Agenda Document Pack - Audit and Scrutiny Committee - 24/06/2025
Moray Council · 24 June 2025
Back to Audit and Scrutiny Committee — 24 June 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Tuesday, 24 June 2025 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Tuesday, 24 June 2025 at 14:00. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Resolution Consider, and if so decide, adopt the following resolution: "That under Section 50A (4) and (5) of the Local Government (Scotland) Act 1973, as amended, the public and media representatives be excluded from the meeting for Item 13 of business on the grounds that it involves the likely disclosure of exempt information of the class described in the relevant Paragraphs of Part 1 of Schedule 7A of the Act.” 4. Minute of meeting of 7 May 2025 7 - 12 5. Written Questions ** 6. Internal Audit Annual Report 2024-25 Report by Audit and Risk Manager 13 - 28 7. Internal Audit Section Update Report Report by Audit and Risk Manager 29 - 64 8. Internal Audit Review - Building Services - Reactive Repairs Report by Audit and Risk Manager 65 - 84 Page 1
Page 2
9. Internal Audit Review - Keith Grammar School Report by Audit and Risk Manager 85 - 100 10. Internal Audit Review - Information Communications Technology Hardware Assets Report by Audit and Risk Manager 101 - 120 11. Audit and Scrutiny Committee - Self-Assessment and Evaluation Exercises Report by Audit and Risk Manager 121 - 142 12. Annual Governance Statement Report by Chief Executive 143 - 162 Item(s) which the Committee may wish to consider with the Press and Public excluded 13. Internal Audit Follow Up Review - Cyber Security and E- Mail Security [Para 14] • 14. Information relating to action taken, or to be taken, in connection with the prevention, investigation or prosecution of crime. Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
Watching the Meeting You can watch the webcast live by going to: http://www.moray.gov.uk/moray_standard/page_43661.html Webcasts are available to view for 1 year following the meeting. You can also attend the meeting in person. If you wish to attend in person, please come to the High Street entrance door and a member of staff will let you into the Chamber. Page 3
Page 4
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be published on the Council’s committee management system by 4pm the day before the meeting. The Member who has put the question may, after the answer has been published, ask one supplementary question directly related to the subject matter at the meeting, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. Page 4
Page 5
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Scott Lawrence (Chair) Councillor Theresa Coull (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor John Divers (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Paul McBain (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Councillor Sonya Warren (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 5
Page 6
Page 6
Page 7
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 07 May 2025 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Tracy Colyer, Councillor Theresa Coull, Councillor John Divers, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Scott Lawrence, Councillor Marc Macrae, Councillor Neil McLennan, Councillor John Stuart, Councillor Sonya Warren, Ms Margaret Wilson APOLOGIES Councillor Paul McBain IN ATTENDANCE Chief Executive; Depute Chief Executive (Education, Communities and Organisational Development); Depute Chief Executive (Economy, Environment and Finance); Interim Chief Social Work Officer / Head of Service; Audit and Risk Manager; Head of Governance, Strategy and Performance; Head of Financial Services; Head of Housing and Property Services; DLO Services Manager; Service Manager - Provider Services, Strategy and Performance Manager and Caroline O'Connor, Committee Services Officer, all Moray Council and Joanne Brown, Grant Thornton - External Auditors. 1. Chair The meeting was chaired by Councillor Scott Lawrence. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. With regard to Item 8 "Annual Audit Plan for the Year Ending 31 March 2025", Councillor Gatt stated, for transparency, that he is Convener of the Grampian Valuation Joint Board and would be taking part in the debate. Mr Augustus stated, for transparency, that he was carer representative on the Moray Integration Joint Board and also in relation to Item 5 "Internal Audit Section Update Report" he managed Self-Directed Support Option 1 from its inception and would be taking part in the debate. With regard to Item 8 "Annual Audit Plan for the Year Ending 31 March 2025", Councillor Warren and Councillor Macrae stated, for transparency, that they were Item 4. Page 7
Page 8
members of the Grampian Valuation Joint Board and would be taking part in the debate. With regard to Item 9 "Local Government Benchmarking Framework 2023-24 Results", Councillor Stuart stated, for transparency, that he is Care Inspector but does not inspect in Moray and would be taking part in the debate. 3. Minute of meeting of 12 February 2025 The minute of the meeting of 12 February 2025 was submitted and approved. 4. Written Questions ** The Committee noted that no written questions had been submitted. 5. Internal Audit Section Update Report The meeting had before it a report by the Audit and Risk Manager providing an update on the work of the Internal Audit Section. Councillor Keith, in relation to the third follow-up review referenced in Audit Recommendation 5.02 of Appendix 3 and noting the monies involved, questioned how assured members of the Committee could be given there was to be a further postponement for the implementation of the Audit Recommendation. In response the Audit and Risk Manager stated his concern however highlighted significant progress had been made and it was expected the financial reviews would be completed in full this year. He stated that the need for another follow-up review impacts the completion of projects within the annual audit plan. The delay in implementing these recommendations will also need to be considered within the context of the internal audit annual report, as previous years have detailed a limited opinion on the Moray Integration Joint Board's systems of governance and internal controls. The Audit and Risk Manager confirmed that he plans to include another full review of this area within next year's audit plan, with any findings and recommendations reported to this Committee. Councillor Gatt stated he shared the concern noted by Councillor Keith in relation to Audit Recommendation 5.02 of Appendix 3. He further noted Audit Recommendation 5.06 of Appendix 3 had been outstanding since 2022 and asked whether the large surplus referred to was a genuine surplus or due to people not receiving the care they required due to carer recruitment issues. In response the Service Manager - Provider Services advised individuals are assessed in terms of need and a financial equivalent is provided to the person for their care however there can then either be an improvement in the amount of care or reduction in the amount of care required which results in a surplus. Councillor Gatt expressed his thanks for the response however stated it was even more important for the financial reviews detailed in Audit Recommendation 5.02 to proceed and asked whether the delay in implementation was having a detrimental effect on the care service if monies were in the wrong place rather than being used where needed. In response the Service Manager - Provider Services explained unmanaged accounts are more difficult to audit and require more resources. He stated the number of direct payments had doubled since the audit however agreed the importance of regular annual assessments. He further advised that the previous significant recruitment issues had improved and the service has set up different ways of monitoring the implementation of audit recommendations to Page 8
Page 9
ensure lessons are learned from the work done by Internal Audit through Health and Social Care Moray's Practice Governance Board and Self-Directed Support Steering Group. It was also noted there was a permanent employee now in post allowing a significant increase in the amount of financial audits and reviews the service had the capacity to undertake. Councillor Gatt, in relation to the decision of Communities Committee on 27 October 2013 for a review of revised working time arrangements to be undertaken detailed in Audit Recommendation 5.01 of Appendix 4, asked whether his understanding was correct that the decision had not been enacted. In response the Audit and Risk Manager advised it was included as an Audit Recommendation due to a need for it to be reported back to Committee with the current arrangements and while there was an agreement, the decision of Committee in 2013 had not been followed through. The DLO Manager provided assurance that the revised hours pilot scheme was approved in 2013 following consultation with the Trade Unions and staff and had been operational since that time however had not been reported back to Committee for approval as a permanent change. He apologised and advised it was planned to issue a further survey, engage with the Trade Unions then report back to Committee for approval. In response to a follow-up question from Councillor Gatt relating to governance and how to ensure this would not happen again, the Head of Governance, Strategy and Performance advised that was demonstrated through reporting to this Committee allowing scrutiny by Members. The Audit and Risk Manager provided assurance that a review of governance arrangements is included in this year’s audit plan. This will include an assessment of controls, with any findings and recommendations also reported to this Committee. Councillor Warren, in relation to Audit Recommendation 5.08 of Appendix 4 and noting there was no mention of stock control measures being put in place for the contract, asked for assurance of what would be put in place and fed back to Committee. In response, the Audit and Risk Manager advised that the value of the stock was limited and there were controls in place. However, he provided assurance that the stock control arrangements will be checked again during the follow-up review. Following lengthy consideration the Committee unanimously agreed to note the report. 6. Internal Audit Review - Special Investigation - Building Services - Windows Replacement Programme The meeting had before it a report by the Audit and Risk Manager advising Committee on an internal audit review completed for the period from 12 February 2025 to 7 May 2025. In order to have a fuller understanding of the scale of the financial and reputational costs including impacts on tenants who had experienced delays and whether they had received an apology from the Council, Councillor Warren asked for more detail. In response the Head of Housing and Property Services advised a new contract had been issued to also include other updates to the properties such as insulation which was expected to be delivered within 10-12 weeks. With reference to details of the financial costs, the Head of Housing and Property Services advised that the value of the windows included in the report was £40,000 and the service would look to repurpose or dispose of the windows attaining best value and Page 9
Page 10
in accordance with the Financial Regulations of the Council. As a conclusion to the process, he undertook to provide apologies to affected tenants. Councillor Warren asked what procedural changes had been put in place to ensure more rigorous contract checks, how building services will ensure compliance with the requirements of the contract and if the procurement process had been amended to ensure more oversight of split contracts. in response the Audit and Risk Manager advised as part of the audit, Internal Audit would be evidencing implementation of the recommendations which would be reported back to Committee. The Head of Housing and Property Services noted one of the factor was the separation of the supply and installation elements of the contracts. He provided assurance that future contracts would be for supply and fit to provide further control. In response to a request from Councillor Lawrence that the final costs to the Council after disposal and repurposing be included in the Internal Audit follow-up report, the Audit and Risk Manager agreed he would detail the decision made whether to reuse or dispose within the follow-up report. During the course of discussion concern was expressed by members of the Committee regarding the period of time that had elapsed since the service became aware of the issue in 2022 to it being escalated following concerns raised by an Elected Member 2024. In terms of governance, the Head of Housing and Property Services referred to a number of contributing factors including the post Covid recovery process ongoing and significant staffing changes however was fully accepting that the issue should have been escalated to a higher level at an earlier stage. He explained he was confident there would not be a reoccurrence within the service as all were now very clear about how matters should be escalated and resolved. Councillor Fernandes in noting that this was not the first occasion when a matter had not been escalated through the correct channels, asked if there was a cultural issue within the service preventing staff from raising issues. In response the Head of Housing and Property Services confirmed he wished to encourage staff within the service to raise issues so as to engender a culture where transparency was key. The Chief Executive provided assurance that the management controls and processes would change as detailed in the Audit Recommendations however she would also be overseeing a change in culture to ensure empowerment of teams along with a clear understanding of when to escalate issues and when to find solutions together. Following lengthy consideration the Committee unanimously agreed to endorse the recommendations contained within the report. 7. The National Fraud Initiative in Scotland The meeting had before it a report by the Audit and Risk Manager providing Committee with information on the Council's approach to participation in the National Fraud Initiative (NFI). In response to a question from Councillor Bloomfield asking whether the Council has a whistleblowing policy, the Audit and Risk Manager confirmed there was a whistleblowing policy which he understood was being reviewed however agreed to ask the officer concerned for detail and provide an update to Committee. Page 10
Page 11
Following consideration the Committee unanimously agreed to endorse the Audit Scotland self-appraisal checklists that participating bodies are invited to complete and present to their local audit committees. 8. Annual Audit Plan for the Year Ending 31 March 2025 The meeting had before it a report by the Depute Chief Executive (Economy, Environment and Finance) informing the Committee of the External Auditor's Annual Audit Plan for 2024/25. Councillor Gordon, in relation to the wider scope and best value arrangements (4) section of Appendix 1 and specifically the sentence in bold print about there being potentially a risk that budget control and financial management information for members is not consistent for effective decision making, asked the Auditor to expand on the point. In response the Auditor advised through best value work previously a potential risk has been identified regarding to the setting of the budget and detailed financial reports which could create a risk for members in terms of their understanding. The Auditor noted that the issue has been captured as a recommendation in the Council's improvement plan, and it is being progressed, but needs to be identified as a risk at this stage. Councillor Keith asked, with reference to the first sentence of the Financial management paragraph in the Introduction and headlines (4) section of Appendix 1; whether the sentence was relevant for every Council in Scotland and therefore included in all audit plans or if it was specific to Moray and queried whether it may be removed in future reports. In response the Auditor explained the landscape round local government and future financial sustainability was a key aspect seen consistently across external auditor reports. The financial management paragraph was an element identified in the first year of the auditors appointment and improvements have been made and evidenced. She advised it was likely this will be removed at some point in the future with the focus then being on longer term financial sustainability. Councillor Lawrence noted fraud being one of the identified risks in the report however the National Fraud Initiative discussed earlier had not identified any major risks and asked how the work in the Audit Plan differentiated from the work done by Internal Audit relating to fraud. In response the Auditor advised external audit's focus on fraud specifically related to the potential risk regarding financial statements of a material element of fraud, misreporting or otherwise which would impact on external audit's ability to give an unmodified opinion on those financial statements. Following consideration the Committee unanimously agreed to note the contents of the External Auditor's Annual Plan for 2025/25. 9. Local Government Benchmarking Framework 2023-24 Results The meeting had before it a report by the Depute Chief Executive (Education, Communities and Organisational Development) presenting a corporate overview of benchmarking performance data for the period 2023-24. Councillor Gordon asked, in relation to budget forecasting referenced in number 23 of Appendix 1, whether budgets should be rebaselined on a more regular basis to ensure more effective decision making when the Council sets its budget. In response the Chief Financial Officer advised there was a particular issue with the Page 11
Page 12
indicator relating to the timing of a budget decision taken on the day the Council's budget was set for the next year. The Council approved exercising its option to have financial flexibility which which not a normal part of the Council's budget setting process but as result of the pandemic and the current funding crisis in local government. The budget for 2023/24 was amended in February 2024 however it was too late to reflect it in the budget figures used for this indicator. She advised going forward normal regular updates would not be impacted by unusual decisions such as this. Councillor Keith asked for an explanation of the Indicator Description "0% participation for 16-19 year olds", referenced in Note 10 of Appendix 3. In response the Strategy and Performance Manager agreed to double check the metadata relating to the indicator and provide an update to Committee. Following consideration the Committee unanimously agreed to note the Council's performance in terms of a corporate overview of benchmarking results. Page 12
Page 13
Report to: Audit and Scrutiny Committee Meeting Date: 24 June 2025 Report by: Audit and Risk Manager Report No: GSP029/25/DL Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Annual Report – 2024/25 1. PURPOSE ☒ For Decision ☐ For Information 1.1 This report is submitted to Committee in terms of Section III (2) and (10) of the Council’s Scheme of Administration relating to the consideration of reports from the Council’s Internal Auditor and the provision of the annual assurance statement provided by Internal Audit on the Council’s control environment. 2. SUMMARY 2.1 To provide Committee with a copy of the Internal Audit Annual Report for the year ended 31 March 2025, together with the Audit and Risk Manager’s opinion on the adequacy and effectiveness of the Council’s system of internal control. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) That Committee considers the contents of the annual report given as Appendix 1 to this report and seeks clarification on any matters relating thereto. Dafydd Lewis Audit and Risk Manager 4. BACKGROUND AND CONTEXT 4.1 The purpose of this report is to present to the Audit and Scrutiny Committee the Internal Audit Annual Report for the year to 31 March 2025, which includes the Audit and Risk Manager's independent assurance opinion on the adequacy of the Council's overall control environment. 4.2 The Public Sector Internal Audit Standards (PSIAS) requires the Chief Audit Executive (CAE), the Council’s Audit and Risk Manager, to provide an annual internal audit opinion and report on the adequacy and effectiveness of the Council’s governance, risk Item 6. Page 13
Page 14
management and internal controls to support the preparation of the Annual Governance Statement. 4.3 To meet the requirements of the PSIAS, the Internal Audit Annual Report 2024/25 (Appendix 1) includes the annual opinion of the Audit and Risk Manager and provides details of internal audit activity and performance during the year. 5. PROPOSALS 5.1 The Internal Audit annual report provides a summary overview of the nature and extent of audit work carried out during the year to inform the audit opinion on the internal control environment operating within the Council. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. Page 14
Page 15
6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 15
Page 16
APPENDIX 1 1 MORAY COUNCIL INTERNAL AUDIT ANNUAL REPORT 1 APRIL 2024 to 31 MARCH 2025 Page 16
Page 17
2 CONTENTS Page SECTION 1 – INTRODUCTION 3 SECTION 2 – BASIS OF OPINION 3-4 SECTION 3 – SUMMARY AND LIMITATIONS OF WORK THAT SUPPORTS OPINION 4-13 SECTION 4 – OPINION 13 Contact Details Audit and Risk Manager: Dafydd Lewis E-mail: dafydd.lewis@moray.gov.uk www.moray.gov.uk Page 17
Page 18
3 SECTION 1 – INTRODUCTION 1.1 This report is issued in compliance with the Public Sector Internal Audit Standards (PSIAS), which requires the Audit and Risk Manager to deliver ‘an annual internal audit opinion and report that can be used by the organisation to inform its governance statement’, and which ‘must conclude on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control.’ This report constitutes the required statement. 1.2 It is management’s responsibility to maintain risk management systems, internal control and governance. Internal audit is an element of the internal control framework established by management to examine, evaluate and report on accounting and other controls over operations. Internal audit assists management in effectively discharging its responsibilities and functions by examining and evaluating controls. Internal audit cannot be held responsible for internal control failures. 1.3 Internal audit’s role includes assessing the adequacy of the risk management, internal controls and governance arrangements put in place by management and performing testing on a sample of transactions to ensure those controls were operating for the period under review. 1.4 Public Sector Internal Audit Standards (PSIAS) require officers of the Internal Audit Section to communicate on a timely basis all facts and matters that may have a bearing on their independence. I can confirm that all staff members involved in the 2024/25 internal audit reviews were independent of operational processes and their objectivity was not compromised in any way. SECTION 2- BASIS OF OPINION 2.1 This opinion is based on my knowledge of the Council’s governance, risk and control processes and from the audit work completed during the period 1 April 2024 to 31 March 2025. There are limitations to the level of assurance that can be provided, dependent on the scope and coverage of the audit work completed. My evaluation is based on the following: Page 18
Page 19
4 . SECTION 3- SUMMARY AND LIMITATIONS OF WORK THAT SUPPORTS THE OPINION 3.1 Internal audit operates independently within the Council. It helps the Council accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. There have been no limitations imposed by management on the scope of audit work performed. The internal audit opinion has been informed by the audit work completed during the year. 3.2 The annual audit plan presented to the Audit and Scrutiny Committee describes in some detail the framework around which audit work is to be developed. In addition, the selection of audit topics was chosen with regard to corporate planning documents, budget data, information drawn from the corporate risk register and consultation with senior management regarding possible areas for review. The percentage of internal audit plans completed for 2024/2025, together with a comparison to the previous year, is summarised below, with a more detailed analysis also provided of the status of each audit project. Overall Opinion Assurance statements signed by Heads of Services Risks identified in the Council's Risk Register Reports issued by the External Auditor and other external review agencies Audit work undertaken by Internal Audit during the year to 31st March 2025 Follow Up Reviews to evidence implementation of audit recommendations Governance, risk management and performance monitoring arrangements Review of corporate governance arrangements Page 19
Page 20
5 Percentage of Internal Audit Plan Completed (%) - 2023/ 24 and 2024/ 25 Status of each project included within the Internal Audit Plan 2024/ 25 89% 87% 11% 13% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 2023/ 24 2024/ 25 Completed Carried Forward Audit Projects Status Payroll Audit Review to be carried forward to Audit Plan 2025/26 Procurement and Creditor Payments Completed ICT Hardware Assets Completed Housing and Property- Reactive Maintenance Works Completed Housing Rent Collection & Arrears Management Completed Education – Secondary School Completed Page 20
Page 21
