5 Annual IA Plan complete
Renfrewshire Council · 13 June 2022
Back to Audit, Risk and Scrutiny Board — 13 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 13 June 2022 ___________________________________________________________________ Report by: Chief Auditor ___________________________________________________________________ Heading: Annual Internal Audit Plan 2022/2023 ___________________________________________________________________ 1. Summary 1.1 In line with the requirements of the Public Sector Internal Audit Standards, a risk based internal audit plan for 2022/23 has been developed. The audit plan takes into account the outcomes of the internal corporate and service risk identification and evaluation processes, and the current business environment. In addition to undertaking work which will provide assurance on the robustness on key internal controls, the plan seeks to reflect the key priorities and challenges for the council. 1.2 A number of methods have been employed to facilitate production of the risk based audit plan for 2022/23: • Consultation with all Directors and their Senior Management Teams, • Senior management from the associate bodies and Audit Scotland; • Benchmarking with other Local Authorities; • Review of strategic, corporate and service risk registers; • Cumulative audit knowledge and experience; • Review of key external audit and inspection reports. 1.3 The following influencing factors have been considered in our assessment of the current business environment and the priority areas of audit: • Financial sustainability; • Economy; • Reducing Inequalities; • Climate, Sustainability & Adaptability
Page 2
• Cyber Attack Threat 1.4 The total available resource is 1193 days, the operational audit time available for 2022/23 has been identified as 941 days (79%). The remaining 252 days (21%) relates to training, service development, administration and management. Coverage of the plan is achieved through the use of in-house staff and where relevant, commissions from other providers. 1.5 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. Non-operational time includes provision for training, performance management and service development. In addition to the internal audit assurance function the Chief Auditor has managerial responsibility for risk management, insurance and corporate counter fraud which are excluded from the calculation of available operational audit resources. 1.6 Delivery of the risk based annual audit plan supports effective member scrutiny of the council’s internal financial and other control mechanisms. ___________________________________________________________________ 2. Recommendations 2.1 Members are asked to approve the content of the risk based audit plan for 2022/23. 2.2 Members are asked to note that the progress of the 2022/23 annual audit plan and summaries of the findings from each audit assignment will be reported to the Board on a quarterly basis. ___________________________________________________________________ Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – Safer and Stronger - effective internal audit is an important element of good corporate governance. 4. Legal - None 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None
Page 3
8. Health & Safety – None 9. Procurement - None 10. Risk - The subject matter of this report is the risk based Audit Plan for 2022 –2023 11. Privacy Impact – None 12. COSLA Implications - None ________________________________________________________________ Author Karen Campbell 07768354651
Page 4
Date March 2022 Annual Internal Audit Plan 2022/23 Finance & Resources Internal Audit
Page 5
Page 2 of 13
Page 6
Page 3 of 13 Renfrewshire Council Annual Internal Audit Plan 2022/23 Contents Page Audit Plan Overview 4 - 8 Supporting Appendices 1 Annual Council Internal Audit Plan 2022/23 9 – 10 2 Annual Other Bodies Internal Audit Plan 2022/23 11 3 Analysis of plan by service 12 4 Annual Audit Plan 2022/23 – Integration Joint Board 13
Page 7
Page 4 of 13 Audit Plan Overview 1. Introduction 1.1 In line with the requirements of the Public Sector Internal Audit Standards, a risk based internal audit plan for 2022/23 has been developed. In formulating the audit plan a risk assessment has been undertaken, giving consideration to the following sources of information: Risk assessment (1) Risk assessment and prioritisation of all auditable activities (audit universe). (2) Strategic and Corporate Risk Register. (3) Service Risk Registers. Consultation (4) The Chief Auditor has met with each member of the CMT and their senior management teams to ascertain any changes to operational practice and national policy and to determine their priorities and risks. (5) Senior Management from the associate bodies and Renfrewshire Leisure have been consulted to ascertain their priorities and risks. (6) The Chief Executive has been consulted on what he sees as the council’s priority and risk areas for the forthcoming year. (7) Feedback from, and the expectations of, the Audit, Risk and Scrutiny Board are identified through the regular meetings with the members of the board. (8) The Chief Auditor has met with Audit Scotland to ascertain their approach to the statutory audit where assurance on key internal controls could be provided to avoid any duplication of effort. Benchmarking (9) Other Local Authority internal audit plans. (10) Discussion with other Chief Auditors through the Scottish Local Authority Chief Auditors Group. Review of key internal reports (11) Thriving People – Connected Communities – Renfrewshire’s Council Plan (12) The results of internal audit work in 2021/22 and in previous years. Review of key external reports (13) Audit Scotland: Renfrewshire Council - Report to Members and the Controller of Audit on the 2020/21 Audit. (14) Audit Scotland: Best Value reports issued during 2021/22. 