2. ARSB - Internal Audit Annual Report 2023 - 2023
Renfrewshire Council · 22 May 2023
Back to Audit, Risk and Scrutiny Board — 22 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 22 May 2023 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Annual Report 2022 - 2023 ___________________________________________________________________ 1. Summary 1.1 The Public Sector Internal Audit Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of the Council’s internal control environment and include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters that can be used to inform the governance statement. 1.3 The Annual Report for 2022-23 is attached and outlines the role of Internal Audit, the performance of Internal Audit, the strategic and operational issues which influenced the nature of the work carried out, the key audit findings, and contains the annual audit assurance statement. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the contents of the Internal Audit Annual Report. ___________________________________________________________________
Page 2
Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author Andrea McMahon
Page 3
Annual Report 2022-2023 Renfrewshire Council Internal Audit May 2023
Page 4
No embedded text on this page.
Page 5
Renfrewshire Council Internal Audit Annual Report 2022/2023 Contents Page 1. Introduction 1 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2022/23 2 4. Summary of Internal Audit Work 4 5. Internal Audit Resources 4 6. Review of Internal Audit Activity • Table 1 – Analysis by category of audit 5 7. Quality Assurance and Improvement Activity • Table 2 – Internal Audit Performance 6 8. Implementation of Audit Recommendations • Table 3 – Implementation of Audit Recommendations 6 9. Performance of Non-Audit Activities • Table 4 – Corporate Counter Fraud Performance 7 10. Audit Assurance Statement 9 Appendix 1 – Summary of Assurances
Page 6
No embedded text on this page.
Page 7
1 Renfrewshire Council Internal Audit Annual Report 1 April 2022 – 31 March 2023 1. Introduction 1.1 Internal Audit is an independent and objective assurance and consulting activity designed to add value and improve the operations of Renfrewshire Council. It assists Renfrewshire Council in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organisation's risk management, control, and governance processes. 1.2 The Chief Auditor reports functionally to the Audit, Risk and Scrutiny Board and administratively (i.e. day to day operations) to the Director of Finance and Resources. In accordance with the principles of good corporate governance, regular reports on internal audit work and performance are presented to the Audit, Risk and Scrutiny Board. 1.3 The purpose, authority and responsibility of the internal audit activity is defined in the internal audit charter, approved by the Audit, Risk and Scrutiny Board; and provides that the Chief Auditor has independent responsibility for the conduct, format and reporting of all internal audit activity and findings. 1.4 The service operates in accordance with the Public Sector Internal Audit Standards (PSIAS). The Standards define the basic principles for carrying out internal audit. They establish the framework for providing internal audit services, which add value to the organisation, leading to improved organisational processes and operations. 1.5 The Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. The annual report must also provide an annual audit opinion, on the overall adequacy and effectiveness of the Council’s internal control environment. It must include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters that can be used to inform the governance statement. 1.6 The aim of this report is to provide an opinion on the overall adequacy and effectiveness of the council’s framework of governance, risk management and control and provide a summary of the work undertaken during the year to support that opinion. The report also provides details of the performance of the internal audit service during the past year, and the results of the quality assurance and improvement programme. 1.7 In addition to the work carried out in relation to council services, we also provide an internal audit service to the following organisations:
Page 8
2 • OneRen • Renfrewshire Valuation Joint Board • Scotland Excel • Clydeplan • Renfrewshire Health and Social Care Partnership – Integration Joint Board 1.8 The outcome of the audit assignments undertaken for these organisations is reported separately as part of their annual report which also contains an assurance statement to their Boards. 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of the Council’s managers to ensure that the management of the areas under their control is adequate and effective and that their services have a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3. Internal Audit Activity during 2022/2023 3.1 The internal audit plan for 2022/2023 was approved by the Audit, Risk and Scrutiny Board on 13 June 2022. The plan was risk-based and took into account the outcomes of the service and corporate risk evaluation processes, any significant changes in council operations over the period, and the impact of developments in national policy and regulation. The plan also took into account key external audit reports including their Annual Audit Plan for the council. 3.2 The audit plan is kept under continuous review throughout the year, to ensure we are flexible in reacting to the post pandemic work environment or to any changing risk profile for the council. We also experienced a reduction in resource for the team for part of the year due to unplanned absence. The Audit, Risk and Scrutiny Board approved the following amendments to the plan: • Administration of medicines in schools has been deferred until 2023/24. • Catering procurement cards, the time on this was utilized to review the revised processes proposed for catering purchases. 3.3 All other planned work as detailed in the 2022/2023 audit plan has been undertaken or commenced and those assignments not finalised by 31 March 2023 have been prioritised in the first quarter of the current year.
