6 Unaudited Annual Governance Statement complete
Renfrewshire Council · 13 June 2022
Back to Audit, Risk and Scrutiny Board — 13 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
___________________________________________________________________ To: Audit, Risk and Scrutiny Board On: 13 June 2022 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Unaudited Annual Governance Statement 2021 - 2022 ___________________________________________________________________ 1. Summary 1.1 The Local Authority Accounting Regulations require that an Annual Governance Statement is prepared and included in the Annual Accounts for the council. The Annual Governance Statement should be prepared in accordance with the CIPFA / Solace guidance “Delivering good governance in Local Government”. 1.2 The Annual Governance Statement for 2021-22 is attached and has been prepared in accordance with the relevant regulation and guidance taking account of the Internal Audit Annual Report and Director’s evaluation of the operation of the governance arrangements within each service area. 1.3 The Governance Statement is subject to statutory audit by the Council’s External Auditors as part of their review of the annual accounts. ___________________________________________________________________ 2. Recommendations 2.1 Members are invited to note the Annual Governance Statement will be included in the Unaudited Accounts for 2021/22. ___________________________________________________________________
Page 2
Implications of the Report 1. Financial - None 2. HR & Organisational Development - None 3. Community Planning – The application of sound governance arrangements supports the Council to deliver on its key objectives and priorities. 4. Legal - subject to approval by Council, the Accounts will be released for audit by the statutory deadline of 30 June 2021. 5. Property/Assets - None 6. Information Technology - None 7. Equality & Human Rights - None 8. Health & Safety – None 9. Procurement - None 10. Risk – Specific risks identified from the Chief Auditor’s Annual Report and the assessments of service Directors are disclosed in the statement. 11. Privacy Impact – None 12. COSLA Implications – None 13. Climate Risk - None ________________________________________________________________ Author: Karen Campbell – 07768354651
Page 3
Annual Governance Statement Scope of responsibility Renfrewshire Council is responsible for ensuring that its business is conducted in accordance with the law and proper standards, and that public money is safeguarded, properly accounted for, and used economically, efficiently and effectively. The Council also has a statutory duty to make arrangements to secure best value under the Local Government in Scotland Act 2003. In discharging this overall responsibility, the Council’s members and the corporate management team are responsible for putting in place proper arrangements for its affairs and facilitating the effective exercise of its functions, which includes arrangements for the management of risk. The Council has approved and adopted a Local Code of Corporate Governance, which is consistent with the principles of the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Society of Local Authority Chief Executives (SOLACE) framework; Delivering Good Governance in Local Government. A copy of the Local Code is available on our website www.renfrewshire.gov.uk. This statement explains how Renfrewshire Council has complied with the Local Code and also meets the Code of Practice on Local Authority Accounting in the UK, which details the requirements for an annual Governance Statement. The purpose of the governance framework The governance framework comprises the systems and processes, and culture and values, by which the Council is directed and controlled and through which it accounts to, engages with and leads the community. It enables the Council to monitor the achievement of its strategic objectives set out in the Council plan. The system of internal control is a significant part of that framework and is designed to manage risk to a reasonable level. Internal control cannot eliminate all risk of failure to achieve policies, aims and objectives and can therefore only provide reasonable and not absolute assurance of effectiveness. The system of internal control is based on an ongoing process designed to identify and prioritise the risks to the achievement of the Council’s policies aims and objectives, to evaluate the likelihood of those risks being realised and the impact should they be realised, and to manage them efficiently, effectively and economically. The governance framework The main features of our governance arrangements are described in the Local Code but are summarised below: The overarching strategic priorities and vision of the Council are set out in the Council Plan 2017-2022 and the Renfrewshire Community Plan 2017-2027. The Council Plan is aligned to the Community Plan and sets out 5 strategic outcomes that the organisation will work to achieve over a 5-year period with specific priorities relating to tackling inequality, promoting economic and cultural regeneration, attainment and sustainability. Renfrewshire’s Community Plan (which also acts as Renfrewshire’s Local Outcome Improvement Plan as required by the Community Empowerment (Scotland) Act 2015) details how community planning partners will work together to achieve the key priorities