Agenda Document Pack - Audit and Scrutiny Committee - 29/09/2026
Moray Council · 29 September 2026
Back to Audit and Scrutiny Committee — 29 September 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Tuesday, 29 September 2026 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Tuesday, 29 September 2026 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of meeting of 18 June 2026 5 - 12 4. Written Questions ** 5. Internal Audit Section Update Report Report by Service Manager Internal Audit and Risk 13 - 84 6. Internal Audit Review - Commercial Harbours Report by Service Manager Internal Audit and Risk 85 - 108 7. Internal Audit Review - Home to School Transport Report by Service Manager Internal Audit and Risk 109 - 132 8. Internal Audit Review - Management of School Funds Report by Service Manager Internal Audit and Risk 133 - 156 Page 1
Page 2
9. Internal Audit Review - Social Care (Short Breaks) Report by Service Manager Internal Audit and Risk 157 - 174 10. Treasury Management Performance and Treasury and Capital Investment Prudential Indicators for 2025-26 Report by Executive Director Finance, Strategy and Transformation 175 - 194 Summary of Audit and Scrutiny Committee functions: Audit Functions- Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions- Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring- To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards -To ensure that the highest standards of probity and public accountability are demonstrated. Watching the Meeting You can watch the webcast live by going to: http://www.moray.gov.uk/moray_standard/page_43661.html Webcasts are available to view for 1 year following the meeting. You can also attend the meeting in person. If you wish to attend in person, please come to the High Street entrance door and a member of staff will let you into the Chamber. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 5pm three working days prior to the day of the meeting, please see Standing Order 36 for deadlines. A copy of any written answer provided by the Chair will be published on the Council’s committee management system by 12pm the day before the meeting. The Member who has put the question may, after the answer has been published, may ask one supplementary question directly related to the subject matter at the meeting, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Scott Lawrence (Chair) Councillor Theresa Coull (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor John Divers (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Paul McBain (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Councillor Sonya Warren (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Thursday, 18 June 2026 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Tracy Colyer, Councillor Theresa Coull, Councillor John Divers, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Scott Lawrence, Councillor Marc Macrae, Councillor Paul McBain, Councillor John Stuart, Councillor Sonya Warren, Ms Margaret Wilson IN ATTENDANCE Chief Executive; Executive Director Economy, Enterprise and Operations; Executive Director Education, Housing and Communities; Executive Director Finance, Strategy and Transformation; Service Manager Internal Audit and Risk; Service Manager Provider Services; Chief Officer, Moray Health and Social Care Partnership; Chief Financial Officer (Depute S95 Officer); Head of Housing, Property and Communities; Chief Governance Officer (Monitoring Officer); Service Manager Legal Services; Head of People, Change and Community Strategy; and Caroline O'Connor, Committee Services Officer, all Moray Council; and Angela Pieri, Grant Thornton - External Auditors 1. Chair The meeting was chaired by Councillor Scott Lawrence. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. With regard to Item 11 "Internal Audit Annual Report 2025-26" and Item 17 "Annual Governance Statement", Councillor Gatt stated, for transparency, that he is Convener of the Grampian Valuation Joint Board and would be taking part in the debate. With regard to Item 11 "Internal Audit Annual Report 2025-26" and Item 17 "Annual Governance Statement", Councillors Warren and Macrae stated, for transparency, that they are members of the Grampian Valuation Joint Board and would be taking part in the debate. Item 3. Page 5
Page 6
With regard to Item 5 "Internal Audit Section Update Report", Councillor Gordon stated, for transparency, that he is a non-executive director of Moray Leisure Limited and would be taking part in the debate. With regard to Item 5 "Internal Audit Section Update Report", Councillor Divers and Fernandes stated, for transparency, that they are Council Advisors to the Moray Citizens Advice Bureau and would be taking part in the debate. 3. Minute of meeting of 25 March 2026 The minute of the meeting of 25 March 2026 was submitted and approved. 4. Written Questions ** The Committee noted that no written questions had been submitted. 5. Internal Audit Section Update Report The meeting had before it a report by the Service Manager Internal Audit and Risk providing an update on the work of the Internal Audit Section. With regard to the outstanding actions in the Self-Directed Support Follow Up Review detailed in Appendix 1, Councillor Warren sought assurance that vulnerable service users were not being adversely affected while the actions have not been completed and whether there was confidence that all actions would be fully implemented by 2026/27. In response, the Service Manager Internal Audit and Risk advised there was assurance from the service that a review and, if required, update of support plans was being prioritised and Internal Audit would be revisiting it as part of the audit plan for the following year. The Service Manager Provider Services confirmed financial audits were up to date for all SDS packages, and financial reviews highlight any gaps in care requirements. He noted it had been a challenging period in terms of budget savings and resourcing, however review targets had been met across services, with the exception of the learning disability service which was more complex in terms of ensuring there are up to date support plans in place. He confirmed there were processes in place for assessment and reviewed in terms of prioritisation to ensure service users are receiving the appropriate level of care. To provide further assurance the Chief Officer, Moray Health and Social Care Partnership confirmed a dashboard has been collated for outstanding internal audit recommendations and timescales to ensure there is proactive management and monitoring in order to achieve audit recommendations being implemented within timescale. With reference to Appendix 7, Ms Wilson noted there had been a request when last considered at Committee for training in order to scrutinise treasury managed and asked whether there was an update. In response, the Chief Financial Officer confirmed a training session had been provided to members and apologised for the oversight of it not being extended to the external members of the Committee. He advised Grant Thornton had also provided a webinar which had been shared with the Committee. Following consideration the Committee unanimously agreed to note the contents of the report. Page 6
Page 7
6. Internal Audit Review - Milnes High School The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 25 March 2026 to 18 June 2026. In relation to the bequest in Audit Recommendation 4, the Executive Director Education, Housing and Communities advised Committee that action was being taken by the school to ensure the monies were used going forward. In response to Councillor Coull noting that unpresented cheques appear to be a regular occurrence, the Service Manager Internal Audit and Risk advised that school funds were separate entity to Council funds ,however, agreed there was a theme from reviews undertaken at other schools. He confirmed an audit review had recently been undertaken on the administration of school funds which would be reported to the September Committee and would address some of the concerns highlighted. The Executive Director Education, Housing and Communities further advised the service had picked up on the issue and were working to ensure there was oversight of the funds in terms of consistent advice on school fund management. Following consideration the Committee unanimously agreed to endorse the recommendations contained within the report. 7. Internal Audit Review - Capital Plan Project Review The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 25 March 2026 to 18 June 2026. Councillor Warren asked whether further reviews of other areas of the Capital Plan would be undertaken. In response, the Service Manager Internal Audit and Risk confirmed other areas of the Capital Plan would be considered for inclusion in future Annual Audit Plans. Following consideration the Committee unanimously agreed to endorse the recommendations contained within the report. 8. Internal Audit Review - Common Good Fund The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 25 March 2026 to 18 June 2026. The Chief Financial Officer advised that implementation of the recommendations is progressing at pace with financial recommendations well into development and in relation to Recommendation 4, a Common Good report is to be presented to Moray Council on 30 June 2026. Councillor Warren asked why the consolidated Common Good Register referred to in Audit Recommendation 1 was not easily accessible for those trying to access the information about common good in their community. In response, the Chief Governance Officer advised the asset register lists those which are common good Page 7
Page 8
however accepted that was not clearly outlined for the public. He stated the process of identification of common good assets involves lengthy research resulting in extended timescale for implementation. The Service Manager Legal Services further advised work is being undertaken with Estates for each individual community to double check the list and link common good assets to a map which will be added to the Council's website. The Executive Director Finance, Strategy and Transformation confirmed a very recent update had been made to the Council website with a specific location for the common good asset list. Following consideration the Committee unanimously agreed to endorse the recommendations contained within the report. 9. Internal Audit Review - Payroll The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 25 March 2026 to 18 June 2026. With regard to Audit Recommendation 2 regarding services being reminded of the requirement for timely notification regarding notification of new appointments and termination of employment, Mr Augustus asked whether a stronger approach was required to ensure compliance. In response, the Head of People, Change and Community Strategy advised a paper based system is currently in place however work was being undertaken with software providers to digitalise the system to make the process easier for service managers with whom responsibility lies. Following consideration the Committee unanimously agreed to endorse the recommendations contained within the report. 10. Internal Audit Follow Up Review - Adult Social Care Commissioning The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit follow-up review completed for the period from 25 March 2026 to 18 June 2026. With reference to the high priority recommendations in Appendix 1 which were not implemented but replaced with alternatives, Councillor Warren asked who had formally approved the changes and whether there was evidence the alternative arrangements provided the same level of assurance as the original recommendations agreed by the Moray Integration Joint Board. In response, the Service Manager Internal Audit and Risk advised that the audit review had been undertaken by an external internal audit provider and that a subsequent review of the report identified the need for greater clarity in the wording of certain recommendations to ensure a consistent understanding of the implementation requirements. Having reviewed the implementation plan to evidence implementation of the recommendations, it was realised some systems and processes had changed since 2023 resulting in recommendations requiring to be revised. Given that the review was undertaken by an external internal audit provider, no working papers are available to support further scrutiny of the original audit findings. The Service Manager Internal Audit and Risk advised that, following discussions with the Chief Officer, the area would be considered for inclusion within a future Annual Audit Plan, with the outcome reported to a future meeting of this Committee. To provide further assurance the Chief Officer, Page 8
Page 9
Moray Health and Social Care Partnership confirmed many of the recommendations in the alternative approaches agreed at operational management level and in liaison with the Service Manager Internal Audit and Risk had been implemented and they were fully supportive of a future audit being undertaken. Following consideration the Committee unanimously agreed to note the contents of the report. 11. Internal Audit Annual Report - 2025-26 The meeting had before it a report by the Service Manager Internal Audit and Risk providing Committee with a copy of the Internal Audit Annual Report for the year ended 31 March 2026, together with Service Manager Internal Audit and Risk's opinion on the adequacy and effectiveness of the Council's system of internal control. Councillor Warren expressed concern that Appendix 1 highlighted the Moray Integration Joint Board's (MIJB) risk to deliver services had increased from high to very high and sought assurance that Moray Council was not being exposed to unsustainable financial risk through continued MIJB overspends. In response, the Service Manager Internal Audit and Risk noted the strengthened governance arrangements already in place within MIJB as referenced by the Chief Officer in terms of monitoring audit recommendations and that a review of financial governance within MIJB has been included in this year’s audit plan, the outcome of which will be reported back to this Committee. The Chief Officer reiterated that increasing pressure on IJBs and their partner funding organisations had been highlighted in several Audit Scotland reports and confirmed the risk rating had been increased given the financial pressures and recurring funding gap set against the increase in demand and complexity of cases. In addition to the strengthened governance arrangements, the Chief Officer referred to reporting to MIJB's Audit, Performance and Risk Committee; Clinical and Care Governance Committee and reports to every MIJB formally on delivery of the financial plan and regular operational meetings with both Section 95 officers from the Council and NHS for early escalation of any emerging issues. Councillor Gatt referred to the savings identified during Internal Audit Reviews totalling £166,530 which he noted proved the value of Internal Audit and encouraged officers to ensure audit recommendations are implemented within timescales to reduce the requirement for Internal Audit to undertake follow-up reviews with revised timescales. The Chief Executive concurred and confirmed Corporate Leadership Team are focussed on improving performance in terms of setting realistic timescales to ensure implementation is achievable, which support was acknowledged by the Service Manager Internal Audit and Risk. In terms of governance, Councillor Stuart referenced the high priority areas in the plan which may require follow up and asked whether services could self-assess and report back on progress until any follow up was undertaken to add an additional layer of governance to ensure momentum of implementation of recommendations. In response, the Chief Executive provided assurance Heads of Service have responsibility for ensuring recommendations are addressed with oversight from Page 9
Page 10
Corporate Leadership Team, specifically as a standing agenda item on Extended Corporate Leadership Team meetings. Following consideration the Committee unanimously agreed to note the contents of the annual report given as Appendix 1 to the report. 12. National Fraud Initiative 2024-25 The meeting had before it a report by the Service Manager Internal Audit and Risk informing Committee of the outcomes from the Council's participation in the National Fraud Initiative for 2024/25. Following consideration the Committee unanimously agreed to note the report. 13. Best Value Thematic Review 2025-26 - Asset Management The meeting had before it a report by the Executive Director Finance, Strategy and Transformation informing the Committee of the outcomes from the Best Value Thematic 2025/26 Asset Management review and inviting consideration of the findings and actions to respond to them. With reference to the report highlighting that the Council holds more assets than are required, Councillor Warren asked what scale of asset reduction was anticipated over the next five to ten years and whether there was a quantified target or rationalisation or whether it would be reactive. In response, the Chief Executive advised officers would require to draft proposals for members consideration across the asset base to agree where improvements are possible while considering how to improve ways to deliver services to the community, noting the scale of those improvements will be dependent on budget. Councillor Keith referred to the second paragraph of Governance and Performance (3) in Appendix 1 which stated that the Moray Growth Deal and Levelling Up Fund projects were impacted due to key partners retracting their committee and sought clarification as to what realistic profiling could be envisaged to prevent recurrence as noted in the last sentence of the paragraph. In response, the Executive Director Finance, Strategy and Transformation acknowledged there had been a gap however there was now a specific recommendation to ensure that no monies are spent where funding is not secured. In response to a query from Councillor Warren seeking clarification of the benefits of moving to a three year capital plan and how members would be aware whether slippage was reducing, the Chief Financial Officer advised the main objective of moving to the three year capital plan was to provide greater flexibility of projects. However, he noted it was important to recognise that not all projects are within the Council's control in terms of being driven by both UK and Scottish Governments however the Council requires to look at the probability of the projects delivering. The Council's focus requires to be on elements within the Council's control and more detail will be included in the Capital Plan report to Moray Council on 30 June. Councillor Stuart, appreciating the plan to update the corporate asset management plan, asked for assurance that decisions being taken were aligned with a clear and Page 10
Page 11
robust long term strategy and sought clarification of the timescale of when the information would be reported to Council seeking decisions relating to rationalisation of assets. In response, the Executive Director Finance, Strategy and Transformation advised the timeline was November 2027 to set the capital plan for 2028/29 which would allow the new management team structure to progress recommendations for the Council to consider. The Chief Executive confirmed work was ongoing and would be reported to service Committees and in terms of adding any additional programmes or existing programmes being moved to the next stage, it would likely be autumn 2027. Following consideration the Committee unanimously agreed to note the findings of the Best Value Thematic review. 14. Local Government Benchmarking Framework 2024-25 Results The meeting had before it a report by the Executive Director Finance, Strategy and Transformation presenting a corporate overview of benchmarking performance data for the period 2024-25, having also been presented to the Corporate Committee on 26 May 2026. Ms Wilson sought clarification of the basis of the text in the final column of Asset 15 in Appendix 1 stating "Moray has high performing schools that are fit for the future and financially and environmentally sustainable". In response, the Chief Executive confirmed it was not the current position but the outcome that the Council was striving to achieve. The Executive Director Education, Housing and Communities advised while there were a number of contributing factors that affect high performance in schools, the particular outcome related to being driven from an asset base. In response to a question from Councillor Stuart seeking clarification on whether the Council is confident it is achieving the correct balance between efficiency and meeting outcomes for the residents of Moray, the Executive Director Education, Housing and Communities confirmed user groups for leisure services have been created so they can be consulted with in order to involved them in the future design of the services and the same approach will be used for the library service. Following consideration the Committee unanimously agreed to note the Council's performance in terms of a corporate overview of benchmarking results. Councillor Colyer left the meeting during discussion of this item. 15. Guidance on Agenda Items The meeting had before it a report by the Executive Director Finance, Strategy and Transformation seeking approval of guidance for the identification of ad-hoc agenda items for the Committee. In response to a question from Councillor Warren asking if safeguards are in place to ensure that legitimate scrutiny requests are not filtered out by Council officers, the Head of Governance confirmed all requests would be filtered by Corporate Leadership Team to determine whether requests are possible. He also advised Page 11
Page 12
members have other mechanisms within the Standing Orders such as Notices of Motion or Written Questions to bring forward issues for consideration. As a follow up question, Councillor Warren asked if a written explanation could be provided with reasons where a thematic review proposal is submitted by a member but not progressed with details of an alternative route to take forward. The Chair advised any proposals submitted in line with the guidance should be accepted by officers. The Chief Governance Officer confirmed any decision taken has an explanation and suggested adding a sentence to the guidance under delegated powers to that effect to ensure a written explanation is provided to members. Following consideration and there being no one otherwise minded, the Committee unanimously agreed to approve the Guidance for Agenda Item Submissions document attached as Appendix 1 to the report, with the addition of the suggested amendment by the Chief Governance Officer. 16. Grant Thornton - Audit progress report and sector updates The meeting had before it a report by the Executive Director Finance, Strategy and Transformation informing the Committee of the progress of the Council's External Auditor on delivering their responsibilities. Following consideration the Committee unanimously agreed to note the audit progress report and sector updates. 17. Annual Governance Statement The meeting had before it a report by the Chief Executive providing Committee with a copy of the Council's Annual Governance Statement for 2025/26 for review and approval. Following consideration the Committee unanimously agreed to note the draft Annual Governance Statement provided as Appendix 1. Page 12
Page 13
Report to: Audit and Scrutiny Committee Meeting Date: 29 September 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Section Update Report 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to consider an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on ork carried out by Internal Audit. 2. SUMMARY 2.1 Global Internal Audit Standards requires the Service Manager Internal Audit and Risk to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan and any other relevant matters. 2.2 This report provides an update on audit activity and projects progressed since the last meeting. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers and notes the contents of this report, seeking clarification on any points. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT Grampian Valuation Joint Board Item 5. Page 13
Page 14
4.1 The Internal Audit Section of Moray Council provides an internal audit service to the Grampian Valuation Joint Board. The Joint Board’s financial systems align with those of the Council, but an annual internal audit review of testing transactions specific to the Assessor’s Service is required to provide assurances for the separate annual financial statements the Board must prepare and publish. It is pleasing to report that based on the audit work completed, reasonable assurance can be placed on the adequacy and effectiveness of the system of internal financial control established within the Assessor’s Service for 2025/26. Internal Audit Plan 2027/28 4.2 Preparation for the Audit Plan for 2027/28 has started. Internal Audit’s approach to annual audit planning is risk-based, with all areas subject to audit review contained within an ‘audit universe.’ The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems. 4.3 The Local Authority Accounts (Scotland) Regulations 2014 require that “a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing.” The standards adopted by all Scottish councils are the Global Internal Audit Standards, developed by the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Chartered Institute of Internal Auditors (CIIA). In accordance with the Global Internal Audit Standards (GIAS), the Service Manager Internal Audit and Risk is responsible for preparing the Annual Internal Audit Plan. However, consultation on projects for review will be undertaken with Senior Officers, Members of this Committee and the Council Leader. 4.4 In accordance with GIAS, local authorities are required to undertake an External Quality Assessment (EQA) of their internal audit function at least once every five years. Through the Council’s membership of the Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG), there is an opportunity to participate in a reciprocal arrangement whereby each internal audit service undertakes a review of another council and in turn, receives a corresponding review. The Council has previously adopted this approach. The findings of the most recent EQA, undertaken by Perth and Kinross Council, were reported to this Committee on 11 September 2024 (para 10 of the minute refers). While the Council could alternatively procure an independent EQA, this approach would incur a significant financial cost. Following consultation with the Chair of the Audit and Scrutiny Committee, Chief Executive and the Chief Governance Officer, it is considered that participation in the reciprocal arrangement represents the most cost-effective option and delivers best value for the Council and its partner organisations. To facilitate this approach, provision will need to be made within a future Annual Internal Audit Plan for the allocation of audit days to undertake an EQA review of another Scottish local authority. Internal Audit Plan Update 4.5 The Audit Plan establishes the annual priorities of the Internal Audit Service and outlines how these align with the Council’s wider strategic objectives. Appendix 1 provides an update on the progress made by the Internal Audit Section in delivering the planned audit projects, as well as the follow-up reviews to be undertaken during 2026/27. Follow Up Reviews 4.6 Internal audit reports are regularly presented to Members detailing audit findings and management responses to recommendations, including agreed implementation dates. Page 14