6 3.3 The internal audit work has been conducted in accordance with an established methodology that promotes quality and conformance with the Public Sector Internal Audit Standards and the approved Internal Audit Annual Audit Plan. Progress on the 2024/2025 Internal Audit Plan 3.4 Progress against planned audit work for the year to 31 March 2025 can be summarised as follows:- • Each year, an element of the plan covers work on core financial systems, which are of key significance to the good governance of the Council. These systems receive the most significant focus in terms of management control and are also reviewed on a cyclical basis by the External Auditor to obtain assurances needed for the audit of the annual accounts. Internal audit testing has noted examples of non-compliance with the Council’s Financial Regulations, but generally, effective controls are operating in the management of financial systems. • Summaries of the issues arising in relation to each system or activity covered by internal audit work in 2024/2025 have been reported separately to the Audit and Scrutiny Committee. Appropriate responses to the recommendations are also included. When actioned, the recommendations made in the internal audit reports should provide management with additional comfort Moray Growth Deal Completed Treasury Management Completed Commercial Refuse Collection Completed Governance arrangements to prevent Fraud and Corruption Completed Education- Secondary School Premises Security Completed Absence Management Audit Review to be carried forward to Audit Plan 2025/26 Following the Public Pound Completed Residential Care Completed Out of area placement Completed Fostering and Kinship payments Completed Grampian Valuation Joint Board Completed Page 21
Page 22
7 that the system of control operates as intended. It is therefore imperative that the agreed actions are implemented by management. • I am pleased to report that the majority of the 2024/25 Audit Plan has been completed. However, the reviews of absence management and the testing of payroll payments will need to be carried forward to next year’s Audit Plan. The Internal Audit Section also undertook additional reviews relating to recovery arrangements for Non-Domestic Rates at the St Giles Shopping Centre and a contract for the replacement of windows in a housing scheme. Internal audit resources have also been required to support the Council’s counter-fraud and corruption arrangements due to a decision by senior management to reduce staff resources. These issues have impacted the completion of this year’s Audit Plan. • The Internal Audit Section reports follow-up reviews to evidence the implementation of recommendations to the Audit and Scrutiny Committee. It is appreciated the demands on services, however the follow-up audits undertaken found recommendations that had yet to be implemented within the agreed timescales. The need to revisit audit reviews to evidence the implementation of recommendations has again resulted in an additional workload commitment for the Internal Audit Section. Implementation of recommendations is a key determinant in assessing the adequacy and effectiveness of the Council’s internal control system. If recommendations are not implemented in a timely manner, then weaknesses in control and governance frameworks will remain in place. • On agreement of the Annual Audit Plan by the Audit and Scrutiny Committee, all Heads of Services are informed of the projects for review for the next financial year. Heads of Services are asked to remind staff that during an audit review, they should respond to information requests and reply to audit recommendations within an appropriate timeframe, i.e., within 20 days for audit recommendations and 5 days for information requests. As the Audit and Risk Manager, I have an ongoing requirement to update the Committee regularly on the work undertaken and the performance of the Internal Audit Service in accordance with the Public Sector Internal Audit Standards. I have noted delays in responding to audit enquiries and recommendations that have impacted the timely completion of reviews. I am closely monitoring this issue and have recently requested an additional paragraph to be included within the Council’s Financial Regulations formalising this requirement for officers to respond promptly to audit enquiries and recommendations. • The audit role for the Moray Integration Joint Board (MIJB) involves providing assurances that governance and financial arrangements have been developed and are operating in accordance with policies and that selected systems and processes are suitably controlled. The audits undertaken have noted significant findings, especially in the administration and management of adult social care. The follow-up reviews completed to evidence implementation of the recommendations have again been a particularly time-consuming commitment on the Internal Audit Section. It is anticipated this requirement will continue in 2025/26. Page 22
Page 23
8 • It is acknowledged that the MIJB is a separate statutory body; however, the Council makes a significant ongoing funding contribution to the delivery of its services. The MIJB Audit Plan for 2024/25 included an audit review of Residential Care and Out-of-Area placements, both of which identified a number of findings. Additionally, follow-up reviews of audit reports from previous years found that further progress was still required in implementing recommendations. It is encouraging to note that the Service is seeking a replacement for the current social work and social care case management system, but there is a need for this to be progressed to ensure full implementation of a new system at the earliest opportunity, as it involves the management and recording of highly sensitive information. As the Audit and Risk Manager of the Council, I am increasingly concerned about the governance and operational arrangements within the MIJB and the potential risks to which the Council may be exposed. I also note the Chief Financial Officer’s report to the Special Meeting of the Council on 26 February 2025, "2025/26 Budget and 2025 to 2028 Financial Plan," which outlines expectations for financial savings within the MIJB. While the challenges faced by the MIJB in meeting the needs of social care users within the current financial climate are recognised, these issues continue to need careful management and oversight. 3.5 The total number of recommendations made is set out in the following table: Report Risk Ratings for Recommendations System/ Testing Assessment 2024/25 Audit Plan High Medium Low Payroll Audit Review Carried forward to 2025/26 Audit Plan Procurement and Creditor Payments 0 2 0 Substantial ICT Hardware Assets 1 3 1 Substantial Building Services- Reactive Works 1 5 0 Substantial Housing Rent Collection & Arrears Management 0 2 1 Substantial Moray Growth Deal 2 3 2 Substantial Education – Secondary School 0 4 2 Substantial Treasury Management 0 2 3 Substantial Commercial Refuse Collection 0 6 4 Substantial Governance arrangements to prevent Fraud and Corruption 0 3 2 Substantial Page 23
Page 24
9 Education- Secondary School Premises Security 1 6 0 Substantial Absence Management Audit Review Carried forward to 2025/26 Audit Plan Following the Public Pound 3 2 0 Substantial Residential Care 0 4 3 Substantial Out of area Placements 3 3 0 Limited Fostering and Kinship payments 0 1 2 Substantial Special Investigation: Non Domestic Rates- St Giles Shopping Centre 2 1 0 Substantial Special Investigation: Building Services- Windows Replacement Contract 1 2 0 Limited Grampian Valuation Joint Board 0 0 0 Full 3.6 The following performance measures were in place for 2024/2025: Measure Description Target Actual 2023/24 Actual 2024/25 Final Report Percentage of Auditee(s) responding within 20 days of receiving the draft report. 100% 65% 100% Final Report Percentage of final audit reports issued within 10 days of agreeing the draft report 100% 100% 100% Audit Plan Delivery Percentage of audits completed v planned. 85% 89% 87% Audit Budget Percentage of audits completed within budgeted days. 80% 76% 77% Audit Recommendations Percentage of audit recommendations agreed. 90% 100% 100% Customer Feedback Percentage of respondents who rated that the audit added value and provided meaningful results. 100% 100% 95% Follow Up Reviews Percentage of Follow Up Reviews completed v planned 100% 92% 94% Page 24
Page 25
10 The analysis of the Internal Audit Section's performance for 2024/25 details that the majority of planned projects within the audit plan for the previous year were completed. A comparison with the previous year’s percentage of audits completed against the audit plan indicates a similar level of performance, notwithstanding staffing challenges remain. The duties of the vacant Corporate Investigations Officer have been undertaken by other officers within the Section, along with the additional requirement to conduct significant reviews requested by senior management. Furthermore, as the Audit and Risk Manager, I prepare the Annual Audit Plan as a challenging programme, considering staff resources and the additional duties and responsibilities of the Internal Audit Section. All reports were issued as “final” within 10 days of agreeing on the draft report, with officers accepting all recommendations. It is pleasing to report that services are responding more promptly to audit recommendations within 20 days of receiving the draft reports, however delays were observed in obtaining the requested information or explanations to audit queries. Heads of Services have been reminded of the importance of responding promptly to audit questions or requested information. Analysis also found that more days were required to complete certain projects from the Audit Plan. This included the Out of Area review, which required more extensive testing than initially envisaged, but significant findings were noted from the audit. Additional days were also required within the audit of Reactive Repairs within Building Services as senior management requested a review of a contract for replacement windows. Feedback has also been positive from officers on the value of participating in the audit review process, however one auditee questioned the need for additional testing they believed to be out with the scope of the audit review. 3.7 Governance – regarding the preparation of the Council’s Annual Governance Statement, it is considered that sufficient information has been obtained to conclude that the Council generally complies with the latest good governance practice issued by CIPFA /SOLACE and that the Corporate Management Team and senior managers have a strong awareness of the challenges facing the Council in the incoming period. Written assurances from senior managers also considered governance practice within individual service areas. 3.8 Key governance and internal control arrangements have been maintained, albeit capacity issues called for resources to be prioritised for essential services and to take forward the Council's strategic priorities. It was noted that the Accounts Commission's Best Value Report on Moray Council, issued in March 2024, detailed a number of governance and service improvement recommendations. Progress in implementing these recommendations is regularly reported to the full Council. I have also noted the recent “Change Plan- Corporate Leadership Team - Restructure Proposal” from the Chief Executive to “provide the Council with a more clearly defined and sustainable leadership structure for the foreseeable future” in meeting operational and strategic challenges. 3.9 The Audit and Risk Manager has facilitated a workshop with Members of the Audit and Scrutiny Committee to carry out self- assessments of compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit from the CIPFA Publication – Audit Committees - Practical Guidance for Local Authorities and Police 2022 Edition. This CIPFA Publication sets Page 25
Page 26
11 out its guidance on the function and operation of audit committees in local authorities and police bodies and represents CIPFA’s view of best practices for audit committees in local authorities throughout the UK. This exercise was undertaken in 2024, and it is pleasing to report that the outcome of the self-assessment and evaluation found significant compliance with good practice principles and a high degree of effectiveness. 3.10 Counter Fraud - While the prevention of fraud and error rests with management through the design and operation of suitable systems of control, the audit plan continues to provide time for Internal Audit to coordinate the Council’s participation in the National Fraud Initiative (NFI), a data matching exercise involving a range of public sector bodies. This activity is viewed as complementary to other audit activities, and participation assists Internal Audit in assessing the potential for the occurrence of fraud and related fraud risk. 3.11 The 2024/25 NFI exercise has progressed and the agreed approach is for services to review and document the reasons for data matches while the Internal Audit Section investigates potential fraud, monitors progress, and reports on the outcome. Audit Scotland recommends that councils complete an "NFI self-appraisal checklist as part of planning for the 2024/25 exercise." This self-appraisal checklist has been reviewed and completed by the Audit and Risk Manager and was provided to the Audit and Scrutiny Committee on 7 May 2025. It is pleasing to report that, based on the overview undertaken, the Council is essentially meeting Audit Scotland’s requirements, with no immediate actions required. 3.12 An element of the Audit Plan is devoted to reviewing core financial systems. Testing was undertaken using a data analysis software application to extract a random sample of creditor payment transactions for review. The audit programme of testing undertaken was developed from the Chartered Institute of Public Finance and Accountancy Systems Based Auditing Control Matrices. Findings found a need for some administrative improvements, but generally, appropriate controls are operating effectively, and the integrity of systems has been maintained. Further use is planned of the data analysis software application to ensure more focused audit testing can be undertaken to provide additional assurance in the prevention of fraud and error. 3.13 A review was undertaken of the Council and the MIJB’s governance arrangements to prevent fraud and corruption. The primary responsibility for preventing and detecting fraud and corruption rests with management to ensure adequate systems of internal control, segregation of duties and proper authorisation procedures. However, the Internal Audit Section does have a role in supporting these arrangements by assessing the adequacy of these controls. Findings included a need for further development in the effective reporting of irregularities. Implementation of the recommendations within this audit review will support the Council’s anti-fraud and corruption arrangements. Page 26
Page 27
12 3.14 Risk Management – procedures have been developed with a risk management policy in place and risk registers maintained at corporate and service levels. The Risk Management and Business Continuity Officer has assisted in facilitating further implementation and development of risk management arrangements. This has included updating policies covering risk management and business continuity. It was noted that the full Corporate Risk Register was reported to the Corporate Committee for review and consideration at its meeting on 23 April 2024. At this Committee, it was agreed there should be quarterly reporting to the Committee on risks that had a high-risk score to enable regular review of the risks and mitigating actions. 3.15 It was noted that financial, staffing, information, communication and technology risks remain on-going challenges to the Council. These are prominent risks for the Council covering how it discharges its functions in terms of good governance, how it manages its financial affairs, the arrangements for managing and supporting its workforce, and the use of technology, which is key to delivering most, if not all services. It is appreciated these high-risk categories come not only from circumstances internal to the Council but also from challenges from the broader economic and social environment faced by all local authorities. Statement on Conformance with the Public Sector Internal Audit Standards 3.16 The Local Authority Accounts (Scotland) Regulations 2014 require that ‘a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing’. The recognised standards adopted by all Scottish councils are the Public Sector Internal Audit Standards (PSIAS) developed by the Chartered Institute of Public Finance and Accountancy and the Chartered Institute of Internal Auditors. 3.17 Internal performance monitoring against PSIAS has been ongoing over the last few years. All Scottish local authorities are required to have an External Quality Assessment (EQA) every 5 years. As part of the Council’s membership of the Scottish Local Authorities Chief Internal Auditors’ Group, it was agreed that this EQA requirement would be met by each local authority internal audit service undertaking a review of another council and will thereafter receive a review in return. An EQA of the Council’s Internal Audit Section was completed by the Chief Internal Auditor of Perth and Kinross Council, and the findings were reported to the Audit and Scrutiny Committee on 11 September 2024. The overall conclusion of the external assessment is that the Council’s Internal Audit Section fully conforms with the PSIAS. This is the highest level of performance standards in the delivery of an internal audit service within a Scottish local authority and should provide assurance to members and senior management of the effectiveness of internal audit arrangements within the Council. 3.18 The Public Sector Internal Audit Standards require the Audit and Risk Manager to assess whether audit staffing resources are sufficient to meet the organisation’s audit needs. Where it is believed that resource levels may adversely impact the delivery of the annual internal audit opinion, this must be brought to the attention of the Committee. As reported to this Committee on 12 February 2025 (paragraph 6 of the minutes refers), and in accordance with the Public Sector Internal Audit Standards, I am Page 27
Page 28
13 required to highlight my concerns regarding whether the current staffing levels within the Internal Audit Section are adequate to meet the future auditing needs of the Council and its partner organisations. An attempt has been made to appoint a full-time Assistant Auditor; however, this was unsuccessful. A subsequent effort to recruit a part-time Auditor also proved unsuccessful, and the post is currently being re-advertised. Members of the Audit and Scrutiny Committee will be kept informed of any developments in the staffing situation and the potential impact on the delivery of the internal audit service. 3.19 In considering the sufficiency of the audit coverage, the Committee is reminded that the responsibility for developing and maintaining a sound control environment rests with management and not with internal audit. SECTION 4- OPINION 4.1 Any system of control can only ever provide reasonable and not absolute assurances that control weaknesses or irregularities do not exist or that there is no risk of error, fraud, or breaches of laws or regulations. Furthermore, it is the responsibility of management to establish an appropriate sound system of internal control and monitor its effectiveness. It is the responsibility of the Audit and Risk Manager to provide an annual assessment of the robustness of the internal control system. 4.2 It is my opinion, with due consideration to the issues detailed within this report, based on the audit work completed and other sources of assurance, it is considered that reasonable assurance can be placed on the adequacy and effectiveness of the Council’s internal control system for the year ending 31 March 2025. Dafydd Lewis Audit and Risk Manager 13 April 2025 Page 28
Page 29
Report to: Audit and Scrutiny Committee Meeting Date: 24 June 2025 Report by: Audit and Risk Manager Report No: GSP024/25/DL Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Section Update Report 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to consider an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 2.2 This report provides an update on audit activity and projects progressed since the last meeting. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers and notes the contents of this report and seek clarification on any points. Dafydd Lewis Audit and Risk Manager 4. BACKGROUND AND CONTEXT Moray Integration Joint Board – Internal Audit Service 4.1 The Audit and Risk Manager of the Council is also the Chief Internal Auditor of the Moray Integration Joint Board (MIJB). This role includes providing assurance on the internal Item 7. Page 29
Page 30
controls of systems and practices required by the MIJB to deliver services, regardless of whether they operate through Council or NHS systems. An agreement has been reached with NHS Grampian management and their Internal Audit Provider to share audit reports on NHS systems and practices relevant to the MIJB with the Chief Internal Auditor (MIJB). This arrangement also allows the Chief Internal Auditor (MIJB) to report these reviews to the Audit, Performance and Risk Committee of the MIJB, enabling members to fulfil the functions outlined in the Scheme of Administration. In addition, a “Ways of Working Protocol” has been agreed between the internal audit services of NHS Grampian and the Moray, Aberdeenshire, and Aberdeen City Integration Joint Boards (see Appendix 1). This collaborative approach aims to strengthen governance and the control environment across all organisations by supporting more comprehensive and overarching reviews. Follow Up Reviews 4.2 Internal Audit reports are regularly presented to Members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: 4.3 Roads Maintenance - Planned The previous follow up review undertaken of Roads Maintenance - Planned was reported to the Audit and Scrutiny Committee on 8 May 2024 (para 5 of minute refers). The review found recommendations that had not been implemented and needed revised implementation dates. It is appreciated that the implementation of these recommendations required significant staff resources, including the support of the Accountancy Section. This Follow-Up Report, detailed on Appendix 2, provides an update on the current position regarding these outstanding recommendations. Unfortunately, it was found that the recommendations to review the in-house contractor schedule of rates, bills of quantities, and on-cost overhead recovery percentages remain outstanding, although some progress had been made. 4.4 During this follow-up review, it was noted that the implementation of the recommendations had been impacted by a lack of staffing resources, which was outside the control of the Service. The possibility of securing additional resources is now being investigated to facilitate a more detailed costing analysis aimed at providing greater accuracy and transparency in the rates and overhead recovery percentages used for accounting and cost recovery purposes. It is intended that the Internal Audit Section undertakes another follow-up review in six months to assess progress in implementing the outstanding recommendations, with a report to be provided to the Audit and Scrutiny Committee. Moray Integrated Community Equipment Store 4.5 An audit was previously undertaken of the Occupational Therapy Store, now known as the Moray Integrated Community Equipment Store. Occupational therapy stock comprises aids and equipment issued to help individuals with various daily tasks, including cooking, dressing, and bathing. Stock items can vary in value, ranging from a few pounds to upwards of £1,000 for certain types of hoists and specialised seating. A particular feature of this Store is that it also handles the return of equipment that is no longer required. Where possible, this equipment is decontaminated and made available for reuse. The audit identified significant areas where improvements are needed in the current operating arrangements. A recent follow-up review found progress in implementing the recommendations; however, several remain outstanding and require the agreement of revised implementation dates. The Follow-Up Report, which evaluates the implementation of the agreed recommendations, is provided in Appendix 3. Page 30
Page 31
