4 Internal Audit Annual Report complete
Renfrewshire Council · 13 June 2022
Back to Audit, Risk and Scrutiny Board — 13 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 13 June 2022 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Internal Audit Annual Report 2021 - 2022 ___________________________________________________________________ 1. Summary 1.1 The Public Sector Internal Audit Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. 1.2 The annual report must also provide an annual audit opinion on the overall adequacy and effectiveness of the Council’s internal control environment and include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters that can be used to inform the governance statement. 1.3 The Annual Report for 2021-22 is attached and outlines the role of Internal Audit, the performance of Internal Audit, the strategic and operational issues which influenced the nature of the work carried out, the key audit findings, and contains the annual audit assurance statement. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to consider and note the contents of the Annual Report. ___________________________________________________________________
Page 2
Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights – None 8. Health & Safety – None 9. Procurement - None 10. Risk - The summary reported relates to the delivery of the risk-based internal audit plan. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author Karen Campbell – 07768354651
Page 3
No embedded text on this page.
Page 4
Annual Report 2021-2022 Renfrewshire Council Internal Audit May 2022
Page 5
No embedded text on this page.
Page 6
Renfrewshire Council Internal Audit Annual Report 2021/2022 Contents Page 1. Introduction 1-2 2. Responsibilities of Management and Internal Audit 2 3. Internal Audit Activity in 2021/22 2-4 4. Summary of Internal Audit Work 4 5. Internal Audit Resources 4 6. Review of Internal Audit Activity • Table 1 – Analysis by category of audit 4-6 7. Quality Assurance and Improvement Activity • Table 2 – Internal Audit Performance 6 8. Implementation of Audit Recommendations • Table 3 – Implementation of Audit Recommendations 6-7 9. Performance of Non-Audit Activities • Table 4 – Corporate Counter Fraud Performance 7-8 10. Audit Assurance Statement 8-9 Appendix 1 – Summary of Assurances
Page 7
No embedded text on this page.
Page 8
1 Renfrewshire Council Internal Audit Annual Report 1 April 2021 – 31 March 2022 1. Introduction 1.1 Internal Audit is an independent and objective assurance and consulting activity designed to add value and improve the operations of Renfrewshire Council. It assists Renfrewshire Council in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organisation's risk management, control, and governance processes. 1.2 The Chief Auditor reports functionally to the Audit, Risk and Scrutiny Board and administratively (i.e. day to day operations) to the Director of Finance and Resources. In accordance with the principles of good corporate governance, regular reports on internal audit work and performance are presented to the Audit, Risk and Scrutiny Board. 1.3 The purpose, authority and responsibility of the internal audit activity is defined in the internal audit charter, approved by the Audit, Risk and Scrutiny Board; and provides that the Chief Auditor has independent responsibility for the conduct, format and reporting of all internal audit activity and findings. 1.4 The service operates in accordance with the Public Sector Internal Audit Standards (PSIAS). The Standards define the basic principles for carrying out internal audit. They establish the framework for providing internal audit services, which add value to the organisation, leading to improved organisational processes and operations. 1.5 The Standards require the Chief Auditor to prepare a report, at least annually, to senior management and the Board on the internal audit activity’s purpose, authority, and responsibility, as well as performance relative to its plan. The annual report must also provide an annual audit opinion, on the overall adequacy and effectiveness of the Council’s internal control environment. It must include details of any significant risk exposures and control issues, including fraud risks, governance issues, and other matters that can be used to inform the governance statement. 1.6 The aim of this report is to provide an opinion on the overall adequacy and effectiveness of the council’s framework of governance, risk management and control and provide a summary of the work undertaken during the year to support that opinion. The report also provides details of the performance of the internal audit service during the past year, and the results of the quality assurance and improvement programme. 1.7 In addition to the work carried out in relation to council services, we also provide an internal audit service to the following organisations:
Page 9
