1 Annual Internal Audit Plan 24 2025 COMPLETE
Renfrewshire Council · 18 March 2024
Back to Audit, Risk and Scrutiny Board — 18 March 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 18 March 2024 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Annual Internal Audit Plan 2024/2025 ___________________________________________________________________ 1. Summary 1.1 In line with the requirements of the Public Sector Internal Audit Standards, a risk based internal audit plan for 2024/25 has been developed. The audit plan takes into account the outcomes of the internal corporate risk identification and evaluation processes, and the current business environment. In addition to undertaking work which will provide assurance on the robustness on key internal controls, the plan seeks to reflect the key priorities and challenges for the council. 1.2 A number of methods have been employed to facilitate production of the risk based audit plan for 2024/25: • Consultation with all Directors and their senior management teams, • Consultation with senior management from the associate bodies; • Benchmarking with other Local Authorities; • Review of strategic and corporate risk registers; • Cumulative audit knowledge and experience; • Review of key external audit and inspection reports. 1.3 The total available resource is 1086 days, the operational audit time available for 2023/24 has been identified as 856 days (79%). The remaining 230 days (21%) relates to training, service development, administration and management. Coverage of the plan is achieved through the use of in-house staff and where relevant, commissions from other providers.
Page 2
1.5 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. Non-operational time includes provision for training, performance management and service development. In addition to the internal audit assurance function the Chief Auditor has managerial responsibility for risk management, insurance and corporate counter fraud which are excluded from the calculation of available operational audit resources. 1.6 Delivery of the risk based annual audit plan supports effective member scrutiny of the council’s internal financial and other control mechanisms. ___________________________________________________________________ 2. Recommendations 2.1 Members are asked to approve the content of the risk based audit plan for 2024/25. 2.2 Members are asked to note that the progress of the 2024/25 annual audit plan and summaries of the findings from each audit assignment will be reported to the Board on a quarterly basis. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk - The subject matter of this report is the risk based Audit Plan for 2024 –2025
Page 3
11. Privacy Impact – None 12. COSLA Implications - None ________________________________________________________________ Author Andrea McMahon, Chief Auditor
Page 4
Date March 2024 Annual Internal Audit Plan 2024/25 Finance & Resources Internal Audit
Page 5
Page 2 of 13
Page 6
Page 3 of 13 Renfrewshire Council Annual Internal Audit Plan 2024/25 Contents Page Audit Plan Overview 4 - 8 Supporting Appendices 1 Annual Council Internal Audit Plan 2024/25 9 – 10 2 Annual Other Bodies Internal Audit Plan 2024/25 11 3 Analysis of plan by service 12 4 Annual Audit Plan 2024/25 – Integration Joint Board 13
Page 7
Page 4 of 13 Audit Plan Overview 1. Introduction 1.1 In line with the requirements of the Public Sector Internal Audit Standards, a risk based internal audit plan for 2024/25 has been developed. In formulating the audit plan a risk assessment has been undertaken, giving consideration to the following sources of information: Risk assessment (1) Risk assessment and prioritisation of all auditable activities (audit universe). (2) Strategic and Corporate Risk Register. Consultation (3) The Chief Auditor has met with each member of the CMT and their senior management teams to ascertain any changes to operational practice and national policy and to determine their priorities and risks. (4) Senior Management from the Associate Bodies and One Ren have been consulted to ascertain their priorities and risks. (5) The Chief Executive has been consulted on what he sees as the council’s priority and risk areas for the forthcoming year. (6) Feedback from, and the expectations of, the Audit, Risk and Scrutiny Board are identified through the regular meetings with the members of the board. (7) The Chief Auditor has met with the local External Audit team to ascertain their approach to the statutory audit where assurance on key internal controls could be provided to avoid any duplication of effort. Benchmarking (8) Other Local Authority internal audit plans. (9) Discussion with other Chief Auditors through the Scottish Local Authority Chief Auditors Group. Review of key internal reports (10) Renfrewshire’s Council Plan 2022 -2027 (11) The results of internal audit work in 2023/24 and in previous years. (12) Review of the results of the Business as Usual risk assurance modules. Review of key external reports (13) External Audit’s - Report to Members and the Controller of Audit on the 2022/23 Audit. (14) Audit Scotland: Best Value reports issued during 2023/24. 1.2 On the basis of the above, the audit engagements planned for 2024/25 are set out in Appendix 1, 2 and 4, for the Council, Associate Bodies and the Integration Joint Board in the following categories of audit activity: • Assurance, • Governance, • Contingency, • Planning and Reporting 1.3 It is the responsibility of management to ensure that they have good governance, risk management and internal control arrangements over the functions they are responsible for. It is internal audit’s role to provide an independent, objective assurance and consulting activity. The scope of the internal audit plan encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation's governance, risk management, and internal control processes; as well as the quality of performance in carrying out assigned responsibilities to achieve the organisation’s stated goals and objectives. Delivery of the internal audit plan supports the requirement for the Chief Auditor to provide an annual opinion which is used to inform the annual governance statement.