Page 15
Internal Audit also undertakes follow-up reviews to provide assurance that agreed recommendations have been implemented. Details of the completed follow-up reviews are provided below: 4.7 Emergency Planning An audit of the Council’s emergency planning arrangements was previously undertaken. The Council has a statutory responsibility to assess risks, prepare for emergencies and undertake exercises in relation to incidents such as flooding, severe weather, pandemics and other events that could have a significant impact on the community. Effective emergency planning is a key element of the Council’s governance and resilience framework, ensuring that critical services can be maintained and recovered in the event of a major incident. The audit identified a number of recommendations and a follow-up review was subsequently undertaken to assess the progress made in implementing the agreed actions. The outcome of that review was reported to this Committee on 25 March 2026 (para 6 of the minute refers). However, a further follow-up review was required due to one outstanding recommendation relating to the submission of an Annual Report to Members detailing emergency planning activities undertaken during the year and those planned for the forthcoming period. A further follow-up review has now been completed and I am pleased to report that the outstanding recommendation has been implemented. An Emergency Planning Annual Report was presented to Council on 6 May 2026 (para 12 of the minute refers). 4.8 Food Standards Scotland Guidelines Internal Audit previously reviewed the systems and procedures used by the Council’s Environmental Health Service to evaluate compliance with the Food Law Code of Practice (Scotland), as set by Food Standards Scotland. Local authorities are required to monitor compliance with food hygiene and standards legislation on behalf of Food Standards Scotland. In 2019, the Food Law Code of Practice (Scotland) introduced a Food Law Rating System, under which local authorities classify all food business operators within their area into defined categories. These ratings determine the frequency and level of intervention required to assess compliance with food safety standards. The original audit report included several recommendations and a follow-up review was undertaken to assess their implementation. This was reported to this Committee on 25 March 2026 (para 6 of the minute refers). However, a further follow-up review was required as one recommendation remained outstanding relating to the review and where necessary, updating of policies and procedures to ensure they remained current and applicable. I am pleased to report that the policies and procedures identified during the audit have now been reviewed and updated where necessary by the Service. 4.9 Children's Services Social Care Commissioning A further follow-up review has been undertaken to assess the implementation of a recommendation arising from a previous audit of the arrangements for commissioning children’s social care services. The original audit, reported to this Committee on 14 February 2024 (para 7 of the minute refers), evaluated the key controls in place within Children’s Services relating to the external commissioning of social care provision. This included contracts for preventive support, restorative services, residential care and out of area residential placements, necessitated by the limited availability of specialised provision within the Moray locality. The audit testing undertaken included a review of commissioning strategies and procedures, an evaluation of financial monitoring arrangements and an assessment of the effectiveness of contract management and Page 15
Page 16
4.10 4.11 4.12 monitoring processes. This follow-up review found that the outstanding recommendation relating to the implementation of a Commissioning Strategy for social care has been substantially implemented, with the Strategy having been developed and agreed by senior management; however, at the time of this review, it was still awaiting formal approval by the Board. The development of the Commissioning Strategy represents a significant improvement to the control framework, providing a structured approach to the planning, commissioning and monitoring of social care services. This will help ensure that future service provision is aligned with the needs of communities, supports strategic objectives and facilitates the effective use of resources. Keith Grammar School A further follow-up review has been undertaken at Keith Grammar School to evidence the implementation of an outstanding recommendation, specifically to confirm that no pre- signed cheques are maintained and that a new School Fund bank account has been opened. The audit of the financial and administrative arrangements at Keith Grammar School was reported to this Committee on 25 March 2026 (para 6 of the minute refers). The scope of the original audit covered the Devolved School Management Scheme, focusing on the allocation and management of funding within the School. The audit also examined whether non-payroll expenditure complied with Financial Regulations and Procurement Guidelines. In addition, testing was undertaken to ensure that appropriate accounting arrangements were in place for the management of School Fund monies. The follow-up review has confirmed that a new School Fund bank account has now been opened and no pre-signed cheques were noted. However, the transfer of the balance from the previous bank account had not yet been undertaken at the time of the follow-up review but is scheduled to take place on 20 August 2026, as confirmed by the new banking provider. Following completion of the transfer, the previous bank account will be closed. Levelling Up Fund A follow-up review has been undertaken to assess the implementation of recommendations arising from a previous audit of the management of the Levelling Up Fund, which was reported to this Committee on 25 March 2026 (para 7 of the minute refers). The Levelling Up Fund is a UK Government initiative aimed at reducing regional inequality. Moray Council was awarded £18.29 million in November 2023 to support town centre regeneration, transport improvements and cultural projects, with the Council acting as the accountable body responsible for financial compliance, procurement and reporting to the UK Government. The scope of the original audit covered the processes established to support governance and administrative arrangements relating to financial management, risk management, stakeholder engagement and performance monitoring. The follow-up report, confirming that all recommendations have been implemented, is provided in Appendix 2. As part of the funding requirements, the Internal Audit Section is required to undertake reviews of the management of the Levelling Up Fund. A further audit will be included in next year's Audit Plan to provide ongoing assurance that project delivery is being undertaken in accordance with the terms and conditions of the Fund award. Governance arrangements to prevent Fraud and Corruption An audit of Moray Council’s and Moray Integration Joint Board’s governance arrangements for preventing fraud and corruption was reported to this Committee on 20 November 2024 (para 8 of the minute refers). The review used CIPFA’s Code of Practice on Managing the Risk of Fraud and Corruption to inform the audit testing undertaken. The audit was Page 16
Page 17
4.13 delivered in partnership with the internal audit services of NHS Grampian and Aberdeenshire/ Aberdeen City Councils. This collaborative approach supported a more comprehensive and coordinated review, drawing on shared expertise and reflecting the integrated nature of service delivery across Council and NHS systems. The audit identified opportunities to further strengthen coordination and clarify responsibilities for fraud investigations across partner organisations, as well as improving the Council’s counter- fraud arrangements through the enhanced use of data analytics and more proactive audit activity. The follow-up report, enclosed in Appendix 3, confirms that all agreed recommendations have been implemented. Complex and Challenging Behaviour An audit of the Complex and Challenging Needs Service was reported to this Committee on 19 November 2025 (para 8 of the minute refers). The Service provides care and assistance to individuals with complex needs within purpose-built facilities in Elgin and Lhanbryde, as well as in their own homes across Moray. The audit reviewed the systems and procedures for the administration of the Service and the operational and financial arrangements in place to assist individuals in managing their personal funds. A follow-up review has now been undertaken and it is pleasing to note the progress made in implementing the recommendations. However, a further review will be required, as some recommendations have not been fully implemented. The follow-up report is enclosed in Appendix 4. 5. PROPOSALS 5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the period from 18 June 2026 to 29 September 2026. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. Page 17
Page 18
a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital Property No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. Does the proposal have the potential to affect people from the below categories differently to the wider Moray population: Yes Maybe No Positive Negative Positive Negative Page 18
Page 19
Any protected characteristics individuals or groups (Equality Act 2010) ☐ ☐ ☐ ☐ ✓ Any socio-economic disadvantaged individuals or groups – i.e. low / no income / wealth or deprivation ☐ ☐ ☐ ☐ ✓ Human Rights of individuals ☐ ☐ ☐ ☐ ✓ Rights of Children or Young People (UNCRC) ☐ ☐ ☐ ☐ ✓ JUSTIFICATION - Please provide a brief justification statement explaining why the above boxes have been selected There are no direct equalities, social inclusion or economic impacts arising from this report. However, the work of Internal Audit contributes to the effectiveness of governance, risk management and control arrangements across the Council, which support the delivery of equitable, inclusive and sustainable outcomes for communities. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 19
Page 20
APPENDIX 1 Internal Audit Annual Work Programme- 2026/27 Update Report CORE SYSTEM REVIEWS Auditable Area Type of coverage Status/ Comments Payroll Continuous auditing to confirm the adequacy of the systems and procedures for paying salaries. The intention is to make further use of an auditing software application in the analysis of data and the sample selected for testing. Audit programmed to start in the next quarter(s) Procurement and Creditor Payments Continuous auditing of samples of non-payroll expenditure to test compliance with procurement and payment processing regulations. An auditing software application in the analysis of data and the sample selected for testing will be used. Review will include separate analysis of expenditure processed through the Council and Moray Integration Joint Board Fieldwork Work Completed Third Party and Strategic Procurement (Topical Requirement) In accordance with the Global Internal Audit Standards (GIAS), an audit will be undertaken to assess the governance, risk management and control arrangements in place to ensure a consistent and comprehensive approach to managing third-party relationships. The GIAS User Guide will inform the development of the detailed audit scope and testing for this review. Draft Report Issued Cyber Security (Topical Requirement) In accordance with the Global Internal Audit Standards (GIAS), an audit of Cyber Security will be undertaken. This will include a review of the controls in place to identify and assess potential threats to the Council’s ICT systems and to evaluate how Draft Report Completed Page 20
Page 21
these threats are being managed. The GIAS User Guide will be used to develop the detailed audit scope and testing for this review. In addition, consideration will be given to the ‘key lessons’ and recommendations outlined in an Accounts Commission report regarding a cyber attack at Comhairle nan Eilean Siar. Insurance A review to provide assurance that the Council has effective and robust insurance procedures, ensuring that appropriate cover is in place and that processes are clearly defined and consistently followed. Audit programmed to start in the next quarter(s) Value Added Tax This audit will assess the adequacy and effectiveness of the Council’s arrangements for managing VAT compliance and reporting. It will review the processes for VAT treatment of income and expenditure, accuracy of VAT returns and adherence to HMRC regulations. Draft Report Completed Global Internal Audit Standards- Self Assessment The Global Internal Audit Standards (GIAS) require an annual self-assessment as part of a continuous quality assurance and improvement program to ensure that the internal audit function conforms to the standards. This assessment will involve reviewing the Internal Audit Section’s procedures and processes against the GIAS to identify areas for improvement and to inform a Quality Assurance and Improvement Plan (QAIP). Ongoing review SERVICE REVIEWS Page 21
Page 22
Auditable Area Type of coverage Status/ Comments Moray Growth Deal An audit will be undertaken of the governance and administrative procedures within the Council for the management of the Moray Growth Deal. The scope will include a review of partnership working arrangements, financial management, and the measurement of success criteria. Audit programmed to start in the next quarter(s) Environmental Services - Roads Maintenance (Response Repairs) This audit will assess the effectiveness of the Roads Maintenance Response Repairs, focusing on how reactive issues are identified, prioritised and resolved. The scope will include a review of the work order management system, costing arrangements and performance monitoring against service standards. Fieldwork Work in progress Elgin Neighbourhood Board This audit will assess the governance and accountability arrangements of the Elgin Neighbourhood Board in delivering local priorities. The review will include an assessment of reporting arrangements and compliance with relevant policies and funding requirements. Fieldwork Work in progress Education – Secondary School An establishment visit to review the financial and administrative arrangements of a secondary school will be undertaken as part of the cyclical review. Audit programmed to start in the next quarter(s) Climate Change and Sustainability The objective of this audit is to review the effectiveness and efficiency of the Council’s arrangements for addressing climate change and sustainability. The review will assess the adequacy of governance, risk management, internal controls, data reliability and compliance with statutory climate change requirements. The audit scope will Audit programmed to start in the next quarter(s) Page 22
Page 23
be agreed with the Principal Climate Change Officer before the review begins. Housing Allocations This audit will assess the Council’s housing allocation processes, including compliance with statutory requirements and the Housing Allocation Policy. It will also assess the adequacy of record- keeping, system access controls, and the monitoring and reporting of allocation decisions to ensure consistency and accountability. Draft Report Issued MORAY INTEGRATION JOINT BOARD Auditable Area Type of coverage Status/ Comments Self-Directed Support Option 1 This audit will assess the effectiveness of governance, financial controls and monitoring arrangements for Self-Directed Support Option 1, where individuals receive a direct payment to arrange their own care. The review will examine eligibility assessments, support planning, payment processing, and oversight of fund usage to ensure compliance with relevant legislation and policies. Fieldwork Work in progress Moray Integration Joint Board- Financial Sustainability/ Governance The review will assess the robustness of Moray IJB’s financial planning and governance arrangements, including the adequacy of its medium and long-term financial strategies, alignment of resources with strategic priorities and the effectiveness of its risk management in addressing funding pressures. The audit will also consider the clarity and transparency of financial reporting to Moray Council and NHS Grampian. Fieldwork Work in progress Block Contracts This audit will assess the effectiveness of Audit programmed to start in the next Page 23
Page 24
governance, procurement, and contract management arrangements for block contracts within social care services. It will review how contracts are awarded, monitored, and evaluated to ensure value for money, service quality and compliance with relevant legislation and Council policies and regulations. quarter(s) GRAMPIAN VALUATION JOINT BOARD Auditable Area Type of coverage Status/ Comments Grampian Valuation Joint Board In accordance with the Public Sector Internal Audit Standards applicable to local government and joint boards, an annual review is required of Grampian Valuation Joint Board activities. Completed VERIFICATION ACTIVITY Auditable Area Type of coverage Status/ Comments Year End Stock Valuations Verification of Year End Stock Verification for Building Services/ Environmental Services/ Community Services Stores. Completed Year end stock valuations agreed Network Support Grant Ongoing certification requirements for the Network Support Grant to Transport Scotland. Ongoing Half yearly audit certification requirement. Last Network Support Grant certified to 29/03/2026. COUNTER FRAUD ACTIVITY Auditable Area Type of coverage Status/ Comments Counter Fraud Review Annual review of the Council's counter fraud framework to minimise the risk and impacts of fraud from internal and external threats. The scope of the audit and testing undertaken will be informed by frauds reported within other organisations. Audit programmed to start in the next quarter(s) National Fraud Initiative The National Fraud Initiative (NFI) is a data-matching Notification has been received that the Page 24
Page 25
project conducted by the Cabinet Office on behalf of Audit Scotland every two years. It involves a data- matching exercise using information from various Council systems, as well as data provided by other councils and organisations. 2025/26 National Fraud Initiative (NFI) exercise has commenced. Services will review and document data matches, while Internal Audit will investigate potential fraud, monitor progress, and report on outcomes. Data uploads are scheduled from 30 September 2026, with matches expected to be available for review by 18 December 2026. FOLLOW-UP REVIEWS DUE TO EVIDENCE IMPLEMENTATION OF OUTSTANDING RECOMMENDATIONS FROM PREVIOUSLY ISSUED AUDIT PROJECTS – 2026/27* * Additional follow-up reviews may be added depending on the implementation dates for recommendations detailed by services Audit Undertaken Scope of Audit Review Pool Cars Scheme The scope of this audit was to review systems and procedures in the management and use of pool cars. Policies and procedures were checked to ensure they provide appropriate operating guidance to officers in the booking and use of pool cars. The audit included a review of arrangements for internal recharging to services and also exploration if further use of pool cars could provide additional value for money opportunities to the Council. Following the Public Pound The Internal Audit Plan provided for a “Following the Public Pound” review to ensure proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Councils fund Arms Length External Organisations (ALEOs) to provide important services to the public. These funding arrangements are often more complex than purchase contracts for goods or services but can bring both financial and operational benefits to councils. Procurement and Creditor Payments (Council & MIJB) A review of payments made to suppliers of goods and services was undertaken. The purpose of the audit was to confirm compliance with Financial, Authorisation, Procurement and Creditor Payment Processing Regulations from the sample checked. The review formed part of the annual continuous auditing activity of non-salary expenditure and is used to support the Service Manager Internal Audit and Risk’s annual opinion of the Council’s internal control system. Burials The scope of this audit was to review systems and procedures in the administration of the Burial Service. The included checking operational processes to ensure compliance with the Burial Grounds Standard of Service. In addition, a check was also made to verify the costs of delivering the Service and a review of systems and procedures for the collection of income Page 25
Page 26
Commercial Refuse Collection The Internal Audit Plan provided for a review to be undertaken of the controls in the management of the Commercial Refuse Collection Service. The audit checked to ensure robust accounting arrangements are followed, and appropriate agreements are in place with customers. Email Security The audit reviewed system controls, policies, and procedures governing the Council’s email system, including arrangements for identifying risks and mitigating phishing threats. It also assessed password management controls for Members’ access to Council networks and systems, as requested by the Audit and Scrutiny Committee (22 November 2023-minute 6 refers). Information Communications Technology (ICT) Hardware Assets The audit reviewed the systems and policies for managing, recording, and disposing of ICT hardware. Testing included verifying a sample of assets from the Inventory Register against their physical location, reviewing processes for recovering equipment from leavers, and assessing physical controls over access to servers and network equipment within Council buildings. Out of Area Placements A review of the systems and procedures regarding adult services users who are out of the area, but whose responsibility remains to meet their eligible care and support needs under the Care Act. Non-Domestic Rates The audit reviewed the effectiveness of key controls within the non-domestic rates system, with a particular emphasis on billing, collection and debt recovery arrangements. The scope focused on assessing whether appropriate controls and procedures are in place to ensure demand notices are issued accurately and on time to all liable ratepayers, that all income received through the various payment channels is fully and promptly accounted for, and that proportionate and effective recovery action is taken where amounts due remain unpaid. Democracy and Governance The scope of the audit was to assess the effectiveness of the governance structures in supporting the decision-making process. This included a review to ensure that key constitutional policies and guidelines are up to date, clearly documented and readily accessible to both members and officers Capital Plan Project Review The audit evaluated the governance and management of civil engineering–type projects within the Capital Plan administered by the Consultancy Service. The review assessed the adequacy of arrangements for identifying, appraising and approving projects for inclusion in the Capital Plan. The audit also included detailed testing of a single project, from contract award through to completion of works. This testing focused on compliance with the Council’s Financial Regulations, Procurement Guidelines and the New Engineering Contract (NEC) Conditions of Contract. Milnes High School The scope of this audit was to review the operation of the Devolved School Management Scheme in terms of funding allocation and management at the school level. As part of the audit, the arrangements for administering the School Fund were also reviewed. Secondary School Security This audit reviewed the security policies and procedures developed by the Education Service, as well Page 26
Page 27
as guidance issued by individual secondary schools on the security of school premises and grounds. Audit testing included the selection of a sample of schools for site visits, during which the effectiveness of security controls was observed and evaluated against the relevant policies and guidance. Building Services – Planned The audit reviewed how the Building Services planned maintenance programme is determined and the contract management arrangements in place for these projects. This included the selection of a sample of projects to verify that costs could be evidenced by appropriate supporting documentation. Additional testing was also undertaken to assess the systems and controls in place for the management and authorisation of overtime payments to officers. Building Services – Reactive The scope of this audit included a review of the systems and controls in place for the administration and management of reactive repairs within Building Services. This involved examining the process from the identification and raising of repair requirements through to the completion of works, the recharge of costs, and budget management. Counter Fraud Review The Annual Audit Plan included a review of the Council’s counter-fraud framework to assess the effectiveness of arrangements for minimising the risk of fraud. The review was undertaken in accordance with the CIPFA Code of Practice on Managing the Risk of Fraud and Corruption. The audit included an examination of systems and procedures identified as having a higher risk of fraud, with the scope of testing informed by fraud cases reported across the public sector and highlighted by regulatory authorities, including Audit Scotland, through its Technical Bulletins. Management of School Funds The scope of the audit was to review the arrangements in place for the management and administration of school funds and to assess compliance with the Council’s School Fund Regulations. The review also examined the governance and oversight framework operated by Education Services. Testing was undertaken at a sample of primary and secondary schools to obtain assurance that controls were operating effectively and consistently across the Council. Treasury Management The scope of audit reviewed the procedures and controls in place to ensure compliance with the borrowing and treasury management requirements set out in the CIPFA Code of Practice on Treasury Management in the Public Services (2021) and the CIPFA Prudential Code for Capital Finance in Local Authorities (2021). Payroll The Internal Audit Plan includes an annual review to provide assurance on the adequacy and effectiveness of the systems and procedures in place for the payment of salaries. The review involved testing a randomly selected sample of starters, leavers and current employees to assess the accuracy of pay calculations and to confirm that appropriate supporting documentation had been retained and approved. In addition, checks were undertaken to confirm that deductions from Page 27
