Summary of IA reports complete
Renfrewshire Council · 21 August 2023
Back to Audit, Risk and Scrutiny Board — 21 August 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 21 August 2023 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 01 April to 30 June 2023 ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement, Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details those audit engagements completed during the period 1 April to 30 June 2023 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to OneRen and Renfrewshire Health and Social Care Integrated Joint Board;
Page 2
• Co-ordination of the Council’s corporate risk management activity; • Management of the counter fraud team; • Management of the risk management and insurance team. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 1 April to 30 June 2023. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Karen Campbell – 07768354651
Page 3
Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 1 April – 30 June 2023 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Environment, Housing & Infrastructure Rental Income Substantial 0 0 0 0 Environment, Housing & Infrastructure/Childr ens Services School Meals Debt Limited 3 5 1 0 Finance and Resources Cyber Security Reasonable 0 2 2 0 Governance Finance and Resources Information Asset Register Limited 1 2 3 0 Note – No assurance rating can be given in respect of investigation assignments Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the
Page 4
objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report Environment, Housing & Infrastructure Rental Income (A0041/2023/001)) Date: June 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: 1. Rents collected are allocated to the correct tenant’s accounts; 2. Appropriate reconciliations are performed against the general ledger and discrepancies investigated; 3. Arrears are appropriately monitored, followed up and recovered; 4. Rent collection and arrears levels are appropriately reported to management. Audit Scope 1. Interviewed the appropriate staff, evaluated the system in place for rent collection for council houses and identified any possible improvements to the system. 2. Prepared a series of tests to ensure the rent collection for council houses processes are operating effectively and as described. 3. Current tenant arrears were tested during the audit. (Former tenant arrears were excluded from the audit scope). Key Audit Assurances 1. The sample of rents collected tested were allocated to the correct tenant’s accounts and cost centre in Business World. 2. Appropriate reconciliations are performed between the housing system and the general ledger and discrepancies investigated; 3. Arrears are appropriately monitored, followed up and recovered; 4. Rent collection and arrears levels are appropriately reported to management. Key Audit Risks There were no key risks identified during the audit. Overall Audit Opinion The controls in place for rent collection from council housing tenants were found to be satisfactory. Rent collection and arrears levels are appropriately reported to management. Gross Rent Arrears as a percentage of rent due has increased in the last few years as a result of the covid 19 pandemic and cost of living pressures. It was reported to the Communities and Housing Policy Board in January 2023 that ‘Gross Rent Arrears have increased by over £1.1m in the last 6 months to £4,930,500. The level of arrears increase is the same as that of other similarly sized authorities’. At
Page 6
Internal Audit Report Environment, Housing & Infrastructure Rental Income (A0041/2023/001)) Date: June 2023 the time of the review to address this, management have increased the level of advice and support to tenants and targeted arrears at the earliest possible stage to stop escalation of debt. Management Commentary N/A as no key risks were identified during the review
Page 7
Internal Audit Report Environment & Infrastructure/Childrens Services School Meals Debt (A0018/2023/001) Date: April 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: – 1. A weekly report is run from ParentPay to identify overdrawn school meals accounts. 2. Timely follow up action is taken on overdrawn accounts and supporting evidence is retained. 3. The appropriate systems are updated to reflect free meal entitlement awards. 4. The Head Teacher waiver forms are completed where required and are reviewed regularly. 5. Invoices are prepared on Business World where necessary and the debt transferred to the Finance Recovery Team or charged to the school. 6. ParentPay is appropriately updated with all relevant information. Audit Scope 1. Obtained a copy of the school meals debt process entitled, ‘Unpaid Meals Management Process’, issued to schools for implementation in October 2021. 2. Interviewed relevant officers and acquired background information. 3. Prepared a series of tests to meet the above objectives and selected a sample of 2 High Schools and one Primary School for testing Key Audit Assurances 1. Generally, a weekly report is run from ParentPay to identify school meals accounts that are overdrawn. 2. ParentPay is appropriately updated with all relevant information i.e. school meals taken, free school meal entitlement and gentle debt reminders issued. Key Audit Risks The procedures were not fully implemented in High Schools and therefore there are risks that:- 1. Where support calls are not made to guardians regarding overdrawn accounts, Head Teachers are unaware of the contributing circumstances leading to the debt situation and whether a Head Teacher waiver would be appropriate or if an application for free school meals may be necessary. 2. Where accumulated debts are not pursued either by invoice via Business World or by charging the school account, the costs incurred for food provided while accounts have an overdrawn balance will remain as a debit within Environment & Infrastructure accounts. Furthermore, the Finance Recovery Team will be unable to implement recovery of the debts if invoices are not raised as required.
Page 8
Internal Audit Report Environment & Infrastructure/Childrens Services School Meals Debt (A0018/2023/001) Date: April 2023 Overall Audit Opinion Documented procedures to address school meals debt were issued to schools on 18th October 2021 for implementation. However, these are only partially implemented at secondary schools thereby allowing debt to continue to accumulate. The Auditor was advised that it is the opinion of some School Head Teachers there are steps in the process that are detrimental to the parent/school relationship. In addition, there are historical issues relating to the pilot of the ParentPay process. Therefore, action is not always being taken to identify the circumstances contributing to the school meals debt and whether assistance can be provided. Furthermore, invoices are not being issued when required. This has resulted in a significant number of overdrawn school meals accounts on the ParentPay System. As a result of these failings, a provision of limited assurance has been made with regards to this review. Management Commentary Children’s Services (CS) carried out a review of the “unpaid meals management process and are in the process of finalising arrangements with colleagues in Environment, Housing & Infrastructure and Finance and Resources senior management prior to implementation. A key component of the revised process will include pastoral support from key staff in the school to ensure that families are aware of accrued debt at an earlier stage and signposted to services to support finances where appropriate. Revised procedures will further support overall communication with parents/carers and will be monitored on an on-going basis to ensure they are consistently applied across establishments.
