Summary of IA Reports complete
Renfrewshire Council · 6 November 2023
Back to Audit, Risk and Scrutiny Board — 6 November 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 06 November 2023 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 01 July to 30 September 2023 ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement, Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details those audit engagements completed during the period 1 July to 30 September 2023 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to OneRen and Renfrewshire Health and Social Care Integrated Joint Board;
Page 2
• Co-ordination of the Council’s corporate risk management activity; • Management of the counter fraud team; • Management of the risk management and insurance team. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 1 July to 30 September 2023. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Karen Campbell – 07768354651
Page 3
Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 1 July – 30 September 2023 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Finance and Resources Debt Management Reasonable 0 1 4 0 Non Domestic Rates Reasonable 0 3 2 0 Disaster Recovery Limited 0 3 2 0 Adult Services Care at Home Processes Substantial 0 0 4 0 Chief Executives Cultural Grants Reasonable 0 3 1 0 Environment, Housing & Infrastructure Energy Management Reasonable 0 1 2 0 Note – No assurance rating can be given in respect of investigation assignments Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could
Page 4
put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report Finance & Resources Debt Management (A0068/2023/001) Date: August 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: 1. There is an adequate debt management strategy in place which is supported by sufficient documented procedures. 2. There is adequate segregation of duties between accounting, collection, cancellation and write off of debtors accounts. 3. Debtors accounts are raised timeously after the date of supply. 4. Credit notes are only issued upon appropriate authorisation. 5. Outstanding accounts are followed up in line with pre-determined triggers and appropriately monitored and appropriate action is taken with regards to non- payment of accounts. Audit Scope 1. Interviewed the appropriate staff, evaluated the arrangements for debt management and identified any possible improvements to the system. 2. Prepared a series of tests to meet the above objectives. 3. The audit examined sundry debt records only. Council Tax and Non-Domestic Rates are audited separately. Key Audit Assurances 1. There is adequate segregation of duties between accounting, collection, cancellation and write off of debtors accounts. 2. Invoices and credit notes tested were only issued upon appropriate authorisation. 3. Appropriate actions are taken with regards to the write off of debts. Key Audit Risks The lack of a Debt Management Strategy and procedures may result in roles and responsibilities for the management and following up of outstanding debt not being clear. Overall Audit Opinion Although there are Business World procedures for administering debts, the council does not have a Debt Management Strategy setting out a high-level approach to preventing the accumulation of debt over time for sundry debts and procedures for each stage of the debt management process. To assist in this process we were informed that the team dealing complex debt within Business Services will provide management information regarding debt trends and patterns of problem debt.
Page 6
Internal Audit Report Finance & Resources Debt Management (A0068/2023/001) Date: August 2023 Invoices and credit notes are only issued upon appropriate authorisation, but some invoices tested were not raised timeously and some reminders tested were not issued in line with the prescribed timescales. We have made recommendations to address the issues raised in the audit report. Management Commentary We are progressing the implementation of the recommendations, including the creation of a formal Debt Management Strategy that will outline the Council’s approach to debt management for all revenue collection areas.
Page 7
Internal Audit Report Finance & Resources Non Domestic Rates (A0082/2023/001) Date: August 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: 1. There is an adequate system in place to ensure the calculation and payment of non-domestic rates. 2. All exemptions and discounts have been properly applied. 3. All Non Domestic Rates income due is properly accounted for and recorded on the system. 4. All accounts have been issued in line with statutory timescales. 5. All income due to East Renfrewshire Council has been remitted to their bank account. 6. Outstanding debt at the year-end is being appropriately managed. Audit Scope 1. Interviewed the appropriate officers to ascertain the system in place in relation to billing, collecting and monitoring Non Domestic Rates income, updating for any recent changes. Identified any areas for improvement. 2. Undertook a series of tests to ensure the system was adequate and operating as intended. 3. Prepared a certificate for East Renfrewshire Council based on the outcome of the audit. Key Audit Assurances 1. There is an adequate system in place for the calculation and payment of Non- Domestic Rates. 2. Demand notices are issued according to statutory timescales. 3. All income due to East Renfrewshire Council has been remitted to their bank account. Key Audit Risks 1. When backup information for reliefs and refunds is not held on the individual systems, the reason for the reliefs and refunds may not be clear. 2. Where income and refund reconciliations are not carried out timeously, errors may not be identified. Overall Audit Opinion The audit identified that satisfactory controls are in place for the billing and collection of Non Domestic Rates. Reviews of Non Domestic Rate reliefs, granted on the basis of a prior
Page 8
Internal Audit Report Finance & Resources Non Domestic Rates (A0082/2023/001) Date: August 2023 year's applications, have now recommenced after having not being carried out for a number of years. However, many actions that management stated would be put in place after previous audit recommendations are not fully implemented. Primarily, evidence of some rates relief applications and refund authorisations were not available. It was also noted that staff changes have resulted in income and refund reconciliations not being carried out timeously. Recommendations in the report to address areas of weakness identified will, if implemented, help strengthen the controls in place for Non Domestic Rates. Management Commentary The recommendations are in the process of being implemented. This will include giving briefings to the relevant staff and preparing guidance notes to ensure staff are fully aware how Non Domestic Rates transactions and documentation should be dealt with.
