Agenda Document Pack - Risk and Audit Scrutiny Committee - 09/12/2025
South Lanarkshire Council · 9 December 2025
Back to Risk and Audit Scrutiny Committee — 9 December 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Council Offices, Almada Street Hamilton, ML3 0AA Monday, 01 December 2025 Dear Councillor Risk and Audit Scrutiny Committee The Members listed below are requested to attend a meeting of the Committee to be held as follows:- Date: Tuesday, 09 December 2025 Time: 10:00 Venue: Hybrid - Committee Room 1, Council Offices, Almada Street, Hamilton, ML3 0AA The business to be considered at the meeting is listed overleaf. Yours sincerely Paul Manning Chief Executive Members Elaine McDougall (Chair), Mary Donnelly (Depute Chair), Mathew Buchanan, Colin Dewar, Alistair Fulton, Ross Gowland, Celine Handibode, Susan Kerr, Richard Lockhart Substitutes Monique Equi, Gavin Keatt, Julia Marrs, Helen Toner 1
Page 2
BUSINESS 1 Declaration of Interests 2 Minutes of Previous Meeting Minutes of the meeting of the Risk and Audit Scrutiny Committee held on 30 September 2025 submitted for approval as a correct record. (Copy attached) 3 - 14 Item(s) for Decision 3 Internal Audit Activity Report Report dated 14 November 2025 by the Executive Director (Finance and Corporate Resources). (Copy attached) 15 - 36 Item(s) for Noting 4 Accounts Commission 2025 – Scrutiny, Governance and Transparency of Decision Making of Exit Packages of Senior Officers Report dated 3 November 2025 by the Executive Director (Finance and Corporate Resources). (Copy attached) 37 - 42 5 Fraud Statistics Six Monthly Update 2025/2026 Report dated 14 November 2025 by the Executive Director (Finance and Corporate Resources). (Copy attached) 43 - 50 6 Performance and Review Scrutiny Forum Annual Update Report dated 25 November 2025 by the Chief Executive. (Copy attached) 51 - 54 7 Forward Programme for Future Meetings Report dated 19 November 2025 by the Executive Director (Finance and Corporate Resources). (Copy attached) 55 - 58 Urgent Business 8 Urgent Business Any other items of business which the Chair decides are urgent. Clerk Name: Ishara Opatha Clerk Telephone: 07385370069 Clerk Email: ishara.opatha@southlanarkshire.gov.uk 2
Page 3
RISK AND AUDIT SCRUTINY COMMITTEE Minutes of meeting held via Confero and in Committee Room 1, Council Offices, Almada Street, Hamilton on 30 September 2025 Chair: Councillor Elaine McDougall Councillors Present: Councillor Mathew Buchanan, Councillor Colin Dewar, Councillor Mary Donnelly (Depute), Councillor Ross Gowland, Councillor Susan Kerr, Councillor Richard Lockhart, Councillor Helen Toner (substitute for Councillor Alistair Fulton) Councillors' Apologies: Councillor Alistair Fulton, Councillor Celine Handibode Councillor Also Present: Councillor Gerry Convery (for items 3 and 4) Attending: Chief Executive’s Service P Manning, Chief Executive (for items 3 and 4) Finance and Corporate Resources J Taylor, Executive Director; Y Douglas, Internal Audit Manager; S Dunsmore, Insurance and Risk Management Adviser; E-A McGonigle, Administration Adviser; A Norris, Administration Assistant; L O’Hagan, Head of Finance (Strategy); I Opatha, Administration Officer; I Strachan, Head of Administration and Legal Services Also Attending: Audit Scotland A Barclay, J Boyd, and M Ferris, External Auditors Order of Business The Committee decided: that the items of business be dealt with in the order minuted below. 1 Declaration of Interests No interests were declared. 2 Minutes of Previous Meeting The minutes of the meeting of the Risk and Audit Scrutiny Committee held on 25 June 2025 were submitted for approval as a correct record. The Committee decided: that the minutes be approved as a correct record. 2 3
Page 4
3a External Auditors’ Annual Report 2024/2025 The following documents were submitted by Audit Scotland, the Council’s external auditors:- letter and appendices relating to the 2024/2025 Annual Audit report on South Lanarkshire Council 2024/2025 South Lanarkshire Council proposed Annual Audit report to members of the Council and the Controller of Audit The Audit Director, Audit Scotland, spoke on the Annual Audit report and highlighted the following:- the audit of the 2024/2025 Annual Accounts financial management financial sustainability best value vision, leadership and governance use of resources to improve outcomes:- key messages significant findings and key audit matters:- implementation of IFRS 16 (Leases) disclosures prior year restatement relating to South Lanarkshire Leisure and Culture (SLLC) Limited pension asset significant risks of material misstatement in the annual accounts identified during planning of the audit:- risk of material misstatement due to fraud caused by management override of controls valuation of property, plant and equipment estimation of the pension liability 2024/2025 action plan on recommendations for improvement summary of corrected misstatements The external auditors’ opinion on the Council’s Annual Accounts 2024/2025 and the charities administered by the Council was unmodified, that is, the financial statements and related reports were free from material misstatement. Due to the interaction of section 106 of the Local Government in Scotland Act 1973 with the charity’s legislation, a separate independent auditor’s report was required for the statement of accounts of each registered charity where members of the Council were sole trustees, and this was irrespective of the size of the charity. Officers responded to members’ questions in relation to:- the year-end timetable and the importance of ensuring working papers for the External Audit were provided to the Finance Strategy team in line with deadlines the high-level review of Oracle Fusion implementation, which had identified that clear supporting documentation had not been available due to the Council’s retention policy the post-implementation and benefits realisation review of the new Oracle platform, and assurance that the Committee would be updated as appropriate training and development of members to ensure the Committee was effective in its role The Audit Director, Audit Scotland, undertook to arrange a session with members to conduct an annual review and self-assessment. The Audit Director also commended the Finance (Strategy) team for delivering the statutory audit on time, particularly with the challenges faced with the implementation of Oracle Fusion. 4
Page 5
The Depute Leader thanked the External Auditors for the report and extended thanks to the Executive Director (Finance and Corporate Resources), the Head of Finance (Strategy) and the wider team for the comprehensive work that had been undertaken to prepare the annual accounts. The Chair, on behalf of the Committee, echoed those remarks. The Committee decided: that the report be noted. 3b Transformation: How Councils are Redesigning and Delivering More Efficient Services to Achieve Planned Outcomes - Best Value Thematic Work in South Lanarkshire Council 2024/2025 A report dated September 2025 by Audit Scotland, the Council’s external auditors, was submitted entitled ‘Transformation: How Councils are Redesigning and Delivering More Efficient Services to Achieve Planned Outcomes - Best Value Thematic Work in South Lanarkshire Council 2024/2025’. The report set out how the Council was responding to transformation challenges through redesigning and delivering more efficient services to achieve planned outcomes. The Accounts Commission’s Strategy (2021 to 2026) had set out its priorities to focus on inequalities, funding, communities and recovery. The Code of Audit Practice had set out the Best Value work required to report on those priorities. The Audit Director, Audit Scotland, highlighted the following sections of the report:- key messages transformation planning programme management partnership working and community engagement impact of transformation The report detailed the following audit recommendations:- the Council should ensure its plans for transformation were sufficiently ambitious to ensure that it could continue to deliver sustainable services, prioritising transformational activities that would deliver the most impact and contribute towards reducing its budget gap the Council should assess whether its arrangements for resourcing transformation activities were sufficient to drive the scale and pace of change required in future the Council should ensure it demonstrated how engagement with communities, including vulnerable groups, had informed planned changes to services the Council should prioritise establishing a framework that identified and monitored the estimated and realised impact to date of its transformation work, including on service delivery and on outcomes for service users. It should report to the Corporate Management Team (CMT) and elected members on both the financial and non-financial impact of the full range of its transformational activities An improvement action plan, attached as Appendix 1 to the report, set out those audit recommendations and the Council’s planned response, which included responsible officers and dates for implementation. The Executive Director (Finance and Corporate Resources) responded to a member’s question in relation to actions being reported back to the Committee. The Committee decided: that the report be noted. 5
Page 6
3c External Auditors’ Annual Report 2024/2025: South Lanarkshire Council Charitable Trusts Summary letters, proposed independent auditor’s reports and letters of representation (ISA 580) were submitted by Audit Scotland, the Council’s external auditors for South Lanarkshire Council Charitable Trusts. The Audit Manager, Audit Scotland advised that there were no unadjusted misstatements to be corrected for the Charitable Trusts administered by the Council. The Committee decided: that the report be noted. 4 Audited Annual Accounts 2024/2025 A report dated 19 September 2025 by the Executive Director (Finance and Corporate Resources) was submitted on the:- Council’s Certified Annual Accounts and Charitable Trusts’ Accounts for 2024/2025, which had received a clean audit certificate from the Council’s external auditors, Audit Scotland requirement to approve the Annual Accounts 2024/2025 for signature in terms of both the Council’s accounts and related charitable trusts The accounts covered the Council as well as 2 Charitable Trusts managed by the Council, namely South Lanarkshire Council Educational Trust and South Lanarkshire Council Charitable Trust. A clean audit certificate had been received for each, with no qualifications on the Council’s accounts. An agreed action plan had been included in the external auditor’s report, and officers would work to ensure those were implemented in 2024/2025. The Annual Accounts would be advertised as being available for public inspection on the Council’s website and on request from Finance Services. The Chair, on behalf of the Committee, thanked the Head of Finance (Strategy) and team for their extensive work involved in preparing the Annual Accounts. The Committee decided: (1) that it be noted that the South Lanarkshire Council Annual Accounts 2024/2025 and the Charitable Trusts’ Accounts had each received a clean audit certificate from the Council’s external auditors, Audit Scotland; (2) that the audited South Lanarkshire Council Accounts 2024/2025 and the Charitable Trusts’ Accounts be approved for signature; (3) that it be noted that the external auditor’s report would be referred to a future meeting of South Lanarkshire Council for information; and (4) that it be noted that, as detailed in section 3.6 of the report, the Audited Accounts 2024/2025 would be available on the Council’s website. [Reference: Minutes of 25 June 2024 (Paragraph 5)] 5 Internal Audit Activity as at 31 August 2025 A report dated 5 September 2025 by the Executive Director (Finance and Corporate Resources) was submitted on work completed by Internal Audit during the period 1 June to 31 August 2025. 6
Page 7