Self Directed Support (SDS) – Option 2/3 4.6 A follow-up review was undertaken to assess the implementation of recommendations from a previous audit of Self-Directed Support (SDS). The Social Care (Self-Directed Support) (Scotland) Act 2013 came into effect in April 2014, introducing the term "Self- Directed Support" (SDS) to describe how individuals can exercise choice and control over the support or services that enable them to live independently and achieve agreed outcomes. The audit reviewed the systems and procedures for administering SDS Option 2 – Managed Budget, where individuals, following assessment, choose their own support while Health and Social Care Moray (HSCM) arranges the provision and payment of that support, and Option 3 – Managed Support, where HSCM selects, commissions, and pays for the appropriate support on behalf of the individual. The audit examined processes related to supporting individuals in determining their preferred care delivery options, contractual relationships with care providers, financial management, and the monitoring of individual care packages. The Follow-Up Report, provided in Appendix 4, highlights several recommendations that have not been implemented. The Service has provided revised implementation dates for the outstanding recommendations. In addition, the Service intends to review progress in implementing these recommendations at the monthly SDS Steering Group meetings, with updates also reported for monitoring at the monthly Practice Governance Board meetings. Pool Cars Scheme 4.7 This follow-up review assessed the implementation of recommendations made in a previous audit of the Pool Car Scheme. A pool car is a vehicle owned by the Council and made available to employees on a shared basis. At the time of the audit, the Council’s fleet of pool cars consisted of 118 vehicles; 84 classified as general and 34 designated as service-dedicated vehicles. Approximately 10% of the pool car fleet comprises electric vehicles. The pool car system is managed through a software application called Tranman, which is overseen by Fleet Services. The scope of this audit was to review the systems and procedures governing the management and use of pool cars. Policies and procedures were examined to ensure they provide appropriate guidance to officers for booking and using pool cars. The follow-up review noted progress in the implementation of recommendations. However, some remain outstanding, and there has been a need to agree on revised dates to implement these recommendations. The Follow-Up Report is provided in Appendix 5. Early Learning and Childcare Premises Security 4.8 This follow-up review concerns a previous audit undertaken of the controls to mitigate the risk of unauthorised access to Early Learning and Childcare Nurseries. The audit also examined the controls to prevent children from leaving nursery buildings and play areas unnoticed. As part of the review, policies and procedures were assessed, and visits were made to a sample of nurseries to observe and test the security measures in practice. The audit acknowledged that the varying age and type of premises present challenges in ensuring the consistent implementation of physical security arrangements. It is pleasing to report that the follow-up review found that all recommendations had been implemented. The Follow-Up Report is provided in Appendix 6. 5. PROPOSALS 5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the period from 7 May 2025 to 24 June 2025. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are Page 31
Page 32
agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments Page 32
Page 33
6.5 Risk The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 33
Page 34
Aberdeenshire Health & Socia! Care Partnership Aberdeen City Health & Social Care Partnership A., • ''" ' • • ..,, Ways of Working Protocol NHS Grampian and Integration Joint Boards Internal Audit NHS � Grampian The following sets out the protocol to be followed with regards to assurance activities across NHS Grampian and the Moray, Aberdeenshire and Aberdeen City fntegration Joint Boards. This work will be led by the respective Chief Internal Auditors (CIAs) and focus on the following: • The Internal Audit function of the Partner bodies will be included as formal consultees in the annual audit plans. It is acknowledged that each Partner body may have different consultation, committee reporting, and timescale requirements. However, where practical, ttie CIAs should share their draft audit plans to allow for consultation before the plans are finalised. • Where possible, and with the approval of the respective Audit Committees, an area for joint working/assurance should be considered annually. This will be subject to the availability of resources from each Partner body. ·A joint thematic report, bringing together the findings from each of the Partner bodies' reviews, should be considered. However, reporting arrangements will depend on the needs and requirements of each Partner body's Audit Committee. • There will be regular collaboration between the CIAs of the respective bodies. This will include a formal quarterly check in, in addition to ad hoc catch ups as required. • The CIAs will draw to the attention of their counterparts any significant findings from audit work they d�em as relevant throughout the year. • In line with their respective timelines, annual audit opinions will be shared by the CIAs with the Internal Audit function of the respective bodies for information. • NHS Grampian Internal Audit Reports shall be shared with the CIA of the IJBs in line with the agreement, as set out in the hold harmless letters. Hold harmless letters will be reviewed annually and updated as required. APPENDIX 1 Page 34
Page 35
APPENDIX 2 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Roads Maintenance - Planned REPORT REF: 22'014 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Works met by the capital budget provision follow proper procurement procedures, are monitored effectively and accurately costed. 5.1 A review of the in-house contractor Schedule of Rates should be undertaken to ensure individual costings provide value for money. As works are also awarded directly to the in house contractor based on a Bill of Quantities, the same requirement Medium Yes 31/03/2023 (Revised Implementation Date 31/03/2025) (2nd Revision to Implementation Date: 31/10/2025) Part Implemented- Evidence was noted that the Service has been reviewing individual costings within the Schedule of Rates and the Bill of Quantities, with support from the Accountancy Section. However, due to a specific staffing issue, this exercise has not been completed as planned. The Roads Maintenance Manager acknowledges the need to progress the review of in-house contractor rates in order to evidence the basis Page 35
Page 36
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation should be undertaken. Yearly changes to individual rates should also be reviewed to ensure best value is achieved for the costs charged. of calculation and provide greater transparency. A similar audit recommendation was recently made to Building Services, highlighting the need to review in-house contractor rates. Further investigation is underway to secure additional resources for both Services to facilitate a detailed costing exercise, adopting a “zero-based” approach to reviewing in-house contractor rates. It is proposed that a follow-up review be undertaken in six months to assess progress and report to the Audit and Scrutiny Committee on the implementation of this recommendation. 5.2 Oncost percentages charged on works completed by the in house contractor should be reviewed to ensure the rates used reflect the expenditure incurred. Medium Yes 31/03/2023 (Revised Implementation Date 31/03/2025) (2nd Revision to Implementation Part Implemented- This recommendation to review on-cost percentages charged is directly linked to the need to review in-house contractor rates, as detailed in section 5.1. As previously detailed, it is proposed that a follow-up review be undertaken again after six Page 36
Page 37
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Date: 31/10/2025) months to assess progress and report back to the Audit and Scrutiny Committee on the implementation of this recommendation. 5.3 Consideration should be undertaken to develop a range of performance indicators to monitor the works undertaken by private and in-house contractors. Medium Yes 31/03/2023 (Revised Implementation Date 31/12/2024) Implemented- The Association for Public Service Excellence (APSE) Roads, Highways, and Winter Maintenance performance comparison indicators with other local authorities are used in the management of the Service. Benchmarking exercises have also been undertaken to compare in-house contractor costs with charges made by external contractors for comparable works. It is pleasing to note, from discussions with the Roads Maintenance Manager, that these benchmarking exercises are to continue and be further developed. 5.4 Operating procedures should be documented to assist officers in managing projects and ensuring Medium Yes 31/07/2022 (Revised Implementation Date 31/12/2024) Part Implemented- An individual scheme file pack for all internal works over £10,000 has been developed. At the time of the follow- Page 37
Page 38
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation working practices follow recommended civil engineering conditions. (2nd Revision to Implementation Date: 30/09/2025 up audit, it was found that officers were not consistently completing all the required fields in the individual scheme file pack. The Roads Maintenance Manager has reminded officers to follow the agreed procedures for the administration of contracts. A further follow-up review will be undertaken to verify the correct completion of individual scheme file packs for all internal works over £10,000. Page 38
Page 39
APPENDIX 3 Moray Council Internal Audit Section DEPARTMENT: Health & Social Care Moray SUBJECT: Moray Integrated Community Equipment Stores REPORT REF: 24'013 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective systems and procedures operating to ensure accurate records are maintained to account for all occupational therapy equipment held within Stores and issued to people who access the service. 5.1 A full stock check should be undertaken to ensure records correspond to the actual number of items held within Stores. High Yes 31/03/2024 Implemented– The review confirmed that Stores officers completed a full stock check after implementing new stock management arrangements. The stock take was verified by an officer from the Internal Audit Section with only minor variances noted between system recorded figures and the actual stock held. Variances were investigated and explanations obtained. Page 39
Page 40
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Items of equipment should be kept wherever possible in Asset Number order within the Stores Building. Asset Numbers should be clearly recorded where possible on shelving. Medium Yes 31/03/2024 Implemented- Asset numbers are now clearly recorded on shelving used for storing equipment. Shelf locations across the Store have also been added to the Stores Software Application (ELMS). 5.2 The software application used for purchasing equipment should be regularly updated with the stock issued to ensure an accurate unit price is maintained. Further exploration should be undertaken of ELMS with the purpose of enabling the direct purchase of equipment. Medium Medium Yes Yes 31/03/2024 (Revised Implementation Date 30/06/2025) 31/10/2024 (Revised Implementation Date 30/06/2025) Outstanding– The review found that the software application used for purchasing occupational therapy equipment, which is separate from ELMS, was not regularly updated with the stock issued. This impacts the accuracy of individual stock valuations. Outstanding- The Service is making enquiries with the software provider for ELMS to check whether it could provide stock valuations in accordance with accounting requirements. However, alternative solutions may be required. The outcome of these investigations will be reported to the Page 40
Page 41
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Operational Management Team so that a preferred solution can be decided. A revised implementation date of 30/06/2025 has been agreed with the Service. 5.3 A review should be undertaken of the current policy of revaluing re- used items of equipment at 50% of the original unit price. Medium Yes 31/01/2024 (Revised Implementation Date 30/06/2025) Outstanding- The decision to revalue re- used equipment at 50% of the original purchase price is still under review. The Service has indicated they intend to provide a report to members of the MIJB at the conclusion of this exercise. A revised implementation date of 30/06/2025 has been agreed with the Service. 5.4 People who access the service should be advised that any equipment received should be included within their personal property content insurance. Medium Yes 31/01/2024 (Revised Implementation Date 30/06/2025) Outstanding– This recommendation is still under review by the Service. A report on this issue is intended to be provided to MIJB members. A revised implementation date of 30/06/2025 has been agreed with the Service. 5.5 Maximum and minimum stock levels Medium Yes 31/03/2024 Implemented- The review has confirmed that Page 41
Page 42
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation should be implemented in ELMS to assist officers in ensuring the effective management of stock levels. maximum and minimum stock level functions are now used within ELMS. The Service also intends to review these stock level parameters regularly. 5.6 A record should be maintained of the stock checks undertaken, and any adjustments to stock figures for equipment recorded within ELMS should require the authorisation of the supervisor. Medium Yes 31/01/2024 Implemented– Records of weekly stock checks are now maintained. It was also confirmed that adjustments to stock levels within ELMS can now only be authorised by supervisory officers. 5.7 In regard to the stock of returned specialised chairs noted during the audit review, a decision should be undertaken regarding their future use. Medium Yes 31/03/2024 Implemented- The Service has decided to retain the chairs. A meeting between officers from the Equipment Stores of Aberdeen City, Aberdeenshire and Moray agreed to explore options regarding the use of these chairs and other equipment within the Grampian area. In addition, the Service has advised that the chairs could be adapted to meet the specific needs of individuals, potentially providing an Page 42
Page 43
Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation alternative to procuring new items. 5.8 Further development should be undertaken of ELMS to enable greater use of the software application in the management of stock items. Medium Yes 31/03/2024 Implemented– It was found that the Service is making greater use of the reporting functions within ELMS. In addition, data from ELMS is exported to another software application to allow for greater analysis of information. 5.9 Officers should be instructed to utilise the facility within ELMS to mark stock as out for delivery. Low Yes 30/06/2024 Implemented- Procedures are now in place requiring drivers delivering equipment from Stores to mark equipment as out for delivery within ELMS. 5.10 A review of off contract expenditure should be carried out and where necessary contracts developed. Low Yes 31/03/2024 (Revised Implementation Date 30/06/2025) Part Implemented- A contract review for procurement of occupational therapy equipment is being undertaken. This includes developing contacts that include a specialised type of chairs currently procured off contract. A revised implementation date of 30/06/2025 has been agreed with the Service. 5.11 A formal procedure should be established for maintaining a list of Medium Yes 29/02/2024 Implemented- A record of all NHS officers with authorised access is maintained, Page 43
Page 44
Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation NHS officers requiring access to ELMS. including confirmation of up-to-date data protection training. The audit also confirmed regular reviews are undertaken that check for officers on-going access requirements to ELMS. 5.12 Current operating practices should be recorded within a Service Operating Manual. Medium Yes 31/03/2024 Implemented - Operating Procedures are now in place to provide officers with a point of reference guidance in the administration of the Moray Integrated Community Equipment Store. 5.13 A review of service procedures should be undertaken to ensure the Store is informed of a change in circumstances in an individual’s condition where an item of equipment may no longer be required. Arrangements should then be undertaken for collection at the earliest opportunity. Medium Yes 29/02/2024 Implemented- The Moray Integrated Community Equipment Service is informed of equipment issued to an individual but is no longer required. Testing has confirmed that when informed, arrangements are made for the collection of this equipment. Page 44
Page 45
Moray Council Internal Audit Section 7 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation If no agreement can be made for the equipment to be returned to the Store, consideration should be given to invoicing the individual for the item. Medium Yes 31/01/2024 (Revised Implementation Date 30/06/2025) Outstanding – A review of whether there should be invoicing for equipment not returned is currently on-going within the Service. It is intended to report to members of the MIJB on this issue. A revised implementation date of 30/06/2025 has been agreed with the Service. 5.14 Improvements identified to the Service during the audit review regarding the physical security of the Moray Integrated Community Equipment Store building should be implemented as a matter of urgency. High Yes 31/03/2024 Implemented - A new alarm system has been fitted at the Moray Integrated Community Equipment Store and is now in operation. Page 45
Page 46
APPENDIX 4 Moray Council Internal Audit Section BODY: Health & Social Care Moray SUBJECT: Self Directed Support (Options 2 & 3) REPORT REF: 23'025 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective controls operate in the management and recording arrangements for the delivery of SDS Options 2 and 3 care packages. 5.1 In accordance with SDS Regulations, evidence should be maintained to document the discussions held by social workers regarding the various care delivery options discussed with the individual using care services. High Yes 30/09/2023 Part Implemented- The Service has developed Social Work Assessment Guidance and documentation that includes a requirement for supporting and recording the conversations that need to occur with individuals and families when determining care delivery options. The new documentation aims to ensure the recording of clear and transparent discussions regarding the decision-making on SDS Page 46
Page 47
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation options. A quality assurance review was undertaken by the Service in January 2025 to evaluate compliance with the Guidance. The review found the majority of assessments sampled to have the supported person’s views on SDS options discussions recorded, but instances were identified of no or limited information being recorded on the supported person’s views. An action plan is to be developed on improvements required, and further reviews are to be carried out by the Service to monitor the recording of discussions and their quality. Outcome reporting will be overseen by monthly meetings of the Practice Governance Board, with the next meeting on 27/05/25. Internal Audit Section does not intend to undertake another formal review to evidence the implementation of this recommendation, but an overview of progress undertaken by the Service will be done when undertaking a Page 47
Page 48
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation follow-up review of other recommendations within this audit. 5.2 Documented procedures should be developed to support social workers and individuals using care services in the selecting of SDS care delivery options. High Yes 31/03/2024 (Revised Implementation Date 30/09/2025) Part Implemented- Comprehensive Social Work Assessment Guidance to support officers has been developed by the Service and put into operational use. An objective of the Guidance is to support a clear and transparent decision-making process and promote consistency whilst aligning with national and local policy requirements and best practices. However, additional work is required on updating the information available to individuals through guides and internet content to SDS standards and further developing the Resource Allocation System. A revised date of 30/09/2025 for full implementation has been agreed. Page 48
Page 49
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.3 An annual reference document detailing a breakdown of the rates paid to care providers should be provided to all relevant officers to assist in budgetary planning and the accurate preparation of an individual's support package. High Yes 30/06/2023 (Revised Implementation Date 01/04/2025) Outstanding. An annual reference document is maintained and made available to all relevant officers to assist in the costing of support packages. However, the document has not been revised to include a breakdown of costs for block funding arrangements. Work is currently ongoing, together with the budget savings plan, to identify the appropriate costing breakdown required for block funded services. A revised implementation date of 01/04/2025 was agreed during this follow up review. Verification regarding the implementation of the recommendation will be done when undertaking the next follow up review for this audit. Page 49
Page 50
Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.4 All officers should be reminded to update the CareFirst System to ensure the database is up-to-date and accurate for each individual using care services. High Yes 30/09/2023 Implemented. The required content of the CareFirst System is set out in the new Social Work Assessment Guidance referred to in 5.1. Training programmes are being overseen by the SDS Consultant Practitioner, and quality assurance and review activities undertaken by the Service to evaluate the effectiveness of the new guidance in achieving the required case recording standards. This will continue to be monitored by further Service reviews and outcome reporting will be overseen by monthly meetings of the Practice Governance Board, with the next meeting on 27/05/25. 5.5 A tripartite agreement between the individual using the care service, Council and care Medium Yes 30/09/2024 (Revised Implementation Date Part Implemented- A random sample of Option 2 packages commencing in 2024/25 was selected, and they all had a valid tripartite agreement in place. However, further Page 50
Page 51
Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation provider should be agreed for all SDS Option 2 care packages. 31/07/2025) to discussions with officers, a review of service provider payments is to be undertaken to identify any gaps in historical packages to ensure all Option 2 individuals receiving a social care service have a tripartite in place. A revised date for full implementation of the recommendation by 31/07/2025 has been agreed with the Service. 5.6 A contractual agreement detailing service delivery and costs should be agreed with the 3 providers of day care services noted within the findings. High Yes 31/03/2024 (Revised Implementation Date 31/08/2025) Outstanding. Contractual agreements with the 3 providers are not yet in place. However, work has been ongoing in line with the budget savings plan which will inform the service requirements and costs. This exercise is intended to be completed by 31/03/2025 and will allow contractual arrangements to be created for these services via a framework agreement. A revised implementation date of Page 51
Page 52
Moray Council Internal Audit Section 7 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 31/08/2025 has been agreed with the Adult Social Care Commissioning Service. 5.7 Annual support plan reviews of individuals in receipt of SDS Option 2 and 3 care packages should be undertaken in accordance with agreed procedures. High Yes 30/09/2024 (Revised Implementation Date 31/12/2025) Outstanding. The recommendation of the requirement to undertake annual reviews of care and support plans was also detailed within the audit of SDS Option 1 and the recent Out of Area Placements review. The Heads of Service have stated that a review schedule is to be established, and the need to undertake annual reviews of care and support plans for individuals receiving social care services is to be considered as part of efficiency strategies. A revised implementation date of 31/12/2025 has now been agreed. 5.8 Consideration should be given for management to undertake regular reviews of the accuracy Medium Yes 30/09/2023 Implemented. A Standard Operating Procedure (SOP) has been developed to comprehensively detail all checks required for Page 52
Page 53
Moray Council Internal Audit Section 8 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation and recording of the checks completed to ensure the accuracy of payments made to care providers. invoice processing. A management review of a sample of invoices is being carried out on a monthly basis, to confirm verification checks have been fully undertaken in line with the SOP. The performance of the management review has been evidenced as recorded on the invoice monitoring spreadsheet maintained by Community Care Finance. 5.9 The Council's charging policy should be reviewed in regard to day care and a decision made as to whether a charge should be levied for the service in the future. High Yes 30/09/2023 (Revised Implementation Date 30/09/2025) Outstanding. The Charging and Contributions Policy has not yet been reviewed due to staffing resourcing issues. However, the Charging and Contributions Policy is planned for review as part of the ongoing savings work within the Service. A working group is reviewing the issue, considering its alignment with the COSLA Non-Residential Charging Policy. The Page 53
Page 54