2 • OneRen • Renfrewshire Valuation Joint Board • Scotland Excel • Clydeplan • Renfrewshire Health and Social Care Partnership – Integration Joint Board 1.8 The outcome of the audit assignments undertaken for these organisations is reported separately as part of their annual report which also contains an assurance statement to their Boards. 2. Responsibilities of Management and Internal Audit 2.1 It is the responsibility of the Council’s managers to ensure that the management of the areas under their control is adequate and effective and that their services have a sound system of internal control which facilitates the effective exercise of the organisation’s functions and which includes arrangements for the management of risk. 2.2 Internal audit is not a substitute for effective control exercised by management as part of their responsibilities. Internal audit’s role is to independently assess the adequacy of the risk management, internal controls and governance arrangements put in place by management and to undertake sufficient work to evaluate and conclude on the adequacy of those controls for the period under review. 3. Internal Audit Activity during 2021/2022 3.1 The internal audit plan for 2021/2022 was approved by the Audit, Risk and Scrutiny Board on 22 March 2021. The plan was risk-based and took into account the outcomes of the service and corporate risk evaluation processes, any significant changes in council operations over the period, and the impact of developments in national policy and regulation. The plan also took into account key external audit reports including their Annual Audit Plan for the council. 3.2 The continued restrictions arising from the pandemic and the changing risk profile of the council and the reduction in resource for part of the year due to unplanned absence necessitated that the audit plan was kept under continuous review throughout the year. It should be noted the working environment throughout this year has led to some audits either requiring additional time from our contingency budget or taking a bit longer to complete. The planned review of administration of medicines in schools was deferred until 2022/23. In addition, at the request of Service Senior Management three further reviews were undertaken during the year and have been reported upon:- a) Billing, Collection and Accounting of Levies by the Council b) PVG Checks and Cleanliness in Schools c) Electronic Payments to Children Services Locations
Page 10
3 3.3 All other planned work as detailed in the 2021/2022 audit plan has been undertaken or commenced and those assignments not finalised by 31 March 2022 have been prioritised in the first quarter of the current year. 3.4 Set out below are the significant risks which influenced the content of the plan and the nature of the work undertaken in recognition of these. (1) Financial Sustainability The council is continuing to face significant financial pressures in the medium and long term. Consequently, the financial sustainability risk remains very high and continues to be subject to significant and regular scrutiny. The council’s transformational change programme to deliver service delivery and savings recommenced during this year. Work undertaken during 2021/22 included: • Reviews of budgetary controls across all services, council tax collection procedures and void processes were completed • Planned reviews of overtime payments and creditor payment processing have commenced and will be completed early in the 2022/2023 audit year. (2) Economy The coronavirus pandemic has resulted in significant challenges for businesses to remain as going concerns and for individuals to be financially sufficient during periods of self isolation.The Scottish Government has made funds available, which have been administered by the Council in the form of business grants and support payments to individuals. A review of the arrangements for paying and accounting for those business support grants was completed to ensure the controls in place were sufficient. Corporate Counter Fraud continued to undertake work in relation to potential and actual fraudulent grant activity and support payments and are continuing to liaise with the police on those cases where necessary. (3) Organisational Resilience Business continuity planning is crucial to our ability to provide services, and those services are increasingly heavily reliant on digital systems. A review is therefore being undertaken to ensure services business continuity plans are sufficient and realistic in terms of recovery. (4) Asset Management Physical assets of the Council required to be efficiently managed to avoid financial, physical and reputational risk for the council. During this year we reviewed Council’s Winter Maintenance Procedures and also the safety checks in place in high rise housing stock. Reviews are currently ongoing on the controls in place over Streetscene equipment and to ensure that the required statutory inspections are being undertaken within Council Buildings. (5) Brexit
Page 11