Page 9
Internal Audit Report Finance & Resources SaaS Disaster Recovery (A0072/2023/001) Date: July 2023 COMMITTEE SUMMARY Audit Objectives A review of the Council's disaster recovery arrangements in relation to Software as a Service (SaaS) systems, where software is procured on a subscription basis and hosted by the supplier. The objectives of this audit were to ensure that: 1. A comprehensive list of all Software as a Service solutions in place is maintained, which details the service owner, criticality and responsibility for disaster recovery. 2. There are council standard requirements to be addressed at the tender stage for any proposed SaaS solution. 3. Disaster recovery plans have been prepared and agreed with the Council, are regularly tested and the Council receives formal assurance from the Contractor that the plans continue to be fit for purpose. 4. Contracts include adequate arrangements for data back-up and retention policies and have clearly defined roles and responsibilities for disaster recovery, including communication and decision-making arrangements for major incidents. 5. There is regular engagement with the contractor and disaster recovery arrangements are part of contract management discussions. Audit Scope A series of tests were undertaken to check that disaster recovery arrangements in place for 5 of the main Software as a Service Solutions operating within the Council were satisfactory. Key Audit Assurances 1. An evaluation questionnaire has been developed that SaaS providers are required to complete, which is based on the National Cyber Security Centre’s cloud principles. This is included in the ICT tender requirements document as well as a document explaining the Council’s expectations from SaaS providers. 2. The minimum requirements for disaster recovery purposes have been outlined in the relevant standards for procuring SaaS services. 3. Contract monitoring arrangements are in place and where underperformance had been identified a service score card was available
Page 10
Internal Audit Report Finance & Resources SaaS Disaster Recovery (A0072/2023/001) Date: July 2023 Key Audit Risks 1. Although it is recognised that a small number of key systems would be treated as priority, there is not an approved central register of critical systems and therefore recovery efforts may be delayed or not be completed in alignment with the Council’s priorities. 2. ICT procurement arrangements are not formally documented and there is a risk that services may not realise that ICT approval is required for ICT systems especially for low cost subscription-based systems accessed via a web browser. 3. If assurance and verification is not sought from SaaS solution providers regarding their ability to meet disaster recovery requirements, services may not be restored in alignment with business continuity requirements. 4. For one of the Systems sampled, the councils disaster recovery and backup requirements could not be evidenced in the contract documentation and therefore the Suppliers arrangements in place may not meet the Council’s expectations and the Council may not have recourse following a disaster recovery incident. Overall Audit Opinion The audit has identified scope for improvement in the existing arrangements and recommendations were made to enhance and strengthen this area. Management Commentary SaaS solutions are provided by different suppliers, so it should be recognised that in a major outage, solutions would be worked on concurrently, negating the need to arbitrarily allocate criticality to each one. However we are developing our business continuity information and this will include supplier and key contact details for systems. We are currently progressing the audit recommendations made. A documented procedure will be prepared in conjunction with procurement colleagues to advise services how the purchase of ICT systems should be undertaken, regardless of platform (e.g SaaS, internally hosted etc). It is essential that any documented procedure is adopted by all services, in conjunction with Corporate Procurement, to ensure any procurement of technology solutions is appropriately assessed by ICT Services. Implementation of the procedure within the Corporate Procurement will be the responsibility of the Corporate Procurement Manager, which will include clear communication of the documented procedures to service managers.
Page 11
Internal Audit Report Finance & Resources SaaS Disaster Recovery (A0072/2023/001) Date: July 2023 Any procurement of technology solutions which does not adhere to the documented procedure should be paused until a review of requirements is undertaken. For future contracts we will ensure that the disaster recovery and backup requirements are adequately stated in the contracts and as part of the contract management arrangements, suppliers will be asked to provide evidence of their disaster recovery testing.