Page 28
salary payments were made in accordance with statutory requirements or had been appropriately authorised by employees. Page 28
Page 29
APPENDIX 2 1 Final Internal Audit Report (Follow Up) Levelling Up Fund August 2026 Distribution: Head of Growth, Planning & Climate Service Manager Strategic Planning & Development Levelling Up Fund Programme Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Full Priority 1 0 Priority 2 0 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 29
Page 30
Appendix 2 2 Contents Page Levelling Up Fund 1. Introduction & Scope 3-4 2. Key Issues 4 Detailed Report 3. Findings/Recommendations 5-7 4. Management Response 6-8 5. Follow Up Review 6-8 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 30
Page 31
Appendix 2 3 1. Introduction and Audit Scope The Annual Audit Plan for 2025/26 includes a review of the adequacy of governance and administrative arrangements in place for managing the Levelling Up Fund awarded to Moray by the United Kingdom (UK) Government. Moray Council successfully secured funding for the Elgin City Centre Masterplan as part of the third-round award of the Fund. This investment is intended to support the regeneration of the town centre, upgrade local transport and enhance cultural and heritage assets. The UK Government announced in November 2023 a Levelling Up Funding award of £18,291,000 to the Moray Council. In December 2024, the Memorandum of Understanding was signed between Moray Council and the UK Government, agreeing on the terms, principles and practices for the administration and delivery of Moray's Levelling Up proposals. Moray's Levelling Up Fund proposals centre on three key projects; revitalising Elgin town centre by bringing disuses buildings back into use and enhancing pedestrian access and the evening economy; transforming a former mart site to enable commercial development, create a multifunctional green space and improve links to the city centre; and reimagining Cooper Park by restoring this valued community space with upgraded recreational and leisure facilities for residents and visitors. Full delivery of the programme is required by 31st March 2028. The Levelling Up Fund projects are governed through a collaborative structure comprising a Project Board, Delivery Groups, and Moray Council. The Project Board provides strategic leadership and oversight, ensuring that all funded initiatives align with the objectives of the Levelling Up Fund. Community representatives also sit on the Project Board, contributing local knowledge and ensuring decisions reflect community priorities. Delivery Groups operate under the guidance of the Project Board to implement individual projects. These groups coordinate day-to-day activities, engage with contractors and partners, and ensure projects progress on time and within budget. Moray Council acts as the Accountable Body for the Fund, managing financial compliance, procurement, and reporting obligations to the UK Government. The Council's Internal Audit Section will include days within the Annual Audit Plan for work relating to the Levelling Up Fund, for the project duration. However, given the proposed timescales, 2025 has primarily been a preparation year, involving planning, design, legal agreements and consenting, while 2026 is scheduled for the delivery of the projects. As the programme is at an early stage, the scope of this audit has been limited to reviewing the processes established for governance and administrative arrangements related to finance, risk, engagement and performance management. At the time of the audit review at the end of September 2025, £8.1 million of Levelling Up funding had been received from the UK Government. Expenditure Page 31
Page 32
Appendix 2 4 of £1.7 million had been incurred for project management, design fees, legal fees and enabling works. The claims submitted to the UK Government to date have been reviewed and checked to ensure alignment with the Financial Management System (FMS). Audit testing has confirmed that the expenditure claimed to date is eligible under the terms of the Levelling Up Funding Scheme, with submissions made to the UK Government in a timely manner. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • The audit found that, within the scope of the review, appropriate arrangements have been developed for the governance and administration required to deliver the funding objectives of the Levelling Up Fund. The Project Board and focused Delivery Groups are meeting in accordance with an agreed schedule, with effective engagement from multidisciplinary officers and external stakeholders. Robust processes for risk identification and management have been established, and delivery plans have been developed in line with best-practice project management standards. Systems for financial performance monitoring are also in place, supported by established processes for reporting and forecasting. • The audit noted the need for some administrative improvements regarding the frequency of financial monitoring information and the review of content related to the Levelling Up Fund published on the Moray Council website. However, these issues are not considered significant and are regarded as lower-level control requirements. Page 32
Page 33
5 Findings/Recommendations - Levelling Up Fund 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Low It was noted that 2025 has been predominantly a preparation period for the Levelling Up Fund, with significant work undertaken in planning, design, stakeholder engagement, legal agreements and consenting, with delivery of the projects planned for 2026. The My Moray website is the official engagement platform for the Moray Economic Partnership and is used to provide updates on progress regarding programme activities. However, information about the Levelling Up Fund is also recorded on a dedicated page of the Moray Council website. The audit review noted that the information on the Council's website contained outdated content. The Moray Council website content relating to Levelling Up Fund activities should be reviewed and updated to ensure it reflects the current status of the programme. Page 33
Page 34
6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Strategic Planning & Development Yes 27/02/2026 The relevant pages on the Council website are in the process of being updated. Going forward into the main construction periods of 2026 and 2027 detailed plans are being discussed for continuous communications with key stakeholders and for joined up communications for the full regeneration project portfolio, dependent on corporate Communications resourcing. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The Moray Council website content relating to Levelling Up Fund activities has been appropriately reviewed and updated with a link added to the My Moray website, which is the official engagement platform reporting programme progress detail. Dedicated communications resourcing has been allocated to the programme and is allowing increased reporting to stakeholders across media channels, as programme delivery progresses. Page 34
Page 35
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low Levelling Up Fund (LUF) programme financial spend and forecasting is compiled on request for monitoring returns from the UK Government and on quarterly capital plan reporting to the Committee. The UK Government monitoring returns were intended to be quarterly reports, but have experienced slippage, with the last two covering 6-month periods. Whilst financial transactions are recorded when incurred within the Council's Financial Management System, there is no monthly compilation of a monitoring statement, as is the standard budget monitoring process for Council services. Full validation of recorded transactions and agreement of allocations therefore takes place covering a longer time period, as it is currently undertaken when formal reporting is required to the UK Government. A monthly financial statement review of expenditure would enhance the control and monitoring process. A monthly financial statement should be compiled and agreed between LUF programme management and the Accountancy Service to facilitate improved financial monitoring arrangements. An up to date summary of spend should be continually available for management, given the sizeable programme of work. Page 35
Page 36
8 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Strategic Planning & Development Implemented 12/11/2025 The provision of monthly financial statements by the Accountancy Service has commenced since the completion of the audit project. This ensures more frequent monitoring, progressive code alignment and consistency between the financial ledger and Service records. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Monthly financial statements are now prepared by the Accountancy Section and provided to the Levelling Up Fund programme management for scrutiny in comparison to project progress, forecasts at completion, compensation events and risks. This allows assessment of whether projects remain on track and to identify any funding pressures or opportunities at regular meetings of the programme team and with finance support. The updated financial monitoring process has been added to the Programme Financial Monitoring Policy. Page 36
Page 37
9 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 37
Page 38
10 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 38
Page 39
APPENDIX 3 1 Final Internal Audit Report (Follow Up Review) Governance arrangements to prevent Fraud and Corruption June 2026 Distribution: Head of Service & Depute Chief Officer (MIJB) Chief Governance Officer Chief Financial Officer Head of People, Change & Community Strategy Service Manager Internal Audit & Risk The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 0 Priority 2 3 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 39
Page 40
Appendix 3 2 Contents Page Governance arrangements to prevent Fraud and Corruption 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-13 4. Management Response 5-14 5. Follow Up Reviews 6-14 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 40
Page 41
Appendix 3 3 1. Introduction and Audit Scope The Annual Audit Plan for 2024/25 provides for a review of the Council and the Moray Integration Joint Board (MIJB) governance arrangements to prevent fraud and corruption. The primary responsibility for preventing and detecting fraud and corruption rests with management who should ensure adequate systems of internal control, segregation of duties and proper authorisation procedures. However, the Internal Audit Section does have a role in supporting these arrangements by assessing the adequacy of these controls, and in accordance with the Council’s Financial Regulations for the Service Manager Internal Audit and Risk to investigate in consultation with the Depute Chief Executive Education, Communities & Organisational Development irregularities concerning finances, property, services or policies of the Council. The audit also reviewed the arrangements for the investigation, preventing and detecting fraud and corruption within the MIJB. The Council’s Service Manager Internal Audit and Risk is also the Chief Internal Auditor of the MIJB. The CIPFA Code of Practice on Managing the Risk of Fraud and Corruption was used as the template for developing an audit programme for this review. The audit was also undertaken as part of a joint working arrangement with the internal audit service providers of NHS Grampian, Aberdeen City and Aberdeenshire Councils. This has allowed the sharing of knowledge and agreement in the audit testing to ensure consistency and a more overarching review of the Integration Joint Boards (IJBs) counter fraud and corruption arrangements within the Grampian area. The IJBs deliver services through officers and systems of the Council and NHS Grampian. Officers from the Council and NHS Grampian will have access to the systems of both organisations. It is hoped these joint working arrangements with the internal audit service providers within Grampian will continue as it provides the opportunity for a more cross-organisational review of the IJB’s risk management, control and governance processes irrespective of NHS Grampian or Council systems are used in the delivery of services. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • The Global Internal Audit Standards require the Chief Internal Auditor to provide an opinion on the overall adequacy and effectiveness of the MIJB risk management, control and governance processes. MIJB delegated services are delivered by Council and NHS Grampian employed officers with access to systems of both organisations. Responsibility for investigating fraud within the Council lies with the Page 41
Page 42
Appendix 3 4 Service Manager Internal Audit and Risk, but for NHS Grampian, it is the responsibility of the NHS Counter Fraud Authority. It is appreciated that the occurrence of fraud is rare, but consideration should be given to developing a protocol between the Service Manager Internal Audit and Risk in consultation with the Chief Internal Auditor of Aberdeenshire/ Aberdeen City Councils and the NHS Counter Fraud Authority. This should assist in providing greater clarity and co-ordination of responsibility in the notification, investigation and reporting of alleged frauds within the MIJB, irrespective of whether the Council or NHS Grampian employs the officer delivering the delegated service. • The CIPFA Code of Practice on Managing the Risk of Fraud and Corruption requires that an “organisation should make arrangements for appropriate resources to support the counter fraud strategy”. This includes the need to detect fraud through data and intelligence analysis. The staff resources of the Internal Audit Section are limited, but consideration should be given to including a project within the Annual Internal Audit Plan to review Council systems and practices where fraud or irregularities have occurred in other organisations. The testing undertaken should make use of data evaluation software in the analysis of information, and a review of fraud cases and other irregularities reported within the media, Audit Scotland Technical Bulletins and participation in the Scottish Local Authority Investigator's Group. Page 42
Page 43
5 Governance arrangements to prevent Fraud and Corruption - 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium A review of the Council’s policy framework which supports a counter fraud strategy, noted a range of policies to inform officers in their conduct and responsibilities as employees. These policies also protect officers from false allegations of fraud or corruption. However, the audit review noted that the Code of Conduct for Employees and the Policy on Outside Employment had not been reviewed for a number of years. It is appreciated that both the Code of Conduct for Employees and the Policy on Outside Employment detail best practices and are still relevant; however, both documents should be reviewed and if required updated. The Code of Conduct for Employees and the Policy on Outside Employment should be reviewed and if required updated. In addition, future dates of review should thereafter be agreed. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Organisational Development & Change Yes 31/03/2026 The employment policy framework is reviewed annually, resulting in agreement on the priorities for policy review according to a range of factors, such as changed legislation. The Code of Conduct for Employees and the Policy on Outside Employment remain appropriate and have not been identified as a priority for updating; however, they will be included in the annual plan for policies review for 2025/26. Page 43
Page 44
6 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The Code of Conduct for Employees has now been reviewed, updated, and approved by the Corporate Committee on 26 May 2026. The updated Code of Conduct incorporates the Policy on Outside Employment. Page 44
Page 45
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low It was noted that the Council’s website included details on reporting allegations of potential fraud to the Internal Audit Section. However, reference is made specifically to the reporting of Housing and Social Security Benefits fraud, as this used to be the most significant area of allegations received for investigation. A review of the wording used within the Council’s internet site should be undertaken, as a need to report a potential fraud may relate to any service area of the Council. In addition, research noted online fraud reporting function within other Local Authorities as an additional method for an individual to report an allegation of fraud. Current wording used within the Council’s internet site for reporting an allegation of fraud should be reviewed and updated. In addition, consideration should be given to the development of an online reporting function as an additional method for an individual to raise a concern of fraud to the Council. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Internal Audit & Risk Yes 31/03/2025 The information on the Council’s website for reporting fraud will be reviewed and updated. The timescale for implementation of this recommendation has been set at 31 March 2025 due to the need to update web pages and develop an online fraud reporting function, which requires support from the ICT Section. Page 45
Page 46
8 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Information relating to fraud reporting on the Council’s website has been reviewed and updated. The revised webpage now includes an online reporting facility for suspected fraud. Page 46
Page 47
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Low As part of the audit planning of projects to be included within the Annual Audit Plan for 2023/24, a joint working arrangement was agreed with the internal audit service providers of NHS Grampian, Aberdeen City and Aberdeenshire Councils to review the Integration Joint Boards governance arrangements to prevent fraud and corruption. This has allowed for a more overarching review to be undertaken. As part of the joint audit working arrangement, this has also enabled the sharing of knowledge and information. The Financial Regulations of the MIJB were updated last year to include revised wording for reporting and investigating a suspected irregularity. However, it was noted that our neighbouring Councils had developed a “Counter Fraud Process” detailing best practices to follow in assessing a referral and investigating fraud. The occurrence of fraud is rare and the nature of each investigation can vary in nature, but consideration should be given to reviewing and if required, adapting this procedural document within Moray. Consideration should be given for the Internal Audit Section to develop a “Counter Fraud Process” procedure. Page 47
Page 48
10 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Internal Audit & Risk Yes 30/11/2024 The “Counter Fraud Process” already developed by a neighbouring Council will be used to prepare a similar procedural guidance document for the Moray Council. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A A ‘Counter Fraud Process’ procedural document has been developed and agreed for use within the Internal Audit Section to support investigations into irregularities. Page 48
Page 49
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium The Council’s Service Manager Internal Audit and Risk is the appointed Chief Internal Auditor for delivering an internal audit service to the MIJB. MIJB delegated services are undertaken by Council and NHS Grampian officers and systems. Officers of both the Council and NHS Grampian are required to use the systems of each organisation to deliver services. The Service Manager Internal Audit and Risk is responsible for investigating suspected irregularities within the Council, and the NHS Counter Fraud Authority investigates NHS Grampian's allegations of fraud. However, an issue may occur if an officer employed by the Council commits fraud involving an NHS system and vice- versa as to whether the allegation within the MIJB should be investigated by the Council’s Service Manager Internal Audit and Risk or the NHS Counter Fraud Authority. The nature of the fraud may have a cross organisational implication regarding access to information and the individual officer's terms and conditions of employment from each organisation. Consideration should be given to the Service Manager Internal Audit and Risk, in consultation with the Chief Internal Auditor of Aberdeenshire and Aberdeen City Councils, to discuss and if possible, agree on a protocol for the notification, investigation and reporting of alleged fraud within the Grampian IJBs with the NHS Counter Fraud Authority. This may require a “letter of understanding” detailing agreed arrangements for the fraud investigation. Page 49
Page 50
12 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Internal Audit & Risk Yes 30/11/2024 Contact will be made with the Chief Internal Auditor of Aberdeenshire and Aberdeen City Councils to discuss arranging a meeting with the NHS Counter Fraud Authority to agree a protocol for investigating fraud within the Grampian IJBs. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Discussions have been held with NHS Grampian and a single point of contact has been agreed to ensure a coordinated approach to investigating alleged irregularities within the Integrated Joint Boards. This will help ensure that investigations are undertaken by the appropriate organisation, irrespective of whether the officer is employed by the Council or NHS Grampian. In addition, this approach will facilitate any cross-organisational investigation requirements. Page 50
Page 51
13 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium At a Special Meeting of the Moray Council on 28 February 2024, it was decided to reduce the Internal Audit Section staffing budget by replacing the Corporate Investigations Officer’s post with a 0.5 full-time equivalent. The remaining budget was used to appoint an Assistant Auditor, but this proved unsuccessful, with no suitable applicants. The CIPFA Code of Practice on Managing the Risk of Fraud and Corruption requires that an “organisation should make arrangements for appropriate resources to support the counter fraud strategy” of the Council. This includes the need to detect fraud through data and intelligence analysis. The limited staff resources of the Internal Audit Section are appreciated, but consideration should be given to including a project within the Annual Internal Audit Plan to review systems and practices where fraud or irregularities have been reported within other organisations. During this review, it was noted that a financial fraud was reported in the media of an officer in another Local Authority embezzling over £1 million in council tax refunds. Further to consultation with the Council’s Taxation Manager, additional controls have been introduced to current operating arrangements. The Service Manager Internal Audit and Risk should consider including a project within the Annual Internal Audit Plan to review Councill systems and practices where fraud has occurred within other organisations. Identification of the scope and testing to be undertaken will be determined from a review of fraud cases reported in the media, Audit Scotland Technical Bulletins and participation in the Scottish Local Authority Investigator's Group. The use of information data evaluation software should also be used in the analysis of information and databases. Page 51
Page 52
14 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Internal Audit & Risk Yes 28/02/2025 A project will be included to support the Council’s and MIJB counter fraud and corruption arrangements in the Annual Internal Audit Plan. The scope of the audit and testing undertaken will be determined from frauds reported within other organisations. The use of IDEA data analysis software will be further developed in the analysis of information used for audit testing. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A A counter fraud review was undertaken as part of the Audit Plan for 2025/26 and was reported to the Audit and Scrutiny Committee on 25 March 2026 (Item 9). The review assessed governance arrangements, fraud risk identification, staff awareness, internal controls, reporting procedures and collaboration with external bodies, in accordance with best practice as set out in CIPFA’s Code of Practice on Managing the Risk of Fraud and Corruption. A further counter fraud review has been incorporated into the 2026/27 Audit Plan, which was presented to the Audit and Scrutiny Committee on 25 March 2026 (Item 10). Page 52
Page 53
15 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 53
Page 54
16 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 54
Page 55
APPENDIX 4 1 Final Internal Audit Report (Follow Up Review) Complex and Challenging Needs Service August 2026 Distribution: Service Manager Provider Services Team Manager/Consultant Practitioner Complex and Challenging Needs The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 1 Priority 2 8 Priority 3 5 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 55
Page 56
Appendix 4 2 Contents Page Complex and Challenging Needs Service 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-26 4. Management Response 6-27 5. Follow Up Review 7-27 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 56
Page 57
