Agenda Document Pack - Audit and Scrutiny Committee - 12/02/2025
Moray Council · 12 February 2025
Back to Audit and Scrutiny Committee — 12 February 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 12 February 2025 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 12 February 2025 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Resolution Consider, and if so decide, adopt the following resolution: "That under Section 50A (4) and (5) of the Local Government (Scotland) Act 1973, as amended, the public and media representatives be excluded from the meeting for Item 11 of business on the grounds that it involves the likely disclosure of exempt information of the class described in the relevant Paragraphs of Part 1 of Schedule 7A of the Act.” 4. Minutes of meeting of 20 November 2024 7 - 12 5. Written Questions ** 6. Internal Audit Section Update Report Report by Audit and Risk Manager 13 - 32 7. Internal Audit Review - Out of Area Placements Report by Audit and Risk Manager 33 - 48 8. Internal Audit Review - Treasury Management Report by Audit and Risk Manager 49 - 64 Page 1
Page 2
9. Internal Audit Review - Housing Rents Collection and Arrears Management Report by Audit and Risk Manager 65 - 78 10. Internal Audit Plan Year Ending 31 March 2026 Report by Audit and Risk Manager 79 - 108 Item(s) which the Committee may wish to consider with the Press and Public excluded 11. Internal Audit Review - St Giles Shopping Centre - Non- Domestic Rates [Para 6] • 6. Information relating to the financial or business affairs of any particular person(s); Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Watching the Meeting You can watch the webcast live by going to: http://www.moray.gov.uk/moray_standard/page_43661.html Webcasts are available to view for 1 year following the meeting. You can also attend the meeting in person, if you wish to do so, please come to the High Street entrance door and a member of staff will be let into the building. Page 2
Page 3
Page 3
Page 4
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be published on the Council’s committee management system by 4pm the day before the meeting. The Member who has put the question may, after the answer has been published, ask one supplementary question directly related to the subject matter at the meeting, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. Page 4
Page 5
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Scott Lawrence (Chair) Councillor Theresa Coull (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor John Divers (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Elaine Kirby (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor Shona Morrison (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 5
Page 6
Page 6
Page 7
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 20 November 2024 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Theresa Coull, Councillor John Divers, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Elaine Kirby, Councillor Scott Lawrence, Councillor Marc Macrae, Councillor Neil McLennan, Councillor Shona Morrison, Councillor John Stuart, Ms Margaret Wilson APOLOGIES Councillor Tracy Colyer IN ATTENDANCE Interim Chief Executive; Depute Chief Executive (Economy, Environment and Finance); Head of Governance, Strategy and Performance; Audit and Risk Manager; Head of Financial Services; Interim Chief Social Work Officer and Head of Service; Moray Growth Deal Programme Manager and Caroline O'Connor, Committee Services Officer, all Moray Council and Angela Pieri and Andrew Wallace, Grant Thornton - External Auditors. 1. Chair Councillor Lawrence, as Chair of Audit and Scrutiny Committee, chaired the meeting. 2. Welcome The Committee joined the Chair in welcoming Councillor Elaine Kirby to her first meeting of the Committee since being elected. 3. Declaration of Group Decisions and Members Interests * In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. With regard to Item 9 "Internal Audit Charter", Councillor Gatt stated, for transparency, that he is Convener of the Grampian Valuation Joint Board and would be taking part in the debate. Mr Augustus stated, for transparency, that he was carer representative on the Moray Integration Joint Board and was operating SDS and would be taking part in the debate. Item 4. Page 7
Page 8
4. Minutes of meeting of 11 September 2024 The minutes of the meeting of the Audit and Scrutiny Committee dated 11 September 2024 were submitted and approved. 5. Written Questions ** The Committee noted that no written questions had been submitted. 6. Internal Audit Section Update Report The meeting had before it a report by the Audit and Risk Manager providing Committee with an update on the work of the Internal Audit Section. In response to a question from Councillor Gordon relating whether there was capacity to undertake all the work areas in the Audit Plan (Appendix 1) identified as commencing in the next quarter, the Audit and Risk Manager advised two additional reviews had been requested since the report was written and he would be considering the impact of those on the Audit Plan and they may require to be moved into next year's Audit Plan. In relation to audit recommendation 5.02 on Appendix 2, Councillor Keith asked what the scale of unpaid invoices had been and if there was now a greater recovery date give that the recommendation had now been implemented. In response, the Audit and Risk Manager advised that at the time of the audit, there were outstanding invoices over 60 days with a cumulative value of £187,000 that still needed to be resolved. He confirmed the service were now undertaking aged date analysis allowing services to focus on debt that has been outstanding for any significant time and from follow-up testing it appeared issues were being identified and resolved more quickly. As a follow-up to the response from the Audit and Risk Manager to Councillor Gordon's question advising there were two additional areas to be included in the Audit Plan, Councillor Stuart asked for confirmation of the subject of the areas. In response, the Audit and Risk Manager confirmed they related to the St Giles Centre recovery of non-domestic rates and the other related to an issue of ordering windows for installation in Building Services. Councillor McLennan asked whether investigation of the Social Work Case which was the subject of his Written Question to the Committee on 11 September 2024 would be added to the Audit Plan. In response the Chair advised an email had been sent to all Elected Members asking if there was anything they wanted added to next year's Audit Plan. As a follow-up question, Councillor McLennan asked who had commissioned the two additional audits identified as requiring to be added to the Audit Plan. In response, the Interim Chief Executive confirmed the Chief Executive is permitted to request audits to be conducted where considered appropriate to do so in response to particular circumstances that occur. He further confirmed the two areas identified are relevant for investigation and it was important to be open and transparent with the findings of the investigations. In terms of the Committee fulfilling its scrutiny role, Councillor McLennan moved the social work case be added to the Audit Plan given the significant amounts paid out after the court judgement and sought a seconder. The Audit and Risk Page 8
Page 9
Manager advised initially consideration would require to be given to what investigations have already been undertaken by the service before anything was added to the Audit Plan. The Interim Chief Social Work Officer provided reassurance stating the case did not relate to a financial audit but to a human rights issue taken through the court process concerning social work process, practice and decision making and work was being undertaken on a learning and development programme. Councillor McLennan thanked the Interim Chief Social Work Officer for the reassurance provided regarding progress being made and confirmed he was happy to discuss scrutiny of the case with the Chair and Interim Chief Social Work Officer following the meeting. Following lengthy consideration the Committee unanimously agreed to note the report. 7. Internal Audit Review - Fostering and Kinship Care Payments The meeting had before it a report by the Audit and Risk Manager advising Committee on the work of the Internal Audit Section for the period from 11 September 2024 to 20 November 2024. In response to a question from Councillor Bloomfield relating to whether the two key issues in Appendix 1 had been rectified, the Audit and Risk Manager advised it would be the subject a follow-up review which would be reported back to the Committee in due course. Following consideration the Committee unanimously agreed to note the report. 8. Internal Audit Review - Governance Arrangements to Prevent Fraud and Corruption The meeting had before it a report by the Audit and Risk Manager advising the Committee on an internal audit review completed for the period from 11 September 2024 to 20 November 2024. In response to a question from Councillor Bloomfield asking when the Code of Conduct for Employee was last reviewed, the Head of Governance, Strategy and Performance advised he would check and provide the information to Committee In respect of partners projects where the Council has overall responsibility for audits such as the Moray Growth Deal, Ms Wilson asked where fraud and corruption is detailed. The Audit and Risk Manager advised it is covered within the condition of the agreement that if there are irregularities, they are required to inform the Audit and Risk Manager as the Chief Internal Auditor of the Moray Growth Deal, noting that each partner has their own audit requirements. In response to a question from Councillor Stuart relating asking if there was confidence that a protocol would be developed across agencies as detailed in the key issues of Appendix 1, the Audit and Risk Manager advised the audit will also be reported to the Moray Integration Joint Board. It is a significant recommendation that requires to be progressed supported by the joint working relationships already established. Following consideration the meeting unanimously agreed to note the report. 9. Internal Audit Review - Moray Growth Deal Page 9
Page 10
The meeting had before it a report by the Audit and Risk Manager advising Committee on an internal audit review completed for the period from 11 September 2024 to 20 November 2024. In response to a question from Councillor Bloomfield relating to audit recommendation 4 on Appendix 1 and whether payments will be withheld if supporting evidence is not provided, the Head of Financial Services confirmed payment has been withheld where satisfactory evidence has not been provided and payment has been made in during the following quarter following receipt of satisfactory evidence. Mr Augustus asked for assurance that the projects are on target for delivery of the outcomes given the scale of monies involved. In response the Moray Growth Deal Programme Manager advised a number of projects have entered the delivery phase and a revised benefits realisation monitoring plan is due to be submitted to the next Moray Growth Deal Board along with updates to the project monitoring plans to keep a close focus on the benefits to be realised. In response to a follow-up point from Mr Augustus that there would benefit from positive communications to ensure the public are kept updated about developments, the Moray Growth Deal Programme Manager advised while working with the governments there has been limited information available to share but as the projects enter delivery there will be the opportunity for more proactive messaging around growth activity and would include updating of the MyMoray website. Following consideration the meeting unanimously agreed to note the report. 10. Internal Audit Charter The meeting had before it a report by the Audit and Risk Manager seeking approval for a revised Internal Audit Charter that defines the purposed, authority and responsibility of the internal audit activity within the Council. In response to a question from Councillor Gatt relating to the review date of May 2029 being excessive, the Audit and Risk Manager confirmed the formal review would be in 2029 but it will be reviewed on an ongoing basis and reported to Committee annually as part of the Audit Plan. Following consideration the meeting unanimously agreed to approve the revised Internal Audit Charter. 11. Scottish Public Services Ombudsman Recommendations Report The meeting had before it a report by the Chief Executive asking the Committee to consider the Scottish Public Services Ombudsman (SPSO) Recommendations report. In response to a question from Councillor Keith relating to why the name of the complainant was published for to the last item in Appendix 1, the Head of Governance, Strategy and Performance apologised for the error and confirmed the name had now been redacted and the revised Appendix had been published with the agenda papers replacing the previous version. Page 10
Page 11
Following consideration the meeting unanimously agreed to approve the report at Appendix 1. Page 11
Page 12
Page 12
Page 13
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 12 FEBRUARY 2025 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2024/25 INTERNAL AUDIT PLAN Internal Audit Plan Update 4.1 The Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed in Appendix 1 is an update on the progress undertaken by the Internal Audit Section regarding the completion of audit review projects against the Annual Audit Plan. In addition, the Audit Plan also details the follow-up reviews to be undertaken to evidence the implementation of recommendations from previously agreed audit projects. However, this is not a complete listing of all follow-up reviews as dates for implementation may fall due outside the 2024/25 Audit Plan, or for operational reasons, it has been required to programme the Item 6. Page 13
Page 14
