and the planned audit approach was outlined to the Audit, Risk & Scrutiny Board in March 2023 in the External Audit Plan 2022/23. Audit Scotland provided an unqualified and unmodified audit opinion on the 2021/22 annual accounts. An external independent review is ongoing regarding the circumstances which led to an error with the projected required school roll of Dargavel Primary School. Once this external review has reached its conclusion, the findings from this review will be considered by Council, including any improvement actions identified. Regular reviews of the Council’s arrangements are undertaken by internal audit, in the 2021/22 governance statement, 2 areas were identified where only limited assurance could be provided. • Memorial safety - The inspection process for memorials has progressed significantly and is currently sitting at 85% complete. The remaining 15% will be completed by the end of June 2023. In addition to the initial inspections being carried out the service is now carrying out reinspection’s to the headstones that were identified as requiring to be monitored annually for any deterioration at their initial inspection. • Corporate purchase cards – card holders and approvers have been reminded that the procedures must be complied with, and sample checks are being undertaken by the Procurement team. Regular internal audit reviews of compliance with the procedures will continue to be undertaken. The programme of work undertaken by internal audit in 2022/2023 identified 6 occasions where a limited or no assurance level was provided in relation to the internal control, risk management and governance objectives for the specific areas of each audit review. Of these 4 were specific to individual service areas and although these areas require to be addressed there is no significant impact on the Council’s overall system of internal control and action plans are in place to address the risk identified. The 2 areas identified as impacting on the overall internal control, risk management and governance arrangements are: • Business continuity plans - Service level Business Continuity Plans require to be improved to record all the ICT areas referred to in the council’s Business Continuity Plan template for all service areas. The main areas to be reviewed and updated are service area restoration plans and plans in the event of ICT system outages. The Crisis and Resilience Management Team have overarching responsibility for Business Continuity Plans and recommendations have been made to address the areas identified and ensure a consistent approach is taken across services. • Creditor payments - The audit specifically reviewed the arrangements for compliance with the purchase to pay procedures, whereby manual payments should only be made in very specific circumstances. The review identified that current process in place for the passing and payment of manual invoices fall short in several areas and creates several risks, particularly in relation to possible breaches of the Council’s Contract Standing Orders. Internal audit undertakes an annual exercise to ensure that recommendations arising from internal audit engagements have been implemented by service management and the results are reported to the Audit, Risk and Scrutiny Board. This work highlighted that 67% of recommendations were implemented by the due date. 30% had passed their original due date and revised implementation dates have now been set and 3% were superseded. Of the 13 recommendations followed up that were deemed to be critical, 8 have been fully implemented, 3 have been partially implemented and 2 were still to be implemented. Revised implementation dates have been agreed for each of these recommendations.
Page 8
It is our view that the Council has in place a sound for governance, risk management and internal control and that appropriate mechanisms are in place to identify any areas of weakness. This is corroborated by an Annual Report incorporating the Annual Assurance Statement prepared by the Council’s Chief Auditor stating that subject to management addressing the critical and important recommendations made the limited and no assurance reports, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s internal control, risk management and governance arrangements. Action Plan Following consideration of the review of adequacy and effectiveness the following action plan has been agreed to ensure continual improvement of the Council’s governance. Agreed action Responsible person Date All service level business continuity plans are to be updated to record all the ICT risks referred to in the council’s business continuity plan template for all service areas. Service Directors September 2023 A review of the current manual payment process is under review with key stakeholders from the Corporate Procurement Unit and the Finance Business Partners, this will enable and introduce an exception policy to support the No Purchase Order No Payment. Once the review is conducted the exception policy will be implemented and the No Purchase Order No Payment approach will commence, this is anticipated to take up to 12 Months. Procure to Pay (P2P) Manager May 2024 The agreed actions will be subject to review to identify the progress being made in implementing these actions. Update on the 2021/22 Action Plan Agreed action Progress Update Responsible person Date Prepare 3-year Improvement Plans for each service Complete All 2022 Service Improvement Plans were approved by the relevant Policy Boards in May/June 2022. Service Directors June 2022 Review and refresh quarterly scorecard of performance information Complete The new Council Plan scorecard was approved by Leadership Board in December 2022. New approach to Corporate Management Team (CMT) scorecard approved by CMT March 2023. Head of Policy and Commissioning December 2022 March 2023 Establish an action plan arising from the CIPFA FM Code Complete The Action Plan was delayed due to other priorities and capacity issues in the Finance team; however, it is Head of Finance and Procurement December 2022
Page 9
now complete and was finalised on 8 March 2023. Update on the 2020/21 Action Plan The 2020/21 Governance Statement identified areas of continuous improvement activities to be taken forward to improve the overall governance, risk management and internal control environment. Progress over the last 12 months against the agreed action plan is detailed below. Agreed action Progress Update Responsible person Date Review and update where necessary the policy for expressing concerns outwith line management whistleblowing’ for approval by Board. Complete Chief Auditor February 2023 Review and refresh the Council Plan. Complete Head of Policy and Commissioning September 2022 Assurance Subject to the above, and on the basis of the assurances provided, we consider the governance and internal control environment operating during 2022/23 provides reasonable and objective assurance that any significant risks impacting on the achievement of our principal objectives will be identified and actions taken to avoid or mitigate their impact. Systems are in place to continually review and improve the governance and internal control environment and action plans are in place to address identified areas for improvement.