4 The Council continue to monitor the impact of Brexit and implement any required changes to our duties. As this work is ongoing no specific internal audit work was undertaken during the year. 3.5 In line with the council’s procedures, instances of suspected theft, fraud or other irregularity are reported to internal audit. Depending on the nature of the allegations, they are investigated either by the internal audit service or by the Corporate Counter Fraud service. All referrals were evaluated and investigated as appropriate. Both Corporate Counter Fraud and Internal Audit undertook work in relation to potential and actual fraudulent grant activity and are continuing to liaise with the police on those cases referred to them. 3.6 During 2021/22, Internal Audit conducted a number of investigations in relation to employee conduct and service management has undertaken disciplinary procedures and strengthened internal controls where necessary. 3.7 The outcomes of all internal investigation reviews are reported to the Audit, Risk and Scrutiny Board. 3.8 The Corporate Counter Fraud team workload during 2021/22, involved mainly investigating matches identified by the national fraud initiative. 4. Summary of Internal Audit Work 4.1 The internal audit team has been working on a hybrid basis, mainly from home. The team also provided advice and support where necessary to council services. 4.2 Appendix 1 details the assurances arising from the internal audit work carried out in line with the 2021/22 audit plan and from those 2020/21 assignments which were finalised during this year which supports the annual assurance statement. These include the conclusions in relation to the overall system of internal control, risk management and governance arrangements. 5. Internal Audit Resources 5.1 For the year to 31 March 2022, the audit plan was based on an establishment of 6.00 full time equivalent employees plus 100 days to be provided from other service providers and a trainee. However, the actual staffing complement was reduced due to higher than anticipated unplanned absence and as a result of the Covid19 pandemic. No audit engagements were outsourced as was planned. 6. Review of Internal Audit Activity 6.1 The Audit Plan for 2021/22 set out our risk-based plans across a range of audit categories, the results of which have been reported quarterly to Audit, Risk and
Page 12
5 Scrutiny Board. Table 1 below compares the actual days spent on each category of audit work against that planned for the year. Table 1 Type of Audit Planned Days Actual Days Variance Days % Governance 81 52 (29) (35%) Assurance 428 332 (96) (22%) Contingency 344 336 (8) (2%) Audit Planning & Reporting 119 114 (5) (4%) Total Operational Days 972 834 (138) (14%) Training 62 33 (29) (47%) Strategic Management 22 6 (16) (72%) Team Administration 90 89 (1) (1%) Development 80 46 (34) (42%) Total Non-operational Days 254 174 (80) (31%) Gross Available Days 1226 1008 (218) (17%) Operational % 79% 82.9% Non-Audit – Including Management of Risk Management and Insurance and Corporate Counter Fraud including the co-ordination of NFI 107 110 3 3% 6.2 Material differences (over 20% and over 20 days) from the plan are explained below: 1) Governance The planned review of administration of medicines in schools was deferred until 2022/23 due to the planned implementation of a revised policy. 2) Assurance Due to the higher than planned absence levels, no work being outsourced and the level of contingency work, the completion of some 2021/22 assignments have been carried forward in 2022/23. 3) Training Planned training activity did not take place due to Covid restrictions and home working arrangements. These are planned to go forward in 2022/23. 4) Strategic Management and Development
Page 13
6 As a result of the Covid Restrictions and unplanned absence levels, the external quality assessment of the internal audit service was delayed until 2022/2023. 7. Quality Assurance and Improvement Activity 7.1 Internal audit measures performance against a range of measures set annually by the Director of Finance and Resources. The Audit, Risk and Scrutiny Board received quarterly reports on progress and performance during the year. Table 2 shows the actual performance against targeted performance for the year. Table 2 Internal Audit Performance 2021/22 Performance measure Target 2021/22 Actual 2021/22 % completion of audit plan for the year* 95% 92.1% % engagements completed by target date 95% 98.4% % engagements completed within time budget 95% 96.8% * this measures the completion percentage as at 31 March. 100% of the plan is ultimately delivered through the finalisation of the outstanding elements in the new financial year. 7.2 The percentage completion of the audit plan is slightly below the target set for the year. This was due to the level of unplanned leave. The actual performance for the year for the two other indicators, is above the target performance level. 7.3 The Chief Auditor is required to develop and maintain a quality assurance and improvement programme that covers all aspects of internal audit including conformance with the PSIAS. The review did not identify any areas of non- conformance that require to be addressed. 7.4 External Audit’s review of the internal audit service concluded that overall the service operates in accordance with the PSIAS. 8. Implementation of Audit Recommendations 8.1 During 2021/22, 150 recommendations were followed up, with 82% of all recommendations being completed. The implementation status of the recommendations across each service area is detailed in Table 3 below. Table 3 Implementation of Audit Recommendations 2021/22 Service No. Followed up Complete Partially Complete (new date) Not Implemented (new date) Redundant Adult Services 8 7 (88%) 1 (12%) 0 0