Page 8
Page 5 of 13 1.4 The Chief Auditor shares information and coordinates activities with other internal and external providers of assurance and consulting services, as appropriate, to ensure proper coverage and minimise duplication of effort. Internal audit may place reliance on the work of other providers of assurance and the ability to do so will be considered during each audit engagement. 1.5 The plan also includes provision for managing and developing the internal audit activity including audit planning, reporting, periodic quality assessments and for following up on previous recommendations and reactive investigative work. The plan includes contingency time to allow for completion of work carried forward from 2023/24 and provides for consultancy engagements to be undertaken where these can improve the council’s operations, add value and improve the management of risks. Contingency time also provides for sufficient flexibility to accommodate changing risks and priorities during the course of the year. More detail on each of these elements is set out in sections 4 to 7 of this plan. 1.6 The internal audit service is delivered and developed in accordance with its purpose which, as set out in the Internal Audit Charter, is to provide assurance by independently reviewing the council’s risk management, control and governance processes. 2. The current business environment and key risk areas 2.1 The audit plan detailed in Appendix 1 has been development to support the achievement of the council’s objectives and the challenges we face in achieving those objectives. The key challenges included in the planned audit work are detailed below. (1) Financial Challenges Our organisation faces an unprecedented financial challenge to make significant savings after many years of already delivering substantial efficiencies and reduction in our spending. Alongside this, our communities are experiencing a cost-of-living crisis and the demand for our services is higher than ever before. Therefore, the financial outlook continues to be subject to significant and regular scrutiny. The 2024/25 audit plan includes time for reviewing: • financial planning; • non-domestic rates; and • payroll. (2) Learning from Dargavel The Council has been subject to criticism regarding errors made during planning and delivery of Dargavel Primary School. As a result, there has been significant scrutiny of our arrangements arising from the independent review (Bowles Report), from our external auditors and from the Accounts Commission under s102 (1) of the Local Government (Scotland) Act 1973. The Council has developed an action plan to address the recommendations made which is subject to regular reporting to the Audit, Risk and Scrutiny Board. The 2024/25 audit plan includes time for reviewing: • governance of the learning estate development programme; • project and programme management; and • risk management (3) Tackling Inequalities The Council plays a key role in tackling inequalities and providing the best possible services to our communities, particularly those who are experiencing the poorest outcomes. The current cost of living crisis impacts disproportionately on particular groups in society. The Council is committed to supporting people on low incomes to maximise income and seek advice with income and debt management. The 2024/25 audit plan includes time for reviewing:
Page 9
Page 6 of 13 • council tax reduction; and • community grants (4) Public Protection Public protection is a wide-ranging agenda relating to the protection of vulnerable people, communities, businesses and organisations. The 2023/24 audit plan includes time for reviewing: • child protection; • housing adaptations; • fostering and adoption; and • Eclipse system. 2.2 There are a number of significant risks, arising from the external and internal environment, which could impact on the council’s ability to achieve its objectives. The most significant risks and the risk control measures to manage these risks, are identified through the council’s corporate risk management process. Subject to the overall flexibility of the Audit Plan, priority will be given to audit engagements which impact on the council’s strategic and corporate risks. 3. Allocation of Resources 3.1 In addition to the internal audit assurance function the Chief Auditor has managerial responsibility for risk management, insurance and counter fraud which are excluded from the calculation of available operational audit resources. 3.2 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. The calculation of operational staff time has been based on 6 full time equivalent employees plus 60 days to be provided from other service providers. The internal audit team is appropriately resourced with 4 qualified and 2 non-qualified staff. Non- operational time includes provision for training, performance management and service development. 3.3 Resources from any unfilled elements of posts and other available audit resource will be used flexibly to ensure that the audit plan commitments are met, through the engagement of temporary staff and other audit service providers where appropriate. Where engagements are undertaken by the other audit service providers, these can provide an opportunity for benchmarking and training and development. Sufficient resources are available to engage specialist contractors where necessary to address any specific risks faced by the council. 