2 Summary of IA complete
Renfrewshire Council · 13 June 2022
Back to Audit, Risk and Scrutiny Board — 13 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 13 June 2022 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Summary of Internal Audit Reports for period 01 January to 20 May 2022 ___________________________________________________________________ 1. Summary 1.1 In line with the Public Sector Internal Audit Standards, Internal Audit must communicate the results of each engagement to the Board. To comply with this requirement Internal Audit submits regular reports on the findings and conclusions of audit engagements to the Audit, Risk and Scrutiny Board. 1.2 Appendix 1 provides details those audit engagements completed during the period 01 January to 20 May 2022 with the overall assurance rating and the number of recommendations in each risk category. The committee summary for each report is also attached. For each audit assignment where recommendations have been made, the relevant managers have put action plans in place to address the issues raised. 1.3 In addition to the reports listed in the Appendix, Internal Audit has an ongoing commitment to: • A range of corporate and service initiatives; • Progressing of information security matters in partnership with ICT and Legal Services; • The regular provision of advice to departmental officers; • The provision of internal audit services to the associated bodies for which Renfrewshire Council is the lead authority and to Renfrewshire Leisure Ltd and Renfrewshire Health and Social Care Integrated Joint Board;
Page 2
• Co-ordination of the Council’s corporate risk management activity; • Management of the counter fraud team; • Management of the risk management and insurance team. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the Summary of Internal Audit Reports finalised during the period from 01 January to 20 May 2022. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Karen Campbell – 07768354651
Page 3
Appendix 1 Renfrewshire Council Internal Audit Service Update for Audit, Risk and Scrutiny Board Final Audit Reports issued from 01 January – 20 May 2022 Category Service Engagement Assurance Rating Recommendation Ratings Critical Important Good Practice Service Improvement Assurance Corporate Supporting Attendance Reasonable 0 1 0 0 Use of Purchase Cards Limited 3 6 2 1 Children’s Services Childrens Houses – Cash Payments Reasonable 0 1 3 0 Finance & Resources Budgetary Controls Substantial 0 0 2 0 Communities & Housing Services Void Properties Reasonable 0 1 1 0 Contingency Finance & Resources Electronic Payments Reasonable 0 2 3 0 Environment & Infrastructure School Cleaning & PVG Checks Reasonable 2 3 3 0 Note 1 – No assurance rating can be given in respect of investigation assignments
Page 4
Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse. Recommendation Rating Service Improvement Implementation will improve the efficiency / housekeeping of the area under review. Good Practice Implementation will contribute to the general effectiveness of control. Important Implementation will raise the level of assurance provided by the control system to acceptable levels. Critical Addresses a significant risk, impacting on the objectives of the area under review.
Page 5
Internal Audit Report CORPORATE Supporting Attendance (A0038/2021/001) Date: March 2022 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to: - 1. Ascertain the availability, accessibility and quality of information available to management (at all levels) to enable them to adequately monitor sickness absences; 2. Identify and evaluate the level of sickness absence monitoring currently in place for adequacy; 3. Ensure that management have adequate information to enable them to ensure that the supporting attendance policy is being followed; 4. Establish the process for recording COVID-19 related absences and ensure that these processes are being complied with in terms of accuracy and timeliness of recording. Audit Scope The following work was carried out: 1. Interviewed staff within Children’s Services and Communities & Housing, to obtain details of all current processes and available information / documentation. 2. Prepared and carried out a programme of tests covering the areas outlined above. Key Audit Assurances 1. The level of sickness absence monitoring in place was found to be adequate. 2. The availability, accessibility and quality of information available to management to enable them to adequately monitor sickness absences was found to be adequate. 3. Management, at all levels, have adequate information through Business World, or provided to them by Human Resources upon request, to enable them to ensure that the supporting attendance policy is being followed. 4. The process for recording COVID-19 related absences is being complied with in terms of accuracy and timeliness of recording. Key Audit Risks Currently, not all sections within the council have been trained to carry out their absence management in a way that is compatible with the Business World system, for logging and viewing their unplanned absences. In the meantime, they are relying on the Time & Attendance team to provide and record this absence information on their behalf, which places pressure on Finance & Resources staff. Overall Audit Opinion The audit review identified that, the level of sickness absence monitoring in place was found to be adequate and that management are provided with adequate information that should enable them to ensure that the supporting attendance policy is being followed. A provision of reasonable assurance has been made, with one recommendation being made in relation to training. Management Commentary The planned rollout of unplanned absence training for the teams not currently live has been delayed due to Covid-19 and is now being progressed.