review for a later date. 4.2 The Internal Audit Section has been asked by senior management to undertake additional reviews regarding issues concerning the recovery of non-domestic rates and a purchase order within Building Services. Internal audit resources have also been required to support the Council’s counter-fraud and corruption arrangements. This was due to a decision by Moray Council on 28 February 2024 to reduce the Internal Audit Section staffing budget of the vacant Corporate Investigations Officer’s post to 0.5 full time equivalent (para 7 of minute refers). An attempt has been made to use the remaining budget to appoint an Assistant Auditor; however, this has proved unsuccessful. At the time of submitting this report, an Auditor post has been advertised on a part time basis. Unfortunately, the additional work requests and the reduced staff resources will impact on the completion of this year’s Audit Plan. There will be a requirement to carry forward the reviews of absence management and the testing of Payroll payments to next year’s Audit Plan. Global Internal Audit Standards 4.3 The Local Authority Accounts (Scotland) Regulations 2014 paragraph 7 requires that a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing’. The recognised standards adopted by all Scottish councils are the Public Sector Internal Audit Standards (PSIAS) developed by standard setters, including the Chartered Institute of Public Finance and Accountancy and the Chartered Institute of Internal Auditors. PSIAS requires a yearly quality assessment of internal audit systems and procedures against these standards. An external quality assessment of the Internal Audit Section was reported to this Committee on 11 September 2024 (para 10 of minute refers). 4.4 The Chartered Institute of Internal Auditors has recently released the Global Internal Audit Standards (GIAS). It is intended that the GIAS will be a replacement for PSIAS and provide a single source to guide the worldwide professional practice of internal auditing and serve as a basis for evaluating and further elevating the quality of the internal audit function. At the centre of the GIAS are 15 guiding principles. These principles are supported by standards that contain requirements, considerations for implementation and examples of evidence to demonstrate conformance. It is intended that a gap analysis of current systems and procedures against these new standards will be undertaken to identify areas for further development of the Internal Audit Section. This has required additional time to be included within the Audit Plan for 2025/26. National Fraud Initiative 2024/25 4.5 The National Fraud Initiative (NFI) is a data matching project conducted by the Cabinet Office on behalf of Audit Scotland every 2 years. The NFI shares and matches data held by public bodies and helps confirm that services and payments are provided to the correct people. Public bodies, including local authorities, are mandatory participants in this process. Each body is required to submit data it holds on individuals and businesses that receive public funds either as paid employees or suppliers of goods, works or services, or in the form of rates relief. Information is also provided on individuals with housing tenancies and housing waiting lists, taxi licence holders and recipients of blue badges. Page 14
Page 15
4.6 The 2024/25 NFI exercise commenced in September 2024 and an upload of data from the services to their website has been completed. The data-matching exercise results were made available in December 2024. The agreed approach will be for services to review a sample of each data set and document the reasons for the matches. The Internal Audit Section will then investigate any potential fraud, monitor progress and report to this Committee on the outcome and any other administrative requirements regarding the Council’s participation in the NFI. Chartered Institute of Public Finance and Accountancy (CIPFA) Publication – Audit Committees: Practical Guidance for Local Authorities and Police 4.7 The CIPFA Publication – Audit Committees: Practical Guidance for Local Authorities and Police sets out its guidance on the function and operation of audit committees in local authorities and police bodies and represents CIPFA’s view of best practices for audit committees in local authorities throughout the UK. 4.8 Audit Committees are a key component of an authority’s governance framework and provide an independent and high-level resource to support governance and strong public financial management. The guidance states the purpose of an audit committee is “to provide an independent and high-level focus on the adequacy of governance, risk and control arrangements. The committee’s role in ensuring that there is sufficient assurance over governance risk and control gives greater confidence to all those charged with governance that those arrangements are effective.” 4.9 CIPFA promotes that a good standard of performance against recommended practice, together with a knowledgeable and experienced membership, are essential requirements for delivering effectiveness. To this effect, CIPFA has provided a high-level review checklist in the form of a Self-Assessment of Compliance with the Good Practice Principles and an Evaluation of Effectiveness that incorporates the key principles set out in the CIPFA Publication – Audit Committees: Practical Guidance for Local Authorities and Police. 4.10 The Audit and Risk Manager facilitated a workshop with Audit and Scrutiny Committee members last year to complete a Self-Assessment and Evaluation Checklist. The findings and recommendations from this exercise were reported to the Audit and Scrutiny Committee on 14 February 2024 (para 9 of minute refers). In accordance with the CIPFA Guidance, the Audit and Risk Manager is planning to facilitate another workshop with members to review and complete the Self-Assessment and Evaluation Checklists. A copy of the full CIPFA Publication – Audit Committees: Practical Guidance for Local Authorities and Police will be shared with members in advance of the meeting. Follow Up Reviews 4.11 Internal Audit reports are regularly presented to Members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Page 15
Page 16
Forres Academy 4.12 An audit of the administrative arrangements within Forres Academy was undertaken. The scope of this audit was to undertake a review of the Devolved School Management Scheme in terms of the allocation of funding and the management of these funds at the School. In addition to undertaking an overview of how the School develops, monitors and controls its £5.1 million budget, the audit reviewed the management of the staffing costs involved in delivering the curriculum. The audit checked that non payroll expenditure complied with Financial Regulations and Procurement Guidelines. The review was also undertaken to ensure appropriate accounting arrangements are followed when managing School Fund monies. It was found that a recommendation concerning appointing an auditor for the School Fund was part implemented. As the School has appointed an external accountant to prepare the annual School Fund Financial Statements, it is not in accordance with accounting principles to also be the appointed auditor. However, the accountant has agreed to include an additional statement that the work undertaken in preparation of the annual accounts will include consideration of any unusual items or disclosures in the accounts and seek explanations from the School concerning any such matters. This should allow for any issue of concern to be highlighted and to meet the control requirement for the independent verification of the School Fund, but not for the recommendation to be detailed as “implemented.” The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 2. Payroll - Regularity Review 4.13 The Payroll system is one of the core financial systems of the Council. A follow- up review has been undertaken to evidence the implementation of recommendations reported in the audit undertaken of the payroll system. The scope of the audit included a review of the effectiveness of key controls in the management of the Payroll Service. This involved a review of systems and procedures and testing a random sample of starters, leavers and continuing employees to verify the accuracy of payments and to provide assurance that supporting documentation was in place to support the payments. The CIPFA Control Matrices were used to develop the audit programme. The follow up review found evidence to confirm the implementation of some of the recommendations, but a revised date for agreeing on a policy/procedure in the authorisation and administration of time off in lieu for officers was required. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 3. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications Page 16
Page 17
No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis, Internal Audit files Audit and Risk Manager Ref: Page 17
Page 18
Page 18
Page 19
APPENDIX 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2024/25 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries. Audit Review to be carried forward to a future Audit Plan Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations. Completed ICT Hardware Asset Management review of systems and practices to record / monitor the location and use of ICT hardware. Fieldwork in progress Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances. Year end stock valuations agreed OTHER SYSTEMS Area Type of coverage Housing and Property Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing). Fieldwork in progress The scope of the audit has been expanded from a request by the Corporate Management Team to review planned works for the replacement of windows for a contract. Item 6. Page 19
Page 20
Grant Claims Certification of grant claims as required: strategic timber; network support grant, regeneration schemes as appropriate Network Support Grant audit completed, and claim submitted to Transport Scotland (October 2023 to March 2024). Housing Rent Collection & Arrears Management A review of the income collection and accounting arrangements for housing rents. Completed Moray Growth Deal An audit review of the governance and administrative procedures within the Council for the management of the Moray Growth Deal. The scope will include the concerning partnership working, financial management and measuring success. Completed Education – Secondary School Establishment visits as part of cyclical review. Audit programmed to start in this quarter Treasury Management To provide assurance that processes and controls are continuing to operate effectively for the Council's treasury management system. Completed Commercial Refuse Collection To consider whether adequate control is in place covering trade waste income and expenditure, that appropriate agreements and other paperwork is in place, and that accounting arrangements are robust. Completed Governance arrangements to prevent Fraud and Corruption Overview of the Councils governance arrangements to prevent fraud and corruption. The audit will use the Cipfa Code of practice on managing the risk of fraud and corruption as the basis in developing the audit programme for the review. Completed Page 20
Page 21
Education- Secondary School Premises Security Review the controls in place to mitigate the risk of unauthorised access to Secondary School Premises. Fieldwork in progress Absence Management An audit to consider the effectiveness of sickness absence monitoring and reporting. Audit Review to be carried forward to a future Audit Plan Following the Public Pound To ensure that there is proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Completed Moray Integration Joint Board Residential Care An audit to review the adequacy of procedures and administrative arrangements regarding the third party suppliers appointed to provide care home services The audit will also include testing to verify the accuracy of the financial assessments and the charging for residential care of both respite and permanent care residents. Fieldwork in progress Out of area placement A review of the systems and procedures regarding adult services users that are out of area but responsibility remains to meet their eligible care and support needs under the Care Act. Completed Fostering and Kinship payments A review to ensure that the internal controls in place for administering Fostering and Kinship Care Allowances are operating effectively. Completed Page 21
Page 22
Follow Up reviews to be undertaken from previous Audit Assignments * Audit Review: Original Scope Status/ Comments Self Directed Support (SDS) – Option 1 This audit remit was to review Option 1 Direct Payments under the SDS scheme, where a payment is made by the local authority directly to a supported person for the provision of support. The scope of the audit was to ensure compliance with operating guidelines in the financial management of SDS packages, expenditure incurred is in accordance with the agreed budget and support plans, and surplus funds are recovered from service users where appropriate. Follow up review programmed to start in this quarter Self Directed Support (SDS) – Option 2/3 The scope of the audit was to review systems and procedures in the delivery and management of adult social care provided under Options 2 and 3 of the SDS scheme. This included examination of the processes to support individuals in determining their preferred care delivery option, contractual relationships with care providers, financial management and monitoring of individual care packages. Follow up review programmed to start in this quarter Building Services - Planned Maintenance Projects An overview was undertaken of how the annual planned maintenance programme is determined and the contract management arrangements of these projects by Building Services. The audit also involved a random selection of projects to verify costs can be evidenced Follow Up Review in progress Page 22
Page 23
to supporting documentation. Additional testing was also undertaken of the systems regarding the management and control of overtime paid to officers. Emergency Planning The objective of this audit was to provide assurance over the adequacy and effectiveness of current controls over emergency planning. The audit scope included a check to ensure adequate training, planning and testing has been developed in the event of an emergency. Follow up review programmed to start in this quarter Domestic Refuse Collection The scope of this audit was to review systems and procedures to ensure the most effective and efficient use is made of resources for the collection of domestic waste. The audit also checked the arrangements for disposing of recyclable waste. This included disposal of plastic, glass and biodegradable waste, in addition to paper / card, aluminium and steel cans for which the Council received regular payments from recycling contractors. Follow up review programmed to start in this quarter Pool Cars Scheme The scope of this audit was to review systems and procedures in the management and use of pool cars. Policies and procedures were checked to ensure they provide appropriate operating guidance to officers in the booking and use of pool cars. The audit included a review of arrangements for internal recharging to services and also Follow up review programmed to start in this quarter Page 23
Page 24
exploration if further use of pool cars could provide additional value for money opportunities to the Council. Moray Integrated Community Stores The audit reviewed the management of the Moray Integrated Community Stores. This included reviewing the procedures for ordering and issuing occupational therapy equipment to service users. In addition, a check was made to compare stock records to the actual equipment held within the Stores. Follow up review programmed to start in this quarter Keith Sports & Community Centre The audit scope reviewed the processes and procedures in place at the Keith Sports and Community Centre and evaluate the effectiveness of internal controls relating to income and expenditure. This involved the sample testing of individual transactions to ensure compliance with Regulations and Guidelines. In addition, an appraisal of working practices was also undertaken to assess if the Service was maximising the income due to the Council Follow up review programmed to start in this quarter Foster and Kinship Care Payments The audit scope reviewed policies and procedures for the management of fostering and kinship payment of fees and allowances are administered in accordance with these policies and procedures and are operating within budgetary control. Follow up review programmed to start in this quarter Page 24
Page 25