Page 9
3 3.4 Set out below are the significant risks which influenced the content of the plan and the nature of the work undertaken in recognition of these. (1) Financial Sustainability The medium to longer term financial sustainability risk remains very high as the financial outlook is subject to considerable uncertainty as a result of various factors including future grant levels, pay pressures and the significant cost of living increases. Therefore, the financial outlook continues to be subject to significant and regular scrutiny. The 2022/23 audit plan included time for reviewing: • the best value arrangements throughout the Council; • the control of payroll variations; • the procurement of goods and services by quick quote processes; • rental income collection procedures; • debt management processes and • care at home processes. (2) Economy The coronavirus pandemic has resulted in many challenges for economies across the world, a number of sectors have been impacted by the lockdown restrictions and some sectors are currently experiencing significant volatility in terms of labour and supply chains as well as major cost rises as a result of the rising inflation rates. The 2022/23 audit plan included a review of the arrangements for processing development planning applications. (3) Reducing Equalities in Renfrewshire The Council plays a key role in tackling inequalities and providing the best possible services to our communities. It is committed to working with and providing support to communities to assist in the successful delivery of local priorities. The 2022/23 audit plan included time for reviewing grants provided to the cultural sector. (4) Cyber Attack Cyber attacks are becoming more and more frequent and sophisticated and we have seen attacks on large public organisations which have had a significant impact on their service provision. The 2022/23 audit plan included a review of the controls and protections the council has in place over its cyber environment. (5) Climate, Sustainability and Adaptability Given the significant rising energy costs consumers are facing, the Council has a role in promoting and advising its community about energy efficiency as well as making optimum use of its property estate and reduce overall running costs and energy consumption levels. The 2022/23 plan included time for reviewing the energy management arrangements in operation.
Page 10
4 2.3 In addition the following reviews included in the 2022/23 plan relate to business as usual risks inherent by nature of our type of organisation:- • Supply Teachers Processes • Disaster Recovery Arrangements • Review of the Information Asset Register. 3.5 In line with the council’s procedures, instances of suspected theft, fraud or other irregularity are reported to internal audit. Depending on the nature of the allegations, they are investigated either by the internal audit service or by the Corporate Counter Fraud service. All referrals were evaluated and investigated as appropriate. 3.6 During 2022/23, Internal Audit conducted a number of investigations in relation to internal control matters which recommended improvements in the arrangements for processing change requests for both payroll and supplier bank detail and improvements in the governance arrangements for capital works within a partner organisation. The remaining unplanned investigations related to employee conduct and service management has undertaken disciplinary procedures and strengthened internal controls where necessary. 3.7 The outcomes of all internal investigation reviews undertaken by internal audit are reported to the Audit, Risk and Scrutiny Board. 4. Summary of Internal Audit Work 4.1 The internal audit team has been working on a hybrid basis, mainly from home. The team also provided advice and support where necessary to council services. 4.2 Appendix 1 details the assurances arising from the internal audit work carried out in line with the 2022/23 audit plan and from those 2021/22 assignments which were finalised during this year which supports the annual assurance statement. These include the conclusions in relation to the overall system of internal control, risk management and governance arrangements. 5. Internal Audit Resources 5.1 For the year to 31 March 2023, the audit plan was based on an establishment of 6.00 full time equivalent employees plus 80 days to be provided from other service providers. However, the actual staffing complement was reduced due to higher than anticipated unplanned absence. Two council and one Integration Joint Board audit engagements were outsourced as planned. 5.2 The internal audit team will ensure that independence and objectivity are maintained in line with the PSIAS including where non-audit work is undertaken. Internal auditors will have no operational responsibilities. There have been no impairments impacting on the Chief Auditor’s independence and the team has been adequately resourced during the year.