Page 9
Internal Audit Report Finance and Resources Cyber Security (A0075/2023/001) Date: June 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: 1. Appropriate governance arrangements are in place with accountability and responsibility for cyber security being allocated to appropriate individuals. 2. Cyber risks and vulnerabilities are regularly assessed through internal processes or contracted arrangements. 3. Actions arising from risk assessments are prioritised, planned and monitored at an appropriate level for completion. 4. Incident response planning and decision-making arrangements are adequately documented and understood by the relevant parties; and 5. Arrangements are in place to provide training and awareness raising to relevant employees. Audit Scope 1. Interviewed relevant officers responsible for the governance of cyber security arrangements and acquired background information. 2. Prepared a series of tests to meet the above objectives Key Audit Assurances 1. The Councils ICT Security Policy is aligned to the NCSC (National Cyber Security Centre) 10 steps to cyber security and the Council has obtained PSN (Public Services Network) certification. 2. The Council is in the process of implementing a managed SOC (Security Operations Centre) which provides 24-hour monitoring to identify anomalous behaviours that might be indicative of a cyber-attack., 3. A Cyber Incident Response Action Card (playbook) has been developed for potential phishing attacks and this appears to be well developed with detailed instructions and in understandable language. 4. The Council have also developed the RenSafeOnline program working in partnership with a online safety charity Introducing the GetSafeOnline certified Ambassador scheme, volunteers are trained on how to recognise if a person is at harm from online threats such as scams or bullying and providing advice to organisations and citizens who live and work in the region. Key Audit Risks 1. If staff do not participate in the available training and awareness regarding cyber security, this could result in staff being unaware of how to respond to a cyber- attack or their roles and responsibilities.
Page 10
Internal Audit Report Finance and Resources Cyber Security (A0075/2023/001) Date: June 2023 2. If incident response planning and decision-making arrangements are not adequately documented or understood for cyber security scenarios, this could result in an uncoordinated or inadequate response. Overall Audit Opinion The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk. The audit identified some scope for improvement in the existing arrangements and made recommendations to address the matters identified. Management Commentary The audit recommendations are in the process of being implemented. Completion of Cyber Security Training by Staff is now being monitored and a process has been put in place to address any issues identified. The incident response procedure for cyber security is currently being reviewed and updated where necessary and further training will be given to key personnel when the procedure is finalised.
Page 11
Internal Audit Report Finance & Resources Information Asset Register (B0010/2023/001) Date: June 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. An Information Asset Register is in place which records the information required by Article 30 of General Data Protection Regulation (GDPR) 2. Information Asset Owners have been assigned to each information asset and Information Asset Administrators have been appointed to maintain the register; 3. Risks to each information asset have been assessed and procedures have been put in place to mitigate those risks; 4. Additions and deletions of information assets are adequately monitored; 5. The Information Asset Register is regularly reviewed to ensure it is kept up to date. Audit Scope 1. Interviewed the appropriate staff, evaluated the system in place for maintaining the Information Asset Register and identified any possible improvements to the system. 2. Prepared a series of tests to ensure the Information Asset Register processes are operating effectively and as described. Key Audit Assurances 1. The main requirements of GDPR Article 30 have been included in the headings in the Information Asset Register. 2. There are regular communications with service officers to remind them to complete all fields in the Information Asset Register and to keep the register up to date. It is also a standing agenda item in Corporate Management Team updates to ensure Information Asset Owners /Administrators are the appropriate officers and have the ongoing support of the CMT to maintain service entries in the Information Asset Register. 3. There is a documented process for Information Asset Administrators on how to complete the Information Asset Register and a number of workshops have been hosted regarding this process. 4. Work to archive information assets no longer required and remove other information from view has been carried our to make the Information Asset Register more manageable. Key Audit Risks 1. Where there is not sufficient ownership and oversight of the Information Asset Register, Information Asset Owners/ Administrators may not be held accountable for keeping the register up to date. 2. Where the Information Asset Register is not kept up to date, there may be reputational damage for the council.
Page 12
Internal Audit Report Finance & Resources Information Asset Register (B0010/2023/001) Date: June 2023 Overall Audit Opinion Work has been carried out by the Enterprise Architecture Team to update the council’s Information Asset Register and by the Information Governance Team to communicate to Information Asset Owners/Administrators that they should complete all fields in the Information Asset Register and to keep the register up to date. However, there is a lack of ownership and oversight of the information contained in the Information Asset Register. We have recommended that the Information Governance team should request positive affirmation/sign off annually from Information Asset Owners that the register is up to date. In addition, Information Asset Owners for each service, should usually be at Head of Service level, and should take overall responsibility for maintaining the Information Asset Register for their service area and ensuring that it is up to date. Management Commentary Whilst a significant amount of work has already been progressed in the area, work is ongoing to implement the audit recommendations to further enhance the operation of the information Asset Register. This includes creation and inclusion of a checklist into the Business As Usual Risk Assurance model seeking annual assurance from Services that Information Asset Owners/Administrators are in place and there is appropriate oversight of Information Asset Register activity. The Information Management & Governance Group will lead on the checklist creation and work with the Risk Manager to embed this into the BAU Risk Assurance processes.