Early Learning and Childcare Premises Security The scope of the audit reviewed policies, procedures, and an appraisal of the security controls within nursery buildings and play areas. The audit included a review of guidelines issued centrally by the Early Learning and Childcare Service and instructions or handbooks that individual nurseries may have developed. The audit process involved selecting a sample of both Council and privately run nurseries to visit, where the actual security controls operating in practice were observed and tested Follow up review programmed to start in this quarter * Additional follow up reviews may be reported depending on the implementation dates detailed by Services for recommendation Page 25
Page 26
Page 26
Page 27
APPENDIX 2 Moray Council Internal Audit Section DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Forres Academy REPORT REF: 24'025 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Grant funding is effectively managed, monitored and applied for the intended purpose. 5.01 Current auditing arrangements of the School Fund should be clarified, and in accordance with the School Fund Regulations, an auditor appointed. Medium Yes 31/08/2024 Part Implemented- The appointed Accountant for the School Fund prepares the annual accounts from the records administered by school officers, giving a required degree of role separation. The accounts are prepared in accordance with best practice issued by the Institute of Chartered Accountants in Scotland and in compliance with ethical guidance. Whilst this does not Item 6. Page 27
Page 28
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation provide an audit opinion, the School Fund accounts are professionally prepared by the Accountant and involve a review of the accounting records kept by the School and a comparison of the accounts presented with those records. It also includes consideration of any unusual items or disclosures in the accounts and seeks explanations from them concerning any such matter. 5.02 A full reconciliation between the cashbook and bank statements should be undertaken every month, and evidence retained. Medium Yes Implemented Implemented - School Fund reconciliation procedures have now been amended to ensure full reconciliation takes place. 5.03 Investigation should be undertaken into using the Council network for saving confidential information, rather than within mobile storage devices. Medium Yes 31/08/2024 Implemented – New secure folders have now been set up on the council network and all confidential information previously held on mobile storage devices has been transferred to these. Page 28
Page 29
Moray Council Internal Audit Section 3 Page 29
Page 30
Page 30
Page 31
APPENDIX 3 Moray Council Internal Audit Section DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Payroll – Regularity Review REPORT REF: 24'023 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Key controls and processes are operating effectively in ensuring accurate salary payments to council employees that are accounted for correctly. 5.01 Notification of Appointment Forms should be completed for appointments of Newly Qualified Teachers. Medium Yes 31/08/2024 Implemented. 5.02 All budget managers should be reminded of the timely completion and submission of a ‘’Termination of High Yes 30/06/2024 Implemented. A reminder was included within the September Human Resources bulletin in relation to the complete, timely and accurate Item 6. Page 31
Page 32
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Employment Form’’ as soon as it is known that an officer is leaving the employment of the Council submission of documentation. A subsequent reminder is planned in 2025. 5.03 Procedures relating to Time Off In Lieu (TOIL) arrangements should be agreed. Medium Yes 31/10/2024 (Revised Implementation Date 30/04/2025) Part Implemented – A policy has been drafted and is currently progressing through the approval process. Page 32
Page 33
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 12 FEBRUARY 2025 SUBJECT: INTERNAL AUDIT REVIEW – OUT OF AREA PLACEMENTS BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an internal audit review completed for the period from 20 November 2024 to 12 February 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the internal audit review completed of Out of Area Placements regarding adult social care users during the period 20 November 2024 to 12 February 2025: Out of Area Placements 3.2 A review of the systems and procedures of people receiving adult care services who are Out of Area (OOA) was undertaken. The term “Out of Area” relates to an individual's care and support being delivered in a local authority area that is different from the local authority with the statutory responsibility for providing that care and support. In Health & Social Care Moray Adult Services, OOA placements are managed within Learning Disability, Mental Health, Physical and Sensory Disabilities and Older Persons Services. 3.3 The audit involved randomly selecting a sample of OOA placements to review the arrangements for the care delivery, ascertain the ordinary residence status and contract management agreements with care service providers. OOA placement costs reported by the Moray Integration Joint Board but charged to an NHS Grampian budget is outside the scope of this review. Overall, a “limited opinion” has been detailed as the assurance level for this review; audit Item 7. Page 33
Page 34
testing noted significant concerns regarding the progress undertaken in determining ordinary residence status for OOA placements and the contractual arrangements with care providers. The audit report for this project is given in Appendix 1. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: Page 34
Page 35
Appendix 1 1 Final Internal Audit Report Out of Area Placements December 2024 Distribution: Head of Adult Services Head of Children’s, Families & Justice Services Chief Financial Officer The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 3 Limited Priority 2 3 Priority 3 0 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Item 7. Page 35
Page 36
Appendix 1 2 Contents Page Out of Area Placements 1. Introduction & Scope 3 2. Key Issues 4 Detailed Report 3. Findings/Recommendations 5-11 4. Management Response 5-11 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 36
Page 37
Appendix 1 3 1. Introduction and Audit Scope The Internal Audit Plan for the 2024/25 year provides for a review of the systems and procedures of people receiving adult care services who are Out of Area (OOA). The term “Out of Area” relates to an individual's care and support being delivered in a local authority area that is different from the local authority with the statutory responsibility for providing that care and support. The reasons for individuals to receive care out with the Moray Council local authority area may be a need to be closer to family or a requirement for more specialist care that cannot be provided locally. However, responsibility, including costs to ensure the care provided to the OOA placement meets outcomes agreed upon within their Care and Support Plan, remains with Health & Social Care Moray as ordinary residence remains in Moray. Guidance for determining Ordinary Residence status is provided by the Scottish Government and supplemented by best practice procedures developed by Social Work Scotland. In Health & Social Care Moray Adult Services, OOA placements are managed within Learning Disability, Mental Health, Physical and Sensory Disabilities and Older Persons Services. Analysis of the Financial Management System noted expenditure of approximately £5.8 million in 2023/24. In addition, it was also noted the Moray Integration Joint Board (MIJB) Annual Accounts include OOA placements managed by NHS Grampian costing £1.8 million in 2023/24. The audit randomly selected a sample of OOA placements to review the arrangements for the care delivery, ascertain the ordinary residence status and contract management agreements with care service providers. The sample for testing was chosen from Learning Disability, Mental Health Needs and Physical & Sensory Disability Services. Annual expenditure within these services was noted at approximately £4.3 million for 45 individual OOA placements. Older Persons are not part of this selected sample, as an audit of Residential Care for Older Persons has been included as a separate review topic within the Internal Audit Plan for 2024/25. In addition, testing of OOA placement costs charged to MIJB but managed by NHS Grampian is outside the scope of this review. Overall, a “limited opinion” has been detailed as the assurance level for this review; audit testing noted significant concerns regarding the progress undertaken in determining ordinary residence status for OOA placements and the contractual arrangements with care providers. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Page 37
Page 38
Appendix 1 4 2. Key Issues • Determination of “Ordinary Residence” for people receiving services is crucial in deciding which local authority is required to meet the needs of adults with care and support needs. Whether the person is ordinarily resident in the area of the local authority is a key test in determining where responsibilities lie between local authorities for the funding and provision of care and support. It is appreciated that the determination of ordinary residence is complex and involves questions of both fact and degree regarding time, intention and continuity, which have to be taken into account. From the sample checked of OOA placements, weekly care and support costs were up to £5,786 per week, and have been residing out of Moray for a number of years. The audit review found examples of OOA placements where it is considered that further escalation was required to determine ordinary residence status, which has not been pursued timeously. Proactive management to review and highlight changes in circumstances of ordinary residence status of people receiving services should be undertaken regularly to ensure the responsibility for care delivery is allocated to the appropriate Local Authority. • Analysis of the Financial Management System (FMS) found that separately identifying expenditure on OOA placements is not readily distinguishable or reported in totality. Moray Integration Joint Board (MIJB) financial reports (2023/24) only record the cost of OOA placements of £1.8 million managed by NHS Grampian and charged to the MIJB. Expenditure on OOA placements managed through the Council’s FMS of approximately £5.8 million per annum is not separately detailed but included within other reported budget headings. Consideration should be given to reporting the overall cost in the delivery of OOA placements by the MIJB, irrespective of budgetary responsibility. • From the sample checked, approximately a third of OOA placements managed by various social work teams had no formal contract with the service providers to deliver support and care to the person receiving the service. There is a need to ensure appropriate contract and performance monitoring arrangements are formalised for all OOA placements. Page 38
Page 39
Appendix 1 5 Out of Area Placements - 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. High The audit found that payments for OOA Placements could not be readily identified from an analysis undertaken of the Financial Management System, either as a gross expenditure cost or within each social work team. Significant analysis was required as part of the audit to identify OOA Placement expenditure. Health & Social Care Moray OOA placement expenditure is allocated to each social work team budget for Learning Disabilities, Mental Health Needs, Older People, and Physical & Sensory Disabilities. Expenditure is included within the total spend per these sectors in the MIJB Joint Finance Report used for reporting budget monitoring to the Board. It was noted that the Joint Finance Report does have a separate line entitled OOA Placements; however, these only detail expenditures for OOA placements managed by NHS Grampian. For 2023/24, the Joint Finance Report details OOA placement expenditure of £1.8 million, but there is also an additional £5.8 million of OOA placement expenditure as part of social work teams budget headings. Health & Social Care Moray governance arrangements would benefit from greater transparency in the financial reporting arrangements to ensure more effective monitoring of OOA placement expenditure. Consideration should be given to further developing the financial monitoring and reporting arrangements to allow for improved monitoring and scrutiny of all OOA expenditures. Page 39
Page 40
Appendix 1 6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Financial Officer Yes 30/06/2025 NHS Out of Area placements are all in one budget, council teams are split amongst many budgets. A dynamic register of placements being developed will allow for easy identification and the Care First system will need to be regularly updated by teams to ensure correct reporting. All Out of Area packages will be recoded to allow for easy identification on financial systems and Care First. Page 40
Page 41
Appendix 1 7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. Medium For an audit review to select a sample for testing, there is a need to ensure that the total population can initially be identified. However, for this review, the Auditor was required to undertake considerable work within each social work team and analysis of the Financial Management System to compile a definitive listing of all OOA placements managed within Health and Social Care Moray. The separate identification of OOA Placements within data systems would assist in the monitoring and management of these commonly high-cost placements. From the sample checked, the audit noted that the weekly cost of care provided to OOA placements was up to £5,786 per week. Consideration should be given to developing OOA placement registers / listings within each social work team to ensure OOA placements are visible for management to review. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Adult Services and Head of Children’s, Families & Justice Services Yes 31/01/2025 Dynamic Register of all Out of Area placements, collating all costings and review dates, has been compiled and is awaiting ratification. This register will be reviewed at regular fortnightly High Cost Packages board meetings. The register will allow for accurate reporting to the IJB Board. Page 41
Page 42
Appendix 1 8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3. High The audit randomly selected 12 OOA placements for testing. It was found that in a third of placements across various social work teams, no formal contracts were in place with the care and support service providers. While monitoring of the placements is undertaken by social work teams, without a contractual agreement, there is the risk of differing expectations, accompanied by a lack of formal monitoring of the engagement and overall service provider performance. The current contractual position of all OOA Placements should be reviewed. Where contracts with service providers are not in place for the delivery of care and support to people receiving the service, referrals should be made to the Adult Care Commissioning Section for appropriate contract and monitoring arrangements to be established. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Adult Services and Head of Children’s, Families & Justice Services Yes 30/06/2026 All Out of Area placements to receive interim Service Level Agreement or contracts that impose regular review periods. Page 42
