Agenda Document Pack - Audit and Scrutiny Committee - 11/09/2024
Moray Council · 11 September 2024
Back to Audit and Scrutiny Committee — 11 September 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 11 September 2024 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 11 September 2024 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Resolution Consider, and if so decide, adopt the following resolution: "That under Section 50A (4) and (5) of the Local Government (Scotland) Act 1973, as amended, the public and media representatives be excluded from the meeting for Items 12, 13 and 14 of business on the grounds that they involve the likely disclosure of exempt information of the class described in the relevant Paragraphs of Part 1 of Schedule 7A of the Act.” 4. Minutes of meeting of 25 June 2024 7 - 12 5. Written Questions ** 6. Internal Audit Section Update Report Report by Audit and Risk Manager 13 - 34 7. Internal Audit Review - Procurement and Creditor Payments Report by Audit and Risk Manager 35 - 44 8. Internal Audit Review - Following the Public Pound Report by Audit and Risk Manager 45 - 62 9. Internal Audit Review - Commercial Refuse Collection Report by Audit and Risk Manager 63 - 80 Page 1
Page 2
10. Public Sector Internal Audit Standards - External Quality Assessment of Internal Audit Report by Audit and Risk Manager 81 - 102 11. Carefirst Replacement - Progress Update Report by Interim Head of Service and Chief Social Work Officer 103 - 108 Item(s) which the Committee may wish to consider with the Press and Public excluded 12. Internal Audit Review - Email Security [Para 14] • 14. Information relating to action taken, or to be taken, in connection with the prevention, investigation or prosecution of crime. 13. Internal Audit Follow Up Review - Cyber Security [Para 14] • 14. Information relating to action taken, or to be taken, in connection with the prevention, investigation or prosecution of crime. 14. Update on Improvement Plan for Adult Social Care Commissioning [Para 8] • 8. Information on the amount of any expenditure proposed to be incurred by the Authority; Summary of Audit and Scrutiny Committee functions: Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Audit Functions - Consider reports from the Council's internal and external auditors concerning Council Functions. Scrutiny Functions - To scrutinise areas of policy, service delivery or performance identified for improvement. Inquiries - To deal with all matters relating to local inquiries into matters affecting children. Page 2
Page 3
Watching the Meeting You can watch the webcast live by going to: http://www.moray.gov.uk/moray_standard/page_43661.html Webcasts are available to view for 1 year following the meeting. You can also attend the meeting in person, if you wish to do so, please come to the High Street entrance door and a member of staff will be let into the building. Page 3
Page 4
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. Page 4
Page 5
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Theresa Coull (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Scott Lawrence (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 5
Page 6
Page 6
Page 7
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Tuesday, 25 June 2024 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Theresa Coull, Councillor John Cowe, Councillor Amber Dunbar, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Scott Lawrence, Councillor Graham Leadbitter, Councillor Marc Macrae, Councillor Neil McLennan, Councillor Shona Morrison APOLOGIES Councillor John Divers, Councillor Jérémie Fernandes, Ms Margaret Wilson IN ATTENDANCE Interim Chief Executive; Head of Governance, Strategy and Performance; Head of Financial Services; Head of Environmental and Commercial Services; Audit and Risk Manager, Caroline O'Connor, Committee Services Officer, all Moray Council and Angela Pieri and Andrew Wallace, Grant Thornton - External Auditors. 1. Chair Councillor Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Pre-Election Period The Chair reminded the Committee the meeting was taking place during the pre- election period and that there are restrictions on the Council over publishing material which could show support for a particular party. As Council meetings are webcast they fall within these restrictions. The Chair stated the advice from the Monitoring Officer was that, whilst the Committee can continue to deal with "business as usual" items, should debate become overtly political then the Chair may require to intervene. 3. Declaration of Group Decisions and Members Interests * In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. 4. Minute of meeting of 8 May 2024 The minute of the Audit and Scrutiny Committee on 8 May 2024 had been submitted. Item 4. Page 7
Page 8
Councillor McLennan suggested an amendment to the wording of the minute for Item 8 "National Fraud Initiative 2022-23" in relation to the last paragraph and recommendation (ii) to accurately record the discussion at the meeting. He asked that the wording be amended to read "In response the Chair moved to add an additional recommendation instructing the Internal Auditor to explore options around making sure the Council meet the national requirements of the National Fraud Initiative whilst also ensuring the work is proportionate" and recommendation (ii) also be changed to reflect the amended wording. The Chair confirmed he was in agreement with the suggested change. Subject to the amendment above, the Committee agreed the minute of the meeting. 5. Written Questions ** The Committee noted that no written questions had been submitted. 6. Internal Audit Annual Report - 2023-24 The meeting had before it a report by the Audit and Risk Manager providing Committee with a copy of the Internal Audit Annual report for the year ended 31 March 2024, together with the Audit and Risk Manager's opinion on the adequacy and effectiveness of the Council's system of internal control. Councillor Coull asked for an update on the appointment of an Assistant Auditor and queried if the Audit and Risk Manager will report back to Committee if there is still insufficient support following the appointment. In response the Audit and Risk Manager advised the post had been advertised however it had not been possible to proceed to interview and he planned to delay re-advertising the post until July or August after exam results are published in the hope a suitable candidate can be appointed. In response to a question from the Chair relating to the Audit Plan Delivery performance measure at paragraph 3.6 and whether the target should be reviewed given that the actual figures for the last two years were higher than the target, the Audit and Risk Manager agreed to given it consideration when setting future targets however advised caution had to be exercised given the impact of the removal of the Corporate Investigation Officer post. Councillor Keith referred to the fourth bullet under paragraph 3.4 where it stated follow-up audits undertaken found that recommendations had yet to be implemented within the agreed timescales and, taking into account 100% customer feedback rating the audit as having added value and provided meaningful results, asked why management was not acting to ensure recommendations were implemented. In response the Interim Chief Executive advised he planned to bring quarterly performance reports within the Corporate Management Team on the position with outstanding internal and external audit recommendations to increase performance scrutiny. The Audit and Risk Manager also stated that delays sometimes occur in obtaining timely responses to audit queries and recommendations that can impact the reporting of reviews to this Committee. The Audit and Risk Manager intends to contact the Chief Financial Officer to include timescales for officers responding to audit queries and recommendations within the Financial Regulations. Page 8
Page 9
Following consideration the Committee unanimously agreed to note the contents of the annual report given as Appendix 1. 7. Internal Audit Section Update Report The meeting had before it a report by the Audit and Risk Manager providing Committee with an update on the work of the Internal Audit Section. The Chair noted it was pleasing to see the vast majority of recommendations had been implemented however asked there was any indication if the revised implementation date at 5.05 in Appendix 4 on the Debtors audit would be achieved. In response, the Head of Financial Services advised work had been undertaken to develop the performance management system and she was confident the August target would be met. Councillor McLennan asked whether the audit capacity issues highlighted by the Audit and Risk Manager at a previous meeting had impacted on the timescales in the debtors audit or if there were any other areas of work that would be of concern given the reduced audit capacity. In response, the Audit and Risk Manager advised capacity remains a concern to meet the requirements of the audit plan given the vacancies and work required by the team on the National Fraud Initiative. He confirmed a further strain related to having to go back to services to evidence implementation on recommendations. Following consideration the Committee unanimously agreed to note the contents of the report. 8. Internal Audit Section - Completed Projects Report The meeting had before it a report by the Audit and Risk Manager advising Committee on the work of the Internal Audit Section for the period from 8 May 2024 to 25 June 2024. Councillor Coull requested more information on what was causing the issues with direct debits for Fitlife memberships in Appendix 2 relating to the Keith Sports and Community Centre audit. In response, the Audit and Risk Manager advised the direct debit payments are processed through the Council's financial management system which is separate to the Gladstone system however variances were found between the two systems. He confirmed recommendation 5.04 had been accepted by the service to undertake a full reconciliation. In the absence of the Depute Chief Executive (Education, Communities and Organisational Development), the Head of Governance, Strategy and Performance provided further information advising that the issue relates to the delay inherent in a manual system of matching active users to active payers in addition to an approach to give users time to reinstate their payments rather than remove them which could have longer term impact in that they are less likely to return to active membership. The reconciliation can be improved by purchasing an additional function on the Gladstone system to automate the process and a request has been submitted to Finance for funding through the small service investments budget. Councillor Gordon asked if there was any way to assess the amount of lost income given that those turning 18 should be applying for separate memberships and removed from family membership but noting was no system set up to review Page 9
Page 10