Page 6
Internal Audit Report CORPORATE Use of Purchase Cards (C0041/2021/010) Date: February 2022 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: - 1. The spend is in line with the Corporate Purchasing Card Guidelines in terms of:- • transaction thresholds. • PCards are not used to purchase ICT goods or services. • there is no preferred method of purchasing already in place for the service/goods. • deliveries to non-council addresses are justified and have been authorised. 2. Purchases made are being recorded on the card holder logs and supported by authorised requisitions. 3. Authorising officers are authorising transactions timeously. 4. For any goods and services purchased regularly using the Pcard, consideration had been given to whether best value would be achieved by establishing contracts with these suppliers. Audit Scope The following work was carried out: 1. Details of current procurement contracts in place were obtained and reviewed. 2. Sample testing was carried out on Pcard transactions to meet the audit objectives. 3. Pcard logs and supporting documentation were examined as appropriate. Key Audit Assurances 1. Frequent transactions are in the main below £499.99 and transactions between £500.00 and £1,999.99 are for one off purchases, in line with the Pcard procedures. Key Audit Risks 1. There may be security/compatibility implications if Pcards are used to purchase ICT goods and services that do not have prior approval from ICT services. 2. There is a lack of transparency when large invoices are part paid by several different Pcard holders to be below individual or monthly transaction thresholds. 3. Budget holders will be unable to manage forecast spend if Pcard transactions are not approved timeously and committed spend is not shown in the financial ledger.
Page 7
Internal Audit Report CORPORATE Use of Purchase Cards (C0041/2021/010) Date: February 2022 Overall Audit Opinion Whilst there are adequate procedures in place covering the purchase of goods with Pcards, issues were identified regarding compliance with areas of these procedures such as the purchase of ICT goods without prior ICT approval, large value invoices being paid over multiple transactions and many card holders having individual transaction limits of more than £2,000. The audit also identified many transactions that were not approved timeously which resulted in committed spend not being recorded in the financial ledger. It was noted that the audit covered financial year 20/21 when working practices were affected by covid, however it is still expected that procedures in place should be adhered to and any exemptions to this are approved by Management and evidenced in backup paperwork. Recommendations were made to address the weaknesses identified and once implemented these should strengthen the controls in place and provide a greater robustness in the process. Management Commentary The Internal Audit Recommendations are currently being actioned. An email has been sent to all Purchase Card Holders and approvers to reiterate that the PCard Policy and Procedures are to be adhered to. We also plan to take a series of reviews to ensure the Policies are being followed. With regards to the individual/monthly transaction thresholds, especially throughout the period of the pandemic there were various PCard holders whose limits are outwith normal practise for operational reasons and these will be reviewed within the next 3 months.
Page 8
Internal Audit Report Childrens Services Childrens Houses - Cash Payments (A0096/2022/001) Date: January 2022 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to: - 1. Analyse the amount of cash payments by type of expenditure and by location. 2. Ascertain the reasons for cash payments being made rather than bank payments or other methods. 3. Assess whether cash payment is the only reasonable method, or if some types of expenditure could be facilitated by an alternative method. 4. Assess for a sample of establishments/offices that any cash imprests held are at a reasonable level for the value of payments made. 5. Confirm for a sample of cash payments that they have been adequately controlled and authorised per the procedures. Audit Scope The following work was carried out: 1. Ascertained the process for obtaining and disbursing all cash payments for social care purposes within Children's Services. 2. Prepared and undertook a series of tests to meet the audit objectives. Key Audit Assurances 1. Satisfactory reasons for cash payments being made rather than bank payments or other methods were obtained from House Managers. Key Audit Risks 1. A number of cash payment vouchers were not appropriately authorised or fully completed. Overall Audit Opinion The audit review highlighted that there is a risk associated with petty cash expenditure authorisation and the manner in which the petty cash vouchers are completed. In addition, the auditor noted minor issues in relation to types of cash expenditure and cash levels held. The auditor has made recommendations which will address these points. A reasonable level of assurance has been provided for the area reviewed. Management Commentary Management are implementing the audit recommendations and have reminded their establishment managers that petty cash vouchers must be correctly completed and authorised.