Appendix 4 3 1. Introduction and Audit Scope The annual Internal Audit plan for 2025/26 includes a review of the Complex and Challenging Needs Service. This service supports individuals with complex care needs at purpose built facilities in Elgin and Lhanbryde, as well as within their own homes across Moray. At the time of the audit, the care facility in Elgin provided support to four adults. The accommodation consists of a large bungalow with shared living rooms, a communal kitchen and a garden. The facility in Lhanbryde serves as the administrative base for the service and supports eight individuals in separate, purpose built accommodation, with access to a communal area used for social activities. The overall budget for delivering the Complex and Challenging Needs Service in 2024/25 was approximately £7.7 million. The scope of the audit was to review the systems and procedures for delivering and managing the Complex and Challenging Needs Service, specifically at the care facilities in Elgin and Lhanbryde. This was an audit of the administrative arrangements, rather than an assessment of the quality of care provided. The Care Inspectorate in Scotland, as the national regulatory body for care services, is responsible for ensuring that care services meet the required standards. The audit focused on reviewing policies, procedures, and operating practices in the administration of the Complex and Challenging Needs Service, particularly in relation to budget management and the arrangements for assisting people in managing their personal funds. However, the audit did include a check to ensure that Support Plans for individuals supported by the service were reviewed in accordance with agreed timescales. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • The Complex and Challenging Needs Service provides 24-hour support to individuals with specific care requirements. The audit found that the Service has a number of staff vacancies and as with other care sectors, is experiencing difficulties in recruiting officers. Analysis of payroll expenditure indicated that the majority of officers are working additional overtime hours each week. Random testing of overtime claims noted that some officers who are supporting individuals are often working more than 60 hours per week. The audit notes the demands on the Service and the commitment of officers to support the care needs of individuals; however, it does question the sustainability of current working arrangements Page 57
Page 58
Appendix 4 4 • The Service also supports people at both care facilities in managing their personal funds. Officers assist individuals with payments for groceries, utilities and other living expenses. Separate records are maintained for each individual and any cash held on their behalf is stored securely. Documented guidelines outline the procedures for officers in administering these funds; however, these guidelines have not been reviewed or updated for several years. Consideration should be given to transitioning from a cash-based system to individual bank accounts, which would allow for the introduction of additional controls. • This audit focused on the financial administration of the Complex and Challenging Needs Service. However, it also included a check to confirm that the Support Plans of individuals at both care facilities had been reviewed in accordance with agreed timescales. The audit found that the majority of care packages sampled had not been reviewed for over a year. In accordance with Health & Social Care Moray Eligibility Criteria Policy, there is a requirement for a Social Worker/Community Care officer to undertake annual reviews where support is provided to meet eligible needs, or more frequently as a response to a significant change in circumstances. Page 58
Page 59
5 Findings/Recommendations - Complex and Challenging Needs Service 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 High Officers of the Service support individuals with complex care needs at the care facilities in Elgin and Lhanbryde, as well as within their own homes. A review of the staffing complement at the time of the audit identified significant vacancies. As with other social care providers, the Service is experiencing difficulties in recruiting officers. An analysis of payroll costs found that the majority of officers employed within the Service are working more than their contracted hours each week. Approximately £750,000 was paid in overtime during 2024/25. Audit testing of individual overtime claims, undertaken to verify accuracy and compliance with Financial Regulations, revealed that some Support Workers are regularly working in excess of 60 hours per week. While the audit acknowledges the commitment of officers to meeting the needs of individuals supported by the Service, it also raises concerns about the sustainability of the current working arrangements. The ongoing recruitment campaign for officers within the Complex and Challenging Needs Service should be maintained. Consideration should also be given to exploring alternative approaches to reduce the significant levels of overtime currently worked by some officers. Page 59
Page 60
6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager (Provider Services) Yes Ongoing A short-life working group will be established to seek solutions and support the ongoing staffing challenges facing the Service. Since the audit, there has been a reduction in vacancies at Woodview from 19.1 FTE to 10.6 FTE (as of 1st October), and at Barlink from 4.49 FTE to 0.45 FTE for Support Workers and 1 FTE for a Keyworker (as of 1st October). While the appointment of new staff will not have an immediate impact on reducing overtime, due to the requirement for training and shadow shifts, it is expected that, over time, this will lead to a decrease in overtime usage. In addition, a review of staffing arrangements is ongoing to identify improvements in service delivery. The combination of recent staff recruitment and a review of current service delivery methods is expected to support a significant reduction in overtime in the future. This will be closely monitored by senior management. Page 60
Page 61
7 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Part Implemented 31/03/2027 The follow-up review found that the Service has made significant progress through the implementation of a Change Management Plan. This has included a comprehensive review of the staffing structure, including the regrading of Support Worker posts. The expected outcomes of these changes include a reduction in the Service's reliance on officer overtime to meet operational demands. However, as the changes have only recently been implemented, the follow-up review has been unable to evidence their impact on the use of overtime. A revised implementation date of 31 March 2027 has been agreed with the Service. Page 61
Page 62
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium The audit reviewed a random sample of officers overtime and travel/expenses claims to verify their accuracy and ensure correct authorisation in accordance with Financial Regulations. Testing identified one case where an officer had submitted an overtime claim for 13.75 hours and a travel/expenses claim for 27 miles in advance of the date the work was to be undertaken. Further investigation found that the officer had neither worked the planned additional hours nor incurred the mileage claimed, due to sickness absence. This is not in compliance with Financial Regulations. The officer has since reimbursed the overpaid amount and the mileage claimed. The audit also found that approximately one-third of all travel claims submitted by the service were not dated at the time of signing, either by the submitting officer or the authorising officer. In accordance with Financial Regulations, officers within the Complex and Challenging Needs Service should be reminded that claims for overtime and travel/expenses must only be submitted after the hours have been worked or the mileage incurred. Additionally, all travel/expenses claims must be dated at the time they are signed by both the submitting and authorising officers. Page 62
Page 63
9 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers Service Manager (Provider Services) Yes Yes 30/09/2025 31/03/2026 All staff are to be informed, in accordance with the Financial Regulations, of the correct procedure for completing and submitting travel and expense claims. In addition, these requirements will be reminded during Supervision and Team Meetings Digital solutions will be explored with the Payroll Service for submitting expenses claims. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The follow-up review noted, from meeting minutes, that officers have been reminded of the correct procedures for submitting travel and subsistence claims. Management has also implemented additional verification controls to review the accuracy of claims. Follow-up audit testing of a sample of travel and subsistence claims submitted by officers within the Service identified no discrepancies. Page 63
Page 64
10 Part - Implemented 31/12/2027 It was noted that a new payroll software application is currently being implemented, which will facilitate the electronic submission of claims. The Service advised that the system is being rolled out on a phased basis, with implementation within the Complex and Challenging Behaviour Service scheduled for 2027/28. Page 64
Page 65
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium A review was undertaken of non-staffing expenditure made by the Complex and Challenging Needs Service. This involved testing a random sample of payments to suppliers of goods and services and checking to ensure compliance with Financial Regulations and Procurement Guidelines. The review found that mostly correct procurement and authorisation processes had been undertaken. However, an example was noted where Guidelines had not been followed in the procurement for the purchase and installation of a bicycle shed to the value of £25,000. Officers involved in the purchasing of goods and services should be reminded of the need to comply with Financial Regulations and Procurement Guidelines. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Team Manager/Consultant Practitioner Residential Complex and Challenging Needs Yes Implemented A grant was secured for the bike shed, and all work was completed within the £25,000 grant allocation. Staff have been reminded of the requirement to comply with the Council’s Procurement Guidelines. Page 65
Page 66
12 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The follow-up review noted from the minutes of meetings within the Service that officers have been reminded of the requirement to comply with Financial Regulations and Procurement Guidance. Page 66
Page 67
13 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Low Analysis of the Financial Management System indicated that the overall budget for delivering the Complex and Challenging Needs Service in 2024/25 was £7.7 million, with the majority of expenditure related to staffing costs. It was found that the staffing budget is regularly reviewed to ensure accuracy and alignment with the needs of individuals supported by the Service. However, a number of other non staffing budget headings that is not material in value e.g. non domestic rates, utilities and ad- hoc repairs had a budget allocation which did not correspond to actual expenditure incurred. A financial “housekeeping” exercise should be undertaken to review and adjust the budget allocations for non-staffing costs to better reflect current expenditure. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Team Manager/Consultant Practitioner Residential Complex and Challenging Needs / Accountant Yes 31/03/2026 The Service, in consultation with the Accountancy Section, will review the non- staffing budget to ensure it is more closely aligned with actual expenditure. Page 67
Page 68
14 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Outstanding 31/03/2027 It is acknowledged that significant resources have been required to implement the Change Management Plan detailed within Finding 1. The Service is currently consulting with Accountancy to review non-staffing budgets and ensure they are more closely aligned with actual expenditure. However, the Service has advised that a revised implementation date of 31 March 2027 is required to fully implement this recommendation. Page 68
Page 69
15 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium The audit visit to the care facility in Lhanbryde found that funds are held in both cash and within a bank account of monies collected through fundraising activities and donations. These funds are intended for the benefit of the people supported by the Service. The administrations of these funds are similar to the requirements of a Private Fund within a School. The audit checked the income and expenditure activity of these funds and undertook a reconciliation to confirm the accuracy of the monies held to supporting documentation. It is pleasing to report that no discrepancies were noted. However, there are no operating guidelines to support officers in the administrative requirements in the management of these funds. Guidelines should be developed detailing the administrative requirements in the management and accounting arrangements of monies held from fundraising activities and donations. Page 69
Page 70
16 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers (Woodview) Service Manager (Provider Services) Yes Yes 31/03/2026 28/02/2026 A financial procedure will be developed for the management and administration of funds collected from events, donations, and fundraising, as well as the expenditures used to benefit individuals using the service. This will include the opening of a new bank account (where an admin fee is not charged). A management panel will be established to oversee and agree the allocation of funds. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented Implemented N/A N/A Guidelines have been developed and are in operation detailing the administrative requirements in the management and accounting arrangements of monies held from fundraising activities and donations, The follow-up review confirmed that a management panel has been established to oversee the allocation of funds generated through events, donations and fundraising activities. Page 70
Page 71
17 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Medium The audit review noted that officers at the care facilities support individuals in the management of their personal monies. Cash sums are stored securely for individuals at the care facilities and are used for purchases such as groceries, day trips, utility bills and other living expenses. Operating arrangements for administering these funds are detailed within the Financial Guidelines developed by the Service. The audit reviewed these arrangements, including a reconciliation of supporting documents to the cash held for a sample of individuals. The following points were noted: • Resident funds are administered in cash. Records are maintained to evidence and reconcile individual balances against the monies held. However, it is considered that the amounts of cash stored at the care facilities for some individuals exceed routine weekly expenditure requirements. Consideration should be given to implementing alternative methods for managing the personal funds of individuals, such as individual banking arrangements. Page 71
Page 72
18 • The Financial Guidelines document detailing the administration arrangements for individuals’ funds has not been reviewed or updated since 2022. The Financial Guidelines document for administering individuals’ funds should be reviewed and updated as required. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager (Provider Services)/ Service Manager (Learning Disability) / Chief Financial Officer (MIJB) Assistant Managers (Woodview) Yes Yes 31/03/2026 30/09/2025 A review will be undertaken to explore alternative methods for managing the personal funds of individuals, including consultation with guardians, social work, and Finance. The Financial Guidelines document for administering individuals’ funds will be reviewed and updated. A request will also be submitted to Community Finance for weekly cash uplifts, thereby reducing the amount of funds held within the service Page 72
Page 73
19 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented Implemented N/A N/A The Financial Guidelines for administering individuals’ funds has been reviewed and updated. The follow-up review noted progress in addressing the issues identified in the original audit. The Service has explored the use of individual banking arrangements for the management of funds held on behalf of individuals; however, administrative challenges remain where appointeeship arrangements are in place. Audit testing found a reduction in the amount of cash held since the original review. In addition, revised operating arrangements, including the increased use of purchasing cards, have reduced reliance on cash transactions and strengthened the associated control framework. Page 73
Page 74
20 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 7 Low The audit visit to the care facility at Lhanbryde noted the provision of two petty cash accounts: an Adult Services account with an imprest amount of £250 and a Children’s and Young Persons account with an imprest amount of £120. The review found that the Adult Services account was well managed and operated in accordance with Financial Guidelines. However, further to discussions with officers indicated that greater use is now being made of the purchasing card. The Children’s and Young Persons petty cash account had not been used since 2022. This account was initially established to support a young person before they turned 18 and transitioned into Adult Services. Consideration should be given to closing both the Adult Services and Children and Young Persons petty cash accounts. Page 74
Page 75
21 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Mangers (Woodview) Yes Implemented Petty cash has now been closed for both services, and evidence of this closure has been submitted to Internal Audit. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The follow-up review has confirmed that both petty cash accounts have been closed. Page 75
Page 76
22 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 8 Medium The audit included a review to ensure that Support Plans for individuals at both care facilities had been updated to confirm that care and support continue to meet their needs and agreed outcomes. It was found that the majority of care packages sampled had not been reviewed for over a year. This finding has also been noted in other social care reviews to highlight the requirement for regular reviews of Support Plans for individuals receiving services. It is acknowledged that management at Health and Social Care Moray are aware of this issue and are progressing the necessary actions in accordance with the Eligibility Criteria Policy, which requires a Social Worker or Community Care Officer to undertake annual reviews where support is provided to meet eligible needs. Support Plans for users of the Complex and Challenging Needs Service should be reviewed at least annually in accordance with the agreed policy. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager (Learning Disability) Yes 31/12/2025 All out-of-date support plans to be updated. Page 76
Page 77
23 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The follow-up review confirmed that all Support Plans for people using the service had been reviewed and where required updated. Page 77
Page 78
24 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 9 Low The care facility at Lhanbryde has one dedicated pool car that officers use to support individuals within the community. It was noted that the annual mileage used for this vehicle was approximately 7,000 miles in 2024/25. A previous audit of pool cars noted that best value is obtained when comparing the cost of purchasing and use of a pool car is achieved when mileage in excess of 12,000 a year is undertaken. Analysis of mileage claimed by officers of the Service when using their personal vehicles noted a cumulative total of approximately 17,000 in 2024/25. Increasing the use of the pool car may provide a financial saving to the Service. Consideration should be given to increasing the use of the available dedicated pool car by officers of the Service. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers (Woodview) Yes 31/01/2026 A review of the current pool car arrangements will be carried out, and a more proactive approach will be implemented for its use during care and support visits outside of Woodview, which currently incur a mileage charge. Page 78
Page 79
25 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The follow-up review noted that the Service now has access to a dedicated pool car for undertaking care and support visits. Audit analysis of a sample period of mileage claims submitted by officers within the Service found a significant reduction in expenditure compared with the corresponding period in 2025. Page 79
Page 80
26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 10 Low The care home facility at Lhanbryde operates a closed-circuit television (CCTV) system as an additional security measure for the property. The use of CCTV requires compliance with Data Protection Legislation, including the completion of a Data Protection Impact Assessment (DPIA). A DPIA is a structured process that systematically analyses the data protection risks associated with CCTV systems. It was found that no DPIA had been completed. Additionally, officers operating the CCTV at the facility had not undertaken the necessary training provided by the Council. It was also noted that the location of the CCTV monitor within the property is in an accessible area, which is not in accordance with Data Protection Legislation. A Data Protection Impact Assessment (DPIA) should be completed for the care home facility at Lhanbryde. All officers operating CCTV must complete the Council’s CCTV training module. The location of the CCTV monitor within the property in Lhanbryde should also be relocated to ensure that footage can only be viewed by trained officers who require access as part of their duties. Page 80
Page 81
27 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers (Woodview) Assistant Managers (Woodview) Yes Yes Implemented Implemented DPIA for the CCTV system at Woodview has been completed and approved. Training has been completed for all staff with access to the CCTV system at Woodview. In addition, access to the CCTV monitor at Woodview is now restricted. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented Implemented N/A N/A The follow-up review confirmed that a DPIA had been completed and approved for the CCTV system at Woodview, Lhanbryde. It has been confirmed that all staff with access to the CCTV system have completed the required training and that physical access to the CCTV monitor is now restricted. Page 81
Page 82
28 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 82
Page 83
29 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 83
Page 84
Page 84
Page 85
Report to: Audit and Scrutiny Committee Meeting Date: 29 September 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Commercial Harbours 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 18 June 2026 to 29 September 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of Commercial Harbours, which was agreed for review within the Audit Plan. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 An audit was undertaken of the Council’s main commercial harbours at Buckie and Burghead. Buckie Harbour is the principal commercial port, supporting fishing, cargo handling and offshore renewable energy operations. Burghead Harbour primarily serves inshore fishing vessels involved in the shellfish and squid sectors. The remaining Council Item 6. Page 85
Page 86
operated harbours at Cullen, Findochty, Hopeman, and Portknockie mainly serve the leisure boating community, with a limited number of inshore fishing vessels and are therefore outwith the scope of this audit. 4.2 The review considered the management and financial performance of commercial maritime activities. The objective of the audit was to assess whether appropriate controls and arrangements are in place to support effective harbour operations. The audit also examined wider aspects of harbour management, including governance, financial oversight and asset maintenance. The detailed findings and recommendations from this review are set out within the audit report in Appendix 1. 5. PROPOSALS 5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the period from 18 June 2026 to 29 September 2026. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. Page 86
Page 87
☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital Property No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. Does the proposal have the potential to affect people from the below categories differently to the wider Moray population: Yes Maybe No Positive Negative Positive Negative Any protected characteristics individuals or groups (Equality Act 2010) ☐ ☐ ☐ ☐ ✓ Any socio-economic disadvantaged individuals or groups – i.e. low / no income / wealth or deprivation ☐ ☐ ☐ ☐ ✓ Human Rights of individuals ☐ ☐ ☐ ☐ ✓ Rights of Children or Young People (UNCRC) ☐ ☐ ☐ ☐ ✓ Page 87
Page 88
JUSTIFICATION - Please provide a brief justification statement explaining why the above boxes have been selected There are no direct equalities, social inclusion or economic impacts arising from this report. However, the work of Internal Audit contributes to the effectiveness of governance, risk management and control arrangements across the Council, which support the delivery of equitable, inclusive and sustainable outcomes for communities. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 88
Page 89
APPENDIX 1 1 Final Internal Audit Report Commercial Harbours May 2026 Distribution: Head of Operations & Environment Service Manager – Property, Estates & Assets The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 0 Priority 2 4 Priority 3 3 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 89
Page 90
Appendix 1 2 Contents Page Commercial Harbours 1. Introduction & Scope 3 2. Key Issues 4 Detailed Report 3. Findings/Recommendations 5-17 4. Management Response 6-18 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 90
Page 91