this. In response, the Audit and Risk Manager indicated the reconciliation should provide more accurate information including on loss of income. Councillor Macrae expressed concern that the paper was not being heard in the private session given the paper was highlighting weaknesses in the processes and details of procurement regulations not being followed. He further noted only 50% of the Gladstone system capabilities were being utilised by the Council in that it was being used only as a booking system. In response to the public debate concerns, the Head of Governance, Strategy and Performance advised the role of the Committee is to focus on improvement and it was important to be open about the issues so work can be done to improve the system moving forward. In response to a question from Councillor Gatt relating to recommendation 5.01 of Appendix 2 asking for an update on the numbers of those holding petty cash across all services in the Council, the Head of Financial Services advised there has been a gradual reduction in the amount of those holding it since the review started, however was hopeful it was building momentum and services would realise the benefits of using other methods such as purchasing cards for smaller purchases. The Chair asked whether work requires to be done on the compatibility of Council systems to reconcile into something more efficient and effective. In response the Audit and Risk Manager advised it is a complex area to record data consistently across so many different services, also noting that resourcing issues have an impact on time spent developing systems and testing prior to implementation. The Head of Governance, Strategy and Performance agreed it would be challenging to have one system to cover such a wide range of services, whilst acknowledging it was something to strive towards. In response to a question from Councillor Cowe as to whether it was possible to attribute income received from Fitlife against the running costs of the Keith Sports and Community Centre to ascertain if the facility was breaking even, the Head of Governance, Strategy and Performance confirmed the Clerk had confirmed a question had been raised at Education, Children's and Leisure Services Committee on 20 June 2024 asking whether it was possible to produce a breakdown of memberships by facility and an undertaking had been given to look into that. Councillor Morrison left the meeting during discussion of this item. Following consideration the Committee unanimously agreed to note the contents of the report. 9. Annual Governance Statement The meeting had before it a report by the Interim Chief Executive providing Committee with a copy of the Council's Annual Governance Statement for 202/24 for review and approval. In relation to Section 2 "Ensuring openness and comprehensive stakeholder engagement" of the Appendix, the Chair noted stakeholder engagement is generally very good however asked that the statement be amended to include work done by the Development Plans Team and suggested consistency is required across all departments. In response the Interim Chief Executive agreed to amend the statement accordingly. Page 10
Page 11
In relation to Section 1 "Behaving with integrity, demonstrating strong commitment to ethical values, and respecting the rule of law" of the Appendix, Councillor Macrae noted the last paragraph referenced the Monitoring Officer being responsible for ensuring compliance with agreed procedures, statutes and regulation however stated that reference in audits often report on non- compliance. In response the Interim Chief Executive confirmed part of the role of the Committee is to ensure compliance and gave a commitment to ensure compliance moving forward and would take action if required. The Head of Governance, Strategy and Performance advised statute sets out that any breaches of rules or codes require to be brought to the Council's attention by the Monitoring Officer however the issues raised had been through due process within the Council and seeking improvement where necessary which was part of the healthy governance of the Council. He further advised if there was not good governance or scrutiny by the Committee, the Monitoring Officer would bring a report to the attention of the Council to advise of any particular issue. Councillor Gatt noted that whilst scrutiny is important as to identify improvements, enforcement is also required. In response, the Head of Governance, Strategy and Performance referred to a previous training session on scrutiny which related to accountability and stated individuals should be accountable in order to provide assurance to the Committee. In response to a query from Councillor Coull relating to the website not being easy to navigate and some information being out of date, the Interim Chief Executive confirmed he would raise the issue at a digital workshop planned for the beginning of July which was to consider and prioritise IT systems going forward including investment. Following consideration the Committee unanimously agreed to note the draft Annual Governance Statement provided as Appendix 1. 10. Local Government Benchmarking Framework 2022-23 and 2021-22 Results The meeting had before it a report by the Depute Chief Executive (Education, Communities and Organisational Development) presenting to the Committee a corporate overview of benchmarking performance data for the period 2022-23 and 2021-22. The Head of Governance, Strategy and Performance advised the report had previously been considered by Corporate Committee and the Committee now had the opportunity to ask any further questions in terms of their overview role. Councillor McLennan asked whether future reports could be considered by a joint Corporate and Audit and Scrutiny Committee or a briefing meeting for both Committees. In response the Head of Governance, Strategy and Performance advised that could be problematic constitutionally however agreed a briefing may be appropriate for more informal questions or the performance management framework reporting arrangements could be reviewed. Councillor Macrae asked whether it could be considered by Moray Council to give every Member an opportunity to address the paper. In response the Head of Governance, Strategy and Performance advised any paper can be brought before Moray Council. Page 11
Page 12
The Head of Governance, Strategy and Performance sought clarification from the Committee as to whether they were happy to agree the recommendation for this report and suggested an additional recommended be added to request that future reporting arrangements are reviewed. There being no-one otherwise minded the Committee unanimously agreed to:- i) note the Council's performance in terms of a corporate overview of benchmarking results; and ii) make a request for future reporting arrangements to be reviewed. Page 12
Page 13
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 11 SEPTEMBER 2024 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2024/25 AUDIT PLAN Audit Plan Update 4.1 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed as Appendix 1 is an update on the progress undertaken by the Internal Audit Section regarding the completion of audit review projects against the Annual Audit Plan. 4.2 In addition to the requirement for completing projects detailed within the Annual Audit Plan, a review has also been undertaken of the Grampian Valuation Joint Board. Internal Audit is required to provide annual assurances on the main Item 6. Page 13
Page 14
financial systems operated for payroll, payments and income from funding requisitions from the constituent authorities and other sources. The Joint Board’s systems align with those of the Council but require annual review and testing in order to provide assurances for the separate annual financial statements the Board is required to prepare and publish. It is pleasing to report that based on the audit work completed, reasonable assurance can be placed on the adequacy and effectiveness of the system of internal financial control established within the Assessor’s Service Audit Plan 2025/26 4.3 It is planned to shortly begin the preparation for the Annual Audit Plan for 2025/26. Internal Audit’s approach to annual audit planning is risk-based, with all areas subject to audit review contained within an ‘audit universe.’ The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems. 4.4 In accordance with the Public Sector Internal Audit Standards, it is the responsibility of the Audit and Risk Manager to prepare the Annual Audit Plan. However, consultation on projects for review will be undertaken with senior officers and members of the Audit and Scrutiny Committee. In addition, this will also provide the opportunity to remind officers of established timescales for responding to requests for information during an audit review and to the recommendations within the audit report. However, I do appreciate the significant workload demands on officers and will always try to accommodate any requests for timescale changes in reporting arrangements. Follow Up Reviews 4.5 Internal Audit reports are regularly presented to Elected Members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Refugee Integration Scheme 4.7 An audit has previously been undertaken to review the Refugee Integration Scheme. The scope of the audit was a review of the financial and administrative processes involved in delivering the Ukrainian Refugee Scheme. The emerging Asylum Dispersal, Afghan Citizens Resettlement Scheme and Afghan Relocation & Assistance Policy Scheme did not form part of the audit testing due to limited activity at the time of the review. The Council has supported approximately 140 Ukrainian displaced persons, with allocated funding from the Central Government in 2022/23 of over £1.9 million spread across the Warm Scottish Welcome Fund, Tariff per Displaced Person funding, Host Thank You Payment Funding and Educational Tariff Funding. All these funds have specific requirements and the audit has reviewed the accounting arrangements for administering these schemes and the claiming of expenditure. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 2. Building Services Stores 4.8 This follow up review checked the implementation of recommendations within the Building Services Stores audit report. The scope of the audit reviewed the systems and controls in managing materials and equipment (stock) stored to Page 14
Page 15
meet the repairs and maintenance requirements of Council housing. It was noted that individual stock items varied in value from a few pounds to upwards of £1,000. Materials and equipment with a cumulative value of approximately £700,000 are issued annually from Stores. A previous follow up review has been undertaken that required revised dates to be agreed for the implementation of some of the recommendations. However, it is now pleasing to report that all recommendations have been implemented. The Follow Up Report is given in Appendix 3. 5 SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: Page 15
Page 16
Page 16
Page 17
APPENDIX 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2024/25 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries. Audit programmed to start in the next quarter(s) Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations. Completed ICT Hardware Asset Management review of systems and practices to record / monitor the location and use of ICT hardware. Audit programmed to start in the next quarter(s) Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances. Year end stock valuations agreed OTHER SYSTEMS Area Type of coverage Housing and Property Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing). Audit programmed to start in the next quarter(s) Grant Claims Certification of grant claims as required: strategic timber; network support grant, regeneration schemes as appropriate Network Support Grant audit completed and claim submitted to Transport Item 6. Page 17
Page 18
Scotland for period- 1/4/23 to 30/09/2023 Housing Rent Collection & Arrears Management A review of the income collection and accounting arrangements for housing rents. Fieldwork in progress Moray Growth Deal An audit review of the governance and administrative procedures within the Council for the management of the Moray Growth Deal. The scope will include the concerning partnership working, financial management and measuring success. Fieldwork in progress Education – Secondary School Establishment visits as part of cyclical review. Audit programmed to start in the next quarter(s) Treasury Management To provide assurance that processes and controls are continuing to operate effectively for the Council's treasury management system. Audit programmed to start in the next quarter(s) Commercial Refuse Collection To consider whether adequate control is in place covering trade waste income and expenditure, that appropriate agreements and other paperwork is in place, and that accounting arrangements are robust. Completed Governance arrangements to prevent Fraud and Corruption Overview of the Councils governance arrangements to prevent fraud and corruption. The audit will use the Cipfa Code of practice on managing the risk of fraud and corruption as the basis in developing the audit programme for the review. Fieldwork in progress Page 18