Page 11
5 6. Review of Internal Audit Activity 6.1 The Audit Plan for 2022/23 set out our risk-based plans across a range of audit categories, the results of which have been reported quarterly to Audit, Risk and Scrutiny Board. Table 1 below compares the actual days spent on each category of audit work against that planned for the year. Table 1 Type of Audit Planned Days Actual Days Variance Days % Governance 112 82 30 27% Assurance 381 318 63 17% Contingency 314 371 (57) 18% Audit Planning & Reporting 134 132 2 1% Total Operational Days 941 903 38 4% Training 57 53 4 7% Strategic Management 20 11 9 45% Team Administration 96 80 16 17% Development 79 35 44 56% Total Non-operational Days 252 179 73 29% Gross Available Days 1193 1082 Operational % 79% 83% Non-Audit – Including Management of Risk Management and Insurance and Corporate Counter Fraud including the co-ordination of NFI 93 65 28 30% 6.2 Material differences (over 20% and over 20 days) from the plan are explained below: 1) Governance The planned review of administration of medicines in schools was deferred until 2023/24 due to the planned implementation of a revised policy. The review of IJB risk management arrangements commenced at the end of March 2023 and consequently part of the budgeted days are deferred into 2023/24. 2) Strategic Management and Development Less time than anticipated was spent on preparing for our external quality assessment and on development of our audit management system.
Page 12
6 7. Quality Assurance and Improvement Activity 7.1 Internal audit measures performance against a range of measures set annually by the Director of Finance and Resources. The Audit, Risk and Scrutiny Board received quarterly reports on progress and performance during the year. Table 2 shows the actual performance against targeted performance for the year. Table 2 Internal Audit Performance 2022/23 Performance measure Target 2022/23 Actual 2022/23 % completion of audit plan for the year* 95% 93% % engagements completed by target date 95% 97% % engagements completed within time budget 95% 98% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 7.3 The percentage completion of the audit plan is slightly below the target set for the year. This was due to the level of unplanned leave and the additional time attributed to unplanned work. The actual performance for the year for the two other indicators, is above the target performance level. 7.4 The PSIAS require the Chief Auditor to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self- assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation. 7.5 We continued to participate in the Scottish Local Authorities Chief Internal Auditors’ Group peer review process and our external assessment has recently been completed by the Chief Internal Auditor from South Ayrshire Council. The report concluded that the internal audit service fully conforms with the PSIAS. The report included 7 recommendations for improvement, 3 of which had already been identified through the internal self-assessment process. An action plan has been completed and the report has been submitted to the Audit, Risk and Scrutiny Board. 7.6 External Audit’s review of the internal audit service concluded that overall the service operates in accordance with the PSIAS. 8. Implementation of Audit Recommendations 8.1 During 2022/23, 94 recommendations were followed up, with 67% of all recommendations being completed. The implementation status of the recommendations across each service area is detailed in Table 3 below.
Page 13
7 Table 3 Implementation of Audit Recommendations 2022/23 Service No. Followed up Complete Partially Complete (new date) Not Implemented (new date) Redundant Adult Services 1 0 1 (100%) 0 0 Chief Executive’s 31 21 (68%) 8 (26%) 2 (6%) 0 Children’s Services 7 7 (100%) 0 0 0 Environment & Infrastructure 12 10 (84%) 1 (8%) 1 (8%) 0 Finance & Resources 38 22 (58%) 10 (26%) 4 (11%) 2 (5%) Communities & Housing 5 3 (60%) 1 (20%) 0 1 (20%) Total 94 63 (67%) 21 (23%) 7 (7%) 3 (3%) 9. Performance of Non-Audit Activities 9.1 Risk Management The responsibility for co-ordinating risk management and insurance activity across the council lies with internal audit. Risk management performance is detailed in the risk management annual report. 9.2 Corporate Counter Fraud The Corporate Counter Fraud Team reports to the Chief Auditor; during the period 2022/2023, the team has worked on a hybrid basis. The Corporate Counter Fraud Team works to raise awareness of fraud, and to encourage and promote an anti-fraud culture. Where a suspicion of fraud arises, the team investigate and report their findings to management. Where appropriate, follow-on action is taken, such as reporting the matter to Police Scotland for further investigation, or directly to the Procurator Fiscal. The team works to protect Council resources, investigating frauds against the Council, such as: council tax reduction, tenancy, housing application, Scottish Welfare Fund, school placements, blue badge; and any other potentially fraudulent matter arising. As a result of changes to working practices during the pandemic, some investigative processes have been streamlined. Where appropriate, customers are now contacted by telephone or e-mail. This process is convenient for customers and staff alike, and enables investigations to be conducted quickly and efficiently. Where necessary, and for more serious cases, visits and interviews under caution are conducted.