Page 43
Appendix 1 9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4. High The audit has checked a sample of OOA placements and reviewed the process for deciding ordinary residence status. The determination of ordinary residence is crucial in determining which local authority is required to meet the care needs of people receiving the service. The audit noted examples of OOA placements where further escalation is necessary to establish ordinary residence status, but this has not been pursued. In addition, it was also found that communication in the determination of ordinary residence had been entered into with other local authorities, which has resulted in protracted delays in progressing transfers of responsibilities. An example was noted where discussion with another local authority regarding agreement of Ordinary Residence Status for an OOA placement has been ongoing for approximately 5 years. An exercise should be undertaken to identify all OOA placements where ordinary residence status requires to be further clarified. This may require more proactive communication with other local authorities or, if necessary, through Scottish Ministerial involvement to determine responsibility. It is important to ensure not only the most effective supervision of care delivery is provided to the person receiving the service but also that the responsibility for the financial cost of the OOA placement care and support is regularly reviewed to ensure it is the responsibility of the appropriate local authority. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Adult Services and Head of Children’s, Families & Justice Services Yes 31/03/2025 Regular ordinary residence meetings with legal support are being scheduled as part of an overall review schedule. All reviews will now go via the fortnightly High Cost Package group, with review dates set and monitored. A schedule of all reviews will be established and monitored with quarterly reporting to the Chief Financial Officer. Page 43
Page 44
Appendix 1 10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5. Medium Social work teams have different authorisation practices regarding the initial OOA placement approval and subsequent invoicing arrangements. Authorisation of placements can involve Team Resource Allocation Meetings, a recently formed High Cost Packages Meeting forum and a Resource Management Group. It was also noted that different procedures can be followed, for example, by Mental Health who are not subject to the same resource allocation processes due to generally not requiring places in the same establishments as the Area Teams dealing with Older Persons and Physical and Sensory Disabilities. The need to review and formalise authorisation practices regarding care packages was also included within a previous internal audit report of SDS Option 2 & 3 management. A review to agree consistent arrangements for authorising individual OOA placements should be undertaken. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Adult Services and Head of Children’s, Families & Justice Services Yes 02/12/2024 All new placements, including mental health, are to be scrutinised via High Cost Packages group which sits every two weeks. Resource Management Group (RMG) then make decision whether to accept placement. Appeals are in the first instance to RMG, then to senior management team if necessary. The review schedule identified will form a regular agenda item for High Cost Packages meetings. Page 44
Page 45
Appendix 1 11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6. Medium Care and Support Plans are developed for each OOA placement detailing agreed outcomes. Procedures detail that Care and Support Plans should be reviewed annually to ensure the agreed care is being provided and continues to meet the supported person's assessed needs. Audit testing of a random sample of 12 OOA placements found that 5 had not received annual reviews. This is an audit finding that has already been highlighted in a number of other social care audits where the requirement to review the Care and Support Plans of people receiving services was noted. Care and Support Plans for people receiving services should be reviewed annually in accordance with agreed procedures. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Adult Services and Head of Children’s, Families & Justice Services Yes 31/12/2025 A review schedule to be established with care and support plans being part of this. SDS and care package reviews as part of efficiencies strategies will be considered alongside the out of area package reviews. A full register with review dates will be available by end January 2025. Page 45
Page 46
Appendix 1 12 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of noncompliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 46
Page 47
Appendix 1 13 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 47
Page 48
Page 48
Page 49
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 12 FEBRUARY 2025 SUBJECT: INTERNAL AUDIT REVIEW – TREASURY MANAGEMENT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an internal audit review completed for the period from 20 November 2024 to 12 February 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the internal audit review completed of Treasury Management during the period 20 November 2024 to 12 February 2025: Treasury Management 3.2 A review has been undertaken of the procedures and controls in place within the Council regarding the operational management of the treasury management function. The overall objective of the audit was to ensure the Council has procedures and controls in place to ensure compliance with the requirements of borrowing and treasury management rules within the Chartered Institute of Public Finance and Accountancy (CIPFA) Code of Practice on Treasury Management in the Public Services 2021, which defines the policies and objectives for treasury management activities and the CIPFA Prudential Code for Capital Finance in Local Authorities 2021. 3.3 The management of treasury management activities is the responsibility of the Chief Financial Officer. However, this is undertaken within the constraints of the Treasury Management Policy, which sets out the policies and objectives of the treasury management activities and within an annual report provided to the full Council on the strategy, plan, and performance of the treasury management Item 8. Page 49
Page 50
function. Overall, within the scope of the audit, it was found that the delivery of the treasury management function was generally in accordance with agreed policies and practices. However, some administrative improvements were noted. The audit report for this project is given in Appendix 1. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: Page 50
Page 51
1 Final Internal Audit Report Treasury Management January 2025 Distribution: Chief Financial Officer Finance Manger Assistant Manager – FMS & Banking The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 0 Substantial Priority 2 2 Priority 3 3 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. APPENDIX 1 Item 8. Page 51
Page 52
2 Contents Page Treasury Management 1. Introduction & Scope 3 2. Key Issues 4 Detailed Report 3. Findings/Recommendations 5-11 4. Management Response 5-11 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 52
Page 53
3 1. Introduction and Audit Scope The annual audit plan for 2024/25 provides for a review of the Council's treasury management function. Treasury management is described by the Chartered Institute of Public Finance and Accountancy (CIPFA) as the management of an organisation’s investments and cash flows, its banking, money market and capital market transactions; the effective control of the risks associated with those activities and the pursuit of optimum performance consistent with those risks. The overall objective of the audit was to ensure the Council has procedures and controls in place to ensure compliance with the requirements of borrowing and treasury management rules within the CIPFA Code of Practice on Treasury Management in the Public Services 2021, which defines the policies and objectives for treasury management activities and the CIPFA Prudential Code for Capital Finance in Local Authorities 2021. CIPFA’s Code of Practice for Treasury Management in the Public Services 2021 (Code) derives its legal status from the Local Government in Scotland Act 2003. The Code recommends that all public service organisations create and maintain a treasury management policy statement, stating the policies, objectives and approach to risk management of its treasury activities. Testing undertaken to meet this audit objective has been to assess the extent to which there are adequate controls and procedures in place to provide effective control over loans and investments, in particular: • Adequate procedures exist for the administration of treasury management; • Loans and borrowing comply with the Treasury Management Policy; • Adequate authorisation controls and contingency arrangements exist • Interest calculations are accurate and appropriately recorded; • Adequate fidelity cover is provided for officers involved in loans management and accounting; • Appropriate treasury management information is made available to relevant officers/management. It was noted that as at 31 March 2024, the Council held £105 million in short term borrowing, £154 million in long term borrowing and approximately £10 million in short term investments. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Page 53
Page 54
4 2. Key Issues • The CIPFA Code of Practice on Treasury Management in the Public Services 2021 (Code) recommends various reporting requirements regarding the Council’s treasury management policies, procedures and performance. It is pleasing to note that in accordance with the Code, an annual report on treasury management strategy, plans and performance is provided to the full Council. However, the audit review noted that the Code also details further reporting requirements of a “mid-year review” of treasury`` management activity to the full Council. In addition, the Code recommends that consideration should be given in reporting treasury management policies and practices to an Audit and Scrutiny Committee to allow additional scrutiny of treasury management activity as part of good governance arrangements. • In accordance with the Financial Regulations, the Council has adopted the requirements detailed within the CIPFA’s Code of Practice for Treasury Management in the Public Services. The Chief Financial Officer should create and maintain suitable Treasury Management Practices, setting how the policies and objectives contained within the Policy Statement shall be achieved and prescribing how these activities shall be managed and controlled. It is pleasing to report that the Council's Treasury Management Practices have been reviewed and updated in 2022 to reflect the requirements of the revised Code in 2021. However, on reviewing the Treasury Management Practices against the Code, it was noted that further reference to environmental, social, and governance is needed as additional investment considerations. In addition, Treasury Management Procedures should include a review date to facilitate any updates required from changes in organisational and staffing structures. Page 54
Page 55
5 Treasury Management - 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. Low The Council details how it manages, delivers and controls its treasury management activities within a procedural document called Treasury Management Practices, which reflect the requirements of CIPFA’s Code of Practice for Treasury Management in the Public Services. In accordance with Financial Regulations, the Chief Financial Officer is responsible for creating and maintaining these Treasury Management Practices (TMP). The audit found that the TMP was reviewed and updated in 2022 to reflect the requirements of the revised CIPFA’s Code of Practice for Treasury Management in the Public Services in 2021. However, it was noted that no review date is recorded within the TMP for reviewing and if required, updating the procedures to reflect any organisational or staffing changes. Consideration should be given to setting a review date for reviewing the Treasury Management Practices to ensure they are regularly reviewed to also reflect, if required, any internal organisational or staffing changes in the management of treasury activities. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Finance Manager Yes 31/03/2026 Treasury Management Practices will be reviewed and updated to reflect the recent restructure in Financial Services. A future review date will be included in this update. Page 55
Page 56
6 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. Medium In accordance with the CIPFA Code of Practice on Treasury Management in the Public Services 2021 (Code), the Council provides an annual report on the strategy, plan and performance of its treasury management function to the full Council. However, on reviewing the Code, it was noted there are also reporting requirements that as a minimum the full Council should also receive: • “a mid-year review” report detailing its treasury management activities; and the performance of the treasury management function. • “The board/council, or the committee to which some treasury management responsibilities are delegated, will receive regular monitoring reports on treasury management activities and risks.” This is currently not being undertaken. Quarterly treasury management performance reports were previously provided to members through the members portal, but due to staffing vacancies within the Accountancy Service, this had not been undertaken for 2024. In accordance with the CIPFA Code of Practice on Treasury Management in the Public Services 2021, a 6 monthly treasury management activities and performance report should be provided to the full Council. Consideration should also be given to the full Council or a delegated Committee to receive regular monitoring reports on treasury management activities and risks. Page 56
Page 57
7 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Finance Manager Yes 31/11/2025 In accordance with the requirements of the CIPFA Code of Practice on Treasury Management in the Public Services 2021, a mid-year review of treasury management activities will be reported to the full Council in the future. Page 57
Page 58
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3. Low Financial Regulations 8.2 details: “A Treasury Management Policy Statement, stating the policies and objectives of the Council’s Treasury Management activities shall be adopted by the Council in accordance with Section 4 of the Code.” The CIPFA Code of Practice on Treasury Management in the Public Services 2021 (Code), section 6, notes that “an organisation’s treasury management policy statement adopts” a recommended form of words “to define the policies and objectives of its treasury management activities”. A review of the wording used within the Moray Council Treasury Management Policy Statement noted it is from a previous version of the Code. The Treasury Management Policy Statement should be updated to reflect the current recommended format detailed within the CIPFA Code of Practice on Treasury Management in the Public Services 2021. In addition, Financial Regulations point 8.2 should updated to reference Section 6 of the Code rather than “Section 4”. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Finance Manager Yes 31/05/2025 The Council's Treasury Management Policy Statement will be updated in accordance with the requirements of the CIPFA Code of Practice on Treasury Management in the Public Services 2021. Financial Regulations will also be amended to refer to Section 6 of the Code. Page 58