Page 19
Education- Secondary School Premises Security Review the controls in place to mitigate the risk of unauthorised access to Secondary School Premises. Audit programmed to start in the next quarter(s) Absence Management An audit to consider the effectiveness of sickness absence monitoring and reporting. Audit programmed to start in the next quarter(s) Following the Public Pound To ensure that there is proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Completed Moray Integration Joint Board Residential Care An audit to review the adequacy of procedures and administrative arrangements regarding the third party suppliers appointed to provide care home services The audit will also include testing to verify the accuracy of the financial assessments and the charging for residential care of both respite and permanent care residents. Audit programmed to start in the next quarter(s) Out of area placement A review of the systems and procedures regarding adult services users that are out of area but responsibility remains to meet their eligible care and support needs under the Care Act. Fieldwork in progress Fostering and Kinship payments A review to ensure that the internal controls in place for administering Fostering and Kinship Care Allowances are operating effectively. Completed Page 19
Page 20
Follow Up reviews to be undertaken from previous Audit Assignments * Audit Review: Original Scope Status/ Comments Business Continuity The audit reviewed the Council's Business Continuity arrangements to confirm up to date policies, procedures and plans are regularly tested and reviewed, and that an appropriate level of awareness of Business Continuity is held throughout the organisation. Follow Up Review completed. Governance, Strategy and Performance Service Plan is now updated with a requirement for the Business Continuity and Risk Management Officer to monitor the progress by services to ensure business continuity arrangements are kept up to date. This work is an ongoing process and has regard to new risks and issues that have the potential to impact or disrupt service delivery. Self Directed Support (SDS) – Option 1 This audit remit was to review Option 1 Direct Payments under the SDS scheme, where a payment is made by the local authority directly to a supported person for the provision of support. The scope of the audit was to ensure compliance with operating guidelines in the financial management of SDS packages, expenditure incurred is in accordance with the agreed budget and support plans, and surplus funds are recovered from service users where appropriate. Follow Up Review programmed to start in the next quarter(s) Self Directed Support (SDS) – Option 2/3 The scope of the audit was to review systems and procedures in the delivery and management of adult social care provided under Options 2 and 3 of the SDS scheme. This included examination of the processes to support individuals in determining their preferred care delivery option, contractual relationships with care providers, financial management and monitoring of individual care packages. Follow Up Review programmed to start in the next quarter(s) Building Services - Planned Maintenance Projects An overview was undertaken of how the annual planned maintenance programme is determined and the contract management arrangements of Follow Up Review programmed to start in this quarter Page 20
Page 21
these projects by Building Services. The audit also involved a random selection of projects to verify costs can be evidenced to supporting documentation. Additional testing was also undertaken of the systems regarding the management and control of overtime paid to officers. Emergency Planning The objective of this audit was to provide assurance over the adequacy and effectiveness of current controls over emergency planning. The audit scope included a check to ensure adequate training, planning and testing has been developed in the event of an emergency. Follow Up Review programmed to start in the next quarter(s) Refugee Integration Scheme The scope of this audit involved a review systems and procedures to account for the relatively new and increasing source of funding for national humanitarian protection schemes. This audit has specifically covered the financial and administrative processes involved in the operation of the Ukrainian Refugee Scheme. Completed Building Services - Stores This audit scope reviewed the systems and controls in managing stock held within Building Services Stores. Testing involved a review of the stores software application called Servitor used for the recording and valuation of materials and equipment. Testing also included a check of the security arrangements to safeguard against unauthorised access to the storage areas. Completed Debtors The audit scope was to review the key operational controls within the Council's Debtors System. The audit checked the systems for raising invoices, collecting income, recording income and debt recovery arrangements. The audit review did not include the arrangements for recovering debts concerning council tax, non domestic rates, and housing rents. Follow Up Review programmed to start in the next quarter Domestic Refuse Collection The scope of this audit was to review systems and procedures to ensure the most effective and Follow Up Review programmed to start in the next quarter(s) Page 21
Page 22
efficient use is made of resources for the collection of domestic waste. The audit also checked the arrangements for disposing of recyclable waste. This included disposal of plastic, glass and biodegradable waste, in addition to paper / card, aluminium and steel cans for which the Council received regular payments from recycling contractors. Pool Cars Scheme The scope of this audit was to review systems and procedures in the management and use of pool cars. Policies and procedures were checked to ensure they provide appropriate operating guidance to officers in the booking and use of pool cars. The audit included a review of arrangements for internal recharging to services and also exploration if further use of pool cars could provide additional value for money opportunities to the Council. Follow Up Review programmed to start in the next quarter(s) Cyber Security The audit reviewed systems, practices and an assessment of the controls in place to protect the Council from a cyber-attack. The audit also reviewed Information, Communication and Technology (ICT) security policies and procedures to ensure they are regularly reviewed and promote best practices. The audit programme has been developed from the Scottish Government Cyber Resilience Framework and other good practice guidelines. Follow Up Review programmed to start in the next quarter(s) Moray Integrated Community Stores The audit reviewed the management of the Moray Integrated Community Stores. This included reviewing the procedures for ordering and issuing occupational therapy equipment to service users. In addition, a check was made to compare stock records to the actual equipment held within the Stores. Follow Up Review programmed to start in the next quarter(s) Forres Academy The audit reviewed the operation of the Devolved School Management Scheme regarding the allocation of funding and the management of Follow Up Review programmed to start in the next quarter(s) Page 22
Page 23
these funds at the school level. The review involved a study of the management of the significant staffing costs involved in delivering the curriculum, a review of procurement practices, an examination of the School's administration of income and also confirming accountability for School Fund monies. Email Security The audit checked the system controls and supporting policies and procedures used to administer the Council's email system. The audit also reviewed the arrangements for risk identification and actions undertaken to protect the Council from phishing emails. In addition, in response to a request from an elected member, the audit included a review of the password management controls for members access to the Council networks and systems. Follow Up Review programmed to start in the next quarter(s) Keith Sports & Community Centre The audit scope reviewed the processes and procedures in place at the Keith Sports and Community Centre and evaluate the effectiveness of internal controls relating to income and expenditure. This involved the sample testing of individual transactions to ensure compliance with Regulations and Guidelines. In addition, an appraisal of working practices was also undertaken to assess if the Service was maximising the income due to the Council Follow Up Review programmed to start in the next quarter(s) Environmental Services- Stores This audit reviewed the systems and controls in managing stock held within Environmental & Commercial Services Stores. The audit used the Chartered Institute of Public Finance Accountants audit programme to review the systems and controls in managing stock held within stores. Testing also included a review of the security arrangements to safeguard against unauthorised access to the storage areas Follow Up Review programmed to start in the next quarter Page 23
Page 24
Purchasing Cards The audit scope for this review was to assess the key controls and processes in place covering the usage of purchasing cards. The audit included a review of purchasing card guidelines and testing the controls operating over the key processes of purchase card applications, issue of cards, usage, authorisation and VAT accounting arrangements. Monitoring undertaken to ensure compliance with regulations, policies and procedures has also been undertaken, in addition to the reconciliation of purchasing card transactions detailed within the payment card system to the Council's Financial Management System Follow Up Review programmed to start in the next quarter * Additional follow up reviews may be reported depending on the implementation dates detailed by Services for recommendation Page 24
Page 25
APPENDIX 2 Moray Council Internal Audit Section DEPARTMENT: Economy, Environmental and Finance SUBJECT: Refugee Integration Scheme REPORT REF: 24'008 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Grant funding is effectively managed, monitored and applied for the intended purpose 5.01 A consolidation exercise should be undertaken to identify all expenditure and designate as costs being met from the available funding. A standard financial monitoring process should thereafter be put in place to ensure funding and its usage is High Yes 01/12/2023 Implemented. Significant analysis has been undertaken since the initial audit to identify all relevant costs of supporting refugee resettlement. A tailored funding monitoring report is prepared by Accountancy and issued to the Service on a monthly basis to allow effective budget management. Item 6. Page 25
Page 26
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation reported and effectively monitored by the service on a monthly basis. 5.02 Ongoing financial forecasting should be undertaken to allow more informed management decisions to be taken and ensure the full potential of the available funding is utilised. High Yes 01/12/2023 Implemented. Financial forecasting for 2024/25 and 2025/26 has been undertaken and is now embedded as part of the monthly financial monitoring process to quantify future commitments and inform service planning. 5.03 Improved consolidation of documentation regarding funding awards and related submissions requires to be undertaken to ensure the service holds the full complement of final version documents for clarity and completeness. Low Yes 01/11/2023 Implemented. All relevant documentation is now saved within the Section’s electronic folders and storage points. A greater degree of communication was also found between the Service and the Accountancy Section, with Accountancy now having an oversight role to validate financial information submitted for claims and aid reconciliations. Page 26
Page 27