Moray Council Internal Audit Section 9 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation outcome of the review and potential charging for day care services is planned to be presented to the MIJB for decision. A revised implementation date of 30/09/2025 has been agreed with the Service. It is appreciated the decision will thereafter be required to be considered by Moray Council under their statutory duties for the setting of charges, ahead of the 2026/27 budget setting process. 5.10 A review of arrangements regarding the authorisation of individual care packages should be undertaken. Thereafter, authorisation requirements should be documented and communicated to all appropriate officers. Medium Yes 31/08/2023 (Revised Implementation Date 30/06/2025) Outstanding. Full review and documentation of care package authorisation requirements have not been resourced to date. Significant temporary measures have been implemented as a result of work on the budget savings plan, including the creation of a High Cost Package Panel for appropriate authorisation, however expansion of the review and Page 54
Page 55
Moray Council Internal Audit Section 10 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation documentation is required. This is to be taken forward with urgency by the Service, with a full review of authorisation levels and documentation aligning to the development of the Resource Allocation process and with consideration given to the Financial Regulations. A revised implementation date of 30/06/2025 has been agreed with the Service. Page 55
Page 56
APPENDIX 5 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Pool Cars REPORT REF: 24'014 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Confirm that policies and procedures for the arrangements and administration of pool cars are in place, up to date and adequate. 5.1 All policies and procedures should be reviewed and updated on a regular schedule to ensure content remains current and valid. Thereafter, they should be promoted and included within the Council Intranet to ensure officers are aware of their requirements and conditions. Medium Yes 31/12/2024 (Revised Implementation Date 30/09/2025) Outstanding- Fleet Services has advertised for a Fleet Officer (Pool Cars and Projects); however, this proved unsuccessful, with the post currently being re-advertised. This has delayed the implementation of this recommendation, but upon recruitment of this additional officer, a full review of policies and procedures will occur. A revised implementation date of 30/09/2025 has been agreed with the Service. Page 56
Page 57
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective controls in place in the management, booking and use of pool cars. 5.2 Services should be reminded that if an officer books a vehicle and is later not required, the booking must be cancelled immediately. Low Yes 30/09/2024 Implemented- The pool car booking site has been updated with a notice reminding officers that if they book a vehicle that is later not required, the booking must be cancelled immediately. 5.3 Senior Management should be informed to remind all officers that the use of pool car vehicles must be in accordance with the Employee Guide. Service Managers should receive monthly reports from Fleet Services of any identified instances where the use of a pool car is not in accordance with the Employee Guide. High High Yes Yes 31/04/2024 31/12/2024 (Revised Implementation Date 30/09/2025) Implemented- A Three Minute Brief has been issued requesting all Heads of Services to remind officers of the need to comply with the Employee Guide when using a pool car. Outstanding- Fleet Services is currently in the process of recruiting a Fleet Officer (Pool Cars and Projects). Once this officer is appointed, the postholder will be responsible for developing additional monitoring reports on the use of pool cars. A revised implementation date of 30/09/2025 has been agreed with the Service. Page 57
Page 58
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.4 Fleet Service in consultation with the Accountancy Service should review the rechargeable hourly rate used for funding the pool car service. Consideration should also be given to recharging these costs to Services every month. Medium Yes 30/06/2024 (Revised Implementation Date 31/10/2025) Part Implemented- The Service is currently reviewing recharge rates for pool cars; however, this process has not yet been completed. A revised implementation date of 31/10/2025 has been agreed with the Service. Page 58
Page 59
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.5 A review of the current pool car fleet should be undertaken to determine whether there are any further value for money opportunities to increase the efficiency of the Service. Low Yes 31/12/2024 Implemented- A review has been undertaken by the Service to explore further value for money and efficiency opportunities regarding the use of pool cars. Recommendations for additional improvements have been identified and will be considered for implementation by the Environmental Commercial Management Team. It was noted that some improvements have already been introduced, particularly in monitoring the usage of pool cars and the recharging arrangements for certain dedicated service vehicles. 5.6 Regular physical inspections of pool car vehicles should be introduced to ensure essential documentation and equipment are maintained in all pool car vehicles. Low Yes Implemented Implemented- Regular physical inspections of pool cars are now undertaken. Checklists detailing the equipment held in each vehicle has also been introduced. Page 59
Page 60
APPENDIX 6 Moray Council Internal Audit Section DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Early Learning and Childcare Premises Security REPORT REF: 24'017 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: The controls for early learning and childcare nurseries and play areas are appropriate to prevent unauthorised access and children from absconding. 5.1 Council operated nurseries should be reminded to update the Early Learning and Childcare Policies, Procedures and Guidance Document with their site-specific security arrangements. Medium Yes 31/08/2024 Implemented- A reminder has been issued to all Council operated early learning and childcare nurseries to update, if required, their site-specific security arrangements. Testing has also been done that the Early Learning and Childcare Policies, Procedures and Guidance for the nurseries visited during the audit have been updated. 5.2 All security training provided to nursery officers should be recorded within their personal training records. Regular security Medium Yes 31/08/2024 Implemented– The follow-up review has confirmed, through sample testing of officers' personal training records, that guidance regarding security procedures is included. In Page 60
Page 61
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation procedures awareness training should also be provided on an ongoing basis. addition, training related to security procedures was found to be part of ongoing training programmes. 5.3 All nurseries should agree on site specific operating guidelines to follow in the event of unauthorised access to the nursery by an individual. Medium Yes 31/08/2024 Implemented- Operating guidelines should now be in place for all nurseries in the event of unauthorised access. Follow up review testing of a sample of early learning and childcare nurseries has confirmed these operating guidelines are in place. 5.4 Consideration should be given to including a requirement for ensuring premises and play area security arrangements within the contractual agreements with private and third sector early learning and childcare nurseries. Medium Yes 31/08/2024 Implemented- The contract with private and third sector early learning and childcare nurseries has been updated and includes a requirement to have an Access Control Policy in place and to adhere to national standards regarding safeguarding, which include maintaining secure premises. It is pleasing to note the close collaboration between Council officers and the private/ third sector providers, Page 61
Page 62
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation which was evidenced by sharing the recently drafted Invacuation, Lockdown, and Evacuation Policy and Emergency Guidance. 5.5 Consideration should be given for all nurseries to install individual alarms on external doors accessible to the children. High Yes 31/08/2024 Implemented- Risk assessments have been carried out for all early learning and childcare nurseries and where required, additional alarms have been installed, or additional mitigating controls have been put in place. 5.6 Consideration should be given for all nurseries to undertake a documented assessment of the premises and play areas to assess current security risks and the controls implemented or required to mitigate these risks. Medium Yes 31/08/2024 Implemented- Follow up review has evidenced that a risk assessment exercise has been undertaken for all early learning and childcare nurseries premises and play areas to assess security risks. It was noted that additional controls have subsequently been introduced. 5.7 Consideration should be given to service delivery inspections at Medium Yes 31/08/2024 Implemented- The self-evaluation checklist completed by Continuous Improvement Page 62
Page 63
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation nurseries, including assessing the physical controls operating within the nurseries and play areas. Officers during service delivery inspections has now been updated to include a requirement to assess site security. 5.8 A premises key holder list should be maintained for all nurseries. Medium Yes 31/08/2024 Implemented- All early learning and childcare nurseries must maintain an up to date premises key holder. Follow up review of a sample of nurseries has confirmed that updated lists are maintained. Page 63
Page 64
Page 64
Page 65
Report to: Audit and Scrutiny Committee Meeting Date: 24 June 2025 Report by: Audit and Risk Manager Report No: GSP08/25/DL Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Building Services - Reactive Repairs 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 7 May 2025 to 24 June 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of Building Services - Reactive Repairs; this project has been agreed for review within the Internal Audit Plan for 2024/ 25. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted, and endorses the recommendations contained within the report. Dafydd Lewis Audit and Risk Manager 4. BACKGROUND AND CONTEXT 4.1 A review has been undertaken of the systems and procedures within Building Services for managing reactive repair works on Council house properties. The audit scope covered systems for the administration and management of reactive repairs. This involved reviewing processes from raising a requirement and carrying out the work to recharging costs and managing budgets. Building Services is responsible for the repairs and maintenance of approximately 6,000 Council properties, with an annual expenditure of approximately £3.6 million. Item 8. Page 65
Page 66
4.2 Findings from the audit review highlighted the need for administrative improvements in costing arrangements and budget management systems. In addition, the provision of certification for gas and electrical work undertaken at properties requires improvement. The audit report for this project is provided in the Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial Page 66
Page 67
No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 67
Page 68
APPENDIX 1 1 Final Internal Audit Report Building Services- Reactive Repairs May 2025 Distribution: Head of Housing and Property Services Building Services Manager The Internal Audit Section provides Management with an opinion on the internal control environment and categories risk ratings for recommendations as high, medium, or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows. Assurance Level Risk Ratings for Recommendations Priority 1 1 Substantial Priority 2 5 Priority 3 0 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment, and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations, and confidentiality. Page 68
Page 69
2 Contents Page Building Services- Reactive Repairs 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-14 4. Management Response 5-14 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 69
Page 70
3 1. Introduction and Audit Scope The annual audit plan for 2024/25 included a review of the systems and procedures within Building Services for managing reactive repair works on Council house properties. Reactive repairs refer to works carried out on a responsive basis as needs arise, rather than being deferred for inclusion in planned maintenance programmes. Examples of reactive works include emergency repairs to central heating systems, water leaks, or damaged windows. Building Services is responsible for the repairs and maintenance of approximately 6,400 Council properties. Approximately 20,000 reactive repairs are carried out annually. Analysis of the Financial Management System noted that for 2023/24, expenditure for reactive repairs amounted to approximately £3.6 million. The majority of reactive repairs are requested by tenants through the Council's Contact Centre; however, the need for repairs can also be raised by Housing/Building Services officers and through the Out of Hours Service. The audit scope reviewed systems for the administration and management of reactive repairs. This involved checking processes from raising a requirement and undertaking the works to recharging costs and managing budgets. In addition, the contractual relationship between Housing, Property, and Building Services was also reviewed. The Annual Internal Audit Plan allows for internal audit reviews to include testing that appears to be “outwith scope.” During a recent special investigation into a window replacement contract, an issue was noted regarding the administration of planned works undertaken by Building Services. As a result, additional testing was also carried out as part of this audit review. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • This issue concerns the additional testing undertaken as part of this review and relates to planned works that are recorded as not completed within Property Services due to the pending receipt of certification documentation for gas and electrical works undertaken at properties by Building Services. The audit review confirmed that several contracts involving properties requiring gas and electrical certification had not been provided by Building Services. The need for certification documentation for electrical and gas works is a regulatory requirement. This is in addition to the gas and electrical safety checks undertaken by Page 70
Page 71
4 Building Services at properties. Building Services should review all reactive and planned works involving gas and electrical works, and, if required, a Gas Safety Certificate and/or an Electrical Installation Certificate for the property should be provided to Property Services. However, it is important to note that this is not a concern regarding the safety of the works undertaken, but rather about ensuring that the correct certification documentation is maintained. • A Schedule of Rates is used to charge for reactive repair works undertaken by Building Services. The Schedule of Rates is based on a costing exercise conducted in 2019. The Building Services Manager stated that an annual percentage uplift is applied to the Schedule of Rates, determined following discussions with Property and Housing Services and a review of construction cost changes detailed by the Building Cost Information Service. Consideration should be given to reviewing and if necessary, updating the costs and percentage recovery rates used within the Schedule of Rates for reactive repairs. While it is acknowledged that this would be a significant exercise, it would provide greater transparency and support more accurate performance data on the actual costs of works undertaken. • Building Services will recharge the Housing Service on a monthly basis for the reactive repairs undertaken in the prior month. Audit testing identified several areas where further administrative improvements are needed. These include delays in recharging costs; prompt recording and accounting of costs are essential for effective budgetary management control. Additionally, improvements were identified in ensuring that once a reactive repair is completed, the cost is promptly recharged to the Housing Service and the work order is recorded as closed within the Dynamic Resource Scheduling (DRS) software system. Page 71
Page 72
5 Findings/Recommendations -Building Services- Reactive Repairs Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium It was noted that the Partnership Agreement between Housing, Property, and Building Services has not been reviewed since 2013. An updated Partnership Agreement was drafted in 2019; however, it was not approved. The purpose of the Partnership Agreement is to provide a framework within which services “can continue to provide an improved service for council tenants.” This document outlines the relationships between the parties, the standards and quality of work, and the costs involved in implementing an ongoing housing maintenance program. A review should be undertaken, and if required, the Partnership Agreement between Housing, Property, and Building Services should be updated to ensure it reflects current operational and service best value requirements. Management Response Responsible Officer Accepted (Yes/No Timescale for Implementation Agreed Management Action/Management Comment Head of Housing & Property Services Yes 31/03/2026 A review of the Partnership Agreement between Housing, Property, and Building Services will be undertaken and if this is still required it will be updated to ensure it reflects current operational and service best value requirements. Consideration will be given to achieving the objectives of the Partnership Agreement by alternative means, based on benchmarking with other local authorities. Page 72
Page 73
6 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium Building Services undertakes approximately 20,000 reactive repairs annually, costing £3.6 million in 2023/24. Discussions with the Building Services Manager noted that a Schedule of Rates is used to recharge the various reactive repair works undertaken on properties for the Housing Service. The calculation of the individual rates within the Schedule was determined through a costing exercise conducted in 2019. The Building Services Manager also stated that the annual percentage increase in the Schedule of Rates is decided after discussions with Property and Housing Services, with consideration also given to the Building Cost Information Service (BCIS) indices. The BCIS Indices provide cost and price data for the UK construction industry, including estimated future construction costs. However, the audit review found it difficult to determine how the individual rates have been established, which is crucial for ensuring the accurate recovery of full costs and enabling effective performance data analysis of the actual costs of the works undertaken. A ‘zero-based’ approach should be considered to review, and if necessary, update the costs and percentage recovery rates used within the Schedule of Rates for reactive repairs. It is acknowledged that this would be a significant exercise in the delivery of a multi-trade service, due to the large number of separate costing lines detailed within the Schedule of Rates. Page 73
Page 74
7 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Housing & Property Services Yes 31/03/2026 In accepting this recommendation, it is timely for the service to consider the broader approach to job costing and its implications for efficiency of process, quality of work and customer services standards in achieving best value for the Council and its tenants. The service will commission a consultant to undertake the zero- basing exercise, including a comprehensive review of repairs data and consider alternatives approaches including a fixed annual cost per property. Page 74
Page 75
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 High Additional testing has been undertaken as part of this review, as planned works were noted within Property Services, which are still awaiting the receipt of certification documentation for gas and electrical works undertaken at properties by Building Services. Regarding electrical works, an Electrical Installation Works Certificate from a qualified Moray Council electrician or electrical contractor is a regulatory requirement upon the completion of electrical installation works. The audit review noted that a number of planned contracts works involving electrical works remain open within Property Services, awaiting the Electrical Installation Works Certificate from Building Services. Analysis of contracts issued to Building Services over a number of years revealed that 36 contracts are still recorded as “open,” awaiting an Electrical Installation Works Certificate for 43 properties. For works involving gas, a Gas Safety Certificate from a qualified engineer is a regulatory requirement for new gas boiler installations, Building Services should review both reactive and planned works involving gas and electrical requirements to determine if additional certification is needed. If not already completed, a Gas Safety Certificate and/or an Electrical Installation Certificate for the property should be provided to Property Services. Moving forward, and in accordance with regulatory requirements, Building Services should provide Electrical Installation Certificates and Gas Safety Certificates to Property Services in a timely manner for all completed projects. The audit finding highlights an administrative requirement, not a concern regarding the safety of the works undertaken. Page 75
Page 76
9 services, and all other gas appliance checks at a property. The audit review also examined planned contracts issued to Building Services involving works at properties requiring a Gas Safety Certificate. The audit noted 96 contracts still recorded as “open,” awaiting the Gas Safety Certificate for 119 properties. . Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Building Services Manager Yes 30/06/2025 The issue of delays in providing gas and electricity certificates in relation to works done was identified within the partnership a number of years ago and as a result the Plentific (Gas and Elec-Tag) system was implemented January 2020 for gas certificates and April 2022 for electric certificates, to allow for the automation of gas and electricity certification records. Where certificates have not been passed to the design team these will be identified and forwarded to them. Where these cannot be identified, the current safety certification will be provided to give assurance that properties are safe. A review of processes will be carried out to ensure all certificates are issued immediately when works are completed to relevant Contact Administrators. Page 76
Page 77
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium An analysis of the Financial Management System noted that the annual reactive repairs expenditure was approximately £3.6 million in 2023/24. Building Services recharge the Housing Service on a monthly basis for reactive repairs undertaken in the previous month. However, audit testing of a sample of works orders from one month's reactive repairs found that in 13% of work orders tested, with a cumulative value of £1,511, delays of up to 4 months were noted between the recharging of costs to the Housing Service and the date the works were actually undertaken. Enquiries with Building Services revealed that delays can occur in receiving the required documentation from officers and subcontractors. The majority of reactive repair works are managed through a repairs Dynamic Resource Scheduling (DRS) software system, but jobs can also be raised manually through a paper-based system. Analysis found that approximately 22% of all reactive repair work orders are issued through the paper-based system. The audit was advised that delays in officers providing all supporting documentation are more prominent in the paper-based system. All officers involved in undertaking reactive repair works should be reminded of the importance of ensuring that the relevant supporting documentation for the job is provided promptly to the administration officers within Building Services to allow the prompt recharging of costs. Consideration should be given to making further use of the DRS software system and reducing reliance on the paper based system for the raising of work orders. This would allow improved transparency and performance monitoring arrangements in the management of reactive works. Page 77
Page 78
11 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Building Services Manager Yes 30/09/2025 Processes are being reviewed as part of current Repairs Review, with implementation to be in place by 30 September 2025. Issues have been identified with the timing of sub contactor invoices being received that has delayed some repairs from being recharged, this process has also been amended. Page 78
Page 79
12 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium In 2023/24, Building Services undertook approximately 20,000 reactive repair work orders with 80% completed within agreed performance timescale targets. At the time of the audit, an analysis of the DRS found 1506 reactive repair works orders with an approximate value of £432,000, remained open past their target completion dates. Enquiries with the Building Services Manager noted a significant reason for not completing work orders within agreed timescales was due to staff shortages and the difficulty in the recruitment of officers. The audit acknowledges that several services within the Moray Council are experiencing similar issues in recruiting staff. However, further analysis noted that 27% of the works orders recorded as not completed had either been carried out or were no longer required but had not been closed off within the DRS. Regular reviews should be undertaken with explanations sought if required for reactive repair work orders recorded as open, but jobs have not been completed within the target timescales. Further to the audit finding, works orders recorded as not completed but the job has been undertaken or no longer required should be closed off promptly within the DRS software. Page 79