1.2 On the basis of the above, the audit engagements planned for 2022/23 are set out in Appendix 1, 2 and 4, for the Council, Associate Bodies and the Integration Joint Board in the following categories of audit activity: • Assurance, • Governance, • Contingency, • Planning and Reporting 1.3 It is the responsibility of management to ensure that they have good governance, risk management and internal control arrangements over the functions they are responsible for. It is internal audit’s role to provide an independent, objective assurance and consulting activity. The scope of the internal audit plan encompasses, but is not limited to, the examination and evaluation of the adequacy and effectiveness of the organisation's governance, risk management, and internal control processes; as well as the quality of performance in carrying out assigned responsibilities to achieve the organisation’s stated goals and objectives. Delivery of the internal audit plan supports the requirement for the Chief Auditor to provide an annual opinion which is used to inform the annual governance statement.
Page 8
Page 5 of 13 1.4 The Chief Auditor shares information and coordinates activities with other internal and external providers of assurance and consulting services, as appropriate, to ensure proper coverage and minimise duplication of effort. Internal audit may place reliance on the work of other providers of assurance and the ability to do so will be considered during each audit engagement. 1.5 The plan also includes provision for managing and developing the internal audit activity including audit planning, reporting, periodic quality assessments and for following up on previous recommendations and reactive investigative work. The plan includes contingency time to allow for completion of work carried forward from 2021/22 and provides for consultancy engagements to be undertaken where these can improve the council’s operations, add value and improve the management of risks. Contingency time also provides for sufficient flexibility to accommodate changing risks and priorities during the course of the year. More detail on each of these elements is set out in sections 4 to 7 of this plan. 1.6 The internal audit service is delivered and developed in accordance with its purpose which, as set out in the Internal Audit Charter, is to provide assurance by independently reviewing the council’s risk management, control and governance processes. 2. The current business environment and key risk areas 2.1 To ensure that the audit activity supports the achievement of the council’s objectives, the audit plan, detailed in Appendix 1, has been aligned with the themes contained in the council plan. 2.2 There are a number of significant risks, arising from the external and internal environment, which could impact on the council’s ability to achieve its objectives. The most significant risks and the risk control measures to manage these risks, have been identified through the council’s corporate risk management process. Subject to the overall flexibility of the Audit Plan, priority will be given to audit engagements which provide assurance in relation to the council’s strategic and corporate risks. The key strategic and corporate risks taken into account in formulating this audit plan are detailed below: (1) Financial Sustainability The medium to longer term financial sustainability risk remains very high as the financial outlook is subject to considerable uncertainty as a result of various factors including future grant levels, pay pressures and the significant cost of living increases. Therefore, the financial outlook continues to be subject to significant and regular scrutiny. The 2022/23 audit plan includes time for reviewing: • the best value arrangements throughout the Council; • the control of payroll variations; • the procurement of goods and services by quick quote processes; • rental income collection procedures; • debt management processes and • care at home processes. (2) Economy The coronavirus pandemic has resulted in many challenges for economies across the world. Renfrewshire’s economy has been impacted by the lockdown restrictions and several businesses/organisations are currently experiencing significant volatility in terms of labour and supply chains as well as major cost rises as a result of the rising inflation rates. In addition, Renfrewshire’s economy is also facing challenges such as a growing working age population and more closely aligning the education and skills provision with the needs of local employers The 2022/23 audit plan includes a review of the arrangements for processing development planning applications.