3.4 The total available resource is 1086 days; the operational audit time available for 2024/25 has been identified as 856 days (79%). The remaining 230 (21%) days relates to training, service development, administration and management. Resources are assessed as being sufficient to provide an evidenced based opinion. 3.5 The following paragraphs provide an overview of how the audit time has been allocated to audit categories for the Council and the Associated Bodies we provide services to. A summary of the operational time by audit category is detailed in table 1 below. The analysis of non- operational audit activity is detailed in the table 2 below. The planned operational/non- operational time for 2023/24 is given for comparative purposes. 2023/24 2024/25 Category of audit Planned Days % of Operational Time Planned Days % of Operational Time GOVERNANCE 96 10% 51 6% ASSURANCE 391 42% 374 44% CONTINGENCY note 1 319 34% 293 34%
Page 10
Page 7 of 13 AUDIT PLANNING / REPORTING 134 14% 138 16% TOTAL OPERATIONAL TIME 940 100% 856 100% Table 1 Notes 1. This category includes time for the finalisation of the previous year’s audits, corporate exercises and groups, investigations, significant project consultancy activities and emerging priorities. 2023/24 2024/25 Activity Planned Days % of Non - operational Time Planned Days % of Non - operational Time TRAINING 63 26% 56 24% STRATEGIC MANAGEMENT 16 7% 16 7% TEAM ADMINISTRATION 96 39% 89 39% DEVELOPMENT note 1 69 28% 69 30% TOTAL NON-OPERATIONAL TIME 244 100% 230 100% Table 2 Notes 1. This category includes time allocated to development activities to support continuous improvement activities. 4. Governance (6% of operational time) 4.1 Internal Audit must evaluate the risk exposures relating to the council’s and associate bodies governance arrangements. The engagements within this category form the basis for the Chief Auditor’s annual audit opinions and support the annual governance statements. 4.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part A in respect of the current year, with a total of 51 days being allocated to these engagements for 2024/25. 5. Assurance (44% of operational time) 5.1 A risk based assessment has been undertaken of all auditable areas taking into account the risk management framework and the expectation of senior management and the Audit, Risk and Scrutiny Board. The engagements within this category also form the basis for the Chief Auditor’s annual opinions and support the annual governance statements. For each engagement internal audit will consider whether there are any available external sources of assurance can be relied upon to deliver the plan. Time is also allocated to following up on the implementation of prior year audit recommendations. 5.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part B in respect of the current year, with a total of 374 days being allocated to these engagements for 2024/25. 6. Contingency (34% of operational time) 6.1 This category includes time allocations for finalisation of the 2023/24 audit plan, undertaking reactive investigations of theft, fraud or other malpractice and provides for post-report work which includes attending disciplinary or appeal hearings, employment tribunals and court, as required. 6.2 The allocation of time for this category is an estimate based on prior experience and available resources. However, this will be monitored during the course of the year to ensure that internal
Page 11
Page 8 of 13 audit continue to be in a position to respond to other priority areas which emerge during the course of the year, and, if necessary, revise the audit plan accordingly. Appendix 1 and 2, Part C details the indicative time of 293 days allocated across the contingency heading. 6.3 Should more time be available this will be added to the contingency budget and will be used to deliver audit reviews from the reserve list detailed on Appendix 1, Part E. 7. Audit Planning / Reporting (16% of operational time) 7.1 This category includes annual planning activity and reporting arrangements to the Corporate Management Team and the Audit, Risk and Scrutiny Board, the Integration Joint Board Audit, Risk and Scrutiny Board and the Boards of the other bodies we provide internal audit services to under a service level agreement. Appendix 1 and 2, Part D details the time of 138 days allocated to planning and reporting activities. 8. Analysis of Plan by Service 8.1 Appendix 3 shows the amount of operational audit time allocated to individual services in 2024/25 and compares it to the planned days for 2023/24. 8.2 The planned days allocated to all services relates to work which is cross-cutting rather than service specific as well as time which is allocated out to services as the year progresses, such as contingency and investigations. 9. Conclusion 9.1 The annual internal audit plan for 2024/25, based on the strategic risk assessment, reflects the current priorities and challenges for the council, and demonstrates that the internal audit service continues to deliver added value while continuing to improve the service in line with best practice. 9.2 The allocation of internal audit resources is sufficient to allow for flexibility to deal with emerging priorities and provide adequate coverage of governance, risk management and internal control to inform the annual assurance statement. 9.3 The plan may be subject to amendment during the course of the year due to the emergence of issues of greater priority, or other unforeseen circumstances. The Audit, Risk and Scrutiny Board will be requested to approve any necessary changes. Chief Auditor March 2024
