Agenda Document Pack - Risk and Audit Scrutiny Committee - 23/05/2023
South Lanarkshire Council · 23 May 2023
Back to Risk and Audit Scrutiny Committee — 23 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Council Offices, Almada Street Hamilton, ML3 0AA Monday, 15 May 2023 Dear Councillor Risk and Audit Scrutiny Committee The Members listed below are requested to attend a meeting of the Committee to be held as follows:- Date: Tuesday, 23 May 2023 Time: 10:00 Venue: Hybrid - Committee Room 1, Council Offices, Almada Street, Hamilton, ML3 0AA The business to be considered at the meeting is listed overleaf. Yours sincerely Cleland Sneddon Chief Executive Members Elaine McDougall (Chair), Mary Donnelly (Depute Chair), Mathew Buchanan, Alistair Fulton, Ross Gowland, Celine Handibode, Cal Johnston-Dempsey, Susan Kerr, Richard Lockhart Substitutes Colin Dewar, Gavin Keatt, Monique McAdams, Helen Toner 1
Page 2
BUSINESS 1 Declaration of Interests 2 Minutes of Previous Meeting Minutes of the meeting of the Risk and Audit Scrutiny Committee held on 7 March 2023 submitted for approval as a correct record. (Copy attached) 3 - 8 Item(s) for Decision 3 Review of Counter Fraud, Bribery and Corruption Policy Report dated 5 May 2023 by the Executive Director (Finance and Corporate Resources). (Copy attached) 9 - 32 Item(s) for Noting 4 Internal Audit Activity as at 5 May 2023 Report dated 5 May 2023 by the Executive Director (Finance and Corporate Resources). (Copy attached) 33 - 48 5 Annual Audit Plan 2022/2023 Report dated March 2023 by Audit Scotland, External Auditor. (Copy attached) 49 - 70 6 Audit Scotland – Financial Bulletin 2021/2022 Report dated 4 May 2023 by the Executive Director (Finance and Corporate Resources). (Copy attached) 71 - 76 7 Financial Resources Scrutiny Forum Activity Report dated 5 April 2023 by the Executive Director (Finance and Corporate Resources). (Copy attached) 77 - 80 8 Forward Programme for Future Meetings Report dated 27 April 2023 by the Executive Director (Finance and Corporate Resources). (Copy attached) 81 - 84 Urgent Business 9 Urgent Business Any other items of business which the Chair decides are urgent. Clerk Name: Elizabeth-Anne McGonigle Clerk Telephone: 07385403101 Clerk Email: elizabeth-anne.mcgonigle@southlanarkshire.gov.uk 2
Page 3
RISK AND AUDIT SCRUTINY COMMITTEE Minutes of meeting held via Confero and in the Council Chamber, Council Offices, Almada Street, Hamilton on 7 March 2023 Chair: Councillor Elaine McDougall Councillors Present: Councillor Mary Donnelly (Depute), Councillor Alistair Fulton, Councillor Ross Gowland, Councillor Cal Johnston-Dempsey, Councillor Susan Kerr, Councillor Richard Lockhart Councillors' Apologies: Councillor Mathew Buchanan, Councillor Celine Handibode Councillor Also Present: Councillor Gerry Convery (for item 3) Attending: Finance and Corporate Resources P Manning, Executive Director; Y Douglas, Audit and Compliance Manager; G McCann, Head of Administration and Legal Services; E-A McGonigle, Administration Officer; A Norris, Administration Assistant 1 Declaration of Interests No interests were declared. 2 Minutes of Previous Meeting The minutes of the meeting of the Risk and Audit Scrutiny Committee held on 6 December 2022 were submitted for approval as a correct record. The Committee decided: that the minutes be approved as a correct record. 3 Good Governance Update A report dated 17 February 2023 by the Executive Director (Finance and Corporate Resources) was submitted providing an update on the Council’s governance arrangements. Each year, the Council undertook a comprehensive review of the governance arrangements required to support its financial and operational controls. The annual review of governance arrangements informed the Governance Statement which was included within the Council’s Annual Accounts. As part of this annual review, the Council’s Local Code of Corporate Governance was reviewed, updated and republished. Compliance with the Code was also reviewed on an annual basis and Appendix 1 to the report provided details of the Council’s compliance with the Code. Details of the amendments made to the Code, following the review, were provided and the revised Code was attached as Appendix 2 to the report. Progress on the significant governance areas, as highlighted within the Annual Governance Statement 2021/2022, was detailed in Appendix 3 to the report. 2 3
Page 4
The Chair and Depute, on behalf of the Committee members, expressed appreciation of the work undertaken to prepare the update and the revised Local Code of Corporate Governance. The Committee decided: (1) that the findings from the annual compliance check against the Local Code of Corporate Governance be noted; (2) that the updated Local Code of Corporate Governance be approved; and (3) that progress against the significant governance areas identified within the Annual Governance Statement 2021/2022 be noted. [Reference: Minutes of 26 January 2022 (Paragraph 3)] 4 2023/2024 Internal Audit Plan A report dated 16 February 2023 by the Executive Director (Finance and Corporate Resources) was submitted on the proposed Internal Audit Plan 2023/2024. In recent years, the Internal Audit Plan had been presented as 2 separate 6-month plans so that the impact of redeployment of the Service to deliver COVID-19 related tasks could be managed. The 2023/2024 Plan had reverted to a proposed programme of work for the full financial year. The Plan included time with the Council’s new External Auditor team to provide data, assist with their audit and respond to queries. A copy of the Plan would be shared with Audit Scotland so that areas where they would place reliance on output could be established. A total of 1,220 audit days, inclusive of days which had been allocated to external clients, had been provided for in the Plan. The proposed Internal Audit Plan, which included a brief outline scope for each proposed assignment, was attached as Appendix 1 to the report. One Auditor post had been deployed full-time to the project and would be supplemented by significant additional time from an Audit Adviser. A detailed plan would be shared with the Committee at a future meeting which would set out how audit time would be used across both pre and post implementation periods. The content of the Audit Plan each year was determined by the requirement to deliver a programme of work that would inform the annual audit opinion on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control arrangements. The 2023/2024 Audit Plan would be delivered within the context of the revised Internal Audit Charter, attached as Appendix 2 to the report, and in accordance with the Public Sector Internal Auditing Standards (PSIAS). The Internal Audit function’s compliance with PSIAS was being externally assessed by East Lothian Council in 2022/2023 and the outcome of that assessment would be presented to the Committee in June 2023. The Chair and Depute, on behalf of the Committee members, thanked officers for the work that had been undertaken to prepare the 2023/2024 Internal Audit Plan. The Committee decided: that the proposed Internal Audit Plan for 2023/2024 be approved. [Reference: Minutes of 26 January 2022 (Paragraph 4)] 4
Page 5
5 Internal Audit Activity as at 17 February 2023 A report dated 17 February 2023 by the Executive Director (Finance and Corporate Resources) was submitted on work completed by Internal Audit during the period 19 November 2022 to 17 February 2023. Findings from internal audit assignments were reported to this Committee throughout the year and the last progress report was considered by this Committee on 6 December 2022. Key performance indicators, which reflected quality, on time and within budget as at 31 January 2023, were summarised in Appendix 1 to the report. 100% of draft reports were issued on time and 100% within budget against targets of 80% respectively. Quality continued to be monitored through internal quality control procedures. As at 17 February 2023, 33% of the 2022/2023 Audit Plan was complete. Of the remaining 67%, 34% related to assignments that were planned to conclude by 31 March 2023 and 33% related to tasks that continued throughout the year and would be closed at financial year end. Client contributions to the delivery of the audit plan took the form of responding to draft reports, agreeing to close meetings and signing reports timeously once agreed. 100% of audit assignments were concluded to a signed action plan within 4 weeks of the issue of a draft report against a target of 80%. Assignments completed in the period 19 November 2022 to 17 February 2023, together with a summary of overall assurances, were detailed in Appendix 2 to the report. The Council formed part of the Glasgow City Region City Deal which funded a range of capital projects within South Lanarkshire. There had been no Internal Audit reports presented at the Cabinet meeting in February 2023. The next meeting of the Cabinet was in May 2023 and an update would be provided to the Committee in June 2023. The self-assessment for the Public Sector Internal Audit Standards (PSIAS) external review had been passed to East Lothian Council for inspection. The assessment had been submitted 2 months later than intended due to other priorities. The outcome of the exercise would be reported to the Committee in June 2023. The Committee decided: (1) that the progress and performance be noted; and (2) that the delay in progressing the external assessment of the Council’s internal audit service level of compliance with PSIAS be noted. [Reference: Minutes of 6 December 2022 (Paragraph 5)] 6 Fraud Statistics 6 Monthly Update 2022/2023 A report dated 16 February 2023 by the Executive Director (Finance and Corporate Resources) was submitted on fraud statistics for the 6 month period to 30 September 2022. Details were given on the number, types, outcomes and costs of fraud investigations, together with performance measures for the 6 month period to 30 September 2022. A comparison with the statistics for the same period in 2021 was also provided. The fraud statistics for the 6 month period to September 2022 highlighted that:- 5
Page 6
164 investigations, with a total value of £128,000, had either been reported in the period or carried forward from 2021/2022, representing an increase in number from the same period in 2021 of the 164 cases, 9, valued at £5,000, had been closed within the period, representing a decrease when compared to the closed investigations for the same period in 2021 33% of cases closed in the period were founded and none of those involved a Council employee 100% of the founded cases related to fraud committed by a third party On conclusion of all internal investigations, an assessment was made on whether an improvement action was necessary and, if required, an improvement plan would be issued containing recommended actions. Improvement plans were agreed with the relevant Heads of Service and the actions followed up by Internal Audit to ensure implementation and that gaps in controls had been addressed. Outcomes for concluded investigations would be reported to the Committee as part of Internal Audit’s annual assurance report. The Council’s Serious and Organised Crime (SOC) Working Group had developed an action plan to address the impact of COVID-19 on SOC and the challenges that this had brought in the short, medium and long-term. The Group had progressed the delivery of various actions which would be revised if new or emerging threats were identified through the pan Lanarkshire Multi Agency SOC Group. Updates would be presented to the Committee periodically. Audit Scotland had published a report in July 2022 entitled Fraud and Irregularity 2021/2022 in July 2022 which had set out a number of key messages and recommendations. The Council’s Fraud Strategy had been reviewed and would be presented to the next meeting of the Committee. The Audit and Compliance Manager responded to members’ questions on various aspects of the report and, where information was not immediately available, undertook to provide this to the relevant members. The Committee decided: that the report be noted. [Reference: Minutes of 26 January 2022 (Paragraph 6)] 7 Update of the 2022/2023 Audit of South Lanarkshire Council and Trusts Registered as Scottish Charities A letter dated 20 February 2023 by Audit Scotland, the Council’s External Auditor, was submitted providing an update on the 2022/2023 audit of South Lanarkshire Council and trusts registered as Scottish charities. The COVID-19 pandemic had continued to impact upon the completion of the 2021/2022 audits with ongoing statutory deadlines. This, combined with the changeover in the appointed auditor, had impacted on the timing of the planning work for the 2022/2023 audits. Planning work for the 2022/2023 audits was at an early stage and, therefore, it had not been possible to present the Annual Audit Plan to the Committee at this meeting. The audit strategy letter highlighted key audit matters which included:- risks best value audit fee and timetable independence and objectivity 6
Page 7
The Annual Audit Plan 2022/2023 would be circulated to members of the Committee by 31 March 2023 once the audit planning procedures had been concluded. The Committee decided: that the information be noted. 8 Forward Programme for Future Meetings A report dated 17 February 2023 by the Executive Director (Finance and Corporate Resources) was submitted on the outline forward programme for the meetings of the Risk and Audit Scrutiny Committee to 30 January 2024. As part of future arrangements, members were invited to suggest topics for inclusion in the Committee’s forward programme. The Committee decided: that the outline forward programme for the meetings of the Risk and Audit Scrutiny Committee to 30 January 2024 be noted. [Reference: Minutes of 6 December 2022 (Paragraph 6)] 9 Urgent Business There were no items of urgent business. 7
Page 8
8
Page 9
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 23 May 2023 Report by: Executive Director (Finance and Corporate Resources) Subject: Review of Counter Fraud, Bribery and Corruption Policy 1. Purpose of Report 1.1. The purpose of the report is to:- [purpose] seek approval of the revised Counter Fraud, Bribery and Corruption Policy [1purpose] 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- [recs] (1) that the Counter Fraud, Bribery and Corruption Policy be approved; (2) that it be noted that the Policy and appendices be uploaded to the intranet and, that separately, the summary document (Appendix 1) ‘Fraud Whistle Blowing for Third Parties’, be uploaded to the Council’s internet; and (3) that the refreshed training approach, as set out at section 5.3 of the report, be noted. 3. Background 3.1 The Council provides a wide range of services to individual South Lanarkshire residents and organisations. As with any large organisation, the size and nature of the Council means that there is always the risk of loss due to fraud and corruption, both internally and externally. This risk is significant as it can adversely affect the delivery of objectives and erode valuable resources. It is, therefore, important that the risk of fraud is soundly managed and mitigated by a number of controls, one of which is a counter-fraud policy. 3.2. South Lanarkshire Council’s Counter-Fraud Policy has been in place for a significant period of time and has undergone a series of revisions. The requirement to amend this policy again to reflect further legislative changes has provided the opportunity to amalgamate various elements of the Council’s Fraud Policy into a single document and to further refine the content. 4. Counter Fraud, Bribery and Corruption Policy 4.1. A copy of the revised Counter Fraud, Bribery and Corruption Policy is attached at Appendix 1. The content remains mainly unchanged other than to present as a single policy in a more concise format. The Policy sets out definitions of fraud and all aspects of fraud management including:- roles and responsibilities of employees and managers fraud detection, investigation and reporting recovery and sanctions 3 9
Page 10
4.2. The over-arching message is one of a commitment to preventing fraud and corruption from occurring, in the first instance, through robust financial and operational controls, to guard against the threat of Serious and Organised Crime and to develop a counter- fraud culture. The risk of fraud is mitigated by a number of controls with a clear process in place to investigate any reported instances of suspected fraud. 4.3. The Council will take, where justified, appropriate disciplinary and legal action in all proven cases and further demonstrates good governance by reporting anti-fraud activity to the Risk and Audit Scrutiny Committee. 4.4. Attached, as Appendix 1 to the Policy, is ‘Fraud Whistle Blowing for Third Parties’. This summary document reflects the main points of the Policy, sets out a process as to how members of the public can raise concerns and details how the Council will respond. 4.5. It is intended to upload the full policy to the Council’s intranet and for the Appendix to this policy to be uploaded to the internet. 4.6. Separately appended to the policy is the proposed Council approach to Due Diligence checks and Anti-Tax Evasion detection. It is proposed that Internal Audit utilise some of the time allocated in the 2023/2024 Internal Audit Plan to anti-fraud checks to provide assurance to the Risk and Audit Scrutiny Committee that policies are being applied in a proportionate and consistent manner. 4.7. The Committee is asked to approve the Policy and note, if approved, the Policy and appendices will be uploaded to the intranet and that the summary document, ‘Fraud Whistle Blowing for Third Parties’, will be uploaded to the Council’s internet. 5. Employee Implications 5.1. Employee roles and responsibilities in the detection, reporting and investigation of fraud are set out in the Policy. 5.2. A Learn on Line fraud course has previously been available to employees. The content of the course was high level and generic to ensure applicable to all Council Services and there has been a reasonable level of completion across Resources. 5.3. The contents of such courses can quickly become outdated as the nature of fraud evolves. Time to regularly review and update these online courses is not considered best use of the resources available nor is this route sufficiently flexible to allow more topical issues to be covered. It is, therefore, proposed that fraud awareness is now raised through periodic bulletins, ‘tool box talks’ and Executive Director briefings. 5.4. The Committee are asked to note this revised approach. 6. Financial Implications 6.1. There are no costs to implement this policy. The application of sound internal controls and anti-fraud checks seek to protect the Council from financial loss. 7. Climate Change, Sustainability and Environmental Implications 7.1 There are no Climate Change, Sustainability and Environmental implications relating to this report. 8. Other Implications 8.1. There are no other implications. 10