Page 14
8 The team continue to work with the DWP, undertaking joint investigations, which can result in the identification of overpayments of Single Person Discount, Council Tax Reduction, Council Tax Benefit, Housing Benefit, Universal Credit, Child and Working Tax Credits, and other DWP benefits. Counter fraud training sessions were suspended during the pandemic. Revised working practices mean that many staff are now working from home, and face to face sessions with staff are no longer practical for many colleagues. Counter fraud staff now utilise Microsoft Teams to liaise with colleagues across Council services; to provide advice, discuss cases, conduct virtual meetings, and group counter fraud training sessions. In addition to this, a Counter Fraud training course has been developed, and will be available to staff, in the coming weeks. Once available on iLearn, the training course will be rolled out to staff, and included in future counter fraud training session packages. Table 4 Corporate Counter Fraud Performance 2022/23 Financial Outcomes 2022/23 (£) Cash savings directly attributable to preventative counter fraud intervention (e.g business grants) 8,674.00 Cash recoveries in progress directly attributable to counter fraud investigations 9,2940.66 Notional savings identified through counter fraud investigation, (e.g. housing tenancy and future council tax) 338,664.05 Housing Benefit Savings identified through other counter fraud work or through joint working with the DWP 65,289.86 Other DWP Benefit or Tax Credit Savings Savings identified through other counter fraud work or through joint working with the DWP 78,706.73 Non-Financial Outcomes 2022/23 Housing properties recovered 3 Housing applications amended/cancelled 4 Blue badge misuse warning letters issued 21
Page 15
9 9.3 The National Fraud Initiative The National Fraud Initiative (NFI) in Scotland is a counter-fraud exercise led by Audit Scotland and overseen by the Cabinet Office for the UK. It uses computerised techniques to compare information about individuals held by different public bodies, and on different financial systems that might suggest the existence of fraud or error. Internal audit is responsible for the co-ordination of the exercise which is undertaken every second year. The Council’s data, as required by the NFI, was submitted in October 2022, the resulting matches were received from January 2023 and investigation of those matches is currently being progressed throughout this year by Corporate Fraud and Council Services. The final outcomes arising from the exercise will be subject to a separate report to the Audit, Risk and Scrutiny Board during 2024/25. 10. Audit Assurance Statement 10.1 Internal audit has performed its work in accordance with the role defined in paragraph 1.4. The audit work performed has been reported to senior managers and where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 10.2 In view of the continued challenges common to all local authorities, the Council recognises the need to exercise very close scrutiny over financial management and compliance with overarching governance arrangements and will continue to take appropriate action to further strengthen control in these areas. 10.3 Internal audit contributes to the promotion of sound corporate governance in the Council. The scrutiny function within the council performed by the Audit, Scrutiny and Petitions Board further demonstrates strong commitment in this area. 10.4 It is not feasible for the system of internal control in the Council to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal audit recognises this and assesses this in its reporting mechanism. 10.5 The audit plan is always intended to be flexible and contingency time was utilised to undertake additional work on areas of emerging risk. Additionally, the gross operational days were reduced by 9% due to unplanned absence. Subject to management addressing the critical and important recommendations made the limited and no assurance reports, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s internal control, risk management and governance arrangements, as evidenced by:- (i) the results of the planned audit work in 2022/23;
Page 16
10 (ii) the results of investigative work in 2022/23; (iii) management self assessment of internal control, risk management and governance arrangements; (iv) management action to respond to audit recommendations to mitigate the risks areas highlighted in this report; (v) the regular review of the Local Code of Corporate Governance. Signed Chief Auditor Date 22 May 2023
Page 17
Appendix 1 1 Audit Engagement Risk Area Assurance Level Conclusion Winter Maintenance Procedures Assurance Reasonable • The audit identified that adequate arrangements were in place in relation to documented procedures, there were sufficient specialist vehicles deployed and appropriate forecasting information was available to support decision making. Areas identified for improvement included record keeping, performance monitoring and stock control. Self-Directed Support Assurance Substantial • Satisfactory arrangements are in place to engage with, assess and provide support and care for eligible clients. Audit findings identified during this review related to good practice associated with review dates for procedures and recording of information. Housing Safety Checks Assurance Substantial • The audit identified that in the main safety checks across the council's high rise estate were carried out and any matters escalated appropriately. It was identified that there is no documentation detailing the roles and responsibilities regarding the safety checks by contractors organised by Property