Page 9
Page 6 of 13 (3) Reducing Inequalities in Renfrewshire The Council plays a key role in tackling inequalities and providing the best possible services to our communities. It is committed to working with and providing support to communities to assist in successful delivery of local priorities. The 2022/23 audit plan includes time for reviewing grants provided to the cultural sector. (4) Cyber Attack Cyber attacks are becoming more and more frequent and sophisticated and we have seen attacks on large public organisations which have had a significant impact on their service provision. The 2022/23 audit plan includes a review of the controls and protections the council has in place over its cyber environment. (5) Climate, Sustainability and Adaptability Given the significant rising energy costs consumers are facing, the Council has a role in promoting and advising its community about energy efficiency as well as making optimum use of its property estate and reduce overall running costs and energy consumption levels. The 2022/23 plan includes time for reviewing the Energy Management arrangements in operation. 2.3 In addition the following reviews included in the 2022/23 plan relate to Business as Usual Risks inherent by nature of our type of organisation:- • Supply Teachers Processes • Disaster Recovery Arrangements • Review of the Information Asset Register 3. Allocation of Resources 3.1 In addition to the internal audit assurance function the Chief Auditor has managerial responsibility for risk management, insurance and counter fraud which are excluded from the calculation of available operational audit resources. 3.2 Operational and non-operational time has been calculated in accordance with CIPFA benchmarking criteria. The calculation of operational staff time has been based on 6 full time equivalent employees plus 80 days to be provided from other service providers and trainees. The internal audit team is appropriately resourced with 4 qualified and 2 non-qualified staff. Non-operational time includes provision for training, performance management and service development. 3.3 Resources from any unfilled elements of posts and other available audit resource will be used flexibly to ensure that the audit plan commitments are met, through the engagement of temporary staff and other audit service providers where appropriate. Where engagements are undertaken by the other audit service providers, these can provide an opportunity for benchmarking and training and development. Sufficient resources are available to engage specialist contractors where necessary to address any specific risks faced by the council. 3.4 The total available resource is 1193 days; the operational audit time available for 2022/23 has been identified as 941 days (79%). The remaining 252 (21%) days relates to training, service development, administration and management. Resources are assessed as being sufficient to provide an evidenced based opinion. 3.5 The following paragraphs provide an overview of how the audit time has been allocated to audit categories for the Council and its Associated Bodies. A summary of the operational time by audit category is detailed in table 1 below. The analysis of non-operational audit activity is detailed in the table 2 below. The planned operational/non-operational time for 2021/22 is given for comparative purposes.
Page 10
Page 7 of 13 2021/22 2022/23 Category of audit Planned Days % of Operational Time Planned Days % of Operational Time GOVERNANCE 81 9% 112 12% ASSURANCE 428 44% 381 40% CONTINGENCY note 1 344 35% 314 34% AUDIT PLANNING / REPORTING 119 12% 134 14% TOTAL OPERATIONAL TIME 972 100% 941 100% Table 1 Notes 1. This category includes time for the finalisation of the previous year’s audits, corporate exercises and groups, investigations, significant project consultancy activities and emerging priorities. 2021/22 2022/23 Activity Planned Days % of Non - operational Time Planned Days % of Non - operational Time TRAINING 62 24% 57 23% STRATEGIC MANAGEMENT 22 9% 20 8% TEAM ADMINISTRATION 90 35% 96 38% DEVELOPMENT note 1 80 32% 79 31% TOTAL NON-OPERATIONAL TIME 254 100% 252 100% Table 2 Notes 1. This category includes time allocated to development activities to support continuous improvement activities. 4. Governance (12% of operational time) 4.1 Internal Audit must evaluate the risk exposures relating to the council’s and associate bodies governance arrangements. The engagements within this category form the basis for the Chief Auditor’s annual audit opinions and support the annual governance statements. 4.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part A in respect of the current year, with a total of 112 days being allocated to these engagements for 2022/23. 5. Assurance (40% of operational time) 5.1 A risk based assessment has been undertaken of all auditable areas taking into account the risk management framework and the expectation of senior management and the Audit, Risk and Scrutiny Board. The engagements within this category also form the basis for the Chief Auditor’s annual opinions and support the annual governance statements. For each engagement internal audit will consider whether there are any available external sources of assurance can be relied upon to deliver the plan. Time is also allocated to following up on the implementation of prior year audit recommendations. 5.2 The results of the risk assessment are detailed at Appendix 1 and 2, Part B in respect of the current year, with a total of 381 days being allocated to these engagements for 2022/23. 6. Contingency (34% of operational time)