Appendix 1 3 1. Introduction and Audit Scope The Internal Audit Plan for 2025/26 included a review of the Council’s Commercial Harbours. The Council acts as the statutory harbour authority for six harbours, serving both the leisure and commercial sectors. Buckie and Burghead are classified as the Council’s primary commercial harbours, with the remaining harbours predominantly serving the leisure market. The Moray Council has inherited the statutory powers conferred by the Grampian Regional Council (Harbours Order) Confirmation Act 1987 to manage, regulate and levy fees. Buckie Harbour is the principal commercial port, providing services to the fishing fleet and supporting cargo operations including timber, aggregates, foodstuffs and fabricated steel, as well as increasingly servicing operations and maintenance activity associated with offshore renewable energy. Burghead Harbour primarily supports inshore vessels engaged in the shellfish and squid industries. The remaining Council-operated harbours at Cullen, Findochty, Hopeman and Portknockie mainly serve the leisure boating community, with a limited number of inshore fishing vessels, and are therefore outwith the scope of this audit. In 2025/26, operating costs for Buckie and Burghead Harbours were approximately £940,000, with staffing costs and infrastructure maintenance comprising the majority of expenditure. Income generated from service users, rents and grant funding totalled approximately £1 million. The objective of the audit was to provide assurance that adequate controls are in place to support the efficient and financially sustainable operation of harbour activities, and that these arrangements align with relevant statutory obligations, Council policies and recognised good practice. This included a review of key income streams, including fish landing charges, import and export fees, pilotage services, berthing applications and allocations, and the collection of income due to the Council from berthing fees and harbour store rentals. The review also considered income generated from ancillary services, such as the provision of water and electricity supplies. The scope of the audit encompassed the key processes and controls associated with harbour management, including strategic oversight, financial management, asset maintenance, compliance with health and safety requirements, and risk management. In particular, the audit considered roles and responsibilities for harbour operations, the effectiveness of performance monitoring arrangements, and the extent to which decision-making is supported by accurate and timely management information. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). Page 91
Page 92
Appendix 1 4 2. Key Issues • The Council has statutory authority to manage and regulate its harbours; however, there is currently no formal Terms and Conditions Agreement in place to govern their use by service users. The audit acknowledges that established practices are in place for the management and control of harbour activities. However, it was noted that other local authorities have implemented formal agreements to strengthen controls over harbour access, safety requirements, charging arrangements and user responsibilities. It is recognised that the Service is currently in the process of developing a similar document, which is expected to enhance transparency and provide a clearer framework for managing harbour operations. Once finalised and implemented, this agreement will improve governance by establishing consistent operating rules, supporting the effective verification of charges, and enhancing assurance over income and compliance. • Audit testing confirmed that income for Buckie and Burghead Harbours is accurately recorded within the Council’s Financial Management System, with no concerns identified in transaction processing. However, an opportunity for improvement was identified regarding the alignment of nominal budget headings with actual income streams. While it is recognised that income levels may fluctuate, enhanced alignment would strengthen financial monitoring and oversight. Income streams, including pilotage charges, landing charges and berthing fees, are processed through the Council’s invoicing system. Testing of a sample of invoices confirmed that these were accurately raised and supported by appropriate documentation. However, delays were identified between the provision of services and the preparation and issue of invoices. Management advised that these delays were due to staffing shortages; remedial action has since been taken to improve invoicing timeliness. Page 92
Page 93
5 Findings/Recommendations - Commercial Harbours 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Low Total income for Buckie and Burghead Harbours was approximately £1 million for 2026/27. Analysis noted that the majority of this income was from a combination of fishing- related activities, commercial cargo handling, and increasingly, offshore renewable energy operations. Audit testing identified no issues with the accurate recording of income within the appropriate cost centres. However, an opportunity to improve financial reporting arrangements was identified. Improved alignment of nominal budget headings with the actual income streams received during the year would enhance financial monitoring and variance analysis. It is recognised that harbour income can be variable and, in some instances, difficult to predict due to fluctuations within the fishing industry and increased activity associated with offshore wind farm projects. However, greater alignment of budgets with historical income trends and expected income profiles may assist Consideration should be given, in consultation with the Accountancy Service, to better align income budgets with actual income streams. Where appropriate, consideration should also be given to amalgamating subjective headings. Page 93
Page 94
6 management in achieving improved budgetary oversight and monitoring arrangements. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Operations & Environment (in absence of Service Manager Harbours) Yes 30/09/26 Work already underway to review phasing and allocations Page 94
Page 95
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low As detailed within the previous finding, an analysis of income was undertaken. It was noted that Buckie Harbour records a nominal income budget of less than £100 in respect of receipts for the use of communal shower facilities by visiting marine users. Discussions with officers confirmed that charges for using these facilities are no longer applied following the removal of the coin-operated machines. It is understood that charging ceased in 2023; however, the facilities continue to be widely used. While the potential for significant additional income is relatively low, the reintroduction of a charging mechanism could provide a contribution towards the ongoing energy and maintenance costs associated with the facilities. Consideration should be given to the introduction of an appropriate mechanism to ensure that Buckie Harbour users are charged for the use of showering facilities. Page 95
Page 96
8 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Operations & Environment (in absence of Service Manager Harbours) Yes 31/03/27 Will be reviewed in line with all fees and charges for forthcoming year, including operational considerations, and a clear long term decision made Page 96
Page 97
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium Financial Regulations Point 4.3 details the following: “Income due to the Council, for work done, goods supplied or services provided and not paid for in advance or at the time, must be the subject of accounts being rendered. Chief Officers must ensure preparation and issue of such accounts within one month of the agreed point of sale…”. The majority of income, including pilotage charges, landing charges and berthing fees, is collected through the Council’s invoicing system. A sample of invoices was selected for detailed testing to confirm the accuracy of charges raised and to ensure that transactions were supported by appropriate and sufficient documentation. Testing undertaken confirmed that the invoices reviewed had been accurately raised and were supported by appropriate evidential documentation. However, audit testing identified that 67% of the sampled invoices Officers should be reminded of the Council’s Financial Regulations and the requirement to raise invoices within one month of service delivery. Page 97
Page 98
10 were issued between 6 weeks and 5 months after delivery of the service. The audit acknowledges that staffing resource pressures contributed to delays in invoice processing during the period under review. Management advised that these issues have subsequently been addressed, and audit testing identified evidence of improved timeliness in invoicing arrangements. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Operations & Environment (in absence of Service Manager Harbours) Yes 30/9/26 Staffing changes contributed to the finding. Process review has been concluded and detailed guidance and standards are being embedded. Page 98
Page 99
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium The audit also included a review to ensure that rents are being charged accurately for Council- owned commercial units located at Buckie and Burghead Harbours. Testing confirmed that rental income for these units is being accurately charged and invoiced, with no discrepancies identified between Housing and Property Services records and the Council’s Financial Management System. However, a review of a sample of lease agreements found that these commercial units had not been subject to a rent review for several years. Lease agreement conditions allow for an annual review of rental charges. Enquiries found this was due to an historical, risk-based operational decision to prioritise resource towards reviewing higher-value leases, with minimal uplifts considered proportionate for leases generating less than £1,000 per annum. However, it is understood that, due to additional temporary resources, the intention is to undertake rent reviews across all value categories. It is appreciated that foregone rent increases are likely to be low given the relatively small values involved; the absence of periodic Consideration should be given to implementing periodic rent reviews across all leases relating to units within commercial harbours, including those generating lower levels of income. This may include assessing the appropriateness of applying rental uplifts to units below a defined value threshold, for example, through inclusion within the Council’s annual review of charges. Page 99
Page 100
12 reviews increases the risk that rental income is not optimised. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager – Property, Estates & Assets Yes 31/12/27 It is recognised that agreements should not be left to proceed indefinitely at their initial rental levels however the opportunity cost of spending time on these low value leases can be high. A review of the lease agreements is required and it is proposed that this is undertaken over the next 12 months with options considered to streamline the process including a standard harbour unit lease agreement, consideration of fixed rental uplifts identified at lease commencement to the option of the rent being part of the Council’s annual review of charges. Officers from Property, Estates and Assets will consider and discuss these options with officers from Harbours and Legal as appropriate and look to implement new agreements within 18 months, resources Page 100
Page 101
13 permitting. Once a new agreement is confirmed it will be used to replace existing agreements as and when they come to an end. Page 101
Page 102
14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium The Moray Council is the statutory harbour authority and has inherited the statutory powers conferred by the Grampian Regional Council (Harbours Order) Confirmation Act 1987 to manage, regulate and levy fees for the harbours at Buckie, Burghead, Cullen, Portknockie, Findochty and Hopeman. While the legislation provides the overarching legal framework for harbour operations, it does not set out detailed terms and conditions governing the use of harbour facilities by service users. Enquiries noted that other local authorities have developed formal agreements to regulate access, safety, charges and liability for all users, thereby ensuring that harbour facilities are used in a safe, controlled and commercially managed manner. It is therefore pleasing to note that the Service is currently developing a similar document. Once implemented, this will support improved management and transparency in the use of harbour facilities by establishing clear rules relating to access, operational requirements and the verification of charges, including those A formal Terms and Conditions Agreement for service users should be finalised to establish a clear and consistent framework governing harbour use. This will strengthen controls over access, operations, charging and compliance, while enhancing transparency and income assurance. Page 102
Page 103
15 associated with cargo handling and fishing landings. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Operations & Environment (in absence of Service Manager – Harbours) Yes 31/03/27 The principle of clarity is accepted. Care needs to be taken that any terms are enforceable and are in line with underpinning harbour legislation. The final document will be based on relevant legislation and legal advice received. Page 103
Page 104
16 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Low In accordance with the Council’s Financial Regulations, inventories should be maintained for moveable equipment to support the effective control and safeguarding of assets. All equipment with a value exceeding £500 is required to be recorded on inventory lists to facilitate the identification and reporting of loss or theft. During the audit, several items, including specialised equipment with a value in excess of £500, were identified. However, no documented inventory record of these assets is maintained. An Inventory Register should be introduced and maintained to record all moveable equipment with a value exceeding £500. The register should include key asset details and be subject to regular review and verification. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Operations & Environment (in absence of Service Manager Harbours) Yes 30/9/26 Asset register to be developed and maintained. Page 104
Page 105
17 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 7 Medium The audit scope included a review of expenditure to confirm appropriate accounting arrangements and compliance with the Council’s Financial Regulations. No significant concerns were identified. However, testing of staffing costs noted where expenditure had been charged to an incorrect cost centre. This has now been corrected. Enquiries found that the requirement for overtime payments relates to ongoing service delivery needs within the Harbour Service. It is recognised that operational working timescales associated with maritime service delivery do not always align with standard Council employee terms and conditions, which may have contributed to this ongoing requirement for overtime payments. However, it is considered that overtime should only be used on an exceptional and temporary basis, rather than as a routine arrangement. Senior management are aware of this issue and are seeking an appropriate solution to address the current contractual arrangements. Senior management should continue to pursue a sustainable solution to the contractual arrangements identified in this finding, with the aim of ensuring that ongoing service delivery can be maintained without reliance on overtime. Page 105
Page 106
18 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Operations & Environment Yes 31/03/27 Without an increase in headcount or substantial change in employee terms & conditions to reflect marine operational environment it is likely that there will be a continued requirement for overtime in order to meet operational need for the harbour (which is staffed 24/7) and the dredger. However, the management team are reviewing whether specialist terms & conditions could be introduced to better reflect the operating environment. The commitment from the management team in terms of action is to review and make firm proposals. Page 106
Page 107
19 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 107
Page 108
20 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 108
Page 109
Report to: Audit and Scrutiny Committee Meeting Date: 29 September 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Home to School Transport 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 18 June 2026 to 29 September 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of the home-to-school transport contracts, which was agreed for review within the Audit Plan. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 An internal audit was undertaken to review the governance, risk management and internal control arrangements for the management of home-to-school transport contracts. The Council has a statutory duty to provide appropriate home-to-school transport for eligible Item 7. Page 109
Page 110
children. The Public Transport Unit is operationally responsible for the delivery of the home-to-school transport service, with a budget of approximately £5.4 million in 2025/26 for around 2,700 pupils across both primary and secondary schools. 4.2 The scope of the audit did not include a review of the tendering arrangements for the recently awarded home to school transport contracts. Instead, the audit assessed the adequacy and effectiveness of the Council’s arrangements for managing and delivering the transport service under the previous contracts awarded in 2019. However, the operational improvements identified through this review remain relevant, given the similarity in contractual conditions between the previous and current home to school transport contracts. The audit reviewed the governance, operational and financial controls in place to ensure that statutory duties are fulfilled, services are delivered efficiently and public funds are appropriately safeguarded. The findings identified a need to further strengthen compliance with regulatory requirements, alongside improvements to administrative arrangements for the management of home to school transport contracts. The detailed findings and recommendations from this review are set out within the audit report in Appendix 1. 5. PROPOSALS 5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the period from 18 June 2026 to 29 September 2026. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. Page 110
Page 111
☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital Property No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. Does the proposal have the potential to affect people from the below categories differently to the wider Moray population: Yes Maybe No Positive Negative Positive Negative Any protected characteristics individuals or groups (Equality Act 2010) ☐ ☐ ☐ ☐ ✓ Any socio-economic disadvantaged individuals or groups – i.e. low / no income / wealth or deprivation ☐ ☐ ☐ ☐ ✓ Page 111
Page 112
Human Rights of individuals ☐ ☐ ☐ ☐ ✓ Rights of Children or Young People (UNCRC) ☐ ☐ ☐ ☐ ✓ JUSTIFICATION - Please provide a brief justification statement explaining why the above boxes have been selected There are no direct equalities, social inclusion or economic impacts arising from this report. However, the work of Internal Audit contributes to the effectiveness of governance, risk management and control arrangements across the Council, which support the delivery of equitable, inclusive and sustainable outcomes for communities. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 112
Page 113
APPENDIX 1 1 Final Internal Audit Report Home to School Transport June 2026 Distribution: Head of Operations and Environment Chief Financial Officer Service Manager Transportation Public Transport Manager Service Manager Strategic Finance The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 0 Priority 2 4 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 113
Page 114
Appendix 1 2 Contents Page Home to School Transport 1. Introduction & Scope 3-4 2. Key Issues 4-5 Detailed Report 3. Findings/Recommendations 6-17 4. Management Response 7-18 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 114
Page 115
Appendix 1 3 1. Introduction and Audit Scope The 2025/26 Internal Audit Plan includes an audit of the arrangements in place to provide assurance that the management of school transport contracts complies with contractual terms and conditions, as well as with the Council’s Financial Regulations and Procurement Guidelines. Moray Council has a statutory responsibility to ensure that appropriate travel arrangements are in place to support school attendance for eligible children. This includes providing free home to school transport for pupils of school age where the nearest suitable school exceeds the prescribed walking distance, as well as making suitable transport arrangements for children who are unable to walk to school due to mobility difficulties, additional support needs or related health and safety risks. The Public Transport Unit is responsible for managing the Council’s statutory home to school transport service. The approved budget for delivery of the service in 2025/26 was approximately £5.4 million with actual expenditure of £5.3 million. Home to school transport is currently provided to approximately 2,700 pupils across both primary and secondary schools, with demand fluctuating in response to changes in pupil numbers and additional support needs requirements. The service is predominantly delivered through external local transport providers, which account for approximately 85% of overall service provision. The Council also operates an in-house service that delivers home to school transport to meet the remaining transport requirements. The Public Transportation Unit has recently completed the award of home to school transport contracts following a tender exercise undertaken between October 2025 and March 2026. The contract, valued at approximately £27.1 million, aligns with the revised home to school Transport Policy approved by the Council on 24 September 2025, with a start date of 1 April 2026 for five years, with an option for a 2 year extension. This replaces the previous home to school transport contract that was awarded in 2019. It was noted that the previous contract included community transport requirements that has now been tendered separately. The Council delivers its statutory home to school transport provision by awarding contracts to multiple transport providers across defined routes, including arrangements for those pupils with additional support needs who are deemed eligible for transport. This approach supports operational flexibility, market access for providers of differing scale and the effective management of cost, risk and service continuity. The scope of the audit did not include a review of the tendering arrangements for the recently awarded home to school transport contracts. Instead, the audit assessed the adequacy and effectiveness of the Council’s arrangements for managing and delivering the transport service under the previous contract, which commenced in 2019. The audit also considered the governance, operational, and financial controls in place to ensure that statutory duties are fulfilled, services are delivered efficiently, and public funds are appropriately safeguarded. Operational Page 115
Page 116
Appendix 1 4 improvements identified through this review remain relevant to current contract management processes, given the similarity in contractual conditions between the previous and current home to school transport contracts. Audit testing included a review of whether policies, procedures and operating practices support compliance with relevant legislation, Council’s Financial Regulations, Procurement Guidelines and the terms and conditions of the home to school transport contract. The audit assessed contract management arrangements, service provider performance monitoring and the controls in place to ensure that payments are accurate, appropriately supported and represent value for money. The audit also considered the Council’s oversight arrangements, including the adequacy of assurance regarding service quality, compliance with health and safety requirements and the effective discharge of safeguarding responsibilities. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • The Council has a responsibility to ensure that providers of home to school transport maintain appropriate levels of insurance, thereby supporting pupil safety and mitigating legal, financial and reputational risk. The audit confirmed that insurance documentation is verified prior to contract award; however, no formal process was in place to provide ongoing assurance that insurance cover continues to meet contractual requirements throughout the life of the contract. The introduction of a formal process to obtain and review annual confirmation of insurance cover from all home to school transport providers would strengthen assurance arrangements and support the effective management of these risks over the duration of the contract. • Sample testing of contract variations found that correct procurement procedures were generally followed and supported by established evaluation arrangements involving both the Public Transport Unit and the Procurement Service. However, improvements in contract documentation and evaluation processes were identified. In addition, the audit sample noted a contract variation in which the appointment of providers for home to school transport routes was not undertaken in accordance with the Council’s approved procurement arrangements. While the operational urgency to maintain continuity of service delivery is acknowledged and alternative quotations were obtained to demonstrate value for money, the approach undertaken did not comply with the Council’s Financial Regulations or Procurement Guidelines. Page 116
Page 117
Appendix 1 5 • The audit report also includes recommendations to further strengthen compliance with regulatory requirements and the administration of the home to school transport contracts. Addressing these matters will enhance transparency, support effective governance and compliance with contractual arrangements and reduce the risk of misunderstanding or challenge. Page 117
Page 118