Page 9
Internal Audit Report Finance & Resources Budgetary Controls (A0033/2021/001) Date: April 2022 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: - 1. There are adequately documented procedures available to accounting staff and budget holders on the budget monitoring procedures to be followed; 2. Roles and responsibilities are clear for accounting staff and budget holders and budget holders have been appropriately identified across all services; 3. Monitoring templates being used are consistent across all services; 4. Budget holders are getting the information they require on a timely basis and in an accessible way; 5. Regular budget meetings are being held with budget holders and actions arising are documented with evidence of timely completion. Audit Scope 1. Interviewed the appropriate staff and ascertained the processes in place for budgetary control. 2. Prepared and undertook a series of tests to evaluate the operation of procedures in practice. Key Audit Assurances 1. Roles and responsibilities are clear for accounting staff and budget holders have been appropriately identified across all services. 2. Monitoring templates being used are consistent across all services tested. 3. Budget holders are getting the information they require on a timely basis and in an accessible way. 4. For the departments tested, accounting staff hold regular budget meetings with budget holders and action owners are identified. Key Audit Risks 1. There were no key risks identified during the audit. Overall Audit Opinion The audit has identified that there are clear budgetary control roles and responsibilities for accounting staff and budget holders. Budget holders get the information they need from accounting staff. The main findings from the review were in relation to having formal procedures i.e. an updated Budget Holders Manual and council specific budget monitoring procedures for accountants. Management Commentary No key risks were identified; however, an updated Budget Holders’ Manual has now been published on the intranet and communicated to relevant staff.
Page 10
Internal Audit Report Communities & Housing Void Properties (A0043/2022/001) Date: April 2022 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to ensure that: - 1. Adequate documented procedures exist detailing the content of void property inspections; 2. Processes to obtain notification of empty properties are adequate and timely to minimise the delayed turn around time on a property, and all appropriate parties are informed; 3. Void property inspections are undertaken timeously and are adequately documented and repair actions are initiated; 4. Repairs to the property are instructed and performed promptly and post inspected prior to completion of the re-occupation certificate. 5. Key performance indicator information is captured, reported and/or acted upon. Audit Scope The following work was carried out: 1. Interviewed the appropriate staff to understand the current systems in place regarding the turnaround of void properties. 2. Prepared and undertook a programme of tests covering the areas above. Key Audit Assurances 1. There are adequate documented processes in place detailing the content of void property inspections. 2. Timely processes are in place to obtain notification of empty properties, minimise turn around and inform appropriate parties. 3. Void property inspections are undertaken timeously and are adequately documented prior to repair actions being initiated. 4. Key performance indicator information is adequately reported on. Key Audit Risks 1. Where difficulties arise in repairing and allocating properties, this leads to delays in the properties being relet and therefore a reduction in rental income. Overall Audit Opinion The audit has identified that there are timely processes in place to minimise turn around of void properties and that general repairs are instructed, performed promptly and post inspected prior to properties being available for reoccupation. However, delays were identified in the time taken to relet properties. While we acknowledge that this was significantly impacted by the covid pandemic we have recommended Housing Services should review processes to determine if the time taken to offer and allocate a property to a new tenant after repairs have been completed can be reduced. Management Commentary The impact of the pandemic on resources have led to increasing timescales for the relet of properties. Action has been taken to assist in reducing turnaround times and any further opportunities to improve timescales will be investigated and implemented if feasible.