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.04 In establishing the new Asylum, Refugee and Resettlement Section, the temporary employment contracts currently in place for team members should be reviewed and aligned consistently to funding terms. Low Yes 31/03/2024 Implemented. Employment contracts of the team have been reviewed and aligned since the initial audit. Furthermore, per reporting to the Moray Council on 22nd May 2024 (Item 11), a review of the current staffing requirements of the Refugee Resettlement Team is to be undertaken to determine necessary resourcing for anticipated future support, resettlement and integration activities with the intention of a further report to the Committee later in 2024. 5.05 Petty cash reimbursement claims submitted must be based on actual expenditure incurred and always reconcile to the authorised petty cash imprest for the section. Medium Yes 30/09/2023 Implemented. Since the agreement of the audit in August 2023, petty cash reimbursement claims submitted have been made from actual expenditure and supported by appropriate documentation. It was also noted that an adjustment to the authorised petty cash imprest amount was undertaken in Page 27
Page 28
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation November 2023, and petty cash claims now reconcile to the authorised imprest amount. 5.06 Expenditure incurred through the petty cash fund, other than the cash Welcome Payments, should comply with Council procedure of no single item exceeding £10. Alternative standard procurement routes should be used for any higher value purchases. Receipts for all expenditure incurred should be submitted with petty cash reimbursement claims to account for purchases and ensure input VAT is recovered where applicable. Medium Yes 01/12/2023 Implemented. Since the audit, petty cash has only been used for cash Welcome Payments. Purchasing cards are now used by the Service. 5.07 To improve the audit trail, the Low Implemented Implemented. The master record has been Page 28
Page 29
Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation master record of hosts and guests should be amended to ensure the date of arrival which is relevant to the initial host payment calculation is clearly recorded. Additionally, all payment calculations which relate to less than a full month of hosting should be checked to confirm accuracy prior to payment processing. amended as recommended to clarify the date of a guest's arrival with the host, from which payment will be made. A new process has also been implemented and documented for undertaking partial month calculations to ensure consistency in application and involves a check by two officers. 5.08 Welcome Hub costs sought for reimbursement by central government should be calculated based on actual expenditure incurred and require to be appropriately evidenced. Low Yes 31/10/2023 Implemented. No Welcome Hub costs have been incurred by the Authority since the initial audit. However, were this to be a feature of any future resettlement scheme, the Service is aware of the process to be followed and would involve the Accountancy Section in preparing any summary of costs to be invoiced for Page 29
Page 30
Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation reimbursement. Page 30
Page 31
APPENDIX 3 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Building Services - Stores REPORT REF: 22'019 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Review of the Building Services Stores to ensure effective controls are operating in the management and control of materials and equipment. 5.01 Building Services equipment and materials purchased as a direct order for specific schemes and stored at the Depot should be recorded within Servitor. Medium Yes 31/03/2023 Implemented. Testing has confirmed that items purchased for direct orders but stored within the Depot are now recorded on Servitor Item 6. Page 31
Page 32
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 Higher value items should be stored whether possible in alarmed storage areas. Medium Yes 31/05/2022 Implemented. The follow up review visit has confirmed that high value items are now stored within alarmed areas. 5.03 Officers should be reminded that greater care should be taken to record items received and issued within Servitor. Medium Yes 30/06/2022 Implemented. A barcoding system is now in place reducing the need to manually enter item numbers when receiving and issuing stock. 5.04 All materials and equipment recorded within Servitor should be updated with minimum and maximum stock levels. This should assist in the effective management of stock levels at the appropriate levels. Low Yes 31/03/2022 Revised Implementation date 30/06/2024 Implemented. Individual maximum and minimum stock levels have been assigned to all regularly issued stock items within the Servitor system. Regarding the slow moving stock, a standard minimum and maximum stock level has been established, which will be reviewed when re-ordering an item. 5.05 Contracts should be agreed with companies used regularly for the supply of goods and materials where Medium Yes 31/03/2023 Revised Implemented. Testing undertaken as part of the follow-up review has confirmed that the Service uses national frameworks or local Page 32
Page 33
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation annual expenditure exceeds the Quick Quote threshold of £5000. Implementation date 30/06/2024 contacts to purchase goods and services where cumulative expenditure to a supplier is in excess of £5,000. The Service is also reviewing on an ongoing basis all payments made to off-contract suppliers to determine whether there is a need for a more formal contractual relationship. Page 33
Page 34
Page 34
Page 35
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 11 SEPTEMBER 2024 SUBJECT: INTERNAL AUDIT REVIEW – PROCUREMENT AND CREDITOR PAYMENTS BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an internal audit review completed for the period from 25 June 2024 to 11 September 2024. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details the internal audit review completed of Procurement and Creditor Payments during the period 25 June 2024 to 11 September 2024: Procurement and Creditor Payments 3.2 Part of the annual audit plan is devoted to main financial systems, including creditor payments that cover non-payroll expenditure, i.e. payment for works, goods and services to suppliers or contractors. The purpose of the audit was to confirm ongoing compliance with Financial, Authorisation, Procurement and Creditor Payment Processing Regulations. 3.3 Testing was undertaken using a data analysis software application to extract a random sample of transactions for review. A check for duplicate payments was also carried out by extracting listings where more than one invoice from a single supplier had been paid for the same amount. Findings from the review noted issues concerning the need for improved clarification regarding the Budget Manager’s responsibilities in authorising expenditure and for the further development of the Authorisation Database. The audit report for this project is given in Appendix 1. Item 7. Page 35
Page 36
4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: Page 36
Page 37
APPENDIX 1 Internal Audit Report Procurement and Creditor Payments June 2024 Distribution: Chief Financial Officer Assistant FMS & Banking Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 0 Substantial Priority 2 2 Priority 3 0 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Contents Page Procurement and Creditor Payments 1. Introduction & Scope 3 2. Key Issues 4 Item 7. Page 37
Page 38
2 Detailed Report 3. Findings/Recommendations 5-6 4. Management Response 5-6 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility 1. Introduction and Audit Scope Page 38
Page 39
3 The Annual Audit Plan for the year 2024/25 provides for coverage of the Council’s core financial systems. A review of payments made to suppliers of goods and services has been undertaken. The purpose of the audit was to confirm compliance with Financial, Authorisation, Procurement and Creditor Payment Processing Regulations from the sample checked. This review is part of the annual continuous auditing activity of non-salary expenditure and will be used to support the Audit and Risk Manager’s annual opinion of the Council’s internal control system. Approximately £80 million was paid by the Council in the six months, October 2023 to March 2024, to suppliers of goods and services. Through the use of a data analysis software application, a random sample of individual payments with a collective total of £11.3 million was selected. The testing included a check to ensure invoices have been correctly authorised, coded and in compliance with regulations. The audit programme was developed from the Chartered Institute of Public Finance and Accountancy Systems Based Auditing Control Matrices and in consultation with the External Auditor. In addition, the data analysis software application was also used to select a sample of high-value invoices to test, and a check made of identical payment amounts made to the same supplier, which may indicate a potential duplicate payment. From the sample checked and within the scope of the review, no issues of significant concern were noted regarding the suppliers/ contractors used, sums paid, authorisation and accounting treatment. It is considered that appropriate controls are operating effectively, and the integrity of systems has been maintained. However, the review has found where further improvements are recommended to operating and administrative arrangements. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Page 39
Page 40
4 2. Key Issues • The Council Authorisation Policy details the management and operating requirements for officers to follow when committing expenditure on behalf of the Council. This Policy allows officers to be designated as Budget Managers with the operational responsibility of actively managing services. However, within the Policy, a provision is also made for a named officer to act as an ‘In Absence Authoriser’ to allow services to function effectively in the absence of the Budget Manager. Audit testing found where an ‘In Absence Authoriser’ had authorised the majority of invoices processed within a specific budget area, with examples of authorisation of individual transactions in excess of £100,000. The Authorisation Policy should be updated to clearly detail that a Budget Manager should initially authorise expenditure with an “In Absence Authoriser’ function only used on an exception basis. • This audit required reference to the Authorisation Database to evidence that the appropriate officer had authorised expenditure with budget management responsibility. The Authorisation Database is a standalone software application that requires significant manual updating of records by officers to remain operationally current. In addition, the Authorisation Database does not interface with the Financial Management System. The Authorisation Database is an important reference record to ensure the Council maintains effective budget management and monitoring arrangements. The Finance Development Team has recognised the limitations of the Authorisation Database, however software development has been restricted due to available staff resources. Page 40
Page 41
5 Procurement and Creditor Payments- 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. Medium Audit testing was undertaken on a random sample of payments to suppliers/ contractors to ensure that expenditure had been authorised in accordance with the Council’s Authorisation Policy. The Authorisation Policy provides for officers to be designated as Budget Managers with the authority to commit expenditure in the operational delivery of services. However, the Policy details a provision for a named officer to act as an ‘In Absence Authoriser’ to allow a service to function effectively in the absence of the Budget Manager. Audit testing noted where an ‘In Absence Authoriser’ had authorised the majority of invoices processed within a specific budget area, with examples of individual authorisation of individual transactions in excess of £100,000. The Authorisation Policy should be updated to provide greater clarity that the Budget Manager should initially make the authorisation of expenditure and an “In Absence Authoriser’ function only be used on an exception basis. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Financial Officer Yes 31/12/2024 This will be updated at the next review date. Last review date of the authorisation policy was Sept 23. Page 41