Findings from internal audit assignments were reported to this Committee throughout the year, and the last progress report was considered by the Committee on 25 June 2025. Information was provided for the Internal Audit work completed during the period from 1 June to 31 August 2025. As at 31 August 2025, good progress had been made with 74% of the 2025/2026 Audit Plan in progress and 14% of assignments completed to the final report stage. Targets for the remainder of the year were outlined to ensure delivery of the Plan by May 2026. Key performance indicators for the period, including 5 indicators assessed as amber with planned corrective actions, were detailed in Appendix 1 to the report. A summary of the audit output for each assignment was detailed in Appendix 2. Updates were also provided on:- audit plan progress, as detailed in section 4 of the report. All assignments from 1 April 2025 would be conducted in conformance with the Global Internal Audit Standards (GIAS). Three assignments from 2024/2025 and 7 assignments from 2025/2026 were completed or closed in the period to 31 August 2025, and those were detailed in paragraph 4.2 of the report all of those assignments, except Self-Directed Support, which would be progressed to a final report. It was proposed that the planned assignment reviewing Self-Directed Support arrangements would be deferred to 2026/2027 to align with the implementation of the new Social Work Resources’ IT system (Liquid Logic), as detailed in paragraph 4.3 of the report. The allocated days for this assignment would be used for a substitute audit to review direct payment arrangements within Social Work Resources, providing a fuller assessment of risks and controls a summary of the audit output for each assignment, which was detailed in Appendix 2 to the report. Further information in relation to the one, more significant assignment, the Economic Crime and Corporate Transparency Act 2023, was set out at Appendix 3 to the report, and the key points were detailed in paragraph 4.4 of the report. The introduction of a new offence of ‘failure to prevent fraud’ was in place from 1 September 2025, which would hold large organisations, including the Council, to account if they profited from fraud 8 assignments which were finalised in the same period for external clients, with output reported to their respective audit committees and Boards the Council’s response to the Accounts Commission Consultation on priorities and work programme, as detailed in Appendix 4 to the report key findings and recommendations, as detailed in section 5 of the report emerging risks and issues, as detailed in section 6 of the report a compliance and standards update, as detailed in section 7 of the report governance and Committee engagement, as detailed in section 8 of the report The Committee decided: (1) that progress with delivery of the 2025/2026 Internal Audit Plan be noted; (2) that performance in the period to 31 August 2025, as detailed in Appendix 1, be noted; (3) that the proposed amendment to the Audit Plan, as set out in paragraph 4.3, be approved; (4) that audit output from assignments completed in the period, as detailed in appendices 2 and 3, be noted; and (5) that the responses to the Accounts Commission Consultation, as detailed in Appendix 4, be noted. 7
Page 8
The Internal Audit Manager responded to a member’s question in relation to the percentage of assignments for which final reports had been issued. The Chair thanked the Internal Audit team for the comprehensive report. [Reference: Minutes of 25 June 2025 (Paragraph 3)] 6 Annual Update on the Use of Surveillance Powers - The Regulation of Investigatory Powers (Scotland) Act 2000 (RIPSA) A report dated 6 August 2025 by the Executive Director (Finance and Corporate Resources) was submitted, providing an updated version of the Council’s Regulation of Investigatory Powers (Scotland) Act 2000 (RIPSA) Policy and providing an overview and update on the use of directed surveillance powers by the Council. The use of surveillance to provide information was a potentially valuable resource for the protection of the public and the maintenance of law and order. To ensure that local authorities and law enforcement agencies were able to discharge their responsibilities, use was made of unaided surveillance and surveillance devices. RIPSA provided a legal framework for the use, deployment, duration and effectiveness of covert surveillance and the use of covert human intelligence sources. The Council must comply with RIPSA and adhere to the authorisation procedures specified in the Council’s RIPSA Policy and related procedures. The Investigatory Powers Commissioner's Office (IPCO) provided independent oversight of the use of the powers contained within RIPSA. This oversight included inspections by IPCO inspectors on a regular basis, approximately every 3 years, with the Council’s next inspection expected in 2026. The Council’s RIPSA Policy and its procedures applied where ‘Directed Surveillance’ was being planned or carried out. Directed Surveillance could only be conducted to achieve one or more of the permitted RIPSA purposes, namely:- preventing or detecting crime or the prevention of disorder in the interests of public safety protecting public health Directed surveillance was covert and was undertaken for the purpose of a specific investigation to obtain private information. The Council’s RIPSA Policy comprised a Protocol for Covert Directed Surveillance and a Protocol for Using Covert Human Intelligence Source. Those were last reviewed in May 2023 and November 2016, respectively and had been the subject of a fresh review. A few minor updates had been made to reflect changes in Council structure and aligned the 2 Protocols, as detailed in appendices 1 and 2 of the report. Those changes had been made by officers under delegated authority in terms of the Scheme of Delegation due to the minor nature of the changes. Going forward, those Protocols would be the subject of an annual review, the outcome of which would be reported to the Committee in line with the IPCO’s recommended practice. The Committee decided: (1) that the contents of this report be noted; 8
Page 9
(2) that the updated Council’s Regulation of Investigatory Powers (Scotland) Act 2000 (RIPSA) Policy, being the Protocol for Direct Covert Surveillance and the Protocol for using Covert Human Intelligence Source, included in appendices 1 and 2 to the report, be noted; and (3) that it be noted that the Council’s use of surveillance powers under RIPSA would be reported annually to the Committee going forward. 7 Financial Resilience and Sustainability A report dated 10 September 2025 by the Executive Director (Finance and Corporate Resources) was submitted, providing an update on:- the Council’s financial outlook, financial resilience and sustainability how risks posed by the financial challenges would be responded to A report had been presented to the Executive Committee on 25 June 2025, which detailed the 2026/2027 to 2027/2028 Revenue Budget Strategy. The report highlighted that the Council faced a Budget Gap of £24.273 million over the next 2 years, with potential further risks if pay awards exceeded assumptions, potentially increasing the gap to over £42 million. The report also noted that Transformational Reviews and options to increase Council Tax could help address the gap. The report acknowledged the importance of financial resilience in light of those challenges. Financial resilience was defined as more than reliance on usable reserves, and included understanding exposure to loss of income, expenditure commitments, and flexibility to access funds in a time of crisis. The Revenue Budget Strategy report to the Executive Committee on 25 June 2025 had detailed that a further report would be presented to the Risk and Audit Scrutiny Committee, which would provide more information on the Council’s resilience. Detailed information was provided on:- the financial position and plan for 2026/2027 to 2027/2028, as detailed in section 4 of the report financial resilience and a summary of the Financial Resilience Framework, as detailed in section 5 and Appendix 1 to the report The Committee decided: (1) that the Financial Position and Plan for 2026/2027 to 2027/2028, as detailed in section 4 of the report, be noted; and (2) that the Financial Resilience Framework, as detailed in section 5 and Appendix 1 of the report, be noted. [Reference: Minutes of the Executive Committee of 25 June 2025 (Paragraph 8) and Minutes of 24 September 2024 (Paragraph 6)] 8 Audit Scotland – Local Government Budgets 2025/2026 A report dated 7 August 2025 by the Executive Director (Finance and Corporate Resources) was submitted on the information contained within Audit Scotland's ‘Local Government Budgets Briefing 2025/2026’. 9
Page 10
In May 2025, Audit Scotland published a report entitled ‘Local Government Budgets 2025/2026’ on behalf of the Accounts Commission. The Audit Scotland report was part of a series of outputs produced by the Accounts Commission that provided an independent overview of the local government sector. Detailed information was provided on:- the introduction and key messages from the Audit Scotland report, as detailed in section 4 of the report funding, budgeting and communities, as detailed in section 5 of the report the Council’s position in relation to the key messages in the Audit Scotland report, as detailed in section 6 of the report The Committee decided: (1) that the key messages and data from the Audit Scotland ‘Local Government Budgets 2025/2026’ report, as detailed in sections 4 and 5 of the report, be noted; and (2) that the commentary on the Council’s position, as detailed in section 6 of the report, be noted. 9 Fraud Statistics Annual Report 2024/2025 A report dated 28 August 2025 by the Executive Director (Finance and Corporate Resources) was submitted, providing:- a summary of the fraud statistics and workload for the year to 31 March 2025 and a comparison to the same period in 2024 an update on other anti-fraud activity a comparison of current fraud arrangements to best practice The number, types, outcomes and costs of fraud investigations, together with performance measures for the year to 31 March 2025, were detailed in the report. A comparison to the statistics for the same period in the previous year was also provided. Those statistics highlighted that:- 30 fraud investigations, with a total value of £9,000, had been reported in the period, representing a decrease in both number and value from the previous year 177 cases were closed in the period, of which:- 14 were founded 1 had insufficient information 44 were unfounded 118 had no housing benefit in the claim of the 14 founded allegations, 13 were external and one was benefits-related Information on the wider fraud workload was provided in paragraphs 4.7 to 4.11 of the report. Outcomes for concluded investigations had been reported to this Committee as part of Internal Audit’s Annual Assurance report or captured in the National Fraud Initiative (NFI) exercise in 2022. Details on the following were provided in sections 5 to 8 of the report, respectively:- the NFI 2024 exercise the ‘Three Lines of Defence’ – Fraud Risk Analysis 10
Page 11
a comparison of fraud risk arrangements to best practice the Serious and Organised Crime (SOC) Group The Committee decided: that the contents of the report be noted. [Reference: Minutes of 24 September 2025 (Paragraph 8) and Minutes of 25 June 2025 (Paragraph 3)] 10 Year-End Insured Risk Report 2024/2025 A report dated 5 September 2025 by the Executive Director (Finance and Corporate Resources) was submitted on the Council’s insurance claims for the year to 31 March 2025 for the following main classes of insurance:- combined liability (covering both public liability and employer’s liability) motor insurance property insurance and other miscellaneous risks Appendix 1 to the report provided annual comparisons of the numbers and values of claims by Resources for the years 2020/2021 to 2024/2025. Claims costs had fluctuated over the last 5 years. On average, over that period, the self-insured cost of claims per annum was £2.882 million, however, the costs for 2024/2025 were above average at £4.137 million. The figures for 2024/2025 had been impacted by Storm Eowyn, with the self-insured estimated cost of that event included within the total. Inflation, increased costs of materials, vehicle parts and repair charges had also impacted claim values. Appendix 2 to the report compared claim numbers and costs for 2024/2025, at 31 March 2025, with the equivalent position for 2023/2024. This showed a reduction of 40 claims (4.5%) on the numbers reported in 2023/2024, with a total of 846 claims intimated. The cost of claims increased from £3.548 million in 2023/2024 to £4.137 million in 2024/2025. This represented an increase of £0.589 million (16.6%), which was a result of the estimated cost of property and motor claims increasing, with the position being offset slightly by reduced estimated costs for liability claims. Appendix 3 to the report provided a further breakdown of public liability claims and costs specifically for Roads and other services within Community and Enterprise Resources. Information was also provided in sections 6 to 9 of the report on:- liability claim motor claims property claims insurance hotspots and the progress made over the last year to mitigate risks The Committee decided: that the Insured Risks Report for the year ended 31 March 2025 be noted. [Reference: Minutes of 24 September 2024 (Paragraph 9)] 11
Page 12
