3. ARSB - Summary of Internal Audit Reports for period 01 January to 31 March 2023
Renfrewshire Council · 22 May 2023
Back to Audit, Risk and Scrutiny Board — 22 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 22 May 2023 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 01 January to 31 March 2023 ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement, Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details those audit engagements completed during the period 1 January to 31 March 2023 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to Renfrewshire Leisure Ltd and Renfrewshire Health and Social Care Integrated Joint Board;
Page 2
• Co-ordination of the Council’s corporate risk management activity; • Management of the counter fraud team; • Management of the risk management and insurance team. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 1 January to 31 March 2023. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Karen Campbell – 07768354651
Page 3
Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 1 January – 31 March 2023 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Environment & Infrastructure Statutory Inspections – Public Buildings Substantial 0 0 0 0 Chief Executive’s Quick Quote Processes Substantial 0 0 2 0 Corporate Business Continuity Plans Limited 2 1 2 0 Chief Executive’s/Finance & Resources Creditors – Purchase to Pay No Assurance 1 2 0 0 Note – No assurance rating can be given in respect of investigation assignments Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk.
Page 4
• The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report Environment & Infrastructure Statutory Inspections – Public Buildings (A0110/2022/001) Date: January 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: - 1. There is an appropriate service level agreement in place with Building Services to undertake statutory inspections and remedial works; 2. Appropriate arrangements are in place to identify all properties requiring statutory inspections, including adult care establishments, within the guidance timescales and log the outcome of these inspections; 3. Appropriate sub contracts are in place for inspections where the inspections are not undertaken directly by Building Services; 4. Arrangements are in place to undertake resulting remedial works arising from inspection visits, within the required timescales and log the works as completed; 5. Compliance certificates are appropriately retained; 6. Adequate performance management information is available to senior management. Audit Scope The following work was carried out: 1. Interviewed the appropriate staff and ascertained the processes in place for statutory inspections at Public Buildings. 2. Prepared a series of tests to enable examination of the areas outlined in the objectives. 3. The inspections selected for testing were Gas Safety, Emergency Lighting and Electrical Routine by Building Services and Lift Maintenance, Fire Alarms and Smoke Ventilation by external contractors. Key Audit Assurances 1. Scheduled inspections by Building Services and Contractors and their frequencies are set out in a table within the Renfrewshire Council Guidance on Statutory Inspections and Maintenance, prepared by the Health and Safety team. 2. Appropriate arrangements are in place to identify all properties requiring statutory inspections and log the outcome of these inspections. 3. Appropriate sub contracts are in place for those inspections which are not undertaken directly by Building Services; 4. Appropriate arrangements are in place to undertake remedial work arising from inspection visits and log the works as completed; 5. Compliance certificates are appropriately retained; 6. Adequate performance management information is available to senior management.
Page 6
Internal Audit Report Environment & Infrastructure Statutory Inspections – Public Buildings (A0110/2022/001) Date: January 2023 Key Audit Risks There were no key risks identified during the audit. Overall Audit Opinion For those inspections within our audit sample, arrangements to identify all properties requiring inspections by Building Services and Contractors were satisfactory. Some inspections were not carried out during the Covid 19 lockdow but the majority of inspections tested were back on track. All adult care establishment inspections tested, were back on track. Management Commentary Not applicable as no key risks were identified.
Page 7
Internal Audit Report Chief Executive’s Quick Quote Processes (A0085/2023/001) Date: February 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: - 1. For contracts with a total value within the quick quote thresholds, quotations are sought from a minimum of 4 suppliers who have the experience and expertise to meet the council’s requirements for the goods and services. 2. Where a quote is sought for the same requirement, a different group of potential suppliers is selected where possible. 3. There is appropriate approval for a non-competitive action in cases where only one supplier bids for the work. 4. The returned quotes are evaluated against the criteria in the quick quote specification, the most economically advantageous quote is selected and that appropriate sign off is received from the Director or authorised representative using the Contract Authorisation report prior to issuing award letters. 5. The contract award is published on the Public Contracts Scotland website. Audit Scope The following work was carried out: 1. Interviewed the appropriate staff, evaluated the system in place for quick quotes and identified any possible improvements to the system. 2. Prepared a series of tests to ensure the quick quote process was operating effectively and as described. 3. It should be noted there were a small number of quick quotes in the financial year 2021/22 and so there were no quotes for the same requirement to test whether or not a different group of potential suppliers was selected where possible. Key Audit Assurances 1. For contracts with a total value between £10,000 and £50,000 (excluding VAT) before 1/1/2022 and between £25,000 and £50,000 (excluding VAT) after 1/1/2022, quotations are sought from a minimum of 4 suppliers who have the experience and expertise to meet the council’s requirements for the goods and services. 2. There is appropriate approval for a non-competitive action in cases where only one supplier bids for the work. 3. The returned quotes are evaluated against the criteria in the quick quote specification, the most economically advantageous quote is selected and that appropriate sign off is received from the Director or authorised representative using the Contract Authorisation report prior to issuing award letters. 4. The contract award is published on the Public Contracts Scotland website.
Page 8
Internal Audit Report Chief Executive’s Quick Quote Processes (A0085/2023/001) Date: February 2023 Key Audit Risks There were no key risks identified during the audit. Overall Audit Opinion The audit identified that satisfactory arrangements are in place which ensure adherence to the quick quote process. The council’s contracts standing orders were temporarily updated at the beginning of 2022 with one of the principal changes being the lower threshold for quick quotes increasing from £10,000 to £25,000. We have recommended that a timescale should be agreed for when the full review of the contract standing orders, including consideration of the increased threshold, will be completed and presented for approval by the Council. Management Commentary Not applicable as no key risks identified.