Page 42
6 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. Medium An Authorisation Database is maintained by Finance Services detailing the names and signatures of officers with budget management responsibility that can authorise expenditure within specific service areas. The Authorisation Database system is over 20 years old and requires significant manual administration to ensure it remains operationally up to date. In addition, the database does not interface with the Financial Management System. The Finance Development Team has recognised the limitations of the Authorisation Database, however development has been constrained due to available staff resources. Further development of the Authorisation Database should be undertaken to enable an interface with the Financial Management System and allow a more automated process for updating standing information. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Financial Officer Yes 31/12/2025 This is part of a wider authorisation review currently with the Finance Development Group. Interdependencies will be duly considered as part of this development. Page 42
Page 43
7 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 43
Page 44
8 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 44
Page 45
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 11 SEPTEMBER 2024 SUBJECT: INTERNAL AUDIT REVIEW – FOLLOWING THE PUBLIC POUND BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an internal audit review completed for the period from 25 June 2024 to 11 September 2024. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the internal audit review completed during the period 25 June 2024 to 11 September 2024 regarding the Council’s arrangements for Following the Public Pound: Following the Public Pound 3.2 A “Following the Public Pound” review has been undertaken to ensure proper accounting arrangements are in place by the Council to fund external bodies in the delivery of services. The scope of the audit did not include a review of the funding of small charitable donations or external bodies with whom the Council has entered into a contractual relationship. This audit has instead undertaken a review of the Council’s governance and funding arrangements regarding Moray Leisure Limited for the management of a leisure centre in Elgin and the Moray Citizens Advice Bureau for providing support and advice on a number of different topics, including benefits entitlement, housing, consumer issues, debt and money management. The audit programme has been developed from the Financial Regulations and recommended guidance on "Arm's Length External Organisations (ALEOs)”. Whilst Moray Citizens Advice Bureau is not specifically categorised as an ALEO, the Council has a significant funding Item 8. Page 45
Page 46
contribution and has therefore been included in this review. The audit report for this project is given in Appendix 1. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: Page 46
Page 47
APPENDIX 1 Internal Audit Report Following the Public Pound July 2024 Distribution: Head of Governance, Strategy & Performance Sport and Culture Service Manager Benefits and Money Advice Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 3 Substantial Priority 2 2 Priority 3 0 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Contents Page Following the Public Pound Item 8. Page 47
Page 48
2 1. Introduction & Scope 3 2. Key Issues 4 Detailed Report 3. Findings/Recommendations 5-13 4. Management Response 5-13 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility 1. Introduction and Audit Scope Page 48
Page 49
3 The Internal Audit Plan for 2024/25 provided for a “Following the Public Pound” review to ensure proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Councils fund Arms Length External Organisations (ALEOs) to provide important services to the public. These funding arrangements are often more complex than purchase contracts for goods or services but can bring both financial and operational benefits to councils. Audit Scotland describes an ALEO as an organisation that is ‘formally separate to the council but is subject to its control or influence.’ Ownership, provision of funding, and significant shareholdings in a company indicate significant control or influence, and therefore constitute an arm’s length relationship with an external organisation. A council is responsible for ensuring that Audit Scotland’s ‘Following the Public Pound’ principles are consistently applied by any ALEOs that it provides funding to and must ensure that ALEOs can demonstrate value for money. A ‘Code of Guidance on Funding External Public Bodies and Following the Public Pound’ was published by the Convention of Scottish Local Authorities (COSLA) and the Accounts Commission in 1996, detailing principles and requirements that should be considered when determining funding for ALEOs. This Code along with more recent publications from Audit Scotland including "Arm's length external organisations (ALEOs): are you getting it right?" (2011) and "Following the Public Pound" (2004 and 2005) was also considered in the development of the audit programme for this review. The audit scope did not include checking the procedures for small charitable donations or external bodies where the Council has entered into a contractual relationship. The audit has instead reviewed the arrangements in place with regard to Moray Leisure Limited for the operational management of a leisure centre in Elgin, and the Moray Citizens Advice Bureau for providing support and advice on a number of different topics, including benefits entitlement, housing, consumer issues, debt and money management. Whilst Moray Citizens Advice Bureau is not specifically categorised as an ALEO, the Council has a significant funding contribution and has been included in this review. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues Page 49
Page 50
4 • Moray Leisure Centre operated by Moray Leisure Limited, was established as an ALEO in 1993, and in addition to Council operated sports and community centres contribute to meeting the leisure and sporting needs of Moray. The audit noted that reviews have been undertaken over the last 10 years regarding the future delivery direction for leisure services. A Moray Sport and Leisure Asset Review report by the Depute Chief Executive (Education, Communities and Organisational Development) to the Moray Council Committee on 26 June 2024 (item 12) agreed to procure a company called Alliance Leisure to conduct a comprehensive leisure assets review for Moray. The purpose of this review is to establish an evidence base to guide future strategic planning, investment decisions and management practices concerning leisure assets, including Moray Leisure Centre. The audit notes and concurs with the recommendations for a report to “be presented back to Council within 6 months detailing the findings of the asset review”. • In accordance with recommended guidance and the Council’s Financial Regulations, there should be a written agreement between the Council and an externally funded body. It was noted that written agreements in the form of Service Level Agreements (SLAs) had previously existed between the Moray Council and Moray Leisure Ltd and Moray Citizens Advice Bureau (CAB) but had expired in 2018 and 2019, respectively. An SLA will provide a contractual relationship detailing expectations in service delivery, funding requirements and performance monitoring reporting to evidence how these Organisations contribute to meeting the Council's strategic plans. • A requirement of the Moray Leisure Limited’ Articles of Association is to appoint 3 elected members as directors on the Board. Moray Citizens Advice Bureau requests that 2 elected members attend Board meetings in an advisory capacity. As part of this audit review, discussions were held with the elected members on both Boards to ensure there was a clear understanding of the roles and possible limitations of their duties. Feedback from elected members noted a need for further guidance to clarify expectations and possible parameters in responsibilities as elected members representing the Council within the Boards of these Organisations. Page 50
Page 51
5 Following the Public Pound - 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. High As detailed within the Financial Regulations, the Council has adopted the principles of the COSLA / Accounts Commission's ‘Code of Guidance on Funding External Bodies and Following the Public Pound’. The Code sets out a framework for the Council’s relationships with external bodies through which they seek to carry out some of their functions other than on a straight-forward contractual basis. In accordance with the “Code”, and as detailed within the Financial Regulations, there is a requirement for a written agreement between the Council and the external bodies. It was noted that written agreements in the form of Service Level Agreements (SLAs) had been established between the Moray Council and Moray Leisure Ltd and the Moray Citizens Advice Bureau. However, the SLAs expired in 2018 and 2019 respectively. An SLA provides a formal agreement that describes the scope and quality of services to be delivered by the external bodies. In addition, the SLAs should also detail the performance information to be provided by both Organisations that will allow effective monitoring arrangements to ensure Council objectives are met and Best Value achieved. Service Level Agreements should be agreed between the Council and the Moray Leisure Ltd and Moray Citizens Advice Bureau detailing the core activities that each Organisation is expected to deliver along with key performance indicators against which they will be measured. Management Response Page 51
Page 52
6 Responsible Officer(s) Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Sport and Culture Service Manager Benefits and Money Advice Manager Yes Yes 31/12/2024 31/12/2024 A new draft Service Level Agreement was collectively drafted between Management staff across Moray Council and Moray Leisure Centre in mid 2021 – this agreement was not formally signed/sanctioned at the time due to the future expansion plans, which was highlighted in the Committee reports on the MLC expansion plans. This draft agreement will be reviewed and updated by the Management teams of both organisations with input from legal advisers prior to sign-off. A review of the Service Level Agreement with Moray Citizens Advice Bureau is currently underway and a draft will be reported to the relevant committee prior to completion. Page 52
Page 53
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. High The Moray Council entered into a 25 year lease in 1993 with Moray Leisure Ltd to operate a leisure centre from a Council owned building. The lease was extended by two, one-year extensions until July 2020. A report by the Depute Chief Executive (Education, Communities and Organisational Development) to a special meeting of Moray Council on 17 December 2019, approved a 10 year extension to the existing lease agreement. An extended lease agreement would provide Moray Leisure Ltd with additional security and greater value for money opportunities for leasing equipment and supporting better negotiation opportunities for improved energy deals. A new draft agreement has been prepared in draft format but has yet to be finalised. Currently, Moray Leisure Ltd operates on a monthly contractual agreement with the Council. It is appreciated that necessary delays have been required due to consideration and amendments needed regarding the proposed expansion scheme of the leisure centre. The audit is also aware of uncertainties regarding this proposed expansion scheme, in addition to the recent commissioning of a company called Alliance Leisure to undertake a comprehensive leisure assets review for Moray. However, there is a need to formalise current arrangements with an agreed lease agreement Current uncertainties regarding expansion and the delivery of future leisure services are appreciated, however a lease agreement between the Council and Moray Leisure Ltd should be agreed as a matter of priority. Page 53