Page 11
9. Equality Impact Assessment and Consultation Arrangements 9.1. There is no requirement to conduct a further equality impact assessment on the revised policy. Paul Manning Executive Director Finance and Corporate Resources 5 May 2023 Link(s) to Council Values/Priorities/Outcomes Accountable, effective, efficient and transparent Previous References None List of Background Papers None Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Yvonne Douglas Audit and Compliance Manager Ext: 2618 (Tel: 01698 45(2618)) E-mail: yvonne.douglas@southlanarkshire.gov.uk 11
Page 12
Appendix 1 Counter Fraud, Bribery and Corruption Policy 12
Page 13
Updated May 2023 Index 1 Introduction 2 Counter Fraud Policy Statement 3 Manager and Employee Roles and Responsibilities 4 Fraud Awareness 5 Fraud Risk Management 6 Fraud Detection and Reporting Process 7 Fraud Response Process 8 Investigative Reporting 9 Recovery and Sanctions 10 Manage, Monitor and Review Risks Appendix 1 Whistleblowing Policy for Third Parties 13
Page 14
1. Introduction 1.1 The Council provides a wide range of services to individual South Lanarkshire residents and organisations. As with any large organisation, the size and nature of the Council means that there is always the risk of loss due to fraud and corruption, both internally and externally. This risk is significant as it can adversely affect the delivery of objectives and erode valuable resources. It is therefore important that the risk of fraud is soundly managed. Fraud, theft, organised crime and cyber crime, are recognised as among the top risks facing South Lanarkshire Council. 1.2 South Lanarkshire Council’s Council Plan, Connect 2022-2027 sets out its vision, values and ambitions and what the Council hopes to achieve to improve outcomes for local people over the next five years. 1.3 A counter fraud and anti-corruption policy supports delivery of the Council’s vision, values and ambitions and the required standards of public life. 1.4 The objective of this document is to set out a strategy for delivering counter fraud and corruption work within the Council; to recognise statutory obligations under the Bribery Act; to increase fraud awareness and to minimise the likelihood and extent of losses through fraud and corruption. 1.5 Achievement of this will be through the implementation and application of good practice guidance from relevant counter fraud experts. 1.6 South Lanarkshire Council is committed to preventing fraud and corruption from occurring, guarding against the threat of Serious Organised Crime and to developing a counter-fraud culture. To achieve this the Council will: • develop and maintain effective controls to prevent fraud • ensure that, if fraud occurs, a vigorous and prompt investigation takes place, in line with the Fraud Response Process within this policy • take appropriate disciplinary and legal action in all cases • review systems and procedures and identify improvements to prevent similar frauds • record and report all cases of fraud identified • participate in the National Fraud Initiative (NFI) • enter into information sharing protocols with external parties where appropriate 1.7 The success of this strategy will be measured and reported through six monthly fraud statistics reports to the Corporate Management Team and the Risk and Audit Scrutiny Committee. 1.8 Links to other policies, procedures and guidance are included throughout this document where appropriate. 2. Counter Fraud Policy Statement 2.1 South Lanarkshire Council is committed to preventing fraud and corruption from occurring, guarding against the threat of Serious Organised Crime1 and developing a counter-fraud culture. 1 Serious Organised Crime is the term used to encompass crime which: • Involves more than one person; • Is organised (i.e. involves control, planning and use of specialist resources); • Causes, or has the potential to cause significant harm; and • Involves benefit to the individual concerned, particularly financial gain. 14
Page 15
2.2 There is no one clear definition of fraud. The Serious Fraud Office states that “fraud is a type of criminal activity, defined as an abuse of position, false representation, or prejudicing someone’s rights for personal gain. Fraud is a type of deception intended for personal gain or to cause loss to another party”. 2.3 Within South Lanarkshire Council, fraud is categorised as external fraud or theft, internal fraud and theft, some misconduct issues, embezzlement, bribery, corruption and benefit fraud. 2.4 Corruption is defined as the offering, soliciting or accepting of any inducement or reward which could influence the actions taken by the body, its members or officers. 2.5 The Council adopts a zero-tolerance approach to fraud and corruption through requiring: • No use of Council assets for any purpose other than the delivery of Council objectives and actions without the permission of a senior manager. The guidelines are clearly laid out in the Employee Code of Conduct and the Code of Governance. • All employees to declare any areas of perceived or actual conflict of interest. Where identified, a Declaration of Interest form should be completed. • Due diligence checks to be carried out prior to entering into any contractual arrangement with external suppliers or companies to ensure they are not involved in any illegal activity. 2.6 The Criminal Finances Act 2017 created two new corporate criminal offences in relation to the evasion of UK and of foreign tax which impacts on the Council’s obligations and considerations when carrying out council business. 2.7 The aim of the Council is to minimise losses through fraud and corruption and further embed the management of fraud risk within the culture of the organisation. 2.8 A counter-fraud culture is evidenced in South Lanarkshire Council by: • Encouraging employees and Members to operate with selflessness, integrity, objectivity, accountability, openness, honesty and leadership as set out in The Seven Principles of Public Life. • Conducting Council business in an open and transparent manner and taking all appropriate steps to minimise the risk of bribery through adhering to best practice in bribery prevention. • Employees having, and being seen to have, the highest standards of honesty, propriety and integrity in the exercise of their duties. • Fraud, bribery, impropriety or dishonesty not being tolerated with all instances of suspected fraud, bribery, impropriety, or dishonest conduct by employees or external contractors or clients being investigated. • Employees being required to not defraud the Council, other employees, Council clients, partners or Council contractors, in any way. • Taking action against any employee defrauding (or attempting to defraud) the Council, other employees, Council clients, partners or contractors. This action may include dismissal and/or civil or criminal prosecution. • Taking action against any employee offering or accepting a bribe (or attempting to offer or accept a bribe) from other employees, Council clients, partners or contractors. This action may include dismissal and/or civil or criminal prosecution. • Taking action against external organisations defrauding (or attempting to defraud) the Council. This action may include cessation of contracts and/or criminal prosecution. 15
Page 16
• Taking action against external organisations bribing (or attempting to bribe) the Council. This action may include cessation of contracts and/or criminal prosecution. • Co-operating fully with an external investigating body. • Seeking to recover funds lost through fraud. 2.9 All reported frauds will be investigated. The level of investigation will be determined by the financial and reputational risk to the Council. If required, additional controls may be implemented and/or disciplinary or prosecution processes invoked. All suspected fraud risks will be considered, after evaluation, for inclusion within Internal Audit work plans. 3. Manager and Employee Roles and Responsibilities 3.1 The creation of a counter fraud culture underpins all work to guard against fraud. This Counter Fraud, Bribery and Corruption Policy is endorsed by the Chief Executive, Corporate Management Team and Council Members. 3.2 The Chief Executive has overall responsibility for the operations and activities of the Council and therefore has overall responsibility to ensure the management of fraud. The Chief Executive will lead investigations of all cases of suspected fraud or corruption that involve Elected Members. 3.3 The Executive Director of Finance and Corporate Resources has a statutory duty to ensure adequate financial controls and that these operate effectively throughout the Council. This requires the provision of resources for detection and prevention of fraud. 3.4 All managers are directly responsible for the prevention and detection of fraud within their own areas. They should ensure that there is an adequate and effective system of internal control within their Services and must act on any concerns in line with the Fraud Response Process. 3.5 Internal Audit forms part of the internal control system by providing advice and assistance on control issues, considering the potential for fraud during routine audit work and by reporting on risks to Service managers and the Council’s external auditors. Internal Audit may also liaise with auditors in partner organisations and other local authorities to develop best practice in fraud prevention and detection. 3.6 The Audit and Compliance Manager is the nominated ‘investigations manager’ for the Council; and will determine when it is necessary and appropriate to use the provisions of the Regulation of Investigatory Powers (Scotland) Act 2000 (RIPSA) and the Regulation of Investigatory Powers Act (RIPA) for the purpose of fraud detection. 3.7 All employees should understand the risk of fraud, bribery and corruption faced by the Council, that these risks are serious and that they divert resources away from the Council’s primary objectives. 3.8 Employees should also understand their responsibility in respect of the management of fraud, bribery and corruption. They must have, and be seen to have, the highest standards of honesty, propriety and integrity in the exercise of their duties. Employees are responsible for: • Acting with propriety in the use of Council resources. This is a key requirement of the Council’s Code of Governance. • Reporting details of any suspected fraud, impropriety or other dishonest activity immediately to their line manager. • Assisting in the investigation of any suspected fraud where necessary. 16
Page 17
4. Fraud Awareness 4.1 Documents supporting this policy in relation to the Employee Code of Conduct are available on the intranet for all employees to access and read. Internal Audit will undertake exercises to raise fraud awareness amongst Council employees on a periodic basis. 5. Fraud Risk Management 5.1 The Council has a dedicated Risk Management Service which has the over-arching responsibility to advise on, and oversee risk for the whole organisation, including insurance claims. A Risk Management Strategy has been produced and is available to all employees on the Council’s intranet site. Internal Audit has responsibility to oversee fraud risk management and provides advice and guidance in relation to mitigating risks. It is the responsibility of each Resource, Service and employee to ensure risks are recorded, controlled, mitigated and monitored. Risk identification 5.2 The key steps in the Council’s Risk Management Strategy apply to the management of fraud as for any other risk namely, identify, assess, manage and monitor. Separate Fraud Risk Registers have been developed for all Resources. Fraud Risk Registers are updated on an annual basis in line with Risk Management procedures and will also be used to inform the annual Internal Audit Plan. Fraud Risk Registers should also be updated following any fraud or other significant incident. 5.3 National publications and guidance are also used to identify areas of emerging risk that may be relevant to South Lanarkshire Council. These risks are considered for inclusion within Fraud Risk Registers where relevant. Risk Investment 5.4 Managing the risk of fraud requires some investment but not necessarily significant financial expenditure. Sound management control, considered system and procedural design, encouragement of behaviours which reflect the Employee Code of Conduct, the Code of Governance and a heightened awareness of the risk contribute towards preventing fraud. 5.5 Resources are expected to invest directly in system controls through revenue and capital budgets and indirectly by maintaining fraud awareness amongst employees and management. Resources are also expected to provide deterrents to fraudulent activity through implementation of Disciplinary Procedures where appropriate. 5.6 The Council has provided for Fidelity Guarantees to allow fraud risk transfer to an insurance company. To access such recovery Resources must be able to prove that they had ensured reasonable and robust controls have been applied. 5.7 Incidents of fraud can often have a significant financial impact and it is often difficult to recover the loss. Most incidents are preventable and may fall outside the scope of insurance. If steps are and cannot be taken to recover the loss due to fraud these must then be financed from Service Revenue budgets normally dedicated to service delivery and improvement. It is thus essential that controls are put in place to prevent such loss. 5.8 In addition, the Council invests in an Internal Audit Section who delivers an annual Internal Audit Plan. The Audit Plan contains an allocation of time aimed at fraud detection and prevention. Internal Audit also monitors existing and expected controls to provide an improvement or assurance service to managers and has committed employee resources within the Plan to investigate suspected or actual occurrences of fraud. 5.9 The Internal Audit Plan is approved by the Corporate Management Team and the Risk and Audit Scrutiny Committee each year. Preparation of the plan complies with the Public Sector Internal Audit Standards (PSIAS) and completion of the programme of audit assignments supports the expression of an annual audit opinion. 17
Page 18
5.10 In addition to specific time allocated in the Audit Plan to review and investigate fraud risks, all routine audit assignments detailed in the annual Internal Audit Plan include an element of fraud detection and/or prevention testing. 5.11 Methods used by Internal Audit to detect and prevent fraud include: data matching, Continuous Controls Monitoring (CCM), risk-based audits, provision of advice and guidance and training, dissemination of counter-fraud materials and participation in NFI. 6. Fraud Detection and Reporting Process 6.1 There are various ways that fraud, bribery or corruption may be detected within the Council: • Local management may detect a possible or actual fraud in the normal course of activity or through existing controls. • The Police may uncover a fraud which impacts upon South Lanarkshire Council. Officers at local and divisional level will lodge all intimations or requests for information through the Chief Executive. • Employees and Elected Members may witness an incident. • Through cross matching of data or specific counter-fraud initiatives including the NFI and representation on the Serious and Organised Crime Group (SOCG). • Fraudulent activity may also be intimated by members of the Public or other public bodies as having a potential impact on South Lanarkshire Council business. 6.2 Concerns which should be reported include: • abuse of funds • misconduct • a criminal offence • a failure to comply with a legal obligation • bribery • the deliberate concealment of information tending to show that any of the matters above is being deliberately concealed 6.3 Examples of concerns which should be reported are, employees committing or attempting to commit: • any dishonest or fraudulent act, including abuse of time • forgery or alteration of document or accounts, including false claims for payment • misappropriation of funds, supplies or other assets • impropriety in the handling or reporting of money or financial transactions • profiting from an official position • disclosure of official activities or information for advantage • accepting or seeking value from third parties by virtue of official position or duties • theft or misuse of Council property, facilities or services 6.4 External organisations actions which should be reported include: • bribes or inducements offered by a supplier • fraudulent invoices • misuse of grant funding • suspicions of corruption or deception by a supplier 18
Page 19
• suspicious e-mails or electronic documents received from a supplier • suspicion of any phishing incidences from an external source Procedure to be followed if fraud is suspected 6.5 An employee has the right to report a matter which she/he believes to be in the public interest, to have the report treated confidentially and without fear of prejudice or harassment. The Council accepts that for the reporting process to have credibility, employees must have confidence that any matter which they draw to its attention will be handled with discretion and tact. This applies to concerns relating to fraud and to any other concerns within the context of the Public Interest Disclosure Act 1998.The types of concerns covered under these procedures include fraud as defined above. 6.6 If an employee wishes to report a fraud, they should contact their line manager or Head of Service. If they do not feel this is appropriate, they may contact the Resource Executive Director, the Council’s Monitoring Officer (the Head of Administration and Legal Services), the Audit and Compliance Manager, Personnel Services Fact Finding Team, Trade Union representatives or the Chief Executive. 6.7 Initial contact may be made in person, by telephone, email or in writing. Anonymous reports will be accepted and followed up by Internal Audit where possible, however, employees should avoid reporting suspected frauds anonymously if possible as this could hinder the investigation if further information is required. 6.8 Once an employee has made a report, he/she will be updated as soon as practicable on the Council's response. 6.9 All reports of suspected fraud against the Council will be treated seriously and will be reported to Internal Audit. 6.10 Fraud is a complex area; it is therefore important that the correct action is taken as failure to do so may compromise a later investigation and invalidate evidence. It is therefore important that employees: • do not attempt to conduct an investigation into the suspected fraud • do not approach the person, people or organisation suspected of the fraud and instead report concerns as specified within these procedures • do not attempt to collect evidence or question anybody, but if documents etc. are held which are thought to be relevant, ensure they are secured safely • do not discuss the case with other colleagues • do not post any detail or comments on social media as this may hinder or invalidate the investigation and will result in disciplinary • do make a note of times, dates and details of anything thought to be relevant 6.11 If an employee is unsure about what has been seen or heard they should ask for advice from their line manager, Head of Service, Executive Director, the Council’s Monitoring Officer, the Audit and Compliance Manager or their trade union representative. 6.12 Wherever possible, the Council will strive to ensure that all cases of suspected fraud reported are treated confidentially. However, in some cases, for example where the matter requires to be reported to the Police if it relates to criminal activity, it may not be possible to preserve anonymity. 6.13 The Public Interest Disclosure Act 1998 provides protection for workers who make certain disclosures of information about misadministration or malpractice in the public sector. 6.14 Regardless of the outcome of an investigation, employees making a confidential report will be protected by legislation against being subjected to any detriment such as dismissal, 19