11 Year End Risk Management Report (2024/2025) and Review of Council’s Top Risks (2025/2026) A report dated 5 September 2025 by the Executive Director (Finance and Corporate Resources) was submitted providing an update on:- progress with risk management activity undertaken during 2024/2025 the Council’s top risk register following the review and consultation process Annual reviews of the Council’s top risks were undertaken, with the findings of the last review reported to the Committee on 24 September 2024. This year’s full review commenced in April 2025, and the consultation had sought views from Heads of Service, elected members and trade unions on new areas of risk. Risk Sponsors were required on an annual basis to assess their Resources’ compliance with the Risk Management Strategy and provide supporting evidence. The information for 2024/2025 was summarised in the end-of-year compliance statement, which was detailed in Appendix 1 to the report. Resources continued to demonstrate full compliance with the Strategy, having scored 45 out of 45. The progress made in delivering actions to control the Council’s top risks was detailed in section 5 of the report. As at 31 March 2025, the percentage of actions completed on the 2024/2025 risk control plan was 73.4% against an overall target of 90%. Actions that were on hold or experienced slippage, in relation to Community Planning and IT forecasting, had been carried forward to the 2025/2026 risk control plan. The annual review, in line with previous years, did not result in wholesale changes to the top risk register. The risks from the previous year’s review, as detailed in the report to the Committee on 24 September 2024, were still deemed to be valid. The results of the review of the Council’s top risks 2025/2026 were detailed in section 6 of the report. The main changes from the previous year were:- 2 risks had been removed from the top risk register:- the Council was materially affected by the implications arising from the National Care Service (NCS) Bill the Council inherited commercially unviable shopping centres due to the financial failure of existing owner/management companies, resulting in significant financial and operational liabilities transferring to the Council the following 2 risks had been consolidated, with the new wording, as detailed in Table 2 of the report, intended to cover all types of civil emergencies:- failure to fulfil emergency response commitments befitting the Council’s status as a Category One (emergency) responder the Council did not have the appropriate emergency/business continuity plans, contingency arrangements, or partnerships in place to respond to/or recover from a pandemic/endemic event some changes to residual risk scores, as detailed in Table 3 of the report some key risk wordings had been updated to reflect the current status of risks and/or to provide more straightforward and understandable risk descriptions As part of the review of the Risk Management Strategy, risk categories had been realigned, and some scores had been revised. This had resulted in the previously high categorised risks now being categorised as medium-level risks and no longer featured as part of the Council’s top risks, as detailed in paragraph 6.3 of the report. 12
Page 13
The Council’s top risk register was monitored on an ongoing basis and updates were reported annually to this Committee. Risk scores and rankings would be amended if new information came to light that allowed the position to be reassessed. The top Risk Register for 2025/2026 was attached as Appendix 2 to the report. Details were provided in section 7 of the report on a benchmarking exercise that had been conducted to review risks faced by a sample of other Scottish local authorities. This review established that the current South Lanarkshire Council top risk register was, in the main, reflective of the risks faced by those other authorities. Horizon scanning was used to identify several areas that could pose potential threats and risks or emerging issues and opportunities that could affect the Council. Areas identified, as detailed in section 8 of the report, included Transformational Change, the Terrorism (Protection of Premises) Act, the Care Reform (Scotland) Bill and Scotland Excel Supply Chain Intelligence Report. Those areas would continue to be monitored to ensure the Council was adequately prepared to respond, where required. Details were also provided in sections 9 and 10 of the report on the following areas:- the ‘Three Lines Model’ work was being undertaken by Internal Audit. This had now concluded and Resource Risk Sponsors have been provided with individual analysis and guidance to support in developing further controls and in closing gaps for the Council's top risks the scope and appetite for risk, which included the top risks heat map and the top risks profile The Insurance and Risk Management Adviser responded to a member’s question in relation to Employer National Insurance Contributions (ENICs). The Committee decided: (1) that Resource compliance with the requirements of the Risk Management Strategy be noted; (2) that the progress being made in delivering actions to mitigate top Council risks be noted; and (3) that the updated Council’s top risks, as detailed in Appendix 2 of the report, be noted. [Reference: Minutes of 24 September 2024 (Paragraph 10)] 12 Forward Programme for Future Meetings A report dated 20 August 2025 by the Executive Director (Finance and Corporate Resources) was submitted on the outline forward programme for the meetings of the Risk and Audit Scrutiny Committee to 29 September 2026. As part of future arrangements, members were invited to suggest topics for inclusion in the Committee’s forward programme. The Committee decided: that the outline forward programme for the meetings of the Risk and Audit Scrutiny Committee to 29 September 2026 be noted. [Reference: Minutes 25 June 2025 (Paragraph 8)] 13
Page 14
13 Urgent Business There were no items of urgent business. 14
Page 15
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 9 December 2025 Report by: Executive Director (Finance and Corporate Resources) Subject: Internal Audit Activity Report 1. Purpose of Report 1.1. The purpose of the report is to:- update the Committee on the progress, performance and output from the Internal Audit service in the period 1 September to 14 November 2025 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- (1) that progress with delivering the 2025/2026 Internal Audit Plan be noted; (2) that performance in the period to 31 October 2025, detailed in Appendix 1, be noted; (3) that output from internal audit assignments completed in the period 1 September to 14 November 2025, as summarised in Appendix 2, be noted; (4) that the proposed amendments to the Audit Plan, as set out at paragraph 4.7, be approved; (5) that the outline Audit Strategy and draft Data Strategy set out in appendices 3 and 4, be noted; and (6) that the assessed level of compliance with the Global Internal Audit Standards, as set out in Appendix 5, be noted. 3. Executive Summary 3.1. The Internal Audit Plan for 2025/2026 was approved by the Risk and Audit Scrutiny Committee (RASC) in February 2025. A copy of this plan can be found here. Good progress has been made with 86% of the Plan started by mid-November 2025. A draft report has been issued for 29%1 of assignments in the Plan. This represents reasonable progress at this point in the year. The following targets have been set to progress the Plan to ‘draft report’ stage for the remainder of the year:- RASC meeting Assignments to Draft Report Stage March 2026 68% (target of 59% reported to RASC, 30 September 2025) May 2026 100%2 (target of 100% reported to RASC, 30 September 2025) 1 Target of 29% reported to RASC, 30 September 2025 2 This pattern of delivery reflects that the nature of some audit assignments is such that they are delivered across the financial year and cannot be closed until the end of this period. 3 15
Page 16
3.2. There are no significant concerns at this point in the year around the overall deliverability of the Plan, but there remains a significant risk around unforeseen service demands and, potentially, wider, inherent risks around responding timeously to team up-skilling requirements, particularly around the development of digital skills. These risks are mitigated by the inclusion of contingency time within the annual plan, a focus on coaching and training and setting realistic expectations around the extent to which data analytics can begin to be incorporated more widely within audit assignments. 3.3. The risk of significant, subsequent amendments to the Plan, arising from a change in the Council’s priorities or risks, is managed by a regular re-assessment of capacity and the content of the Audit Plan to allow incremental adjustments and reporting to the RASC as the year progresses. 3.4. Having provided the mandate for an internal audit service to be delivered within South Lanarkshire Council (which includes the authority, role and responsibilities under which Internal Audit operates), the Committee should satisfy itself that the function is fulfilling its mandate. One element of this is to review how the Service has performed in the period under review. 3.5. Performance indicators for the period to 31 October 2025 are set out in Appendix 1 alongside targets and an overall assessment as to whether it is anticipated that these will be met by 31 March 2026. All indicators have been included for completeness, but some are not reported until the end of the financial year. The table notes how these are being progressed, in the interim, to provide assurance that all aspects of performance are being managed. 3.6. There are currently 4 indicators assessed as amber. A list of these indicators and planned corrective action is as follows:- Indicator Corrective Action Number of processes where we use continuous control monitoring. To be developed as part of the Fusion programme of testing through to 31 March 2026. It is anticipated that the target will be met. Number of training days per Employee. Formal programme in place through to 31 March 2026, that will meet the target in full. Plan completed to draft report stage by 30 April. Targets to complete set are out at 3.1. Arrangements in place to conclude the Plan by 30 April 2026. Internal Audit recommendations followed up. Programme of work scheduled for Quarter 4. Output will be reported in the Annual Assurance Report presented to RASC in June 2026. 3.7. Members are asked to note progress with delivering the approved Plan in the reporting period, and that overall performance against delivery targets is positive in the period to 31 October 2025. 16
Page 17
4. Audit Plan Output 4.1. The last progress report to the Committee was in September 2025 and reported on work completed in the period 1 June to 31 August 2025. This report covers all work completed in the period 1 September to 14 November 2025. 4.2. All assignments from 1 April 2025 will be conducted in conformance with the Global Internal Audit Standards (GIAS). Four assignments from 2025/2026 were completed in the period to 14 November 2025. These are as follows:- Audit Assignment Scope of Assignment Data Analytics To explore tools to analyse data that is gathered during an audit assignment and how this may be presented to Council Services in the form of management information. Pupil Equity Fund Risk Indicators Extract a range of data from the financial ledger relating to Pupil Equity Fund expenditure and present this in a format that allows further analysis by Education Resources using a range of defined risk indicators. Risk Register Review Analysis of controls using the Institute of Internal Auditors ‘three lines of defence’3 model. Audit Strategy Development of an audit strategy that complies with the requirements of GIAS. 4.3. A summary of the audit output for each of these assignments is detailed in Appendix 2. A copy of the outline Audit Strategy and draft Data Strategy is included in appendices 3 and 4. 4.4. The Audit Strategy seeks to provide a structured, forward-looking plan that assists with evidencing compliance with GIAS. It does this by setting out how the function adds value and optimises resources, by demonstrating a focus on continuous improvement and establishing an over-arching alignment of the Council’s governance expectations with its organisational goals. 4.5. The Data Strategy recognises that this is a new and emerging area setting out a series of objectives for Internal Audit to progress the embedding of automation and analysis of data throughout the audit process. This draft Strategy requires to be refined and, through time, aligned to the wider Council approach to the use of data as this develops and matures. 4.6. In addition to completing work across these 4 audit areas, 2 assignments were concluded for external clients along with mid-year reports that will be presented to the relevant external Committee or Board in November and December 2025. 4.7. GIAS requires reconsideration of the Plan as the year progresses to ensure that it continues to be risk-based and aligns with the organisation’s objectives. This review, undertaken most recently in October 2025, suggests that work in 3 separate areas should be deferred. The reasons for this and the proposed courses of action are set out in the table below:- 3 This model defines 3 separate groups as having separate roles and responsibilities for managing and overseeing risk and can be used to inform assurance mapping exercises. 17
Page 18