Page 14
7 Chief Executive’s 21 10 (47%) 9 (43%) 2 (10%) 0 Children’s Services 12 9 (75%) 2 (17%) 1 (8%) 0 Environment & Infrastructure 38 37 (97%) 0 1 (3%) 0 Finance & Resources 67 56 (84%) 7 (10%) 2 (3%) 2 (3%) Communities & Housing 4 4 (100%) 0 0 0 Total 150 123 (82%) 19 (13%) 6 (4%) 2 (1%) 9. Performance of Non-Audit Activities 9.1 Risk Management The responsibility for co-ordinating risk management and insurance activity across the council lies with internal audit. Risk management performance is detailed in the risk management annual report. 9.2 Corporate Counter Fraud The Corporate Counter Fraud team report to the Chief Auditor, during 2021/22 the team worked mainly from home. The aim of the team is to raise awareness to promote an anti-fraud culture and investigate instances of suspected fraud against the Council, such as council tax reduction fraud, tenancy fraud and other corporate fraud. Our working practices were revised in order to protect the health of residents and staff during the pandemic, including contacting individuals, where possible, by telephone or e-mail rather than face to face visits and this has worked well for cases with a lower monetary value. For cases, where it is possible that a referral could be made to the Procurator Fiscal, interviews under caution resumed during the year. The joint working arrangements with the DWP in place to investigate potential high value fraud cases which involve both benefits payments and council tax reduction, recommenced in the last quarter of the year. Table 4 Corporate Counter Fraud Performance 2021/22 Financial Outcomes 2021/22 (£) Cash savings directly attributable to preventative counter fraud intervention (e.g business grants) 426,600.00 Cash recoveries in progress directly attributable to counter fraud investigations 181,281.59 Notional savings identified through counter fraud investigation, (e.g. housing tenancy and future council tax) 434,708.04
Page 15
8 Housing Benefit Savings identified through other counter fraud work or through joint working with the DWP 40,310.52 Non-Financial Outcomes 2021/22 Housing properties recovered 4 Housing applications amended/cancelled 10 Blue badge misuse warning letters issued 13 9.3 The National Fraud Initiative The National Fraud Initiative (NFI) in Scotland is a counter-fraud exercise led by Audit Scotland and overseen by the Cabinet Office for the UK. It uses computerised techniques to compare information about individuals held by different public bodies, and on different financial systems that might suggest the existence of fraud or error. Internal audit is responsible for the co-ordination of the exercise which is undertaken every second year. The Council’s data, as required by the NFI, was submitted in October 2020, the resulting matches were received in January 2021 and investigation of those matches was progressed throughout this year by Corporate Fraud and Council Services. The final outcomes arising from the exercise will be subject to a separate report to the Audit, Risk and Scrutiny Board during 2022/23. 10. Audit Assurance Statement 10.1 Internal audit has performed its work in accordance with the role defined in paragraph 1.4. The audit work performed has been reported to senior managers and where areas for improvement in internal control have been identified appropriate recommendations have been made and accepted for action by management. 10.2 In view of the continued challenges common to all local authorities, the Council recognises the need to exercise very close scrutiny over financial management and compliance with overarching governance arrangements and will continue to take appropriate action to further strengthen control in these areas. 10.3 Internal audit contributes to the promotion of sound corporate governance in the Council. The scrutiny function within the council performed by the Audit Panel and the Audit, Scrutiny and Petitions Board further demonstrates strong commitment in this area. 10.4 It is not feasible for the system of internal control in the Council to be without any weakness. It is important to balance the risks involved in accepting systems limitations with the consequences if a problem emerges. Internal audit recognises this and assesses this in its reporting mechanism.