Page 20
harassment, victimisation, or any other form of punitive sanction provided the disclosure was made in good faith. 6.15 However, if an employee acts purely on some ulterior motive and it has been proven that they deliberately or maliciously made false accusations they may lose the protection of the Act and may be liable to action under the Council’s disciplinary procedures. Procedure to be followed by managers when fraud is reported 6.16 Heads of Service are responsible for putting procedures in place to ensure matters regarding fraud within their Service are reported to them. 6.17 The Head of Service or their nominee, should email details of the fraud to Internal Audit at fraudenquiries@southlanarkshire.gov.uk within 24 hours of them becoming aware of an incident occurring or being suspected. 6.18 On being informed by an employee of a fraud incident occurring or suspected it is important that the manager receiving the information deals with it appropriately. In particular, the manager should: • deal with the employee giving the information in a way that shows that their concerns are being taken seriously • not belittle or dismiss the information as set out above • respect, as far as possible, the confidentiality of the employee • attempt to identify where any evidence may be but do not attempt to obtain it, or question anybody • follow the procedure for passing the information on, namely to the Head of Service, a designated senior manager or Internal Audit 6.19 If a manager identifies a fraud through another means, for example through routine management checks or from a third party, they should: • follow the guidelines • attempt to identify where any evidence may be but do not attempt to obtain it, or question anybody • follow the procedure for passing the information on, namely to the Head of Service, a designated senior manager, the Fact Finding Team or Internal Audit 6.20 Line managers should not carry out their own investigations before informing Internal Audit, through their Head of Service or relevant other senior manager, as this may compromise a later investigation, invalidate evidence, and consequently allow a guilty person to get away with a possible crime. 6.21 Where it is suspected that a theft has occurred and it is believed that the stolen item may still be on the premises, it may be necessary to carry out searches. If searches are to be conducted in areas where employees may hold personal belongings, for example desk drawers or cabinets which are also used for business purposes, the employee must be advised that a search is about to be undertaken and asked to remove personal belongings prior to the search taking place. The employee may also be asked to show the contents of other personal belongings, for example a handbag or briefcase. Searches of this kind can only be undertaken with the full consent of the employee and should be avoided where possible. In addition, employees may be requested to remain in the office until searches have been carried out, however, you cannot detain an employee without their full and prior consent. 6.22 All searches should be sanctioned by the Head of Service and should be carried out jointly by Internal Audit and either the Head of Service or a relevant other Senior Manager provided this does not prejudice the investigation. 20
Page 21
6.23 Immediate action, such as removal of a person from the workplace by the Head of Service or other senior manager, should only be taken where an employee or a third party is caught committing an offence, or there is a risk that evidence will be destroyed for example something illegal on a computer. Removal of an employee from the workplace should be carried out in consultation with Personnel Services. 6.24 Where an employee is suspected of committing fraud, the Head of Service may remove that person from the workplace or redeploy to alternative duties or location. This should only happen after due consideration of the guidance within the Disciplinary Procedures. However, Internal Audit and the Executive Director, Finance and Corporate Resources must be advised of the action taken. Internal Audit must be advised of any action taken by the Head of Service as soon as possible. Third Party Whistleblowing procedure 6.25 The Council is committed to dealing, on a confidential basis, with any allegation of material fraud or malpractice brought to its attention by any contractor, supplier, organisations, or by the public. Fraud Whistle Blowing for Third Parties procedures are in place that provide a means where such matters can be brought to the attention of the Council (Appendix 1). Third parties can also report concerns to the Council through the Customer Relationship Management system (CRM) on 0303 123 1015. 6.26 Information on reporting Benefit Fraud can be found here. Contacts: Audit and Compliance Manager Council Offices Beckford Street Hamilton Email: fraudenquiries@southlanarkshire.gov.uk Council’s Monitoring Officer Head of Administration and Legal Services Council Offices 2nd Floor Almada Street Hamilton Telephone: 01698 454658 6.27 Internal Audit will assess all reported frauds as detailed in the approved Internal Audit Procedures. This assessment will determine the next course of action and is based on the circumstances of the incident, the risk associated with the incident, the information available and the resources available to investigate. It is therefore imperative that as much detail as possible is reported. 6.28 Elected Members and members of the Public Elected Members and members of the public can report any concerns in relation to fraud, bribery and corruption using the following email address fraudenquiries@southlanarkshire.gov.uk. 7. Fraud Response Process 7.1 All investigations will be completed in line with Internal Audit’s terms of reference. Internal Audit may lead or pass to Services to investigate. 7.2 Joint investigations may also be carried out by Resources and Internal Audit depending on the nature of the fraud and the operational knowledge required. 21
Page 22
7.3 The Fact Finding Team within Personnel Services will undertake all investigations relating to employee conduct. Internal Audit will maintain contact with the Fact Finding team to ensure that input into investigations is provided where required and may also take part in a Fact Finding interview. 7.4 Discipline and Grievance Procedures will be invoked in consultation with the Fact Finding Team where required. 7.5 In order to conduct the investigation effectively, Internal Audit is permitted: • unrestricted access to employees, senior management, including the Chief Executive, Heads of Service and Elected Members • unrestricted access to all necessary Council records, IT systems, cash, stores and other assets • unrestricted access to Council property • access to other Council personnel in order to obtain necessary explanations 7.6 Investigative techniques such as data matching may be used in fraud investigations. In certain investigations covert surveillance may also be used to detect fraud but will be the last course of action to be considered and will be subject to the provisions of RIP(S)A and RIPA legislation. 7.7 Having been informed of a suspected or actual fraud, the Audit and Compliance Manager, after an appropriate level of consultation between the Audit Adviser, the nominated Resource contact and the Fact Finding Team (where appropriate), will decide on the scope of and the responsibility for any investigation. 7.8 The options will be; to take no action; to immediately inform the Police; to appoint an auditor to determine the facts of the allegation; to refer the matter to Resource management for further investigation or to refer the matter to the Fact Finding Team. Depending on circumstances, it may be necessary to undertake joint investigations with the Fact Finding Team and/or involve officers or external professionals with relevant technical expertise to assist. Skills needed to preserve evidence may sometimes be a specialism which only trained officers for example IT Professionals or the Police can provide. 7.9 Internal Audit will ensure that the Fact Finding Team is aware of all ongoing investigations, provided this does not prejudice the investigation. Separate arrangements are in place to ensure all relevant information on ongoing investigations is shared between Internal Audit and the Fact Finding Team. N.B. Internal Audit is entitled to access files and make enquiries of individuals to initially establish the facts of any incident. This entitlement is enshrined within the Internal Audit Charter and is not part of the disciplinary process. Individual’s rights will, however, be respected. 7.10 The level of investigation will be proportionate to the perceived level of risk or concern. The objective, scope and expected outcomes will be laid out in an audit remit approved by the Audit and Compliance Manager, regardless of where the responsibility lies to investigate. 7.11 Updates for Resource investigations will be requested by Internal Audit on a regular basis up to the due date for completion as per the remit. This will be dependent on the time allocated to the investigation. A suitable timescale for updates will be agreed with the Resource for investigations expected to be completed in less than one month. 7.12 Resource updates can take the form of a briefing note prepared by the Resource contact or by a telephone call made to the Resource contact by the auditor responsible for the investigation. 22
Page 23
7.13 The relevant Resource Manager will formally report to Internal Audit on the outcomes on completion of an assigned investigation. This may indicate that the Head of Service has decided to commence disciplinary procedures where employees are suspected of involvement in the fraud. In this case a further formal intimation to Internal Audit is required to notify the outcome of the disciplinary process when completed. 7.14 Where the investigating Resource is not instigating disciplinary procedures, Internal Audit reserves the right, on receipt of the Resource report, to undertake or request further work or to refer the matter to the Police at this stage. The investigation may be closed at this stage if the allegation is unsubstantiated, or evidence is weak. Executive Directors and Heads of Service may be consulted at this stage. 7.15 Internal Audit does not take decisions on disciplinary action and will refer to the Fact Finding team for consideration. 7.16 Where Internal Audit is investigating, auditors may conclude their work after only preliminary investigation. At this point a report, memo or letter outlining findings and providing an audit opinion will be supplied to the Resource Head of Service. 7.17 Where more in depth investigative work is undertaken by Internal Audit, a formal audit report will be produced for Resource Management outlining findings, providing an audit opinion and detailing recommendations where necessary. 7.18 For any investigation Internal Audit may also undertake procedural or analytical reviews or exploration of the circumstances that led to the fraud. This will be appropriate to the level of concern. 7.19 Investigation reports will be prepared by Internal Audit or by the appointed Resource investigating officer. The investigation report will present the facts obtained during the investigation. It is the responsibility of the Head of Service, or nominated officer, to assess the findings and decide whether it is necessary to start disciplinary proceedings. 7.20 Advising employee(s) on the outcome of investigations is the responsibility of the Head of Service or the nominated officer. 7.21 If disciplinary procedures are invoked, the Council’s approved policy and procedures will be followed with the investigating officer presenting the case on behalf of management. The role of Internal Audit during disciplinary hearings is restricted to that of a witness, to discuss the audit findings contained within the report. Only where the complete investigation has fallen entirely within the remit of Internal Audit will the auditor assume the role of investigating officer. 7.22 Where a material crime has been committed or suspected, the Police will be contacted by the Audit and Compliance Manager after seeking approval from the Chief Executive. No approach will be made to the Police regarding suspicions of fraud, corruption or irregularity, except by the Chief Executive or other person acting on the Chief Executive’s authority. The Audit and Compliance Manager will be informed where this authority is given. Full co- operation will be given to the Police while they conduct their enquiries. 7.23 Only where there has been a break-in and this may result in an insurance claim against the Council or where a crime has been committed against an individual for example personal injury should Resource employees call the Police directly. 7.24 The decision to refer the matter to the Police has no bearing on internal investigations, the decision reached by the Disciplining Officer, or the justification to be relied upon before an Appeals Panel. Internal investigations may proceed during Police enquiries unless the Police intimate otherwise. 7.25 Any disciplinary action, fraud or crime which has been identified must remain confidential. Where there is the possibility that information may be made public, no employee should 23
Page 24
speak to press or upload information on any social media channels. All public information should only be provided by the Media team within Finance and Corporate Resources. 8. Investigative Reporting 8.1 Investigative reports or Internal Audit Memos are prepared for each incidence which occurs. The reports or memos will be used to inform Service Managers and Heads of Service of expectations for improvements or to inform future detection and prevention work primarily within the annual Fraud Control Plan. 8.2 All risks, whether suspected or occurring will be recorded in the Resource Fraud Risk Registers within the Council’s Risk Management system. This provides a key record of the identification of the risk of fraud and completes the risk management cycle. Fraud Risk Registers should be updated to reflect any fraud detected and to record additional or new controls required. 8.3 Internal Audit, on an annual basis, advises the Council’s External Auditors of all frauds of £5,000 and above. 8.4 Fraud statistics reports are prepared by Internal Audit and presented to the Corporate Management Team (CMT) and the Risk and Audit Scrutiny Committee (RASC) on a six monthly basis. The reports detail the number and types of fraud investigated by the Council and a comparison with previous period. 9. Recovery and Sanctions 9.1 The Council will take, where justified, appropriate disciplinary and legal action in all proven cases. 9.2 Every opportunity will be taken to recover any loss as a result of fraud. It may be possible to recover the loss directly from the employee, contractor or client who acknowledges his or her guilt. Arrangements made for recovery do not in any way lessen the crime. However, an attempt by the employee, contractor, or client to restore the loss may lead to a more favourable outcome should the case be taken to court. 9.3 The ultimate source of recovery may be through an insurance claim. Contact should always be made with the Council’s Insurance Officer to ascertain whether a claim is relevant for any losses not recovered by other means. 9.4 Recovery, where possible, will be dealt with by the relevant Resource in consultation with Personnel Services, Legal Services and Internal Audit. The amount recovered may be split between the Resource and Internal Audit depending on the Internal Audit resources required for the investigation. This will be subject to agreement by the relevant Executive Directors. 10. Manage, Monitor and Review Risks 10.1 Management of the risk of fraud, through internal and system control, is important. Internal Control is a management responsibility. 10.2 Controls depend on the nature and the evaluation of the risk but there are a number of well recognised internal controls that line managers are expected to implement to prevent or control the level of fraud within their Service. The most common are: • clear written rules and procedures which are regularly updated • monitoring and spot checks on procedures and systems • robust pre-employment checks, for example, qualifications and references 24
Page 25
• avoiding accumulation of backlogs • designing safeguards against fraud within new systems/processes • a committed response to any allegation of fraud reported • reviewing and changing systems and procedures after any incident of fraud 10.3 The Internal Audit Plan provides an element of monitoring of the controls over fraud risks. Reports resulting from completion of the audit plan identify new risks or provide a level of assurance on how well controls are working. Improvements in controls may be required and audit recommendations will be routinely followed up to monitor the level of implementation. 10.4 This policy will be reviewed on an annual basis and updated where required. For more information or if you want this information in a different format or language, please email Internal Audit at: fraudenquiries@southlanarkshire.gov.uk. 25
Page 26
Finance and Corporate Resources Appendix 1 Fraud Whistle Blowing for Third Parties May 2023 26
Page 27