Page 12
Page 9 of 13 Appendix 1 Renfrewshire Council Internal Audit Annual Plan 2024/25 Entity Engagement Title Service Days Allocated Part A – Governance 46 Corporate Governance Corporate Governance Framework Corporate - All Services 6 Corporate Risk Management Risk Management Finance & Resources 20 Project & Programme Governance Governance of the Learning Estate Investment Programme Children’s Services 20 Part B – Assurance 291 Follow Up Follow Up Corporate - All Services 38 Waste Management Household Waste Recycling Environment, Housing & Infrastructure 20 Catering Operations Management of Allergens in Schools Environment, Housing & Infrastructure 25 Housing Grants Housing Adaptations Environment, Housing & Infrastructure 20 Community Engagement and Services Community Grants Chief Executive’s 20 ICT Delivery & Support Eclipse Application Review Adult Services 20 Non-Domestic Rates Non-Domestic Rates Finance & Resources 15 Housing Benefit & Council Tax Reduction Council Tax Reductions Finance & Resources 20 Financial Sustainability Financial Planning Finance & Resources 25 Housing Assurance Statement Housing Assurance Statement Environment, Housing & Infrastructure 8 Payroll Payroll Finance & Resources 20 Child Protection Child Protection Children’s Services 20 Fostering and Adoption Fostering Arrangements – short term and permanency planning Children’s Services 20 Programme Management Project Management Corporate – All Services 20 Part C – Contingency 286 Contingency Contingency Corporate - All Services 124
Page 13
Page 10 of 13 Entity Engagement Title Service Days Allocated Contingency Corporate Groups Corporate - All Services 25 Contingency Investigations Corporate - All Services 137 Part D – Planning & Reporting 115 Planning & Reporting Planning & Reporting Corporate - All Services 115 Part E – Prioritised Reserve List 120 Policy and Procedures Job Evaluation Finance & Resources 20 ICT Delivery and Support Infrastructure as a Service – Contract Management Finance & Resources 20 Licencing Licencing Finance & Resources 20 Client Financial Assessment and Charges Financial Assessments Adult Services 20 Adult Protection Transition Arrangements Children’s / Adult Services 20 Legislation Management Community Asset Transfers Chief Executive’s 20
Page 14
Page 11 of 13 Appendix 2 Other Bodies Internal Audit Annual Plan 2024/25 Entity Engagement Title Service Days Allocated Part A – Governance 5 Integration Joint Board – Governance Arrangements Corporate Governance Framework Integration Joint Board 5 Part B – Assurance 83 SE – Contract Monitoring Contract Delivery Plan Scotland Excel 20 OneRen – Other Systems Sports Services Booking Processes OneRen 15 OneRen – Other Systems Libraries – Performance Management OneRen 8 IJB – Other Systems Financial Planning Integration Joint Board 20 RVJB – Valuation System Non-Domestic Rates RVJB 20 Part C – Contingency 7 Contingency Contingency All Associate Bodies 7 Part D – Planning & Reporting 23 Planning & Reporting Planning & Reporting All Associate Bodies 23
Page 15
Page 12 of 13 2023/24 2024/25 Service Planned Days % of Operation al Time Planned Days % of Operational Time All Services note 1 612 65% 465 54% Chief Executive’s Service 20 2% 20 2% Finance & Resources 55 6% 100 12% Children’s Services 40 4% 60 7% Adult Services 0 0% 20 2% Environment, Housing & Infrastructure 93 10% 73 9% COUNCIL TOTAL 820 87% 738 86% Scotland Excel 30 3% 25 3% Clydeplan 4 0% 2 0% Renfrewshire Valuation Joint Board 25 3% 25 3% Renfrewshire Health & Social Care Integration Joint Board (Appendix 4) 35 4% 40 5% OneRen 26 3% 26 3% TOTAL 940 100% 856 100% Notes 1 Planned time includes, Follow up Audit, Contingency, Planning and Reporting and an element of Cross cutting Assurance and Governance Audits and is allocated against services during the course of the year Appendix 3 Analysis by Service
Page 16
Page 13 of 13 Audit Category Engagement Title No. of days Detailed work Governance Local Code of Corporate Governance 5 Annual review of the adequacy and compliance with the Local Code of Corporate Governance to inform the governance statement. Assurance Financial Planning 20 The purpose of the audit is to review the arrangements in place for financial planning and managing the financial risks. Planning & Reporting Annual Plan, Annual Report and Audit Committee annual assessment, reporting & Training 12 The Chief Internal Auditor is required to prepare an annual plan and annual report for the Audit Committee, summarising the work undertaken by Internal Audit during the year and using this to form an opinion on the adequacy of the control environment of the IJB. Time is also available to facilitate the annual assessment against the CIPFA position statement on Audit Committees. Contingency Ad-hoc advice and Consultancy 3 Time for advice and consultancy on relevant priorities and risks or change related projects and following up on the implementation of internal audit recommendations. Appendix 4 Annual Audit Plan 2024/25 – Integration Joint Board