Page 54
8 between the Council and Moray Leisure Ltd. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Governance, Strategy & Performance Yes 31/12/2024 The Council’s legal advisers will co-ordinate with the agents of Moray Leisure Limited to support the completion of a lease agreement within the specified timescale. Page 54
Page 55
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3. High During the course of this audit, a Moray Sport and Leisure Asset Review report by the Depute Chief Executive (Education, Communities & Organisational Development) to the Moray Council Committee on 26 June 2024 (item 12) agreed to procure a company called Alliance Leisure to undertake a comprehensive leisure assets review for Moray. The purpose is to establish an evidence base to guide future strategic planning, investment decisions and management practices concerning leisure assets, including Moray Leisure Centre. It was noted that over the last 10 years, other reviews have been undertaken to explore future delivery options for leisure services. The internal audit undertaken agrees with the committee report recommendation to detail the findings of the asset review to the Council within the next 6 months. Internal Audit concurs with the recommendation detailed within the Moray Sport & Leisure Asset Review Report to Moray Council Committee on 26 June 2024 (item 12) that on conclusion of the external review, findings should be used “to provide further evidence base that will contribute to the design of our future leisure estate”. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Sport and Culture Service Manager Yes 31/12/2024 As stated in the Committee report in June, a report will be taken back to Committee before end of Dec 24 detailing the findings of the Alliance Leisure Review alongside other future service design evidence. Page 55
Page 56
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4. Medium In accordance with Financial Regulations, the Council has a requirement for funding external organisations to establish “reporting and monitoring arrangements to ensure Council objectives are met and Best Value achieved”. It is pleasing to note that performance related information is shared with the Council by both Moray Leisure Limited and Moray Citizens Advice Bureau on a regular basis. However, no structured monitoring systems have been established to measure the performance information provided against agreed objectives. Governance arrangements also do not include a requirement of how the performance of each Organisation contributes to Council objectives, which a relevant committee could then scrutinise. Consideration should be given to establishing clear objectives supported by tailored performance indicators that are agreed with Moray Leisure Limited and Moray Citizens Advice Bureau each year. The Council should then monitor performance information provided by each Organisation against these agreed objectives and if necessary, report it to the appropriate committee for scrutiny. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Sport and Culture Service Manager Yes 30/04/2025 Footfall statistics for Moray Leisure Centre are reported as part of the Council’s Service Performance reporting however appreciate these do not align to clear objectives. Intention is to report annually on performance as per performance targets set in the new Service Level Page 56
Page 57
11 Benefits and Money Advice Manager Yes 30/04/2025 Agreement. A report will be presented to Education, Children’s and Leisure Services Committee between April-June annually which will focus on performance measures/achievement based on the previous financial year. Relevant performance objectives and performance reviews will be included in the updated SLA for the Moray Citizens Advice Bureau and will be monitored and reported as appropriate. Page 57
Page 58
12 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5. Medium It was noted that a requirement of Moray Leisure Limited’ Articles of Association is for the appointment of 3 elected members as directors on the Board. Moray Citizens Advice Bureau requests that 2 elected members attend Board meetings in an advisory capacity. Elected members sitting as board members can provide important links between the Council and the funded bodies and help ensure that the organisations are being properly run and funds used effectively. However, there are disadvantages, with Audit Scotland highlighting the risk of potential conflicts of interest for elected members. As part of this audit review discussions were held with elected members representing the Council on the Boards of Moray Leisure Limited and the Moray Citizens Advice Bureau. Feedback from the elected members noted a need for improved guidance to further clarify their roles, responsibilities and parameters in their duties as elected members representing the Council on the Board of each Organisation. Further to discussions with the Head of Governance Strategy & Performance, the Council should consider and confirm whether to accept the reputational risks associated with perceived conflicts of interest where elected members sit on the boards of funded external bodies. If it is considered to continue with the current arrangement, additional guidance should be provided to elected members to further clarify the roles, duties and parameters of their responsibilities as elected members representing the Council on the board of funded external bodies. Management Response Page 58
Page 59
13 Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Governance, Strategy & Performance Yes 31/10/2024 Consideration will be given to the perceived risks associated with appointments to outside bodies. Guidance will be refreshed and agreed by the council as appropriate following this consideration. Page 59
Page 60
14 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 60
Page 61
15 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 61
Page 62
Page 62
Page 63
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 11 SEPTEMBER 2024 SUBJECT: INTERNAL AUDIT REVIEW – COMMERCIAL REFUSE COLLECTION BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an internal audit review completed for the period from 25 June 2024 to 11 September 2024. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details the internal audit review completed of Commercial Refuse Collection during the period 25 June 2024 to 11 September 2024: Commercial Refuse Collection 3.2 An audit has been undertaken to review systems and controls in managing the Commercial Refuse Collection Service. The audit examined the accounting arrangements for commercial trade waste income and expenditure. This included a check that mandatory trade waste agreements are in place for all commercial waste customers. Findings from the audit noted a need to review charges for collecting and disposing of commercial waste to reflect current operational arrangements. In addition, some improvements were also needed to administrative systems, but it is pleasing to report that no fundamental control weaknesses were noted. The audit report for this project is given in Appendix 1. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan Item 9. Page 63
Page 64
(LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: Page 64
Page 65
APPENDIX 1 1 Internal Audit Report Commercial Refuse Collection August 2024 Distribution: Head of Environmental & Commercial Services Service Manager Waste Manager Administration Officer The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 0 Substantial Priority 2 6 Priority 3 4 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Item 9. Page 65
Page 66
APPENDIX 1 2 Contents Page Commercial Refuse Collection 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-14 4. Management Response 5-14 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 66
Page 67
APPENDIX 1 3 1. Introduction and Audit Scope The annual Internal Audit Plan for the 2024/25 year provides for a review to be undertaken of the controls in the management of the Commercial Refuse Collection Service. The audit checked to ensure robust accounting arrangements are followed, and appropriate agreements are in place with customers. The Waste (Scotland) Regulations 2012 require all businesses producing waste to appoint a registered carrier for disposing of their waste. The Moray Council, as a Professional Collector & Transporter of Waste, collects commercial residual and recycling waste for approximately 1,200 businesses. Analysis of the Financial Management System for 2023/24 detailed the operational cost for delivering a commercial refuse collection service amounted to £725,000, with staffing and vehicle costs as the most significant expenditure items. The annual income collected from commercial waste collection was noted as £922,000. The scope of the audit reviewed the accounting arrangements for commercial (trade) waste income and expenditure and the associated administrative processes. This involved a review of the operational planning and budget monitoring practices and checking the main cost elements of staffing and vehicle expenditure for delivering the service. The income charging and collection arrangements were also reviewed as part of the audit. In addition, a check was made that mandatory trade waste agreements are in place for all commercial waste customers of the service. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • The audit found no full service costing analysis has been undertaken in the last 5 years. A review should be undertaken to ensure the charges for collecting and disposing of trade waste continue to reflect current operational arrangements. In addition, the review will also provide increased effectiveness in budget monitoring and forecasting processes. • A discrepancy was noted in the current trade waste charges whereby the Council approved a 10% administration fee to be added to charges for collecting trade waste from businesses under sub-contracting arrangements to national waste contractors with customers but no physical presence in Moray. The administration fee was introduced for 2024/25; however, the audit found that the fee has not been applied to the charges made to businesses. Page 67
Page 68
APPENDIX 1 4 • The Waste (Scotland) Regulations 2012 requires a duty of care on all business waste producers to have a formal Trade Waste Agreement. Trade Waste Agreements are sent to customers by post, on initial customer engagement and thereafter, on an annual basis, for each business to agree on and confirm the continuation of the service. This is a time-consuming paper-based system; consideration should therefore be given to the development of an electronic method to issue Trade Waste Agreements to businesses and receive return submissions. Page 68
Page 69
APPENDIX 1 5 Commercial Waste Collection- 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. Low Scottish local authorities have a statutory requisite to provide domestic waste collection services, but there is no requirement to deliver a waste collection service to the commercial sector. The Council's duty concerning trade waste is to provide information and advice to businesses. It was noted that a Commercial Waste Information Guide has been prepared and is available to businesses on the Council website. However, it was compiled in 2014 and some of the information recorded is out of date. Council website content relating to the Commercial Waste Service should be reviewed on a regular basis to confirm continued validity, with updates undertaken of any relevant areas of change. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/10/2024 Review of all online content to be undertaken and any required updates actioned. Page 69
Page 70