1 Introduction 1.1 South Lanarkshire Council is committed to ensuring probity and accountability in all its activities. The Council has a Counter Fraud, Bribery and Corruption Policy that requires individuals and organisations with which the Council deals to behave towards the Council with integrity. 1.2 The Council is also committed to dealing, on a confidential basis, with any allegation of material fraud or malpractice brought to its attention by any contractor, supplier, organisation, or by the general public. Such allegations may concern the conduct of those acting in the name of the Council or contractors, suppliers, or members of the public, where they involve misuse of Council assets or budgets. 1.3 Examples of employee concerns which should be reported include but are not limited to: • profiting from an official position • disclosure of official activities or information for advantage • accepting or seeking value from third parties by virtue of official position or duties • theft or misuse of Council property, facilities or services 1.4 External organisations actions which should be reported include but are not limited to: • bribes or inducements offered by a supplier • misuse of grant funding 1.5 This Fraud Whistle Blowing Policy for Third Parties lays out the procedures whereby such matters can be brought to the attention of the Council. 2 Handling Reported Incidents 2.1 South Lanarkshire Council will take seriously, all material matters raised in good faith by third parties. 2.2 Once a concern has been raised, the Council will assess the action that should be taken in line with our investigative protocols and procedures. 2.3 If the person raising the concern has provided contact details, they will be informed, within a reasonable period of time, as to how the matter is being handled and whether further assistance will be required from the whistle-blower. 2.4 It is not necessary for the person raising the concern to provide contact details as all concerns raised in good faith will be taken seriously. However, it may be helpful to the successful conclusion of the investigation if the person reporting a concern is able to provide further details if required. Their identity will not be revealed outside Internal Audit, who will investigate the concern in accordance with the Council’s Fraud Response Process. 2.5 If the person raising the concern has any personal interest in the matter, they must tell the Council at the outset. If they do not, and the interest becomes apparent later, the failure to declare an interest may affect the Council’s conclusion of the investigation. 2.6 Feedback will be provided to the person raising the concern where appropriate, provided their identity is known. 2.7 If requested, the Council will provide a written update on the progress of the investigation. Notification will be also given when the investigation has been completed. 2.8 Please be aware that the Council may not be able to divulge the precise action taken, or give detailed results of an investigation, where this might: • infringe a duty of confidence owed by the Council to another person or organisation • prejudice the investigation 27
Page 28
• result in a breach of either the Human Rights Act or Data Protection legislation. 3 Raising a Concern 3.1 Concerns should be raised, either: • in writing, addressed to the Executive Director of Finance and Corporate Resources, for the attention of the Audit and Compliance Manager, Council Offices, 4th Floor, Almada Street, Hamilton, ML3 0AB; or • by emailing the Council’s Internal Audit Section: fraudenquiries@southlanarkshire.gov.uk • by telephoning the councils whistleblowing line CRM 0303 123 1015 • benefit fraud can be reported to the DWP at www.gov.uk/report-benefit-fraud. 3.2 If a correspondent wishes their concern to be treated in confidence, this should be intimated at the outset, so that the appropriate arrangements to protect anonymity can be put in place. 4 Further Action 4.1 The policy aims to provide assurance to anyone who raises a concern, in good faith, that it will be fully and impartially investigated. While the Council cannot guarantee that it will respond to all matters in the way that the person raising it might wish, it will try to handle any concern expressed by a third party fairly and properly. However, should anyone be dissatisfied by the Council’s response to their concerns they can share their concerns with: Scottish Public Services Ombudsman Bridgeside House 99 McDonald Road Edinburgh EH7 4NS Audit Scotland 4th Floor 102 West Port Edinburgh EH3 9DN For more information or if you want this information in a different format or language please email Internal Audit at fraudenquiries@southlanarkshire.gov.uk 28
Page 29
Finance and Corporate Resources Appendix 2 Due Diligence Policy May 2023 29
Page 30
Due Diligence Policy Background South Lanarkshire Council have developed a policy that reflects the principles of the Due Diligence guidance issued by HMRC. HMRC’s strategy recognises that organisations may have people working for them directly or indirectly via third parties (via contractors, sub-contractors, agencies, via intermediaries etc) and, as such, organisations should have arrangements in place to ensure that they are not entering into contracts; getting involved with criminals or high risk individuals; or using (albeit indirectly) illegal workers or workers that are being exploited. South Lanarkshire Council could face reputational damage if they contract with organisations that are involved in exploitation or illegal, criminal or fraudulent activity. Operational delivery could be impacted if labour supply is interrupted and costs incurred (for fines and potential recovery of taxes not paid by others in the supply chain) should HMRC find non-compliance. HMRC Guidance HMRC guidance sets out expectations that organisations carry out their own checks on the integrity of labour supply, and the third parties involved in the supply, and do not simply rely on assurances from organisations. These checks are commonly known as ‘due diligence’ and provide assurance that organisations are legitimate (and not high risk), are treating/paying their employees correctly and are paying all taxes due. Application of the guidance within South Lanarkshire Council Robust due diligence helps to mitigate the risks and satisfy legal requirements for checks on labour. South Lanarkshire Council have embedded proportionate checks within existing processes supported by (but not limited to): • clauses within contracts to require compliance with legal obligations and HMRC requirements • completion of Serious Organised Crime Agency checks ahead of contract award • utilisation of the ‘Single Procurement Document’ to allow the Council to identify suitably qualified and experienced bidders with questions on both exclusion and selection criteria • application of off-payroll working rules (known as IR35) • application of standard procedures around the adoption of new suppliers and undertaking of certain transactions South Lanarkshire Council will continue to develop and embed due diligence checks within processes in line with best practice. Any queries or requests for assistance in relation to this policy should be forwarded to fraudenquiries@southlanarkshire.gov.uk. 30
Page 31
Finance and Corporate Resources Appendix 3 Anti-Tax Evasion Policy May 2023 31
Page 32
Anti-Tax Evasion Policy Introduction The Criminal Finances Act 2017 created two new corporate criminal offences: • the facilitation of UK tax evasion • the facilitation of foreign tax evasion Tax evasion is defined as the deliberate and dishonest evasion of tax or taking steps to enable another person to evade tax. Tax is defined widely to cover all forms of UK taxation including corporate tax, income tax, VAT, stamp duty, NI contributions etc. Evidence of tax evasion can take many forms but some scenarios which may suggest this are as follows: • payment of a substantial sum in cash • a refusal to provide requested information without good reason • transactions within countries identified as not having robust anti-money laundering or counter-terrorism financing arrangements or those where there are sanctions or embargoes or similar measures imposed Obligations of the Council This policy sets out the proportionate anti-tax evasion safeguards that South Lanarkshire Council has put in place. Due Diligence Process An appropriate due diligence process is in place and is followed when dealing with new suppliers or undertaking certain transactions. Nominated Officers A nominated officer has been appointed to which any suspicions of tax evasion can be reported. In South Lanarkshire Council this is the Audit and Compliance Manager who should be notified of any concerns around suspected tax evasion at fraudenquiries@southlanarkshire.gov.uk. Reporting Procedure All known or suspected anti-tax evasion incidents relating to the Council should be reported to the nominated officer who will review the information and, where relevant, complete the Anti-Tax Evasion reporting form and send to HMRC. All documentary evidence collected by the nominated officer will be retained in line with the Council’s retention policy. Staff training Staff training in this policy will be included within anti-fraud training. For any further queries or assistance, please contact the nominated officer at the email address above. 32
Page 33
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 23 May 2023 Report by: Executive Director (Finance and Corporate Resources) Subject: Internal Audit Activity as at 5 May 2023 1. Purpose of Report 1.1. The purpose of the report is to:- update the Committee on progress of the Internal Audit service in the period 18 February to 5 May 2023 provide an update on progress with the external assessment of the Council’s internal audit function’s level of compliance with the Public Sector Internal Audit Standards (PSAIS) 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- (1) that progress be noted. 3. Background 3.1. Findings from internal audit assignments are reported to the Committee throughout the year. The last progress report to the Committee was in March 2023 and reported on work completed in the period 19 November 2022 to 17 February 2023. This report covers all work completed in the period 18 February to 5 May 2023. Performance information is also included. 4. Delivery of the Internal Audit Plan: Progress 4.1. As at 5 May 2023, 94% of the 2022/2023 Audit Plan was complete with 3 assignments still work in progress at that date. 4.2. Key performance indicators reflecting quality, on time and within budget for the 2022/2023 Internal Audit Plan are being collated and will be presented in the 2022/2023 Internal Audit Annual Assurance Report. It is anticipated that all targets will be met. 4.3. Appendix 1 lists all assignments completed in the period 18 February to 5 May 2023 together with a summary of overall assurances from each area of work. These relate, in the main, to areas where work has been completed throughout the financial year. 4.4. Members are asked to note progress. 5. Glasgow City Region City Deal – Internal Audit Plan 2022/2023 5.1. At the May 2023 Cabinet meeting of the Glasgow City Region City Deal, audit reports were presented on; the Internal Audit Plan for 2023/2024; Change Control 4 33
Page 34
and Contract Management (Phase 2); Project Procurement Strategies and Follow Up work. A link to these reports can be found here. 5.2. The report on the Internal Audit Plan for 2023/2024 presented and sought approval of a proposed routine programme of work that included an assignment on the new Shared Prosperity Fund for the first time. 5.3. The second report on Change Control and Contract Management (Phase 2) set out findings from a review of change control processes to provide assurance that these comply with local tolerances and delegated authority levels, that requests contain sufficient detail and have been appropriately authorised and, that contract management arrangements within member authorities, are effective. The audit concluded that, overall, reasonable assurance can be placed on the control environment as set out above. 5.4. The Project Procurement Strategies audit reviewed the project procurement strategies to gain assurance that strategies aim to achieve competitive bids and ensure value for money during procurement exercises and that sufficient and appropriate controls were in place in relation to procurement. The audit concluded that, overall, reasonable assurance can be placed on the control environment as set out above but that there was scope for improvement in the existing arrangements. Two audit recommendations were made. 5.5. The final audit reported on follow up of previous audit actions that fell due in the period to April 2023 and confirmed that all 5 actions had been implemented. 6. Public Sector Internal Audit Standards – External Review 6.1. The external review is in progress and is expected to conclude by the end of this month. The Committee was advised in March 2023 that the findings from the review would be reported in June 2023 and Members are being asked to note progress to date. 7. Chief Internal Auditors Group 7.1. Throughout the year the Chief Internal Auditor’s Group has convened meetings that have provided an opportunity to share best practice and attend presentations on topical issues. 7.2. A copy of the 2022/2023 annual report is attached at Appendix 2 setting out the Group’s activities during the year. Attendance at these meetings is sometimes extended to the wider Internal Audit teams within Local Authorities and this has proven to be a positive development. 7.3. Where the opportunity is provided, the meetings have been well attended by the Internal Audit team within South Lanarkshire helping to build a greater awareness and understanding of key risk areas. 8. Progress against Strategy 8.1. The PSIAS require progress against the audit strategy to be monitored and reported to the Committee as part of regular monitoring reports that are presented at each meeting. 8.2. Delivery of the strategy in 2022/2023 has been evidenced by the completion of the Internal Audit Plan in year monitored during the year by performance indicators which have been regularly reported to the Committee. 34
Page 35
9. Employee Implications 9.1. There are no employee issues. 10. Financial Implications 10.1. The confirmed final financial position for the Internal Audit function for 2022/2023 is a marginal overspend that reflected lower than anticipated fees from external clients. 11. Climate Change, Sustainability and Environmental Implications 11.1 There are no Climate Change, Sustainability and Environmental implications relating to this report. 12. Other Implications 12.1. The main risks to the delivery of the Audit Plan are, generally, vacancies and team up-skilling requirements, unforeseen service demands and delays with client sign-off. These have been mitigated by coaching and training, regular meetings and escalation processes as well as inclusion of contingency time within the annual plan. The risk of significant, subsequent amendments to the Plan, arising from a change in the Council’s priorities or risks, were reduced given the approach in 2022/2023 that has allowed capacity and content to be reassessed mid-year. 12. Equality Impact Assessment and Consultation Arrangements 12.1 There is no requirement to equality assess the contents of this report. 12.2. Heads of Service are consulted on each and every audit assignment. Paul Manning Executive Director Finance and Corporate Resources 5 May 2023 Link(s) to Council Values/Priorities/Outcomes Accountable, effective, efficient and transparent Previous References 2022/2023 Internal Audit Plan, 26 January 2022 Internal Audit Activity as at 17 February, 7 March 2023 List of Background Papers Figtree extracts of Action Plans Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Yvonne Douglas, Audit and Compliance Manager Ext:- 2618. (Tel:- 01698 452618) E-mail:- yvonne.douglas@southlanarkshire.gov.uk 35
Page 36
Assignments completed 18 February to 5 May 2023 Appendix 1 Job Number Assignment name Draft Issue Final Issue Assurance Info Current Year I411089 Informal Follow-up 2022/2023 31/03/2023 31/03/2023 Provided quarterly advance prompts of actions falling due. Collated responses monthly for reporting. I612201 Continuous Control Monitoring (CCM) 31/03/2023 31/03/2023 Completion of programme of data downloads from main financial systems during 2022/2023 to inform audit sampling and provide management reports. I823036 Committee Reporting 31/03/2023 31/03/2023 Provision of reports to Committee. I730070 Attend Business Process Review Group 31/03/2023 31/03/2023 Attendance at and participation in internal working group. I730071 Attend Procurement Working Group 31/03/2023 31/03/2023 Attendance at and participation in internal working group. I732072 Attend Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) 31/03/2023 31/03/2023 Attendance at and participation in external working groups. I737069 Attend Risk Sponsors Group 31/03/2023 31/03/2023 Attendance at and participation in internal working group. I720075 Fusion 31/03/2023 31/03/2023 Participation in Fusion project. I250115 City Deal 31/03/2023 31/03/2023 Collation of actions falling due in 2022/2023. I640196 National Fraud Initiative (NFI) 31/03/2023 31/03/2023 Facilitate and administer NFI exercise. I731068 Attend Information Governance Board 31/03/2023 31/03/2023 Attendance at and participation in internal working group. I732073 Attend Scottish Local Authorities Investigators’ Group (SLAIG) 31/03/2023 31/03/2023 Attendance at and participation in external working groups. I732074 Attend Computer Audit Sub-Group (CASG) 31/03/2023 31/03/2023 Attendance at and participation in 36
Page 37
external working groups. I261111 Interim data for External Audit 31/03/2023 31/03/2023 Provision of interim data to External Audit re 2022/2023 financial year end. I650206 Fraud Risk Register Review 31/03/2023 31/03/2023 Evidence of review and update across all Resources. I710078 Advice and Guidance re extended use of Purchase Cards 31/03/2023 31/03/2023 Guidance provided. External Clients I924207 LVJB Follow Up 01/02/2023 01/02/2023 Reported to LVJB I923203 LVJB Canvass data match 20/02/2023 21/03/2023 Reported to LVJB I923204 LVJB Governance checks 14/03/2023 21/03/2023 Reported to LVJB I921210 LVJB Admin 2022/2023 31/03/2023 31/03/2023 Reported to LVJB I925205 LVJB Shared systems 31/03/2023 31/03/2023 Reported to LVJB I926206 LVJB Fraud Alerts 2022/2023 31/03/2023 31/03/2023 Reported to LVJB I910192 South Lanarkshire Leisure and Culture (SLLC) Admin 31/03/2023 31/03/2023 Reported to SLLC I913195 SLLC Shared Systems 31/03/2023 31/03/2023 Reported to SLLC I913201 SLLC Oracle Fusion 31/03/2023 31/03/2023 Reported to SLLC I914197 SLLC Follow Up 31/03/2023 31/03/2023 Reported to SLLC I916198 SLLC Fraud Alerts 31/03/2023 31/03/2023 Reported to SLLC 37
Page 38