identified for Renfrewshire. • The key outcomes the Council is committed to delivering with its partners, are set out in the Community Plan; • The Council operates within an established governance framework which incorporates a scheme of delegated functions, financial regulations, standing orders relating to contracts and procedural standing orders. These elements of the framework are kept under regular review by the Council; • The Council facilitates policy and decision making through a policy board structure; • Services are able to demonstrate how their own activities link to the Council’s vision and priorities through their service improvement plans. Performance management and monitoring of service delivery is reported through policy boards regularly including six monthly updates to the Leadership Board on progress against the implementation of the Council Plan; •Prior to COVID-19, the Corporate Management Team monitored a quarterly scorecard of performance information which is now being refreshed to ensure this is fit for purpose. The Council regularly publishes information about its performance, e.g. “It’s all about you”, a publication outlining the
Page 4
performance of the Council published annually. An annual benchmarking report on the performance of the Council is submitted to the Audit, Risk and Scrutiny Board; • The Council has adopted a code of conduct for its employees. Elected members adhere to the nationally prescribed Code of Conduct for Members. In addition, the Council has in place a protocol for Relationships between Political Groups, Elected Members and Officers; • The Council’s approach to risk management is set out in the risk management strategy and is well embedded. Risks are reported regularly to the Audit, Risk and Scrutiny Board; • The Director of Finance and Resources is the Council’s Senior Information Risk Owner and information risk is monitored through the Information Management and Governance Group and its sub-groups. The Managing Solicitor, Information Governance is the statutory Data Protection Officer; • Comprehensive arrangements are in place to ensure members and officers are supported by appropriate training and development; • Registers of interests for elected members and senior officers are maintained and published on the Council’s website; • The Council complies with the CIPFA Code of Practice on Managing the Risk of Fraud and Corruption and the Council’s arrangements for fraud prevention, detection and investigation are managed through the corporate counter fraud service; • The Council’s approach to ‘whistleblowing’ is outlined in the policy for expressing concerns outwith line management; • A range of multi layered Cyber Security controls are in place and are tested annually to check standards in line with Government guidance. Industry cyber security standards are followed and explicitly those belonging to Public Sector Network (PSN), National Cyber Security Centre (NCSC) guidance, Scottish Government Public Sector Cyber Resilience Plan and Payment Card Industry (PCI) data security standards. The O365 security and compliance toolset provides a wide range of protection against cyber-attacks including identity theft and phishing. The Council holds a current Certificate of Compliance for PSN standards. ICT network and digital services are monitored monthly through our cyber security partner. These are all monitored and managed through the Cyber Security team which is headed up by a CISM qualified Cyber Security Architect (Cyber Information Security Manager) • Clear and independent governance arrangements are in place with One Ren and the Renfrewshire Health and Social Care Partnership with oversight from the Head of Policy and Commissioning (Council’s Designated Monitoring Officer) and the Council’s Leadership Board. • Seven Local Partnerships have been established and have identified initial local priorities. Decision making including that relating to relevant grants is delegated to each Local Partnership through a Lead Officer appointed by the Council. This governance framework has been in place at Renfrewshire Council for the year ended 31 March 2022, subject to the impact of the COVID-19 pandemic as disclosed in the section on review of effectiveness and continuous improvement below. Within the 2020/21 report, Audit Scotland concluded that “The Council has appropriate governance arrangements in place. We recognise that in responding to the COVID-19 pandemic the Council revised its governance arrangements. The new arrangements are appropriate and support good governance and accountability. There is effective scrutiny, challenge and informed decision making.” The system of internal financial control The system of internal financial control is based on a framework of regular management information, financial regulations, administrative procedures (including segregation of duties), management and supervision, and a system of delegation and accountability. Development and maintenance of the system is undertaken by managers within the Council. The system includes: • Guidance on financial management supported by comprehensive financial regulations and codes; • Comprehensive budgeting systems, and detailed guidance for budget holders; • Regular reviews of periodic and annual financial reports which indicate financial performance against the forecasts; • Setting targets to measure financial and other performance; • The preparation of regular financial reports that indicate actual expenditure against the forecasts;