Page 16
9 10.5 The audit plan is always intended to be flexible and contingency time was utilised to undertake additional work on areas of emerging risk. Additionally, the gross operational days were reduced by 14% due to unplanned absence and no audit engagements were outsourced as was planned due to the pandemic . In this context, it is considered that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s internal control, risk management and governance arrangements, as evidenced by:- (i) the results of the planned audit work in 2021/22; (ii) the results of investigative work in 2021/22; (iii) management self assessment of internal control, risk management and governance arrangements; (iv) management action to respond to audit recommendations to mitigate the risks areas highlighted in this report; (v) the regular review of the Local Code of Corporate Governance. Signed Assistant Chief Auditor Date 13 June 2022
Page 17
Appendix 1 1 Audit Engagement Risk Area Assurance Level Conclusion Payments to Care Homes Assurance Reasonable • The audit has identified that financial assessments and payments to care homes were calculated correctly. However, it identified that signed payment schedules are not always being returned timeously by care homes and also that there was outstanding information which was delaying the completion of financial assessments. Events Management Assurance Reasonable • The events programme is adequately supported by appropriate event manuals which are based upon regulation and official published guidance. • Additionally, based on the information provided and the analysis of hours worked to ensure that events are delivered safely and successfully, it is clear that employees have been working excessive extra paid and unpaid hours to fulfil the events programme and this required to be addressed. Document Solution Centre Assurance Reasonable • The audit has identified that stock is held in a secure location and that DSC staff promoted use of their services to a number of specific service areas Consideration should be given to wider promotion of DSC services to all areas of the Council. • Some recommendations for improving the charging process and in relation to the procedure for apportioning the year end under/overspend were made. Management of ICT Systems Governance Reasonable • The audit review highlighted that there is an adequate system in place in relation to the centralisation of software applications backed by individual Support Models. Some annual reviews had not taken place timeously, however action has been taken to address this issue and a recommendation has been made to make the process more robust. Business Support Grants Assurance Substantial • Business grant payments were made in line with documented procedures. Roles and responsibilities for decision making, escalation and dispute resolution were
Page 18
Appendix 1 2 clear. Grant costs were monitored and appropriately reported. Memorial Safety Assurance Limited • Procedures have been prepared for the inspection of memorials to ensure that unsafe memorials identified are properly dealt with to prevent accidents • It was a major concern that at the time of the audit review only around 4% of Renfrewshire memorials had been inspected in cemeteries. In addition, there were only 2 members of staff who were currently undertaking these inspections. Whilst it is acknowledged that memorial inspection work was interrupted by events as a result of the COVID 19 pandemic, it is vital that plans and resources were put in place to complete this exercise as soon as possible and management agreed to do this Payroll Assurance Reasonable • Although there is a Salary Adjustment Policy in place, recovery action does not always strictly comply with the policy and recommendations were made to strengthen controls in this area. • There are satisfactory arrangements in place to ensure that employees and managers are aware of their responsibilities in relation to payroll processing and salary overpayments. • The introduction of monthly overpayment reports to services to inform them of employee overpayments has enabled services to address any issues that may lead to further overpayments. A dedicated team has been established to concentrate on overpayment recoveries. Capital Expenditure Assurance Reasonable • Contracts were awarded only where there was sufficient capital funding available and the financial implications of the contracts awarded were fully detailed on Board reports. It was recommended that standardised business case templates should be used for all capital projects and Finance Business Partners should be more
Page 19
Appendix 1 3 involved in reviewing and challenging assumptions during capital projects Levy Processes Contingency Reasonable • The audit has identified that generally satisfactory arrangements are in place for the billing, collection and recording of the levy transactions. We have made recommendations mainly in respect of the refund process. Supporting Attendance Assurance Reasonable • The audit review identified that, the level of sickness absence monitoring in place was found to be adequate and that management are provided with adequate information to ensure that the supporting attendance policy is being followed. • One recommendation was made in relation to training. Use of Purchase Cards Assurance Limited • Whilst there were adequate procedures in place covering the purchase of goods with Pcards, issues were identified regarding compliance with areas of these procedures such as the purchase of ICT goods without prior ICT approval, large value invoices being paid over multiple transactions and many card holders having individual transaction limits of more than £2,000. • The audit also identified many transactions that were not approved timeously which resulted in committed spend not being recorded in the financial ledger. • It was noted that the audit covered the period when working practices were affected by covid, however it is still expected that procedures in place should be adhered to and any exemptions to this are approved by Management and evidenced in backup paperwork. Childrens Houses Cash Payments Assurance Reasonable • The audit highlighted that there is a risk associated with petty cash expenditure authorisation and the manner in which the petty cash vouchers are completed. In addition, the auditor noted minor issues in relation to types of cash expenditure and cash levels held.