6 Findings/Recommendations - Home to School Transport 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Low The audit reviewed whether information relating to home to school transport arrangements, as published on the Council’s website or provided in paper format, is current, accurate and clearly presented. This included an assessment of whether appropriate instructions and guidance are provided, together with clear information on any applicable charges. The audit found that information relating to home to school transport is generally easily accessible and provides clear guidance and instructions. However, elements were identified as being outdated. This includes information on charges within the online application forms for non-entitled and out-of-zone applications, as well as details contained within the paper application form relating to mileage parameters for pupils eligible for free home to zoned school transport. Information relating to home to school transport arrangements, across both online and paper formats, should be reviewed and updated to reflect current policy and charges. Regular reviews should be undertaken to ensure the ongoing accuracy of published information. Page 118
Page 119
7 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Public Transport Manager Yes 31/07/2026 The team have already reviewed website and updated most areas that had become out of date in oversight. Final checks and any additional updates will be made by 31 July 2026. Page 119
Page 120
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium The audit reviewed the process applied when contract variations are required for previously awarded home to school transport routes. Route variations that cannot be delivered by existing transport providers must be procured in accordance with the Procurement Guidelines. Depending on the financial value, this may require a formal tendering exercise or the obtaining of alternative quotations through the use of Quick Quotes. Sample testing was undertaken of contract variations to ensure compliance with Procurement Guidelines. The sample comprised four contract variations, with a combined annual contractual value of £196,442. A review of these variations was undertaken to assess compliance with Financial Regulations, Procurement Guidance and the terms and conditions of the home to school transport contracts. The following points were noted: • Audit testing found that contract variations were procured in accordance with the Procurement Guidelines for three of the four variations reviewed. However, the specification requirements detailed in the Invitation to Quote issued to transport providers did not include key operational The Public Transport Unit, in conjunction with the Procurement Service, should ensure that all future contract variations for home to school transport services comply with Financial Regulations and Procurement Guidelines and include requirements for the provision of key contractual and performance information. Page 120
Page 121
9 conditions, including vehicle maintenance standards, Protection of Vulnerable Groups (PVG) Scheme membership, possession of valid Driver Qualification Cards and broader regulatory compliance requirements. However, it was noted that checks were undertaken as part of the evaluation process to provide assurance that appointed transport providers met these operational requirements prior to contract award. • Procurement evaluations to determine the preferred transport provider are undertaken using a defined quality-to-price ratio. The process involves the Public Transport Unit (PTU) evaluating provider submissions, which are subsequently moderated by the Procurement Service as an assurance control over the validity of the assessment process. Within the sample reviewed, it was noted that the evaluation spreadsheet used by PTU as part of the evaluation process included an incorrect application of the quality-to-price ratio. This was attributed to human error. A recalculation of the evaluation using a corrected spreadsheet confirmed that the error did not affect the outcome, and the preferred transport providers for the contracts remained unchanged. Page 121
Page 122
10 • In the sample reviewed, one contract variation was found to not comply with the Procurement Guidelines. The annual value of this contract variation was approximately £86,450, which required the procurement of transport providers through a tendering exercise. In addition, where Procurement Guidelines are not followed, the Financial Regulations detail requirements for reporting and consultation with the Chief Financial Officer; this was not undertaken. However, the operational urgency to maintain service delivery continuity is acknowledged, and alternative quotations were sought from service providers prior to awarding the contract. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Public Transport Manager Yes 31/03/2027 Improvements have already been made in terms of agreed processes with procurement for variations. All officers involved in the procurement process in the PTU will be retrained on the Financial Regulations and Procurement Guidelines to ensure a comprehensive understanding of the underpinning regulations and rationale. Page 122
Page 123
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium The Council has a responsibility to ensure that providers delivering home to school transport services hold appropriate insurance cover. This is essential to safeguard pupils and to mitigate associated legal, financial and reputational risks. This requirement also supports the Council’s safeguarding obligations and effective contract management arrangements. While verification of transport providers’ insurance documentation is undertaken at the point of contract award, the audit review identified that no ongoing process is in place to obtain annual assurance that insurance cover remains valid and compliant with contractual requirements throughout the contract period. Confirming that adequate insurance coverage remains in place provides assurance that risks and exposures arising from accidents or incidents are appropriately managed and reduces the Council’s exposure to uninsured claims and associated reputational risk. Annual assurance should be obtained to confirm that home to school transport providers maintain appropriate insurance cover throughout the full duration of their contractual arrangements. Page 123
Page 124
12 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Public Transport Manager Yes 31/03/2027 The service has always been mindful of good controls in relation to the council’s broad duty of care and a statutory requirement to have regard to safety in relation to the journey to school. In addition to the start of contract insurance checks, Operator Licence and Taxi Licensing requirements mean that all operators of home to school transport are required to be of good standing and have appropriate insurance in place. Any bus / coach operator not able to demonstrate insurance alongside their financial standing would be rendered liable to be stripped of their Operator licence and thus ability to trade at Public Inquiry. Failure to demonstrate insurance for a taxi operator through the council’s own taxi licensing arrangements would see their licence withdrawn and the taxi operator unable to trade. Notwithstanding these existing controls an annual check of insurance will be put in place by the PTU team. Page 124
Page 125
13 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium The Council’s home to school transport tenders advertised on Public Contracts Scotland in 2018 specified an initial five-year contract term with provision for a two-year extension. The contracts were subsequently extended for the additional two-year period. Such an extension represents a variation to the original contract and should be formally documented through a Letter of Variation to ensure appropriate contractual governance, transparency and compliance with procurement and contract management requirements. A Letter of Variation constitutes a contractual amendment and should be agreed and signed by all parties to the original contract, including the transport provider. Audit testing identified that no Letters of Variation were in place for contract extensions implemented during 2024–25, and that only partial documentation was obtained for extensions in 2025–26, with signed Letters of Variation available for approximately 40% of service providers. All future extensions to home to school transport contracts should be supported by agreed and signed Letters of Variation from all providers. Page 125
Page 126
14 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Public Transport Manager Yes 31/07/2026 The team has created a revised contract award letter template in discussion with the procurement team, which will be sent out as normal to the supplier when any contract change is agreed, signed by the supplier and returned duly signed to the PTU to then be forwarded to the Procurement admin. Page 126
Page 127
15 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium As detailed previously, the Council’s home to school transport tenders advertised on Public Contracts Scotland in 2018 specified an initial five-year contract term, with provision for a two-year extension. As the contracts were subsequently extended for the additional two-year period, this should be formally documented through a Letter of Variation agreed with the relevant transport provider. A review of the Letter of Variation issued for the second optional extension period detailed the following: “…that the inflationary increase applied to the contract in April 2025 will be either the current CPI (Consumer Price Index) rate of 2.2% plus 1% or the CPI rate in March 2025, whichever is higher.” The audit noted that, based on advice from the Chief Financial Officer, the March 2025 CPI rate was set at 3%. This rate was subsequently applied as the percentage uplift to payments made to transport providers for 2025/26 and was formally communicated by letter in April 2025. However, the Letter of Variation details the uplift as 3.2% (comprising 2.2% plus 1%). Analysis found that applying the lower rate has resulted in an estimated In accordance with the Letter of Variation extending the home to school transport contracts for 2025/26, consideration should be given, in consultation with Legal Services, to whether an additional 0.2% uplift is payable to transport providers. Page 127
Page 128
16 underpayment of approximately £10,000 to home to school transport providers. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Public Transport Manager Yes 30/09/2026 The PTU manager has evidence of contacting the Head of Finance in March 2025, as would be normal practice, to agree a rate for the April route uplift on the contract. This was agreed at 3% and letters advising of the uplift on a route by route basis were issued to the suppliers. The PTU Manager is unsure why the original offer of 2.2% plus 1% was made and can only surmise that it was due to a misunderstanding of the rate carried over from an earlier award. No supplier advised of any discrepancy between the 3.2% originally proposed and the actual award of 3% paid out. A view should be taken by Legal Services as to which rate is contractually applicable and whether a retrospective payment based on the 3.2% should be made. Page 128
Page 129
17 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Low The Public Contracts (Scotland) Regulations 2015 require contracting authorities to calculate and publish contract award values based on the total estimated lifetime value of a contract, including any potential extension periods. A review of the Council’s home to school transport tenders advertised on Public Contracts Scotland in 2018 and 2025 identified that, while the tender documentation provided for a two-year extension to the initial five-year contract term, the contract award values published reflected the initial five-year period only and did not include the estimated value of the potential extension. All future home to school transport contract award notices published on Public Contracts Scotland should accurately reflect the total estimated lifetime value of the contract, including any potential extension periods. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Procurement Manager Yes 30/09/2026 Procurement will ensure that all future contract award notices published on Public Contracts Scotland reflect the total estimated lifetime value of the contract, including any potential extension periods, in line with the Public Contracts (Scotland) Regulations 2015. This Page 129
Page 130
18 will be communicated to officers involved in procurement activity and reflected in procurement guidance and review processes. This will be factored into any future procurement exercises in discussion with the Procurement team. Page 130
Page 131
19 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 131
Page 132
20 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 132
Page 133
Report to: Audit and Scrutiny Committee Meeting Date: 29 September 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Management of School Funds 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 18 June 2026 to 29 September 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of Management of School Funds, which was agreed for review within the Audit Plan. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 An Internal Audit review was undertaken of the arrangements in place for the Management of School Funds. A school fund is money held and managed by a school, separately from the Council's delegated budget from the local authority. They are typically used to support school activities, trips, events and additional resources for pupils. These funds are Item 8. Page 133
Page 134
required to be managed in accordance with the School Fund Regulations, with the Head Teacher being responsible for ensuring that the administration of these monies operates in accordance with these Regulations. 4.2 The audit reviewed the governance, financial management and control arrangements in place for the administration of School Funds. Audit testing included examining a sample of funds to assess whether income and expenditure were properly recorded and supported by appropriate documentation, whether bank accounts were regularly reconciled and independently reviewed and whether funds were managed in accordance with the School Fund Regulations. The detailed findings and recommendations from this review are set out in the audit report in Appendix 1. 5. PROPOSALS 5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the period from 18 June 2026 to 29 September 2026. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy Page 134
Page 135
☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital Property No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. Does the proposal have the potential to affect people from the below categories differently to the wider Moray population: Yes Maybe No Positive Negative Positive Negative Any protected characteristics individuals or groups (Equality Act 2010) ☐ ☐ ☐ ☐ ✓ Any socio-economic disadvantaged individuals or groups – i.e. low / no income / wealth or deprivation ☐ ☐ ☐ ☐ ✓ Human Rights of individuals ☐ ☐ ☐ ☐ ✓ Rights of Children or Young People (UNCRC) ☐ ☐ ☐ ☐ ✓ Page 135
Page 136
JUSTIFICATION - Please provide a brief justification statement explaining why the above boxes have been selected There are no direct equalities, social inclusion or economic impacts arising from this report. However, the work of Internal Audit contributes to the effectiveness of governance, risk management and control arrangements across the Council, which support the delivery of equitable, inclusive and sustainable outcomes for communities. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 136
Page 137
APPENDIX 1 1 Final Internal Audit Report Management of School Funds June 2026 Distribution: Head of Education (Chief Education Officer) Interim Service Manager Business Support Business Support Development Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Limited Priority 1 2 Priority 2 3 Priority 3 1 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 137
Page 138
Appendix 1 2 Contents Page Management of School Funds 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-17 4. Management Response 6-18 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 138
Page 139
Appendix 1 3 1. Introduction and Audit Scope As part of the approved Internal Audit Plan for 2025/26, a review was undertaken of the arrangements in place for the management of school funds. Council funding provided to schools is governed by Financial Regulations and Procurement Guidelines. However, schools may also hold funds outside of their delegated budgets, which are managed locally and typically comprise monies raised through activities such as donations, fundraising events, and contributions towards school trips and other voluntary activities. While school funds are not held within core Council budgets, the Council retains overarching responsibility for their governance. These funds are required to be managed in accordance with the School Fund Regulations. The Head Teacher is responsible for ensuring that the administration of these monies operates in accordance with these Regulations. The Regulations set out the types of activities that fall within the scope of school funds and provide a consistent framework for good practice and financial control. They are intended to ensure that appropriate standards of governance, financial management and accountability are applied consistently across all schools within the Council. The audit review noted that the cumulative fund balances held by all schools across the Council, including both primary and secondary establishments, totalled approximately £1 million. The scope of the audit was to review the arrangements in place for the management of school funds and to check compliance with the Council’s School Fund Regulations. This included consideration of the governance and oversight arrangements within Education Services. The audit approach involved reviewing a sample of primary and secondary schools to provide a representative assessment of practices across the Council. In addition, the audit sought to identify opportunities to strengthen internal controls and improve consistency in the administration of School Funds across the school estate. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • The audit review identified inconsistencies across schools in complying with the School Fund Regulations, particularly in relation to the completion, reporting and timely submission of Annual Statements of Accounts and Bank Reconciliation Statements to Education Services. Audit testing of the types of payments made from a sample of schools found that the majority of payments were in accordance with the School Fund Regulations. However, examples were identified where expenditure did not comply with the Regulations and in one case, with Page 139
Page 140
Appendix 1 4 the Council’s Financial Regulations. It is therefore considered that improved governance arrangements and strengthened financial compliance controls are required to ensure consistent adherence to the School Fund Regulations across all schools. • It is considered that the School Fund Regulations provide a framework for the effective management, safeguarding and administration of school funds, ensuring accountability, transparency and compliance with statutory requirements. However, there is no defined process for the periodic review or regular reissue of the Regulations to schools. Audit testing identified areas where updates are required within the Regulations, including Value Added Tax and where further guidance should be considered on the use of debit cards for purchases. While changes in school staffing are acknowledged, an audit visit to a school found a lack of awareness of the School Fund Regulations. Page 140
Page 141
5 Findings/Recommendations –Management of School Funds - 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium The School Fund Regulations provide a framework for the proper management, safeguarding and administration of school funds, ensuring accountability, transparency and compliance with statutory requirements. It was noted that the Regulations were last reviewed and updated in April 2021. The audit considers that the Regulations remain broadly fit for purpose; however, certain elements, including guidance relating to Value Added Tax (VAT), require updating. In addition, the Regulations do not specify a formal review cycle or arrangements for periodic reissue to Head Teachers. While staffing changes within the Education Service are recognised, an audit visit found that a Head Teacher and the School Administrator were not aware of the School Fund Regulations. The findings from this review indicate a need to strengthen awareness and understanding to support schools in meeting the administrative requirements for effective School Fund management. The Education Service should review and update the School Fund Regulations, including areas such as Value Added Tax (VAT), and introduce a formal review cycle with arrangements for regular reissue to Head Teachers. Where necessary, appropriate training should also be provided to support staff in understanding and complying with the requirements of the Regulations. Page 141
Page 142
6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Interim Service Manager Business Support Yes 31/12/2026 The School Fund Regulations will be updated with a review cycle implemented and training will be provided to all Head Teachers at a monthly Education Briefing. Page 142
Page 143
7 Ref Risk Ratings for Recommendations Audit Finding 2 Low School Fund Regulations (3.1) details; “The School Fund should be managed by a staff committee which should include at least a Chairperson and the School Administrator as the appointed Treasurer. The Business Support Administration Manager within Education Services should be notified of the names of these officers and should also be notified immediately of any changes to the above posts.” The audit found that Education Services do not maintain records of current Chairpersons and Treasurers for schools. Maintaining accurate and up-to-date records of key school fund postholders is essential to support effective governance arrangements and provide appropriate oversight of fund administration across all schools. Education Services should establish and maintain an up-to-date central record of school fund chairpersons and treasurers for all schools. The record should be subject to periodic review and verification to ensure information remains accurate and complete. Page 143
Page 144
8 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Interim Service Manager Business Support Yes 30/09/2026 A register of school fund chairpersons and treasurers will be created and completed by all schools with a process established for regular review and update. Page 144
Page 145
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 High School Fund Regulations (16.1) detail the following requirement: “A signed copy by both the Treasurer and Auditor of the Annual Statement of Accounts/ Bank Reconciliation Statement should be submitted to the Business Support Administration Manager (Education Services) by the 1st November each year.” The audit reviewed the school fund financial returns for 2024/25 submitted by all schools to Education Services to ensure they were in accordance with the prescribed requirements. The following points were noted: • At the time of the audit, five schools had not submitted their Annual Statement of Accounts and Bank Reconciliation Statements for 2024/25. In addition, one of these schools had also failed to submit the required financial returns for 2023/24. All schools should be reminded of their responsibility to comply with the School Fund Regulations, particularly regarding the completion and timely submission of annual financial returns to Education Services. In addition, the Annual Statement of Accounts should be sufficiently detailed to accurately reflect the full range of school fund activities. Consideration should also be given to Education Services, strengthening monitoring and compliance review arrangements for annual school fund returns to ensure adherence to the School Fund Regulations. Page 145
Page 146
10 • Twenty-two schools (18 primary and 4 secondary) submitted their returns after the 1 November 2025 deadline, with delays ranging from one to three months. • Four primary schools’ Annual Statements of Accounts and Bank Reconciliation Statements did not include evidence of independent certification/ audit. • Eleven schools (9 primary and 2 secondary) submitted incomplete returns, omitting either the Annual Statement of Accounts or Bank Reconciliation Statements. • The review of submitted Annual Statements identified 16 schools (13 primary and 3 secondary) that allocated over 20% of their annual expenditure to miscellaneous/general categories. This reduces financial transparency and weakens the audit trail. From an internal audit perspective, these findings are of concern in relation to levels of compliance with School Fund Regulation requirements and the effectiveness of monitoring arrangements. Page 146
Page 147
11 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Education (Chief Education Officer) Yes 31/12/2026 Once the School Fund Regulations are updated, a briefing will be held for all Head Teachers to remind them of their duty and to share expectations and responsibilities for adhering to the regulations and providing annual updates or changes once these occur. Page 147
Page 148
12 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium School Fund Regulations provide a structured control framework for the management of funds held by schools. Their purpose is to ensure that all income and expenditure relating to school funds are properly authorised, recorded, and used for the general benefit of the pupils or the school as a whole. The Regulations provide working examples of activities within the scope of the fund, including school trips, fetes, concerts, dances and raffles, but also specify what the fund should not be used for, including staff functions, leaving gifts, salary payments, loans, and travelling expenses. The internal audit review randomly selected a sample of schools and reviewed payments made from their school fund accounts to check compliance with the Regulations. Testing found that the majority of expenditure complied with the School Fund Regulations. However, examples were noted where payments had been made for the following categories of expenditure: Education Services should remind schools of the requirements of the School Fund Regulations and provide clear guidance on the categories of expenditure that fall within and outside the scope of the Regulations to support consistent application and compliance. Page 148
Page 149