Page 59
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4. Low The CIPFA Code of Practice on Treasury Management in the Public Services 2021, Treasury Management Practice 1, Credit and Counterparty Risk Management section details a need for an “organisation's credit and counterparty policies should set out its policy and practices relating to environmental, social and governance (ESG) investment considerations.” A review of the Council’s Treasury Management Practices noted no reference to ESG for any investment considerations. However, the Code details this is still a “developing area, and it is not implied that the organisation’s ESG policy will currently include ESG scoring or other real-time ESG criteria at individual investment level”. . In accordance with the CIPFA Code of Practice on Treasury Management in the Public Services 2021, consideration should be given to updating the Council’s Treasury Management Practices to include references to environmental, social and governance as additional factors in any investment decisions. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Finance Manager Yes 31/12/2025 Treasury Management Practices will be amended to include environmental, social and governance considerations as additional factors in investment decisions. Page 59
Page 60
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5. Medium It was noted that the CIPFA Code of Practice on Treasury Management in the Public Services 2021 (Code)- TMP6 Reporting Requirements and Management Information Arrangements, details as a minimum requirement: “The body responsible for scrutiny, such as an audit or scrutiny committee, will have responsibility for the scrutiny of treasury management policies and practices.” It is appreciated that in accordance with the requirements of the Code an annual report on the strategy, plan and performance of the treasury management function is provided to the full Council. However, as noted above, the Code details a role for the Audit and Scrutiny Committee to undertake further scrutiny of treasury management policies and practices. For noting, it was also noted that the CIPFA's Audit Committees: Practical Guidance for Local Authorities and Police 2022 also detailed that some authorities have nominated a function for their audit committees to include: “Reviewing the treasury management policy and procedures to be satisfied that controls are satisfactory”. Consideration should be given in reporting treasury management policies and practices to the Audit and Scrutiny Committee. It is appreciated that reporting of treasury management activity is already provided to the full Council; however governance arrangements could be further strengthened in scrutinising the Council‘s treasury management service at the Audit and Scrutiny Committee. Page 60
Page 61
11 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Finance Manager Yes 31/12/2025 In accordance with the CIPFA Code of Practice on Treasury Management in the Public Services 2021, Treasury Management Policies and Practices will also be reported to the Audit and Scrutiny Committee for review by Members. Page 61
Page 62
12 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of noncompliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 62
Page 63
13 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 63
Page 64
Page 64
Page 65
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 12 FEBRUARY 2025 SUBJECT: INTERNAL AUDIT REVIEW – HOUSING RENTS COLLECTION AND ARREARS MANAGEMENT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an internal audit review completed for the period from 20 November 2024 to 12 February 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the internal audit review completed of Housing Rents Collection and Arrears Management during the period 20 November 2024 to 12 February 2025: Housing Rents Collection & Arrears Management 3.2 As part of the 2024/25 Internal Audit Plan, the housing rents income collection and accounting arrangements have been reviewed. This included a review of the debt recovery arrangements for rent arrears of both current and former tenants. The objective of the audit was to check that effective controls and procedures were in place regarding the administration of rent accounts in accounting for all income received. The review forms part of the yearly audit coverage of core financial systems. It was noted that housing rents within Moray have an annual budgeted income of £25.1 million from approximately 6,380 properties. The audit report for this project is given in Appendix 1. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan Item 9. Page 65
Page 66
(LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: Page 66
Page 67
Appendix 1 1 Final Internal Audit Report Housing Rent Collection & Arrears Management January 2025 Distribution: Head of Housing and Property Area Housing Managers Housing Strategy & Development Manager Housing Operations Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 0 Substantial Priority 2 2 Priority 3 1 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Item 9. Page 67
Page 68
Appendix 1 2 Contents Page Housing Rent Collection & Arrears Management 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-9 4. Management Response 5-9 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 68
Page 69
Appendix 1 3 1. Introduction and Audit Scope The 2024/25 annual internal audit plan provides for an audit review to be undertaken of the housing rents income collection and accounting arrangements. Housing rents within Moray raises budgeted income of £25.1 million per annum, from approximately 6,380 properties. The review forms part of the yearly audit coverage of core Council systems. The audit scope was to review the key operational controls regarding rent collection and arrears management of current and former tenant rents. The aim of the audit was to look at the controls and processes existing over the administration of rent accounts, accounting fully and promptly for monies collected. The accounting interface between the Housing Rents system and the Council's Financial Management System was also reviewed. The audit also checked the arrears management arrangements to ensure a robust system exists of rent arrears identification, escalation actions and collection. The timescale covered for audit testing undertaken was 2024/25, but reference to the full 2023/24 financial year is made when applicable. It was noted that rent arrears amounted to £926,000 as at 31st March 2024, with £749,000 relating to current tenants and £177,000 in respect of former tenancies. Analysis indicates an increasing trend in rent arrears over recent years, which may be due to external factors such as Covid recovery, cost of living, and the system of Universal Credit making payments in arrears. However, it was found Moray has continued to perform well when compared to national averages and other local authorities, with arrears of 4.7% of rent due in 2023/24. It is pleasing to report that in general, the audit has confirmed well established practices to be in place in administering housing rent accounts and accounting for monies collected, with strong audit trails seen in evidencing actions taken in the continual cycle of monitoring and pursuing rent arrears. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • Overall, the audit found that within the scope of the review, the housing rent system is well managed. However, it was found that the Council's Rent Arrears Policy has not been reviewed since its agreement by the Communities Committee in October 2013. It is appreciated that effective administrative procedures are followed in Page 69
Page 70
Appendix 1 4 the recovery of rent arrears, but the Policy should be reviewed and if required, updated to reflect activities and responsibilities involved where tenant rent accounts of both current and former tenants are in arrears. • The Rent Arrears Management Guide details procedures to be undertaken to recover rent arrears through the issue of reminder letters to tenants at specific timed intervals. Audit testing of a sample of rent arrears cases has identified examples of where the rent arrears recovery approach taken by officers has involved the use of emails, texts and calls to tenants rather than following agreed procedures in issuing formal reminder letters to tenants. It is appreciated that the Service is exploring different methods to maximise recovery of rent arrears, but from the audit testing of individual rent arrears cases, there is a lack of consistency in the following of established procedures. Page 70
Page 71
Appendix 1 5 Housing Rent Collection & Arrears Management- 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1. Medium The Council's Rent Arrears Policy was agreed by Communities Committee in October 2013. The Policy describes the broad activities and responsibilities involved where tenant rent accounts of both current and former tenants are in arrears, and applies to all rented property owned or managed by the Housing Service. Detailed operational procedures have been developed to support this Policy. It was also noted that the Policy document stated that the next review was due in 2015, but from discussions with the Service, it was found this had not been undertaken due to limited staff resources and prioritisation of work. The Rent Arrears Policy is still relevant but should be reviewed and if required, updated. The Rent Arrears Policy should be reviewed and if required, updated, with communication thereafter to all relevant parties. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Housing Operations Manager Yes 31/12/2025 A review of both the Rent Arrears Policy and Evictions Policy has been scheduled in the Policy Team’s work plan for 2025, to be led by a member of the Housing Management Team. Page 71
Page 72
Appendix 1 6 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2. Medium The Rent Arrears Management Guide is a procedural document detailing a requirement to issue a sequence of reminder rent arrears letters to tenants at specific timed intervals to stimulate payment. For current tenant arrears management, this involves the issue of 4 reminder letters before a Notice of Proceedings can be requested to advance to legal action, if appropriate. Sample audit testing has identified examples of inconsistent approaches being employed across the Service whereby more informal methods of communication such as email, texts and calls have been utilised in attempting to engage tenants, rather than the issue of the formal reminder letters at the specified intervals. Whilst comprehensive audit trails have been seen in the recovery action undertaken by officers in engaging with tenants for the payment of rent arrears, examples were noted where there is a lack of consistency in the following of established procedures. . The established sequence of formal reminder letters should be issued to all tenants in arrears, without delay, when the appropriate circumstances pertain. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Area Housing Manager Yes 31/12/2025 The rent arrears procedure will be reviewed as part of the wider review of the Rent Arrears Policy. This will include a review of the formal reminder letters issued to tenants as part of the rent Page 72
Page 73
Appendix 1 7 arrears escalation process. In the meantime, Area Housing Officers will be reminded by 31/01/2025 that the rent arrears escalation policy must be followed and actions completed on rent accounts each week. This will be monitored by the Area Housing Managers. Page 73
Page 74
Appendix 1 8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3. Low The terms detailed within a housing tenancy agreement is a requirement that rent is payable by a tenant in advance on or before the Monday of each week. In the audit testing of a sample of rent accounts, a number of tenants, particularly those in receipt of Universal Credit, have been seen to be in rent arrears at some points during a month, but with the arrears being cleared on receipt of a payment towards the end of the month, then accumulating again until the next rent payment is made. Examples have been seen where no valid repayment arrangement has been agreed with the tenant to build a small credit balance to eliminate the occurrence of the rent arrears position. Whilst arrears in these cases remain at a low level due to regular rent payments, the tenancy terms are not being adhered to. A review should be undertaken to confirm repayment arrangements are being entered into with all applicable tenants, ensuring advance payment tenancy terms are adhered to. All repayment arrangements agreed should be formally documented within the NEC Housing system. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Area Housing Manager Yes 31/12/2025 The management of rent accounts in arrears, particularly for accounts where tenant/s are in receipt of Universal Credit will be included in the updated rent arrears procedure. In the meantime, Area Housing Officers will be reminded by 31/01/2025 that all rent accounts regardless of how the tenant/s rent is paid, should be paying in advance as per the Page 74
Page 75
Appendix 1 9 Scottish Secure Tenancy Agreement. Repayment agreements (RPA) to be sought to address balances where the tenant/s is unable to clear the balance outstanding in full. RPA’s to be logged on NEC Housing system and confirmation sent to tenants. Area Housing Managers will monitor accounts for these actions being completed. Page 75
Page 76
Appendix 1 10 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of noncompliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 76
Page 77
Appendix 1 11 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 77
Page 78
Page 78
Page 79
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 12 FEBRUARY 2025 SUBJECT: INTERNAL AUDIT PLAN YEAR ENDING 31 MARCH 2026 BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 This report provides the Committee with details of the planned internal audit coverage for the year ending 31 March 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (7) of the Council’s Scheme of Administration relating to reporting on internal audit’s programme of work. 2. RECOMMENDATIONS 2.1 The Committee is asked to consider and: i) note the proposed internal audit coverage for the 2025/26 financial year; and ii) seek clarification on any matters arising from the report or from the proposed Internal Audit Plan for 2025/26 attached as Appendix 1. 3. BACKGROUND 3.1 The Public Sector Internal Audit Standards (PSIAS) applicable to Local Government in Scotland requires the Audit and Risk Manager to report functionally to the Audit and Scrutiny Committee on various issues concerning audit planning. This requirement includes preparing a risk based internal audit plan for submission to the Committee and providing the Committee with details of internal audit resourcing or other issues that may impact the scope of audit work. 3.2 Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 3.3 The Internal Audit Plan is a means of determining the priorities of the internal Item 10. Page 79