Assignment Audit Days Reason for Deferral Proposed Action Financial Sustainability 15 Included within the scope of the External Audit’s 2024/2025 work and reported to RASC in September 2025. Further audit work in this area would provide no added value. Days transferred to contingency. Housing System 20 Deferred to 2026/2027 to align with the implementation of HOME, the new Housing system. Days transferred to investigative assignments. Social Work System 20 Deferred to 2026/2027 to align with the implementation of Liquid Logic, the new Social Work system. Days transferred to contingency. 4.8. Members are asked to note the assignments completed and closed in the period and approve the proposal to defer three assignments and the respective, proposed courses of action. Members are also to note the outline Audit Strategy and draft Data Strategy as set out in appendices 3 and 4 and that a final Audit Strategy will be presented to the Committee in March 2026. 5. Key Findings and Recommendations 5.1. Across all the assignments concluded in the period, Council Resources have demonstrated a good level of engagement and, where required, an action plan has been developed and agreed to address areas for improvement. These actions have now been logged together with a ‘responsible owner’ and a due date. Verbal updates are obtained when the action falls due. This is classed as informal follow up and included within routine performance indicators reported to RASC. Separately, actions will be formally followed up to confirm that there is evidence of action being taken, and the findings of these reviews reported to RASC throughout the year. 5.2. Fifty internal audit actions fell due in the period to 31 October 2025. Most of the actions were in response to special investigation assignments. 90% have been verbally advised as implemented on time. 6. Emerging Risks and Issues 6.1. The annual process to review the Council’s top risks has concluded. These revised risks have been mapped to the approved 2025/2026 Internal Audit Plan, with 3 from 5 of the top risks (categorised as very high) within the scope of planned assignments in 2025/2026. A further 3 from eleven of the top risks (categorised as high) are within the scope of planned assignments in 2025/2026. 6.2. New and emerging risks will continue to develop as the year progresses and there will be periodic reassessments of the Plan to ensure that it continues to be risk- based and aligned to the organisation’s objectives. Any proposed amendments to the Plan will be presented to RASC for approval. 18
Page 19
7. Compliance and Standards Update 7.1. A report that set out the requirements and responsibilities of the new GIAS, which was effective from 1 April 2025, was presented to this Committee on 18 February 2025. A copy of this report can be found here. 7.2. As an audit committee, the RASC have a key role to play in ensuring that the internal audit function adheres to the Standards and fulfils its mandate effectively and efficiently. The role of audit committees is set out in some detail in Domain 3 “Governance of the Internal Audit function”. The RASC demonstrates support for the Service by engaging constructively with Internal Audit’s findings, conclusions and advice. 7.3. The Code of Practice for the Governance of Internal Audit in UK Local Government assists with the interpretation of the new GIAS. Specifically, in relation to these activity updates, the Committee should be satisfied that the content is such to allow them to effectively scrutinise and challenge. 7.4. A process to map current practice to all elements of the new GIAS is ongoing, and a summary assessment as at November 2025 is attached in Appendix 5. Progress in levels of compliance can be seen in the revised and extended suite of performance indicators. This, together with the development of a detailed Audit Strategy, addresses the 2 main gaps in compliance with GIAS. The outline Audit Strategy and Data Strategy will be developed further, and a final Audit Strategy presented alongside the proposed Audit Plan for 2026/2027 to this Committee in March 2026. 8. Governance and Committee Engagement 8.1. The Council’s Internal Audit Manager attends all meetings of the RASC. The authority of the internal audit function is established through its direct reporting relationship to the Council’s audit committee, which allows for unrestricted access. 8.2. Arrangements are in place to allow members of the RASC to meet privately with the Internal Audit Manager, as required by GIAS, in December 2025. This will provide an opportunity to offer feedback around the revised format of the activity report and to share suggestions for areas for inclusion in the 2026/2027 Internal Audit Plan. 8.3. Further one-to-one or group support will continue to be available to Members should this be required to allow Members to ensure appropriate scrutiny can be undertaken by them in their role. 9. Employee Implications 9.1. There have been no changes to the team in the period to 31 October 2025 and there are no vacancies within the Service. Training arrangements includes regular team briefs, internal training sessions, attendance at professional body conferences and external seminars and briefings. Further online resources are being secured to support the team throughout the year. 10. Financial Implications 10.1. The Internal Audit plan for the year aligns to the budget that has been set, and sufficient resources are in place to deliver the approved programme of audit assignments. 11. Climate Change, Sustainability and Environmental Implications 11.1. There are no implications for climate change, sustainability or the environment in terms of the information contained in this report. 19
Page 20
12. Other Implications 12.1. There are no other implications in terms of the information contained in this report. 13. Integrated Impact Assessment and Consultation Requirements 13.1. There is no requirement to impact assess the contents of this report. 13.2. Heads of Service are consulted on each and every audit assignment. Jackie Taylor Executive Director (Finance and Corporate Resources) 14 November 2025 Link(s) to Council Values/Priorities/Outcomes Accountable, effective, efficient and transparent Previous References Risk and Audit Scrutiny Committee-18 February 2025 (Internal Audit Plan Report 2025/2026) Risk and Audit Scrutiny Committee-18 February 2025 (Global Internal Audit Standards Report) Risk and Audit Scrutiny Committee-6 May 2025 (Internal Audit Activity Report) Risk and Audit Scrutiny Committee- 25 June 2025 (Internal Audit Annual Assurance Report 2024/2025) Risk and Audit Scrutiny Committee- 25 June 2025 (Internal Audit Activity Report) Risk and Audit Scrutiny Committee- 30 September 2025 (Internal Audit Activity Report) List of Background Papers Figtree extracts of Action Plans Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Yvonne Douglas, Internal Audit Manager Ext: 2618 (Tel: 01698 452618) E-mail: yvonne.douglas@southlanarkshire.gov.uk 20
Page 21
Key Audit Performance Indicators – October 2025 Appendix 1 Measures reported during financial year No Area Monthly Measure Target Actual Status 1 Operation Number of open vacancies 0 0 2 Operation Employees holding a qualification from a recognised CCAB body or Institute of Internal Auditors 75% 75% 3 Operation Number of audits completed that comply with the requirements of Global Internal Audit Standards 100% 100% 4 Operation Number of processes where we use continuous control monitoring 3 1 5 Operation Number of training days per employee 5 2 6 Operation Plan completed to draft report stage by 30 April 100% 29% 7 Performance Internal Audit recommendations delivered on time 80% 90% 8 Performance Utilisation of contingency time by 30 April 100% 38% 9 Performance Meetings with Heads of Service during each audit 2 2 10 Performance Planned assignments deferred to a future year to accommodate unplanned work 0 0 11 Performance Draft reports issued by target date 80% 100% 12 Performance Audit assignments completed within budget days 80% 100% 13 Performance Internal Audit recommendations followed up 80% 0% 14 Performance Top risks covered in the audit plan on an annual basis 33% 38% 15 Performance Number of Council Services covered by Audit Plan on an 33% 62% 21
Page 22
No Area Monthly Measure Target Actual Status annual basis 16 Strategic Number of audits where objectivity or independence is impaired 0 0 17 Strategic Audits that align to the Council's values 100% 100% 18 Strategic Internal Audit Manager attendance at meetings of the RASC 100% 100% 19 Strategic Number of formal complaints about the Service 0 0 20 Strategic Audit Plan presented to Risk and Audit Scrutiny Committee March 2025 February 2025 21 Strategic Annual Internal Audit Report presented to Risk and Audit Scrutiny Committee June 2025 June 2025 22 Strategic Audit Strategy presented to Risk and Audit Scrutiny Committee Ahead of 2026/2027 IA Plan December 2025 23 Strategic Meeting with members of the Risk and Audit Scrutiny Committee (in private and without senior management) 1 December 2025 Measures to be reported at the end of the financial year No Area Monthly Measure Target Actual Status 24 Operation Number of key performance indicators achieved 100% March 2026 25 Performance Planned annual audit days delivered by 30 April 100% March 2026 26 Strategic Issue of Service questionnaires to support audit planning process and assess levels of satisfaction with the Service March 2026 March 2026 27 Strategic Meetings with 5 Executive Directors and Chief Executive each financial year 1 Scheduled Q3 22
Page 23
Definition of Measures AREA DEFINITION Operation measures that assess day to day operational targets for the Service Performance measures the effectiveness of the Service in its delivery of core objectives Strategic measures as to how activity aligns to wider organisational objectives STATUS DEFINITION anticipate that target will not be met by 31 March 2026 anticipate that target will be met by 31 March 2026 but some slippage that requires corrective action anticipate that target will be met by 31 March 2026 23
Page 24
Assignments Completed 1 September to 14 November 2025 Appendix 2 Number Assignment name Draft Issue Final Issue Audit Conclusion I340126 Data Analytics 23/10/2025 23/10/2025 Investigate and trial use of different IT tools with a focus on the development of the Power BI which has been used to present data for one audit assignment. Power BI was found to be helpful to visualise and analyse data but it was noted that some other IT tools e.g. Microsoft co-pilot AI (artificial intelligence) may provide wider benefits across the programme of work given not all audit assignments are based on data. Internal Audit are part of the co-pilot accelerator programme trialling an advanced version of the tool and have used this to generate summaries for audit planning meetings. The team will continue to participate in this pilot exercise and develop AI skills across the team. I350135 Pupil Equity Fund (PEF) Risk Indicators 31/10/2025 31/10/2025 Use of Power BI to provide a visual analysis of PEF spend. To be used as an initial overview with further detailed analysis of areas of interest. Data passed to Education Resources for review. I650238 Risk Register Review 14/10/2025 14/10/2025 An analysis of the Council’s Top Risk Register controls using the Institute of Internal Auditors 3 lines of defence model. Each group of controls will be mapped as part of the 2026/2027 audit planning process to identify sources of assurance that the control is working effectively. The ‘assurance map’ will be presented to RASC in March 2026 alongside the 2026/2027 Internal Audit Plan. I810052 Audit Strategy 14/11/2025 14/11/2025 An outline Audit Strategy is attached in Appendix 3, and a draft Data Strategy at Appendix 4. See 4.4 and 4.5. No assignment generated an action plan 24
Page 25
Internal Audit Strategy for South Lanarkshire Council Appendix 3 Purpose of Internal Audit Internal Audit is an independent assurance function that seeks to provide the Council’s audit committee and senior management with independent and objective assurance and consultative guidance that meets professional standards. Internal Audit seeks to enhance governance, risk management and control processes within the Council to support achievement of the organisation’s objectives and its ability to serve the public interest. The internal audit function aims to operate in compliance with the Global Internal Audit Standards issued by the International Internal Audit Standards Board and endorsed by the Institute of Internal Auditors effective from 1 April 2025. 1. Vision The internal audit function will be recognised as a strategic advisor, proactively assessing risks and providing well-supported recommendations that help South Lanarkshire Council achieve its objectives in governance, sustainability, efficiency, and public trust. The function will promote transparency, accountability, continuous improvement, and ethical conduct across the council. 2. Stakeholder Expectations Internal Audit will seek to meet stakeholder expectations which are defined as follows:- Senior Management: seeks assurance that Council resources are managed transparently and efficiently. Risk and Audit Scrutiny Committee: expects robust risk-based assurance, strategic advice, and effective reporting. External Auditors and Regulators: require evidence of compliance with standards and effective governance. Public and Partners: expect value for money, ethical conduct, and continuous improvement. 3. Key Challenges Key challenges for the team are around:- Delivery of core purpose alongside responding to unplanned requests for support and assistance Building expertise in emerging areas (e.g., digital transformation, new systems) 25
Page 26