Page 11
Page 8 of 13 6.1 This category includes time allocations for finalisation of the 2021/22 audit plan, undertaking reactive investigations of theft, fraud or other malpractice and provides for post-report work which includes attending disciplinary or appeal hearings, employment tribunals and court, as required. 6.2 The council is also undergoing a significant period of change and although these changes represent significant priorities and risks for the council, the arrangements may not be sufficiently well established to be suitable for evidence based audit reviews. In recognition of this, the 2022/23 audit plan includes provision for the on-going and anticipated involvement in significant project consultancy activities, optimisation of the Business World product, participation in corporate groups, as well as smaller scale internal control reassessment by services. 6.3 The allocation of time for this category is an estimate based on prior experience and available resources. However, this will be monitored during the course of the year to ensure that internal audit continue to be in a position to respond to other priority areas which emerge during the course of the year, and, if necessary, revise the audit plan accordingly. Appendix 1 and 2, Part C details the indicative time of 314 days allocated across the contingency heading. 7. Audit Planning / Reporting (14% of operational time) 7.1 This category includes annual planning activity and reporting arrangements to the Corporate Management Team and the Audit, Risk and Scrutiny Board, the Integration Joint Board Audit, Risk and Scrutiny Board and the Boards of the other bodies we provide internal audit services to under a service level agreement. Appendix 1 and 2, Part D details the time of 134 days allocated to planning and reporting activities. 8. Analysis of Plan by Service 8.1 Appendix 3 shows the amount of operational audit time allocated to individual services in 2022/23 and compares it to the planned days for 2021/22. 8.2 The planned days allocated to all services relates to work which is cross-cutting rather than service specific as well as time which is allocated out to services as the year progresses, such as contingency and investigations. 9. Conclusion 9.1 The annual internal audit plan for 2022/23, based on the strategic risk assessment, reflects the current priorities and challenges for the council, and demonstrates that the internal audit service continues to deliver added value while continuing to improve the service in line with best practice. 9.2 The allocation of internal audit resources is sufficient to allow for flexibility to deal with emerging priorities and provide adequate coverage of governance, risk management and internal control to inform the annual assurance statement. 9.3 The plan may be subject to amendment during the course of the year due to the emergence of issues of greater priority, or other unforeseen circumstances. The Audit, Risk and Scrutiny Board will be requested to approve any necessary changes. Asst Chief Auditor March 2022
Page 12
Page 9 of 13 Appendix 1 Council Internal Audit Annual Plan 2022/23 Entity Engagement Title Service Council Plan Theme1 Days Allocated Strategic & Corp Risk Part A – Governance 66 Corporate Governance Corporate Governance Framework Corporate - All Services 5 6 No Information Governance Information Asset Register FAR 5 20 No Corporate Policy & Planning Best Value Arrangements CE 5 20 Yes Schools Procedures Administration of Medicines Children’s Services 2 20 No Part B – Assurance 318 Follow Up Follow Up Corporate - All Services 5 40 No Administration of Grants Cultural Grants Corporate - All Services 2 20 Yes Payroll – Service Controls Payroll – Variations to Pay Corporate - All Services 5 25 Yes Procurement Quick Quote Processes Corporate - All Services 5 20 Yes Non Domestic Rates Non Domestic Rates FAR 5 15 No Debt Management Debt Management FAR 1 20 Yes ICT Monitoring Cyber Security FAR 2 20 Yes ICT Planning & Organisation Disaster Recovery FAR 4 20 No Housing Assurance Statement Housing Assurance Framework Communities & Housing 2 8 No Rental income Rental income Communities & Housing 5 20 Yes Planning Services Planning Processes CE 1 20 Yes Home Care Care At Home Processes AS 2 20 Yes Procurement – Service Controls Purchase Cards - Catering E&I 5 15 No Energy Management Energy Management E&I 4 20 Yes School Meals Income Monitoring School Meals Debt E&I 3 15 No Supply Teachers Supply Teachers Children’s Services 2 20 No 1 1: Reshaping our place, our economy and our future, 2: Building strong, safe and resilient Communities, 3:Tackling equality, ensuring opportunities for all, 4:Creating a sustainable Renfrewshire for all to enjoy, 5:Working together to improve outcomes.