Page 80
audit activity and how these fit with the wider goals of the Council. Internal Audit’s approach to annual audit planning is risk-based, with all areas which may be subject to audit review contained within an ‘audit universe’. The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. 3.4 The Audit Plan details what Internal Audit anticipates being able to review in the year, assuming stability in resources available to the Section. The time allocation for all audits assumes that systems to be reviewed are adequately documented, detailing the controls put in place by management and that testing identifies that these controls are being complied with; however, if this is not the case, there will be an impact on the time taken to review planned areas and on the plan’s achievability. 3.5 The proposed Internal Audit Plan for 2025/26 is attached at Appendix 1. I have updated the format to provide greater clarity regarding the allocation of time against review topics, verification and development needs of the Internal Audit Section and other contingency requirements. The Plan includes projects from within the Council and the Internal Audit Section’s requirements for delivering the internal auditing services to the Moray Integration Joint Board, Grampian Valuation Joint Board and Moray Growth Deal. In addition, the Plan includes the review of core systems that will support the Audit and Risk Manager’s requirement to provide an opinion on the adequacy and effectiveness of the Council’s internal control system for the year ending 31 March 2026 within the Annual Governance Statement. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) No direct implications. (b) Policy and Legal The activities of Internal Audit assist the organisation to demonstrate the control environment and risk management arrangements are consistent with good practice. (c) Financial Implications No direct implications. (d) Risk Implications The work of internal audit mitigates the risk of dilution of controls established within systems to ensure best value is secured in the use of public resources. (e) Staffing Implications No direct implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts Page 80
Page 81
No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations Planned audit work is informed throughout the year from various Sources, including Heads of Services. 5. CONCLUSION 5.1 This report invites the Committee to consider and note the planned internal audit coverage for 2025/26. Authors of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: DL/ASC/ Page 81
Page 82
Page 82
Page 83
Appendix 1 MORAY COUNCIL INTERNAL AUDIT PLAN 2025/26 Item 10. Page 83
Page 84
1.1 The Public Sector Internal Audit Standards (PSIAS) applicable to Local Government in Scotland requires the Audit and Risk Manager to report functionally to the Audit and Scrutiny Committee on various issues concerning audit planning. This requirement includes preparing a risk-based internal audit plan for submission to the Committee and providing the Committee with details of internal audit resourcing or other issues that may impact the scope of audit work. 1.2 Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It also helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 1.3 PSIAS sets out the requirement for the: ▪ Audit and Risk Manager to prepare a risk-based audit plan which considers the Council’s strategic objectives, associated risks and the views of senior management and the Committee. ▪ Audit and Risk Manager to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities. ▪ Internal Audit Plan to incorporate or be linked to a strategic or high-level statement of how Internal Audit will be delivered and developed in accordance with the Internal Audit Charter approved by this Committee at its meeting on 20 November 2024 (Item 2) and how it links to the organisational objectives and priorities. The Internal Audit Plan represents a summary of the coverage that the internal audit team aims to deliver throughout the 2025-26 financial year. Delivery of an internal audit programme of work that provides sufficient and appropriate coverage will enable a well- informed and comprehensive year-end annual internal audit opinion. The Internal Audit Charter is a formal document that defines the internal audit’s purpose, authority, responsibility and position within the Council. The Internal Audit Charter is attached on Appendix 1 and should be reviewed annually by members of the Audit and Scrutiny Committee. 1. Internal Audit Plan Page 84
Page 85
2.1 The following diagram sets out the various sources of information used to inform the audit universe of potential projects to review. . 2.2 Internal audits' approach to annual audit planning is risk-based, with the areas detailed above that may be subject to audit review contained within an ‘audit universe’. The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems that contribute to achieving the Council’s priorities and objectives. An audit universe is the collective grouping of auditable ’components’ – sometimes also called auditable areas, units or entities – that support the development of the internal audit plan and help to identify appropriate internal audit coverage that the Audit and Risk Manager can then prioritise. 2. Internal Audit Plan: Approach The Audit Universe Consultation External Research Corporate Plan & Risk Register Professional Guidance & Publications Internal Audit Knowledge A documented risk-based audit universe has been developed to ensure that sufficient and appropriate areas are identified for consideration. 2. Internal Audit Plan: Approach Page 85
Page 86
2.3 The audit universe is risk assessed each year to help determine the annual Internal Audit Plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. 2.4 The audit universe risk assessment is based upon a number of factors including: • materiality (based on expenditure or income) • sensitivity (based on whether a service is a statutory duty, statutory power or non-statutory, is customer facing and whether it features as a specific challenge in the Council’s Service Plans) • time elapsed since an area was last subject to review • Corporate Risk Register- Assessment of any movement in the principal risks facing the Council • overall audit assessment of the control environment 2.5 Consideration is also given to the demands within services to ensure a proportionate audit coverage is taken across the functions of the Council. Note that the audit universe, whilst a key factor, is not the only consideration when determining the audit plan. Senior management has been consulted on priority areas for review. In addition to senior management, consultation has also been undertaken this year with members of the Audit and Scrutiny Committee and the Council Leader in the preparation of the Annual Audit Plan for 2025/26. 2.6 These various sources are designed to enable the Audit and Risk Manager to meet a requirement to provide an annual internal audit opinion on the adequacy and effectiveness of the systems of internal control for inclusion in the annual governance statement published with the Council’s annual financial statements. A review of the internal audit plans for other local authorities is also undertaken as per their committee reporting, which is available online. This provides an opportunity to gain an understanding of issues being faced by other local authorities and identify any auditable areas for the Moray Council. 2.7 Public Sector Internal Audit Standards encourage internal audit services to consider if there are other bodies whose work would allow for reliance to be placed for assurance purposes. While internal and external audit roles are separate and distinct, internal audit maintains a close working relationship with the external auditor as required to secure an optimum combined benefit from the audit resource and avoid duplication where possible. 2. Internal Audit Plan: Approach Page 86
Page 87
2.8 An additional element of the planning process takes place for the Moray Integration Joint Board (MIJB); the Council’s Audit and Risk Manager is also the MIJB’s Chief Internal Auditor. A separate Internal Audit Plan is prepared for the MIJB and is reported to their Audit, Performance and Risk Committee. The established working protocol is for audit reviews of interest to the MIJB to be reported to the Council’s Audit and Scrutiny Committee before the Audit, Performance and Risk Committee. However, depending on future committees, the Audit and Risk Manager will consider some flexibility in this reporting arrangement to ensure that the requirement of meeting the functions of both Committees can be achieved. 2.9 The audit role for the MIJB involves providing assurances that governance and financial arrangements have been developed and are operating in line with policies and that selected systems and processes are suitably controlled. Previous year's audit testing has noted significant findings with the need to undertake follow up reviews to evidence implementation of the recommendations. This has been a particularly time consuming commitment for the Internal Audit Section. It is anticipated this requirement will continue in 2025/26. 2.10 In addition, the Council’s Internal Audit Service undertakes the internal audit work for the Grampian Valuation Joint Board, which requires the provision of annual assurances on the main financial systems operated for payroll, payments and income from funding requisitions from the constituent authorities and other sources. The Joint Board’s systems align with those of the Council but require annual review and testing in order to provide assurances for the separate annual financial statements the Board is required to prepare and publish. 2.11 Moray Council Internal Audit Service is also the appointed lead auditor for the Moray Growth Deal, but each Partner Organisation is separately responsible for allocating internal audit resources for their own growth deal activities. There is a requirement by the Scottish Government for a biannual internal audit review to be undertaken of Moray Growth Deal governance and administrative arrangements. The audit of the core financial systems will appear in the audit plan every year in some form. This work aims to provide significant assurance to the Chief Financial Officer and wider senior management team of the integrity and robustness of the control framework of the systems that handle large numbers of transactions and account for all the authority’s income and expenditure. The core financial systems typically includer: • accounts payable / purchase to pay • accounts receivable / income • payroll (employee admin / organisational management) • housing rents • council tax • Non-Domestic Rates • Treasury management • Insurance The auditing of accounts payable and payroll expenditure may be undertaken annually to support the Audit and Risk Manager’s annual assessment of the robustness of the Council’s internal control system. The review of the above core financial systems will be undertaken over a 5 year audit planning. period Internal Audit Plan: Approach Internal audit will annually assess the adequacy of the arrangements to prevent and detect irregularities, fraud and corruption. This will be done by considering projects for the Audit Plan of subject areas that are regarded as high risk. In addition, an allocation of time will be included annually within the Audit Plan to review systems and practices where fraud or irregularities have been noted within other authorities. However, the primary responsibility for preventing and detecting corruption, fraud and irregularities rests with management who should institute adequate systems of internal control, including clear objectives, segregation of duties and proper authorisation procedures. 2. Internal Audit Plan: Approach Page 87
Page 88
Conformance with Public Sector Internal Audit Standards 2.12 The Local Authority Accounts (Scotland) Regulations 2014 paragraph 7 requires that ‘a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing’. 2.13 The recognised standards adopted by all Scottish Councils are the Public Sector Internal Audit Standards (PSIAS) developed by standard setters, including the Chartered Institute of Public Finance and Accountancy and the Chartered Institute of Internal Auditors. The standards include a requirement for an External Quality Assessment (EQA) of internal audit once every five years. 2.14 Through the Scottish Local Authorities Chief Internal Auditors’ Group, which the Council participates in, it was agreed that the EQA requirement could be met through a peer review process. This required each council’s chief internal auditor to lead a review of another council’s internal audit service and receive a review in return. Perth and Kinross Council was selected to undertake the assessment of Moray Council. The overall conclusion of the external assessment is that Moray Council’s Internal Audit Service fully conforms with the PSIAS. As part of the PSIAS requirements, an annual internal quality assessment is required. This will be undertaken, and the findings and any improvement recommendations will be reported to the Audit and Scrutiny Committee to ensure continuing compliance with PSIAS The delivery of the Internal Audit Service is in accordance with the requirements of the Public Sector Internal Audit Standards. 2. Internal Audit Plan: Approach Page 88
Page 89
3.1 The Annual Audit Plan details what Internal Audit anticipates being able to review in the year, assuming stability in resources available to the Section. The time allocation for all audits assumes that systems to be reviewed are adequately documented, detailing the controls put in place by management and that testing identifies that these controls are being complied with. If this is not the case, there will be an impact on the time taken to review planned areas and on the plan’s achievability. 3.2 The Plan also includes time to assist services in developing their controls and approach to improving compliance. This reflects the continuing development of a more proactive value-added approach by Internal Audit to supplement the more traditional core compliance-oriented audit work. However, this needs to be balanced with the requirement for Internal Audit to complete sufficient work to provide an evidence based annual opinion on the adequacy and effectiveness of the Council’s internal control system. Internal Audit will continue to review the Council’s risk registers and update its own risk assessments based on audit findings throughout the Plan’s term. 3.3 Whilst undertaking planned work, it is possible that Internal Audit may identify governance issues that are not within the stated scope of the review being undertaken. PSIAS requires that Internal Audit report such instances to those charged with governance. In this respect, Internal Audit reports may contain issues that appear to be “outwith scope”. Where at one time, five year audit plans were commonplace, the PSIAS standards now advocate annual planning, noting that ‘the plan should be sufficiently flexible and kept up to date with the organisation and its changing risks and priorities’. 3.4 Sufficiently flexible is not defined; however, it suggests that ‘contingency days’ should be held to deal with emerging issues. Thus, a proportion of the available audit days are being retained as contingency days, which, if not used, can accommodate additional audit projects that may be brought into the audit plan later in the year. These projects may be identified by the Audit and Risk Manager as an emerging issue or come from a recommendation by committee. 3.5 The objectives of each audit are to identify potential risks and provide assurance on the adequacy and effectiveness of the associated controls in the following areas: The Internal Audit Plan details a list of projects the Internal Audit Service will review to provide management and members with an independent opinion that the Council’s risk management, governance and internal control processes are operating effectively. The proposed 2025/26 plan is presented in Appendix 2. The audit of the core financial systems will appear in the annual audit plan in some form. This work aims to provide significant assurance to the Chief Financial Officer and wider senior management team of the integrity and robustness of the control framework of the systems that handle large numbers of transactions and account for all the authority’s income and expenditure. The core financial systems typically include: • accounts payable/ creditors • accounts receivable / income • payroll • housing rents • council tax • non-domestic rates • Treasury management • Insurance Auditing accounts payable and payroll expenditure may be undertaken annually to support the Audit and Risk Manager’s annual assessment of the robustness of the Council’s internal control system. It is intended that the review of all core financial systems will be done over a 5 year audit planning period. 3. Internal Audit Plan 2025/26 Page 89