Enhancing the fraud prevention role in response to new legislation and emerging threats Enhancing perception of the function’s role as a trusted strategic advisor, not just a compliance unit. Optimise resources available through best use of technology. 4. Strategic Objectives, Initiatives, and Key Performance Measures Objective 1: Delivery of Core Purpose Initiative: set interim targets for % of the Plan to draft report stage throughout the year Measured by KPI 6 (Plan complete to draft report stage by 30 April) Measured by KPI 10 (planned assignments deferred to a future year to accommodate unplanned work) Interim targets set and reported to the Risk and Audit Scrutiny Committee in routine update reports Objective 2: Build Expertise in Key Risk Areas Initiative: Develop formal training programmes for auditors in digital transformation and new council systems (e.g., Fusion, housing, social work). Measured by KPI 2 (employees holding a qualification from a recognised CCAB body or Institute of Internal Auditors) with resulting CPD requirements Measured by KPI 5 (number of training days per employee) Objective 3: Enhancing Fraud Prevention Role Initiative: Develop formal training programmes for auditors in fraud prevention Measured by KPI 5 (number of training days per employee) Measured by delivery of fraud awareness programme (tracked and reported separately) Objective 4: Enhancing Perception Initiative: Deliver a service that is perceived as enhancing governance, risk management and control processes Measured by KPI 3 (number of audits completed that comply with the requirements of the Global Internal Audit Standards) Measured by KPI 7 (Internal Audit recommendations delivered on time) Measured by KPI 8 (utilisation of contingency time) Measured by KPI 9 (meetings with Heads of Service during each year) Measured by KPI 19 (number of formal complaints about the Service) Measured by KPI 26 (issue of questionnaire to support audit planning and to assess levels of satisfaction with the Service) Measured by KP 27 (meetings with Executive Directors and Chief Executive) Objective 5: Optimise Resource Utilisation Initiative: Leverage data analytics to automate routine audit tasks and improve efficiency Measured by KPI 4 (number of processes where continuous control monitoring is used) Measured by KPI 5 (number of training days per employee) 26
Page 27
5. Communicate the Strategy To implement the Strategy, we will present the vision and objectives to senior management and the Risk and Audit Scrutiny Committee. We will use internal communications to build credibility and shift perceptions of the Service from compliance to that of a strategic advisor. 6. Review and Revise Strategic objectives and initiatives will be reviewed during the annual planning process, adjusted as required and re-communicated. We will continue to provide regular update reports to senior management and the Risk and Audit Scrutiny Committee. 7. Addressing Weaknesses To address perceived weaknesses, we will take the following action: Expertise Gaps: introduce targeted training in emerging areas (e.g., digital, fraud, cybersecurity). Resource Constraints: further develop the support network with other Councils to share tools and training. Perception Issues: meet with Resources on a six-monthly basis to discuss our Strategy, Plan and performance. Alignment with Council Priorities and Standards This strategy is fully aligned with the Global Internal Audit Standards, the council’s own Mandate and Charter, and the priorities set out in the annual Audit Plan. It supports the council’s objectives of accountability, efficiency, and continuous improvement, and ensures the internal audit function remains independent, well-resourced, and strategically focused. 27
Page 28
Data Strategy Appendix 4 Mission: To further embed the use of automation and analysis of data throughout the audit process. Our objective is to make Internal Audit more efficient and enhance our performance: by changing the “way” we audit (moving away from time intensive / small sample review / site visits / need to copy individual back-up documentation to desk based 100% testing – quickly and easily providing more accurate assurances and requiring less time to perform the audit work / write up findings and working papers etc). by changing how we “prepare” our audit plans (by using artificial intelligence (AI) to provide succinct audit planning documents that provide intelligent identification of risk areas meaning we spend less time on the administration associated with preparing audit plans) by changing how we “report” (keeping written reports short and succinct, with the key output being presented in visual format, when relevant). by improving the quality of our data and in turn improve the quality of our output (at all stages - plans, audit findings, reports) by supporting clients better (in terms of more targeted audit recommendations, availability of new management information, more dynamic data, better 100% assurances) To do this, we will extract / analyse / provide data to clients on: an individual / one-off basis – as required as part of individual reviews / audits a continuous basis (making best use of Oracle Fusion and IDEA) This data will be relevant and meaningful as well as complete and accurate. We will analyse this data competently and ensure personal, sensitive and confidential data is sufficiently protected and safeguarded. We will use the data to provide: improved business intelligence - greater insight / identify any strategic emerging issues directions for audit testing - to target our testing better / expand our audit sample The key benefits to our audit clients will be: added value by taking the client’s raw data and turn it into meaningful management information that supports the client’s own local analysis improved value from testing to obtain assurances / identify risks provision of data and output in new “dynamic” ways (such as dashboards instead of traditional appendices) 28
Page 29
GIAS Compliance Assessment Checklist Appendix 5 Purpose: This checklist is designed to assess compliance with the Global Internal Audit Standards (GIAS). It covers the five domains and fifteen principles, providing a structured approach to evaluate adherence, identify gaps, and plan corrective actions. Domain/Principle Requirement Evidence Status Domain 1: Purpose, Authority, and Responsibility Principle 1 – Purpose of Internal Audit Is the internal audit function clearly defined in the charter? Does it align with organisational objectives? Internal Audit Mandate and Charter sets out the purpose of the internal audit function. This was presented to RASC in February 2025. This document also confirms that Internal Audit seeks to enhance governance, risk management and control processes within the Council to support achievement of the organisation’s objectives and its ability to serve the public interest. C Domain 1: Purpose, Authority, and Responsibility Principle 2 – Independence and Objectivity Is the internal audit function independent from management? Are safeguards in place to maintain objectivity? The Internal Audit Mandate and Charter sets out the purpose of the internal audit function and states that Internal Audit is an independent assurance function. The internal audit function operates within a position of organisational independence with a direct accountability to the Council’s Risk and Audit Scrutiny Committee. Internal Audit is located within Finance and Corporate Resources, under the direction of the Proper Officer, the Executive Director Finance and Corporate Resources. The Chief Internal Auditor is positioned at a level in South Lanarkshire Council that enables an internal audit service and responsibilities to be performed without interference from management and establishes the idependence of the internal audit function. The Chief Internal Auditor reports directly to the Risk and C 29
Page 30
Audit Scrutiny Committee. This Committee serves as the audit committee for South Lanarkshire Council and independently provides assurance on the soundness of the Council’s control environment and the adequacy of governnace and risk management frameworks. The Chief Internal Auditor has direct access and reports administratively to the Executive Director Finance and Corporate Resources, the Proper Officer, as defined in Section 95, Local Government Act 1973, meeting with this officer on a regular one to one basis. This relationship is the escalation route for issues arising within Internal Audit and for those matters where it is appropriate for the Chair of the Risk and Audit Scrutiny Committee to be briefed. The Chief Internal Auditor also has direct access to the Council’s Monitoring Officer and will use this route to report as appropriate. The Chief Internal Auditor confirms to Risk and Audit Scrutiny Committee on an annual basis that the internal audit function is organisationally independent. Any factors that impact on independence will be disclosed to the Risk and Audit Scrutiny Committee along with any issues encountered relating to a limitation of scope, performance or communication of internal audit findings and conclusions. Within South Lanarkshire Council, the Employee Code of Conduct provides guidance on the type and nature of interests that should be declared (including paid employment outside the Council and personal interests in contracts). Auditors declare any interests in accordance 30
Page 31
with the Code of Conduct and with regard to the audit principle of independence, notifying the Chief Internal Auditor of any conflicts of interest which may arise. This formal declaration is required to be renewed on an annual basis but is revisited should any conflicts arise. This disclosure extends to any impairments of independence either actual or perceived with an expectation that internal auditors act with profesional objectivity in all aspects of the audit engagement, that this results in balanced assessments that considers all facts and circumstances and avoids bias and undue influence. The Chief Internal Auditor is required to report to the audit committee and senior management any potential impairments to independence. Domain 1: Purpose, Authority, and Responsibility Principle 3 – Professional Responsibility Are auditors adhering to ethical standards and professional conduct? Employees are required to accept the terms of the Council’s Code of Conduct as a condition of employment. The Internal Audit team (qualified and part qualified) are members of various professional accountancy bodies with a requirement to adhere to ethical standards and professional conduct. A structured programme of training is in place. Within South Lanarkshire Council, the Employee Code of Conduct provides guidance on the type and nature of interests that should be declared (including paid employment outside the Council and personal interests in contracts). Auditors must declare their interests in accordance with the Code of Conduct and with regard to the audit principle of independence, notify the Chief Internal Auditor of any conflicts of interest which may arise. This formal declaration is required to be renewed C 31
Page 32
on an annual basis but is revisited should any conflicts arise. This disclosure extends to any impairments of independence either actual or perceived with an expectation that internal auditors act with profesional objectivity in all aspects of the audit engagement, that this results in balanced assessments that considers all facts and circumstances and avoids bias and undue influence. Domain 2: Governance Principle 4 – Governance Structure Is there clear oversight by the board or audit committee? The Executive Director Finance and Corporate Resources and the Chief Internal Auditor seek to maintain sound working relationships with appropriate elected members and ensure that good channels of communication are maintained. The audit committee discuss with the Chief Internal Auditor, the function’s mandate in terms of its role, responsibility, scope and services and review and approve the Internal Audit Mandate and Charter on an annual basis. Members of the Risk and Audit Scrutiny Committee and the Chief Internal Auditor are able to meet privately. Internal Audit report all findings from concluded assignments via progress reports to the Risk and Audit Scrutiny Committee. Lines of communication between the Chairs of all Committees and the Chief Internal Auditor is open at all times. All elected members are free to raise concerns directly with the Chief Internal Auditor and input to the Internal Audit Charter and audit plan. Areas suggested for inclusion in the audit plan are assessed in terms of risk prior to any audit work being undertaken. C 32
Page 33