APPENDIX 1 6 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. Medium The audit review found a significant variance between the actual income collected and the budget for several financial years. This has been due to a number of reasons, such as declining trade since the Covid period and a greater awareness of recycling resulting in a reduction in waste to be collected, in conjunction with budget provisions not being wholly realigned to current market factors. However, it was noted that the information available on trade waste contracts with customers is not being used to inform the income budget figure. Consideration should be given to the use of the trade waste sales contract data held to inform income projections and align future budget provisions for improved management information purposes. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/03/2025 Implementation of this recommendation is interlinked with the service costing and charging review referred to at Recommendation 7 below. Budget provisions will be reassessed with Accountancy support following the Council charges review for 2025/26. Page 70
Page 71
APPENDIX 1 7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3. Low Analysis of the staffing costs charged to the Waste Management Service was found to be correct. However, it was noted that some employee costs for the Commercial Refuse Collection Service should have been charged to the Domestic Refuse Service. In order to allow a more precise analysis of actual expenditure, costs should be accurately recorded against the different operational waste sectors. Employees identified as misallocated to the Commercial Refuse Collection Service should be reassigned to the correct cost centre. Going forward, staffing cost breakdowns and establishment listings received by the service should be scrutinised to ensure staffing allocations within the service remain accurate. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/10/2024 Whilst the overall numbers of staff being charged were correct it is agreed there were some budget charging discrepancies with regard to who was allocated under Trade Waste. Going forward, staffing adjustments will be correctly coded. Page 71
Page 72
APPENDIX 1 8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4. Low The Commercial Refuse Collection Service is internally recharged by Fleet Services to hire vehicles used in service delivery. Audit testing to confirm the accuracy of the vehicle costs recharged to the Commercial Refuse Collection Service found that other waste services are using some vehicles, and correspondingly costs for some vehicles used by the Commercial Refuse Collection Service are being charged to the Recycling and Domestic Waste Collection cost centres. A review should be undertaken of vehicle costs recharged to the Waste Management Service to ensure vehicle recharges are allocated to the correct cost centres. Any budget realignment required as a result of vehicle reassignment should also be undertaken. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/10/2024 Similar to Recommendation 3 above, the correct number of vehicles are being charged under Trade Waste but there are discrepancies over vehicle usage between Waste sectors which require adjustment. Page 72
Page 73
APPENDIX 1 9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5. Medium The Waste (Scotland) Regulations 2012 requires a duty of care on all business waste producers to have a formal trade waste agreement to transfer their waste in the required manner. Businesses requesting the Council to collect their trade waste must sign a Trade Waste Agreement. Thereafter, a business is also required to sign an annual Trade Waste Agreement to confirm the continuation of the service. All Trade Waste Agreements are sent to customers by post. Documents are returned to the Council using email and post, depending on customer choice. Audit testing found that a significant proportion of existing customers do not return their annual Agreements despite being issued a reminder. Consideration should be given to the development of E-forms for Trade Waste Agreements to enable a more automated approach to businesses and also provide value for money savings to the Council. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 01/04/2025 It is agreed there should be an assessment of options undertaken to work smarter in this area. Consideration will be given as to the impacts of mandatory Digital Waste Tracking to be introduced from April 2025. Page 73
Page 74
APPENDIX 1 10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6. Medium The Council’s Trade Waste Agreement allows for a 28- day notification period for a business or the Council to cancel a commercial waste collection service. As businesses are billed in advance, refunds are frequently required on cessation of the service. The Conditions of Service permit a nominal charge to cover the administrative costs of cancelling the service when processing a refund. However, the audit found there has been no charge to businesses cancelling their Trade Waste Agreement. Consideration should be given to the application of the Trade Waste Agreement cancellation charge on processing a refund, as stated in the Conditions of Service. If the service decides to retain this charge, the decided fee should be included within the annual approval of the Council’s fees and charges. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 30/11/2024 The administration charge for contract cancellation should be applied. A view will need to be taken on an appropriate fee and included in the review of annual fees for Council approval in November 2024 ahead of implementation from April 2025. Page 74
Page 75
APPENDIX 1 11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 7. Medium Commercial waste charges were subject to a price freeze for the financial years 2019/20 to 2022/23, but a price increase has been applied to 2023/24 and 2024/25. Before the commencement of the price freeze in 2019/20 a comprehensive costing exercise was undertaken, however this has not been repeated to evidence that current charges for commercial waste services are based on the current operational model. A full-service costing analysis should be undertaken to determine the appropriate charges required for current operations. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 30/11/2024 Charges need to be reviewed, particularly to account for the recent change in disposal to Energy from Waste (EfW) as opposed to landfill. This action has previously been noted by the service and discussed with Accountancy. Page 75
Page 76
APPENDIX 1 12 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 8. Low The Council provides a free waste collection service to registered charities with a set size and number of bins to be collected on a 3-weekly basis. Where the charity requests larger/ additional bins or more frequent collections, an additional charge should be levied. Audit testing has confirmed that where additional or larger sized bins have been requested, the charity has been correctly charged. However, where more frequent collections of the free issue bins are required, the charity has not been charged for this additional service. A review of charitable trade waste customers should be undertaken to ensure all services provided in excess of the free allowable provision are appropriately charged in accordance with service conditions. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 30/10/2024 A review of charitable trade waste customers had previously begun but initial issues identified and staffing shortages have delayed progress. The exercise will be resumed when staffing resources return to full complement. Page 76
Page 77
APPENDIX 1 13 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 9. Medium It was noted that for 24/25, the Council approved the addition of a 10% administration fee for sub- contracting services to collect commercial waste from businesses that are part of a national waste contract where the contractor does not have presence in Moray. The audit review noted that from analysis of the sales ledger of invoices issued from April 2024, the 10% administration fee was not applied. For 2024/25, administration fees should be charged to businesses where the Council collects trade waste as a sub-contractor to a national waste contract. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes Implemented This has been addressed on audit notification. Necessary changes have been made to incorporate the 10% administration fee to charges to customers under sub- contracted agreements. Page 77
Page 78
APPENDIX 1 14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 10. Medium A review of commercial waste invoices issued to businesses found low levels of unpaid debt. However, audit testing has identified examples that despite following agreed Sundry Debt Management Procedures, debt has accumulated over a prolonged period of over 6 months, and in some cases over multiple years, before the action to cease service provision has been taken. Consideration should be given to establishing set debt management parameters of financial limits and / or time periods for the cessation of a commercial waste collection service when charges remain unpaid by a business. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 30/10/2024 This process has been discussed following an earlier review at service level. The approach to debtors to date has been to manage through payment plans whilst retaining customers. However, a strengthening of approach is accepted as required and the process to be followed, and its accompanying documentation, is being developed. Page 78
Page 79
APPENDIX 1 15 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 79
Page 80
APPENDIX 1 16 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 80
Page 81
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 11 SEPTEMBER 2024 SUBJECT: PUBLIC SECTOR INTERNAL AUDIT STANDARDS- EXTERNAL QUALITY ASSESSMENT OF INTERNAL AUDIT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 To provide the committee with details of a recent external quality assessment undertaken on the council’s internal audit service. 1.2 This report is submitted to Committee in terms of Section III (I) (6) of the Council’s Scheme of Administration relating to the consideration of reports in overseeing the independence, objectivity, performance and conformance to professional standards of Internal Audit. 2. RECOMMENDATION 2.1 That Committee considers and notes the report and the action plan prepared to address the issues raised in the external quality assessment of internal audit. 3. BACKGROUND 3.1 The Local Authority Accounts (Scotland) Regulations 2014 at paragraph 7 require that ‘a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing’. 3.2 The recognised standards adopted by all Scottish councils are the Public Sector Internal Audit Standards, (PSIAS) developed by standard setters including the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Chartered Institute of Internal Auditors. The standards include a requirement for an External Quality Assessment (EQA) of internal audit once every five years, and for the findings to be considered at a meeting of a Council committee. Item 10. Page 81
Page 82