Appendix 2 ANNUAL REPORT FROM THE CHAIR – 2022 “WORKING TOGETHER TO SUPPORT THE KEY ROLE OF INTERNAL AUDIT” 1. INTRODUCTION 1.1 Membership of the CIPFA Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG) is open to the chief internal auditor from each Scottish local authority and the Strathclyde Partnership for Transport (SPT). SLACIAG is a Special Interest Group of CIPFA in Scotland, with operational arrangements, vision, and objectives set out in a formal Constitution. 1.2 The Group’s vision is to be the voice of internal audit across Scottish local authorities and a driving force for best practice in respect of local authority and public transport bodies internal audit, governance, and operations. In support of that vision the Group has the following objectives: • to secure a quality and responsive service for members of the group; • to develop the influence of the group with key decision makers and institutions in Scotland, as the key representative body for internal audit in local government with a particular emphasis on governance, risk, control and assurance matters; • to strengthen links and build long term relationships across the internal audit community within the public service; • to provide an effective group for the discussion of issues of common concern, sharing of good practice and commissioner of work to develop advanced practice; • to consider the development and training needs of our people as a collective to ensure that the best available products are procured at the best price; • to uphold the group’s key values including: respect; openness and honesty; adding value; professional team working; sharing best practice; integrity; continuous improvement. 1.3 The purpose of this annual report to key stakeholders is to provide an update on the Group’s activities and achievements over the course of 2022 and to recognise actions required to achieve its vision. 1.4 SLACIAG has two sub-groups whose activity is also reflected in this report: • the Computer Audit Sub-Group (CASG); and • the Scottish Local Authorities Investigators’ Group (SLAIG). 38
Page 39
2. MANAGEMENT COMMITTEE 2.1 I, Jill Stacey, Scottish Borders Council, was appointed Chair of SLACIAG at the AGM on 11 March 2022. I previously served as Chair of SLACIAG during 2014-2015. In accordance with SLACIAG’s Constitution, my term of office will expire after serving 2 years at our AGM in March 2024. New members were welcomed to the Management Committee, with former Chairs providing valuable continuity. As SLACIAG is a special interest group of CIPFA in Scotland there is an expectation that the SLACIAG Chair joins the meetings of the CIPFA Scotland Branch Executive Committee. It was agreed that the Eilidh Mackay, East Ayrshire Council (former Chair 2019-2020), would continue to perform that function in my stead. 2.2 There were four Management Committee virtual during 2022 in January, May, July and October. The purpose of these meetings is to reflect on learning and review actions arising from past meetings in order to forward plan meetings, considering topics, setting dates and arranging speakers. 2.3 The Management Committee also oversees the External Quality Assessment (EQA) process, which is a peer review process established by SLACIAG to enable external validation of compliance with the Public Sector Internal Audit Standards (PSIAS). The Management Committee monitors progress with completion against a recommended programme of reviews each year to ensure that all participating organisations comply with the requirement to undertake an EQA once every 5 years. 2.4 The Management Committee at AGM March 2022 was constituted as follows: SLACIAG MANAGEMENT COMMITTEE 2022 Jill Stacey Scottish Borders Council Chair SLACIAG Yvonne Douglas South Lanarkshire Council Treasurer SLACIAG Eilidh Mackay East Ayrshire Council member and former Chair Kenneth Ribbons West Lothian Council member and former Chair Pamela Redpath Fife Council member Gillian McConnachie East Dunbartonshire Council member Duncan Stainbank East Lothian Council member Duncan Black Glasgow City Council member Peter Moore East Lothian Council Chair CASG Barry Moncur East Dunbartonshire Council Chair SLAIG 2.5 It has been an ongoing challenge in recent years to ensure that the Management Committee has a full complement of office bearers, in particular a Vice Chair and Secretary. Members of the Management Committee have taken turns to assist with preparing Agendas and taking Minutes/Action Notes. The SLACIAG Constitution needs to be amended to formally reflect this adopted practice. 2.6 The Chairs of both CASG and SLAIG have attended the SLACIAG Management Committee to enable us to benefit from their sectoral expertise and to ensure synergy. The SLACIAG Constitution needs to be amended to formally reflect this. This will ensure that the SLACIAG Constitution remains fit for purpose going forward. 39
Page 40
3. SCOTTISH LOCAL AUTHORITIES CHIEF INTERNAL AUDITORS GROUP (SLACIAG) 3.1 There were four SLACIAG virtual meetings in 2022 with topics/speakers as follows in addition to core business: Date Topics / Speakers 11 March 2022 Update from the Chartered Institute of Internal Auditors (CIIA) • Graham Gillespie, former Chair of the Scottish Region Committee, and Partner at Wyllie Bissett Data Analytics • Derek Jamieson, Director, Regions, Chartered Institute of Internal Auditors North Ayrshire Performance Dashboard • Craig Valentine, Team Manager / ICT; Dyllan North, Snr Tech Officer / ICT , and Isla Hardy, Corporate Policy & Performance Officer, all North Ayrshire Council Police Scotland – Serious Organised Crime overview • Ricky Hutton, Police Scotland 17 June 2022 Scottish Government Business Support Funding: Fraud Risks and Counter Fraud Controls • Zac O'Neil, Head of Counter Fraud Profession at the Scottish Government CIPFA new Position Statement covering audit committees in UK local government bodies • Diana Melville, Governance Advisor at CIPFA Breakout Session to discuss CIA Issues and Challenges Three separate groups to discuss key issues facing our internal audit functions, including hybrid working, workforce planning and the skills mix of audit committees, and to share approaches being taken to address these. 16 September 2022 Overview from CIPFA (technical accounting issues; internal audit; economic pressures; anti-corruption; leadership; “micro-modules” free training resources on CIPFA website) • Kirsty Stanners, Head of Policy and Technical CIPFA Breakout Session to discuss Audit Committee structures, remits, self- evaluation, learning and development Q1 appointment of external members (CIPFA guidance) Q2 annual self-evaluation using CIPFA toolkits and annual report to Council Q3 use of CIPFA knowledge and skills for members’ training Breakout Session to discuss workforce issues Q1 what could SLACIAG do to encourage new people into the Internal Audit profession? Q2 Is 'Grow Your Own' an effective workforce strategy? 40
Page 41
Date Topics / Speakers 9 December 2022 Records Management requirements for public sector bodies, issues, risks and role of Internal Audit • Khopolo Jamangile, Records and Information Security Manager, Perth & Kinross Council Overview from CIIA (IPPF Internal Audit standards subject to change; Audit Committee Service; CIIA virtual forums (Data Analytics; Heads of Internal Audit; Local Authority HIA; Fraud; (possible LA Fraud); Auditing Culture) • Derek Jamieson, Director, Regions, Chartered Institute of Internal Auditors 3.2 There are increasing challenges for the EQA2 schedule including staff resourcing issues in Councils, knock-on effect of delays in EQA2 completions during the pandemic response and recovery periods, and conflicts of interest arising from increased Internal Audit shared services arrangements. Responsibility is on the reviewee Council CAE to meet EQA requirements and to keep their Audit Committee informed of any delays in meeting the 5- year timeframe. In light of these extraordinary circumstances there is likely to be some flexibility on timescales subject to transparency. 3.3 In light of recent events, it was agreed at the December 2022 meeting that there was a need for the SLACIAG EQA Sub-Group and Moderation Panel to be re-established. A number of volunteers were forthcoming and the following were appointed: EQA Sub-Group Moderation Panel Pamela Redpath Fife Council Paul MacAskill Argyll & Bute Council Andrew Paterson Orkney Islands Council Ken Adamson North Lanarkshire Council Cecilia McGhee South Ayrshire Council Gordon O’Connor Stirling Council 3.4 The Treasurer, Yvonne Douglas, South Lanarkshire Council provided regular updates on the financial position of SLACIAG and produced the annual accounts, which were considered by the Group. Thanks to those at North Lanarkshire Council for completing the audit of the 2021 Accounts. Those at South Ayrshire Council have volunteered to complete the audit of the 2022 Accounts in early 2023. 3.5 The Group regularly discussed the development and training needs of our teams. Prior to the pandemic a Training Sub-Group collated training needs assessments and procured the best available products to meet the needs. The current approach is that information is shared on training courses available through providers that have previously delivered training to SLACIAG Members for chief internal auditors to evaluate and book any courses through their own organisations. 3.6 The following carry forward actions were noted: Chair to invite a CIPFA representative to a quarterly meeting once per year; Chair to engage with COSLA for SLACIAG collaboration; All to contact Jacqueline Clark, Perth and Kinross Council, if any interest in trainees looking to join a trainee community to assist with networking and their development. 41
Page 42
3.7 The following actions were noted, a number of which could be explored within the content of the SLACIAG Conference 2023: • Share training content used for audit committees and best practice self-evaluation toolkits to support audit committee members’ development to fulfil roles. • Need to upskill team members on digital skills and data analytics e.g. Power BI. • Need to reassess fraud risk controls due to reducing resources and the wider operating environment of local authorities. • Use the SLACIAG Conference 2023 as a platform to inform the business of future quarterly meetings of SLACIAG, CASG and SLAIG; revisit remits and expected outcomes, assign projects/development activity, and enhance skills and knowledge. • Engage in CIIA Heads of Internal Audit Forum and LA HIA Forum that provide useful insights on relevant topics and Internal Audit developments. 3.8 All Agendas, Minutes, and Presentations of SLACIAG meetings, EQA Framework Guidance, and other relevant documents are uploaded to the SLACIAG Knowledge Hub to enable access by all members in a secure way. 42
Page 43
4. COMPUTER AUDIT SUB-GROUP 4.1 The main aim of the Computer Audit Sub-Group (CASG), which is a permanent sub-group of SLACIAG, is to provide a forum to share and discuss computer audit practices and developments. This includes raising awareness of new standards, updates to legislation, new and current topics of interest, and computer audit developments, resources, and techniques. 4.2 The Computer Audit Sub Group (CASG) met three times in 2022, all meetings were virtual, with topics/speakers as follows in addition to core business: Date Topics / Speakers 7 April 2022 Data Analytics • Andrew Low and Mary Fitton, Senior Business Technology Consultants, Azets Cyber Security Audit • Peter Moore, East Lothian Council 18 August 2022 Use and Control of Social Media • Jason Ross, Clackmannanshire Council Power BI • Jimmy Dawe, Fife Council 24 November 2022 Audit Report Presentation – IT Asset Management • Peter Moore, Senior Auditor, East Lothian Council (CASG Chair) Email Security Threats and Data Loss Prevention • Alex Smith, Account Executive, Egress Software Technologies Cloud Hosted Environments – Including Cloud Governance, Cloud Security and Cloud Migration • Andy Milne, Service Manager Technical and Hosting, Fife Council 4.3 A common discussion point at CASG meetings during 2022 has been the sustainability of the sub-group in part due to lower number of specialist computer auditors in Councils exacerbated by retirements of experienced individuals in the past few years, the planned retirement of CASG Chair in 2023, and some wider developments that could affect its current remit and outputs. The sub-group is keen to influence its future, and to gain some insights from CIIA Data Analytics Forum. 4.4 In my role as Chair of SLACIAG, I joined at the start of the 24 November 2022 CASG meeting to ensure engagement with the sub-group. I spoke about the future of CASG and how it could meet requirements going forward around new developments, particularly around Data Analytics. I emphasised that the sustainability of CASG and other sub-groups is dependent upon significant effort involved in planning and holding meetings and good participation from 43
Page 44
all members to optimise the benefits. I promoted the SLACIAG Conference, which will be held as an in-person event on 15 and 16 June 2023 open to the wider teams to fulfil personal learning and development, including CASG members, as an opportunity to encourage wider collaboration and share good practice, and to influence the future of CASG or new sub-group. 4.5 All Agendas, Minutes, and Presentations for CASG meetings are uploaded to the SLACIAG Knowledge Hub (CASG sub-folder) to enable access by all members in a secure way. 44
Page 45
5. SCOTTISH LOCAL AUTHORITY INVESTIGATORS GROUP (SLAIG) 5.1 The main aim of the Scottish Local Authority Investigators Group (SLAIG), which is a permanent sub-group of SLACIAG, is to provide a forum to share and discuss counter fraud practices and developments. This includes raising awareness of updates to legislation, new and current topics of interest, and developments in counter fraud activities. 5.2 The Scottish Local Authority Investigators Group (SLAIG) met four times in 2022, all meetings were virtual, with topics/speakers as follows in addition to core business: Date Topics / Speakers 17 February 2022 Presentation on Pension Scams • Bryan Mackie - Police Scotland Overview of the work of the National SOC Interventions Unit and update on products, suitable to LAs, that have been developed • Ricky Hutton - Police Scotland 25 May 2022 Overview of the scope and business areas of the Counter Fraud Service in Scotland with a focus on Prevention, Detection and Investigation • Darrell Thomson, National Counter Fraud Manager, NHS Scotland Insight to the Digital Economy Act recently adopted in Scotland, potential for data sharing between public bodies and the process to be adopted • Art Mitchells-Urwin, Counter Fraud Manger, Cabinet Office 31 August 2022 Overview of how the Scottish & Northern Ireland Operational Intelligence Unit operates and how Immigration can impact our everyday activities • Jennifer Robertson, Home Office, Scottish & Northern Ireland Operational Intelligence Unit Overview of work in Interventions to Disrupt and Detect Serious & Organised Crime Groups in Scotland • Jo Lennie, Detective Inspector, Police Scotland Audit Scotland reports: Fraud & Irregularity 2021/22 and the National Fraud Initiative (NFI) in Scotland 2022 • Anne Cairns, Audit Scotland 13 December 2022 Overview of Communications Data and the Investigatory Powers Act • Sarah Cooper, National Anti-Fraud Network (NAFN) 5.3 The SLAIG Chair at the 13 December 2022 meeting proposed that the Sharing of Good Practice/Fraud Prevention sessions should be reintroduced into the agenda. The aim is to develop a good practice guide for SLAIG members. 45
Page 46
5.4 In my role as Chair of SLACIAG, I joined at the start of the 13 December 2022 SLAIG meeting to ensure engagement with the sub-group. I promoted the SLACIAG Conference, which will be held as an in- person event on 15 and 16 June 2023 open to the wider teams to fulfil personal learning and development, including SLAIG members, as an opportunity to encourage wider collaboration and share good practice. It is hoped that post-Conference 2023 there may be an opportunity for SLAIG members to work on new initiatives to enhance skill sets and develop smarter counter fraud practices. SLAIG is keen to gain some insights from the CIIA Counter Fraud Forum. 5.5 All Agendas, Minutes, and Presentations of SLAIG meetings, and other relevant documents are uploaded to the SLAIG Knowledge Hub to enable access by all members in a secure way. 46
Page 47
6. CONCLUSION 6.1 Notwithstanding the challenges that continue to affect our organisations, SLACIAG and its sub groups have had another successful year, as evidenced by the attendance at our virtual meetings and the range of topics discussed. Chief Internal Auditors considered matters such as data analytics, counter fraud and crime, performance, audit committees, internal audit national developments, and records management, and discussed key issues facing our assurance functions, including hybrid working, workforce planning and the skills mix of audit committees, and shared approaches being taken to address these. In line with their remits, the CASG and SLAIG virtual meetings focussed on computer audit and counter fraud matters respectively. 6.2 SLACIAG has continued to meet virtually with all of our meetings in 2022 (SLACIAG, Management Committee, CASG, SLAIG) using videoconferencing software. We have noted greater attendance at virtual meetings in all Groups and agreed to continue virtual meetings to be inclusive for our members in organisations that are located across the whole of Scotland, given the climate emergency declared by many of them. We will consult on the option of one per year in-person meeting of each of the Groups. The biennial Conference will be held as an in-person event on 15 and 16 June 2023 open to the wider teams to fulfil personal learning and development, as an opportunity to encourage wider collaboration and share good practice. 6.3 I would like to thank the Management Committee and the office bearers of our sub groups for their work in organising meetings and responding to the challenges that have arisen. I would also like to thank our speakers for giving up their time to join us at our virtual meetings and assist us in enhancing our effectiveness as internal auditors and fraud investigators. 6.4 My thanks are also extended to our members for their support, as evidenced not just by engaging in our virtual meetings, but also by the generous advice and assistance provided in relation to the myriad of audit, risk and governance questions which have arisen within our membership during the year. 6.5 I am very proud to be chairing a Group of such dedicated and hard-working public sector professionals in these challenging times. Jill Stacey Chief Officer Audit & Risk, Scottish Borders Council Chair of SLACIAG 16 March 2023 47
Page 48
48
Page 49
Prepared for South Lanarkshire Council March 2023 South Lanarkshire Council Annual Audit Plan 2022/23 5 49
Page 50