Page 12
Internal Audit Report Adult Services Care at Home Processes (A0099/2023/001) Date: August 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to: 1. Review processes relating to scheduling tasks associated with Totalmobile and ensure that the scheduling of home care staff is adequate and efficient. 2. Review and assess the resource management information available and ensure that it is being utilised effectively to inform management actions. 3. Review access controls to ensure that only current authorised officers can access the system. Audit Scope 1. Interviewed relevant officers to obtain the required information and documentation relating to Totalmobile. 2. Prepared a series of tests which met the detailed audit objectives Key Audit Assurances 1. The processes in place relating to scheduling tasks associated with Totalmobile are of a good standard and efficient. 2. Management information available from the Totalmobile system is being used to inform management actions. 3. Processes are in place to ensure that only current authorised officers can access the system. Key Audit Risks No key risks were identified during the audit. Overall Audit Opinion The current processes and controls in place relating to the Totalmobile system are adequate and efficient in the scheduling of home care visits with the current staffing establishment. The Totalmobile system has provided the service with improved higher quality management information which is being used to increase the efficiency of the service provided. Recommendations have been made within the report regarding the completion of daily checks and system permission checks. Management Commentary N/A as no key risks were identified
Page 13
Internal Audit Report Chief Executives & OneRen Cultural Grants (A0030/2023/001) Date: September 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the review were to ensure that: 1. Consistent policies and procedures are in place for each cultural fund that provide guidance to those making grant recommendations to Board; 2. Grants are allocated only where the conditions of the fund are met; 3. All grants are supported by a completed application form and relevant supporting documentation; 4. Arrangements are in place to ensure that the grant is used for the specified purpose; Audit Scope 1. Obtained a copy of the procedures and guidance in place for each cultural fund. 2. Interviewed relevant officers to acquire background information. 3. Prepared a series of tests to meet the above objectives. In order to conduct these tests, applications and associated documentation from several grant funding streams which are either completed or ongoing were reviewed. Key Audit Assurances Policies and procedures are in place for each cultural fund that provide guidance on the conditions of the fund to those involved in the grants process. Key Audit Risks Where documentation relating to the sample of grant awards could not be located, it could not be confirmed that all of the process had been followed correctly or all conditions met, for the grants reviewed. Overall Audit Opinion Although there is policy and guidance documentation in place to support grant funds, there was a lack of supporting evidence to confirm that some grant conditions were met and that projects were being adequately monitored. It is acknowledged that the main contacts for the audit from the Chief Executives Service and One Ren were unavailable at the time of the review. In addition, other officers within One Ren and the Chief Executives Service were unable to provide the Auditor with all information required for the cultural grants awarded prior to 2022 due to staffing changes and being recently in post. In addition, the Auditor was advised that COVID affected usual practices and that there is now a dedicated Grants Officer in place within One Ren with overall responsibility for
Page 14
Internal Audit Report Chief Executives & OneRen Cultural Grants (A0030/2023/001) Date: September 2023 grant monitoring. Recommendations have been made within this report to improve some of the controls in operation. Management Commentary Actions have been completed by the parties involved in the cultural grants process and additional checklists introduced to ensure that we record that all documents are received prior to a grant application being fully processed and grant condition have been met. The monitoring process for grant awards has also been strengthened. This ensures all supporting documentation can be centrally accessed, mitigating the risk of staffing changes in future.
Page 15
Internal Audit Report Environment, Housing & Infrastructure Energy Management (A0049/2023/001) Date: September 2023 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: 1. There is a documented energy management plan in place which covers the whole organisation, clearly sets out roles and responsibilities and complies with industry standard best practice. 2. Identified and agreed actions arising from the energy management plan are monitored and reported on to ensure there is adequate oversight of the progress of the plan. 3. Targets are set for individual premises and there are processes in place to monitor energy consumption and action is taken where variances from target are identified. 4. Invoices are only passed for payment after being checked for completeness and accuracy. Audit Scope 1. Interviewed the appropriate staff, evaluated the arrangements for energy management and identified any possible improvements to the system. 2. Prepared a series of tests to meet the above objectives. Key Audit Assurances Invoices are only passed for payment after being checked for completeness and accuracy. Key Audit Risks When the council does not have an Energy Management Plan, actions to minimise energy demand and maximise energy efficiency may not be delivered. Overall Audit Opinion The objectives of this review could not be fully met as there is no council Energy Management Plan in operation since the council’s Carbon Management Plan concluded in 2020. Renfrewshire’s Plan for Net Zero, was approved in August 2022 and although it is a Council led plan, it relates to the whole area of Renfrewshire. One of the main focus areas of this plan is clean energy and some of the intended actions to minimise energy demand and maximise energy efficiency are council specific and whilst we acknowledge that at the time of the audit, the Net Zero plan was at an early stage, we recommend that an Energy Management plan should be prepared as soon as possible to ensure these actions are delivered. In addition, whilst checks are in place to investigate energy consumption variances, we found that there is a lack of evidence held to show that these have been undertaken
Page 16
Internal Audit Report Environment, Housing & Infrastructure Energy Management (A0049/2023/001) Date: September 2023 timeously. The invoices checking procedure in place before payments were made was found to be satisfactory. Management Commentary The Energy Management Unit are involved in Renfrewshire Councils ambition to become net zero and continue to contribute to the approved Net Zero Plan. We are actively involved in the preparation of the net zero delivery plan and milestones to ensure progress towards the target is being achieved. Once this delivery plan has been completed, an action plan and timescales will be prepared for the Renfrewshire Council specific energy management actions for the Clean Energy focused area of the Net Zero Plan.