Page 5
• Clearly defined capital expenditure guidelines; • As appropriate, formal project management principles; • The Chief Finance Officer is the Director of Finance and Resources who complies with the CIPFA Statement on the Role of The CFO in Public Services. The role and responsibilities of the Audit Committee and the Chief Auditor The role of the audit committee is under the remit of the Audit, Risk and Scrutiny Board which is chaired by a member of the opposition; its role includes: • to approve the internal audit charter and annual internal audit plans; • to review internal and external audit reports and the main issues arising, including those relating to the annual accounts and seek assurance that action has been taken and make recommendations to the Council where appropriate; • to receive and consider the Chief Auditor’s annual report, summarising internal audit activity and the level of assurance this provides over the arrangements for internal control, risk management and governance within the Council; • to monitor the performance of internal audit; • to consider the annual review of the Local Code of Corporate Governance. The internal audit service operates in accordance with the Public Sector Internal Audit Standards and reports to the Audit, Risk and Scrutiny Board. Internal audit undertakes an annual programme of work, approved by the Board, based on a strategic risk assessment. The Council’s Chief Auditor provides an independent opinion on the adequacy and effectiveness of the governance framework, risk management and internal control. The Council conforms to the requirements of the CIPFA Statement on the Role of the Head of Internal Audit (2019). Members and officers of the Council are committed to the concept of sound governance and the effective delivery of Council services. The Audit, Risk and Scrutiny Committee complies with the CIPFA guidance Audit Committees: Practical Guidance for Local Authorities and Police. The Council’s Chief Auditor has responsibility to review independently and report to the Audit, Risk and Scrutiny Board annually, to provide assurance on the adequacy and effectiveness of the Local Code and the extent of compliance with it. The Audit, Risk and Scrutiny Board performs a scrutiny role in relation to the application of the Local Code of Corporate Governance and regularly monitors the performance of the Council’s internal audit service. Internal Audit reporting arrangements include communication of finalised audit engagements, monitoring the progress of agreed management actions and communication of any unacceptable risk identified to the Board. Review of effectiveness and continuous improvement Renfrewshire Council has responsibility for conducting, at least annually, a review of the effectiveness of its governance framework including the system of internal control. The review of effectiveness of the framework is informed by the work of the Corporate Management Team who have responsibility for the development and maintenance of the governance environment, the Chief Auditor’s annual report, and reports from the external auditors and other review agencies and inspectorates. The effectiveness of the governance framework is reviewed annually by the Corporate Management Team, including the use of an annually updated self-assessment tool covering six key areas of governance (including the impact on governance of the coronavirus pandemic), as follows: • Business Planning and Performance Management • Internal Control Environment • Budgeting, Accounting and Financial Control • Risk Management and Business Continuity • Conflicts of Interest, Whistleblowing and Gifts and Hospitality • Impact of coronavirus (COVID-19). This self-assessment indicated the governance framework is being complied with in all material respects. In addition, the review of the effectiveness of the governance arrangements and the systems of internal control
Page 6
within the group entities places reliance upon the individual bodies’ management assurances in relation to the soundness of their systems of internal control. The Council has a well embedded approach to continuous improvement through self-assessment. Registered services within education, social care and housing undertake regular self-assessment as part of the delivery of their services, including aspects such as multi agency file reading and practice and improvement groups in place. Staff from across services are also invited to participate in improvement sessions linked to the service improvement plans on an annual basis, or in relation to specific exercises such as the “Our Values” staff engagement process in 2019. The Council previously utilised the Public Services Improvement Framework and is considering options for a future self -assessment activity. The Council continues to recognise the need to exercise strong financial management arrangements to manage the financial pressures common to all local authorities, and has robust financial control and financial planning processes in place. The CIPFA Financial Management (FM) Code was adopted in June 2021 and work is underway to disseminate the results and establish an action plan to address any required improvements. Throughout this year, there continued to be unprecedented challenges facing the Council in responding to the ongoing