Page 90
• Management – To ensure the consistency of operations or programs with established objectives and goals and effective performance. • Value – To ensure the effectiveness and efficiency of operations and employment of resources. • Regulatory – To ensure compliance with significant policies, plans, procedures, laws, regulations. • Information – To ensure the reliability and integrity of management and financial information processes, including the means to identify, measure, classify and report such information. • Security – To ensure safeguarding of assets 3.6 The staff complement of the team is currently 3.8 FTE, including the Audit and Risk Manager, who has a range of responsibilities, including the management and supervision of the team, planning work, development of the service, servicing committees, overseeing the development of business continuity and risk management arrangements. On the basis that all posts are filled and allowing for overheads for holidays, training, administration and the like, some 780 working days are available to be allocated for the 2025/26 year. This time is spread over a number of headings, principally audit projects (core and service systems) but also work related to governance, business continuity and risk management. 3.7 PSIAS requires the Audit and Risk Manager to consider whether or not the audit staffing resources are sufficient to meet the audit needs of the organisation and where it is believed that the level of resources may adversely impact the provision of the annual internal audit opinion, to draw that to the attention of the Committee. Demands on the Internal Audit Service have increased over the years and are expected to continue. Further to a Special Meeting of the Moray Council on 28 February 2024, it was agreed to reduce the Internal Audit Section staffing budget by replacing the Corporate Investigations Officer’s post with a 0.5 full-time equivalent. The remaining funding was used to try and recruit an Assistant Auditor to mitigate the risks associated with a reduction in staff resources while still maintaining the delivery of an effective internal audit service, but this proved unsuccessful. Due to the more strategic type of work required concerning the MIJB, Moray Growth Deal, Levelling Up Fund and counter fraud type reviews, it is considered that the Internal Audit Service would be better served with a more experienced and qualified auditor. An attempt is now being made within the limited budget to appoint a qualified auditor on a part-time basis. Detailed Internal Audit Resources have been determined and are listed in Appendix 3. 3. Internal Audit Plan 2025/26 Page 90
Page 91
4.1 Completed reviews of projects detailed within the Annual Audit Plan will be reported to members of the Audit and Scrutiny Committee on a regular basis. The reporting format was developed using audit management software used by the Internal Audit Service. It will include details of the scope, findings from the review undertaken and recommendations for improvements in the governance, risk, and control arrangements. Senior management’s responses to the recommendations will also be recorded within the internal audit report. 4.2 The Internal Audit Service also reports on follow up reviews to evidence implementation of the recommendations agreed by management. The follow up review will be undertaken after the last agreed date of a recommendation with the audit report has passed. However, due to the available resources of the Internal Audit Section and operational demands within services, some flexibility is required in the timescales of when reviews are undertaken and the reporting of follow up reports. 4.3 Requests for unplanned work will be considered against the capacity to ensure the internal audit’s independence and that the resource required to provide the annual audit opinion is not compromised. Any significant additional consulting activities that impact the delivery of the plan will be communicated to the Audit and Scrutiny Committee. 4.4 The output of audits completed during the year will inform the annual audit opinion. The annual internal audit opinion will conclude on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control. This will be reported through the Internal Audit Annual Report, a key assurance source for the Annual Governance Statement (AGS). The role of internal audit is to provide independent assurance that an organisation's risk management, governance and internal control processes are operating effectively. Internal auditors must have an impartial, unbiased attitude and avoid any conflict of interest. If independence or objectivity is impaired, the Audit and Risk Manager will report these concerns to senior management and members of the Audit and Scrutiny Committee. Completed audit reviews will be regularly reported to the Audit and Scrutiny Committee in accordance with the Council’s Scheme of Administration. Each audit report of a project will provide an audit assurance opinion of the effectiveness of the controls in place, the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. 4. Internal Audit Reporting Page 91
Page 92
5.1 The following performance targets will be used to measure the performance of the internal audit activity: Measure Description Target Final Report Percentage of Auditee(s) responding within 20 days of receiving the draft report. 100% Final Report Percentage of final audit reports issued within 10 days of agreeing the draft report 100% Audit Plan Delivery Percentage of audits completed v planned. 85% Audit Budget Percentage of audits completed within budgeted days. 80% Audit Recommendations Percentage of audit recommendations agreed. 90% Customer Feedback Percentage of respondents who rated that the audit added value and provided meaningful results. 100% Follow Up Reviews Percentage of Follow Up Reviews completed v planned 100% A range of performance indicators have been developed to monitor the performance of the Internal Audit Service. Actual performance against the detailed performance will be reported within the Annual Internal Audit Opinion Report. 5. Internal Audit Performance Page 92
Page 93
Appendix 1 Internal Audit Charter Author: Audit and Risk Manager Date for review: May 2029 Page 93
Page 94
1. INTRODUCTION 1.1 The Local Authority Accounts (Scotland) Regulations 2014 introduced a requirement for all Scottish Local Authorities to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Public Sector Internal Audit Standards (PSIAS), which came into effect in April 2013, and were updated in March 2017. These standards are largely based on the International Professional Practices Framework (IPPF). A requirement of the PSIAS is that all local authorities should have an Internal Audit Charter. 2. Definition and Purpose of Internal Auditing 2.1 The overarching “mission” of an Internal Audit Service is to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. Internal Auditing is defined in the PSIAS as ‘an independent, objective, assurance and consultancy activity designed to add value and improve an organisation’s operations. Internal Audit adds value to the organisation (and its stakeholders) by enhancing governance, risk management and internal control and objectively providing assurance. 2.2 As part of the meeting Moray Council’s system of corporate governance, Internal Audit’s purpose is to support the Council in its activities designed to achieve its declared objectives and to do so: • In support of the Council’s vision, values and priority. • As a contribution to the Council’s management of risks, including assisting management to improve the risk identification and management process in particular where there is exposure to significant regulatory, financial, strategic, reputational and operational risk to the achievement of the Council’s objectives. • As an aid to ensuring that the Council and its elected members, employees and contracted third parties are operating within the law and relevant regulations and that public money is safeguarded and properly accounted for, and used economically, efficiently and effectively. Page 94
Page 95
• As a contribution towards establishing and maintaining a culture of honesty, integrity, openness, accountability and transparency throughout the Council in all its activities and transaction. • As a contribution towards ensuring that financial statements and other published performance information are accurate and reliable. 2.3 Moray Council also provides an internal audit service to Moray Integration Joint Board (MIJB) and the Grampian Valuation Joint Board (GVJB). It will apply the same standards as defined in this Charter to any work undertaken for the MIJB and the GVJB, with separate Internal Audit plans and reports presented to their respective ‘senior management’ and ‘board’. 3. POSITION OF INTERNAL AUDIT WITHIN THE ORGANISATION 3.1 The Internal Audit Service is managed by the Audit and Risk Manager. The Audit and Risk Manager will report functionally to the Audit and Scrutiny Committee and administratively (i.e., day-to-day operations) to the Head of Governance, Strategy and Performance (the Council’s Monitoring Officer). The Audit and Risk Manager will have access to the Chief Executive, to all Council officers and to the elected members in connection with any relevant matter 3.2 The Audit and Risk Manager will also have unrestricted access to, and communicate and interact directly with any Council Committee, including in private meetings without management present. 3.3 The Audit and Scrutiny Committee is charged with responsibility for ensuring good stewardship of the Council’s resources, enhancing the profile, status and authority of Internal Audit and affirming its independence. Specifically, in relation to audit matters, the committee: • Contributes to making the Council, its committees and services more responsive to the audit function and its purpose; • Enhances good governance arrangements by promoting internal control and risk management by supporting an anti- fraud culture, and by the review of revisions to financial procedures; • Has responsibility for focusing audit resources through agreeing to an annual programme of work; • Monitors delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit; Page 95
Page 96
• Considers the annual opinion provided by the Audit and Risk Manager on the adequacy and effectiveness of the control environment. 4. ORGANISATIONAL STATUS AND INDEPENDENCE 4.1 In terms of the PSIAS, the status of Internal Audit should enable it to function effectively, with recognition of the independence of Internal Audit that is fundamental to its effectiveness. Moray Council’s Financial Regulations detail that the Depute Chief Executive (Education, Communities and Organisational Development) is responsible for securing a continuous Internal Audit service to provide an independent and objective opinion on the control environment comprising risk management, internal control and governance. This remit is delegated to the Audit and Risk Manager. 4.2 Internal Audit will systematically review, appraise, make appropriate recommendations for improvement, and report upon: • The efficacy of governance arrangements put in place to achieve the organisation’s objectives and priorities. • The effectiveness of all internal controls and other arrangements put in place to manage risk, in particular where there is exposure to significant financial, strategic, reputational and operational risk to the achievement of the organisation’s objectives. • The completeness, reliability and integrity of information, both financial and operational performance, including working alongside services in a ‘critical friend’ role to authenticate any self-assessment evidence of service performance and improvement. • The systems formed to ensure compliance with policies, plans, procedures, laws and regulations whether established by the organisation or externally. • The effectiveness of arrangements for safeguarding the organisation’s assets and interests, including fraud prevention controls and detection processes. • The economy, efficiency and effectiveness with which resources are deployed. Page 96
Page 97
• The extent to which services’ operational practices are being carried out as planned and objectives and goals are met. 4.3 Internal Audit’s work covers: • All activities, systems, processes, policies and protocols that currently exist or under development. • All records, personnel and properties. • All services and other activities for which the organisation is responsible or accountable, whether delivered directly or by third parties through contracts, partnerships or other arrangements. Where the Audit and Risk Manager has or is expected to have roles and/or responsibilities that fall outside of Internal Auditing, safeguards will be established to limit impairments to independence or objectivity. 5. RIGHTS OF ACCESS 5.1 The Audit and Risk Manager and any member of the Internal Audit service are authorised in the performance of an audit engagement and have the authority to: • Have access at any reasonable time to all systems and records (both paper and electronic). • Require and receive explanations concerning any matter under examination from personnel relevant to their roles, including elected members or board members • Enter at all reasonable times and without notice any properties provided that the terms of the lease are observed where such properties are leased to a third party. • Require personnel to produce cash, stores, or other assets under their control. Page 97
Page 98