Page 20
Appendix 1 4 Children’s Services Electronic Payments Contingency Reasonable • The process to facilitate electronic payments within Children’s Services was introduced quickly because of the Covid pandemic. The audit review identified some issues in relation to processes, controls and recording of payment information. Budgetary Controls Assurance Substantial • The audit identified that there were clear budgetary control roles and responsibilities for accounting staff and budget holders. Budget holders get the information they need from accounting staff. • The main findings from the review were in relation to having formal procedures i.e. an updated Budget Holders Manual and council specific budget monitoring procedures for accountants. Non-Domestic Rates Assurance Reasonable • The audit identified that satisfactory controls are in place for the billing and collection of NDR. However, the pandemic workload had led to delays in reinstating reviews of reliefs and the controls over refunds required to be strengthened. Void Properties Assurance Reasonable • The audit identified that there are timely processes in place to minimise turnaround of void properties and that general repairs are instructed, performed promptly and post inspected prior to properties being available for reoccupation. • Delays were identified in the time taken to relet properties. While we acknowledged that this was significantly impacted by the covid pandemic we have recommended processes should be reviewed to determine if the time taken allocate a property to a new tenant can be reduced School Cleaning and PVG Checks Assurance Reasonable • It is evident that during the period in question, facilities management were under severe pressure to provide an enhanced cleaning regime in order to enable schools to remain open when they had significant staff shortages due to vacancies and unplanned absence. The new staffing model also had to be implemented during this
Page 21
Appendix 1 5 time. All available options were utilised to increase capacity within the service as soon as possible to try and alleviate the pressures and this led to the PVG clearance oversight for a group of contract staff who normally would not come into contact with children. • With regards to the standards of cleanliness in schools, the new staffing model at the time of the review was still being embedded in and we have made some recommendations to further enhance the management controls in operation to ensure the standards of cleanliness are maintained at a satisfactory level. Housing Assurance Statement Assurance Substantial • Based on sample check of the evidence used to demonstrate compliance, we would confirm that the Council complies with the Housing Regulator requirements of the Housing Assurance Statement. LEADER Programme Assurance Substantial • The audit identified that satisfactory arrangements are in place for issuing, monitoring and managing the External Funding Applications through the LEADER grant funding programme. Assurance Level Substantial Assurance • There is a sound system of internal control designed to achieve the objectives of the area being reviewed. • The control processes tested are being consistently applied. Reasonable Assurance • The internal control processes are generally satisfactory with some areas of weakness being identified that could put some objectives of the area being reviewed at risk • There is evidence that the level of non-compliance with some of the control processes may put some of the objectives of the area being reviewed at risk. Limited Assurance • Weaknesses in the system of internal controls are such as to put the objectives of the area being reviewed at risk. • The level of non-compliance puts the objectives of the area being reviewed at risk. No Assurance • Control processes are generally weak with significant risk to the achievement of the objectives of the area being reviewed. • Significant non-compliance with control processes leaves the processes/systems open to error or abuse.