13 • In-service day refreshments • Staff travelling costs to attend training events • Maintenance and repairs to school premises • Gritting and snow clearing of car parks and paths • Staff gifts It is considered that most of the categories of expenditure listed fall outwith the scope of the School Fund Regulations and would normally be expected to be procured through the Devolved School Management Budget. While it is recognised that gifts to staff may mark significant occasions, such payments should not be funded from Council or School Funds. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Interim Service Manager Business Support Yes 31/12/2026 This will be included in training, updated Regulations and key information added to Education Handbook. Page 149
Page 150
14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 High The sample of school fund accounts reviewed, as detailed in Finding 4, also identified a payment of £1,200 made to a member of staff at a school. Further enquiries established that this related to a “staff advancement” arising from a delay in implementing a change to the employee’s contractual hours. The amount was subsequently reimbursed to the School Fund approximately two months after the payment was made. As noted previously, the school fund must not be used for “salary payments”. In addition, this arrangement is not in accordance with the Council’s Financial Regulations, specifically Regulation 3.10, which states: “All individuals employed by the Council under a contract of service shall be paid through the payroll system to ensure proper accounting for Income Tax and National Insurance is made.” Education Services should remind schools that school fund accounts must not be used for salary payments, advances of pay or loans to staff. All payroll-related matters should be processed through the Council’s Payroll Service in accordance with the Council’s Financial Regulations. Page 150
Page 151
15 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Education (Chief Education Officer) Yes 31/08/2026 This will be included in the pre-return briefing for session 2026-27 for all Head Teachers in August with a copy of the current School Fund Regulations. Moving forward all actions will be included in Head Teacher Induction. Page 151
Page 152
16 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Medium The audit reviewed a sample of schools to assess arrangements for processing payments and to ensure compliance with the School Fund Regulations. The Regulations allow payments to be made either by cheque or online; however, all payments must be authorised by at least two individuals included on the authorised signatories list. The following points were noted: • Online transactions were noted in the sample of schools reviewed, which were authorised by only one signatory. School Fund Regulations (4.6) state that “each payment must be authorised by two signatories separately online before any funds are released from an account.” This functionality is available through banks for school fund-type accounts. The review found no concerns regarding the validity of the payments, and it was also noted that schools had arrangements in place for a secondary signatory to review transactions undertaken. As highlighted in previous findings, schools should be reminded of the requirements of the School Fund Regulations to ensure compliance. In addition, consideration should be given to reviewing and updating the Regulations in relation to payment processing arrangements, including the use of debit cards. Page 152
Page 153
17 • Audit testing also identified that schools used debit cards for purchases. Arrangements were in place for oversight of the authorisation process by another signatory of the account. However, the use of debit cards is not in accordance with the School Fund Regulations. It is acknowledged that the use of cheques for expenditure has declined significantly over a number of years due to the increased prevalence and convenience of digital payment methods. As a result, consideration should be given to reviewing and, where appropriate, updating the School Fund Regulations to reflect current payment practices better. However, any revised regulations should ensure that effective governance, authorisation and monitoring controls are maintained to support appropriate financial oversight and mitigate the risk of misuse or fraud. Page 153
Page 154
18 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Education (Chief Education Officer) Yes 31/08/2026 This will be included in pre-return briefing for session 2026/27 and then included in updated Regulations. Page 154
Page 155
19 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 155
Page 156
20 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 156
Page 157
Report to: Audit and Scrutiny Committee Meeting Date: 29 September 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Social Care (Short Breaks) 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 18 June 2026 to 29 September 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of Social Care (Short Breaks), which was agreed for review within the Audit Plan. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 An Internal Audit review of accommodated Social Care (Short Breaks) has been completed as part of the 2025/26 Internal Audit Plan. The Scottish Government defines a Short Break as any form of service or assistance that enables carers to have periods away from their caring routines or responsibilities. The audit primarily focused on Item 9. Page 157
Page 158
accommodated Short Breaks within the older persons’ care sector. 4.2 The scope of the audit reviewed the processes in place for assessing care needs and for ensuring accurate payments are made to third-party providers for accommodated Short Breaks at agreed contract rates. In addition, the audit checked whether the arrangements for charging supported persons' contributions towards the cost of applicable Short Break provision comply with Scottish Government charging guidance. The detailed findings and recommendations from this review are set out within the audit report in Appendix 1. 5. PROPOSALS 5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the period from 18 June 2026 to 29 September 2026. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population Page 158
Page 159
6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital Property No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. Does the proposal have the potential to affect people from the below categories differently to the wider Moray population: Yes Maybe No Positive Negative Positive Negative Any protected characteristics individuals or groups (Equality Act 2010) ☐ ☐ ☐ ☐ ✓ Any socio-economic disadvantaged individuals or groups – i.e. low / no income / wealth or deprivation ☐ ☐ ☐ ☐ ✓ Human Rights of individuals ☐ ☐ ☐ ☐ ✓ Rights of Children or Young People (UNCRC) ☐ ☐ ☐ ☐ ✓ JUSTIFICATION - Please provide a brief justification statement explaining why the above boxes have been selected Page 159
Page 160
There are no direct equalities, social inclusion or economic impacts arising from this report. However, the work of Internal Audit contributes to the effectiveness of governance, risk management and control arrangements across the Council, which support the delivery of equitable, inclusive and sustainable outcomes for communities. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 160
Page 161
APPENDIX 1 1 Final Internal Audit Report Social Care (Short Breaks) June 2026 Distribution: Chief Finance Officer – MIJB Locality Manager – West Team Manager (East Community Care) Team Manager (West Community Care) Unpaid Carers Team Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 2 Priority 2 1 Priority 3 1 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 161
Page 162
Appendix 1 2 Contents Page Social Care (Short Breaks) 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-11 4. Management Response 6-11 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 162
Page 163
Appendix 1 3 1. Introduction and Audit Scope An Internal Audit of accommodated Social Care (Short Breaks) has been undertaken as part of the 2025/26 coverage of Moray Integration Joint Board (MIJB) activity. There has been a requirement to further develop the audit programme for this review, as the original scope was to assess the processes and accounting arrangements for charging care to individuals receiving a service. However, it was noted early in the audit process that a review is currently ongoing within the Service to explore charging arrangements for Social Care services. The audit has therefore been expanded to review the procedures and administrative arrangements in procuring accommodated Short Breaks for individuals requiring support in a care home environment for an intended temporary period. Short Breaks are a common feature in delivering support for Unpaid Carers under the authority's responsibilities established by "The Carers (Scotland) Act 2016". The audit has mainly focused on accommodated Short Breaks for the older persons care sector, attracting an annual budget provision of £517,000 for the 25/26 financial year. The audit examined the processes in place for assessing care needs and for ensuring accurate payments are made to third-party providers for accommodated Short Breaks at agreed contract rates. In addition, the review assessed whether the arrangements for charging supported persons contributions towards the cost of applicable Short Break provision are compliant with Scottish Government charging guidance. This audit review covers a further sector of residential care service provision and complements recent audit activity on Out of Area Placements, Older Persons Permanent Residential Care and Procurement & Creditor Payments, ensuring substantial coverage of residential care over consecutive Internal Audit Plans. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • In accordance with the Scottish Government Charging for Residential Accommodation Guidance (CRAG), local authorities have discretion to apply charges for Short Break provision, however Scottish Government regulations waive charging where the support is provided to meet the needs of unpaid carers or for individuals with a terminal illness within specific parameters. The audit identified that no supported individuals receiving a Short Break service within a care home setting were referred Page 163
Page 164
Appendix 1 4 for a financial assessment during 2025/26. Consequently, no charges were applied in respect of contributions towards the cost of Short Break provision. Audit testing confirmed that the sample reviewed included Short Break cases that would be eligible for charging under CRAG, including extended stays in care home settings spanning several months. These arrangements were in place for reasons including delays in the commencement of community care packages and pending decisions regarding permanent care home placement. While the current financial climate and the sensitivity associated with charging for social care services are acknowledged, management should consider exploring the implementation of charging for eligible services. • The Carers (Scotland) Act 2016 requires local authorities to ensure that carers receive the necessary support to maintain their wellbeing while providing care. As recognised good practice, Carer Support Plans provide a formal mechanism to document carers' needs and personal outcomes, separately from the supported person's care and Support Plan. While the audit identified that Short Breaks were being provided to support unpaid carers, audit testing found that, in the majority of cases reviewed, a Carer Support Plan was not in place to substantiate the carer’s assessed needs. Further promotion and development of Carer Support Plans would strengthen the identification of carers' needs and outcomes, support the sustainability of caring arrangements, and provide clear evidence of appropriate assessment, decision-making and agreed support. Page 164
Page 165
5 Findings/Recommendations - Social Care (Short Breaks) 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 High The Charging for Residential Accommodation Guidance (CRAG) issued by Scottish Government provides for temporary residents, defined "such as respite", which aligns with the provision of accommodated Short Breaks. CRAG states that for temporary residents, undertaking a financial assessment of ability to pay for the first 8 weeks is at local authority discretion. If a financial assessment is made it must follow CRAG but if no assessment is undertaken a local authority can charge an amount that appears reasonable for the supported person to pay. After 8 weeks, an assessment of ability to pay, under CRAG conditions, must be carried out. However, Scottish Government regulations waive charging for breaks which support unpaid carers or those with terminal illness within specific parameters. The Authority currently has no charging policy in place for Short Break provision. The audit identified that no referrals for financial A formal charging policy for accommodated Short Break provision should be introduced, compliant with CRAG, including clear criteria for when financial assessments and charges apply and when exemptions are required. Page 165
Page 166
6 assessment were undertaken in respect of Short Break provision during the 2025/26 financial year. Consequently, no charges are levied to individuals receiving a service to recover contributions towards the cost of Short Break social care. The audit review noted that, based on research undertaken, other local authorities have charging policies in place for accommodated Short Break provision. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Locality Manager - West Yes 31/05/2027 There is a short life working group which was formulated prior to the audit due to identification of the need to consider a charging policy and guidance for short breaks. This group will progress with recommendations from the Short Breaks audit with regard to charging policy development. Page 166
Page 167
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 High Audit testing identified expenditure recorded as Short Break provision which, on further analysis, related to individuals remaining in residential accommodation for extended periods ranging from five to sixteen months. Short Breaks are typically intended to provide time-limited respite support, depending on assessed need. In the majority of cases reviewed, individuals initially presented for a Short Break, however subsequent changes in circumstances or care requirements resulted in these arrangements being extended while decisions regarding future care were pending. Despite these changes, the cases continued to be classified and funded as Short Breaks. Enquiries with the Service identified instances where Short Break provision had been approved due to the unavailability of community care packages or where it was used as an interim measure pending permanent residential care placement. It is noted that the Service is currently undertaking work to reclassify Short Break provision within CareFirst and the Financial Management System. This work aims to distinguish between planned, emergency and Short Break placements should be subject to timely review and if required reclassification. Financial assessments should be undertaken in line with the charging policy to be developed. Page 167
Page 168
8 interim Short Breaks and to improve service planning, budgeting, and the quality of management information. Under this revised approach the extended stays described above will be categorised as Short Breaks - Interim. As described in Finding 1, a recommendation has been made to consider the development of a charging policy for Short Break provision. However, audit testing found that, irrespective of the length of stay for individuals classified as receiving Short Breaks, financial assessments are only undertaken once individuals are reclassified as receiving community-based care or permanent residential care. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Locality Manager - West Yes 31/05/2027 As referred to in recommendation 1 above, the short life working group will support progression of an updated charging policy and guidance. The short break definition and classifications will be monitored via the existing Resource Allocation Meeting (RAM) structure. Page 168
Page 169
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium The audit review noted that Short Breaks are used to support unpaid carers. Under "The Carers (Scotland) Act 2016", the Authority has a duty to ensure that carers receive the support necessary to maintain their wellbeing while providing care. Carers are also entitled to a Support Plan, which formally identifies and documents their needs and outcomes. An Adult Carer Support Plan is not required in order for an Unpaid Carer to receive support but is considered an important tool in improving support for unpaid Carers to access the necessary resources and formally recognise their role in line with the aims of The Carers Act. Audit testing found that in the majority of the cases sampled where Unpaid Carer support was stated as the reason for the need for Short Break, an Adult Carers Support Plan was not in place to substantiate the Carers needs. At the time of the audit, a pilot project was in operation within a Social Care team to develop separate Adult Carer Support Plans alongside Where Short Breaks are provided to support unpaid carers, Carer Support Plans should be promoted and developed to formalise carers' needs and support the delivery of personalised outcomes- focused support. Page 169
Page 170
10 the Cared For Person's Needs Assessment. Activity is also ongoing to separate costs of supporting Carers on a more refined basis for service planning and information availability. A future audit review of Support for Carers is planned and will be included within a future Internal Audit Plan. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Unpaid Carers Team Manager Yes 31/03/2027 Governance for this action will primarily be through the Unpaid Carers Strategy Oversight Group and linked to the Self-Directed Support Standards Steering Group. Work is already underway in relation to the separate recording on the CareFirst system to ensure a clear distinction between supports for the cared for person and for the unpaid carer. A temporary work around is currently in place until the move to the new Social Care recording system, Mosaic, is complete. A test of change is currently in place in relation to recording supports for the unpaid carer via an Adult Carer Support Plan. Page 170
Page 171
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Low During the audit review, instances of inaccurate recording of Short Breaks were identified within the CareFirst system. CareFirst is the primary information system used for the management of social care packages. Inaccuracies included end dates not being updated to reflect approved extensions or differences between planned and actual end dates, end dates not being entered, and services not being correctly categorised as Short Breaks. While the limitations of the CareFirst system are acknowledged, and it is noted that a replacement social care case management system has been procured with implementation planned by March 2027, the requirement for accurate and complete data input remains. Officers should be reminded of the importance of accurate and complete data recording within the CareFirst system of Short Breaks, as it is the primary system used to record social care activity and to support the validation of payments for care provided. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Team Managers – East & West Community Care Yes 31/01/2027 Team Managers will support operational staff to undertake learning and refresher opportunities surrounding accuracy of recording and its importance within their role. Page 171
Page 172
12 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 172
Page 173
13 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 173
Page 174
Page 174
Page 175
Report to: Audit and Scrutiny Committee Meeting Date: 29 September 2026 Report by: Executive Director Finance, Strategy and Transformation Author: Susan Souter Contact Email: Susan.souter@moray.gov.uk Subject: Treasury Management Performance and Treasury and Capital Investment Prudential Indicators for 2025/26 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to provide Committee with the annual outturn report on Treasury Management and details of the Council’s Prudential Indicators for Treasury Management and Capital Investment for the year ended 31 March 2026. 1.2 This report is submitted to Committee in terms of Sections III B (9) of the Council's Scheme of Administration relating to Treasury Management and the Capital Plan. 2. SUMMARY 2.1 The Treasury Management Policy and Strategy and the Investment Strategy for 2025/26, along with the Prudential Indicators for 2025/26, were approved at Moray Council on 26 February 2025 (paragraph 5 of the Minute refers). Revised indicators were reported to Moray Council on 25 February 2026 when Council approved the above mentioned strategies for 2026/27 (paragraph 7 of the Minute refers). 2.2 During 2025/26 the UK economy experienced modest growth, although the pace of growth slowed as the year progressed. Inflation remained above the Bank of England’s 2% target for much of the year but eased towards the end of the period. In response to improving inflationary conditions and weaker economic growth, the Bank Rate reduced from 4.50% at the start of the financial year to 3.75% by 31 March 2026. 2.3 During 2025/26 the Council continued to maintain a balanced borrowing portfolio through a combination of short-term inter-authority borrowing and longer-term Public Works Loan Board (PWLB) borrowing. The availability of preferential rates within the inter-authority market resulted in an increase in the proportion of short-term borrowing during the year when compared to long-term borrowing. Treasury management activities were undertaken Item 10. Page 175
Page 176
in accordance with the approved strategy whilst ensuring the Council's capital financing requirements continued to be met. 2.4 The Prudential Indicator performance for 2025/26 is set out in Appendix 2. The outturn demonstrates that the Council remained within its approved prudential and treasury management limits during the year, with the exception of the upper limit for borrowing maturing within 12 months. This reflected the Council's use of lower-cost short-term borrowing opportunities and was actively monitored throughout the year. Borrowing and capital financing costs remained affordable and sustainable. 2.5 The report provides a mid-point update on the 2026/27 Treasury Management and Prudential Indicators as approved by Council on 25 February 2026 (paragraph 7 of the Minute refers) in Appendix 4. 3. RECOMMENDATIONS 3.1 It is recommended that Committee notes the Treasury Management Performance for 2025/26, the Treasury Management and Capital Investment Prudential Indicator outturn position for 2025/26 as set out in Appendix 2, and the revised Prudential Indicators for 2026/27 as set out in Appendix 4. Susan Souter Service Manager – Strategic Finance 4. BACKGROUND AND CONTEXT 4.1 The Council has adopted the Chartered Institute of Public Finance and Accountancy (CIPFA) Treasury Management in the Public Services Code of Practice and Cross-Sectoral Guidance Notes (the CIPFA Code), revised in 2021, and complies with the Local Government Investments (Scotland) Regulations 2010 (the Regulations). All treasury management activities are undertaken in accordance with the CIPFA Code and the Regulations. 4.2 The primary requirements of the Code are as follows: • An approved Treasury Management Policy, which sets out the policies and objectives of the Council’s treasury management activities. • An annual treasury management strategy report to Council for the year ahead and an annual review report to Council of the previous year. 4.3 The Local Government (Scotland) Act 2003 requires the Council to adopt the CIPFA Prudential Code for Capital Finance in Local Authorities and to produce the prudential indicators set out in the Prudential Code. These indicators are designed to support and record affordable and sustainable capital investment and treasury management. 4.4 The Treasury Management Policy and Strategy and the Investment Strategy for 2025/26 were approved at Moray Council on 26 February 2025 (paragraph 5 of the Minute refers). Page 176
Page 177
4.5 The revised indicators for 2025/26 along with the Treasury Management Strategy Statement and Prudential Indicators for 2026/27 were approved at Moray Council on 25 February 2026 (paragraph 7 of the Minute refers). 5. PROPOSALS Treasury Performance 2025/26 5.1 This annual Treasury Management performance report covers: • The Economy and Interest Rates 2025/26 • Treasury Management Strategy and Performance for 2025/26 • Annual Investment Strategy and Performance 2025/26 • Investment Outturn for 2025/26 • Long Term Borrowing and Debt Rescheduling • Short Term Borrowing • Prudential Code for Capital Finance in Local Authorities 5.2 Current Portfolio Position The council’s debt and investment position at the beginning and end of 2025/26 was as follows: 1 April 2025 31 March 2026 Principal £m Rate % Debt Principal £m Rate % 196.854 5.07 Long-term Borrowing (fixed rate) 205.418 5.13 99.000 5.21 Temporary Borrowing (fixed rate) 118.000 4.44 295.854 Total Debt 323.418 13.5 years Average Life of Debt 11.8 years £m Rate % Investments £m Rate % 22.730 4.45 Investments 18.295 3.72 Total debt shown above represents the principal value of loans outstanding. Borrowing figures reported within the Prudential Indicators are based on the 2025/26 unaudited accounts and therefore differ slightly due to year-end accounting adjustments. The Economy and Interest Rates 2025/26 5.3 During 2025/26 the UK economy continued to grow, although the pace of growth slowed as the year progressed. Economic performance was stronger in the early part of the year, supported by growth across the services, production and construction sectors. However, growth weakened during the second half of the year as business confidence and investment remained subdued and consumers continued to face cost pressures. Despite these challenges, the economy remained resilient and avoided recession, although overall growth levels were relatively modest throughout the period. Page 177
Page 178