Page 80
13 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Building Services Manager Yes 30/09/2025 Weekly reports are issued highlighting the volume of repairs not complete. These are circulated to relevant staff to ensure outstanding repairs completed can be closed off. A number of issues have been identified that includes delays recharging a high volume of paper based works orders (over 70 of outstanding repairs) , that are being reviewed as part of the Repairs Review to ensure that the majority of jobs are scheduled via DRS which allows jobs to be completed and recorded in real time, rather than on a paper based system. Page 80
Page 81
14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Medium As detailed previously, Building Services will recharge the Housing Service on a monthly basis for the reactive repair works undertaken in the prior month. However, it was noted during the audit that the monthly recharges for October and November 2025, with a total value of £445,000, had not been processed until January 2025. Prompt recording and accounting for costs is an important budgetary management control requirement. Further to audit enquiries, it was noted that this error was due to a staffing change, with an officer unaware of the operating arrangements. Additionally, it was found that Building Services had no documented procedures detailing the monthly recharging requirements for reactive repair works to the Housing Service. The cost of reactive repair works undertaken by Building Services during a month should be recharged to the Housing Service in the following month. Documented procedures should also be developed to ensure that officers have clear guidelines on the actions to be undertaken when recharging reactive repair works. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Building Services Manager Yes 30/06/2025 Process for recharging repairs has been reviewed within Building Services. These have now been amended to ensure that recharges are processed within accountancy time frames, with a written procedure now developed. A further review will be carried out of procedures within the Housing Asset team to ensure the authorisation/certification process is improved. Page 81
Page 82
15 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls. • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of noncompliance with some of the controls may put some of the system objectives at risk. Limited The level of noncompliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 82
Page 83
16 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 83
Page 84
Page 84
Page 85
Report to: Audit and Scrutiny Committee Meeting Date: 24 June 2025 Report by: Audit and Risk Manager Report No: GSP025/25/DL Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Keith Grammar School 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 7 May 2025 to 24 June 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of Keith Grammar School; this project has been agreed for review within the Internal Audit Plan for 2024/25. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted, and endorses the recommendations contained within the report. Dafydd Lewis Audit and Risk Manager 4. BACKGROUND AND CONTEXT 4.1 An audit of the administrative arrangements at Keith Grammar School has been completed. The scope of the audit was to review the Devolved School Management Scheme, focusing on the allocation and management of funding at the School. In addition to examining how the School develops, monitors, and controls its £3.3 million budget, the audit also assessed the management of staffing costs associated with delivering the curriculum. The audit checked whether non-payroll expenditure complied with Financial Regulations and Procurement Guidelines. A review was also undertaken to ensure appropriate accounting arrangements are followed in the management of Item 9. Page 85
Page 86
School fund monies. Overall, the audit found that Keith Grammar School was generally well managed within the scope of the review. However, some areas requiring administrative improvement were identified. The findings and recommendations are detailed in the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. Page 86
Page 87
One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 87
Page 88
APPENDIX 1 1 Final Internal Audit Report Keith Grammar School April 2025 Distribution: Head of Education Head Teacher School Support Co-ordinator The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 0 Priority 2 4 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 88
Page 89
2 Contents Page Keith Grammar School 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-10 4. Management Response 5-10 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 89
Page 90
3 1. Introduction and Audit Scope The annual Internal Audit plan for 2024/25 provides for a review of a secondary school within Education Services. This audit details the findings from the review undertaken of Keith Grammar School as part of a rolling programme of audit visits planned for secondary schools. The scope of this audit was to review the operation of the Devolved School Management Scheme in terms of funding allocation and management at the school level. Consideration was given to how budgets are affected by National, Council and School priorities. In addition to undertaking an overview of how the School develops, monitors and controls its £3.3 million annual devolved budget, the audit involved a study of the management of the staffing costs involved in delivering the curriculum. The audit checked that non payroll expenditure complied with Financial Regulations and Procurement Guidelines. A review was also undertaken to ensure appropriate accounting arrangements are followed when managing School Fund monies in accordance with the School Fund Regulations. This report sets out the work undertaken in relation to the 24/25 financial year. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • A review of the School's Inventory Record noted that movable assets valued at £250 or above have been recorded. This exceeds the requirements of the Council's Financial Regulations, which specify the need for a comprehensive record of all movable items with an individual replacement cost exceeding £500. In addition, despite recording movable assets valued at more than £250, the majority of items listed had no recorded value detailed within the Inventory Record. The School should review and update its Inventory Record, ensuring that the replacement costs of all items exceeding £500 are accurately documented. • Further improvements are recommended to strengthen controls in the administration and accounting arrangements for the School Fund. The review noted that one of the signatories had pre-signed blank cheques for the School Fund bank account. Enquiries found that the School Fund bank account only had two signatories, and the pre-signing of cheques was due to a staffing issue and a need to facilitate the ongoing Page 90
Page 91
4 processing of payments. To enhance financial oversight, additional cheque signatories should be established for the School Fund bank account, ensuring that one signatory authorises a payment while another verifies the transaction. Additionally, the annual School Fund Income and Expenditure Statement could be further detailed to provide readers with a clearer understanding of financial activities. • The iPayimpact online payment system is not being utilised collecting income related to school activities such as trips, clubs and events. As a result, the School has had to rely on more labour intensive manual income collection processes. Consideration should be given to increasing the use of the iPayimpact online payment system. Page 91
Page 92
5 Findings/Recommendations - Keith Grammar School 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium Financial Regulations require an Inventory List to be maintained of all movable assets valued at £500 or above to be maintained. However, it was found that the School maintained an Inventory List of items valued at more than £250, a figure specified in a previous version of the Financial Regulations. Additionally, at the time of the audit, only 35% of the listed items had a recorded value. It was explained that this was due to officers updating the list without readily available invoice price information. Procedures should be amended for maintaining the School's Inventory List to reflect the requirements of the current iteration of the Council's Financial Regulations and to ensure that cost or estimated replacement value is recorded against each item. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head Teacher Yes 01/09/2025 The current inventory is to be updated and amended as per the Council's Regulations. Page 92
Page 93
6 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low The audit visit noted that Supermarket vouchers totalling £1,000 were held in a secure location at the School. Enquiries revealed that these vouchers had been purchased by the School from the Pupil Equity Fund in 2023, with the intention of providing them to families of pupils in financial need. However, this had been done during a period of absence by the Head Teacher, and to date, none of the vouchers have been issued since the purchase, nor have any criteria for issuing them been developed. Options for the future use of the vouchers were discussed with the Head Teacher, but it was noted that no decision had been reached at the time of the audit. Consideration should be given to the best use of the vouchers held, in accordance with the Pupil Equity Fund National Operational Guidance. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head Teacher Yes 01/10/2025 The vouchers will be used to support sessions at a charitable youth project which supports families in the local area. Cooking sessions are attended by pupils disengaging from school, offering life skills and building on engagement. Additionally, a Summer Supper Club is run which provides a meal for families who may be struggling during the holiday period, fitting the aims of Pupil Equity Funding. Page 93
Page 94
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Low It was noted that the current petty cash imprest level for the School is £300. On analysis of expenditure and discussion with officers at the School, it was noted that this limit is no longer required and that a lower level of petty cash would be appropriate for the School's day-to-day needs. The ongoing use of petty cash was queried with the School but is still required for the purchase of minor reimbursements and ad hoc purchases. Consideration should be given to reducing the level of petty cash held by the School. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment School Support Co-ordinator Yes 01/04/2025 The Petty Cash Fund has been reduced to £50. Page 94
Page 95
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium An Annual Income and Expenditure Statement must be prepared and audited in accordance with the School Fund Regulations. Upon reviewing the School's Income and Expenditure Statement, it was found to contain only three income and expenditure categories: School Fund, School Prizes and Holding. While the School does hold supporting evidence detailing the breakdown of the activities and clubs that contribute to these categories, the lack of detail in the Annual Statement prevents readers from understanding the activities undertaken using the School Fund. The School Fund Annual Income and Expenditure statement should be expanded to give improved transparency of the significant activities during the previous year. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment School Support Co-ordinator Yes 01/09/2025 A more comprehensive report will be produced at the end of the School Fund financial year to reflect School Fund activities. Page 95
Page 96
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium iPayimpact is an online payment system used by schools to accept online payments from parents and carers for school related expenses such as school clubs, trips, and the purchase of tickets for school events. iPayimpact reduces the inherent control risks associated with cash handling within an establishment. Although a trial use of iPayimpact has been undertaken for one activity at Keith Grammar School, no further use has been made of the system. The current cash handling and banking arrangements at the School are manually intensive. Further use of the iPayimpact system would allow for more efficient use of staff time within the School. Consideration should be given to the further use of the iPayimpact system at the School for the collection and banking of income. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment School Support Co-ordinator Yes 01/12/2025 Ongoing training for office staff to be scheduled over the next few months to enable a robust transition from cash to iPayimpact. Page 96
Page 97
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Medium The School Fund bank account has only two authorised signatories, both of whom are required to sign a cheque for payments made from the account. During the audit visit, it was discovered that one of the signatories had pre-signed blank School Fund cheques. Enquiries revealed that a signatory, who was on extended leave, had pre-signed cheques to ensure the ongoing administration of the School Fund. Unfortunately, it was also found that the School has been unable to add additional signatories to the account, as this requires both existing signatories to engage with the bank to approve the action. The School Fund Regulations state that blank cheques must not be signed in advance. The individual circumstances surrounding the need for cheques to be pre-signed for the School Fund in this instance are appreciated. However, in accordance with the School Fund Regulations, cheques must not be pre-signed. Discussions with the School have noted an intention to change the current banking facility. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment School Support Co-ordinator Yes 01/09/2025 New accounts with additional signatories will be opened as soon as possible. Page 97
Page 98
11 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 98
Page 99
12 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 99
Page 100
Page 100
Page 101
Report to: Audit and Scrutiny Committee Meeting Date: 24 June 2025 Report by: Audit and Risk Manager Report No: GSP026/25/DL Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review - Information Communications Technology Hardware Assets 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 7 May 2025 to 24 June 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of systems and procedures in the management of Information Communications Technology (ICT) Hardware Assets; this project has been agreed for review within the Internal Audit Plan for 2024/25. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted, and endorses the recommendations contained within the report. Dafydd Lewis Audit and Risk Manager 4. BACKGROUND AND CONTEXT Item 10. Page 101
Page 102
4.1 An audit review was undertaken of the systems and procedures involved in managing the ICT hardware assets within the Council. Hardware asset management refers to the process of inventorying and tracking physical ICT equipment, such as servers, laptops, drives, routers, and monitors throughout their entire lifecycles. The scope of the audit was to review the systems and policies used for the management, recording, and disposal of ICT hardware equipment. Testing included selecting a random sample of ICT hardware recorded in the Inventory Register and verifying its physical location. The audit also assessed the physical controls in place to safeguard and restrict access to ICT hardware. 4.2 The findings from the audit included the need to review and update the Corporate Information Security Policy, as well as to consider improvements in the access, location, and storage of hardware equipment. The audit report in Appendix 1 details the findings and recommendations from the review. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy Page 102
Page 103
☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 103
Page 104
1 Final Internal Audit Report Information Communications Technology (ICT) Hardware Assets May 2025 Distribution: Head of Human Resources, ICT & Organisational Development ICT Manager (Infrastructure) The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 1 Priority 2 3 Priority 3 1 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. APPENDIX 1 Page 104
Page 105
2 Contents Page Information Communications Technology (ICT) Hardware Assets 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-13 4. Management Response 6-14 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 105
Page 106
3 1. Introduction and Audit Scope The Audit Plan for 2024/25 provides for a review of systems and practices to record and monitor the location and use of Information Communications Technology (ICT) hardware assets. Hardware assets are physical and tangible pieces of computer equipment. The most common type of hardware equipment are servers, desktop/laptop computers and monitors. Since this equipment is a key requirement in the delivery of services, managing and organising it effectively is essential. This audit considered corporate ICT assets. School assets will be considered for review at a future date. Analysis of the Financial Management System noted that expenditure for ICT hardware equipment in 2022/23 amounted to approximately £0.5 million and £236,000 in 2023/24. At the time of the audit, the Council had approximately 4,500 individual, corporate ICT hardware items, including 300 desktop computers, 1,500 laptops and 100 servers. A reason for the significant variance in annual expenditure is due to the laptop replacement programme. Since the pandemic, significant changes have occurred with the introduction of the Smarter Working Initiative, resulting in an increase in the number of Council employees working from home and a greater demand for laptops. It is essential that all ICT hardware equipment are tracked and managed appropriately to avoid unnecessary purchases, promote the efficient use of existing resources, and ensure Council data is protected. The scope of the audit was to review the systems and policies used for the management, recording, and disposal of ICT hardware equipment. Testing included selecting a random sample of ICT hardware equipment recorded in the Inventory Register and verifying its physical location. A review was conducted on the processes involved in recovering hardware equipment from officers leaving Council employment. The audit also assessed the physical controls to safeguard and restrict access to Council servers and network equipment located in various locations within Council buildings. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • The Corporate Information Security Policy details the Council’s requirements for appropriate control mechanisms to prevent unauthorised access, damage and/or interference to the Council's ICT infrastructure and systems, including all physical ICT assets that support critical or sensitive activities. However, it was found that the Policy was last reviewed and updated in January 2009. It is important that the Corporate Information Security Policy is regularly updated in response Page 106
Page 107
4 to business needs and evolving threats. Discussions with the ICT Service noted that the Policy has been reviewed, and an updated version is near completion. • The audit review noted various security concerns regarding the location and storage arrangements for ICT hardware equipment. The challenges faced by the ICT Service regarding the availability of suitable storage locations are appreciated. However, in accordance with the Corporate Information Security Policy there is a requirement for ICT equipment to be stored and protected to reduce the risks associated with environmental hazards and opportunities for unauthorised access. Consideration should be given to investigating the availability of any alternative storage facilities for ICT hardware equipment or whether additional security controls are required to safeguard against unauthorised access. Page 107
Page 108
5 Findings/Recommendations - Information Communications Technology (ICT) Hardware Assets Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 High The Council’s Corporate Information Security Policy establishes the appropriate control mechanisms “to prevent unauthorised access, damage and/or interference to the Council's ICT infrastructure and systems, including all physical ICT assets that support critical or sensitive departmental activities”. However, as previously detailed in other audit reviews, it was found that the Policy was last reviewed in January 2009. The Policy should be reviewed and, if required, updated to ensure control requirements remain relevant or be further strengthened in meeting the Council’s ICT security management requirements. It is understood from discussions with the Service that work is currently being undertaken to review and update the Policy. It is acknowledged that a review and, if required, updating of the Corporate Information Security Policy is underway. However, this should now be progressed, and in the future, the Policy should be subject to periodic reviews to ensure its effectiveness, cost, and impact of controls on business efficiency, as well as the effects of technology changes. Page 108
Page 109
6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment ICT Team Leader (Infrastructure & Information Security) Yes 31/03/2026 Progress on finalising the Policy has been hindered due to a lack of dedicated resources for cyber security, as well as operational pressures taking precedence. The approval of funding for additional resources will provide the capacity to complete the work. Proposed timescale allows for completion of the Policy and appropriate governance for approval / adoption of the new Policy. Page 109
Page 110
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium The Data Centre is a physical room within the Headquarters complex where networked computer servers are located for the remote storage, processing, or distribution of large amounts of data. These servers contain the Council’s critical applications and data and are therefore essential to ensure the ongoing delivery of services. Access to the Data Centre is controlled through a door entry system that records activity over a 24-hour period, with entry only allowed to the appropriate ICT officers but also to Facilities and Property Services officers for defined purposes. However, external contractors also require access to the Data Centre for the maintenance of equipment to ensure appropriate climatic conditions. During the audit review, a visit was made to the Data Centre to check the security arrangements. It was noted that the servers are stored in racks, and while this storage facility has the option to further restrict access to the servers, it is not being utilised. Consideration should be given to utilising locks on server racks within the Data Centre to further enhance the security of the servers. Page 110
Page 111
8 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment ICT Infrastructure Manager Yes 19/12/2025 It should be noted that external contractors who undertake work related to the ICT infrastructure within the Data Centre are always accompanied by a member of the ICT Team. However, it is appreciated that other contractors also require access to this area. It should also be noted that there are some racks where the physical dimensions of the equipment therein, prevent the doors on the rack from being closed. In relation to access, this means that someone could potentially cause physical damage to a server, as opposed to accessing systems / data. In line with the audit recommendation, the ICT Team will consider options to mitigate the risk wherever possible. Page 111
Page 112
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Low ICT Services maintain a computer-based ICT Inventory Register. This Register should include all major items of ICT hardware, such as servers, desktop computers, and laptops. The audit selected a random sample of laptops recorded in the Inventory Register, and a check was made to verify their physical locations. It is pleasing to report that no discrepancies were noted. However, examples were found where certain hardware, including servers and network equipment were not located in the most secure areas to reduce the risk of potential unauthorised access. The challenges and limitations regarding available and suitable spaces within Council buildings for locating ICT hardware are acknowledged. However, as an example, the audit review noted a network switch located in an unlocked small room within an unused office. A risk assessment review should be undertaken of all ICT hardware located within the various locations of Council buildings and consideration given to whether additional security controls are required to safeguard against unauthorised access. Page 112