COVID-19 pandemic which significantly altered the way in which the organisation operates and significantly changed the delivery of services. Reduced capacity and competing priorities as well as an upturn in demand in some areas due to the easing of restrictions continue to be actively managed on a daily basis. The following should be specifically noted: • emergency governance arrangements remained in operation throughout 2021/22 and amended regularly to take account of the prevailing COVID-19 regulations. These amendments were approved by Council. A protocol was established during the year to facilitate the conduct of hybrid meetings which were broadcast live with the option available to the Convenor of each Board to hold the meeting remotely by teams if they wish and this protocol continues to be in operation; • the Council are progressing with their economic and social renewal and recovery plans in recent months, along with partners in response to the COVID-19 pandemic over the short to medium term. The Corporate Management Team continue to have a specific focus on recovery from the COVID-19 pandemic; • regular performance reports have been prepared for policy boards throughout the period of the pandemic in the form of service update reports. Each service has developed a Service Delivery Plan for 2021/22 in place of the usual service improvement plans, in order to focus on activities linked to recovery over this year in particular. Services are currently preparing 3 year Service Improvement Plans for approval by policy boards prior to Summer 2022; • tranche 2 of the Right for Renfrewshire programme was commenced over the second half of 2021. This was on a smaller scale than originally planned and the service redesigns progressed were in those areas where it was anticipated that there would be potentially less direct impact from the pandemic recovery process and where the greatest opportunity exists for appropriate management and service capacity to be directed towards the Right for Renfrewshire agenda; • financial management across the Council has remained strong, with continued additional reporting in place to clearly distinguish COVID-19 related costs and income losses from core operating costs. Over the course of the year significant amounts of additional non-recurring income has been secured from the Scottish Government in order to ensure local government continues to provide support to local communities and businesses. Funding has been provided both to support Council expenditure, but also on an “agency” basis whereby the Council administers grant schemes designed by the Scottish Government. Ensuring compliance with the various grant conditions has entailed considerable work by Council officers throughout 2021/22. Any potential fraudulent grant applications were referred to the Council’s Corporate Fraud Team for investigation and referral on to the Procurator Fiscal or Police, as appropriate; • all essential services have continued to be delivered throughout the pandemic and business continuity arrangements are in place and operating highly effectively. Some areas of service activity were stopped or deferred; others were delivered through different processes. There have been no significant changes to internal controls although significant numbers of new and amended processes
Page 7
and services have been put in place to allow the Council to appropriately respond to the impact of the pandemic and to support local communities and businesses. The Council has now developed service recovery programmes to reopen services and catch up on deferred work, moving towards more normal levels of service activity and service priority. This is a process and programme of work that is likely to continue into 2022/23 and beyond; • although the Council’s cyber security arrangements are considered to be robust and are regularly tested, recognition of the ever increasing criminal cyber activity and the recognition that cyber- attacks are becoming more and more frequent and sophisticated and that there is an increased reliance on electronic systems resulted in a focused review of the Council’s cyber environment being undertaken. This led to the decision that the cyber -related elements within the Organisation Resilience risk would benefit from being a separate corporate risk for a period of time, with the further scrutiny that this affords; • the Council commenced planning for Brexit during 2019/20 and identified risks have been incorporated into the Strategic and Corporate Risk Registers. A number of significant areas of risk remain for the organisation and for communities that have been deferred due to a combination of COVID-19 impacts, particularly in relation to employment constraints related to closure of hospitality and retail establishments masking the impact of the end of freedom of movement and the deferral of the introduction of required import checks and restrictions which when introduced will lead to increased restrictions, delays and cost increases on products and services from the European Union and a significant and ongoing regulatory burden for Environmental Health Officers and Trading Standards Officers. Some of these risks will be further exacerbated by the ongoing conflict in Ukraine and the associated sanctions on Russia which will place additional cost and supply pressures on some products and materials that are likely to increase and continue