Page 9
Internal Audit Report Corporate Business Continuity Plans for ICT Systems (A0034/2022/001) Date: January 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: - 1. Services have undertaken Business Impact Assessments which have been documented and risk assessed. 2. Services have prepared Business Continuity Plans which specifically address recovery arrangements of their business critical ICT systems including prioritising which systems to recover and in what order. 3. Services’ Business Continuity Plans are clear regarding roles, responsibilities and decision making arrangements for activation of the business continuity plans. 4. Services’ Business Continuity Plans have considered the optimum way to gather data during an outage in such a way that it facilitates updating the source system on resolution of the outage. 5. Services and ICT (or external supplier) Business Continuity Plans are appropriately aligned in terms of expectations, response times and resources required. 6. Services Business Continuity Plans are tested on a regular basis. Audit Scope The following work was carried out: 1. We reviewed 5 service level Business Continuity Plans that referred to many service areas. 2. Met with relevant officers to obtain background information on processes followed for Business Continuity Plans. 3. Prepared and undertook a series of tests designed to meet the audit objectives. Key Audit Assurances 1. Roles, responsibilities, and decision making arrangements for activation of Service Business Continuity Plans are clear. Key Audit Risks 1. Where Service Business Continuity Plans do not include restoration documents for all service areas, those areas may not have up to date arrangements for continuing to deliver critical service provision. 2. Where Business Continuity Plans do not refer to arrangements for providing services in the event that ICT system outages cannot be reinstated in the preferred timescales, recovery from outages may not be adequately planned for.
Page 10
Internal Audit Report Corporate Business Continuity Plans for ICT Systems (A0034/2022/001) Date: January 2023 Overall Audit Opinion Service level Business Continuity Plans require to be improved to record all the ICT areas referred to in the council’s Business Continuity Plan template for all service areas. The main areas to be reviewed and updated are service area restoration plans and plans in the event of ICT system outages. The Crisis and Resilience Management Team have overarching responsibility for Business Continuity Plans and recommendations have been made within the report to address the areas identified and ensure a consistent approach is taken across services. Management Commentary We are currently progressing the audit recommendations. The Civil Contingencies Service, in conjunction with the Council Resilience Management Team (CRMT), are liaising with all Business Continuity Co-ordinators to carry out a programme of Business Continuity workshops working with all the relevant service areas (with one of the outcomes being to ensure that the updated business continuity documentation takes proper cognisance of the arrangements to be put in place due to a loss of systems) Oversight of this process will be through a series of special CRMT meetings.
Page 11
Internal Audit Report Chief Executives and Finance & Resources Creditors – Purchase to Pay (A0083/2022/001) Date: March 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: - 1. Manual payments are only processed for valid suppliers/providers listed on the Exception List and are supported by the appropriate documentation. 2. There are monitoring processes in place to ensure that manual creditor payments made to suppliers/providers are reported to the relevant Service. 3. Services take appropriate action to investigate reasons for manual payments being made and where necessary ensure that any future payments are made in line with correct council approved payment methods. 4. The absence of recorded commitment information, as a result of manual payments, is not impacting budgets. 5. Manual creditor payments have not led to Contract Standing Orders being breached. Audit Scope The following work was carried out: 1. Interviewed the appropriate officers to obtain background information regarding processes and documentation in relation to manual creditor payments. 2. Prepared a series of tests to meet the audit objectives. Key Audit Assurances No assurances can be given in relation to the procedures for making manual creditor payments. Key Audit Risks 1. Due to the large number of manual invoices being processed, no checks in relation to purchase orders, exemption list codes or invoice values are being carried out. 2. Services are not taking appropriate action to investigate reasons for manual payments being made or ensuring that any future payments are made in line with correct council approved payment methods. 3. The lack of committed expenditure information available through Business World, in addition to the large number of manual payments being made, could potentially result in budgetary overspends. 4. The manual process bypasses Procurement and, as no value checks are being carried out by them, this creates a risk of the Council’s Contract Standing Orders being breached.
Page 12
Internal Audit Report Chief Executives and Finance & Resources Creditors – Purchase to Pay (A0083/2022/001) Date: March 2023 Overall Audit Opinion The current process in place for the passing and payment of manual invoices are not sufficient in several areas and creates several risks, particularly in relation to possible breaches of the Council’s Contract Standing Orders. The auditor has made recommendations to address these issues. Mainly, that council management should should set a date to implement a ‘No Purchase Order, No Payment’ policy to ensure that the only manual payment invoices administered by the Purchase to Pay team are those with valid exemption codes. This will reduce the numbers of manual payment being processed, allow more checks to be carried out, and mitigate the risks associated with manual creditor payments. This will also provide the required time to reduce the number of manual payments being made and to notify all suppliers and staff of the change in policy. Due to covid other resourcing pressures, management have not sought corporate approval and support to implement this approach. Procurement staff and Business World staff have put procedures in place over the last 10 years to encourage budget holders to raise orders through the council’s approved purchasing system, with a valid Purchase Order number. However, budget holders are still allowed to raise large numbers of manual creditor payments, resulting in an increased workload for Purchase to Pay staff to process them. Management Commentary Recommendations are being progressed. Implementation of new Purchase 2 Pay system and processes and a no Purchase Order, no Pay policy have been prioritised as a project through the Digital Strategy. The Corporate Management Team endorsed this project in late April 2023 and agreed this was to be prioritised.