5.2 Internal Audit safeguards all information obtained in the carrying out its duties, only uses it for defined purposes, and makes no disclosure of any information held, unless this is authorised or there is a legal/professional requirement to do so. 6. AUDIT RESOURCES AND WORK PRIORITISATION 6.1 The Moray Council’s Internal Audit Annual Plan, as approved by the Audit and Scrutiny Committee, is the primary determinant of the relative priority to be placed on each part of the work of Internal Audit, with Internal Audit Annual Plans specific to the MIJB and the GVJB being approved and monitored by their respective ‘senior management’ and ‘board’. The audit planning process, to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, includes consideration of the organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided. The Audit and Risk Manager determines the actual deployment of available resources covering the range and breadth of audit activity, which is integral to the assurance process across the activities of the Council, MIJB and GVJB in order to provide the statutory annual Internal Audit opinion to each organisation’s ‘senior management’ and ‘board’. This plan also requires to be sufficiently flexible to reflect the changing risks and priorities of each organisation. 6.2 The Audit and Risk Manager ensures that Internal Audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. Appropriate refers to the mix of qualifications, knowledge, skills and other competencies needed to perform the plan, such as compliance with the Code of Ethics set out in the PSIAS and with the Nolan principles established in the Seven Principles of Public Life. This is of particular importance and relevance for the profession of Internal Audit, founded as it is on the trust placed in its objective assurance about risk management, internal control and governance. 6.3 In the event that there is a need for additional audit work than there are resources available, the Audit and Risk Manager will identify the shortfall in the Plan and initially advise the Head of Governance, Strategy and Performance, the Depute Chief Executive (Education, Communities and Organisational Development) followed by the Audit and Scrutiny Committee as required. It will be for the Audit and Scrutiny Committee to decide whether to accept the risks associated with the non-delivery of such audit work or to recommend to the Council that it requires Management to identify additional resources. 6.4 Internal Audit responsibilities are not relieved in areas of the Council’s work that are subject to review by others, but reliance is placed on the work of other review agencies, principally the Council’s External Auditor, to avoid duplication, make the best use of resources and inform the overall assessment of governance arrangements. Page 98
Page 99
7. MANAGEMENT RESPONSIBILITIES 7.1 Responsibility for internal control rests with Management, who must ensure that proper internal control arrangements are in place. Internal Audit’s role is to evaluate the effectiveness of such internal control arrangements. Management is responsible for accepting and implementing audit recommendations and bears any risk from not taking agreed action. Internal Audit is not a substitute for an effective system of internal control implemented by management. 8. COUNTER FRAUD WORK 8.1 The prevention and detection of fraud is a management function and management is responsible for implementing and maintaining suitable systems of control to mitigate the risk of fraudulent activity. In support of the Council's counter fraud arrangement, the Audit and Risk Manager will consider including a project within the Annual Audit Plan to review systems or practices where irregularities or fraud have been reported within other Local Authorities. Internal audit also supports the Council’s commitment to fraud prevention and detection by overseeing data matching exercises carried out under the National Fraud Initiative. The Council takes the threat of fraud or related malpractice seriously and has adopted a Policy to Combat Fraud, Theft, Bribery and Corruption. In addition, a Whistle-blowing Policy has been developed in consultation with the Human Resources service to facilitate the reporting of any concerns. 8.2 The Financial Regulations provide that whenever any matter arises which involves, or is thought to involve, irregularities concerning cash, stores or other property of the Council or any suspected irregularity in the exercise of the functions of the Council, any Officer having knowledge thereof, shall, as soon as possible, notify Internal Audit. 9. OBJECTIVITY AND CONFLICTS OF INTEREST 9.1 The Council’s Code of Conduct for Employees sets out the required standards for the conduct of all employees and includes provisions for the declarations of interests, gifts and hospitality. 9.2 The Internal Audit service preserves its independence and objectivity by ensuring that: staff are free from any conflicts of interest when undertaking assurance audits by following the requirements of relevant professional bodies and HR policies; Page 99
Page 100
and by providing clarity on duties undertaken during audit consultancy engagements to ensure these do not impact on assurance audits and do not impair its independence and objectivity. 9.3 The Audit and Risk Manager has managerial responsibility for the corporate functions and resources, which develop, support and advise on the frameworks in place within the Council on Risk Management, Business Continuity and on Counter Fraud to support Management. In order to prevent a perceived impairment of objectivity and to ensure that Internal Audit independence and impartiality are maintained and demonstrated, no Internal Audit resources will be used in the performance of these functions. 10. OTHER PARTIES OUTWITH THE COUNCIL 10.1 The Council’s Audit and Risk Manager is also the Chief Internal Auditor for the Moray Integration Joint Board and the Internal Auditor for the Grampian Valuation Joint Board. While separate and distinct governance arrangements apply to these bodies, the principles outlined in this Charter apply and are adopted in respect of all work completed by Internal Audit. 11. REVIEW 11.1 The PSIAS requires that the chief audit executive periodically reviews the Internal Audit Charter and presents it to senior management and also to the Board for approval. In this context, the chief audit executive is the Audit and Risk Manager, senior management is the Corporate Management Team, and the Board is the Audit and Scrutiny Committee. Dafydd Lewis Audit and Risk Manager September 2024 Page 100
Page 101
Appendix 2 Internal Audit Annual Work Programme- 2025/26 At the start of each audit, a discussion will be held with the service to agree on the specific terms of reference for the audit, which includes the objective and scope of the review. The scheduling of reviews is dependent on officer availability, resourcing, and priorities. CORE SYSTEM REVIEWS Auditable Area Audit Scope Corporate Risk Register (Control Assurance) Allocated Days Payroll Continuous auditing to confirm the adequacy of the systems and procedures for paying salaries. The intention is to make further use of an auditing software application in the analysis of data and the sample selected for testing. Financial & Regulatory 30 Procurement and Creditor Payments Continuous auditing of samples of non-pay expenditure to test compliance with procurement and payment processing regulations. The intention is to make further use of an auditing software application in the analysis of data and the sample selected for testing. Financial & Regulatory 40 Page 101
Page 102
Counter Fraud Review Annual review of counter fraud framework to minimise the risk and impacts of fraud from internal and external threats. The scope of the audit and testing undertaken will be informed from frauds reported within other organisations. Regulatory 25 Democracy and Governance Review administrative arrangements established to support effective democracy, governance and committee reporting arrangements. The audit will include reviewing policies and checking a sample of meetings/papers/action logs to ensure adequate and timely information is provided as required and requested to aid informed decision making. Regulatory & Operational Continuity and Performance 25 Banking and Reconciliation To obtain assurance that adequate procedures are in place, ensuring accurate, timely reconciliations of income received and any differences are addressed promptly. A review of the banking arrangements will also be undertaken. Financial 25 Absence Management An audit will consider the effectiveness of sickness absence monitoring and reporting. This will include the arrangements from within the Council and the Moray Integration Joint Board. HR (Staffing) & Operational Continuity and Performance 30 National Non-Domestic Rates To ensure that Business Rates billing and collection arrangements are robust and are adequately applied and that reliefs awarded are adequately supported. Financial & Regulatory 30 Page 102
Page 103
SERVICE REVIEWS Auditable Area Audit Corporate Risk Register (Control Assurance) Allocated Days Moray Growth Deal Follow Up A follow up review to evidence implementation of the recommendations agreed within the audit undertaken in 2024/25 Audit Plan of the governance and administrative arrangements within the management of the Moray Growth Deal. Economic Sustainability 20 Levelling Up Fund An overview of the governance and administrative arrangements within the Council for the management of the Levelling Up Fund. Economic Sustainability 25 Capital Plan Audit testing of contract management arrangements for selected project(s) within the capital plan. Financial & Regulatory 20 Education – Secondary School Establishment visits as part of cyclical review. Further to the consultation with the service, additional testing will be undertaken in the use of purchasing cards. Operational Continuity and Performance 25 Commercial Harbours A review of commercial harbours regarding the accounting arrangements of income and expenditure. The audit will review operating activity against Council Policies and Procedures. Economic Sustainability 30 Management of School Funds Review the processes in the management and control of School Funds. Financial & Operational Continuity and Performance 20 Page 103
Page 104
Common Good Funds An audit of the accounting arrangements and procedures in the management of Common Good Funds. Financial & Operational Continuity and Performance 25 Adult Care Commissioning- Follow up review KPMG review Follow up review to evidence implementation of the recommendations detailed within the KPMG Adult Social Care Commissioning audit. Regulatory 25 Transportation- Education Review operating arrangements to ensure compliance with the conditions of contracts and compliance with Council Financial Regulations and Procurement Guidelines in managing school transport contracts. Financial & Regulatory 30 MORAY INTEGRATION JOINT BOARD Auditable Area Audit Corporate Risk Register (Control Assurance) Allocated Days Complex and Challenging Behaviour Services Review of systems and procedures within Complex and Challenging Behaviour Services in the management of Woodview and Barlink Social Work Establishments. Operational Continuity and Performance 25 Support for Carers – including respite support Review of established processes to provide information, advice and support for unpaid carers including short breaks and respite support. Consideration will be given to including the review of both adult and young carers within the scope of this audit. Regulatory 25 Social Care Financial Assessments/ Contributing to your Care An audit to check the processes and accounting arrangements in the charging of care to service users. Financial & Regulatory 30 Page 104
Page 105
GRAMPIAN VALUATION JOINT BOARD Auditable Area Audit Corporate Risk Register (Control Assurance) Allocated Days Grampian Valuation Joint Board In accordance with the Public Sector Internal Audit Standards applicable to local government and joint boards, an annual review is required of Grampian Valuation Joint Board activities. Regulatory 10 VERIFICATION ACTIVITY Auditable Area Audit Corporate Risk Register (Control Assurance) Allocated Days Stocks and stores - year end valuations Verification of Year End Stock Verification for Building Services/ Environmental Services/ Community Services Stores. Regulatory 10 Network Support Grant Ongoing certification requirement of Network Support Grant to Transport Scotland. Regulatory 20 INTERNAL AUDIT SECTION ONGOING SERVICE REQUIREMENTS Auditable Area Audit Corporate Risk Register (Control Assurance) Allocated Days Public Sector Internal Audit Standards/ Global Internal Audit Standards Annual self-assessment of the Internal Audit function against the Public Sector Internal Audit Standards and report findings to the Audit and Scrutiny Committee. Additional allocation of days to undertake GAP analysis review to identify any additional requirements between current practices and the new Global Internal Audit Standards. Regulatory 25 Page 105
Page 106
NFI 2024/25 Oversee the Council's participation in the Cabinet Office / Audit Scotland led National Fraud Initiative (NFI) exercise, including data submission and investigation of matches by services. Financial & Regulatory 20 Audit Committee Self Assessment Provide assistance to Chair of the Audit and Scrutiny Committee in undertaking a self assessment of the Committee against the CIPFA best practice guidance, with input from members. Plan and facilitate associated Development Sessions during the year. Regulatory 10 Audit Planning for 2026/27 Develop and consult on proposed coverage for the Internal Audit Annual Plan 2026/27. Regulatory 10 Critical Friend Consultancy In its ‘critical friend’ role, provide internal challenge and quality assurance on a sample of programmes and projects involving major change and systems implementation; provide independent challenge of the evidence to support improvement; and perform an independent and objective assessment of the evidence to support self- evaluation and improvement in support of Best Value. Operational Continuity and Performance 25 Management, Planning and Contingency Management, planning and assurance reporting to Council, MIJB and GVJB Committee. Contingency days also include an allocation for completing works in progress from the 2024/25 Internal Audit Plan. Operational Continuity and Performance 25 Page 106
Page 107
Follow-Up Monitor progress with implementation of Internal Audit recommendations on a quarterly basis to ensure that Management Actions have been timeously and effectively implemented, to check that these have had the desired effect of managing identified risks, and to demonstrate continuous improvement in internal control and governance. Operational Continuity and Performance 80 Page 107
Page 108
Appendix 3 INTERNAL AUDIT SECTION INTERNAL AUDIT AVAILABLE DAYS – 2025/26 Staff Resources Available Days 3.8 FTE staff x 52 weeks x 5 days 988 Less: Overheads: Annual Leave (including public holidays) 152 Training 25 Sick Leave (Estimate) 20 Administration 11 Available Days 780 Allocation of Days Core Systems Reviews 205 Service Reviews 220 Moray Integration Joint Board 80 Grampian Valuation Joint Board 10 Verification Requirements 30 Internal Audit Section Ongoing Service Requirements 195 Risk Management & Business Continuity 40 Total 780 Page 108