5.4 The Bank of England (BoE) began the financial year with the Bank Rate at 4.50%. The BoE continued to ease monetary policy during 2025/26 as economic growth remained modest and inflationary pressures began to moderate. Bank rate was reduced from 4.25% in May 2025 to 4.00% in August 2025 and again to 3.75% in December 2025. While inflation remained above the Government’s 2% target for much of the year, weakening economic growth, softening wage growth and increasing signs of spare capacity in the labour market supported a gradual reduction in interest rates. By March 2026, Bank Rate remained at 3.75%. 5.5 Despite reductions in the Bank Rate during 2025/26, long-term borrowing costs remained relatively high compared to recent years. Market uncertainty around inflation, economic growth and government borrowing requirements continued to influence PWLB borrowing rates throughout the year. 5.6 Quarterly Gross Domestic Product (GDP) growth remained positive throughout most of the period, although the rate of growth slowed following a strong first quarter. GDP increased by 0.7% in Q1 2025 before slowing to 0.3% in Q2 and 0.1% in both Q3 and Q4. Growth during the year was supported primarily by the services sector, whilst production and construction performance varied between quarters. Although household spending showed signs of resilience, business investment remained subdued and consumer confidence weakened towards the end of the period. Overall, the economic outlook remained uncertain and growth levels were modest throughout the year. 5.7 Consumer Price Index (CPI) inflation fluctuated throughout 2025/26, reflecting both domestic and global economic pressures. Inflation increased from 2.6% in March 2025 to 3.5% in April 2025, largely due to increases in household costs including energy and water charges, as well as higher transport and food prices. Inflation remained elevated through much of the summer and early autumn, reaching 3.8% between July and September 2025. Thereafter, inflationary pressures gradually eased, with CPI falling to 3.0% by January and February 2026. While underlying inflation remained above the Bank of England's 2% target throughout the year, the overall trend towards the end of the period was one of moderation as food, fuel and other price pressures reduced. Annual Investment Strategy 5.8 The Council’s creditworthiness policy was formulated after consultation with Arlingclose, the Council’s treasury advisers. The Chief Financial Officer maintains a counterparty list in compliance with the minimum criteria approved by Moray Council on 3 March 2020 (paragraph 4 of the minute refers). 5.9 All credit ratings are monitored daily, and the Counterparty list amended to reflect any changes if necessary. An updated Counterparty list is shown in Appendix 3. Investment Outturn for 2025/26 5.10 The Council managed its investment in-house and invested with the institutions listed on the Council’s approved Counterparty list show in Appendix 3. 5.11 The table below shows the overall investment undertaken by the Council during 2025/26. Page 178
Page 179
Total sum deposited (£m) Average rate (%) Approved Financial Institutions 535.530 4.08 Council’s Bankers 31.953 2.89 TOTAL 567.483 4.04 5.12 The above figures are cumulative, and the actual amounts invested at any one time range from £7.800m to £50.440m. 5.13 The average rate of interest earned on investments during the year was 4.04%, compared to the average 7 day London Interbank Bid Rate (LIBID) of 3.98%. When the Bank of England base interest rate increases, the Council’s Bank of Scotland call account rate is increased from that day, as is the LIBID rate. The money market funds in which the Council invests the balance of funds takes time to catch up as their interest rates are not set and fluctuate depending on the market and the size of the investment in each fund. The Council’s investments throughout the year were in line with the Treasury Management Practices and money deposited in the approved funds, redeeming from the ones with the lower rates first. 5.14 As at 31 March 2026, the following balances were invested. Counterparty Investment Amount (£m) Interest Rate (%) Bank of Scotland Call Account 1.000 2.4 Aberdeen Standard Money Market Fund 5.000 3.82 Federated Hermes Money Market Fund 5.000 3.84 Blackrock Money Market Fund 5.000 3.76 CCLA Money Market Fund 2.295 3.75 TOTAL 18.295 3.72 Long Term Borrowing and Debt Rescheduling 5.15 The Council’s long term external debt position at 31 March 2026 compared with the position at the end of the last financial year was as follows: 31 March 2025 31 March 2026 Actual (£000) Rate (%) Average Life Actual (£000) Rate (%) Average Life Fixed Rate Funding (PWLB) 163,454 33,400 5.22 4.68 14.21 48.81 172,018 33,400 5.24 4.68 12.39 47.81 Page 179
Page 180
Fixed Rate Funding (Market) TOTAL DEBT 196,854 5.07 205,418 5.13 There was no variable rate borrowing in the year. 5.16 The Council continued to maintain an under-borrowed position during 2025/26. This means that the Capital Financing Requirement (CFR) was not fully funded by external borrowing and the Council continued to utilise cash-backed reserves, balances and cash flows to support its capital financing requirement on a temporary basis. 5.17 The Council's borrowing strategy relied heavily on short-term inter-authority borrowing during 2025/26 due to the favourable rates available when compared to long-term borrowing. Whilst this approach helped minimise borrowing costs, it resulted in the proportion of borrowing maturing within 12 months exceeding the approved upper limit. The position was monitored throughout the year and liquidity and refinancing risks remained manageable. The Council continued to mitigate these risks through a combination of short-term borrowing and longer- term PWLB borrowing where appropriate. 5.18 In the financial year 2025/26 £20m of new PWLB borrowing was undertaken. 5.19 No debt rescheduling was undertaken during the year as the differential between PWLB new borrowing rates and PWLB premature repayments rates made rescheduling unviable. Short Term Borrowing 5.20 During the year, 26 new temporary loans, totalling £118m were borrowed from other UK local authorities. A table detailing these loans is included at Appendix 1. The Prudential Code for Capital Finance in Local Authorities 5.21 The Local Government (Scotland) Act 2003 requires the Council to undertake its treasury activities with regard to the Prudential Code for Capital Finance in Local Authorities. 5.22 To comply with the Prudential Code, authorities must not borrow to invest primarily for financial return. The Prudential Code also states that it is not prudent for local authorities to make investment or spending decisions that will increase the Capital Financing Requirement (CFR) unless directly and primarily related to the functions of the authority. Borrowing is permitted for cash flow management, interest rate risk management, to refinance current borrowing and to adjust levels of internal borrowing. Borrowing to refinance capital expenditure primarily related to the delivery of a local authority’s function but where a financial return is also expected is allowed, provided that financial return is not the primary reason for the expenditure. 5.23 The Code requires the Council to produce mandatory indicators aimed at assisting members in ensuring that proposed capital investment levels and treasury management decision satisfy the key requirements of affordability, prudence and sustainability. The Prudential Indicators for 2025/26 were approved at Moray Council on 26 February 2025 (paragraph 5 of the Minute refers). Performance against key indicators is shown in Appendix 2. Page 180
Page 181
Prudential Indicators 2026/27 5.24 The Prudential Indicators for 2026/27 were approved by Council on 25 February 2026 (paragraph 7 of the minute refers) based on the estimated outturn position for 2025/26 available at that time. Following completion of the 2025/26 annual accounts and approval of the Quarter 1 Capital Monitoring Report for 2026/27, the indicators below have been updated to reflect the latest projected position. 5.25 The principal changes relate to the final 2025/26 outturn position and the approved carry forwards incorporated within the 2026/27 capital programme. As a result, revised estimates have been prepared for capital expenditure, external debt limits, the Capital Financing Requirement (CFR) and affordability indicators. Despite these revisions, all prudential indicators remain within the Council's approved affordability and prudential limits. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) ✓ Policy and Legal ✓ Financial ✓ Risk ✓ Staffing ✓ Best Value and Transformation Property ✓ Information Communications Technology/Digital ✓ Equalities. Social Inclusion and Economic Impact ✓ Climate Change and Biodiversity Impact ✓ 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population Page 181
Page 182
None specifically arising from this report. 6.3 Policy and Legal The Local Government in Scotland Act 2003 provides the powers to borrow and invest as well as providing controls and limits on these activities. The Council has adopted the CIPFA Prudential Code and the CIPFA Treasury Management in the Public Services Code of Practice and Guidance Notes (the CIPFA Code) which was revised in 2021. The Council also complies with the Local Government Investments (Scotland) Regulations 2010 (the Regulations). All Treasury Management activities are carried out in accordance with the CIPFA Code and the Regulations. 6.4 Financial There are no direct financial implications as a result of this report. Appendix 2 provides the outturn results of the investment and borrowing decisions for 2025/26. 6.5 Risk The Council is aware of the risks of passive management of the treasury portfolio and, with the support of the Council’s treasury advisers, will proactively manage its investments and debt over the year. Capital expenditure is closely monitored, and Budget Managers are aware of their responsibilities to manage budget allocations. 6.6 Staffing None specifically arising from this report. 6.7 Best Value and Transformation None specifically arising from this report. 6.8 Property None specifically arising from this report. 6.9 Information Communications/Technology/Digital None specifically arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact Does the proposal have the potential to affect people from the below categories differently to the wider Moray population: Yes Maybe No Positive Negative Positive Negative Page 182
Page 183
Any protected characteristics individuals or groups (Equality Act 2010) ☐ ☐ ☐ ☐ ✓ Any socio-economic disadvantaged individuals or groups – i.e. low / no income / wealth or deprivation ☐ ☐ ☐ ☐ ✓ Human Rights of individuals ☐ ☐ ☐ ☐ ✓ Rights of Children or Young People (UNCRC) ☐ ☐ ☐ ☐ ✓ JUSTIFICATION - Please provide a brief justification statement explaining why the above boxes have been selected The report relates to treasury management activity and prudential indicators only and does not in itself affect service delivery, staffing, Council Tax levels, housing rents or the provision of services to any group. Accordingly no differential impact has been identified. 6.11 Climate Change and Biodiversity Impacts None specifically arising from this report. 7. CONSULTATION 7.1 This report has been prepared in consultation with Arlingclose, the Council’s treasury advisors. 8. BACKGROUND PAPERS 8.1 All background papers held by Accountancy section. Page 183
Page 184
APPENDIX 1 Short Term Loans Outstanding as at 31 March 2026 Organisation Maturity Date Borrowing Rate (%) Amount (£m) South Oxfordshire District Council 02/04/2026 4.65 5.00 Local Government Association 28/04/2026 4.60 1.50 Local Government Association 28/04/2026 4.60 1.50 West Of England Combined Authority 11/06/2026 4.60 5.00 Wychavon District Council 26/10/2026 4.25 5.00 Thames Valley Police 17/09/2026 4.25 5.00 Bolton Metropolitan Borough Council 25/06/2026 4.25 5.00 Western Isles Council 23/07/2026 4.25 5.00 Rochford District Council 19/06/2026 4.15 5.00 Vale Of White Horse District Council 10/09/2026 4.10 5.00 Tendring District Council 06/05/2026 4.10 5.00 Wandsworth Borough Council 27/07/2026 4.40 5.00 City of Edinburgh Council 30/07/2026 4.50 5.00 Nottinghamshire Police 21/12/2026 4.50 5.00 Hyndburn Borough Council 05/01/2027 4.60 2.00 West Yorkshire Combined Authority 16/10/2026 4.65 5.00 East Lindsey District Council 21/12/2026 4.65 3.00 Test Valley Borough Council 20/01/2027 4.55 5.00 Somerset Council Pension Fund 05/01/2027 4.55 5.00 Lancashire Combined Fire Authority 03/02/2027 4.55 5.00 Oxfordshire County Council 27/11/2026 4.55 5.00 Northern Ireland Housing Executive 14/12/2026 4.45 5.00 London Borough of Havering 18/12/2026 4.60 5.00 Furness Building Society 16/03/2027 4.60 5.00 East Suffolk Council 08/01/2027 4.60 5.00 Cambridgeshire & Peterborough Combined Authority 26/01/2027 4.60 5.00 TOTAL 118.00 Page 184
Page 185
APPENDIX 2 TREASURY AND PRUDENTIAL INDICATORS External Debt and Treasury Indicators 1. The Authorised Limit for External Debt The authorised limit for external debt is required to separately identify external borrowing and other liabilities such as Public Private Partnership (PPP), Design, Build, Finance, Maintain (DBFM) Contracts and finance lease obligations. This limit provides a maximum figure to which the Council could borrow at any given point during the financial year. Authorised Limit 2025/26 Approved Indicator 2025/26 Estimated Indicator 2025/26 Actual Maximum £000 £000 £000 Borrowing 391,240 410,015 331,256 Other Liabilities 50,342 52,257 57,529 Total External Debt 441,582 462,272 388,785 The overall authorised limit for external debt was not breached during 2025/26. While Other Liabilities exceeded the level originally estimated, primarily due to changes in lease liabilities recognised under IFRS 16 Leases, total external debt remained well within the approved limit. 2. Operational Boundary for External Debt This indicator is a management tool for in-year monitoring and is based on an estimate of the most likely level of external borrowing at any point during each year. The estimated indicators are based on the approved capital plan as part of the Council’s budget setting process. The actual is based on the capital expenditure in the year and there was slippage in various projects which has resulted in a variance. Operational Boundary 2025/26 Approved Indicator 2025/26 Estimated Indicator 2025/26 Actual Maximum £000 £000 £000 Borrowing 376,240 405,015 331,256 Other Liabilities 49,342 51,257 57,529 Total External Debt 425,582 456,272 388,785 The overall operational boundary for external debt was not breached during 2025/26. Although Other Liabilities were higher than estimated, total external debt remained within the approved operational boundary and borrowing levels were significantly below the approved limit due to slippage within the capital programme. Page 185
Page 186
3. Actual External Debt This is measured at the end of each financial year. The actual external debt reported in the annual accounts for the previous year is required to be shown as an indicator for comparison purposes only. Actual Debt At 31 March 2025 At 31 March 2026 £000 £000 Borrowing 299,057 326,256 Other Liabilities 58,555 57,529 Total External Debt 357,612 383,785 Other Liabilities include the PPP finance liability for Elgin Academy and Keith Primary School, the DBFM finance liability for Elgin High School and other miscellaneous finance lease payments as required by IFRS 16 Leases. The borrowing figures in the Prudential Indicators are based on the audited accounts and therefore differ slightly from the loan balances reported elsewhere in this report due to year-end accounting adjustments. 4. Treasury Management Indicator There are four treasury prudential indicators, the purpose of which is to contain the activity of the treasury function within certain limits, thereby managing risk and reducing the impact of an adverse movement in interest rates. However, if these are set to be too restrictive, they will impair the opportunities to reduce financing costs. The indicators are: • Upper limits on variable rate exposure – This indicator identifies a maximum limit for variable interest rates based upon the debt position net of investments. • Upper limits on fixed interest rate exposure – Similar to the previous indicator this covers a maximum limit on fixed interest rates. • Maturity structures of borrowing – These gross limits are set to reduce the Council’s exposure to large fixed rate sums falling due to refinancing within the same financial year, and are required for upper and lower limits. • Maximum period of investment - Following changes arising from the new Investment Regulations applicable from 1 April 2010, the Council can invest for periods longer than 364 days. The Council does not currently take advantage of this change and so has set a limit of Nil for investing over 364 days. Page 186
Page 187
Fixed and Variable Rate Limits 2024/25 Actual 2025/26 Approved Limits 2025/26 Actual Interest Rate Exposure Upper Limit Upper Limit Upper Limit Limits on fixed interest rates based on net debt 100% 100% 100% Limits on variable interest rates based on net debt 0% 35% 0% Maturity Structure of Fixed Interest Rate Borrowing 2024/25 Actual 2025/26 Approved Limits 2025/26 Actual (£m) 2025/26 Actual Lower Upper <12 months 37.84% 0% 37% 139.444 42.74% 12-24 months 6.38% 0% 20% 30.116 9.23% 2-5 years 9.26% 0% 25% 27.385 8.39% 5-10 years 12.65% 0% 50% 30.764 9.43% >10 years 33.87% 0% 85% 98.547 30.21% The upper limit for borrowing maturing within 12 months was exceeded during 2025/26 due to the Council's continued use of short-term inter-authority borrowing. This reflected the significant differential between short-term and long- term borrowing costs during the year. The breach was monitored, and no additional risk to the Council's affordability or liquidity position arose. Maximum Principal Sums Invested Greater than 364 days 2024/25 Actual 2025/26 Actual Principal sums invested >364 days £0m £0m Page 187
Page 188
Capital Expenditure Indicators 5. Capital Expenditure This indicator is included so the Council complies with the Local Government in Scotland Act 2003 which requires the Council to establish and keep under review capital investment plans which are affordable. 2025/26 Approved Indicator 2025/26 Revised Indicator 2025/26 Revised Capital Plan 2025/26 Actual £000 £000 £000 £000 Capital Expenditure: General Services 64,045 46,995 50,564 32,855 HRA 37,767 38,005 40,639 31,655 Total Capital Expenditure 101,812 85,000 91,203 64,510 Financed by: Capital Receipts 100 1,215 100 565 Capital Grant & Contributions 54,443 31,910 35,376 23,771 Revenue 3,550 3,512 3,849 3,613 Total Funding 58,093 36,637 39,325 27,949 Net Financing Need for the year 43,719 48,363 51,878 36,562 The General Service Capital Programme for 2025/26 final approved amount was £50.564m. Expenditure for the year was £32.855 million, representing a delivery rate of 65% of the final programme. The shortfall was largely due to the reprofiling of expenditure across a number of major capital projects, including the Learning Estate, Moray Growth Deal and other property and infrastructure projects, resulting in expenditure being carried forward into future financial years. HRA spend in the same period was £31.655m against a revised capital plan of £40.639m, representing a 78% delivery rate. The underspend was mainly due to slippage within the planned capital maintenance and new build housing programmes, with expenditure reprofiled into future financial years. Ongoing challenges around contractor availability, internal resources and tenant permissions also affected delivery of elements of the programme. Page 188
Page 189
Prudence Indicators 6. Gross Debt and the Capital Financing Requirement This indicator records the extent that gross debt is less than the capital financing requirement. This indicator shows prudence by demonstrating that over the medium term external borrowing is used only for a capital purpose. The values are measured at the end of each financial year. Debt is the sum of external borrowing and other liabilities relating to the financing of assets (i.e. PPP, DBFM and finance leases). The Capital Financing Requirement (CFR) represents the Council's underlying need to borrow to fund capital investment. It increases when new borrowing is required to fund capital expenditure and reduces over time through annual repayments charged to revenue. Comparing the CFR with the Council's actual debt position helps demonstrate that borrowing remains prudent and is being used to support capital investment rather than day-to-day spending. 2024/25 Actual 2025/26 Approved Indicator 2025/26 Revised Estimate 2025/26 Actual £000 £000 £000 £000 Borrowing 299,057 314,134 333,573 326,256 Other Liabilities 58,555 48,342 50,527 57,529 Gross Debt 357,612 362,476 384,830 383,785 CFR 383,054 432,935 418,012 428,280 Under Limit by 25,442 61,459 33,182 44,495 The above figures confirm that the Council’s borrowing is under the Capital Financing Requirement. Page 189
Page 190
Affordability Indicators 7. Ratio of Financing Costs to Net Revenue Stream This is an indicator of affordability and calculates the proportion of the net revenue budget required to finance the costs associated with borrowing and investment and is calculated by taking the total financing costs, including the costs of PPP/DBFM schemes as a proportion of the income received by the Council. The Council has set a limit of 10% for General Services and 35% for the HRA. The relevant proportions are set out below. 2024/25 Actual 2025/26 Approved Indicator 2025/26 Revised Indicator 2025/26 Actual General Services 10.63% 8.90% 9.43% 8.62% HRA 30.00% 29.72% 29.79% 29.06% For General Services, the indicator reduced from 10.63% in 2024/25 to 8.62% in 2025/26 and remained below the Council's affordability threshold of 10%. The reduction reflects lower financing costs than originally estimated together with the continued management of borrowing requirements and delivery of the capital programme. For the Housing Revenue Account, the indicator was 29.06% for 2025/26, compared with the approved indicator of 29.72% and remains within the Council's affordability threshold of 35%. The indicator reflects the ongoing investment in the Council's housing stock and new build housing programme whilst remaining within the limits set as part of the Housing Revenue Account Business Plan. Both indicators were therefore within the approved affordability limits during 2025/26. Page 190
Page 191
8. Estimates of Incremental Impact of New Capital Investment Decisions on Council Tax and House Rents This Prudential Code indicator provides an illustration of the impact that changes in capital financing costs could have on Council Tax and housing rents. It is a theoretical measure used to demonstrate affordability and does not represent actual changes to Council Tax or rent levels. Impact including all finance costs 2024/25 Actual 2025/26 Approved Indicator 2025/26 Revised Indicator 2025/26 Actual Council Tax – Band D £234.13 £0.85 (£40.26) (£58.02) Average Weekly Housing Rents £7.36 £3.85 £1.05 £1.09 This indicator is a Prudential Code measure that compares financing costs with the previous year and illustrates the theoretical impact on Council Tax and housing rents. The negative Council Tax figure reflects lower financing costs than in the previous year and does not represent an actual reduction in Council Tax. Similarly, the housing rent figure is an illustrative indicator rather than a direct change in rents. Page 191
Page 192
APPENDIX 3 UK Banks Limit (£m) Time Limit Bank of Scotland (Lloyds) 10 Call Barclays Bank 5 35 days HSBC 5 35 days Lloyds Bank 5 35 days National Westminster Bank (RBS) 5 35 days Royal Bank of Scotland 5 35 days Santander (UK) 5 35 days Standard Chartered Bank 5 35 days UK Building Societies Nationwide 5 35 days Other Institutions Debt Management Office Unlimited 6 Months UK Local Authorities 5 2 years Money Market Funds Standard Life Sterling Liquidity Fund 5 Call Federated Sterling Prime Fund 5 Call Blackrock Institutional Sterling Liquidity Fund 5 Call Insight Sterling Liquidity Fund 5 Call Deutsche Bank Managed Sterling Fund 5 Call CCLA Public Sector Deposit Fund (UK) 5 Call Notes 1.The long term ratings for each institution above are in the format Fitch/ Moodys/ Standard & Poor. The minimum ratings are as follows: - Fitch: BBB+ Moodys: Baa1 Standard & Poor: BBB+ THE MORAY COUNCIL APPROVED COUNTERPARTIES LIST Page 192
Page 193
APPENDIX 4 TREASURY AND PRUDENTIAL INDICATORS 2026/27 1. Capital Expenditure The revised capital expenditure estimates reflect the latest approved capital plan for 2026/27, including the reprofiling of expenditure from 2025/26 and any amendments approved through the capital monitoring process. 2025/26 Actual 2026/27 Approved Indicator 2026/27 Revised Indicator £000 £000 £000 Capital Expenditure: General Services 32,855 67,894 77,294 HRA 31,655 44,454 44,454 Total Capital Expenditure 64,510 112,348 121,748 Financed by: Capital Receipts 565 100 100 Capital Grant & Contributions 23,771 39,333 48,255 Revenue 3,613 4,563 4,563 Total Funding 27,949 43,996 52,918 Net Financing Need for the year 36,562 68,352 68,830 2. The Authorised Limit for External Debt Authorised Limit 2025/26 Actual 2026/27 Approved Indicator 2026/27 Estimated Outturn £000 £000 £000 Borrowing 331,256 494,895 405,912 Other Liabilities 57,529 51,655 50,257 Total External Debt 388,785 546,550 458,169 The revised Authorised Limit reflects the latest forecast borrowing requirement and other liabilities arising from the updated capital programme and remains sufficient to accommodate the Council's anticipated borrowing and treasury management activities during 2026/27. Page 193
Page 194
3. Operational Boundary for External Debt Operational Boundary 2025/26 Actual 2026/27 Approved Indicator 2026/27 Estimated Outturn £000 £000 £000 Borrowing 331,256 479,895 400,912 Other Liabilities 57,529 50,655 51,257 Total External Debt 388,785 530,550 452,169 The revised Operational Boundary reflects the Council's latest estimate of the most likely level of external debt during 2026/27 and remains within the revised Authorised Limit. 4. Gross Debt and Capital Financing Requirement The revised CFR reflects the actual closing CFR at 31 March 2026 together with the latest forecast capital expenditure for 2026/27. 2025/26 Actual 2026/27 Approved Indicator 2026/27 £000 £000 £000 Borrowing 326,256 389,752 395,912 Other Liabilities 57,529 49,655 49,257 Gross Debt 383,785 439,407 445,169 CFR 428,280 472,589 485,369 Under Limit by 44,495 33,182 40,200 The revised CFR has increased compared with the approved indicator, primarily reflecting the impact of capital expenditure reprofiled from 2025/26 together with the actual closing CFR at 31 March 2026. Gross debt remains below the CFR, demonstrating compliance with the Prudential Code requirement that borrowing is undertaken for capital purposes. 5. Ratio of Financing Costs to Net Revenue Stream 2025/26 Actual 2026/27 Approved Indicator 2026/27 Estimated Outturn General Services 8.62% 9.27% 7.89% HRA 29.06% 32.17% 33.78% The revised affordability indicators remain within the Council's approved limits of 10% for General Services and 35% for the HRA. Page 194