Page 13
Page 10 of 13 Entity Engagement Title Service Council Plan Theme1 Days Allocated Strategic & Corp Risk Part C – Contingency 306 Contingency Contingency Corporate - All Services N/A 124 N/A Contingency Corporate Groups Corporate - All Services N/A 45 N/A Contingency Investigations Corporate - All Services N/A 137 N/A Part D – Planning & Reporting 115 Planning & Reporting Planning & Reporting Corporate - All Services N/A 115 N/A
Page 14
Page 11 of 13 Appendix 2 Other Bodies Internal Audit Annual Plan 2022/23 Entity Engagement Title Service Days Allocated Part A – Governance 46 Integration Joint Board – Governance Arrangements Corporate Governance Framework IJB 5 Integration Joint Board – Governance Arrangements Risk Management IJB 20 RVJB - Governance Risk Management Associate Bodies - RVJB 15 Clydeplan Governance Arrangements Governance Arrangements Associate Bodies - Clydeplan 6 Part B – Assurance 63 Integration Joint Board – Other Systems Information Governance IJB 20 SE – Contract Monitoring Social Care Contracts Associate Bodies - SE 20 OneRen – Other Systems Payroll Processes OneRen 23 Part C – Contingency 8 Contingency Contingency Associate Bodies 8 Part D – Planning & Reporting 19 Planning & Reporting Planning & Reporting Associate Bodies 19
Page 15
Page 12 of 13 2021/22 2022/23 Service Planned Days % of Operation al Time Planned Days % of Operational Time All Services note 1 554 57% 512 55% Chief Executive’s Service 35 4% 60 6% Finance & Resources 80 8% 95 10% Children’s Services 45 5% 40 4% Adult Services 20 2% 20 2% Environment & Infrastructure 70 7% 50 5% Community & Housing 50 5% 28 3% COUNCIL TOTAL 854 88% 805 85% Scotland Excel 29 3% 25 3% Clydeplan 5 0% 10 1% Renfrewshire Valuation Joint Board 23 2% 20 2% Renfrewshire Health & Social Care Integration Joint Board (Appendix 4) 35 4% 55 6% OneRen 26 3% 26 3% TOTAL 972 100% 941 100% Notes 1 Planned time includes, Follow up Audit, Contingency, Planning and Reporting and an element of Cross cutting Assurance and Governance Audits and is allocated against services during the course of the year Appendix 3 Analysis by Service
Page 16
Page 13 of 13 Audit Category Engagement Title No. of days Detailed work Assurance Information Governance – Requests for Information 20 The aim of this review is to provide assurance that the various types of requests for information are being dealt with correctly. Governance Local Code of Corporate Governance 5 Annual review of the adequacy and compliance with the Local Code of Corporate Governance to inform the governance statement. Governance Risk Management – Risk Management Processes 20 The purpose of the audit is to review the arrangements in place for identifying and managing risks. Planning & Reporting Annual Plan, Annual Report and Audit Committee reporting & Training 7 The Chief Internal Auditor is required to prepare an annual plan and annual report for the Audit Committee, summarising the work undertaken by Internal Audit during the year and using this to form an opinion on the adequacy of the control environment of the IJB. Contingency Ad-hoc advice and Consultancy 3 Time for advice and consultancy on relevant priorities and risks or change related projects and following up on the implementation of internal audit recommendations. . Appendix 4 Annual Audit Plan 2022/23– Integration Joint Board