Page 113
10 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment ICT Infrastructure Manager Yes 31/03/26 It is acknowledged that the level of security varies across Council locations. In newer locations where security has been considered as part of the design, access to ICT hub rooms is strictly controlled via the Door Entry system. In other locations, due to practicalities arising over time, there are examples of shared facilities e.g. ICT network hub shared with a printing hub. Given the need to rationalise the property estate, there may be limitations on what can be achieved. However, it is accepted that a risk assessment should be carried out in line with the audit recommendation. Page 113
Page 114
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium It was noted that the main ICT office serves as a storage area for new laptops, as well as those designated for refresh or disposal. The audit observed that, when the office is unoccupied, the entry door should remain closed, with access restricted through a keypad entry system. However, the main ICT office serves as the primary workplace for the ICT officers, and access is also required by other Council officers. The challenges faced by the ICT Service regarding the availability of secure storage facilities and the need to meet operational service requirements are again appreciated. Consideration should be given to the current use of the main ICT office to store hardware equipment and whether a more secure location is available. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment ICT Infrastructure Manager / ICT Team Leader (Support) Yes 31/10/25 The ICT Section has occupied various temporary storage locations over time, culminating in the allocation of the main ICT office space, when no suitable alternative storage location could be found. This arrangement is not ideal. However, it does Page 114
Page 115
12 have benefits from a service efficiency perspective, as it minimises ICT Officer travel time in relation to the configuration of the equipment. The office is always manned during normal working hours which reduces any associated risks. Enquiries will be made into the availability of suitable, alternative storage solutions. Page 115
Page 116
13 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium Council officers are required to comply and regularly confirm adherence with the Computer Use Policy. However, the audit review noted that within the Moray Integration Joint Board (MIJB), approximately 13 NHS Grampian employed officers also use Council hardware equipment and software in the delivery of services. However, there is no agreement with NHS Grampian employed officers to confirm their requirement to comply with Council Policies, which may differ from working procedures within the NHS. This could result in different compliance requirements between NHS Grampian and Moray Council employed officers in the delivery of MIJB delegated services. Consideration should be given by the Chief Officer of the MIJB to request all NHS Grampian employed officers that use Council owned hardware and software to comply with the appropriate Computer and Information Management Policies of the Council. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Officer (MIJB) / ICT Infrastructure Manager Yes 31/10/2025 Although there is no agreement in place, the NHS Grampian employed officers will be aware of the Computer Use Policy in the sense that they will also be prompted to confirm Page 116
Page 117
14 adherence as part of the login process on their Council equipment. The offices also have access to the Interchange (the Council’s Intranet), which is the repository for the policy, albeit they may not necessarily be aware of this. However, agreement will be sought with NHS employed officers with access to Council systems to confirm compliance with the Computer Use Policy. . Page 117
Page 118
15 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 118
Page 119
16 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 119
Page 120
Page 120
Page 121
Report to: Meeting Date:Audit and Scrutiny Committee 24 June 2025 Report by: Report No:Audit and Risk Manager GSP028/25/DL Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Audit & Scrutiny Committee Self-Assessment & Evaluation Exercises 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to advise Committee on the outcome of a self assessment of Compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit undertaken from the Chartered Institute of Public Finance and Accountancy (CIPFA) Publication “Audit Committees: Practical Guidance for Local Authorities and Police 2022 Edition”. 1.2 This report is submitted to Committee in terms of Section III I (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. SUMMARY 2.1 This report provides the results a Self-Assessment of Good Practice and an Evaluation of Effectiveness from the CIPFA Publication – Audit Committees: Practical Guidance for Local Authorities and Police 2022 Edition undertaken with members of the Audit and Scrutiny Committee. This CIPFA Publication sets out its guidance on the function and operation of audit committees in local authorities and police bodies and represents CIPFA’s view of best practices for audit committees in local authorities throughout the UK. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted, and endorses the recommendations contained within the report. Dafydd Lewis Audit and Risk Manager 4. BACKGROUND AND CONTEXT Item 11. Page 121
Page 122
4.1 The CIPFA Publication “Audit Committees: Practical Guidance for Local Authorities and Police 2022 Edition” sets out its guidance on the function and operation of audit committees in local authorities and police bodies. Audit committees are a key component of an authority’s governance framework and provide an independent and high-level resource to support governance and strong public financial management. The guidance states the purpose of an audit committee is “to provide an independent and high-level focus on the adequacy of governance, risk and control arrangements. The committee’s role in ensuring that there is sufficient assurance over governance risk and control gives greater confidence to all those charged with governance that those arrangements are effective.” 4.2 CIPFA promotes that a good standard of performance against recommended practices, together with a knowledgeable and experienced membership, are essential requirements for delivering effectiveness. To this effect, CIPFA has provided a high- level review checklist that incorporates the key principles set out in CIPFA’s Position Statement: Audit Committees in Local Authorities and Police 2022 Edition. In addition, the Public Sector Internal Audit Standards also call for the committee to assess their remit and effectiveness in relation to purpose, authority and responsibility to facilitate the work of this committee. 4.3 Members from the Audit and Scrutiny Committee carried out self-assessments of Compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit from the CIPFA Audit Committees Guidance during a workshop session on 25 March 2025 facilitated by the Audit and Risk Manager. The results of these self-assessment and evaluation exercises are appended to this report as Appendix 1 (Good Practice Principles) and Appendix 2 (Effectiveness) for consideration. 4.4 The outcome of the self-assessment and evaluation noted significant compliance with good practice principles and a high degree of effectiveness. However, areas have been identified for further improvements. An Action Plan has been produced as Appendix 3 to strengthen and improve the overall effectiveness of the Audit and Scrutiny Committee. 5. PROPOSALS 5.1 This report provides the Committee with details of the self-assessment of Compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit undertaken from the CIPFA Publication “Audit Committees: “Practical Guidance for Local Authorities and Police 2022 Edition”. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Page 122
Page 123
Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comment s Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable ) Other Comment s 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. Page 123
Page 124
6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 The Chief Executive and the Head of Governance, Strategy & Performance have been consulted on the contents of this report. 8. BACKGROUND PAPERS 8.1 None Page 124
Page 125
APPENDIX 1 CIPFA Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition Self-Assessment of Effectiveness of the Audit & Scrutiny Committee Ref. Good practice questions Yes Partly No Audit Review Audit committee purpose and governance 1 Does the authority have a dedicated audit committee that is not combined with other functions (eg standards, ethics, scrutiny)? P The Council has an Audit and Scrutiny Committee. Responsibility for scrutiny lies with the Service Committees, but the Audit and Scrutiny Committee has the authority to seek further service reviews if required. Discussions during the workshop considered a need to develop further the scrutiny function of the Audit and Scrutiny Committee. 2 Does the audit committee report directly to full council? Y Yes- The Council has delegated functions to the Audit and Scrutiny Committee. 3 Has the committee maintained its advisory role by not taking on any decision-making powers? Y Audit and Scrutiny Committee has no decision making powers 4 Do the terms of reference clearly set out the purpose of the committee in accordance with CIPFA’s 2022 Position Statement? Y Audit and Scrutiny functions are detailed within the Scheme of Administration. Functions of the Committee updated (Moray Council Committee – 7/12/2022- Item 15) to reflect the current CIPFA Position Statement. A planned review and update of the Scheme of Administration is planned shortly. Page 125
Page 126
5 Do all those charged with governance and in leadership roles have a good understanding of the role and purpose of the committee? Y Yes- Scheme of Administration details the purpose of the Audit and Scrutiny Committee to ensure that the highest standards of probity and public accountability. Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. 6 Does the audit committee escalate issues and concerns promptly to those in governance and leadership roles? P The Audit and Scrutiny Committee is a key part of the Council’s governance framework. This Committee is a critical component in the overall corporate governance arrangements of the Council, where good corporate governance requires independent and effective assurance about the adequacy of financial management and reporting. These functions are delivered independently from the scrutiny functions of the Corporate Management Team. The Committee can scrutinise areas of policy, service delivery or performance identified for improvement where sufficient evidence of progress from the appropriate committee is not available. Any issues of concern can be raised with the Council's senior management. This has recently been evidenced by members raising concerns regarding timescales for implementing audit recommendations where services have been asked to review implementation dates. Page 126
Page 127
However, as detailed within point 1 of this self-assessment exercise, concerns were discussed regarding the lack of the scrutiny function of this Committee. It is considered that a review of the Scheme of Administration should be undertaken to allow further scrutiny by members of any issue of concern where further review is required. 7 Does the governing body hold the audit committee to account for its performance at least annually? P Moray Council has 26 councillors. Membership of the Audit and Scrutiny Committee has 15 councillors and 2 independent (non- voting) members. As the majority of councillors are already members of the Audit and Scrutiny Committee, performance is monitored on an ongoing basis. 8 Does the committee publish an annual report in accordance with the 2022 guidance, including: N An annual review is not undertaken. It was discussed that a yearly report is not a priority as most members are already members of the Audit and Scrutiny Committee. All members have access to audit reports and can raise any query or seek further clarification directly with the Audit and Risk Manager. • compliance with the CIPFA Position Statement 2022 N • results of the annual evaluation, development work undertaken and planned improvements N • how it has fulfilled its terms of reference and the key issues escalated in the year? N Functions of the committee 9 Do the committee’s terms of reference explicitly address all the core areas identified in CIPFA’s Position Statement? Page 127
Page 128
good governance Y Standards of the committee are to ensure that the highest standards of probity and public accountability are demonstrated. Reference was made to supporting the Council’s governance, risk and control arrangements by providing a review of the Annual Governance Statement and the assurances underpinning it. (I5) In addition, functions also include considering the annual assurance statement provided by Internal Audit on the Council’s control environment (I10 Risk management arrangements Y Supporting the Council’s governance, risk and control arrangements by considering the effectiveness of the Council’s risk management arrangements. (I5) Internal control arrangements, including: financial management value for money ethics and standards counter fraud and corruption P Standards of the committee detail a requirement to ensure that the highest standards of probity and public accountability are demonstrated. (Audit Standards (1)) Supporting the Council’s governance, risk and control arrangements by promoting internal controls and assurances, supporting an anti- fraud culture, review of revisions to financial procedures. (I5) No clear reference is made to value for money but implied with functions of the committee. Annual governance statement Y Functions detail supporting the Council’s governance, risk and control arrangements by providing a review of the Annual Council Statement and the assurances underpinning it. (I5) Financial reporting Y Enhancing corporate governance arrangements by promoting internal control and risk management, by supporting an anti-fraud culture, and by the review of revisions to financial procedures (I5), Reference also noted to reviewing revisions to financial procedures within functions. (I5) Assurance framework Y Implicit in all aspects of Audit functions. However, reference is made to considering the annual assurance statement provided by Internal Audit on the Council’s control environment. (I10) internal audit Y Considering reports from the Council’s Internal Auditor (I2) Page 128
Page 129
external audit Y Considering reports from the External Auditor concerning Council functions. (I9) 10 Over the last year, has adequate consideration been given to all core areas? Y Per CIPFA Audit Committees: Practical Guidance for Local Authorities and Police 2022: “The Position Statement sets out the core functions of the audit committee. Essentially, the responsibilities of the committee fall into three broad areas: 1 Supporting the establishment and maintenance of good governance, risk management and control arrangements. 2 Supporting accountability and public reporting, in particular the financial statements and the annual governance statement, and other statements that accompany the financial statements. 3 Supporting the establishment and maintenance of good arrangements for internal audit and external audit.” The Audit and Scrutiny Committee functions in accordance with the Scheme of Administration, which should support effective governance, risk management, and control arrangements. The Corporate Risk Register is also regularly reviewed. It is planned for the updated Corporate Risk Register to be reported to the Corporate Committee on 10 June 2025. Financial reporting –Draft accounts are reported to Moray Council Committee rather than the Audit and Scrutiny Committee. It is intended for the Annual Governance Statement for 2024/25 to be reported to Audit and Scrutiny Committee on 24 June 2025. External and Internal Audit Reports reported to Audit and Scrutiny Committee. Page 129
Page 130
11 Over the last year, has the committee only considered agenda items that align with its core functions or selected wider functions, as set out in the 2022 guidance? Y Yes core areas considered include: Governance – Yes. Governance forms part of some audits. Risk management – Not to Audit and Audit and Scrutiny Committee but to the Corporate Committee Accountability and public reporting- Yes, Annual Governance Statement is reported to the Audit and Scrutiny Committee Internal audit – Yes, reports received and representatives from Internal Audit attend meetings to allow challenge. External audit - Yes, reports received and representatives from External Audit attend meetings to allow challenge. 12 Has the committee met privately with the external auditors and head of internal audit in the last year? Y Members have met in private with the Audit and Risk Manager. This is at minimum a yearly requirement but can be held at any time at the request of members. Membership and support 13 Has the committee been established in accordance with the 2022 guidance as follows? • Separation from executive Y • A size that is not unwieldy and avoids use of substitutes P Membership –15 from 26 Full Council Elected Members In accordance with the CIPFA Guidance, this is more than is required, but members were of the opinion that no change is needed as it is considered that current arrangements are appropriate. Non- administration members are appointed to the positions of Chair and Vice Chair. • Inclusion of lay/co-opted independent members in Y 2 X Independent Members to the Audit and Scrutiny Committee have been appointed. Page 130
Page 131
accordance with legislation or CIPFA’s recommendation 14 Have all committee members been appointed or selected to ensure a committee membership that is knowledgeable and skilled? Y Standards detail that all members must demonstrate the highest probity and public accountability standards. Briefings have also been provided in informal sessions to coincide with the audit cycle to help committee members extend their knowledge. 15 Has an evaluation of knowledge, skills and the training needs of the chair and committee members been carried out within the last two years? Y There is a comprehensive Induction Programme. Ongoing training and briefings are also provided to elected members. In addition, a training questionnaire has been developed from the knowledge and skills framework outlined in the CIPFA Guidance and distributed to members to identify any additional training needs. . 16 Have regular training and support arrangements been put in place covering the areas set out in the 2022 guidance? Y Organisational Development provides training to support elected members in discharging their duties effectively. As detailed previously, a training questionnaire has been developed from the CIPFA Questionnaire that will also help identify any skills gap where Organisational Development can provide further training. 17 Across the committee membership, is there a satisfactory level of knowledge, as set out in the 2022 guidance? Y The appointment of 2 X Independent Members with specialised financial and governance skills has assisted in meeting this requirement. 18 Is adequate secretariat and administrative support provided to the committee? Y Support is provided by Democratic Services who send out agendas and compile minutes. 19 Does the committee have good working relations with key people and organisations, Y Yes. External/ Internal Audit and CFO representatives attend meetings where elected members can discuss and challenge items on the agenda. Full Council meeting on 21 January 2025 agreed on a revised committee reporting format and a more efficient and Page 131
Page 132
including external audit, internal audit and the CFO? effective process for the timely submission to the pre-agenda meetings. Effectiveness of the committee 20 Has the committee obtained feedback on its performance from those interacting with the committee or relying on its work? Y There is no formal mechanism for feedback on the Committee’s performance; however, there are opportunities for views and guidance to be provided as both the Chief Executive and the Monitoring Officer attend the Audit and Scrutiny Committee. 21 Are meetings well chaired, ensuring key agenda items are addressed with a focus on improvement? Y As reflected in the Minutes of the Committee 22 Are meetings effective with a good level of discussion and engagement from all the members? Y As reflected in the Minutes of the Committee 23 Has the committee maintained a non-political approach to discussions throughout? Y Members agreed this should be moved to a “yes” as work has been ongoing to further develop improved collaborative working relationships. 24 Does the committee engage with a wide range of leaders and managers, including discussion of audit findings, risks and action plans with the responsible officers? Y Members challenge officers on audit findings and endorse recommendations. Audit and Scrutiny Committee may request Senior Management to attend Committee and provide an update on their actions to address the risks and associated recommendations identified by Internal Audit. 25 Does the committee make recommendations for the P The Audit and Scrutiny Committee does not make recommendations; however, it does agree to the Annual Internal Audit Plan, and the implementation of the plan is monitored Page 132
Page 133
improvement of governance, risk and control arrangements? accordingly. The audits reported to Committee include recommendations concerning governance, risk and control arrangements. The Audit and Risk Manager meets with the Chair of the Audit and Scrutiny Committee independently of senior management. As detailed previously, it was discussed that further development of the scrutiny function for the Audit and Scrutiny Committee should be considered. 26 Do audit committee recommendations have traction with those in leadership roles? P Audit and Scrutiny Committee can recommend services to provide progress reports on implementing audit recommendations. Internal audit recommendations with management responses included within reports and follow up reviews also undertaken to evidence implementation. 27 Has the committee evaluated whether and how it is adding value to the organisation? Y A previous self-assessment and evaluation was undertaken to review how effectively it fulfilled its functions (CIPFA guidance 2022 ‘audit committees’). 28 Does the committee have an action plan to improve any areas of weakness? Y As part of this self-evaluation review, an action plan has been prepared. 29 Has this assessment been undertaken collaboratively with the audit committee members? Y Meeting held with members to discuss and agree CIPFA self assessment and evaluation of the Audit and Scrutiny Committee. Page 133
Page 134
APPENDIX 2 CIPFA Audit Committees: Practical Guidance for Local Authorities and Police 2022 Edition Evaluating the Impact and Effectiveness of the Audit & Scrutiny Committee AREAS WHERE THE AUDIT COMMITTEE CAN ADD VALUE BY SUPPORTING IMPROVEMENT EXAMPLES OF HOW THE AUDIT COMMITTEE CAN ADD VALUE AND PROVIDE EVIDENCE OF EFFECTIVENESS SELF-EVALUATION, EXAMPLES, AREAS OF STRENGTH AND WEAKNESS OVERALL ASSESSMENT 5-1 SEE KEY BELOW 1. Promoting the principles of good governance and their application to decision making Supporting the development of a local code of governance. Providing robust review of the Annual Governance Statement (AGS) and the assurances underpinning it. Supporting reviews/audits of governance arrangements Participating in self assessments and evaluation of governance arrangements Working with partner audit committees to review governance arrangements in partnerships. Chair of the Audit and Scrutiny Committee meets with Chief Executive / Heads of Services on a regular basis. The Committee supports the role of audit in improving internal control and governance. Chair meets Committee Chairs of MIJB and GVJB. The committee scrutinises AGS. Audit and Risk Manager provides annual opinion on the adequacy and effectiveness of the Council’s internal control systems. 3 Page 134
Page 135
Annual self-assessment of Compliance and Evaluation of Effectiveness from the CIPFA Publication “Audit Committees: Practical Guidance for Local Authorities and Police 2022 Edition”, undertaken by Audit and Scrutiny Committee members. 2. Contributing to the development of an effective control environment. Actively monitoring the implementation of recommendations from auditors. Encouraging ownership of the internal control framework by appropriate managers. Raising significant concerns over controls with appropriate senior managers. Committee receives regular progress reports from Auditors including follow up reviews to evidence the implementation of recommendations. Heads of Services attend committee meetings to answer questions concerning audit findings and timescales/progress in the implementation of recommendations. Audit and Risk Manager provides annual opinion on Council’s internal control systems. Control frameworks are in place and operating effectively for key control areas. External and Internal Audit findings are reported to the Audit and Scrutiny Committee. 4 3. Supporting the establishment of arrangements for the governance of risk and Reviewing risk management arrangements and their effectiveness, e.g. risk management benchmarking. Monitoring improvements. Corporate Committee receives quarterly and an annual report on the corporate risks and mitigations. The Corporate Committee approved an updated Risk Management Policy 4 Page 135