3.3 Through the Scottish Local Authorities Chief Internal Auditors’ Group which the Council participates in, it was agreed that the EQA requirement could be met through a peer review process. This required each council’s chief internal auditor to lead a review of another council’s internal audit service and receive a review in return. Perth and Kinross Council was selected to undertake the assessment of Moray Council. 3.4 The assessment took place in March 2024 and involved the Chief Internal Auditor of Perth and Kinross Council reviewing operating arrangements within Moray against PSIAS. This involved verification of a portfolio of evidence, interviews with the Chair of the Audit and Scrutiny Committee, the Chief Executive, and the Head of Governance, Strategy & Performance, as well as discussions and file reviews involving officers within the Internal Audit Section. A copy of the report detailing the audit findings together with an action plan containing recommendations is provided as Appendix 1. 3.5 The overall conclusion of the external assessment is that Moray Council’s Internal Audit Service fully conforms with the PSIAS, which can be found in section 2.1 of the attached report. This should assure members and senior management of the effectiveness of internal audit arrangements within the Council. However, the report includes a recommendation to reinforce the Internal Audit’s function as an “independent appraisal function” for the Council and partner organisations. As part of the PSIAS requirements, an annual internal quality assessment is required. The Senior Auditor will undertake this, and the findings and any improvement recommendations will be reported to the Audit and Scrutiny Committee to ensure continuing compliance with PSIAS. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. . (f) Property Page 82
Page 83
No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an external quality assessment of the Council’s Internal Audit Service. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: Page 83
Page 84
Page 84
Page 85
Item 10. Page 85
Page 86
Page 86
Page 87
Page 87
Page 88
Page 88
Page 89
Page 89
Page 90
Page 90
Page 91
Page 91
Page 92
Page 92
Page 93
Page 93
Page 94
Page 94
Page 95
Page 95
Page 96
Page 96
Page 97
Page 97
Page 98
Page 98
Page 99
Page 99
Page 100
Page 100
Page 101
Page 101
Page 102
Page 102
Page 103
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 11 SEPTEMBER 2024 SUBJECT: CAREFIRST REPLACEMENT – PROGRESS UPDATE BY: INTERIM HEAD OF SERVICE & CHIEF SOCIAL WORK OFFICER 1. REASON FOR REPORT 1.1 To inform the Committee of the progress of the replacement Social Work and social care management information system and the outline business case. 1.2 This report is submitted to the Committee in terms of Section III (I)(11) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and supporting the Council’s governance, risk and control arrangements by promoting internal controls and assurances. 2. RECOMMENDATION 2.1 Committee are asked to consider the contents of this report, seek clarification on any points and otherwise note the report. 3. BACKGROUND 3.1 CareFirst system is the principal management information system for adult, children and families and justice social work and social care services. CareFirst5 was implemented in 1998 and upgraded to CareFirst 6 in 2010. The last upgrade took place in 2017. 3.2 A report was submitted to this committee on 23 November 2022 (para 7 of minute refers), and Moray Integration Joint Board (MIJB) Audit, Performance and Risk Committee on 24 November 2022 (para 7 of minute refers), providing an update on Internal Audit Completed Projects and reference to a review of the CareFirst System undertaken that recommended replacement of CareFirst . 3.3 A report was submitted to the MIJB on 25 January 2024 (para 12 of minute refers) where approval was given to initiate the process to begin scoping a replacement system and subsequently the current contract was extended for a further year to 31 March 2025. Item 11. Page 103
Page 104
3.4 A follow up review was undertaken by Internal Audit and reported to this committee on 14 February 2024 (para 6 of minute refers) where it was requested a progress report be provided to this committee at 6 months. 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 A project manager was allocated in March 2024 to progress the project mandate and outline business case. 4.2 A project mandate was prepared incorporating risks outlined in previous reports to this committee and MIJB. The project mandate was presented to the ICT Gateway Review meeting on 28 May 2024. They were wholly supportive of the proposal to replace the system because of the risks of operating a legacy system, however they would need further information regarding funding and resource requirements and requested to see the Outline Business Case (OBC) when completed. ICT resource will be provided to support specification and option appraisals for inclusion in the OBC. 4.3 The mandate was then presented to the Asset Management Working Group (AMWG) on 12 June 2024 where it was noted that there was no current budget allocation and there will be options for the replacement that affect the funding. If a server based solution is chosen, the spend will be capital and through Moray Council, if a cloud based system, then the spend is revenue and will be a pressure for MIJB. It was also noted that Health and Social Care Moray (HSCM) was aware of the resourcing pressures on the Procurement team so there was no additional capacity for this project and there would be a need to reprioritise existing support provision. AMWG also determined that the project should be classed as strategic and should proceed to the outline business case. 4.4 The project mandate was presented to MIJB on 27 June 2024 (para 10 of minute refers) and it was noted that project resourcing would be from existing staff complement and the project was to progress to OBC to the MIJB in September 2024. 4.5 All of the governance meetings have agreed with the need to change the system however it is confirmed that there are no additional funding streams identified for the replacement and that it was estimated likely costs would be in excess of £800k. Given the current financial situation of Moray Council and MIJB this is a significant challenge. 4.6 The current provider has created a new cloud-based product and experience dictates that they will, in the next 3-5 years, discontinue support for the existing system and push customers towards their new product. It is expected that from the award of a tender, the new system takes 18 months to 2 years to migrate to the new product because of the size, complexity and involvement of extremely sensitive and critical data types. 4.7 The technology of the platform is over 20 years old and the software was written years ago, there are no upgrades so no potential for development. This system no longer supports efficient and effective working hence the urgency to progress implementation of a replacement. There was a failure in one of the servers on 11 July 2024 resulting in downtime for all social work and social care Page 104
Page 105
teams of 5 hours during which it was not possible to access any information. Services have business continuity arrangements in place, however, considering the increasing likelihood of potential disruption, arrangements are being reviewed to ensure they are as robust as possible. 4.8 Work has continued at a slower pace to develop a detailed specification, to proceed to options appraisal due to competing pressures for HSCM project resource. A resource has now been identified and the project will move forward with a revised timeline to be presented to MIJB in September 2024 to ensure appropriate governance routes are followed. This delay means the anticipated budgetary pressure will occur during 2025/26. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Partners in Care 2022 – 2032” Providing staff with effective tools to provide the right support and the right time in the right place is essential for meeting people’s outcomes, the fundamental aim of the strategic plan. (b) Policy and Legal There are no legal implications arising from this report. (c) Financial implications The only budget currently allocated is the current revenue costs for support and as yet no additional provision has been made in MIJB or Council budgets. Future recommendations regarding budgetary provision would require to be backed up initially by an outline business case and following Council’s protocols. It is intended to utilise existing staff resource to progress the project to Outline Business Case. (d) Risk Implications and Mitigation The audit review noted serious concerns regarding the limitations of the CareFirst system with information regarding social care users needing to be retained on a Council server or in paper files. In addition, issues were also noted regarding access and information management controls within CareFirst. The Council’s Audit and Risk Manager and Chief Internal Auditor of the Moray Integration Joint Board is very concerned about the current recording arrangements of very sensitive information, the risk of maintaining multiple databases, and the CareFirst System not being supported. There is an urgent need to agree on a future direction of how social care information should be recorded that will allow officers to effectively manage the needs of social care users in accordance with policies/regulations while still ensuring strong information management controls are maintained. To continue with the existing system is a significant risk to service delivery. • Continuing to operate on a legacy system presents likely risks of non- compliance with changes to legislation and regulation and provides no Page 105
Page 106
opportunity to develop working practices to reflect improvements and good practice. • There is an increased risk of lack of data security as the system is not updated with protection against new cyber threats. • There are risks to efficient and effective working practices e.g. the system does not support uploading of documents, requiring records to be held in alternative storage solutions which impacts negatively on time to search for information. Without the system, staff would have to resort to using paper-based records. • The reporting solution of the existing system does not support provision of robust performance information on which to base decisions. There is a risk to the MIJB budget in that no funding is currently identified so costs will have to be incorporated, therefore requiring potential additional savings to be identified. If the project is not resourced sufficiently there is a risk, it will not deliver the anticipated efficiencies and will not improve staff morale. The proposed governance arrangements through identified resource requirements would enable assurance and oversight of delivery of the project. (e) Staffing Implications Internal secondment within HSCM will provide project resource. There will also be significant input required from project team members and from other staff across services who will be involved in process mapping to streamline ways of working before introduction of a new system. It is anticipated that if the OBC is approved, additional ICT resource will be required. (f) Property There are no property implications arising from this report. (g) Equalities/Socio Economic Impact There are no equalities implications arising from this report. (h) Climate Change and Biodiversity Impacts There are no climate change implications arising from this report. (i) Consultations Interim Chief Officer; Chief Financial Officer, HSCM; Chief Financial Officer (Moray Council), Head of Human Resources, ICT & Organisational Development; Chief Internal Auditor, MIJB and Caroline O’Connor, Committee Services Officer, Moray Council. 6. CONCLUSION 6.1 This report provides an update on progress with scoping and outline business case regarding the requirements for a replacement information and case management system for Social Work and Social Care services in HSCM. Page 106
Page 107
Author of Report: Jeanette Netherwood Background Papers: CareFirst Replacement, Moray Integration Joint Board 27 June 2024 CareFirst Replacement - Appendix 1 CareFirst Replacement - Appendix 2 CareFirst Replacement - Appendix 3 Internal Audit Section Update Report, Audit and Scrutiny Committee 14 February 2024 Internal Audit Section Update Report - Appendix 1 Internal Audit Section Update Report - Appendix 2 Internal Audit Section Update Report - Appendix 3 Internal Audit Section Update Report - Appendix 4 Internal Audit Section Update Report - Appendix 5 Internal Audit Section Update Report - Appendix 6 CareFirst Replacement, Moray Integration Joint Board 25 January 2024 Internal Audit Section – Completed Projects Report, 24 November 2022 Internal Audit Section Completed Projects Report – Appendix 1 Internal Audit Section Completed Projects Report – Appendix 2 Ref: SPMAN-305227695-146 Page 107
Page 108
Page 108