South Lanarkshire Council Annual Audit Plan 2022/23 | 2 Contents Introduction 3 Annual accounts audit planning 5 Wider Scope and Best Value 11 Reporting arrangements, timetable, and audit fee 14 Other matters 17 Appendix 1. Your audit team 19 50
Page 51
Introduction | 3 Introduction Summary of planned audit work 1. This document summarises the work plan for our 2022/23 external audit of South Lanarkshire Council (the Council) and its group. The main elements of our work include: • evaluation of the key controls within the main accounting systems • an audit of the annual accounts and provision of an Independent Auditor’s Report • an audit opinion on the other statutory information published within the annual accounts including the Management Commentary, the Annual Governance Statement and the Remuneration Report • consideration of arrangements in relation to wider scope areas: financial management; financial sustainability; vision, leadership and governance; and use of resources to improve outcomes • consideration of Best Value arrangements • providing assurance on the Housing Benefit Subsidy Claim, Non- Domestic Rates Return and the Whole of Government Accounts (WGA) return • review of the Council’s arrangements for preparing and publishing statutory performance information • review of the Council’s participation in the National Fraud Initiative. Audit Appointment 2. We are pleased to be appointed as the external auditor of South Lanarkshire Council and its group for the period 2022/23 to 2026/27 inclusive. You can find a brief biography of your audit team at Appendix 1. 3. In the first year of the audit appointment, we invest significant time gaining an understanding of your business and identifying and assessing the risks of material misstatement to the financial statements. While we use our initial assessment of risk to inform our planned audit approach, we keep our assessment of risks under review as the audit progresses. We will inform you of any significant changes in assessed risks and any resulting changes in our planned audit work. 4. The audit team will actively engage with you over the course of the audit to ensure our audit work continues to be focused on risk. 51
Page 52
Introduction | 4 Adding value 5. We aim to add value to the Council through our external audit work by being constructive and forward looking, by attending meetings of the Risk and Audit Scrutiny Committee and by recommending and encouraging good practice. In doing so, we will help the Council promote improved standards of governance, better management and decision making and more effective use of resources. Respective responsibilities of the auditor and South Lanarkshire Council 6. The Code of Audit Practice 2021 sets out in detail the respective responsibilities of the auditor and the Council. Key responsibilities are summarised below. Auditor responsibilities 7. Our responsibilities as independent auditors are established by the Local Government (Scotland) Act 1973 and the Code of Audit Practice (including supplementary guidance) and guided by the Financial Reporting Council’s Ethical Standard. 8. Auditors in the public sector give an independent opinion on the financial statements and other information within the annual accounts. We also review and report on the wider scope arrangements in place at the Council. In doing this, we aim to support improvement and accountability. South Lanarkshire Council’s responsibilities 9. The Council is responsible for maintaining accounting records and preparing financial statements that give a true and fair view. 10. The Council has the primary responsibility for ensuring the proper financial stewardship of public funds, compliance with relevant legislation and establishing effective arrangements for governance, propriety and regularity that enable them to deliver their objectives. 52
Page 53
Annual accounts audit planning | 5 Annual accounts audit planning Introduction 11. The annual accounts are an essential part of demonstrating the Council’s stewardship of resources and its performance in the use of those resources. 12. We focus our work on the areas of highest risk. As part of our planning process, we prepare a risk assessment highlighting the audit risks relating to each of the main financial systems relevant to the production of the financial statements. Materiality 13. The concept of materiality is applied by auditors in planning and performing the audit, and in evaluating the effect of any uncorrected misstatements on the financial statements. We are required to plan our audit to obtain reasonable assurance that the financial statements are free from material misstatement. The assessment of what is material is a matter of professional judgement over both the amount and the nature of the misstatement. Materiality levels for the 2022/23 audit 14. We assess materiality for the Council and its group at different levels as described in Exhibit 1. Exhibit 1 2022/23 Materiality levels for the Council and its group Materiality Amount Group Planning materiality – This is the figure we calculate to assess the overall impact of audit adjustments on the financial statements. Materiality has been set based on our assessment of the needs of the users of the financial statements and the nature of the council’s operations. For the year ended 31 March 2023 we have set our materiality at 2% of gross expenditure (less Integration Joint Board contributions) based on the audited financial statements for 2021/22. £26.5 million £29.9 million Performance materiality – This acts as a trigger point. If the aggregate of errors identified during the financial statements audit exceeds performance materiality, this could indicate that further audit procedures should be considered. Using our professional judgement, we have assessed performance materiality at 60% of planning materiality. £15.9 million £18 million Reporting threshold (i.e. clearly trivial) – We are required to report to those charged with governance on all unadjusted misstatements more than the ‘reporting threshold' amount. This is set at 5% of £250 thousand £250 thousand 53
Page 54
Annual accounts audit planning | 6 materiality up to a maximum threshold of £250,000, as defined within Audit Scotland’s planning guidance. Source: Audit Scotland Significant risks of material misstatement to the annual accounts 15. Our risk assessment draws on our cumulative knowledge of the Council, its major transaction streams, key systems of internal control and risk management processes. It is informed by our discussions with management, meetings with internal audit, attendance at committees and a review of supporting information. 16. Audit risk assessment is an iterative and dynamic process. Our assessment of risks set out in this plan may change as more information and evidence becomes available during the progress of the audit. Where such changes occur, we will advise management and where relevant, report them to those charged with governance. 17. Based on our risk assessment process, we identified the following significant risks of material misstatement to the financial statements. These are risks which have the greatest impact on our planned audit procedures. Exhibit 2 summarises the nature of the risk, the sources of assurance from management arrangements and the further audit procedures we plan to perform to gain assurance over the risk. Exhibit 2 2022/23 Significant risks of material misstatement to the financial statements Significant risk of material misstatement Sources of assurance Planned audit response 1. Risk of material misstatement due to fraud caused by management override of controls As stated in International Standard on Auditing (UK) 240, management is in a unique position to perpetrate fraud because of management’s ability to override controls that otherwise appear to be operating effectively. Owing to the nature of this risk, assurances from management are not applicable in this instance • Assess the design and implementation of controls over journal entry processing. • Make inquiries of individuals involved in the financial reporting process about inappropriate or unusual activity relating to the processing of journal entries and other adjustments. • Test journals at the year-end and post-closing entries and focus on significant risk areas where there is greatest risk of fraud. • Consider the need to test journal entries and other adjustments during the period. • Evaluate significant transactions outside the normal course of business. 54
Page 55
Annual accounts audit planning | 7 Significant risk of material misstatement Sources of assurance Planned audit response • Assess the adequacy of controls in place for identifying and disclosing related party relationship and transactions in the financial statements. 2. Estimation in the valuation of land and buildings. There is a significant degree of subjectivity in the valuation of land and buildings. Valuations are based on specialist and management assumptions and changes in these can result in material changes to valuations. The Council held other land and buildings, including council dwellings, with a net book value of more than £3 billion as at 31 March 2022. Valuations are based on specialist and management assumptions and changes in these can result in material changes to valuations. There is therefore an increased risk of material misstatement in the valuation of land and buildings. Accounting for land and buildings also remains an area of focus for out 2022/23 audit work. Over several years, we have identified errors in this area. The council has taken steps to address previous audit recommendations, however, an error in a working paper resulted in a material misstatement in 2021/22. Whilst the error identified was corrected in the • Revaluations completed by Royal Institute of Chartered Surveyors (RICS) registered valuers. • Revaluations carried out for all assets as part of rolling revaluation programme. • Detailed working papers retained to support asset reviews and impairments. • Review of materiality underway in advance of year end. • Regular Asset Valuation Working Group meetings with representatives from Finance and Property Services. • Procedures for council house year- end processes have been documented, user manual refreshed, and training rolled out. • Review the information provided to the external valuer to assess for completeness. • Evaluate the competence, capabilities, and objectivity of the internal professional valuer. • Obtain an understanding of management’s involvement in the valuation process to assess if appropriate oversight has occurred. • Assessing the reasonableness of the assumptions made and data used by the valuer in arriving at asset valuations. • Critically assess the approach South Lanarkshire Council has adopted to assess the risk that assets not subject to valuation are materially misstated, consider the robustness of that approach and the appropriateness of any assumptions made. • Review of the council’s controls around accounting for fixed assets and agreement to underlying records. 55
Page 56
Annual accounts audit planning | 8 Significant risk of material misstatement Sources of assurance Planned audit response accounts, there remains a risk that similar issues are identified this year. Source: Audit Scotland 18. As set out in International Standard on Auditing (UK) 240: The auditor’s responsibilities relating to fraud in an audit of financial statement, there is a presumed risk of fraud over the recognition of revenue. There is a risk that revenue may be misstated resulting in a material misstatement in the annual accounts. 19. We have rebutted this risk as funding received from the Scottish Government is clearly communicated and can be readily agreed to third party confirmations. In addition, the Council’s other income streams comprise of a high volume of low valued transactions and we have concluded there is limited opportunity or incentive to manipulate the recognition of income in the annual accounts. 20. In line with Practice Note 10: Audit of financial statements and regularity of public sector bodies in the United Kingdom, as most public-sector bodies are net spending bodies, the risk of material misstatement due to fraud related to expenditure recognition may in some cases be greater than the risk relating to revenue recognition. 21. We have rebutted this risk as the main expenditure streams of the Council can be readily forecast based on a predictable pattern of spend and mainly comprise a high volume of relatively low value items. We also consider there to be limited incentive and opportunity for the manipulation of expenditure recognition in the annual accounts. 22. We have not, therefore, incorporated specific work into our audit plan in these areas over and above our standard audit procedures. Other areas of audit focus 23. As part of our assessment of audit risks, we have identified other areas where we consider there are also risks of material misstatement to the annual accounts. Based on our assessment of the likelihood and magnitude of the risk, we do not consider these to represent significant risks. We will keep these areas under review as our audit progresses. 24. The areas of specific audit focus are: • Pension liability: The pension liability valuation due to the material value and significant assumptions used in the calculation of the liability. We will utilise the work of PwC as auditor expert in assessing the reasonableness of the methodology used and assumptions made by the Council’s actuary, Hymans Robertson LLP, in arriving at the IAS 19 pension valuation as at 31 March 2023. 56
Page 57
Annual accounts audit planning | 9 Group Consideration 25. As group auditors, we are required under International Standard on Auditing (ISA) (UK) 600: Audits of group financial statements (including the work of component auditors) to obtain sufficient appropriate audit evidence on which to base our audit opinion on the group financial statements. 26. South Lanarkshire Council has a group which comprises the following component entities; South Lanarkshire Council Group Structure Significant Component South Lanarkshire Council Subsidiaries Common Good Fund South Lanarkshire Leisure and Culture Limited Routes to Work South Associates Strathclyde Partnership for Transport Strathclyde Concessionary Travel Scheme Joint Committee Lanarkshire Valuation Joint Board Clyde Valley Learning and Development Joint Committee Joint Ventures South Lanarkshire Integration Joint Board Source: Audit Scotland 27. Our planned audit approach for the components is informed by our assessment of risk at the component bodies and our consideration of the size and nature of assets, liabilities, and transaction streams. 28. The audits of the financial information of some of the components are performed by other auditors. These components have been assessed as being not significant through our audit planning process. No reliance will be placed on the work of these auditors. 29. We will obtain sufficient appropriate audit evidence in relation to the consolidation process and the financial information of the components on which to base our group audit opinion. Audit of the trusts registered as Scottish charities 30. The 2006 Regulations require charities to prepare annual accounts and require an accompanying auditor’s report where any legislation requires an audit. The Local Government (Scotland) Act 1973 specifies the audit requirements for any trust fund where some or all members of a council are the sole trustees. 57
Page 58
Annual accounts audit planning | 10 Therefore, a full and separate audit and independent auditor’s report including a separate opinion is required for each registered charity where members of the Council are sole trustees, irrespective of the size of the charity. 31. Members and officers of South Lanarkshire Council are trustees for three trusts registered as Scottish charities, with total assets of some £1.171 million. The preparation and audit of financial statements of registered charities is regulated by the Charities and Trustee Investment (Scotland) Act 2005 and the Charities Accounts (Scotland) Regulations 2006. 32. Following our recommendations in previous years, the Council prepared and approved new arrangements for the administration of the three charitable trusts under its control. In 2021/22, the Council began the process of transferring the assets of the charitable trust and educational trust to the new charities. These transfers are subject to the approval of the charity’s regulator, Office of the Scottish Charity Regulator (OSCR). The transfer of the educational trust is now complete whilst the transfer of the charitable trust is ongoing. 33. Other than a risk of management override of controls which has also been identified as a risk in respect of the Council’s annual accounts, no specific planning risks were identified in respect of the charity’s accounts. Materiality levels for the 2022/23 audit of trusts registered as Scottish charities 34. Materiality levels for the various trusts are set out in Exhibit 3. Exhibit 3 2022/23 Materiality levels for charitable trusts Charitable trust Planning Materiality Performance Materiality Reporting Threshold South Lanarkshire Council Charitable Trusts £24,500 (Based on 2% of audited 2021/22 net asset value) £18,300 (Based on 75% of planning materiality) £1200 South Lanarkshire Council Educational Trusts £2,550 (Based on 2% of audited 2021/22 net asset value) £1,900 (Based on 75% of planning materiality) £150 East Kilbride Technology Centre Trust £550 (Based on 2% of audited 2021/22 net asset value) £410 (Based on 75% of planning materiality) £100 Source: Audit Scotland 58
Page 59
Wider Scope and Best Value | 11 Wider Scope and Best Value Introduction 35. The Code of Audit Practice sets out the four areas that frame the wider scope of public sector audit. The Code of Audit Practice requires auditors to consider the adequacy of the arrangements in place for the wider scope areas in audited bodies. 36. In summary, the four wider scope areas cover the following: • Financial management means having sound budgetary processes. We will consider the arrangements to secure sound financial management including the strength of the financial management culture, accountability and arrangements to prevent and detect fraud, error and other irregularities. • Financial sustainability – as auditors, we consider the appropriateness of the use of the going concern basis of accounting as part of the annual audit. We will also comment on financial sustainability in the longer term. We define this as medium term (two to five years) and longer term (longer than five years). • Vision, leadership, and governance – we conclude on the arrangements in place to deliver the vision, strategy and priorities adopted by the Council. We also consider the effectiveness of the governance arrangements to support delivery. • Use of resources to improve outcomes – we will consider how the council demonstrates economy, efficiency and effectiveness through the use of financial and other resources. Wider scope risks 37. We have identified wider scope audit risks in the areas set out in Exhibit 4. This exhibit sets out the risks, sources of assurance from management arrangements and the further audit procedures we plan to perform to gain assurances over the risks. 59