Page 136
for effective arrangements to manage risks. Holding risk owners to account for major/strategic risks. on 23 April 2024. Business Continuity and Risk Management Officer supports services to deliver effective arrangements. 4. Advising on the adequacy of the assurance framework and considering whether assurance is deployed efficiently and effectively. Specifying its assurance needs, identifying gaps or overlaps in assurance. Seeking to streamline assurance gathering and reporting. Reviewing the effectiveness of assurance providers, e.g. internal audit, risk management, external audit. Induction programme outlines governance/ assurance framework and audit cycle. Audit and Scrutiny Committee considers annual strategies, plans and reports from auditors. The authority’s leadership team has defined an appropriate assurance framework for core delivery arrangements, major service areas and collaborations with external bodies. 5 5. Supporting the quality of the internal audit activity, particularly by underpinning its organisational independence. Reviewing the audit charter and functional reporting arrangements. Assessing the effectiveness of internal audit arrangements, providing constructive challenge and supporting improvements. Actively supporting the quality assurance and improvement programme (QAIP) of internal audit. Audit and Scrutiny Committee considers and approves the Internal Audit Charter. A copy of the Internal Audit Charter is also provided annually as part of the Annual Internal Audit Plan. The Committee is provided with regular internal audit reports allowing for any points of clarification to be discussed and the endorsing of recommendations. Committee receives Internal Audit and PSIAS conformance reports. 5 Page 136
Page 137
Internal Audit undertakes projects in accordance with the approved audit plan, and any amendments are explained. 6. Aiding the achievement of the authority’s goals and objectives through helping to ensure appropriate governance, risk, control and assurance arrangements Reviewing how the governance arrangements support the achievement of sustainable outcomes. Reviewing major projects and programmes to ensure that governance and assurance arrangements are in place. Reviewing the effectiveness of performance management arrangements. Auditors provide assurance reports on governance arrangements for transformation, sustainability, and performance management. Annual Governance Statement sets out the Governance Framework. Inspection reports detail current arrangements and any improvement areas to support achieving service objectives. The authority’s arrangements to review and assess performance are primarily undertaken by Service Committees. It is considered that further development of the scrutiny function of the Audit and Scrutiny Committee would improve current governance arrangements. 3 7. Supporting the development of robust arrangements for ensuring value for money. Ensuring that assurance on value for money arrangements is included in the assurances received by the audit committee. Considering how performance in value for money is evaluated as part of the AGS. Following up issues raised by external audit in their value-for- Value for money is assessed by both Internal and External Audit. Annual Governance Statement sets out the Governance Framework including arrangements for best value. External audit’s assessments of arrangements to support best value are satisfactory. 4 Page 137
Page 138
money work. This overall assessment score was reduced to 4 as the Council is going through a period of significant change to ensure future financial sustainability and a revised corporate management re-structure. 8. Helping the authority to implement the values of good governance, including effective arrangements for countering fraud and corruption risks. Reviewing arrangements against the standards set out in the Code of Practice on Managing the Risk of Fraud and Corruption (CIPFA, 2014). Reviewing fraud risks and the effectiveness of the organisation’s strategy to address those risks. Assessing the effectiveness of ethical governance arrangements for both staff and governors. Audit and Scrutiny Committee has scrutinised the Policy to Combat Fraud, Theft, Bribery and Corruption (which are underpinned by relevant standards, codes of conduct, policies and procedures) The Corporate Committee approved the Policy to Combat Fraud, Theft, Bribery and Corruption on 30 January 2024. Auditors have issued assurance reports on fraud risks and counter fraud controls. 4 9. Promoting effective public reporting to the authority’s stakeholders and local community and measures to improve transparency and accountability. Improving how the authority discharges its responsibilities for public reporting; for example, better targeting at the audience, plain English. Reviewing whether decision making through partnership organisations remains transparent and publicly accessible and encourages greater transparency. Publishing an annual report from the committee. The Audit and Scrutiny Committee meets in public with only reports exempt from the public discussion that are presented in private. Plain English is used throughout reports with jargon kept to a minimum. Audit and Scrutiny Chair meets with other Committee Chairs on a regular basis to understand assurance arrangements to avoid duplication. 5 Page 138
Page 139
Evidence noted that the Council meets statutory deadlines for financial reporting. The Audit and Scrutiny Committee reviews the Annual Governance Statement to ensure it accurately assesses the adequacy of governance arrangements. As the Audit and Scrutiny Committee membership includes 15 elected members, 2 independent members, audit reports are available to all members and direct access to the Audit and Risk Manager, an annual report would only be for administrative rather than governance control purposes. Assessment key 5 Clear evidence is available from a number of sources that the committee is actively supporting improvements across all aspects of this area. The improvements made are clearly identifiable. 4 Clear evidence from some sources that the committee is actively and effectively supporting improvement across some aspects of this area. 3 The committee has had mixed experience in supporting improvement in this area. There is some evidence that demonstrates their impact but there are also significant gaps. 2 There is some evidence that the committee has supported improvements, but the impact of this support is limited. 1 No evidence can be found that the audit committee has supported improvements in this area. Page 139
Page 140
APPENDIX 3 CIPFA Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Objective: The Council’s audit, scrutiny and governance arrangements should comply with CIPFA’s Audit Committees: Practical Guidance for Local Authorities and Police, 2022 Edition. 1 The Audit and Scrutiny Committee should undertake an annual self-assessment and evaluation exercise against the best practice checklists detailed within the CIPFA Publication – Audit Committees: Practical Guidance for Local Authorities and Police 2022.(E1) Medium Yes Annual self- assessment and evaluation exercise will be undertaken with members of the Audit and Scrutiny Committee. Audit and Risk Manager Annual Requirement 2 The External Auditor and the Audit and Risk Manager should at least annually meet in private with members of the Audit and Scrutiny Committee. (SA12) Medium Yes Members can contact the Audit and Risk Manager directly at any time. However, a meeting will be Audit and Risk Manager 31/10/2025 Page 140
Page 141
Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation arranged. 3 A self-evaluation questionnaire should be issued to elected members to identify additional skills or training needs. (SA16) Medium Yes A self assessment questionnaire has been issued to all members of the Audit and Scrutiny Committee. Any training requirements identified will be referred to the Organisational Development Service. Audit and Risk Manager Implemented 4 A review and if necessary, an update of the Scheme of Administration should be undertaken with a specific focus on further developing the scrutiny function of the Audit and Scrutiny Committee. (SA1/4/6/25/E6) Medium Yes A review will be undertaken to explore the further development of the Council's scrutiny functions. This process will involve researching how Head of Governance, Strategy & Performance 31/12/2025 Page 141
Page 142
Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation other local authorities operate their scrutiny functions to identify best practices. The review is expected to be completed by the end of September 2025, and the Committee will receive a report detailing any proposed changes by 31 December 2025. Page 142
Page 143
Report to: Audit and Scrutiny Committee Meeting Date: 24 June 2025 Report by: Report No:Chief Executive GSP039/25/AS Author: Atholl Scott Contact Email: atholl.scott@moray.gov.uk Subject: Annual Governance Statement 1. PURPOSE ☒ For Decision ☐ For Information 1.1 This report provides Committee with a copy of the Council’s Annual Governance Statement for 2024/25 for review and approval. 1.2 This report is submitted to Committee in terms of Section III (I) (5) of the Council’s Scheme of Administration relating to supporting the Council’s governance arrangements through review of the Annual Governance Statement. 2. SUMMARY 2.1 The Annual Governance Statement is a mandatory requirement for local government bodies and is published by the Council alongside its annual accounts. This report includes a copy of the draft Annual Governance Statement and is presented to the Committee for scrutiny before it is finalised for inclusion in the audited annual accounts. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Committee is asked to scrutinise the draft Annual Governance Statement provided as Appendix 1. Atholl Scott Business Continuity and Risk Management Officer 4. BACKGROUND AND CONTEXT 4.1 The function of good governance in the public sector ensures that entities act in the public interest at all times. Governance comprises the arrangements put in place to ensure intended outcomes are defined and achieved. Item 12. Page 143
Page 144
4.2 The Chartered Institute of Public Finance and Accountancy (CIPFA) and the Society of Local Authority Chief Executives (SOLACE), building on work undertaken by the International Federation of Accountants, have published a guidance framework on ‘Delivering Good Governance in Local Government’. 4.3 The Local Authority Accounts (Scotland) Regulations 2014 requires the Council to publish an Annual Governance Statement with its annual accounts. The Statement is based on the guidance and summarises practice across the seven principles identified within the framework, considers the roles of those who oversee the development and operation of such practice, and provides an overall assessment of the effectiveness of governance arrangements. The statement includes an annual opinion provided by the Audit and Risk Manager in line with Public Sector Internal Audit Standards. 4.4 Good governance practice involves both elected members and officers and this is reflected in the requirement for the statement to be certified by both the Leader of the Council and the Chief Executive as Head of Paid Service 4.5 The statement is subject to review by external audit, where the external auditor is required to report on anything believed to be inconsistent with any other findings disclosed from the audit work completed. There has been nothing to report in this regard in previous annual audits. 5. PROPOSALS 5.1 This report provides Committee with a copy of the draft 2024/25 Annual Governance Statement, which has been produced following completion of the annual review of the Council’s governance arrangements and system of internal control. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Governance refers to how organisations are managed and controlled. Effective governance is key to the delivery of the strategic priorities promoted in Community and Council strategic plans. Page 144
Page 145
a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☒ Tackle Poverty and Inequality. ☒ Build Stronger Greener Vibrant Economy. ☒ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal The Annual Governance Statement forms part of the annual accounts the Council is required to prepare under statute. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk Good governance includes the effective management of risk, as evidenced in this ‘risk implications’ paragraph in all reports that come before the Council and its committees, and in the Council’s corporate risk register that is kept under review by Senior Management and reported at agreed intervals to the Corporate Committee 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation The Council’s Annual Governance Statement is prepared in accordance with the CIPFA/SOLACE ‘Delivering Good Governance in Local Government’ Framework and is key to ensure the delivery of the council’s strategic priorities. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. Page 145
Page 146
6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 The Chief Executive, and Corporate and Senior Management Teams have been consulted and have contributed to the content of the Annual Governance Statement. In addition, the Leader of the Council, as a signatory to the Statement, has also been consulted. 8. BACKGROUND PAPERS 8.1 None Page 146
Page 147
APPENDIX 1 Moray Council Annual Governance Statement 2024/25 Page 147
Page 148
Table of Contents 1. Scope of Responsibility 2. Framework for Good Governance 3. Review of the Adequacy and Effectiveness of the Council’s Governance Arrangements 4. Overall Assessment of the Effectiveness of Governance Arrangements 5. Significant governance issues 6. Concluding Remarks Page 148
Page 149
1. Scope of Responsibility The council is responsible for ensuring its business is conducted in accordance with the law and proper standards, and that public money is safeguarded, properly accounted for, and used economically, efficiently and effectively. The council has a statutory duty to make arrangements to secure Best Value under the Local Government in Scotland Act 2003. In discharging these responsibilities, elected members and the corporate leadership teams are responsible for putting in place proper arrangements for the governance of the council’s affairs and for facilitating the effective exercise of its functions. In delivering these functions, there is a requirement to maintain effective partnership working with others, principally with NHS Grampian and the Moray Integration Joint Board, Grampian Valuation Joint Board, tsi Moray, and the Moray Leisure Centre, as well as with other bodies involved in Community Planning and in the delivery of projects forming part of the Moray Growth Deal. This annual governance statement, which covers the period from 1 April 2024 through to the date of signing of these annual accounts, explains how the council has used the CIPFA/SOLACE 2016 Framework ‘Delivering Good Governance in Local Government’ as a basis for considering the effectiveness of its own governance arrangements. 2. Framework for Good Governance The overall aim of the ‘Delivering Good Governance in Local Government’ Framework is to ensure that: resources are directed in accordance with agreed policy and according to priorities; there is sound and inclusive decision making; and there is clear accountability for the use of those resources in order to achieve desired outcomes for service users and communities. The key elements of the council’s governance arrangements are described in terms of the seven principles defined in the Framework, summarised as follows: 2.1 Behaving with integrity, demonstrating strong commitment to ethical values, and respecting the rule of law; The roles and responsibilities of elected members and senior officers and the processes to govern the conduct of the council’s business are defined in procedural Standing Orders, a Scheme of Administration, a Scheme of Delegation, and Financial Regulations. These are updated annually following consideration and review of changes necessary for the effective functioning of the council’s affairs. These changes are prompted by new legislation, audit recommendations, or to incorporate identified revisions necessary to improve governance practice. Supplementary (second tier) documents providing additional guidance on specific constitutional matters have also been updated to support improvements in collaborative leadership; these covering councillor roles and responsibilities, councillor/senior officer relations, and the role of councillors serving on outside Page 149
Page 150
bodies. Early stages of a plan to implement a revised management structure, to include new ways of working and a refreshed corporate culture have also been progressed. Codes of Conduct for both elected members and officers are in place, and these define the ethical values and standards of behaviour expected. The Codes draw on the ‘Standards in Public Life’ covering issues including leadership, fairness and integrity. Refresher training on the Code of Conduct for elected members was delivered in conjunction with the Improvement Service. Two referrals in respect of councillor conduct were made to the Standards Commission during the year; neither resulted in formal action being taken. The council’s Head of Governance, Strategy and Performance is the designated Monitoring Officer responsible for ensuring that agreed procedures are followed and that all applicable statutes and regulations are complied with. External support was secured to support the development of collaborative leadership as an aid to good governance in decision making, with elected members acknowledging the benefits of collegiate working where practicable to do so. 2.2 Ensuring openness and comprehensive stakeholder engagement; In developing improvement and modernisation opportunities, meetings of the council and its committees are delivered using a hybrid format that enables attendance in person or via web link. Meetings of the council and main service Committees are live streamed and available for public viewing, with matters discussed and determined in confidence relating only to those deemed confidential in terms of Part 1 of Schedule 7A of the Local Government (Scotland) Act 1973. The rationale for all decisions proposed and taken is fully set out in committee reports. Stakeholder engagement is central to the council’s work at a strategic level, notably in the development of the updated Corporate Plan which sets out strategic priorities for the period from 2024-29. Both staff and the public were surveyed, and the results reported to a meeting of the council to aid and inform consideration of the priorities to be taken forward. Service consultations are also conducted as appropriate, recent examples including a tenant satisfaction survey in housing, engagement on town centre redevelopment, and on options for future school provision in communities across Moray. Wide consultation with both internal and external stakeholders also informed the preparation of a comprehensive Evidence Report, one of the first to be approved by Scottish Government ahead of the council formulating its Moray Local Development Plan for 2027. The council seeks and obtains feedback on delivery of its services having adopted a comprehensive complaints procedure based on a model scheme developed by the Office of the Scottish Public Services Ombudsman. All complaints are responded to Page 150
Page 151
as appropriate and inform improvements to service delivery. A comprehensive report on complaints handling is prepared and presented annually to a council committee. 2.3 Defining outcomes in terms of sustainable economic, social, and environmental benefits; The creation and implementation of a vision for the local area, including expected outcomes for the community, is encompassed in the Local Outcomes Improvement Plan (LOIP). The overarching aim and purpose of this 10-year Plan is ‘to raise aspirations by creating an enabling environment where our residents can achieve expanded choices, improved livelihoods and wellbeing”. In particular, the LOIP recognises the importance of and benefits from reducing inequalities and poverty, with outcomes focused on the need for a growing, diverse and sustainable economy, building a better future for our children and young people in Moray, empowering and connecting communities, and improving the wellbeing of our population. The LOIP is a partnership plan, and its strategic delivery is overseen by a Community Planning Board, which meets quarterly. The Board comprises representatives from a broad range of organisations as reflected in agenda items considered during the year. These included reports on School Age Childcare, Climate Change, Moray Growth Deal, Community Learning and Development, Promotion of Physical Activity, and Community Wealth Building. Development sessions have been held to strengthen good governance arrangements, recognising the benefits that working in partnership can bring. A self- assessment facilitated by the Improvement Service has also been completed with a feedback development session planned to consider outcomes from the self- assessment and any further actions arising therefrom. Currently the LOIP sits alongside a refreshed Corporate Plan Moray 2024-2029, the latter setting out the vision and priorities of the council for the next five years. The council plan updates council priorities focussing on three key themes: tackling poverty and inequality, building a stronger greener vibrant economy, and seeking to build thriving, resilient, empowered communities. The plan sets targets for outcomes consistent with maintaining a sustainable council that provides valued services to its communities. The period also saw the council agree a Sustainable Development Statement aligned to the Corporate Plan, council priorities and the Climate Change Strategy. The statement acknowledges sustainable development as a fundamental aspect of Best Value and provides a framework against which the council can monitor progress and demonstrate compliance. 2.4 Determining the interventions necessary to optimise the achievement of the intended outcomes; Page 151
Page 152
The strategic partnership and corporate plans are translated into service plans prepared within each council service area. These facilitate delivery of agreed outcomes and assist in securing continuous improvement. Service plans are reported to a meeting of the council or appropriate service committee for consideration and approval, in reports that provide information on planned activity. More generally, all committee reports contain a ‘Summary of Implications’ section that links report content to strategic plans, legal and policy issues; financial implications, risk, staffing and property matters; equalities; social impact; and climate change and biodiversity considerations. The format of these reports has been updated during the period based on advice from the Improvement Service with the principal objective of providing enhancements to current reporting arrangements. A particular focus continues to be given to financial implications of any proposals given the current economic climate. The council is fully aware of the financial challenges it faces, and elected members are provided with an extensive volume of information on both the availability of resources and options for future service delivery. This has been made available during workshops for elected members; in reports to the council on budget setting, including projections for the medium to longer term; and in regular budget monitoring reports covering both capital and revenue expenditure submitted to service committees. A formal budget protocol was developed during the year to aid governance in this area, which set a framework of engagement and consultation to support the process. A balanced budget for 2025/26 was secured without use of reserves for the first time in several years. This was achieved through a combination of an improved financial settlement from Scottish Government, an increase in Council Tax, and savings delivered in line with the council’s short to medium term financial strategy. A number of unknowns including impacts of inflation and arising from future pay awards were highlighted during the budget setting process, as were continued pressures in respect of the council’s funding obligations to the Moray Integration Joint Board. Longer term financial planning projections note that further council tax rises and additional savings will be required going forward, and a transformation strategy was agreed during the year to aid in the delivery of these savings. The achievement of agreed outcomes is monitored through an established Performance Management Framework that calls for frequent reporting on key performance measures developed for each service. In addition, the council participates in the Local Government Benchmarking Framework which compares a range of established performance measures with those of other Scottish local authorities. Service Committees are provided with reports to review, scrutinise and note actions undertaken by services to meet performance objectives. An illustrated annual Public Performance Report is prepared and published to demonstrate the outcomes and achievements of the council during the year, together with an annual report on progress relative to delivery of the Corporate Plan objectives. Page 152
Page 153