Enquiries from elected members follow the Council’s protocols and guidance. The Risk and Audit Scrutiny Committee approve a risk- based internal audit plan on an annual basis having satisfied itself around the adequacy of budgets, qualifications and competencies of the internal audit function and of the Chief Internal Auditor to deliver the plan. The Committee satisfy itself that a quality assurance and improvement programme has been established and review the results of the quality assurance and improvement programme on an annual basis. The Risk and Audit Scrutiny Committee seek assurances that there has been no limitation in scope or resources and receive regular updates in relation to performance to allow this to be assessed relative to the function’s objectives and individual roles and responsibilities. Domain 2: Governance Principle 5 – Board Oversight Does the board approve the audit plan and monitor performance? The audit committee discusses with the Chief Internal Auditor the function’s mandate in terms of its role, responsibility, scope and services and reviews and approves the Internal Audit Mandate and Charter on an annual basis. The Risk and Audit Scrutiny Committee approves a risk- based internal audit plan on an annual basis having satisfied itself around the adequacy of budgets, qualifications and comptencies of the internal audit function and of the Chief Internal Auditor to deliver the plan. Any factors that impact on independence are disclosed to the audit committee along with any issues encountered C 33
Page 34
relating to a limitation of scope, performance or communication of internal audit findings and conclusions. The Risk and Audit Scrutiny Committee seek assurances that there has been no limitiation in scope or resources and receive regular updates in relation to performance to allow this to be assessed relative to the function’s objectives and individual roles and responsibilities. A suite of performance measures are reported at each meeting of the audit committee and to senior management as part of the annual reporting process. Domain 2: Governance Principle 6 – Organisational Alignment Is internal audit integrated into governance processes? Internal Audit within South Lanarkshire Council forms part of the Council’s wider governance framework. Output from the function is the delivery of a planned programme of internal audit assignments. Each assignment is formally reported to the Council’s Risk and Audit Scrutiny Committee and, from 1 April 2025, an ‘assignment conclusion’ (previously an ‘audit opinion’) expressed based on the level of assurance that testing has provided. These assurances, in turn, inform an overall assessment of the adequacy and effectiveness of the Council’s framework of governance, risk management and control arrangements that is reported annually to the Corporate Management Team and the Risk and Audit Scrutiny Committee and captured within the Council’s Governance Statement that forms part of the Annual Accounts. C Domain 3: Managing the Internal Audit Function Principle 7 – Internal Audit Strategy Is there a documented strategy aligned with organisational goals? A process to map current practice to all elements of the new GIAS is ongoing and the final key documents, a formal outline Audit Strategy is attached at Appendix 3 and a draft Data Strategy at Appendix 4. These will be developed further and presented alongside the proposed Audit Plan for 2026/2027 in early 2026. PC 34
Page 35
Action: Final Audit Strategy to be presented alongside the 2026/2027 Internal Audit Plan (March 2026). Domain 3: Managing the Internal Audit Function Principle 8 – Resource Management Are resources adequate and appropriately skilled? No resourcing constraints that would prevent delivery of the Audit Plan. Training includes regular team briefs, internal training sessions, attendance at professional body conferences and external seminars and briefings. C Domain 3: Managing the Internal Audit Function Principle 9 – Quality Assurance and Improvement Is there a QAIP (Quality Assurance and Improvement Programme)? Quality Assurance and Improvement Programme has been developed and is reported as part of the Internal Audit assurance report. C Domain 4: Performing Internal Audit Services Principle 10 – Engagement Planning Are objectives, scope, and criteria clearly defined? Standard audit remit template that sets out a review of governance, risk management and control processes; the audit objective and scope; testing and sample details; arrangements for the reporting of findings; Audit Staff who will deliver the audit; liaison arrangements; audit timescales and budget. C Domain 4: Performing Internal Audit Services Principle 11 – Engagement Execution Are audits conducted in accordance with standards? Compliant processes have been developed. Audit assignments are planned; risk-based approach and methodology developed; sufficient fieldwork and evidence gathered; clear reporting protocol in place; follow up and monitoring arrangements established and continuous improvement promoted. C Domain 4: Performing Internal Audit Services Principle 12 – Evidence and Documentation Is sufficient, appropriate evidence maintained? Electronic audit files are retained for all assignments. C Domain 5: Communicating Results and Monitoring Progress Principle 13 – Reporting Are reports clear, accurate, and timely? Reports are subject to review before issue. Target timescales track timeous issue. Standard format for all audit reports. C 35
Page 36
Domain 5: Communicating Results and Monitoring Progress Principle 14 – Follow-up and Monitoring Are corrective actions tracked and verified? All actions are logged in a database. Actions are logged together with a ‘responsible owner’ and a due date. Verbal updates are obtained when the action falls due. This is classed as informal follow up and included within routine performance indicators reported to RASC. Separately, actions are formally followed up to confirm that there is evidence of action being taken and the findings of these reviews reported to RASC throughout the year. C Domain 5: Communicating Results and Monitoring Progress Principle 15 – Continuous Improvement Is there a process for ongoing improvement? There is ongoing evaluation of performance (performance indicators); a Quality Assurance and Improvement Programme has been developed; emerging risks are evaluated throughout the year; best practices in audit processes are identified and implemented; promotion of continuous professional development for audit staff and stakeholder engagement to review expectations and alignment with organisational objectives and governance requirements. C 36
Page 37
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 9 December 2025 Report by: Executive Director (Finance and Corporate Resources) Subject: Accounts Commission 2025 – Scrutiny, Governance and Transparency of Decision Making of Exit Packages of Senior Officers 1. Purpose of Report 1.1. The purpose of the report is to:- provide an update to the Risk and Audit Scrutiny Committee on a letter recently issued by the Accounts Commission to all councils in relation to the scrutiny, governance and transparency of decision making of exit packages of senior officers, and provide a summary of the Council’s position on the 5 recommendations the Accounts Commission makes in relation to exit packages related to senior officers 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- (1) that the contents of the report be noted; and (2) that the next steps detailed in section 6, be noted. [1recs] 3. Background 3.1. Since the late 1990s, a number of reports have been published by the Accounts Commission for Scotland and Audit Scotland on the management of early retirements, with a view to ensuring that public sector organisations have sufficiently robust frameworks in place for decision making and scrutiny. These are included in the Background Papers section for reference. 3.2. The Accounts Commission has recently written to all councils in relation to the scrutiny, governance and transparency of decision-making of exit packages of senior officers. This followed the publication of a report on Senior Officer Exit Packages at Glasgow City Council ( link to report here - Glasgow City Council S102 report) 4. Accounts Commission 2025 4.1. On 8 September 2025, the Accounts Commission wrote to the Leaders and Chief Executives of all Councils in Scotland. The purpose of this letter was to advise that on the 14 August 2025, the Accounts Commission considered a report from the Controller of Audit (under powers in s102 (1) of the Local Government (Scotland) Act 1973) in relation to the scrutiny, governance and transparency of decision making of exit packages of senior officers in Glasgow City Council (GCC). 4 37
Page 38
4.2. The Commission advises that it considered carefully the most appropriate way to use the powers available to it, including holding a hearing, making recommendations to Scottish Ministers or censuring in light of the concerning issues presented in the report. On this occasion, alongside publishing findings, the Commission states that it is vital that all councils take action to recognise the important learnings from this report. The Commission expects that the letter issued to councils and the issues they note that the report highlights, would be discussed by Councils’ Risk and Audit and Scrutiny Committee and that steps would be taken to review its Scheme of Delegation and decision-making processes. 4.3. The Commission also recognised that as councils continue to face financial challenges, service redesign and restructuring are key tools available to councils to respond to these challenges. However, transparency and good governance around decision-making were essential. 4.4. The Commission is clear that decisions of elected members and officers should uphold the 9 Key Principles of Public Life in Scotland – selflessness, integrity, objectivity, accountability, openness, honesty, leadership, public services, respect. Key Principles of Public Life | The Standards Commission for Scotland 4.5. The Commission stated that where decisions around restructuring and exit packages are being taken, councils must ensure there is clear evidence of effective governance, independent scrutiny, and value for money, as well as robust and transparent record keeping. The lessons learned from GCC have been considered in light of the 5 key recommendations set out in a previous Audit Scotland report (2003). These have been adapted by the Commission for today’s context:- 1. Frameworks for decision-making: policies in relation to the exit packages of senior officers should be approved by councillors and reviewed regularly. 2. Informing councillors: councillors should receive a report at least annually that details the number of early retirals, and redundancy decisions made in the year, along with the associated costs and savings attached to these decisions. 3. Decision-making: councils should rigorously appraise individual business cases to ensure the expected savings associated with a retiral or redundancy outweigh the costs, ensuring value for money. 4. To improve accountability and assist in monitoring, the costs of early retirement should be charged to the appropriate service budget. 5. Elected members should be involved in approving early retirement and redundancy decisions for senior staff, providing the independent scrutiny that is essential to issues and decisions where there are potential conflicts of interest. 4.6. The Council’s position on the adapted recommendations is detailed in section 5. 4.7. All councils were urged to take action now to ensure that officers and members are familiar with the Key Principles of Public Life and that they could evidence that their organisation's culture respects and fully supports them. 38
Page 39
5. Council Position 5.1. As a result of previous Audit Scotland reports on Early Release, the following recommendations were approved at the Executive Committee on 12 September 2012:- that Reports regarding early retirement/voluntary severance of all Chief Officers/Statutory Officers would be presented to the Executive Committee for approval these reports would include information on the rationale for early release and any consequential implications, including financial implications, which will allow the Executive Committee to decide on the appropriateness of the proposals to accommodate this, a change is required to be made to the Council’s Scheme of Delegation 5.2. The Council is compliant with the position recommended by the Commission (included at 4.5):- 1. Framework for decision-making : All personnel policies are approved at the Committee and reviewed on a regular basis; this includes policies in relation to exit packages relating to all employees including senior officers. Any early retirement/voluntary severance of any Chief Officer/Statutory Officer would require to be presented to the Executive Committee for approval. 2. Informing Councillors: The Council reports on a 6 monthly basis to Finance and Corporate Committee on all early retirement, voluntary severance and SWITCH2. There have been no early retirement or redundancy payments made to any officers in the last 6 years 3. Decision Making: Any service review that results in structures changing and posts being removed, resulting in early release, would be presented to the appropriate Resource or Executive Committee. In addition, the 6-monthly report to Finance and Corporate Committee would include details of one-off and recurring employer costs, however, there have not been any recent costs to report. 4. Accountability/Monitoring: Any business case and decision relating to early departures of Chief Officers/Statutory Officers (Described as senior officers by the Accounts Commission) would be required to be approved by Councillors at Committee, and any costs associated with this would be reported and charged to the appropriate service budget. There have been no arrangements agreed for early retirement or voluntary severance since 2019. 5. Elected Member Oversight: This scrutiny exists through reports and approvals at the Committee, as summarised above. 39
Page 40
5.3. In summary, reports regarding any structure changes which result in early retirement/voluntary severance of all Chief Officers/Statutory Officers would be presented to the Executive Committee for approval. These reports would include information on the rationale for early release and any consequential implications, including financial implications, which will allow the Executive Committee to decide on the appropriateness of the proposals. 6. Next Steps 6.1. To demonstrate that the council continues to meet the recommendations outlined in paragraph 4.5, the following next steps are proposed:- the Council will continue to review any requirement to change existing policies, and any change would be reported to the Committee for approval a personnel circular will be issued to all employees, reminding them of the Principles of Public Life that the Principles of Public Life are included in Elected Member and Employee Induction programmes and are circulated on an annual basis with the Employee Code of Conduct. These will be updated by January 2026 as per the Scheme of Delegation, all requests for early retirement / voluntary severance for Chief Officers and Statutory Officers must be presented to Executive Committee for decision/approval any request for early release/early severance must demonstrate clear evidence of effective governance, independent scrutiny, and provide evidence of value for money, as well as robust and transparent record keeping 7. Employee Implications 7.1. As covered earlier in the report, this paper clarifies that for Chief Officers and Statutory Officers, any early release must be approved by elected members. 8 Financial Implications 8.1. There are no direct financial implications from this report. 9 Climate Change, Sustainability and Environmental Implications 9.1. There are no climate change, sustainability or environmental associated with this report. 10. Other Implications 10.1. There are no other implications associated with this report. 11. Integrated Impact Assessment and Consultation Requirements 11.1. This report does not introduce a new policy, function or strategy or recommend a change to an existing policy, function or strategy and, therefore, no impact assessment or consultation is required. 40
Page 41
11.2 There is no requirement to consult with the Trade Unions. Jackie Taylor Executive Director (Finance and Corporate Resources) 3 November 2025 Link(s) to Council Values/Priorities/Outcomes Accountable, effective, efficient, and transparent Fair, open, and sustainable Ambitious, self-aware, and improving Previous References None List of Background Papers 1997- Accounts Commission for Scotland; Bye Now, Pay Later? report 2003 - Accounts Commission for Scotland; Bye Now, Pay Later? A follow up review of the management of early retirement report. May 2013 - Audit Scotland; Managing departures from the Scottish public sector report November 2013 - Audit Scotland; Scotland’s public sector workforce report September 2012 Early Retirement and Voluntary Severance Authorisation Process, Executive Committee List of Appendices None Contact for Further Information If you wish to inspect the background papers or want further information, please contact:- Michelle Milne, Head of Personnel Services Ext: 4330 (Tel: 01698 454330) Email: michelle.milne@southlanarkshire.gov.uk 41
Page 42
42
Page 43
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 9 December 2025 Report by: Executive Director (Finance and Corporate Resources) Subject: Fraud Statistics Six Monthly Update 2025/2026 1. Purpose of Report 1.1. The purpose of the report is to:- provide a summary of the fraud statistics for the six months to 30 September 2025 and a comparison to the same period in 2024 provide an update on the progress of other fraud awareness activity and anti- fraud work 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- (1) that the contents of this report be noted. 3. Background 3.1. Collating and reporting fraud statistics and setting targets for improvement are considered best practice by the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Association of Local Authority Risk Managers (ALARM). 3.2. This report provides information on the number, types and outcomes of fraud investigations within South Lanarkshire Council (SLC) for the 6 months to 30 September 2025, together with a comparison to the statistics for the same period in 2024, where available. It includes all frauds reported to Internal Audit, benefit frauds during this period passed to the Department for Work and Pensions (DWP) for investigation and insurance losses resulting from a failure in internal controls or which have been investigated by Internal Audit. It also contains information on other work being undertaken by Internal Audit in relation to fraud prevention. 3.3. Although responsibility for housing benefit fraud investigations has transferred to the DWP Fraud and Error Service (FES), SLC retains responsibility for the recovery of fraud overpayments from its own Housing Benefit claimants. Housing Benefit fraud data will therefore continue to be included within the fraud statistics reported, as information is provided by FES. 5 43
Page 44
3.4. Benefits and Revenue deliver an annual programme of rolling reviews on Housing Benefit claimants based on risk-profiling to establish the most likely areas of benefit fraud or overpayment. Information is also obtained from HMRC through the Verification of Earnings and Pensions arrangement, from DWP through the Housing Benefit Matching Service and from data gathered through the National Fraud Initiative (NFI). Where fraud is suspected, the case will be passed to FES for investigation and, if proven, returned to SLC to pursue recovery. Irrespective of whether a fraud is proven or not, the Council takes steps to recover any overpayment. 4. Results 4.1. All concerns reported to Internal Audit are risk assessed, with high-risk areas investigated by Internal Audit, medium risks investigated by Resources and low risks registered for monitoring of trends. Internal Audit may also undertake joint investigations with Resources and the Fact-Finding team within Personnel Services depending on the nature of the fraud and the level of operational knowledge required. 4.2. Areas within the Council that have an inherently higher risk of fraud are considered for inclusion in the annual Audit Plan. There have been no new patterns or trends identified in the first 6 months of 2025/2026. 4.3. An analysis of the fraud caseload for the six months to 30 September 2025 and the comparative period in 2024 is detailed in Table 1. Table 1 - Fraud Caseload Status Six Months to 30/09/25 Six Months to 30/09/24 Nos. £000 Nos. £000 Cases open as of 1 April 24 5 171 44 Concerns reported during financial year 11 49 271 8 SLC caseload for the year 35 54 198 52 Cases closed in period (see Table 2) 15 1 13 14 Work in progress at 30 September 20 53 185 38 4.4. DWP referrals made to the Council have been excluded from Table 1 to ensure data reflects only the SLC-managed element of the caseload. A further 19 SLC investigations are currently being progressed by the DWP with a potential cumulative housing benefit overpayment/fraud value of around £7k. On conclusion of investigations, if required, SLC will seek repayment in line with standard recovery procedures. 4.5. Concerns reported in the first 6 months were relatively low, with cases coming primarily from suspected benefit fraud. 1 includes one case where work to ascertain value is still in progress 44
Page 45
4.6. An analysis of closed cases in the year is detailed in Table 2:- Table 2 - Analysis of Closed Cases Source of fraud Six Months to 30/09/25 Six Months to 30/09/24 Nos. £000 Nos. £000 Founded allegation (see Table 3) 3 0 10 7 Insufficient information 7 1 1 0 Unfounded allegations 5 0 2 7 Total 15 1 13 14 4.7. An analysis of founded allegations is detailed in Table 3:- Table 3 – Analysis of Founded Allegations Source of fraud Six Months to 30/09/25 Six Months to 30/09/24 Nos. £000 Nos. £000 External 3 0 10 7 Internal 0 0 0 0 Benefits 0 0 0 0 Total 3 0 10 7 5. Wider Fraud Workload 5.1. Time spent on and outcomes from investigative work are monitored throughout the year. Services work with the Security Coordinator or with Internal Audit to review and address gaps in controls identified during the investigation of cases. Where appropriate, improvement plans are agreed with the relevant Heads of Service and the actions followed up by Internal Audit to ensure implementation. Outcomes for concluded investigations are reported to the Risk and Audit Scrutiny Committee as part of routine activity reports and included in Internal Audit’s annual assurance report. 5.2. Aside from time to respond to potential frauds, there is a wider programme of anti- fraud activity that runs across the year to proactively manage the risk of fraud. Interim updates in relation to these other areas are set out in paragraphs 5.3 to 5.15 below. Fraud Awareness Programme 5.3. A fraud awareness programme has been developed which aims to focus the attention of all employees on the increased risks of fraud, their responsibilities and the need for daily vigilance and action. To date, the following actions have been completed in 2025/2026:- the Conflict of Interest policy has been re-issued a fraud presentation has been delivered to the Risk Sponsors Group fraud risk registers have been updated a Personnel Circular has been issued providing an update on the NFI exercise 5.4. A series of communications to SLC employees are the final actions in this programme for 2025/2026. These communications are a range of short anti-fraud updates and messages to be conveyed across the remainder of the financial year. 45
Page 46
5.5. All of this activity forms part of a wider response to the new corporate criminal offence of ‘failure to prevent fraud’. A plan has been developed to mitigate legal and reputational risks attached to non-compliance with the legislation and good progress is being made with implementing actions. 5.6. A full update on progress will be provided in the 2025/2026 annual fraud report. Fraud Alerts 5.7. Internal Audit monitors fraud alerts through internal and external sources and disseminates information as appropriate. In 2025/2026 these have continued to relate to ad-hoc issues and have been shared with Council Resources as appropriate with action taken where required. Lessons Learned Exercises 5.8. External auditors are required to report significant frauds, or suspected frauds, to Audit Scotland, where they were caused or facilitated by weaknesses in public bodies’ internal controls. Frauds and irregularities are considered significant where the value of the loss is over £5,000 or where it is of significance owing to the nature of the activity. 5.9. Audit Scotland routinely report these frauds within technical bulletins which also includes detail around improvements to controls to prevent similar frauds occurring. Bulletins are reviewed and cases shared with relevant Services to assess whether controls require amendment. 5.10. The most recent bulletin shared a fraud in relation to a third party impersonating a foreign supplier to commit a bank mandate fraud which resulted in the public body paying £34,000 to a fraudulent bank account. Standard processes are in place to validate any change in bank account details within SLC. Details of the case have been shared with Finance (Transactions) Services to act as a reminder and raise awareness. 5.11. The second case was in relation to an employee who received £12,000 of salary to which they were not entitled as they were paid a full-time salary for a part-time post. Details of this case have been shared with Personnel Services to review and respond, if required. Comparison of Fraud Risk Arrangements to Best Practice 5.12. On an annual basis, the Council subscribes to the National Anti-Fraud Network (NAFN), a UK-based organisation that provides data and intelligence services to support public sector bodies in tackling fraud, safeguarding, and regulatory compliance. 5.13. In the summer of 2025, SLC participated in a UK-wide survey which aimed to “provide a clear view into a rapidly evolving and increasingly complex and challenging (fraud) environment (and to offer) a foundation for informed, evidence- based action”. 5.14. The output from this survey highlights a significant increase in fraud case volumes over the past 5 years, estimating £265 million in detected fraud nationally for 2024/2025 (based on survey extrapolation). Average fraud case values were noted as falling, suggesting a rise in lower-value but higher-volume frauds. 46
Page 47
5.15. Tenancy, procurement and council tax fraud were noted as remaining the highest- value categories. 5.16. A report on the survey has been published, and a summary will be included in the 2025/2026 annual fraud report presented to this Committee, along with any required actions. 6. National Fraud Initiative 6.1. Aside from internal reviews, the Council also participate in the NFI, a UK-wide data matching exercise led by the Cabinet Office and Audit Scotland to detect and prevent fraud across public sector organisations. 6.2. The Council, on a biennial basis, uploads a series of pre-defined datasets. These datasets are then matched against the same datasets uploaded by all participating bodies, with a ‘match’ indicating a case that requires review and which may, potentially, be fraudulent. 6.3. Participating bodies receive a high level of matches and, from this, select a series of target matches that are determined on the basis of high risk, fraud risk and outcomes from previous years. Within SLC, these are then issued to relevant Services for investigation. 6.4. At 30 September 2025, a total of 34,547 matches have been received. Progress with investigations is shown in Table 4, which is being regularly monitored by Internal Audit. All target investigations are anticipated to be completed by the deadline of 31 March 2026. Table 4 – NFI Investigation Progress Category Total matches Target matches Progress on matches investigated Housing Benefits 130 91 74 Payroll 115 111 89 Creditors 1,242 316 116 # Housing Tenants 1,225 474 379 Housing Waiting List 670 231 201 Council Tax Reduction 2,592 493 355 Blue Badges 1,365 1,365 333 Procurement 39 39 10 # Small Business Bonus Scheme (SBBS) 166 166 0 # Single Person Discount 27,003 638 * 102 # Total 34,547 3,924 1,659 # Investigation work has commenced but not finalised/NFI website to be updated * Target will be increased following a review by Datatank, a contractor employed by the Council to undertake rolling reviews 7. Employee Implications 7.1. SLC has a zero-tolerance approach to fraud. Manager and employee roles and responsibilities are set out in SLC’s Counter Fraud, Bribery and Corruption Policy. 47
Page 48
8. Financial Implications 8.1. The investigation of fraud, participation in the NFI exercise and the collection and reporting of fraud statistics is carried out within existing resources. The 2025/2026 Internal Audit Plan includes 165 days to manage the NFI exercise, disseminate fraud alerts, update fraud risk registers and undertake anti-fraud assignments and fraud investigations. 9. Climate Change, Sustainability and Environmental Implications 9.1. There are no implications for climate change, sustainability or the environment in terms of the information contained in this report. 10. Other Implications 10.1. Fraud risk is recognised as one of the top risks facing SLC. This risk is significant as it can adversely affect the delivery of Council objectives and erode valuable resources. It is therefore important that the risk of fraud is soundly managed. Fraud Risk Registers are in place within all Resources and are reviewed and updated annually in line with standard Risk Management procedures. Periodic self- assessment exercises against good practice guidance in fraud management inform these updates. 10.2. The Council’s Serious and Organised Crime (SOC) working group progress delivery of various anti-fraud actions, revising whether any new or emerging threats are identified through the pan Lanarkshire Multi Agency SOC Group. This Group met in May 2025 for a workshop, and plans to articulate the next steps that are being developed. A high-level summary will be included within fraud statistics reports. 10.3. The collection and reporting of fraud statistics assist in the management of fraud by identifying patterns and trends of fraud and areas of high risk where preventative controls should be concentrated. However, in order to do this effectively, fraud statistics must be complete. Internal Audit will continue to highlight areas where practice could be improved to ensure that all instances of potential and actual fraud are reported to Internal Audit. 11. Integrated Impact Assessment and Consultation Requirements 11.1. There is no requirement to undertake an impact assessment. 11.2. Consultation was not necessary for this report. Jackie Taylor Executive Director (Finance and Corporate Resources) 14 November 2025 Link(s) to Council Values/Priorities/Outcomes Accountable, effective, efficient and transparent 48
Page 49
Previous References Risk and Audit Scrutiny Committee-18 February 2025 (Fraud Statistics Six Monthly Update) Risk and Audit Scrutiny Committee-25 June 2025 (National Fraud Initiative Exercise -2022) Risk and Audit Scrutiny Committee-30 September 2025 (Fraud Statistics 2024/2025 Annual Report) List of Background Papers None Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Yvonne Douglas, Internal Audit Manager Ext: 2618 (Tel: 01698 452618) E-mail: yvonne.douglas@southlanarkshire.gov.uk 49
Page 50
50
Page 51
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 9 December 2025 Report by: Chief Executive Subject: Performance and Review Scrutiny Forum Annual Update 1. Purpose of Report 1.1. The purpose of the report is to:- [purpose] provide, for information, a summary of the reports considered by the Performance and Review Scrutiny Forum during the period January to December 2025 [1purpose] 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- [recs] (1) that the content of this report be noted. [1recs] 3. Background 3.1. The Terms of Reference and Powers and Responsibilities for the Performance and Review Scrutiny Forum includes consideration of the Council’s response to Best Value, improvement and performance management. 3.2. The details within this report provide the Risk and Audit Scrutiny Committee with a summary of business reported to the Performance and Review Scrutiny Forum. 4. Agenda Items 4.1. The table below notes the reports submitted to the Performance and Review Scrutiny Forum during 2025 under the main areas of responsibility. Date Report 4 February Audit Scotland: Delivering for the Future – why Leadership Matters Audit of Best Value – reports on City of Edinburgh, Clackmannanshire and Scottish Borders councils Transformational Reviews – update Transformational Reviews – forward reporting programme 1 April Local Government Benchmarking Framework 2023/2024 results and action plan Statutory Performance Information Direction 2024 Audit of Best Value – reports on Western Isles, Fife, and Renfrewshire councils Transformational Reviews – update Third Sector Partnership review 17 June Audit of Best Value – reports on Highland Council and Argyll and Bute Council 6 51
Page 52
Transformational Reviews - update Property Services – Efficiencies and Income Generation Fleet Management Digital Transformation – update Customer Engagement Transformational Review - update 19 August Council Plan Connect Quarter 4 progress report 2024/2025 Annual Performance Spotlights 2024/2025 Audit of Best Value – reports on East Lothian and Renfrewshire councils Transformational Reviews – update Digital Transformation – update Customer Engagement Transformational Review - update 4.2. A schedule of reporting will continue covering the key themes noted at paragraph 3.1 above. The Risk and Audit Scrutiny Committee will be provided with an annual report for information, advising it of the business presented to the Performance and Review Scrutiny Forum. 5. Employee Implications 5.1. There are no employee implications relating to this report. 6. Financial Implications 6.1. There are no financial implications relating to this report. 7. Climate Change, Sustainability and Environmental Implications 7.1 There are no Climate Change, Sustainability and Environmental implications relating to this report. 8 Other Implications 8.1. There are no risk or sustainability issues associated with the content of this report. 9. Integrated Impact Assessment and Consultation Requirements 9.1. This report does not introduce a new policy, function or strategy or recommend a change to an existing policy, function or strategy and therefore no impact assessment is required. 9.2. There is also no requirement to undertake any consultation in terms of the information contained in this report. Paul Manning Chief Executive 25 November 2025 Link(s) to Council Values/Priorities/Outcomes Accountable, effective, efficient and transparent Ambitious, self-aware and improving We will work to recover, progress and improve 52
Page 53
Previous References None List of Background Papers Performance and Review Scrutiny Forum meetings – 4 February 2025, 1 April 2025, 17 June 2025 and 19 August 2025. Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Tom Little, Head of Communications and Strategy Ext: 4904 (Tel: 01698 454904) Email: tom.little@southlanarkshire.gov.uk 53
Page 54
54
Page 55
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 9 December 2025 Report by: Executive Director (Finance and Corporate Resources) Subject: Forward Programme for Future Meetings 1. Purpose of Report 1.1. The purpose of the report is to:- [purpose] advise members of the forward programme for the meetings of the Risk and Audit Scrutiny Committee to 3 November 2026, and invite members to suggest topics for inclusion in the Committee’s forward programme [1purpose] 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- [recs] (1) that the report and the outline forward programme for the meetings of the Risk and Audit Scrutiny Committee to 3 November 2026, attached as an Appendix to the report, be noted. [1recs] 3. Background 3.1. As part of a range of improvement measures introduced as a result of Audit Scotland’s report on the Audit of Best Value and Community Planning (2009), an Action Plan was prepared. One of the actions was to include, as a standard agenda item, a list of items proposed for consideration at subsequent meetings of this Committee to provide an opportunity for members to inform future agendas. The outline forward programme to 3 November 2026 is attached, for members’ information, as an Appendix to the report. 4. Employee Implications 4.1. There are no employee implications. 5. Financial Implications 5.1. There are no financial implications. 6. Climate Change, Sustainability and Environmental Implications 6.1. There are no Climate Change, Sustainability or Environmental implications in terms of the information contained within this report. 7. Other Implications 7.1. There are no risk implications in terms of the information contained within this report. 7 55
Page 56
8. Integrated Impact Assessment and Consultation Requirements 8.1. The report does not introduce a new policy, function or strategy or recommend a change to an existing policy, function or strategy and, therefore, no impact assessment is required. 8.2. There was no requirement to undertake any consultation in terms of the information contained in this report. Jackie Taylor Executive Director (Finance and Corporate Resources) 19 November 2025 Link(s) to Council Values/Priorities/Outcomes Accountable, Effective, Efficient and Transparent Previous References Executive Committee 8 July 2009 List of Background Papers Audit Scotland Audit of Best Value and Community Planning Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Ishara Opatha, Administration Officer Tel: 07307385370069 E-mail:- ishara.opatha@southlanarkshire.gov.uk 56
Page 57
APPENDIX – RASC OUTLINE FORWARD PROGRAMME Meeting Date Item Responsibility 10 March 2026 Internal Audit Activity Report Audit and Compliance Manager 2026/2027 Internal Audit Plan Audit and Compliance Manager RASC Good Governance Update and Significant Governance Areas Quarter 2 Progress Report Head of Administration and Legal Services Annual Audit Plan External Audit 26 May 2026 Internal Audit Activity Report Audit and Compliance Manager 2025 NFI Exercise Audit and Compliance Manager Audit Scotland – Financial Bulletin 2024/2025 Head of Finance (Strategy) Financial Resources Scrutiny Forum Activity Head of Finance (Strategy) 23 June 2026 (Special) Internal Audit Assurance Report 2025/2026 Audit and Compliance Manager Annual Governance Statement for 2025/2026 and Significant Governance Areas for Quarter 4 Progress Report Head of Administration and Legal Services Unaudited Annual Accounts 2025/2026 Head of Finance (Strategy) 25 August 2026 Internal Audit Activity Report Audit and Compliance Manager Year End Insured Risks Report 2025/2026 Head of Finance (Transactions) Year End Risk Management Report 2025/2026 and Review of Council’s Top Risks 2026/2027 Head of Finance (Transactions) Fraud Statistics Annual Report 2025/2026 Audit and Compliance Manager 57
Page 58
Financial Resilience and Sustainability Report Head of Finance (Strategy) 29 September 2026 (Special) External Auditor’s Annual Report to South Lanarkshire Council 2025/2026 External Audit Audited Annual Accounts 2025/2026 Head of Finance (Strategy) 3 November 2026 Internal Audit Activity Report Audit Scotland Report: Local Government in Scotland Overview 2025 Audit and Compliance Manager Head of Communications and Strategy Annual Update on the Use of Surveillance Powers - The Regulation of Investigatory Powers (Scotland) Act 2000 Head of Administration and Legal Services N.B:- Audit Scotland national studies and reviews will appear as a recurring item, but the frequency and subject matter will vary according to their programme. 58