Services on Housing Services behalf. Creditors Assurance Reasonable • The controls in place over the five procurement systems tested were generally satisfactory. Recommendations were made in relation to documented procedures for one system and improvements were recommended in relation to segregation of duties for another system. Council Tax Collection Assurance Substantial • Satisfactory arrangements are in place for administering council tax payments received and following up arrears. Payments received were correctly and promptly posted to taxpayers’ accounts. KPI’s were regularly reviewed and appropriately reported. Improvements were recommended in relation to the processes for refunds, write offs and credit balances. Non-Domestic Rates Assurance Reasonable • Satisfactory controls are in place for the billing and collection of rates. Improvements were recommended in
Page 18
Appendix 1 2 relation to record keeping for rates relief applications. At the time of the audit, reviews of Non Domestic Rates reliefs were not being carried out, as a result of other priorities during the pandemic, but were planned to recommence. Driver and Vehicle Checks Assurance Limited • A number of recommendations for improvement made in relation to documented procedures, daily record keeping and compliance and certain safety arrangements. Housing Assurance Framework – Compliance Checks Assurance Substantial • Based on a sample check of the evidence used to demonstrate compliance, we would confirm that the Council complies with the requirements of the Housing Assurance Statement. Stores – Stock Issues Assurance Limited • The audit reviewed the arrangements in place for roads, lighting and refuse bins stock. Recommendations for improvement were made to improve records of stock movements and to ensure that the three sections reviewed comply with all aspects of the council’s Instructions for stocktaking and annual reporting including possible write offs of stock. Statutory Inspections – Public Buildings Assurance Substantial • For those inspections within our audit sample, arrangements to identify all properties requiring inspections by Building Services and Contractors were satisfactory. Some inspections were not carried out during Covid but the majority of inspections tested were back on track. All adult care establishment inspections tested, were back on track. Procurement – Quick quote processes Assurance Substantial • Satisfactory arrangements are in place which ensure adherence to the quick quote process. The council’s contracts standing orders were temporarily updated at the beginning of 2022 with one of the principal changes being the lower threshold for quick quotes increasing from £10,000 to £25,000. It was recommended that a full review of the contract standing orders, including
Page 19
Appendix 1 3 consideration of the increased threshold, should be completed and presented for approval by the Council. Business Continuity Plans Assurance Limited • Service level Business Continuity Plans require to be improved to record all the ICT areas referred to in the council’s Business Continuity Plan template for all service areas. The main areas to be reviewed and updated are service area restoration plans and plans in the event of ICT system outages. The Crisis and Resilience Management Team have overarching responsibility for Business Continuity Plans and recommendations have been made to address the areas identified and ensure a consistent approach is taken across services. Creditors – Purchase to pay Assurance No Assurance • The audit specifically reviewed the arrangements for compliance with the purchase to pay procedures, whereby manual payments should only be made in very specific circumstances. The review identified that current process in place for the passing and payment of manual invoices were not sufficient in several areas and creates several risks, particularly in relation to possible breaches of the Council’s Contract Standing Orders. Corporate Governance Framework Governance Substantial • Based a sample check of the evidence used to demonstrate compliance, it was confirmed that the Council complies with the requirements of the Local Code of Corporate Governance. In addition, it was evident that the Local Code has been subject to review and updating in line with developments in best practice and any revised Council Policies. Cyber Security Assurance Reasonable • The internal control processes were generally satisfactory. The audit identified some scope for improvement in the existing arrangements mainly in relation to training for staff and updating the incident response plan to include more detail on decision- making arrangements. School Meals Debt Assurance Limited • Documented procedures have been in place since October 2021. However, these are only partially
Page 20
Appendix 1 4 implemented at secondary schools thereby allowing debt to continue to accumulate. Action is not always being taken to identify the circumstances contributing to the school meals debt and whether assistance can be provided. Furthermore, invoices are not being issued when required. This has resulted in a significant number of overdrawn school meals accounts on the ParentPay System. Control and Recording of Assets – plant and equipment Assurance Limited • The audit specifically reviewed the compliance with the inventory procedures in relation to Streetscene plant and equipment and identified that the controls in place were inadequate. At the time of the review, some items could not be located. Significant improvements are required to ensure compliance with the Council’s Inventory Procedures. Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse.