Agenda Document Pack - Audit and Scrutiny Committee - 20/11/2024
Moray Council · 20 November 2024
Back to Audit and Scrutiny Committee — 20 November 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 20 November 2024 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 20 November 2024 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minutes of meeting of 11 September 2024 5 - 12 4. Written Questions ** 5. Internal Audit Section Update Report Report by Audit and Risk Manager 13 - 44 6. Internal Audit Review - Fostering and Kinship Care Payments Report by Audit and Risk Manager 45 - 56 7. Internal Audit Review - Governance Arrangements to Prevent Fraud and Corruption Report by Audit and Risk Manager 57 - 72 8. Internal Audit Review - Moray Growth Deal Report by Audit and Risk Manager 73 - 88 9. Internal Audit Charter Report by Audit and Risk Manager 89 - 100 Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Watching the Meeting You can watch the webcast live by going to: http://www.moray.gov.uk/moray_standard/page_43661.html Webcasts are available to view for 1 year following the meeting. You can also attend the meeting in person, if you wish to do so, please come to the High Street entrance door and a member of staff will be let into the building. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be published on the Council’s committee management system by 4pm the day before the meeting. The Member who has put the question may, after the answer has been published, ask one supplementary question directly related to the subject matter at the meeting, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Scott Lawrence (Chair) Councillor Theresa Coull (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor John Divers (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Elaine Kirby (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor Shona Morrison (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 11 September 2024 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Councillor Peter Bloomfield, Councillor Theresa Coull, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Scott Lawrence, Councillor Marc Macrae, Councillor Neil McLennan, Councillor John Stuart, Ms Margaret Wilson APOLOGIES Mr Ivan Augustus, Councillor Shona Morrison IN ATTENDANCE Interim Chief Executive; Depute Chief Executive (Education, Communities and Organisational Development); Head of Governance, Strategy and Performance; Audit and Risk Manager; Head of Financial Services; Service Manager - Strategic Commissioning; Interim Chief Social Work Officer and Head of Service; Lizette Van Zyl, Service Manager; Head of ICT, Human Resources and Organisational Development; ICT Team Leader/Information Security Officer and Caroline O'Connor, Committee Services Officer, all Moray Council and Angela Pieri, Grant Thornton - External Auditors. 1. Chair Following the resignation of the previous Chair, Councillor Leadbitter and in terms of Standing Order 6(a), the Interim Chief Executive called on Members of the Committee to choose a Member to preside. Councillor Macrae, seconded by Councillor Divers, moved to nominate Councillor Lawrence. There being noone otherwise minded, the meeting unanimously agreed to appoint Councillor Lawrence as Chair to preside at today's meeting. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. With regard to Item 6 "Internal Audit Section Update Report", Councillor Gatt stated, for transparency, that he is Convener of the Grampian Valuation Joint Board and would be taking part in the debate. Item 3. Page 5
Page 6
With regard to Item 8 "Internal Audit Review - Following the Public Pound", Councillor Macrae and Councillor Gordon stated, for transparency, that they were members of the Moray Leisure Centre Board and would be taking part in the debate. With regard to Item 8 "Internal Audit Review - Following the Public Pound", Councillor Divers and Council Fernandes stated, for transparency, that they were advisors to the Citizens Advice Bureau. 3. Resolution The meeting resolved that in terms of Section 50A (4) and (5) of the Local Government (Scotland) Act 1973, as amended, the public and media representatives be excluded from the meeting for Item 11 of business on the grounds that it involves the likely disclosure of exemption information of the class. Para number of the minute Para Number of Schedule 7a 13 Para 8 Information on the amount of any expenditure proposed to be incurred by the Authority 14 Para 14 Information relating to action taken, or to be taken, in connection with the prevention, investigation or prosecution of crime 15 Para 14 Information relating to action taken, or to be taken, in connection with the prevention, investigation or prosecution of crime 4. Minutes of meeting of 25 June 2024 The minutes of the meeting of the Audit and Scrutiny Committee dated 25 June 2024 were submitted for approval. Councillor McLennan suggested an amendment to the wording of the minute for Item 10 "Local Government Benchmarking Framework 2022-23 and 2021-22" in relation to the last paragraph on page 11 as his understanding was that Councillor Macrae had proposed rather asked about the Framework being considered by Moray Council and that Councillor McLennan had seconded with no dissent or counter motion. The Chair confirmed the wording would be amended to reflect that Councillor McLennan had seconded the proposal. Subject to the amendment above, the Committee agreed the minute of the meeting. 5. Written Questions ** Under referent to Standing Order 36 a written question from Council McLennan was submitted in the following terms: Social Work Case Page 6
Page 7
On 8th August 2024 I submitted a written question asking about "a decision by a Scottish Court to uphold a complaint against Moray Council social workers making false sexual claims about a foster parent and the events therein costing the council a total of £1.3 million including damages of £346,000 reported in the Press and Journal 28.06.2024. The press reports suggest the false allegations levelled at the foster parent(s) were potentially motivated by the fact the foster parents had made a complaint about the Council. I noted that understanding this case, having assurances and ensuring lessons are learned which ensure no repeat of this is vital for public trust and Best Value. This includes eradicating any culture of attacking those who speak up on serious matters and wrongdoing. What assurances can be given that such wrongdoing will not occur again that those involved in this case are properly investigated (and if appropriate, censured) by their governing body and that children are, and have been safe under the care of Moray Council?" In response for the 13th August 2024 Full Council meeting I was told "For clarity, the total sum of compensatory payments made under Human Rights legislation was £346,000. Legal costs associated with the case were £514,000. The Chief Social Work Officer (CSWO) has met with existing employees who were involved at the time and a member of a partner provider service, from which he has drawn out points of learning. Work is underway for professional learning and development from the themes identified. The CSWO is co-operating fully with the Scottish Social Services Council (SSSC) in its investigations into potential misconduct by those involved in the case. These investigations have not yet concluded and when their findings are received, appropriate action will be taken as required." Can we have reassurance that once the investigations are complete a report into the findings will be put before this council for careful consideration; and in the interim can it be confirmed which elected members were made aware of these the complaint against the Council and has any scrutiny taken place by Elected Members into the key decisions taken by the Council apropos this case; and is the Chair and Vice Chair of the Audit and Scrutiny Committee satisfied that all those involved in decision-making apropos this case have been referred or have self- referred to appropriate investigatory body(ies). If not will the chair and vice chair work cross party to ensure that no stone is left unturned in order that the public have full confidence in Moray Councils ability to look after vulnerable children. RESPONSE The Chief Social Work Officer has confirmed that further to the response given to the meeting of Moray Council on 13 August 2024: • He notes the dual interests of the Council and the MIJB in relation to this issue. • Internal learning and development work and external investigations are taking place, the results of which will be reported to the appropriate committees or bodies. The Council’s internal and external auditors have been alerted to the ongoing work and external investigations. • Due to changes in personnel, it is unknown what conversations took place with Councillors at that time in relation to the Court’s original findings. Decisions in relation to litigation have been taken under delegated powers by the Head of Governance, Strategy and Performance. • The question raises the opportunity to highlight to Councillors the outcome of the recent Child Protection Inspection Report by the Care Inspectorate and the Page 7
Page 8
opportunity for further training for Councillors in relation to Corporate Parenting. Councillor McLennan as a supplementary question asked for assurance that the Council's auditors and the external auditors will have full access to all paperwork pertaining to the case and that Elected Members will have full, confidential access to ensure fulfilment of scrutiny functions and roles. In response, the Interim Chief Executive confirmed the internal/external auditors and Elected Members would have access to all available information however referred to the Interim Chief Social Work Officer's response which stated that due to changes in personnel in the time that has lapsed, it may prove challenging to locate all the information. 6. Internal Audit Section Update Report The meeting had before it a report by the Audit and Risk Manager providing Committee with an update on the work of the Internal Audit Section. Following consideration the Committee unanimously agreed to note the contents of the report. 7. Internal Audit Review - Procurement and Creditor Payments The meeting had before it a report by the Audit and Risk Manager advising the Committee on an internal audit review completed for the period from 25 June 2024 to 11 September 2024. In response to a question from Councillor Gordon relating to the testing of the random sample of payments to suppliers and contractors and the likelihood the sample would have included consultants, the Audit and Risk Manager advised a the sampling is done through an audit interrogation software package which analyses all payments for a specific period and breaks them down into groups. The audit team then select random transactions varying in value including credit payments to test. The Audit and Risk Manager confirmed he is currently reviewing the core testing role due to the audit programme being developed several years ago in consultation with Audit Scotland, noting the testing supports his annual opinion in terms of a core financial system. Councillor Macrae, whilst welcoming the work being undertaken detailed in the audit recommendation in respect of the Authorisation Database risk identified in the Appendix, noted there are other systems across departments of the Council which do not interface. In response the Audit and Risk Manager confirmed there are systems that require to be developed across the Council however advised there are competing demands on resources for development of systems balanced against the operational service demands. In response to a follow-up question from Councillor Keith relating to the Authorisation Database and whether such issues should be picked up by internal management rather than Internal Audit, the Head of Governance, Strategy and Performance advised services undertaking continuous improvement checklists under the Public Sector Improvement Framework, noted as part of the Best Value Review, will have a programme of services to internally review their systems, processes, consultation which should pick up such issues. Page 8
Page 9
Following consideration the meeting unanimously agreed to note the contents of the report. 8. Internal Audit Review - Following the Public Pound The meeting had before it a report by the Audit and Risk Manager advising the Committee of an internal audit review completed for the period 25 June 2024 to 11 September. Councillor Divers noted in relation to Audit Finding 5 in the Appendix it stated discussions had been held with Elected Members on both the Moray Leisure Centre Board and Citizens Advice Board, however he could not recall being involved in such discussions. In response the Audit and Risk Manager advised a random sample of Elected Members on the Boards were selected as part of the audit. In response to a question from Councillor Gatt asking on what basis the Council was currently operating with the Boards given the expired Service Level Agreements (SLAs) referred to in Audit Finding 1 in the Appendix, the Depute Chief Executive (Education, Communities and Organisational Development) advised there has been a longstanding agreement in place for some time which requires to be updated and, as reported to Committee, is being progressed. She confirmed a progress report will come to Moray Council to update Elected Members which will explain the delays are as a result of the need to reflect the wider project being pursued in the agreement by Moray Leisure and, given that position, the Council will be progressing the SLA in its current form on the basis that it can be adapted further if required. In terms of ongoing arrangements and to provide assurance the Council has good value for money in respect of the support to Moray Leisure, the Depute Chief Executive advised the Sports and Leisure Services Manager meets regularly with members of the Board and there have been regular strategic meetings held between the Council's Interim Chief Executive, external partners and Moray Leisure Board representatives. Councillor Keith noted the explanation provided regarding the expired Moray Leisure SLA and asked for clarification why the Citizens Advice Bureau SLA was allowed to fall into abeyance. In response the Head of Governance, Strategy and Performance advised there is an agreement in place however it does not meet the requirements of Following the Public Pound in terms of specific deliverables. He confirmed it is planned to bring the process for the new SLA to Committee in October for approval to bind the payment into deliverables related to the Council's areas of statutory responsibility. Following the earlier question from Councillor Divers relating to the discussions with Elected Members on both Boards, Councillor McLennan suggested it may be useful in terms of good governance for future engagement to be cross-party and include the Chair and Depute Chair of this Committee. In response the Audit and Risk Manager agreed to take the point on board. Following consideration the Committee unanimously agreed to note the contents of the report. 9. Internal Audit Review - Commercial Refuse Collection Page 9
Page 10
The meeting had before it a report by the Audit and Risk Manager advising Committee on an internal audit review completed for the period from 25 June 2024 to 11 September 2024. Following consideration the Committee unanimously agreed to note the contents of the report. 10. Public Sector Internal Audit Standards - External Quality Assessment of Internal Audit The meeting had before it a report by the Audit and Risk Manager providing the Committee with details of a recent external quality assessment undertaken on the Council's internal audit services. The Committee joined the Chair in thanking all staff involved for their hard work which had resulted in such a positive report. In response to a question from Councillor Gatt relating to para 6.3.7 of the Appendix and whether the Council have the appropriate resources to undertake the workload, the Interim Chief Executive advised benchmarking work required to be done over the next few months taking into account the overall financial position of the Council. Following discussion the Committee unanimously agreed to note the report and action plan prepared to address the issues raised in the external quality assessment of internal audit. 11. Carefirst Replacement - Progress Update The meeting had before it a report by the Interim Head of Service and Chief Social Work Officer informing the Committee of the progress of the replacement Social Work and social care management information system and the outline business case. Councillor Macrae referred to the failure of the server in paragraph 4.7 and expressed concern at the lengthy downtime for staff and, in terms of business recovery, asked what assurance could be provided that the Council could continue to operate if there was a outage across all services. In response, the Head of Human Resources, ICT and Organisational Development confirmed back up arrangements are in place with a prioritised list of services who would be restored and the list was currently under review in line with business continuity plan arrangements. In response to a question from Councillor McLennan regarding whether the 5 hours downtime referred to in paragraph 4.7 was within the parameters of the business continuity plan, the Head of Human Resources, UCT and Organisational Development advised she would confirm where the system sits on the prioritised list and advise Members. In response to a question from Councillor Macrae relating to whether shared learning from colleagues in other local authorities could be used to find a solution to be implemented timeously and at reasonable cost or if outsourcing could be considered, the Interim Chief Social Work Officer confirmed benchmarking work is being undertaken to identify councils using single systems. He advised there is a cost pressure including significant staff resourcing to transition to a new system as Page 10
Page 11
migration is a complicated process which cannot be done quickly to ensure requirements are met. Councillor McLennan referred to the Audit and Risk Manager's concerns as stated in paragraph 5(d) of the report and asked what assurance could be provided that the current systems and any new system will give a balance of multi-agency working whilst ensuring legislative requirements are met by each agency in terms of data management and information security. In response the Interim Chief Social Work Officer advised the Council and agencies operate within the confines of information sharing agreements and there are systems in place to ensure access is proportionate and necessary. Following consideration the Committee unanimously agreed to note the report. The press were asked to leave the meeting. 12. Order of Business In terms of Standing Order 29 the meeting agreed to vary the order of business set down on the agenda and take Item 14 "Update on Improvement Plan for Adult Social Care Commissioning [Para 8]" followed by Item 12 "Internal Audit Review - Email Security [Para 4]" and Item 13 "Internal Audit Follow Up Review - Cyber Security [Para 4]" as the next items of business to allow the Interim Chief Social Work Officer to attend another meeting. 13. Update on Improvement Plan for Adult Social Care Commissioning [Para 8] The meeting had before it a report by the Interim Head of Service and Chief Social Work Officer updating the Committee of progress regarding the Improvement Plan for Adult Social Care Commissioning. Following consideration the Committee unanimously agreed to:- i. note the progress of the Improvement Plan attached at Appendix 1; ii. note the progress within this report as at the end of July 2024 in relation to the recommendations detailed in the Improvement Plan; and iii. note the updated report includes details of contract values, timelines and risks. 14. Internal Audit Review - Email Security [Para 14] The meeting had before it a report by the Audit and Risk Manager on an internal audit review completed for the period from 25 June 2024 to 11 September 2024. Following consideration the Committee unanimously agreed to note the contents of the report. 15. Internal Audit Follow Up Review - Cyber Security [Para 14] The meeting had before it a report by the Audit and Risk Manager providing the Committee with an updated on a follow up review completed by the Internal Audit Section. Page 11
Page 12
Following consideration the Committee unanimously agreed to note the contents of the report. Page 12
Page 13
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 20 NOVEMBER 2024 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2024/25 AUDIT PLAN Audit Plan Update 4.1 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed as Appendix 1 is an update on the progress undertaken by the Internal Audit Section regarding the completion of audit review projects against the Annual Audit Plan. Item 5. Page 13
Page 14
Follow Up Reviews 4.2 Internal Audit reports are regularly presented to Members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Debtors 4.3 An audit of the Debtors System was previously undertaken. Invoices are raised for various types of services, e.g., financial contribution for care, trade waste, special uplifts, hire of facilities and rechargeable repairs. The audit scope involved a check to ensure invoices can be evidenced with enough backing documentation to be able to support debt recovery should the need arise; confirm payments had been auto matched to debtor accounts; receipts without a valid reference have been posted to and cleared from a suspense account on a regular basis; effective monitoring of unpaid invoices are monitored and chased in accordance with debt recovery procedures; collection performance is monitored and reported. The audit review did not include the arrangements for recovering debts concerning council tax, non domestic rates and housing rents. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 2. Purchasing Cards 4.4 An audit was previously undertaken of the systems and procedures for the management, use and control of purchasing cards. A purchasing card is similar to a personal credit card issued by the Council's Bank used by the Moray Council to enable purchases of supplies and services to be made quickly and efficiently. Cards are available to officers on approval of their budget manager. It provides flexibility and a cost effective alternative to the Council's standard requisition ordering process. Purchasing cards are managed by a payment card software application administered by the Bank. The audit scope for this review was to assess the key controls and systems in place in the management and use of purchasing cards. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 3. Environmental Services Stores 4.5 A follow up review has been undertaken to evidence the implementation of recommendations reported in the audit undertaken of the Environmental & Commercial Services Stores. The stores are located at the Ashgrove Depot in Elgin and include internal and external storage facilities. This is the primary storage facility for meeting the needs of Roads, Cleaning, and Fleet Services. In addition, the stores are responsible for purchasing and issuing approved clothing for all Council Services. The stores software system has 1225 lines of individual stock items, which can vary in value from a few pounds to upwards of £1,000. It was noted during the follow up review that an upgrade to the stores software system is shortly planned, which should enable greater automation of processes. The Follow Up Report is given in Appendix 4. Page 14
Page 15
5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: SPMAN-2045703626-500 SPMAN-2045703626-501 SPMAN-2045703626-502 SPMAN-2045703626-503 SPMAN-2045703626-504 Page 15
Page 16
Page 16
Page 17
APPENDIX 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2024/25 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries. Audit programmed to start in the next quarter(s) Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations. Completed ICT Hardware Asset Management review of systems and practices to record / monitor the location and use of ICT hardware. Fieldwork in progress Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances. Year end stock valuations agreed OTHER SYSTEMS Area Type of coverage Housing and Property Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing). Fieldwork in progress Item 5. Page 17
Page 18
Grant Claims Certification of grant claims as required: strategic timber; network support grant, regeneration schemes as appropriate Network Support Grant audit completed, and claim submitted to Transport Scotland (October 2023 to March 2024). Housing Rent Collection & Arrears Management A review of the income collection and accounting arrangements for housing rents. Fieldwork in progress Moray Growth Deal An audit review of the governance and administrative procedures within the Council for the management of the Moray Growth Deal. The scope will include the concerning partnership working, financial management and measuring success. Completed Education – Secondary School Establishment visits as part of cyclical review. Audit programmed to start in the next quarter(s) Treasury Management To provide assurance that processes and controls are continuing to operate effectively for the Council's treasury management system. Draft report prepared Commercial Refuse Collection To consider whether adequate control is in place covering trade waste income and expenditure, that appropriate agreements and other paperwork is in place, and that accounting arrangements are robust. Completed Governance arrangements to prevent Fraud and Corruption Overview of the Councils governance arrangements to prevent fraud and corruption. The audit will use the Cipfa Code of practice on managing the risk of fraud and corruption as the basis in developing the audit programme for the review. Completed Page 18
Page 19
Education- Secondary School Premises Security Review the controls in place to mitigate the risk of unauthorised access to Secondary School Premises. Audit programmed to start in this quarter Absence Management An audit to consider the effectiveness of sickness absence monitoring and reporting. Audit programmed to start in the next quarter(s) Following the Public Pound To ensure that there is proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Completed Moray Integration Joint Board Residential Care An audit to review the adequacy of procedures and administrative arrangements regarding the third party suppliers appointed to provide care home services The audit will also include testing to verify the accuracy of the financial assessments and the charging for residential care of both respite and permanent care residents. Audit programmed to start in the next quarter(s) Out of area placement A review of the systems and procedures regarding adult services users that are out of area but responsibility remains to meet their eligible care and support needs under the Care Act. Completed Fostering and Kinship payments A review to ensure that the internal controls in place for administering Fostering and Kinship Care Allowances are operating effectively. Completed Page 19
Page 20
Follow Up reviews to be undertaken from previous Audit Assignments * Audit Review: Original Scope Status/ Comments Self Directed Support (SDS) – Option 1 This audit remit was to review Option 1 Direct Payments under the SDS scheme, where a payment is made by the local authority directly to a supported person for the provision of support. The scope of the audit was to ensure compliance with operating guidelines in the financial management of SDS packages, expenditure incurred is in accordance with the agreed budget and support plans, and surplus funds are recovered from service users where appropriate. Follow Up Review programmed to start in this next quarter Self Directed Support (SDS) – Option 2/3 The scope of the audit was to review systems and procedures in the delivery and management of adult social care provided under Options 2 and 3 of the SDS scheme. This included examination of the processes to support individuals in determining their preferred care delivery option, contractual relationships with care providers, financial management and monitoring of individual care packages. Follow Up Review programmed to start in this next quarter Building Services - Planned Maintenance Projects An overview was undertaken of how the annual planned maintenance programme is determined and the contract management arrangements of these projects by Building Services. The audit also involved a random selection of projects to verify costs can be evidenced to supporting documentation. Additional testing was also undertaken of the systems regarding the management and control of overtime paid to officers. Follow Up Review programmed to start in this quarter Emergency Planning The objective of this audit was to provide assurance over the adequacy and effectiveness of current controls over emergency planning. The audit scope included a check to ensure adequate training, planning and testing has been developed in the event of an emergency. Follow Up Review programmed to start in the next quarter(s) Page 20
Page 21
Debtors The audit scope was to review the key operational controls within the Council's Debtors System. The audit checked the systems for raising invoices, collecting income, recording income and debt recovery arrangements. The audit review did not include the arrangements for recovering debts concerning council tax, non domestic rates, and housing rents. Completed Domestic Refuse Collection The scope of this audit was to review systems and procedures to ensure the most effective and efficient use is made of resources for the collection of domestic waste. The audit also checked the arrangements for disposing of recyclable waste. This included disposal of plastic, glass and biodegradable waste, in addition to paper / card, aluminium and steel cans for which the Council received regular payments from recycling contractors. Follow Up Review programmed to start in the next quarter(s) Pool Cars Scheme The scope of this audit was to review systems and procedures in the management and use of pool cars. Policies and procedures were checked to ensure they provide appropriate operating guidance to officers in the booking and use of pool cars. The audit included a review of arrangements for internal recharging to services and also exploration if further use of pool cars could provide additional value for money opportunities to the Council. Follow Up Review programmed to start in the next quarter(s) Cyber Security The audit reviewed systems, practices and an assessment of the controls in place to protect the Council from a cyber-attack. The audit also reviewed Information, Communication and Technology (ICT) security policies and procedures to ensure they are regularly reviewed and promote best practices. The audit programme has been developed from the Scottish Government Cyber Resilience Framework and other good practice guidelines. Follow Up Review programmed to start in the next quarter(s) Page 21
Page 22
Moray Integrated Community Stores The audit reviewed the management of the Moray Integrated Community Stores. This included reviewing the procedures for ordering and issuing occupational therapy equipment to service users. In addition, a check was made to compare stock records to the actual equipment held within the Stores. Follow Up Review programmed to start in the next quarter(s) Forres Academy The audit reviewed the operation of the Devolved School Management Scheme regarding the allocation of funding and the management of these funds at the school level. The review involved a study of the management of the significant staffing costs involved in delivering the curriculum, a review of procurement practices, an examination of the School's administration of income and also confirming accountability for School Fund monies. Follow Up Review programmed to start in the next quarter(s) Email Security The audit checked the system controls and supporting policies and procedures used to administer the Council's email system. The audit also reviewed the arrangements for risk identification and actions undertaken to protect the Council from phishing emails. In addition, in response to a request from an elected member, the audit included a review of the password management controls for members access to the Council networks and systems. Follow Up Review programmed to start in the next quarter(s) Keith Sports & Community Centre The audit scope reviewed the processes and procedures in place at the Keith Sports and Community Centre and evaluate the effectiveness of internal controls relating to income and expenditure. This involved the sample testing of individual transactions to ensure compliance with Regulations and Guidelines. In addition, an appraisal of working practices was also undertaken to assess if the Service was maximising the income due to the Council Follow Up Review programmed to start in the next quarter(s) Page 22
Page 23
Environmental Services- Stores This audit reviewed the systems and controls in managing stock held within Environmental & Commercial Services Stores. The audit used the Chartered Institute of Public Finance Accountants audit programme to review the systems and controls in managing stock held within stores. Testing also included a review of the security arrangements to safeguard against unauthorised access to the storage areas Completed Purchasing Cards The audit scope for this review was to assess the key controls and processes in place covering the usage of purchasing cards. The audit included a review of purchasing card guidelines and testing the controls operating over the key processes of purchase card applications, issue of cards, usage, authorisation and VAT accounting arrangements. Monitoring undertaken to ensure compliance with regulations, policies and procedures has also been undertaken, in addition to the reconciliation of purchasing card transactions detailed within the payment card system to the Council's Financial Management System Completed Foster and Kinship Care Payments The audit scope reviewed policies and procedures for the management of fostering and kinship payment of fees and allowances are administered in accordance with these policies and procedures and are operating within budgetary control. Follow Up Review programmed to start in the next quarter(s) Governance arrangements to prevent Fraud and Corruption This audit reviewed the Council and the Moray Integration Joint Board (MIJB) governance arrangements to prevent fraud and corruption. The Cipfa Code of Practice on Managing the Risk of Fraud and Corruption was used as the template for developing an audit programme for this review. The audit was also undertaken as part of a joint working arrangement with the internal audit service providers of NHS Grampian, Aberdeen City and Aberdeenshire Follow Up Review programmed to start in the next quarter(s) Page 23
Page 24
Councils. Moray Growth Deal The scope of the audit included reviewed the governance and administrative arrangements surrounding the Moray Growth Deal. It also considered how partnership working is operating, the financial management of the Deal and how success is being measured. Follow Up Review programmed to start in the next quarter(s) Early Learning and Childcare Premises Security The scope of the audit reviewed policies, procedures, and an appraisal of the security controls within nursery buildings and play areas. The audit included a review of guidelines issued centrally by the Early Learning and Childcare Service and instructions or handbooks that individual nurseries may have developed. The audit process involved selecting a sample of both Council and privately run nurseries to visit, where the actual security controls operating in practice were observed and tested Follow Up Review programmed to start in the next quarter(s) * Additional follow up reviews may be reported depending on the implementation dates detailed by Services for recommendation Page 24
Page 25
APPENDIX 2 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Debtors REPORT REF: 24'011 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: The audit reviewed the key operational controls in the management of the Debtors System. 5.01 Further to a review undertaken by the Payments Section, additional controls have been implemented to ensure more effective monitoring of software licensing requirements. This will include establishing a register of software High Yes 31/12/2023 Implemented – Revised processes have been introduced to ensure software licenses are renewed in accordance with contract conditions. Item 5. Page 25
Page 26
2 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation certificates requiring future renewal. 5.02 To ensure the Council is maximising income recovering arrangements, services should be reminded to resolve any disputed invoices as quickly as possible. Medium Yes 31/01/2024 Implemented – The Payments Section sends quarterly debt management reports of unpaid invoices to services. Services have been reminded of the need to resolve disputed invoices promptly. Payments Section also undertakes regular age debt analysis to highlight unpaid invoices over different time periods. 5.03 In accordance with Financial Regulations, services should be reminded of the requirement that invoices are issued promptly, either in advance or within a maximum of 30 days of the service or goods being provided. Medium Yes 31/01/2024 Implemented – Quarterly debt management reports are sent to services, which include a reminder of the Financial Regulations requirement of issuing invoices within 30 days of providing a service or goods. Page 26
Page 27
3 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.04 Consideration should be given for additional guidance to be included within the Sundry Debt Management Procedures to ensure a uniform approach is taken where the use of legal action should be considered by services for the recovery of unpaid invoices. Medium Yes 31/01/2024 Implemented – Revised Sundry Debt Management Procedures have been updated to include guidance on the use of legal action for unpaid invoices. 5.05 Consideration should be given to further developing performance management information to allow benchmarking with other local authorities and for the internal management of debt recovery action undertaken by individual services. Medium Yes 31/03/2024 Revised Implementation Date 31/08/2024 Implemented – Performance management information detailing the total value of invoices raised, aged debt and debts written off by service has now been developed. This information is issued to Heads of Services every quarter to enable more effective debt management arrangements. Page 27
Page 28
Page 28
Page 29
APPENDIX 3 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Purchasing Cards REPORT REF: 24'019 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Procedures are in place and frequently reviewed to govern use of the corporate purchasing cards system. 5.01 In accordance with agreed timescales, Purchasing Card Procedures should be reviewed annually and made available on the Interchange for user reference. Medium Yes 30/04/2024 Implemented. The Purchasing Card Procedures Manual has been reviewed and presented on the Interchange for user reference in June 2024. Going forward, the procedures will be reviewed on an annual basis. Key Control: A robust purchase card application process is in place accompanied by a controlled process for issue of cards on acceptance of terms of operation. Item 5. Page 29
Page 30
2 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 All officers must sign and return a Payment Card Terms of Use Form to the Payments Service before being issued a purchasing card and access granted to the Payment Card System. Medium Yes 30/04/2024 Implemented. Audit testing has confirmed administrative processes have been strengthened to ensure purchasing cards are not despatched to new users until the signed terms of use acceptance form has been received by the Payments Service. A tidy up exercise has also been undertaken to ensure conditions of use acceptances are on file for all existing cardholders. Key Control: Usage of purchase cards is controlled by imposed limits, is for purchases not suitable for standard procurement routes, is appropriately detailed for authorisation and scrutiny purposes and supports the continued appropriateness of card retention. 5.03 Consideration should be given to Low Yes 31/07/2024 Implemented. An exercise has been confirmed as undertaken to align cardholder Page 30
Page 31
3 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation aligning all purchasing cardholders who hold a standard single transaction limit to the current transaction limit of £1,000 to ensure consistency. transaction limits. There are now 15 officers holding single transaction limits over the standard £1,000 threshold, all due to assessed operational requirements, compared to the 151 officers with higher than standard limits in the original audit review. 5.04 The Bank should be informed to correct the errors found in Cardholders spending limits noted during the audit review. Low Yes 31/07/2024 Implemented. As referred to in 5.03 above, an exercise has been undertaken to review all cardholder spending limits and errors previously identified have been advised to the Bank, resulting in amended limits being applied. Key Control: Purchase Card transactions are appropriately authorised by the relevant budget manager. 5.05 Full transaction listings of purchase card transactions should be issued for information to Medium Yes 30/04/2024 Implemented. A catch-up exercise has been undertaken to issue full transaction listings for 2023/24 and the reports have been evidenced Page 31
Page 32
4 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation all budget managers every quarter, in compliance with purchasing card procedures. as issued for Quarter 1 of 2024/25. No delay is expected for issue of reports to budget managers going forwards due to streamlining of the recording process with the newly implemented electronic transaction logging. 5.06 Agreed timescales should be established where payment card transactions not authorised by a budget manager are referred to the appropriate Head of Service to resolve and if required, authorise the outstanding expenditure. Medium Yes 30/04/2024 Implemented. Significant improvement has been seen in the prompt authorisation of transactions since the initial audit. Payments Section has introduced new processes since the end of June 2024. Transactions must now be approved before they can be downloaded for processing, giving greater impetus for budget managers to act timeously and for Page 32
Page 33
5 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation unapproved transactions to be identified and pursued by Payments. Unapproved transactions at the time of the follow-up audit relate to only recent transactions with no recurring control issue identified. Key Control: VAT on purchasing card transactions is accurately documented and accounted for with full recovery of applicable input tax elements. 5.07 A reminder should be issued to all services to remind officers of VAT accounting requirements for payment card transactions. High Yes 30/04/2024 Implemented. A reminder of the VAT accounting requirements has been added to the annual terms of use confirmation issued to all cardholders in March 2024. In addition, the Purchasing Card guidelines have been augmented in June 2024 to include more clarity and detail on VAT requirements. The new electronic receipt logging process Page 33
Page 34
6 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation implemented in June 2024 has also provided a further opportunity to communicate VAT accounting requirements to all cardholders. Process enhancements implemented can be seen to have strengthened the VAT accounting system. 5.08 Consideration should be given for the Payments Service to undertake further monitoring of payment card transactions with the aim of maximising VAT recovery where documentary evidence is required of valid VAT receipts / invoices from services. High Yes 31/07/2024 Implemented. Since the audit took place, mandatory electronic VAT receipt submission within the Purchasing Card system has been introduced. This has assisted the monitoring process with electronic receipt submissions being validated by the Payments service and any documentation unsuitable for VAT reclaim being immediately identified and further queried as a routine process to ensure maximisation of VAT recovery is achieved. Page 34
Page 35
7 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.09 The agreed procedure for the Payments Service of issuing routine escalation reports on purchase card transactions with potential VAT implications to Heads of Service should be reinstated to promote VAT recovery arrangements. High Yes 30/04/2024 Implemented. A catch-up exercise has been undertaken to issue VAT information reports to Heads of Service (HOS) for 2023/24 and for Quarter 1 of 2024/25. No delay is expected for issue of reports to HOS going forwards due to streamlining of the recording process with the newly implemented electronic transaction logging. With the requirement for receipt production on transaction logging, the need to escalate to HOS is expected to decrease and will be reviewed in time to assess if still appropriate and impactful. Page 35
Page 36
8 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.10 Investigation of an electronic document imaging facility to record VAT receipts / invoices on transaction logging should continue with the aim of implementing more effective VAT accounting and documentation retention arrangements. Medium Yes 31/07/2024 Implemented. Mandatory electronic receipt logging has been introduced as part of the Purchasing Card system in June 2024. This is already showing benefits in effective VAT accounting and document retention arrangements and is deemed to be a welcome improvement to Purchasing Card administration. Key Control: Processes are in place to ensure purchase card permissions are fully withdrawn from cardholders on termination of employment. 5.11 In accordance with operating arrangements, the payment card system should be updated promptly to reflect current budget management responsibilities Medium Yes 30/04/2024 Implemented. A tidy up exercise has been completed regarding budget managers within the payment card system. Monthly processing of leavers is being undertaken. Page 36
Page 37
9 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation when notified of officers leaving the employment of the Council. 5.12 Greater care should be taken on inputting payroll reference numbers when setting up employees on the purchasing card system. Low Yes 30/04/2024 Implemented. A reminder on input accuracy has been issued to relevant officers and follow -up testing has confirmed accurate set up of new users on the purchasing card system. Page 37
Page 38
Page 38
Page 39
APPENDIX 4 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Environmental Services Stores REPORT REF: 23'023 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective systems and procedures are operating to ensure accurate records are maintained to account for all stocks held within Environmental Services Stores. 5.01 A review should be undertaken of the items stored within the external storage compound and consideration should be given to whether any items could be stored within the internal storage facility for improved security. High Yes 30/06/2023 Implemented – A review of the items stored within the external storage area has been carried out, and several items, including the copper coil, are now stored in a secure location. Item 5. Page 39
Page 40
2 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation This includes the copper coil identified during the audit review. 5.02 All materials and equipment recorded within Tranman should be updated with minimum and maximum stock levels. This should assist in more effective management of stock levels at the appropriate levels. Medium Yes 31/12/2023 Implemented – Maximum and minimum stock levels have now been set for all items within Tranman. 5.03 Adjustments required to stock figures recorded within Tranman should require the authorisation of the Fleet Business Co-ordinator. Medium Yes Implemented Implemented - Procedures have been amended to ensure that adjustments to Tranman stock levels are authorised by the Fleet Business Co-ordinator or the Senior Stores Officer. 5.04 The Stock items currently housed in the Roads Hanger should be placed in a secure area where only Stores Medium Yes Implemented Implemented – A secure area has been created within the Roads Hanger to store Page 40
Page 41
3 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation staff can access them so as to ensure that accurate recording of issues and returns can be maintained. stock items, with only Stores officers having access to this area. 5.05 Current procedures should be amended to ensure that changes to framework contract prices of stock items are regularly updated within Tranman. High Yes 30/06/2023 Part Implemented – Increases in the price of higher value items will be manually updated in Tranman on delivery of a stock purchase. This finding concerned a minor variance noted in the average price stock valuation when an item is received, recorded within Tranman and issued before the receipt of the invoice where there has been an increase in the unit price. The audit testing of a sample of lower value stock items where this has occurred only found a minor material stock valuation variance within Tranman. An upgrade to the Tranman system is planned shortly, which should allow the automation of increases in framework contract prices. No further follow up review of this recommendation is planned. Page 41
Page 42
4 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.06 Regular reviews should be undertaken of stores to highlight any slow moving or obsolete stock. Consideration should then be undertaken as to whether any identified items are sold or disposed. Medium Yes 30/09/2023 Implemented – A review of slow-moving stock has been carried out, and where items have been identified as obsolete, they have been written off and disposed. This is now part of an ongoing process. Key Control: Effective systems and procedures operating to ensure accurate records are maintained for all stocks issued and returned by Environmental Services Stores. 5.08 The details and signature of the officer raising and authorising requisitions for items from stores or similar information within email requests should be recoded in all instances. Staff should be reminded of the need for this to take place. Medium Yes Ongoing Implemented – A reminder email was issued to all services that use the Stores. The follow up review was then undertaken and a sample of requisitions for stock items was randomly selected. It is pleasing to report that details of the officer raising and authorising the requisitions are now recorded. Where requisitions are raised over the phone or Page 42
Page 43
5 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation email, Stores staff detail the information and sign the requisition note. Page 43
Page 44
Page 44
Page 45
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 20 NOVEMBER 2024 SUBJECT: INTERNAL AUDIT REVIEW – FOSTERING AND KINSHIP CARE PAYMENTS BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 11 September 2024 to 20 November 2024. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the following internal audit work concluded during the period 25 June 2024 to 20 November 2024.: Fostering and Kinship Care Payments 3.2 An audit has been undertaken of the administrative arrangements for Fostering and Kinship Care Payments. The audit reviewed that the processing of fostering and kinship payments of fees and allowances are administered in accordance with agreed policies and procedures. It is pleasing to report that within the scope of the audit, the management of fostering and kinship payments was well managed. However, some administrative control improvements were noted concerning the recording of information and the introduction of additional verification checks to confirm eligibility for ongoing kinship allowance payments. The audit report for this project is given in Appendix 1. Item 6. Page 45
Page 46
4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-2045703626-505 / SPMAN-2045703626-506 Page 46
Page 47
Appendix 1 1 Final Internal Audit Report Fostering and Kinship Care Payments July 2024 Distribution: Chief Social Work Officer/Head of Service Children and Families Social Work Service Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 0 Substantial Priority 2 1 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Item 6. Page 47
Page 48
Appendix 1 2 Contents Page Foster and Kinship Care Payments 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-7 4. Management Response 5-7 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 48
Page 49
Appendix 1 3 1. Introduction and Audit Scope The 2024/25 Annual Audit Plan provides for a review of the administration of Fostering and Kinship Care Payments. Fostering occurs when a child cannot be cared for by their birth parents, or by their extended family or close friends, and need to be cared for by an approved foster family. Whereas kinship care is where a child is unable to live with their birth parent and resides instead with a relative or other individual with whom they have a pre-existing relationship, e.g., a sibling or close family friend. In August 2023, the Scottish Government and COSLA agreed on the Scottish Recommended Allowance for foster and kinship carers. In addition, foster carers are also paid a weekly fee depending on their skill levels and experience. A review of the Council’s Financial Management System noted that fostering and kinship payments made to carers in 2023/24 amounted to £1.2 million and £443,000 respectively. At the time of the audit, the Council financially supports 47 children in foster care and 80 children within kinship arrangements. The audit scope reviewed policies and procedures for the management of fostering and kinship payment of fees and allowances are administered in accordance with these policies and procedures and are operating within budgetary control. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues The audit found that the management and processing of fostering and kinship payments were well managed. However, some systems and administrative control improvements were noted, including: • The audit noted the Service has detailed case recording procedures to assist officers in managing foster and kinship arrangements. However, audit testing of a sample of care arrangements noted that some documents, although found, had not been saved in the correct location in accordance with agreed procedures. In addition, it was also noted a need to update the Kinship Carer Agreement between the Council and carers to reflect current data protection legislation. Page 49
Page 50
Appendix 1 4 • The scope of this audit included reviewing the controls in place to verify the ongoing entitlement of allowances and fees paid to carers. It was noted that a financial irregularity has occurred within another Scottish Local Authority concerning a significant overpayment of a kinship payment made to a carer. The irregularity related to the ongoing payment when the child no longer stayed with the kinship carer. It is pleasing to note that the Service has controls in place to check carers eligibility to maintain continued allowance payments; however, further verification testing should also be considered. Page 50
Page 51
Appendix 1 5 Commercial Waste Collection- 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. Low A requirement of the kinship care placement process for a child is for a carer to agree and sign a Kinship Carer Agreement with the Council. This document details the duties and obligations of both the Council and the carer regarding the ongoing care responsibility for the child. The audit found that on review of the Kinship Carer Agreement, reference is made to previous data protection legislation. The Kinship Carer Agreement template should be reviewed and updated with reference to the current data protection legislation. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Social Work Service Manager Yes Implemented Kinship Carer Agreement template has been amended to reflect current data protection legislation. Page 51
Page 52
Appendix 1 6 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. Low In addition to a review of the arrangements for administering fostering and kinship payments, a check was also made to ensure that documentation retention of information and key documents for managing the relationship between the Council and the carer was saved in accordance with the Case Recording Procedures. Audit testing of a sample of care arrangements noted that some documents, although found, had not been saved within a location that was per these agreed procedures. All officers administering fostering and kinship arrangements with carers should be reminded that the recording and retention of documents should be in accordance with the Case Recording Procedures. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Social Work Service Manager Yes 31/10/2024 Reminder will be issued by the Business Support Team to officers of the requirement to follow Case Recording Procedures around recording and retention of documents. Page 52
Page 53
Appendix 1 7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3. Medium As part of the research for this audit, it was noted that a financial irregularity had occurred within another Scottish Local Authority concerning a significant overpayment of a kinship payment made to a carer. The overpayment occurred due to ongoing payment when the child no longer stayed with the kinship carer. The Council concerned was contacted to gain a further understanding of the issues that have assisted in developing the audit programme of testing for this review. It is pleasing to note that the Service introduced a requirement a few years ago for carers to make a self-declaration of eligibility to maintain continued allowance payments. However, it is considered that further verification checks should also be considered. In accordance with the Children (Scotland) Act 1995, a carer is entitled to a kinship allowance payment until the young person is 18 if they remain in full time education. Further to discussions with the Service, consideration should be given to undertaking regular verification checks to confirm details of educational status and address for children within a kinship residence order arrangement with Education Services. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Social Work Service Manager Yes Implemented A new process has been implemented for residence carers to complete the details of the child’s school on their annual return. This information will be checked regularly with Education Services to ensure there is no change in circumstances. Page 53
Page 54
Appendix 1 8 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of noncompliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 54
Page 55
Appendix 1 9 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 55
Page 56
Page 56
Page 57
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 20 NOVEMBER 2024 SUBJECT: INTERNAL AUDIT REVIEW – GOVERNANCE ARRANGEMENTS TO PREVENT FRAUD AND CORRUPTION BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an internal audit review completed for the period from 11 September 2024 to 20 November 2024. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the internal audit review completed during the period 11 September 2024 to 20 November 2024 regarding the Council’s and the Moray Integration Joint Board (MIJB) governance arrangements to prevent fraud and corruption: Governance arrangements to prevent Fraud and Corruption 3.2 A review was undertaken of the Council and the MIJB’s governance arrangements to prevent fraud and corruption. The Chartered Institute of Public Finance and Accountancy Code of Practice on Managing the Risk of Fraud and Corruption was used as the template for developing an audit programme of testing to be undertaken. This review was done as part of a joint audit exercise with the internal audit providers of NHS Grampian and Aberdeenshire / Aberdeen City Councils. As the Integration Joint Boards deliver services through officers and systems of the Council and NHS Grampian, this approach has allowed for a more overarching and complete review to be undertaken. In addition, the opportunity for sharing knowledge and expertise has benefited all the internal audit providers in the delivery of this audit review. Item 7. Page 57
Page 58
3.3 The responsibility for preventing and detecting fraud and corruption rests with management. However, the Internal Audit Service has a role in supporting these arrangements by assessing the adequacy of these controls and leading investigations of irregularities concerning finances, property, services, or policies of the Council. Regarding allegations of fraud or corruption within NHS Grampian, it is the responsibility of the NHS Counter Fraud Authority to investigate. Findings noted where further improvements are needed in developing agreed procedures between the Internal Audit Service and the NHS Counter Fraud Authority, as officers of both NHS Grampian and the Council use systems of both organisations to deliver services. Improvements were also noted where further development is needed within the Council to enable more effective reporting of irregularities. The audit report for this project is given in Appendix 1. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Page 58
Page 59
Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-2045703626-507 / SPMAN-2045703626-508 Page 59
Page 60
Page 60
Page 61
Appendix 1 1 Final Internal Audit Report Governance arrangements to prevent Fraud and Corruption October 2024 Distribution: Interim Chief Officer Health & Social Care Moray (MIJB) Head of Governance Strategy & Performance Chief Financial Officer Head of Human Resources ICT & Organisational Development Audit & Risk Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 0 Substantial Priority 2 3 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Item 7. Page 61
Page 62
Appendix 1 2 Contents Page Governance arrangements to prevent Fraud and Corruption 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-10 4. Management Response 5-10 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 62
Page 63
Appendix 1 3 1. Introduction and Audit Scope The Annual Audit Plan for 2024/25 provides for a review of the Council and the Moray Integration Joint Board (MIJB) governance arrangements to prevent fraud and corruption. The primary responsibility for preventing and detecting fraud and corruption rests with management who should ensure adequate systems of internal control, segregation of duties and proper authorisation procedures. However, the Internal Audit Section does have a role in supporting these arrangements by assessing the adequacy of these controls, and in accordance with the Council’s Financial Regulations for the Audit and Risk Manager to investigate in consultation with the Depute Chief Executive Education, Communities & Organisational Development irregularities concerning finances, property, services or policies of the Council. The audit also reviewed the arrangements for the investigation, preventing and detecting fraud and corruption within the MIJB. The Council’s Audit and Risk Manager is also the Chief Internal Auditor of the MIJB. The Cipfa Code of Practice on Managing the Risk of Fraud and Corruption was used as the template for developing an audit programme for this review. The audit was also undertaken as part of a joint working arrangement with the internal audit service providers of NHS Grampian, Aberdeen City and Aberdeenshire Councils. This has allowed the sharing of knowledge and agreement in the audit testing to ensure consistency and a more overarching review of the Integration Joint Boards (IJBs) counter fraud and corruption arrangements within the Grampian area. The IJBs deliver services through officers and systems of the Council and NHS Grampian. Officers from the Council and NHS Grampian will have access to the systems of both organisations. It is hoped these joint working arrangements with the internal audit service providers within Grampian will continue as it provides the opportunity for a more cross-organisational review of the IJB’s risk management, control and governance processes irrespective of NHS Grampian or Council systems are used in the delivery of services. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • The Public Sector Internal Audit Standards require the Chief Internal Auditor to provide an opinion on the overall adequacy and effectiveness of the MIJB risk management, control, and governance processes. MIJB delegated services are delivered by Council and NHS Grampian employed officers with access to systems of both organisations. Responsibility for investigating fraud within the Council Page 63
Page 64
Appendix 1 4 lies with the Audit and Risk Manager, but for NHS Grampian, it is the responsibility of the NHS Counter Fraud Authority. It is appreciated that the occurrence of fraud is rare, but consideration should be given to developing a protocol between the Audit and Risk Manager in consultation with the Chief Internal Auditor of Aberdeenshire/ Aberdeen City Councils and the NHS Counter Fraud Authority. This should assist in providing greater clarity and co-ordination of responsibility in the notification, investigation and reporting of alleged frauds within the MIJB, irrespective of whether the Council or NHS Grampian employs the officer delivering the delegated service. • The CIPFA Code of Practice on Managing the Risk of Fraud and Corruption requires that an “organisation should make arrangements for appropriate resources to support the counter fraud strategy”. This includes the need to detect fraud through data and intelligence analysis. The staff resources of the Internal Audit Section are limited, but consideration should be given to including a project within the Annual Internal Audit Plan to review Council systems and practices where fraud or irregularities have occurred in other organisations. The testing undertaken should make use of data evaluation software in the analysis of information, and a review of fraud cases and other irregularities reported within the media, Audit Scotland Technical Bulletins and participation in the Scottish Local Authority Investigator's Group. Page 64
Page 65
Appendix 1 5 Governance arrangements to prevent Fraud and Corruption - 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. Medium A review of the Council’s policy framework which supports a counter fraud strategy, noted a range of policies to inform officers in their conduct and responsibilities as employees. These policies also protect officers from false allegations of fraud or corruption. However, the audit review noted that the Code of Conduct for Employees and the Policy on Outside Employment had not been reviewed for a number of years. It is appreciated that both the Code of Conduct for Employees and the Policy on Outside Employment detail best practices and are still relevant; however, both documents should be reviewed and if required updated. The Code of Conduct for Employees and the Policy on Outside Employment should be reviewed and if required updated. In addition, future dates of review should thereafter be agreed. . Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Organisational Development Manager Yes 31/03/2026 The employment policy framework is reviewed annually, resulting in agreement on the priorities for policy review according to a range of factors, such as changed legislation. The Code of Conduct for Employees and the Policy on Outside Employment remain appropriate and have not been identified as a priority for updating; however, they will be included in the annual plan for policies review for 2025/26. Page 65
Page 66
Appendix 1 6 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. Low It was noted that the Council’s website included details on reporting allegations of potential fraud to the Internal Audit Section. However, reference is made specifically to the reporting of Housing and Social Security Benefits fraud, as this used to be the most significant area of allegations received for investigation. A review of the wording used within the Council’s internet site should be undertaken, as a need to report a potential fraud may relate to any service area of the Council. In addition, research noted online fraud reporting function within other Local Authorities as an additional method for an individual to report an allegation of fraud. Current wording used within the Council’s internet site for reporting an allegation of fraud should be reviewed and updated. In addition, consideration should be given to the development of an online reporting function as an additional method for an individual to raise a concern of fraud to the Council. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Audit and Risk Manager Yes 31/03/2025 The information on the Council’s website for reporting fraud will be reviewed and updated. The timescale for implementation of this recommendation has been recorded as 31 March 2025 due to the need for updating web pages and the development of an online fraud reporting function which requires the support of the ICT Section. Page 66
Page 67
Appendix 1 7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3. Low As part of the audit planning of projects to be included within the Annual Audit Plan for 2023/24, a joint working arrangement was agreed with the internal audit service providers of NHS Grampian, Aberdeen City and Aberdeenshire Councils to review the Integration Joint Boards governance arrangements to prevent fraud and corruption. This has allowed for a more overarching review to be undertaken. As part of the joint audit working arrangement, this has also enabled the sharing of knowledge and information. The Financial Regulations of the MIJB were updated last year to include revised wording for reporting and investigating a suspected irregularity. However, it was noted that our neighbouring Councils had developed a “Counter Fraud Process” detailing best practices to follow in assessing a referral and investigating fraud. The occurrence of fraud is rare and the nature of each investigation can vary in nature, but consideration should be given to reviewing and if required, adapting this procedural document within Moray. Consideration should be given for the Internal Audit Section to develop a “Counter Fraud Process” procedure. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Audit and Risk Manager Yes 30/11/2024 The “Counter Fraud Process” already developed by a neighbouring Council will be used to prepare a similar procedural guidance document for the Moray Council. Page 67
Page 68
Appendix 1 8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4. Medium The Council’s Audit and Risk Manager is the appointed Chief Internal Auditor for delivering an internal audit service to the MIJB. MIJB delegated services are undertaken by Council and NHS Grampian officers and systems. Officers of both the Council and NHS Grampian are required to use the systems of each organisation to deliver services. The Audit and Risk Manager is responsible for investigating suspected irregularities within the Council, and the NHS Counter Fraud Authority investigates NHS Grampian's allegations of fraud. However, an issue may occur if an officer employed by the Council commits fraud involving an NHS system and vice-versa as to whether the allegation within the MIJB should be investigated by the Council’s Audit and Risk Manager or the NHS Counter Fraud Authority. The nature of the fraud may have a cross organisational implication regarding access to information and the individual officer's terms and conditions of employment from each organisation. Consideration should be given to the Audit and Risk Manager, in consultation with the Chief Internal Auditor of Aberdeenshire and Aberdeen City Councils, to discuss and if possible, agree on a protocol for the notification, investigation and reporting of alleged fraud within the Grampian IJBs with the NHS Counter Fraud Authority. This may require a “letter of understanding” detailing agreed arrangements for the fraud investigation. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Audit and Risk Manager Yes 30/11/2024 Contact will be made with the Chief Internal Auditor of Aberdeenshire and Aberdeen City Councils to discuss arranging a meeting with the NHS Counter Fraud Authority to agree a protocol for investigating fraud within the Grampian IJBs. Page 68
Page 69
Appendix 1 9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5. Medium At a Special Meeting of the Moray Council on 28 February 2024, it was decided to reduce the Internal Audit Section staffing budget by replacing the Corporate Investigations Officer’s post with a 0.5 full- time equivalent. The remaining budget was used to appoint an Assistant Auditor, but this proved unsuccessful, with no suitable applicants. The CIPFA Code of Practice on Managing the Risk of Fraud and Corruption requires that an “organisation should make arrangements for appropriate resources to support the counter fraud strategy” of the Council. This includes the need to detect fraud through data and intelligence analysis. The limited staff resources of the Internal Audit Section are appreciated, but consideration should be given to including a project within the Annual Internal Audit Plan to review systems and practices where fraud or irregularities have been reported within other organisations. During this review, it was noted that a financial fraud was reported in the media of an officer in another Local Authority embezzling over £1 million in council tax refunds. Further to consultation with the Council’s Taxation Manager, additional controls have been introduced to current operating arrangements. The Audit and Risk Manager should consider including a project within the Annual Internal Audit Plan to review Councill systems and practices where fraud has occurred within other organisations. Identification of the scope and testing to be undertaken will be determined from a review of fraud cases reported in the media, Audit Scotland Technical Bulletins and participation in the Scottish Local Authority Investigator's Group. The use of information data evaluation software should also be used in the analysis of information and databases. Page 69
Page 70
Appendix 1 10 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Audit and Risk Manager Yes 28/02/2025 A project will be included to support the Council’s and MIJB counter fraud and corruption arrangements in the Annual Internal Audit Plan. The scope of the audit and testing undertaken will be determined from frauds reported within other organisations. The use of IDEA® Data Analysis software will be further developed in the analysis of information used for audit testing. Page 70
Page 71
Appendix 1 11 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of noncompliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 71
Page 72
Appendix 1 12 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 72
Page 73
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 20 NOVEMBER 2024 SUBJECT: INTERNAL AUDIT REVIEW – MORAY GROWTH DEAL BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an internal audit review completed for the period from 11 September 2024 to 20 November 2024. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the internal audit review completed during the period 11 September 2024 to 20 November 2024 regarding the Moray Growth Deal: Moray Growth Deal 3.2 The Moray Growth Deal is a transformational programme of over £100 million, designed to drive economic growth across Moray over a ten year period. The Moray Growth Deal brings together the Scottish and UK Governments, Moray Council, partners from across the public and third sector, and businesses to work collaboratively to deliver the Deal’s vision for the area. Moray Council is the accountable body for the Growth Deal and has the responsibility to hold to account partner organisations in the delivery of the overall programme. 3.3 This audit reviewed the governance and administrative procedures for managing the Moray Growth Deal. A check was also made for a sample of grant claims for projects currently in delivery, including the verification of expenditure claimed by a partner organization to supporting evidence. Overall, from the audit undertaken and within the scope of this review, effective arrangements are in place for the governance and administration of Item 8. Page 73
Page 74
the Moray Growth Deal. The audit report for this project is given in Appendix 1. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-2045703626-509 / SPMAN-1042990102-275 Page 74
Page 75
Appendix 1 1 Final Internal Audit Report Moray Growth Deal October 2024 Distribution: Acting Head of Economic Growth & Development Moray Growth Deal Programme Manager Chief Financial Officer Senior Communications Officer The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 2 Substantial Priority 2 3 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Item 8. Page 75
Page 76
Appendix 1 2 Contents Page Moray Growth Deal 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-11 4. Management Response 5-12 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 76
Page 77
Appendix 1 3 1. Introduction and Audit Scope The annual audit plan for 2024/25 provides for a review of the governance and administrative procedures for the management of the Moray Growth Deal (the Deal). The Moray Council’s Internal Audit Service will overview the Deal programme and project activities, but each partner organisation is separately responsible for allocating internal audit resources for its specific project. The Moray Growth Deal is a transformational programme, designed to drive economic growth across Moray over a ten year period and is supported by £100 million of investment with £65 million being invested by the UK and Scottish Governments. The Deal brings together the UK and Scottish Governments and Moray Council, together with Partners from across the public, third sector, and businesses, to work collaboratively in delivering the Deal's vision for the region. This year, the Deal entered its fourth year of the ten year programme with four of the eight approved projects now in the delivery phase and three of the four having already made grant claim submissions to draw down funding. At the time of the audit review, the funding claimed for the Moray Growth Deal amounted to £5.2 million. The scope of the audit included a review of the governance and administrative arrangements surrounding the Moray Growth Deal. It also considered how partnership working is operating, the financial management of the Deal and how success is being measured. It is pleasing to report that from the testing undertaken and within the scope of this review, effective arrangements are in place for the governance and administration of the Moray Growth Deal. However, the following areas were identified for management attention: The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • The audit included testing on a sample of grant claims for projects currently in delivery and the expenditure claimed. The review found that in relation to one project, not all expenditure claimed had supporting documentation to evidence the payment. This concerned certain categories of expenditure relating to salary costs, overheads, travel/ subsistence and software related recharges. Page 77
Page 78
Appendix 1 4 • In accordance with the Moray Growth Deal Financial Plan, each Partner Organisation is separately responsible for allocating internal audit resources for Moray Growth Deal Activities. It was agreed within a previous audit report that each Partner Organisation should provide their Annual Audit Plans to the Moray Council for planned internal audit activity regarding the Moray Growth Deal. However, this requirement could be further supported with an annual meeting between the Internal Audit Services of the Council and Partner Organisation to review previous audits undertaken and to discuss and agree on the scope of future auditing activities. Page 78
Page 79
Appendix 1 5 Moray Growth Deal- 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. Medium The Communications Protocol was developed by the Moray Council Communications Team before the signing of the Deal. This document sets out an agreed framework for communication and engagement protocols for both proactive and reactive activities in relation to the Moray Growth Deal. The Protocol details that effective use should be made of My Moray web and social media sites to ensure members of the public are kept up to date on Moray Growth Deal news and developments. The audit appreciates the limited staff resources, but it was noted that during the audit period, news releases had not been posted to the My Moray website and social media postings can be infrequent. Further use should be made to post information on My Moray website and social media sites to ensure effective communication of any developments concerning the Moray Growth Deal. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Senior Communications Officer/ MGD Programme Manager Yes 31/12/2024 A lack of dedicated comms and engagement resource was flagged as a risk before the deal was signed and has continued to be an issue with ensuring continuous comms activity. However, information is shared in-line with project comms plans. Social media posts are shared when there is a relevant update and appropriate content – best practice is to only share updates when there is newsworthy content, otherwise Page 79
Page 80
Appendix 1 6 engagement rates will be negatively impacted. A publishing error on the website has now been rectified to ensure all releases are shared timeously. As more projects enter delivery and there is more content available to share publicly this will be done. Quarterly full deal public updates will also be introduced. Page 80
Page 81
Appendix 1 7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. Medium A Stakeholder Engagement Plan was developed in 2021 to detail the framework for engagement across all Moray Growth Deal projects with a key objective of promoting positive benefits for Moray and creating opportunities for stakeholders to influence the projects as they develop. The Plan details the need for regular review, however it was found there is no evidence of a formal review of this document. The audit also noted that the Stakeholder Engagement Plan requires engagement with targeted audiences to evidence the success of implementing Moray Growth Deal Projects. As more projects enter the delivery phase, it will become more important to obtain this data to evidence a success objective in supporting the realisation of benefits. The Stakeholder Engagement Plan should be reviewed and, if required, updated. Engagement should be undertaken with the targeted audiences for a project to evidence an established objective of the Moray Growth Deal. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment MGD Programme Manager / Senior Communications Officer Yes 31/03/2025 While engagement has been taking place at the appropriate stages of project development, the plan needs to be updated and have partner sign-off. Analytics, insights and evaluation are included in the comms tracker and will link to the updated engagement plan. Page 81
Page 82
Appendix 1 8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3. Low It was noted that a Communications Planner spreadsheet is used to organise and plan a communication strategy for all projects. The audit noted examples where fields within this spreadsheet regarding dates and explanatory information had not been completed. Better use could be made of the Communications Planner spreadsheet to support the management of the communication needs of the Moray Growth Deal more effectively. It was also found that not all communications related information is saved on the Moray Growth Deal Sharepoint site. In order to ensure consistency, all information concerning Deal activities should be saved on the Moray Growth Deal Sharepoint site. All fields within the Communications Planner spreadsheet should be completed to aid the communication management needs of the Moray Growth Deal. All communications related activities, where documented, e.g., press releases, should be saved on the Moray Growth Deal Sharepoint site. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Senior Communications Officer Senior Communications Officer Yes Yes Implemented Implemented The tracker has been refined to ensure all fields are relevant and information has been backdated where necessary to create a comprehensive record of comms actions undertaken. Now that the comms team has full access to the Sharepoint site, documentation can be kept updated through version controls. Page 82
Page 83
Appendix 1 9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4. High The audit reviewed a sample of grant claims for projects currently being delivered where expenditure has been claimed from Moray Growth Deal funding. It was noted that not all spending included in the claims from a partner organisation could be verified with supporting evidence. Invoices/receipts had been provided for some creditor payments, however, certain expenditure categories i.e. salary costs, overheads, travel/ subsistence and software application costs were not supported by claim forms or system back-up documentation. The audit also checked the type of payments included within the funding claimed by a partner organisation, as eligibility for reimbursement can depend on whether the expenditure is capital or revenue cost. It was noted that included within the claims are payments for subsistence, travelling and overheads, which are generally not considered as capital expenditure. However, it is appreciated the accounting rules detailing if expenditure can be capitalised are complex. All partner organisations should be informed that supporting evidence must be provided for all expenditure claimed from Moray Growth Deal funding. Further to the findings noted within the audit and discussions with the Chief Financial Officer, a review of the types of payments claimed by the partner organisation should be undertaken to ensure the correct classification of expenditure. Page 83
Page 84
Appendix 1 10 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Financial Officer Chief Financial Officer Yes Yes Immediate 31/12/2024 Partners are reminded of the requirement for audit evidence when claims are submitted and additional scrutiny given to the project in question A review of payment types will be undertaken to ensure compliance with the European System of Accounts 10 and in accordance with grant conditions. Page 84
Page 85
Appendix 1 11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5. Medium Further to an internal audit report issued in 2022, a recommendation detailed that 'Each Partner Organisation should provide their Annual Audit Plan to the Moray Council of planned internal audit activity regarding Moray Growth Deal activities. These plans should then be forwarded to the Audit and Risk Manager for Review'. At the time of this review, two partner organisations internal audit services have either delivered or are undertaking reviews regarding the delivery of Moray Growth Deal projects. Copies of each partner organisations annual audit plans had not been provided to the Moray Council Internal Audit Service. However, it is pleasing to note that one of the partner organisations internal audit services did forward details of the scope of a review to the Council’s Audit and Risk Manager, which does provide some assurance of the audit coverage undertaken of Moray Growth Deal project delivery. Partner organisations' internal audit services should be reminded to forward copies of their annual audit plans to the Moray Council regarding planned internal audit activity of Moray Growth Deal activities. This will allow the Moray Council, as the Accountable Body, to be consulted and contribute to the scope of the review. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment MGD Programme Manager / Senior Auditor Yes 31/03/2025 At the time of the audit 2 of the 4 Growth Deal projects led by partners were in delivery, with one having completed an internal audit at the end of 2023 (the details of which had been passed to the audit team) and the other project had only entered delivery in 2024. Page 85
Page 86
Appendix 1 12 Given different approaches to audit in the partner organisations, the PMO will work collaboratively with the Council’s Internal Audit Team to organise an annual meeting that seeks to: - Identify audit activity planned for the year ahead, securing audit plans ahead of the meeting when Moray Growth Deal activity is scheduled. - Review audit activity undertaken in the previous 12 months - Share learning and identify cross cutting issues that all partners should take account of when planning future activity It is expected that the first of these meetings will take place during Q4 24/25 FY and partners were briefed at the MGD Board on 26/09/24 of the need to support this. Page 86
Page 87
Appendix 1 13 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of noncompliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 87
Page 88
Appendix 1 14 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 88
Page 89
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 20 NOVEMBER 2024 SUBJECT: INTERNAL AUDIT CHARTER BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 To seek Committee approval for a revised Internal Audit Charter that defines the purpose, authority, and responsibility of the internal audit activity within the Council. 1.2 This report is submitted to the Committee in terms of Section III I (2) and (6) of the Council’s Scheme of Administration relating to the consideration of reports from the Council’s Internal Auditor and overseeing the independence, objectivity, performance and conformance to professional standards of Internal Audit. 2. RECOMMENDATION 2.1 The Committee is asked to consider and approve the revised Internal Audit Charter. 3. BACKGROUND 3.1 The Public Sector Internal Audit Standards (PSIAS) require the purpose, authority and responsibility of the internal audit activity to be formally defined in an Internal Audit Charter. The Internal Audit Charter establishes Internal Audit’s position within the Council; authorises access to records, personnel and physical properties relevant to the performance of engagements; and defines the scope of Internal Audit activities. 3.2 The PSIAS was developed by the Chartered Institute of Public Finance and Accountancy and the Chartered Institute of Internal Auditors and is mandatory for all providers of internal audit services in the public sector. The standards include a requirement for an External Quality Assessment (EQA) of internal audit once every five years and for the findings to be considered at a Council committee meeting. This was undertaken at the Audit and Scrutiny Committee meeting on 11 September 2024 (para 10 of minute refers). The overall conclusion of the external assessment was that Moray Council’s Internal Audit Service fully conforms with the PSIAS. Item 9. Page 89
Page 90
3.3 However, the EQA report included recommendations to update the Audit Charter to provide greater clarity regarding the Audit and Risk Manager position within the Council and to detail the separation of duties controls needed between internal auditing and risk management/ business continuity duties. The revised Internal Audit Charter has been updated and is provided in Appendix 1. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal Public sector bodies are required to adopt mandatory standards for internal audit and these call for the regular review and updating of an internal audit terms of reference document. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications Not having a formally agreed charter could mean the role of internal audit within the council is not clearly defined and understood, and technically is a non-compliance with the required standards. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations In accordance with the Public Sector Internal Audit Standards, consultation of the draft Charter has taken place with the Interim Chief Executive, Depute Chief Executive (Education, Communities & Organisational Development), Chief Financial Officer and the Head of Governance, Strategy & Performance and any comments incorporated into this report. 5. CONCLUSION 5.1 The Committee is asked to consider and approve the revised Charter document for internal audit to ensure ongoing compliance with recognised auditing standards. Page 90
Page 91
Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: DL/ASC/101124 SPMAN-2045703626-498 SPMAN-2045703626-499 Page 91
Page 92
Page 92
Page 93
APPENDIX 1 Governance, Strategy and Performance Internal Audit Charter Author: Audit and Risk Manager Date for review: May 2029 Item 9. Page 93
Page 94
1. Introduction 1.1 The Local Authority Accounts (Scotland) Regulations 2014 introduced a requirement for all Scottish Local Authorities to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Public Sector Internal Audit Standards (PSIAS), which came into effect in April 2013, and were updated in March 2017. These standards are largely based on the International Professional Practices Framework (IPPF). A requirement of the PSIAS is that all local authorities should have an Internal Audit Charter. 2. Definition and Purpose of Internal Auditing 2.1 The overarching “mission” of an Internal Audit Service is to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. Internal Auditing is defined in the PSIAS as ‘an independent, objective, assurance and consultancy activity designed to add value and improve an organisation’s operations. Internal Audit adds value to the organisation (and its stakeholders) by enhancing governance, risk management and internal control and objectively providing assurance. 2.2 As part of the meeting Moray Council’s system of corporate governance, Internal Audit’s purpose is to support the Council in its activities designed to achieve its declared objectives and to do so: In support of the Council’s vision, values and priority. As a contribution to the Council’s management of risks, including assisting management to improve the risk identification and management process in particular where there is exposure to significant regulatory, financial, strategic, reputational and operational risk to the achievement of the Council’s objectives. As an aid to ensuring that the Council and its elected members, employees and contracted third parties are operating within the law and relevant regulations and that public money is safeguarded and properly accounted for, and used economically, efficiently and effectively. As a contribution towards establishing and maintaining a culture of honesty, integrity, openness, accountability and transparency throughout the Council in all its activities and transaction. As a contribution towards ensuring that financial statements and other published performance information are accurate and reliable. Page 94
Page 95
2.3 Moray Council also provides an internal audit service to Moray Integration Joint Board (MIJB) and the Grampian Valuation Joint Board (GVJB). It will apply the same standards as defined in this Charter to any work undertaken for the MIJB and the GVJB, with separate Internal Audit plans and reports presented to their respective ‘senior management’ and ‘board’. 3. POSITION OF INTERNAL AUDIT WITHIN THE ORGANISATION 3.1 The Internal Audit Service is managed by the Audit and Risk Manager. The Audit and Risk Manager will report functionally to the Audit and Scrutiny Committee and administratively (i.e., day-to-day operations) to the Head of Governance, Strategy and Performance (the Council’s Monitoring Officer). The Audit and Risk Manager will have access to the Chief Executive, to all Council officers and to the elected members in connection with any relevant matter 3.2 The Audit and Risk Manager will also have unrestricted access to, and communicate and interact directly with any Council Committee, including in private meetings without management present. 3.3 The Audit and Scrutiny Committee is charged with responsibility for ensuring good stewardship of the Council’s resources, enhancing the profile, status and authority of Internal Audit and affirming its independence. Specifically, in relation to audit matters, the committee: Contributes to making the Council, its committees and services more responsive to the audit function and its purpose; Enhances good governance arrangements by promoting internal control and risk management by supporting an anti-fraud culture, and by the review of revisions to financial procedures; Has responsibility for focusing audit resources through agreeing to an annual programme of work; Monitors delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit; Considers the annual opinion provided by the Audit and Risk Manager on the adequacy and effectiveness of the control environment. 4. ORGANISATIONAL STATUS AND INDEPENDENCE 4.1 In terms of the PSIAS, the status of Internal Audit should enable it to function effectively, with recognition of the independence of Internal Audit that is fundamental to its effectiveness. Moray Council’s financial regulations detail that the Depute Chief Executive (Education, Communities and Organisational Development) is responsible for securing a continuous Internal Audit service to provide an independent and objective opinion on the control environment comprising risk management, internal control and governance. This remit is delegated to the Audit and Risk Manager. 4.2 Internal Audit will systematically review, appraise, make appropriate recommendations for improvement, and report upon: Page 95
Page 96
The efficacy of governance arrangements put in place to achieve the organisation’s objectives and priorities. The effectiveness of all internal controls and other arrangements put in place to manage risk, in particular where there is exposure to significant financial, strategic, reputational and operational risk to the achievement of the organisation’s objectives. The completeness, reliability and integrity of information, both financial and operational performance, including working alongside services in a ‘critical friend’ role to authenticate any self-assessment evidence of service performance and improvement. The systems formed to ensure compliance with policies, plans, procedures, laws and regulations whether established by the organisation or externally. The effectiveness of arrangements for safeguarding the organisation’s assets and interests, including fraud prevention controls and detection processes. The economy, efficiency and effectiveness with which resources are deployed. The extent to which services’ operational practices are being carried out as planned and objectives and goals are met. 4.3 Internal Audit’s work covers: All activities, systems, processes, policies and protocols that currently exist or under development. All records, personnel and properties. All services and other activities for which the organisation is responsible or accountable, whether delivered directly or by third parties through contracts, partnerships or other arrangements. Where the Audit and Risk Manager has or is expected to have roles and/or responsibilities that fall outside of Internal Auditing, safeguards will be established to limit impairments to independence or objectivity. 5. RIGHTS OF ACCESS 5.1 The Audit and Risk Manager and any member of the Internal Audit service are authorised in the performance of an audit engagement and have the authority to: Have access at any reasonable time to all computer systems and records (both paper and electronic). Page 96
Page 97
Require and receive explanations concerning any matter under examination from personnel relevant to their roles, including elected members or board members Enter at all reasonable times and without notice any properties provided that the terms of the lease are observed where such properties are leased to a third party. Require personnel to produce cash, stores, or other assets under their control. 5.2 Internal Audit safeguards all information obtained in the carrying out its duties, only uses it for defined purposes, and makes no disclosure of any information held, unless this is authorised or there is a legal/professional requirement to do so. 6. AUDIT RESOURCES AND WORK PRIORITISATION 6.1 The Moray Council’s Internal Audit Annual Plan, as approved by the Audit and Scrutiny Committee, is the primary determinant of the relative priority to be placed on each part of the work of Internal Audit, with Internal Audit Annual Plans specific to the MIJB and the GVJB being approved and monitored by their respective ‘senior management’ and ‘board’. The audit planning process, to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, includes consideration of the organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided. The Audit and Risk Manager determines the actual deployment of available resources covering the range and breadth of audit activity, which is integral to the assurance process across the activities of the Council, MIJB and GVJB in order to provide the statutory annual Internal Audit opinion to each organisation’s ‘senior management’ and ‘board’. This plan also requires to be sufficiently flexible to reflect the changing risks and priorities of each organisation. 6.2 The Audit and Risk Manager ensures that Internal Audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. Appropriate refers to the mix of qualifications, knowledge, skills and other competencies needed to perform the plan, such as compliance with the Code of Ethics set out in the PSIAS and with the Nolan principles established in the Seven Principles of Public Life. This is of particular importance and relevance for the profession of Internal Audit, founded as it is on the trust placed in its objective assurance about risk management, internal control and governance. 6.3 In the event that there is a need for additional audit work than there are resources available, the Audit and Risk Manager will identify the shortfall in the Plan and initially advise the Head of Governance, Strategy and Performance the Depute Chief Executive (Education, Communities and Organisational Development) followed by the Audit and Scrutiny Committee as required. It will be for the Audit and Scrutiny Committee to decide whether to accept the risks associated with the non-delivery of such audit work or to recommend to the Council that it requires Management to identify additional resources. Page 97
Page 98
6.4 Internal Audit responsibilities are not relieved in areas of the Council’s work that are subject to review by others, but reliance is placed on the work of other review agencies, principally the Council’s External Auditor, to avoid duplication, make the best use of resources and inform the overall assessment of governance arrangements. 7. MANAGEMENT RESPONSIBILITIES 7.1 Responsibility for internal control rests with Management, who must ensure that proper internal control arrangements are in place. Internal Audit’s role is to evaluate the effectiveness of such internal control arrangements. Management is responsible for accepting and implementing audit recommendations and bears any risk from not taking agreed action. Internal Audit is not a substitute for an effective system of internal control implemented by management. 8. COUNTER FRAUD WORK 8.1 The prevention and detection of fraud is a management function and management is responsible for implementing and maintaining suitable systems of control to mitigate the risk of fraudulent activity. In support of the Council's counter fraud arrangement, the Audit and Risk Manager will consider including a project within the Annual Audit Plan to review systems or practices where irregularities or fraud have been reported within other Local Authorities. Internal audit also supports the Council’s commitment to fraud prevention and detection by overseeing data matching exercises carried out under the National Fraud Initiative. The Council takes the threat of fraud or related malpractice seriously and has adopted a Policy to Combat Fraud, Theft, Bribery and Corruption. In addition, a Whistle-blowing Policy has been developed in consultation with the Human Resources service to facilitate the reporting of any concerns. 8.2 The Financial Regulations provide that whenever any matter arises which involves, or is thought to involve, irregularities concerning cash, stores or other property of the Council or any suspected irregularity in the exercise of the functions of the Council, any Officer having knowledge thereof, shall, as soon as possible, notify Internal Audit. 9. OBJECTIVITY AND CONFLICTS OF INTEREST 9.1 The Council’s Code of Conduct for Employees sets out the required standards for the conduct of all employees and includes provisions for the declarations of interests, gifts and hospitality. 9.2 The Internal Audit service preserves its independence and objectivity by ensuring that: staff are free from any conflicts of interest when undertaking assurance audits by following the requirements of relevant professional bodies and HR policies; and by providing clarity on duties undertaken during audit consultancy engagements to ensure these do not impact on Page 98
Page 99
assurance audits and do not impair its independence and objectivity. 9.3 The Audit and Risk Manager has managerial responsibility for the corporate functions and resources, which develop, support and advise on the frameworks in place within the Council on Risk Management, Business Continuity and on Counter Fraud to support Management. In order to prevent a perceived impairment of objectivity and to ensure that Internal Audit independence and impartiality are maintained and demonstrated, no Internal Audit resources will be used in the performance of these functions. 10. OTHER PARTIES OUTWITH THE COUNCIL 10.1 The Council’s Audit and Risk Manager is also the Chief Internal Auditor for the Moray Integration Joint Board and the Internal Auditor for the Grampian Valuation Joint Board. While separate and distinct governance arrangements apply to these bodies, the principles outlined in this Charter apply and are adopted in respect of all work completed by Internal Audit. 11. REVIEW 11.1 The PSIAS requires that the chief audit executive periodically reviews the Internal Audit Charter and presents it to senior management and also to the Board for approval. In this context, the chief audit executive is the Audit and Risk Manager, senior management is the Corporate Management Team, and the Board is the Audit and Scrutiny Committee. Dafydd Lewis Audit and Risk Manager September 2024 Page 99
Page 100
Page 100