2.5 Developing the entity’s capacity, including the capability of its leadership and the individuals within it; The Chief Executive is responsible and accountable to the council for all aspects of management including promoting sound governance, providing quality information/support to inform decision making and scrutiny, supporting other statutory officers, and building relationships with all elected members. For the majority of the period covered by this statement, the Chief Executive role was filled on an interim basis following retirement of the permanent jobholder. A permanent replacement Chief Executive has been appointed and commenced in post in March 2025. Leadership capacity of senior officers is supported through the promotion of a Leadership Forum, which brings together senior managers from all services to provide a wider perspective to the consideration of issues facing the council. Forum meetings ensure consistent messaging is available from senior management to managers. Human Resources has continued to review and refine workforce development opportunities, including on leadership development, and to provide training opportunities for all staff online. An external review of the roles and responsibilities of senior employees has been progressed during the period to ensure corporate management arrangements remain appropriate in terms of capacity and capability in the current operating environment. A revised senior management structure was agreed by council in April 2025. Actions arising therefrom will be progressed over the summer period with a target date for full implementation of September 2025. The revisions stress the importance of prioritising leadership, in consequence the corporate management arrangements that applied for most of the period covered by this statement have been revised. A Corporate Leadership Team (CLT) comprising the Chief Executive, three Executive Directors, the Monitoring Officer, the Chief Financial Officer and the Chief Officer (Health and Social Care Moray) has been established. This is supported by an Extended Corporate Leadership Team (ECLT) that additionally includes Heads of Services. The council has an agreed elected members’ development strategy that includes an on-going training programme of learning, development and briefings. Members appointed to certain committees also receive specific training related to the responsibilities of these committees. A Strategic Leadership Forum has been established involving both elected members and senior officers to facilitate collaborative cross-party discussions on the future direction of council services. Senior Officers also meet regularly with Chairs of the council and its committees. In addition, elected members represent the council on a range of outside bodies, including on boards of other Community Planning partners, across partnership bodies such as the Moray Economic Partnership, various national bodies such as COSLA and its themed Boards, and a broad range of charitable and third sector organisations. This representation provides valuable learning and networking opportunities for those members. Page 153
Page 154
2.6 Managing risks and performance through robust internal control and strong public financial management; The council has a risk management policy designed to support the identification, evaluation and mitigation of risks that may impact on its ability to meet its objectives. The policy was updated during the year. A Corporate Risk Register is also maintained providing summary information on issues the CLT considers are the principal risks facing the council. The register describes how these risks are managed and controlled. Risk implications are also detailed in all committee reports to inform decision-making processes. The council’s system of internal control is based on a framework of financial regulations, regular management information, administrative procedures, management supervision and a scheme of delegation that defines accountabilities of senior officers. Establishing and maintaining an effective system of internal control is a management function. An Audit and Scrutiny Committee, through its consideration of reports by internal and external auditors, monitors the effectiveness of the system of internal control. Strong financial management is secured through the work of the Chief Financial Officer appointed in terms of s.95 of the Local Government (Scotland) Act 1973. This officer advises the Council on all financial matters and ensures the timely production and reporting of budget estimates, budget monitoring reports and annual accounts. Draft and audited Annual Accounts are published on the council website. 2.7 Implementing good practices in transparency, reporting, and audit to deliver effective accountability; Council business is conducted through an established cycle of webcast committee meetings. Webcasts remain available for viewing for 12 months following a meeting. Meeting dates are published in advance, and agenda papers are made available at least one week before meetings take place. Minutes of meetings are prepared, and important decisions are publicised on the council website and through social media. The council’s website provides a platform from which to disseminate a wide range of information including news items on policy decisions, guidance on council services, and on service disruptions/interruptions arising from weather events or similar. The website increasingly facilitates efficient access to digital services across a range of service areas and allows for consultations to be undertaken and for interested parties to provide feedback electronically. The council responds to the findings and recommendations of Internal Audit, External Audit, and other Scrutiny and Inspection bodies by developing improvement Action Plans. The Audit and Scrutiny Committee is integral to overseeing independent and objective assurance processes that make recommendations for improvements to the system of internal control. Training for elected members on the specifics of effective scrutiny was provided during the period. Page 154
Page 155
A particular and continuing focus in the period was the council’s response to the latest Accounts Commission Best Value review report. The report was considered in detail at a meeting of the Council in June 2024, with an action plan developed in response to the Commission’s findings. Progress towards meeting the action plan objectives, which covers issues including the council’s vision, leadership, effective use of resources and sustainable development, has been considered by the council’s Corporate Committee at quarterly intervals for the remainder of the period covered by this statement, with actions taken to address the agreed recommendations from the report being closely monitored. The council responds to requests for information under Freedom of Information legislation having processed some 1,500 such requests during the period covered by this statement. 3. Review of the Adequacy and Effectiveness of the Council’s Governance Framework 3.1 In order to assess the effectiveness of the governance framework, including the system of internal control, it is necessary to consider the role of the functions and individuals who contribute to it, as follows: Elected Members Governance arrangements at a political level emanate from the council, its committees and from other roles that elected members fulfil. These include participation in the Community Planning Board and associated groups for multi-agency issues. Elected members also have substantive roles on the Moray Integration Joint Board for Health and Social Care, the Grampian Valuation Joint Board, and the Moray Leisure Arm’s Length External Organisation (ALEO), each of which has its own governance arrangements. In addition, elected members have membership and represent Moray Council interests in partnerships that contribute to meeting council aims and objectives, notably in the development and delivery of projects forming part of the Moray Growth Deal. Acknowledging political difference, elected members have been encouraged to strengthen collegiate working where possible. This has been evident during the period with improved opportunities for informal discussion and engagement on development of policy proposals. A survey of elected members and chief officers on collaborative leadership and working relationships also returned positive results. Audit and Scrutiny Committee The council has an Audit and Scrutiny Committee where elected members consider reports on audit matters. These reports provide assurances on the adequacy and effectiveness of the system of internal controls including those relative to the delivery of plans, compliance with laws and regulations, accuracy of information and safeguarding of assets. The Committee functions Page 155
Page 156
in line with best practice guidance published by the Chartered Institute of Public Finance and Accountancy. Two external members sit on the committee to provide an independent perspective on issues under consideration. This committee is a key component of good governance, distinguished from other committees by the role elected members are required to fulfil, not in setting policy or considering service matters, but by providing independent oversight and challenge in support of the council’s duty to secure continuous improvement. These functions are delivered independently from the supervisory oversight roles of the Leadership Teams. The Corporate Leadership Team The Corporate Leadership Team (CLT) has overarching operational responsibility for good governance arrangements. The team for much of the year comprised the Chief Executive, two Depute Chief Executives with portfolio responsibilities for Education, Communities and Organisational Development; and Economy, Environment and Finance respectively, the Chief Officer (Health and Social Care Moray), the Monitoring Officer and the Chief Financial Officer. As reported above, the roles and responsibilities of officers within the Corporate Management Team have been revised and, in some cases, redesignated to strengthen strategic leadership arrangements. The Corporate Leadership Team / Extended Corporate Leadership Team This is an extended management team comprising the CLT and Heads of Services. The role and remit of this group is to support the formulation and implementation of policies, strategies and plans to achieve local and national outcomes, to share and promote good practice from an inter-service perspective, to act with the wider objectives of the council in mind to ensure the resources are effectively deployed, and to assist CLT in keeping the governance of the council and its services under review. Individual Heads of Service, including the Chief Financial Officer and Monitoring Officer, have considered the effectiveness of governance arrangements within their respective services by reference to the principal risks identified in the council’s Corporate Risk Register and provided assurance statements for use in the preparation of this corporate statement. This affirms the broad ownership of good governance and recognition of its importance within the senior leadership of the council. Overall, the assurance statements provided confirm that governance arrangements within services are working as intended, and in support commentary has been given on elevated risks and on mitigating actions taken in response. The main issues raised in these returns are: Page 156
Page 157
Staffing shortages and vacancies, and their impact on capacity to deliver change at pace in a number of service areas. Continuing risk of data breaches, and the response being taken by services to mitigate these through provision of training on data security and reminder on data security considerations when using email. Ongoing obligations on the Housing Service to monitor homelessness data and progress electrical safety improvements in council houses in support of national initiatives directed by the Scottish Housing Regulator. A need for continued focus on Health and Safety requirements thereby protecting the workforce and minimising the number of reportable incidents. Reported progress made to strengthen governance arrangements around delivery of Additional Support Needs in Education, and to embed climate change implications into procurement practice. A need to ensure due consideration is given to equalities impacts in all cases where persons or groups potentially affected have protected characteristics. The Head of Governance, Strategy and Performance (Monitoring Officer) / Chief Financial Officer The Head of Governance, Strategy and Performance and the Chief Financial Officer perform their respective statutory duties as outlined elsewhere in this statement. In discharging the responsibilities of the role, the Chief Financial Officer complies with the governance requirements of the CIPFA Statement on the role of the Chief Financial Officer, and the Head of Governance, Strategy and Performance provides an annual information report on discharging the duties of a Monitoring Officer to a meeting of the council. The Chief Social Work Officer The Head of Service, Health and Social Care Moray fulfils the statutory role of Chief Social Work Officer (CSWO) as part of the duties of the post. The latest available CSWO annual report for the year to 31 March 2024 notes continuing challenges, with increased service needs set against financial and recruitment pressures. This report covers the first year Children & Young People and Criminal Justice Social Work services have been fully integrated into the Health and Social Care Partnership, and, in the period covered by this statement, work has continued to better align governance structures across Health and Social Care. Improvements under way include replacement of the case management system, development of data used for performance reporting, and progressing the review of adult commissioning arrangements in response to a recently completed audit of current practice by an external firm. Page 157
Page 158
The report also noted an impending change in the holder of the CSWO post and in a number of other senior manager roles and stressed the importance of ensuring services remain as stable as possible during a period of further transition. The post of CSWO has been filled on an interim basis since June 2024, and arrangements are being finalised for the recruitment of a permanent CSWO. Internal Audit The Internal Audit activity adds value to the Council by considering strategies, objectives, and risks; offering ways to enhance governance, risk management and control processes; and objectively providing relevant assurances. The Audit and Risk Manager is accountable on a day-to-day basis to the Head of Governance, Strategy and Performance and to the Audit and Scrutiny Committee. Internal Audit applies mandatory Public Sector Internal Audit Standards (PSIAS) in delivering the Internal Audit Service. An external quality assessment of the service during the year confirmed compliance with the PSIAS. The Council has a system of internal control designed to manage risk to a reasonable level. Internal controls cannot eliminate the risk of failure to achieve policies, aims and objectives and can therefore only provide reasonable and not absolute assurance of effectiveness. The internal audit plan for the year includes a range of audit projects covering main financial systems, other systems operating within services and several ad-hoc/unplanned projects. The outcomes from these projects, together with any recommendations to enhance the control environment, are reported to the Audit and Scrutiny Committee. This Committee is chaired by an elected member who is not part of the council Administration. Almost all planned reviews detailed within the Annual Internal Audit Plan for 2024/25 were completed as scheduled. PSIAS requires an internal audit opinion to be provided annually. As planned audit work was substantially completed by the year-end and based on this and other knowledge of the organisation and its control systems, it is the opinion of the Audit and Risk Manager that reasonable assurance can be placed upon the adequacy and effectiveness of the internal control environment which operated in the council during the year. Health & Social Care Partnership The council, as a key partner of Health and Social Care Moray has an interest in the governance arrangements of the Moray Integration Joint Board (MIJB). This given its financial exposure as a principal funder and continuing statutory responsibilities for Social Work services and the role and function of the Chief Social Work Officer. Governance was improved during the period with the Page 158
Page 159
Chief Officer (Health and Social Care Moray) now attending council meetings and providing reports summarising details of the Board’s activities. Audit arrangements for the MIJB are provided jointly by the council’s Internal Audit Service and NHS Grampian’s Internal Auditors. The council’s Audit and Risk Manager (as Chief Internal Auditor for the MIJB) provides assurance over social care services, and oversight of the MIJB governance arrangements. In prior years there was no formal reporting to the MIJB of internal audit work relative to NHS services delivered under its direction. This position has been reviewed to strengthen governance practice, with agreement now reached to enable relevant NHS Internal audit reports to be considered by the MIJB. From audit work completed in this role, the Chief Internal Auditor has provided an opinion of only limited assurance that the Moray Integration Joint Board has adequate systems of governance and internal control for the year ended 31st March 2025. A continuing governance consideration for the council on a recurring basis is the financial sustainability of the MIJB, with any overspend against budget requiring to be met by NHS Grampian and the council as principal funders, pro-rata in line with an agreed funding agreement. For the 2024/25 financial year, an overspend was forecast and work undertaken to identify savings. A recovery plan was also agreed and is being delivered. Service pressures in Health and Social Care are likely to continue and will require close monitoring going forward. External Agencies In addition to the various internal review processes and the external audit of the Annual Accounts, aspects of the council’s governance arrangements are considered in various inspection reports produced by the external auditor and other inspectorate agencies. The latest Accounts Commission Best Value Report on the council, while highlighting areas of good practice, made a number of recommendations to further strengthen systems and processes in key strategic areas. The report called on the council to accelerate plans to transform how it works and deliver services, and to demonstrate its ability to create capacity to sustain the pace and momentum necessary to effect change. In particular, the report highlighted a need for the council’s Improvement and Modernisation Programme to set out clear deliverables, deadlines and lines of accountability, and for arrangements to be put in place to ensure the accuracy of financial forecasting and in-year budget monitoring. The council in response has reviewed its governance arrangements around priorities and strategic direction and prepared a comprehensive Best Value Action Plan and Transformation Strategy to aid progress. The Best Value Page 159
Page 160
Report findings were formally accepted at a special meeting of the council on 12 June 2024. The External Audit Plan for 2024/25 notes there is potentially a risk that the council does not meet its key priorities due to delayed progression of objectives and the pace of change being limited or slow, and the external audit assessment of progress will be undertaken as part of the annual audit work due to take place during the summer of 2025. A thematic external review of transformation is on-going at the time of drafting this statement. 4. Overall Assessment of the Effectiveness of Governance Arrangements 4.1 Having regard to the information provided in the preceding paragraphs, it is considered that established systems and processes are consistent with the seven principles identified in the ‘CIPFA/SOLACE’ Framework ‘Delivering Good Governance in Local Government.’ Implementation of the Best Value Action Plan has further strengthened these arrangements, and work will continue as outlined below to optimise governance arrangements that deliver Best Value for Moray. 5. Significant Governance Issues 5.1 Issues reported as requiring attention in the Annual Governance Statement for the prior year (2023/24) were aligned to the Best Value report, and to reports prepared by external advisers who provided consultancy support to the Council. These reports informed a Best Value self-assessment exercise completed by council managers which included the following priority areas for improvement: Continue work to establish a clear shared vision for Moray that supports delivery of sustainable public services. Maintain current activity to ensure leadership is effective and there is good collaboration between elected members and senior officers. Increase the pace of transformation and identify savings with the intention of securing longer term financial sustainability. Revisit governance arrangements covering partnerships; principally for Health and Social Care Moray in respect of performance and early identification of any significant financial and service risks. 5.2 While good progress has been made on all of these areas, the plan for improvement is a three-year plan and will need further refinement as the council responds to change both internally and in response to emerging issues impacting on local government. 5.3 Specifically: Page 160
Page 161
The potential to further articulate a clear shared vision for Moray remains under consideration in terms of developing a single high-level plan that consolidates the Moray Local Outcomes Improvement Plan and the council’s Corporate Plan. The absence of a single plan of itself has not prevented effective working in partnership in multiple areas, including community safety, leisure and health, child protection, and economic development. Measures to strengthen governance arrangements around leadership have been developed to enhance collegiate working and a review of senior management roles and responsibilities has been progressed, primarily to address workload capacity issues. Notwithstanding interim arrangements in a number of key roles, the council has continued to drive forward multiple initiatives across all services, including the management and oversight of substantial external funding streams including those for the Moray Growth Deal. Transformation opportunities are being pursued with specific funding allocated from earmarked reserves aimed at securing service improvements and efficiencies. Financial sustainability has been secured short-term through delivery of a balanced budget for 2025/26, with medium to longer term financial plans updated to evidence a continuing commitment to sound financial management. While Health and Social Care Moray has taken steps to generate savings from its operations during the period, a significant operating deficit in 2024/25 is expected, and further significant budget pressures are forecast in 2025/26. The council is obliged to meet its share of any overspend and has made provision to mitigate this risk. 5.4 Looking forward, key governance challenges relate to: supporting elected members to sustain the benefits derived from collaborative working, while recognising and respecting political difference; rebuilding a strong and effective corporate leadership team under the recently appointed Chief Executive in line with the agreed revised senior management structure. continuing to explore transformation opportunities where these are likely to generate improved, modern and sustainable ways of working. monitoring closely capital and revenue spend, including allocations to partner bodies, to ensure the ongoing financial sustainability of the council. reviewing committee meeting timetables to ensure these fully align with recently revised reporting arrangements. giving consideration to the mechanism for discharging the scrutiny role of elected members and distinguishing that from their decision-making roles on service committees. progressing the review of other staffing structures to create capacity Page 161
Page 162
necessary to deliver agreed priorities; this will require on-going engagement with staff, service users and other stakeholders and provide clarity around changes to service aims, delivery models, standards and levels of performance. 6. Concluding Remarks 6.1 Good governance is key to the successful operation of the council and during the period covered by this statement, governance arrangements have been strengthened further through the development and application of a best value action plan. External support has also been secured to improve organisational culture. A number of changes in senior management roles have taken place with interim management arrangements applying for much of the period. A permanent replacement Chief Executive is now in post and a new senior management structure designed to strengthen leadership capacity approved. 6.2 The council is now better placed to meet the challenges that undoubtedly lie ahead. Working together we are committed to securing continuous improvement in governance practice in order to deliver the best possible outcomes for the citizens and communities of Moray. Kathleen Robertson Karen Greaves BEM Leader of the Council Chief Executive xx September 2025 Page 162