Page 60
Wider Scope and Best Value | 12 Exhibit 4 2022/23 wider scope risks Description of risk Sources of assurance Planned audit response 1. Financial Sustainability As is the position across Scotland, South Lanarkshire Council continues to operate in an increasingly complex and challenging environment where they aim to provide the best possible service within the resources available. Although plans are in place to meet the 2023/24 budget gap, there are considerable budget gaps to be addressed from 2024/25 onwards with the Council identifying a savings requirement of £87.8 million from 2024/25 – 2027/28. • Budget gap for medium term is reviewed annually. • Fully engaged CMT looking at longer term solutions through programmes of efficiencies. • Structured engagement with elected members to look at budget for 2024/25 and beyond. • Review of the Council’s annual budget setting arrangements. • Review and assessment of budget monitoring arrangements. • Review of the Council’s medium to longer term financial planning including how the Council aligns savings plans and transformation activity with strategic priorities. • On-going review of the council’s financial position and delivery of planned savings. Source: Audit Scotland 38. Our planned work on our wider scope responsibilities is risk based and proportionate and in addition to local risks we consider challenges which are impacting the public sector as a whole. In 2022/23 we will consider tackling climate change and responding to cyber security threats. Climate Change 39. Tackling climate change is one of the greatest global challenges. The Scottish Parliament has set a legally binding target of becoming net zero by 2045 and has interim targets including a 75% reduction in greenhouse gas emissions by 2030. The public sector in Scotland has a key role to play in ensuring these targets are met and in adapting to the impacts of climate change. 40. The Auditor General and Accounts Commission are developing a programme of work on climate change. In 2022/23, we will gather information on the Council’s arrangements for responding to climate change covering areas such as the development of climate change strategies and the monitoring and reporting of progress against targets for reducing emissions. Cyber Security 41. There continues to be a significant risk of cyber-attacks to public bodies, and it is important that they have appropriate cyber security arrangements in place. A number of recent incidents have demonstrated the significant impact that a 60
Page 61
Wider Scope and Best Value | 13 cyber-attack can have on both the finances and operation of an organisation. In 2022/23, we will consider the Council’s arrangements for managing and mitigating cyber security risks. Best Value 42. Under the 2021 Code of Audit Practice, the audit of Best Value in councils is fully integrated within our annual audit work. 43. Best Value at South Lanarkshire Council will be assessed comprehensively over the period of the audit appointment and will include an annual evaluation of the council’s approach to demonstrating improvement in its strategic priorities and public performance reporting. We will also follow up findings reported previously on Best Value to assess the pace and depth of improvement. This work will be integrated with the wider scope audit areas discussed above. 44. In addition to our annual work on Best Value we will conduct thematic reviews as directed by the Accounts Commission. In 2022/23 the thematic review across the sector will be on the effectiveness of council leadership in developing new local strategic priorities following the elections in May 2022. Our conclusions and judgements will be reported in a separate report to management and summarised in our Annual Audit Report. 45. At least once every five years, the Controller of Audit will report to the Accounts Commission on South Lanarkshire Council’s performance in meeting its Best Value duties. The first year of the programme will be form October 2023 to August and will cover the councils listed in Exhibit 5. Exhibit 5 Controller of Audit reports Falkirk South Ayrshire Moray Dumfries and Galloway Clackmannanshire West Dunbartonshire Orkney Islands City of Dundee Source: Audit Scotland 61
Page 62
Reporting arrangements, timetable, and audit fee | 14 Reporting arrangements, timetable, and audit fee Reporting arrangements 46. Audit reporting is the visible output for the annual audit. All Annual Audit Plans and the outputs, as detailed in Exhibit 6, and any other outputs on matters of public interest will be published on our website: www.audit-scotland.gov.uk. 47. Matters arising from our audit will be reported on a timely basis and will include agreed action plans. Draft management reports will be issued to the relevant officers to confirm factual accuracy. 48. We will provide an independent auditor’s report to the Council, the Scottish Parliament and the Accounts Commission setting out our opinions on the annual accounts. We will provide the Council and the Accounts Commission with an annual report on the audit containing observations and recommendations on significant matters which have arisen during the audit. 49. Exhibit 6 outlines the target dates for our audit outputs, and we aim to issue the independent auditor’s report by the statutory deadline of 30 September 2023. Exhibit 6 2022/23 Audit outputs Audit Output Target date Risk and Audit Scrutiny Committee Date Annual Audit Plan 31/03/2023 23/05/2023* Best Value Management Report 30/06/2023 26/09/2023 Independent Auditor's Report 30/09/2023 26/09/2023 Annual Audit Report 30/09/2023 26/09/2023 *Audit Strategy letter presented to committee on 7 March 2023. Source: Audit Scotland 62
Page 63
Reporting arrangements, timetable, and audit fee | 15 Timetable 50. To support an efficient audit, it is critical that the timetable for producing the annual accounts for audit is achieved. We have included a proposed timetable for the audit at Exhibit 7 that has been discussed with management. 51. Covid-19 has had a considerable impact on the conduct and timeliness of the audit. We recognise that it is in the best interests of public accountability to get the reporting of audited accounts back to pre-pandemic timelines. We are identifying ways to work more efficiently to expedite the 2022/23 audits whilst at the same time maintaining high standards of quality. 52. We intend to take a hybrid approach to the 2022/23 audit with a blend of onsite and remote working. We will continue to work closely with management to identify the most efficient approach as appropriate and will keep timeframes and logistics for the completion of the audit under review. Progress will be discussed with management and finance officers over the course of the audit. Exhibit 7 Proposed annual report and accounts timetable Key stage Provisional Date Consideration of the unaudited annual accounts by those charged with governance 27 June 2023 Latest submission date for the receipt of the unaudited annual accounts with complete working papers package. 27 June 2023 Latest date for final clearance meeting with the Director of Finance September 2023 Issue of draft Letter of Representation and proposed Independent Auditor’s Report September 2023 Agreement of audited and unsigned annual report and accounts September 2023 Issue of Annual Audit Report to those charged with governance. September 2023 Signed Independent Auditor’s Report September 2023 Certified Non-Domestic Rates Return October 2023 Certified Housing Benefit subsidy claim October 2023 Latest date for WGA assurance To be confirmed Source: Audit Scotland 63
Page 64
Reporting arrangements, timetable, and audit fee | 16 Audit fee 53. In determining the audit fee, we have taken account of the risk exposure of the council and the planned management assurances in place. The agreed audit fee for 2022/23 is £591,835 as set out in Exhibit 8. 54. Our fees have increased in 2022/23 and this is a reflection of the current audit market and the rising costs in delivering high quality audit work. There are increased regulatory expectations and risks placed on audit and its quality, as well as a widening in the scope of work audit must cover. Exhibit 8 Audit fees (including VAT) Fee component Fees (£) External Auditor Remuneration £351,000 Contribution to Audit Scotland costs £13,310 Contribution to Performance and Best Value £114,110 Sectoral Cap Adjustment £107,990 2022/23 Audit fee £586,410 Audit of Charitable Trusts £5,425 Total 2022/23 fee £591,835 Source: Audit Scotland 55. In setting the fee for 2022/23 we have assumed that the Council has effective governance arrangements and will prepare comprehensive and accurate accounts for audit in line with the agreed timetable for the audit. The audit fee assumes there will be no major change in respect of the scope of the audit during the year and where our audit cannot proceed as planned, a supplementary fee may be levied. 64
Page 65
Other matters | 17 Other matters Internal audit 56. It is the responsibility of the council to establish adequate internal audit arrangements. We will review the internal audit plan and the results of internal audit’s work. 57. While we are not planning to place formal reliance on the work of internal audit in 2022/23, we will review internal audit reports and assess the impact of the findings on our financial statements and wider scope audit responsibilities. Independence and objectivity 58. Auditors appointed by the Auditor General for Scotland or Accounts Commission must comply with the Code of Audit Practice and relevant supporting guidance. When auditing the financial statements, auditors must also comply with professional standards issued by the Financial Reporting Council and those of the professional accountancy bodies. These standards impose stringent rules to ensure the independence and objectivity of auditors. 59. Audit Scotland has robust arrangements in place to ensure compliance with these standards including an annual ‘fit and proper’ declaration for all members of staff. The arrangements are overseen by the Executive Director of Innovation and Quality, who serves as Audit Scotland’s Ethics Partner. 60. The appointed auditor for South Lanarkshire Council is John Boyd, Audit Director. Auditing and ethical standards require the appointed auditor to communicate any relationships that may affect the independence and objectivity of audit staff. We are not aware of any such relationships pertaining to the audit of South Lanarkshire Council. Audit Quality 61. Quality is at the core of public audit in Scotland and is the foundation for building consistency and confidence across all audit work. High quality audits provide assurance, add value, and can support public bodies to achieve their objectives. 62. Until 2021/22, the applicable audit quality standard was International Standard on Quality Control 1 (ISQC (UK) 1). This set out an audit practice’s responsibilities for its system of quality control for audits. 63. ISQC(UK) 1 has been replaced by two new audit quality standards: Internal Standards on Quality Management (ISQM (UK) 1) applicable from 15 December 2022 and (ISQM(UK) 2) effective for the 2023/24 audits. Work is underway at Audit Scotland to meet the requirements of these quality standards. 65
Page 66
Other matters | 18 64. Audit Scotland is committed to delivering high quality audits. The foundation of our quality framework is our Audit Guide, which incorporates the application of professional auditing, quality and ethical standards and the Code of Audit Practice (and supplementary guidance) issued by Audit Scotland and approved by the Auditor General for Scotland. To ensure that we achieve the required quality standards, Audit Scotland conducts peer reviews and internal quality reviews. Additionally, the Institute of Chartered Accountants of England and Wales (ICAEW) have been commissioned to carry out external quality reviews. 65. As part of our commitment to quality and continuous improvement, Audit Scotland will periodically seek your views on the quality of our service provision. We welcome feedback at any time, and this may be directed to the engagement lead. 66
Page 67
Appendix 1. Your audit team | 19 Appendix 1. Your audit team 66. The audit team involved in the audit of South Lanarkshire Council have significant experience in public sector audit. John Boyd Audit Director Jboyd@audit-scotland.gov.uk John has overall responsibility for the Audit Engagement. He has considerable audit experience across public sector audits including local government, IJB, pension, health and central government sectors. John is the Audit Scotland Audit Services Group Lead for local authority audit and is a member of the Local Authority (Scotland) Accounting Advisory Committee (LASAAC). Mark Ferris Senior Audit Manager mferris@audit-scotland.gov.uk Mark has over 30 years of public sector audit experience and has delivered external audit services to a range of bodies including local authorities, health boards and central government bodies. Iain Lochhead Audit Manager ilochhead@audit- scotland.gov.uk Iain has over 15 years’ experience in planning and delivering audits and has delivered external audit services to a range of bodies including local authorities, health boards and central government bodies. Iain will manage the team and work alongside the Senior Audit Manager and Audit Director to deliver the audit. Jacqueline Farmer Senior Auditor jfarmer@audit-scotland.gov.uk Jacqueline has considerable experience in planning and delivering audits across the public sector. Jacqueline will work alongside the Audit Manager to deliver the audit. Eilidh Nelson Senior Auditor enelson@audit-scotland.gov.uk Eilidh has considerable experience in planning and delivering audits across the public sector. Eilidh will work alongside the Audit Manager to deliver the audit. Lindsay Stother Best Value Auditor lstother@audit-scotland.gov.uk Lindsay has 14 years of experience working in local government across a number of different local authorities and over four years of public sector audit experience. She has worked on five local authority best value audits and one performance audit. She has also been involved in the most recent review of the Accounts Commission’s SPI Direction in 2021 67
Page 68
Appendix 1. Your audit team | 20 67. The local audit team is supported by a specialist technical accounting team, all of whom have significant experience of public bodies and work with accounting regulatory bodies. 68. Where possible and appropriate, we use our data analytics team to enable us to capture whole populations of your financial data. This analysis allows us to identify specific exceptions and anomalies within populations to enhance the focus of audit testing and support efficiency. 68
Page 69
Appendix 1. Your audit team | 21 South Lanarkshire Council Annual Audit Plan 2022/23 Audit Scotland’s published material is available for download on the website in a number of formats. For information on our accessibility principles, please visit: www.audit-scotland.gov.uk/accessibility For the latest news follow us on social media or subscribe to our email alerts. Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN Phone: 0131 625 1500 Email: info@audit-scotland.gov.uk www.audit-scotland.gov.uk AS.4.0 69
Page 70
70
Page 71
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 23 May 2023 Report by: Executive Director (Finance and Corporate Resources) Subject: Audit Scotland – Financial Bulletin 2021/2022 1. Purpose of Report 1.1. The purpose of the report is to:- [purpose] provide the Risk and Audit Scrutiny Committee with a summary of the information contained within the Audit Scotland report entitled ‘Local government in Scotland: Financial bulletin 2021/2022’, published in January 2023 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- (1) that the key messages and recommendations of the Audit Scotland Financial bulletin 2021/2022 (detailed in sections 4 and 5), be noted; and (2) that the commentary on the Council’s position, as included in the Audit Scotland report (section 6), be noted. 3. Background 3.1. In January 2023, Audit Scotland published the Financial bulletin 2021/2022 report on behalf of the Accounts Commission. Audit Scotland publish 2 overview reports each year, this one focuses on financial matters, and the other report on councils' performance and outcomes is expected be published in Summer 2023. A copy of the Local government in Scotland: Financial bulletin 2021/2022 report can be found on the Audit Scotland website. 3.2. The Audit Scotland report is divided into 2 parts:- Part 1: councils’ financial summary 2021/2022 Part 2: councils’ financial outlook 3.3. The key messages from each of the 2 parts are outlined in sections 4 and 5 of this report. Comments in relation to the Council’s position on these are included in italics alongside the Audit Scotland key messages. Section 6 notes commentary on the Council’s data included in the Audit Scotland report. 4. Part 1 – 2021/2022 Councils’ Financial Position 4.1. A number of key messages are presented by Audit Scotland in their report in relation to the 2021/2022 Financial Performance of councils: Total Revenue Funding and Income The average Council Tax collection rate across Scotland increased during 2021/2022. It is now more in line with pre pandemic levels. The Council’s Council 6 71
Page 72