into 2022/23. Regular reviews of the Council’s arrangements are undertaken by internal audit and overall, the Council’s internal financial control arrangements are considered to be sound. As part of the ongoing relationship which is in place under the new best value methodology, Audit Scotland continuously engage with the Council in relation to the improvement plan, regularly attending Council and board meetings and reviewing information provided. Each year Audit Scotland provide an assessment of the ongoing position in relation to best value, within the Annual Audit Report. The Annual Audit Report for 2020/21 was published in November 2021 noted that the Council continues to make positive progress addressing the recommendations contained in our 2016/17 Best Value Assurance Report. Audit Scotland provided an unqualified and unmodified audit opinion on the 2020/21 annual accounts. The programme of work undertaken by internal audit identified 2 occasions where a limited assurance level was given in relation to the internal control, risk management and governance objectives for the specific areas of each audit review. The following areas are those identified as requiring improvement: • A review of the procedures in place for identifying and dealing with unsafe memorials in cemeteries was undertaken and it was identified that insufficient progress had been made in this area due to capacity issues, mainly as a result of the service having other priorities arising from the pandemic. Management agreed to allocate additional resource to this area and progress will be monitored through the internal audit follow-up process. Although this area requires to be addressed there is no significant impact on the Council’s overall system of internal control. • The operation of Purchase Cards was reviewed to ensure that the correct procedures were being followed during the pandemic and whilst there were adequate procedures in place covering the purchase of goods with Purchase Cards, issues were identified regarding compliance and the timeliness of approval of transactions. Management agreed to implement the improvement actions required and progress will be monitored through the internal audit follow-up process. Internal audit undertakes an annual exercise to ensure that recommendations arising from internal audit engagements have been implemented by service management and the results are reported to the Audit, Risk and Scrutiny Board (ARSB). This work highlighted that 82% of recommendations were implemented by the due
Page 8
date. 17% had passed their original due date and revised implementation dates have now been set and 1% were superseded. Of the 21 recommendations followed up that were deemed to be critical, 18 have been fully implemented and 3 have been partially implemented. Revised implementation dates have been agreed for each of these recommendations. It is our view that the Council has in place a sound system of governance, risk management and internal control and that appropriate mechanisms are in place to identify any areas of weakness. This is corroborated by an Annual Assurance Statement prepared by the Council’s Chief Auditor stating that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s governance, risk management and internal control framework. Action Plan Following consideration of the review of adequacy and effectiveness the following action plan has been agreed to ensure continual improvement of the Council’s governance. Agreed action Responsible person Date Prepare 3-year Improvement Plans for each service Service Director August 2022 Review and refresh quarterly scorecard of performance information Head of Policy and Commissioning September 2022 Establish an action plan arising from the CIPFA FM Code Head of Finance and Business Services 31 December 2022 The agreed actions will be subject to review to identify the progress being made in implementing these actions. Update on the 2020/21 Action Plan The 2020/21 Governance Statement identified areas of continuous improvement activities to be taken forward to improve the overall governance, risk management and internal control environment. Progress over the last 12 months against the agreed action plan is detailed below. Agreed action Progress Update Responsible person Date Revised Date Ongoing Actions Review and update where necessary the policy for expressing concerns outwith line management ‘whistleblowing’ for approval by Board. The update was delayed due to other priorities, but the policy is now in its final draft and has been submitted for consultation to senior management and other appropriate parties, prior to being submitted to Board for approval Chief Auditor September 2021 August 2022 Review and refresh the Council Plan. The work on the new Council Plan has commenced Head of Policy and Commissioning September 2022 N/A Assurance Subject to the above, and on the basis of the assurances provided, we consider the governance and internal control environment operating during 2021/22 provides reasonable and objective assurance that any significant risks impacting on the achievement of our principal objectives will be identified and actions taken to avoid or mitigate their impact. Systems are in place to continually review and improve the governance and internal control environment and action plans are in place to address identified areas for improvement.
Page 9
No embedded text on this page.