Page 11
Internal Audit Report Communities & Housing Void Properties (A0043/2022/001) Date: April 2022
Page 12
Internal Audit Report CORPORATE Children’s Services - Electronic Payments (C0041/2022/005) Date: January 2022 COMMITTEE SUMMARY Audit Objectives The objectives of the audit were to: - 1. Ascertain and review the processes and controls in place surrounding electronic payments made through locality teams. 2. Analyse a sample of payments to assess the level of compliance with procedures and to establish if the correct and most effective method of payment has been selected. 3. Ascertain and review the accounting process in place to ensure that payments and charges are recorded accurately and correctly. Audit Scope The following work was carried out: 1. Ascertained the process for making electronic payments for social care purposes within Children's Services. 2. Prepared and undertook a series of tests to meet the audit objectives. Key Audit Assurances 1. There are process notes in place surrounding electronic payments requested by the locality teams. 2. Payment methods selected were the correct and most effective. Key Audit Risks 1. Payment Requests could be processed without being properly authorised. 2. Payments and charges are not always being recorded accurately and timeously in the ledger. Overall Audit Opinion The process to facilitate electronic payments within Children’s Services was introduced quickly because of the Covid pandemic. The audit review identified some issues in relation to processes, controls and recording of payment information. The auditor has made recommendations to address these issues. A provision of reasonable assurance has been made in relation to the areas under review. Management Commentary This process was introduced quickly to ensure payments were made during the pandemic. Procedures have now been strengthened with regards to authorisation and PayPoint journals are now completed each period.
Page 13
Internal Audit Report Environment & Infrastructure Services School Cleaning & PVG Checks (C0041/2022/006) Date: May 2022 COMMITTEE SUMMARY Audit Objectives The Council, agreed the following motion: “In light of press allegations and concerns raised by parents, council agrees to hold an inquiry regarding the causes of the lack of cleanliness in our schools and the employment of labour without the proper PVG clearance”. Following discussion with the Director of Environment & Infrastructure, it was agreed that Internal Audit would conduct an independent review to evaluate: 1. the arrangements in place regarding maintaining cleanliness in schools and; 2. the arrangements that are in place for PVG checks to be undertaken where appropriate, prior to deployment within the school environment. 3. the circumstances leading to the negative press reports and provide assurances or make appropriate recommendations that the arrangements are robust moving forward. Audit Scope The following work was carried out: 1. Interview the appropriate officers to ascertain the circumstances relating to the press reports relating to both the cleanliness in schools and the lack of PVG checks. Identify what lessons have been learned and how are these being taken forward. 2. Liaise with Disclosure Scotland to determine whether day cleaners actually meet the definition of regulated work and ensure our current procedures comply with the legal requirements. 3. Visit some schools to consider any documented cleaning standards and what procedures are in place to assist cleaners, establishment responsible officers and cleaning supervisors to uphold these standards. Consider whether there are checklists etc in place. 4. Review training records for a sample of cleaning staff and confirm that training has been provided and training records have been updated. 5. Review the most recent BICS audits, consider if there are action plans in place and whether these are progressing as expected and being monitored. 6. Review the timetable of BICS audits and consider whether we would recommend an escalation of this timetable. Key Audit Assurances As soon as it was brought to management’s attention, that Contract Staff had not been PVG checked, they were immediately taken off day cleaning duties until such times as this check had been completed.
Page 14
Internal Audit Report Environment & Infrastructure Services School Cleaning & PVG Checks (C0041/2022/006) Date: May 2022 Key Audit Findings 1. During the period of severe staffing issues, it could not be confirmed which staff members were at certain locations during each shift. 2. Training for the new facilities roles were in the early stages of implementation at the time of this review. 3. The planning process of the BICS Cleaning Audits requires to be enhanced to ensure the service is achieving the maximum benefit from this assurance tool. Overall Audit Opinion It is evident that during the period in question, the facilities management service were under severe pressure to provide an enhanced cleaning regime in order to enable schools to remain open when they had significant staff shortages due to vacancies and unplanned absence. The new staffing model also had to be implemented during this time. All available options were utilised to increase capacity within the service as soon as possible to try and alleviate the pressures and this has led to the PVG clearance oversight for a group of contract staff who normally would not come into contact with children. With regards to the standards of cleanliness in schools, the new staffing model at the time of the review was still being embedded in and we have made some recommendations to further enhance the management controls in operation to ensure the standards of cleanliness are maintained at a satisfactory level. Management Commentary The Contractor who provides contract cleaning staff to the Council is now a registered countersignatory for Disclosure Scotland and provide a weekly report to the Council, confirming the PVG Status of all staff. With regards to the recommendations made to enhance the management controls over the standards of cleanliness in schools, these have all been progressed.