Tax collection rate (exc. Water) was 94.89% in 2021/2022. This compares to 95.36% in 2020/2021. Scottish Government Funding An increasing proportion of local government funding is now either formally ring- fenced or provided with the expectation it will be spent on specific services. The Council’s formal ring-fenced grants for 2021/2022 totalled £43.734 million. There are other funding sources that are informally ring-fenced where the money is allocated to the Council with specific policy intent attached that covers the majority of the councils’ spend 2021/2022 funding levels from the Scottish Government to local government (excluding COVID-19 funding) increased in real terms for the first time since 2015/2016 and converged with other Scottish Government revenue funding. The Council does not have the equivalent real terms increase, however, in cash terms, the 2021/2022 budget was an increase of £13.054 million on the previous year. This excludes the impact of non-recurring COVID-19 Funding. Council Budgets and Outturn 2021/2022 In 2021/2022, budget gaps were largely consistent with previous years. For 2021/2022, the Council’s Revenue Budget Strategy identified an initial budget gap of £52.741million (June 2020) before any corporate solutions or savings were identified. Savings performance improved in comparison to previous years. For 2021/2022, the Council had an underspend in its Revenue Budget. Total usable reserves increased by £0.3 billion to £4.1 billion in 2021/2022. The Council’s useable Reserves increased by £6.4 million (including COVID-19 monies) to £152.2 million by the end of 2021/2022. The vast majority of these are set aside for future commitments, with only £13.043 million unearmarked. Councils have improved the way in which COVID-19 funds are disclosed in their accounts, but the level of detail varies. The Council included a COVID-19 spend section as part of its Management Commentary. Capital Capital expenditure increased in 2021/2022 though was still below the level in 2019/2020. The Council had General Fund capital spend of £61.6 million in 2021/2022 and Housing spend of £73.2 million. COVID-19, inflationary costs and shortages in construction materials had an impact on capital projects. The Council acknowledged the risk of increased market costs on its capital projects, with any issues managed on a project-by- project basis. National net debt (being total debt less cash and investments) has increased by £0.2 billion since 2020/2021. Local Government Pension Funds 2021/2022 Pension Fund investment returns, although largely positive, were 62 per cent lower than in the previous year. Scottish Pension Fund’s funding positions have generally improved since the last triennial valuation. 72
Page 73
5. Part 2 – Councils’ Financial Outlook 5.1. A number of key messages are presented by Audit Scotland in their report in relation to the Financial Outlook for councils, namely:- Financial Challenges Councils are having to deal with a number of significant financial challenges and will need to make some difficult decisions with their spending priorities. The Council’s Medium Term Financial Strategy shows a significant Budget Gap in the coming years. The future funding settlements set out in the Scottish Government’s Resource Spending Review reflects flat cash funding settlements for 2022/2023 to 2025/2026. The Council’s Medium Term Budget Strategy takes account of the Spending Review outcome. Budgets for 2022/2023 Councils intend to bridge the budget gap of £0.4 billion for 2022/2023 with planned savings and reserves, but the reliance on non-recurring reserves is not sustainable in the medium to long-term. The Council’s Budget for 2022/2023 relied on £30.575 million of non-recurring funding solutions. These were reinstated as part of the 2023/2024 Budget Strategy. 2022/20223 Funding Settlement Scottish Government revenue funding in 2022/2023 decreased by 0.1% in real terms when non-recurring funding elements are excluded. The Council does not have the calculation of its budget movement in real terms, however, in cash terms, the 2022/2023 budget was an increase of £23.925 million on the previous year. This excludes the impact of non-recurring COVID-19 funding but does include funding for specific government policies . Capital Funding The Local Government capital settlement in 2022/2023 increased from £649 million in 2021/22 to £685 million. The Council’s General Capital Grant decreased by £0.011 million to £21.362 million into 2021/2022. 6. South Lanarkshire Council – Financial Overview 2021/2022 6.1. The Audit Scotland report contains a number of tables that set out information for all councils, however, there are 5 tables of data which show the performance of individual councils. Commentary on the Council’s position in each of these tables is provided below. 6.2. The Budget Gap as a proportion of net cost of services in 2021/2022 ranged between 1% and 22%. The Council’s Budget Gap was circa 5%, fourth behind Shetland (22%), Orkney (6%) and Perth and Kinross (5.5%). Argyll and Bute were the lowest at 1%. 6.3. In terms of the Savings Achieved compared to Targets, fourteen councils achieved their savings target. The Council had an underspend in its budget in 2021/2022. 6.4. Re the Changes in Councils’ Usable Reserves during 2021/2022, 23 councils recorded an increase, ranging from c£1 million (Aberdeen) to c£55 million (North Lanarkshire). The report notes that South Lanarkshire Council is ranked ninth in terms of increase as the usable reserves increased by £6.4 million. East Renfrewshire had 73
Page 74
a decrease of c£2 million and Glasgow had the greatest decrease at c£50 million which will reflect each council’s planned use of reserves. 6.5. The Council’s COVID-19 Reserves as a Percentage of General Fund Balance total 25%. This is ranked 17 out of 32. The highest percentage was Moray with 49% and the lowest being Shetland with no COVID-19 Reserves. Glasgow sits slightly lower than the Council with c22% and Renfrewshire sit at c26%. 6.6. Regarding the Budget gap as a proportion of net cost of services for all 32 councils in 2022/2023, the Council sits fifth at 6% behind Shetland (22%). 7. Employee Implications 7.1. None. 8. Financial Implications 8.1. The Audit Scotland Report raises a number of financial areas for consideration by councils, however, there are no direct financial implications as a result of the content of this report. 9. Climate Change, Sustainability and Environmental Implications 9.1. There are no implications for climate change, sustainability or the environment in terms of the information contained in this report. 10. Other Implications 10.1. None. 11. Equality Impact Assessment and Consultation Arrangements 11.1. This report does not introduce a new policy, function or strategy or recommend a change to an existing policy, function or strategy and, therefore, no impact assessment is required. 11.2. There is also no requirement to undertake any consultation in terms of the information contained in the report. Paul Manning Executive Director (Finance and Corporate Resources) 4 May 2023 Link(s) to Council Values/Priorities/Outcomes Accountable, Effective, Efficient and Transparent Previous References None List of Background Papers Local Government in Scotland – Financial Overview 2020/2021. Audit Scotland, March 2022. 74
Page 75
Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Jackie Taylor, Head of Finance, Finance (Strategy) Ext: 5637 (Tel: 01698 455637) E-mail:- jackie.taylor@southlanarkshire.gov.uk 75
Page 76
76
Page 77
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 23 May 2023 Report by: Executive Director (Finance and Corporate Resources) Subject: Financial Resources Scrutiny Forum Activity 1. Purpose of Report 1.1. The purpose of the report is to:- [purpose] provide, for information, a summary of reports considered by the Financial Resources Scrutiny Forum from September 2022 to April 2023 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- (1) that the summary of reports considered by the Financial Resources Scrutiny Forum for the period September 2022 to April 2023, as detailed in Appendix 1 of this report, be noted. [1rec 3. Background 3.1. In May 2017, the Council agreed details relating to the review of Member Scrutiny Forums. This included consideration of the Terms of Reference and Powers and Responsibilities for the Forums. In respect of the Financial Resources Scrutiny Forum, the focus can be summarised as:- scrutinise all of the Council’s revenue budgets review the financial and operational progress of the Council’s capital programmes review the financial and operational progress of the Council’s trading operations. 3.2. This report will cover items submitted to the Financial Resources Scrutiny Forum since the last update to the Risk and Audit Scrutiny Committee in June 2022. 4. Agenda Items 4.1. The table attached at Appendix 1 notes the reports submitted to the Financial Resources Scrutiny Forum during the period September 2022 to April 2023, under the main areas of responsibility. The meeting on 1 September 2022 was the first of the new financial year, 2022/2023 and also covered the closing position of the old year (2021/2022). 4.2. Further reports will be provided to this Committee on an annual basis advising of the business presented to the Financial Resources Scrutiny Forum. 5. Employee Implications 5.1. There are no employee implications. 7 77
Page 78
6. Financial Implications 6.1. There are no financial implications. 7. Climate Change, Sustainability and Environmental Implications 7.1. There are no specific climate change, sustainability or environmental implications arising from the information contained within this report. 8. Other Implications 8.1. The main risk associated with the Council’s Revenue Budget is that there is an overspend. The risk has been assessed as low given the detailed budget management applied across the Resources. The risk is managed through four weekly Budget Monitoring Meetings at which any variance is analysed. In addition, the probable outturn exercise ensures early warning for corrective action to be taken where appropriate. 8.2. The main risk associated with the Council’s Capital Programme is that there is an overspend. The risk has been assessed as low given the detailed project management plans prepared and monitored for each project. The risk of an overspend is managed through four weekly Investment Management Meetings. 8.3. There are no implications for sustainability in terms of the information contained in this report. 9. Equality Impact Assessment and Consultation Arrangements 9.1. This report does not introduce a new policy, function or strategy or recommend a change to an existing policy, function or strategy and, therefore, no impact assessment is required. 9.2. There is also no requirement to undertake any consultation in terms of the information contained in the report. Paul Manning Executive Director (Finance and Corporate Resources) 5 April 2023 Link(s) to Council Values/Priorities/Outcomes Accountable, Effective, Efficient and Transparent Previous References Risk and Audit Scrutiny Committee, 22 June 2022 List of Background Papers None Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Lorraine O'Hagan, Finance Manager (Strategy) Ext: 2601 (Tel: 01698 452601) Email:- lorraine.o'hagan@southlanarkshire.gov.uk 78
Page 79
Reports Submitted to Financial Resources Scrutiny Forum Appendix 1 Date Revenue Monitoring Capital Monitoring 1 September 2022 Provide an update on the position as at 31 March: • Revenue Budget Monitoring 2021/2022 • Revenue Budget Monitoring 2021/2022 - Detailed Resource Analysis Provide an update on the position as at 15 July (period 4) for the following: • Revenue Budget Monitoring 2022/2023 • Revenue Budget Monitoring 2022/2023 - Detailed Resource Analysis Provide an update on the position as at 31 March: • 2021/2022 General Fund Capital – Financial Information, Programme exceptions approved by Executive Committee and Physical Progress for Build, Non-Build and Roads Projects • 2021/2022 Housing Capital Programme – Financial Information and Physical Progress Provide an update on the position as at 15 July (period 4) for the following: • 2022/2023 General Fund Capital Financial Information, Programme exceptions approved by Executive Committee and Physical Progress for Build, Non-Build and Roads Projects • 2022/2023 Housing Capital Programme- Financial Information and Physical Progress 29 September 2022 Provide an update on the position as at 12 August (period 5) for the following: • 2022/2023 Financial Monitoring • 2022/2023 Detailed Resource Analysis for the General Services Budget and Housing Revenue Account Provide an update on the position as at 12 August (period 5) for the following: • 2022/2023 Housing Capital Programme - Financial Information and Physical Progress • 2022/2023 General Services Capital Programme - Financial Information, Programme exceptions approved by Executive Committee and Physical Progress for Build, Non-Build and Roads Projects 8 December 2022 Provide an update on the position as at 4 November (period 8) for the following: • 2022/2023 Financial Monitoring • 2022/2023 Detailed Resource Analysis for the General Services Budget and Housing Revenue Account Provide an update on the position as at 4 November (period 8) for the following: • 2022/2023 Housing Capital Programme - Financial Information and Physical Progress • 2022/2023 General Services Capital Programme - Financial Information, Programme exceptions approved by Executive Committee and Physical Progress for Build, Non-Build and Roads Projects 9 February 2023 Provide an update on the position as at 29 December (period 10) for the following: • 2022/2023 Financial Monitoring • 2022/2023 Detailed Resource Analysis for the General Services Budget and Housing Revenue Account Provide an update on the position as at 29 December (period 10) for the following: • 2022/2023 Housing Capital Programme - Financial Information and Physical Progress • 2022/2023 General Services Capital Programme - Financial Information, Programme exceptions approved by Executive Committee and Physical Progress for Build, Non-Build and Roads Projects 79
Page 80
Date Revenue Monitoring Capital Monitoring 9 March 2023 Provide an update on the position as at 27 January (period 11) for the following: • 2022/2023 Financial Monitoring • 2022/2023 Detailed Resource Analysis for the General Services Budget and Housing Revenue Account Provide an update on the position as at 27 January (period 11) for the following: • 2022/2023 Housing Capital Programme - Financial Information and Physical Progress • 2022/2023 General Services Capital Programme - Financial Information, Programme exceptions approved by Executive Committee and Physical Progress for Build, Non-Build and Roads Projects 27 April 2023 Provide an update on the position as at 24 February (period 12) for the following: • 2022/2023 Financial Monitoring • 2022/2023 Detailed Resource Analysis for the General Services Budget and Housing Revenue Account Provide an update on the position as at 24 February (period 12) for the following: • 2022/2023 Housing Capital Programme - Financial Information and Physical Progress • 2022/2023 General Services Capital Programme - Financial Information, Programme exceptions approved by Executive Committee and Physical Progress for Build, Non-Build and Roads Projects 80
Page 81
Report Agenda Item Report to: Risk and Audit Scrutiny Committee Date of Meeting: 23 May 2023 Report by: Executive Director (Finance and Corporate Resources) Subject: Forward Programme for Future Meetings 1. Purpose of Report 1.1. The purpose of the report is to:- [purpose] advise members of the forward programme for the meetings of the Risk and Audit Scrutiny Committee to 26 March 2024 invite members to suggest topics for inclusion in the Committee’s forward programme [1purpose] 2. Recommendation(s) 2.1. The Committee is asked to approve the following recommendation(s):- [recs] (1) that the report and the outline forward programme for the meetings of the Risk and Audit Scrutiny Committee to 26 March 2024, attached as an Appendix to the report, be noted. [1recs] 3. Background 3.1. As part of a range of improvement measures introduced as a result of Audit Scotland’s report on the Audit of Best Value and Community Planning (2009), an Action Plan was prepared. One of the actions was to include, as a standard agenda item, a list of items proposed for consideration at subsequent meetings of this Committee to provide an opportunity for members to inform future agendas. The outline forward programme to 26 March 2024 is attached, for members’ information, as an Appendix to the report. 4. Employee Implications 4.1. There are no employee implications. 5. Financial Implications 5.1. There are no financial implications. 6. Climate Change, Sustainability and Environmental Implications 6.1. There are no Climate Change, Sustainability or Environmental implications in terms of the information contained within this report. 7. Other Implications 7.1. There are no risk implications in terms of the information contained within this report. 8 81
Page 82
8. Equality Impact Assessment and Consultation Arrangements 8.1. The report does not introduce a new policy, function or strategy or recommend a change to an existing policy, function or strategy and, therefore, no impact assessment is required. 8.2. There was no requirement to undertake any consultation in terms of the information contained in this report. Paul Manning Executive Director (Finance and Corporate Resources) 27 April 2023 Link(s) to Council Values/Priorities/Outcomes Accountable, Effective, Efficient and Transparent Previous References Executive Committee 8 July 2009 List of Background Papers Audit Scotland Audit of Best Value and Community Planning Contact for Further Information If you would like to inspect the background papers or want further information, please contact:- Elizabeth-Anne McGonigle, Administration Officer Tel: 0738 5403101 E-mail:- elizabeth-anne.mcgonigle@southlanarkshire.gov.uk 82
Page 83
APPENDIX – RASC OUTLINE FORWARD PROGRAMME TO 30 JANUARY 2024 Meeting Date Item Responsibility 27 June 2023 Public Sector Internal Audit Standards (PSIAS) – External Assessment Audit and Compliance Manager Internal Audit Assurance Report 2022/2023 Audit and Compliance Manager Annual Governance Statement for 2022/2023 and Significant Governance Areas Quarter 4 Progress Report Head of Administration and Legal Services Unaudited Annual Accounts 2022/2023 Interim Management Report Head of Finance (Strategy) Audit Scotland Internal Audit Activity Report Audit and Compliance Manager Audit Scotland – Financial Overview 2021/2022 Head of Finance (Strategy) 2022 NFI Exercise Audit and Compliance Manager Audit Scotland - Resourcing the benefit service: A Thematic Study Head of Finance (Transactions) 22 August 2023 Internal Audit Activity Report Audit and Compliance Manager Year End Insured Risks Report 2022/2023 Head of Finance (Transactions) Fraud Statistics Annual Report 2022/2023 Audit and Compliance Manager 26 September 2023 (special) External Auditor’s Annual Report to South Lanarkshire Council 2022/ 2023 External Audit Audited Annual Accounts 2022/2023 Head of Finance (Strategy) 31 October 2023 Internal Audit Activity Report Audit and Compliance Manager Year End Risk Management Report 2022/2023 and Review of Council’s Top Risks 2023/2024 Head of Finance (Transactions) 83
Page 84
Meeting Date Item Responsibility 30 January 2024 Internal Audit Activity Report Audit and Compliance Manager Performance and Review Scrutiny Forum Annual Update Head of Corporate Communications Fraud Statistics Six Monthly Update 2023/2024 Audit and Compliance Manager 26 March 2024 Good Governance Update Internal Audit Activity Report 2022 NFI Exercise 2024/2025 Internal Audit Plan Head of Administration and Legal Services Audit and Compliance Manager Audit and Compliance Manager Audit and Compliance Manager N.B:-. Audit Scotland national studies and reviews will appear as a recurring item but the frequency and subject matter will vary according to their programme. 84