Agenda Document Pack - Audit and Scrutiny Committee - 10/09/2025

Moray Council · 10 September 2025
Back to Audit and Scrutiny Committee — 10 September 2025 and its agenda

Text extracted from the council's PDF. Layout and reading order may differ from the original.

Original council PDF · Download plain text

Page 1

Audit and Scrutiny Committee 
Wednesday, 10 September 2025 
NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to
be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on
Wednesday, 10 September 2025 at 09:30. 
BUSINESS 
1. Sederunt 
2. Declaration of Group Decisions and Members Interests * 
3. Resolution
Consider, and if so decide, adopt the following resolution:
"That under Section 50A (4) and (5) of the Local Government (Scotland)
Act 1973, as amended, the public and media representatives be excluded
from the meeting for Items 10 and 11 of business on the grounds that it
involves the likely disclosure of exempt information of the class
described in the relevant Paragraphs of Part 1 of Schedule 7A of the Act.”   
4. Minute of meeting of 24 June 2025 7 - 14
5. Written Questions ** 
6. Internal Audit Section Update Report
Report by Service Manager Internal Audit and Risk
15 - 26
7. Internal Audit Review - Banking and Reconciliation
Report by Service Manager Internal Audit and Risk
27 - 40
8. Internal Audit Review - Residential Care
Report by Service Manager Internal Audit and Risk
41 - 66
Page 1

Page 2

9. Public Sector Internal Audit Standards - External Quality
Assessment of the Internal Audit Section - Follow Up
Review
Report by Service Manager Internal Audit and Risk
67 - 90 
Item(s) which the Committee may wish to consider with the
Press and Public excluded   
10. Internal Audit Review - Secondary School Buildings and
Grounds Security [Para 14]
• 14. Information relating to action taken, or to be taken, in connection
with the prevention, investigation or prosecution of crime. 
11. Internal Audit Follow Up Review - St Giles Shopping Centre -
Non-Domestic Rates [Para 6]
• 6. Information relating to the financial or business affairs of any
particular person(s); 
Summary of Audit and Scrutiny Committee functions:
Audit Functions - Consider reports from the Council's internal auditor &
Audit Scotland concerning Council Functions.
Scrutiny Functions - Scrutinising the policies of the Council and their
effectiveness in meeting the action plans of the Council as set out in the
Corporate Development Plan and evaluating the actions of Committees
in implementing the action plans set out in the Corporate Development
Plan.
Performance Monitoring - To receive reports on the performance of and
trends within all of the Council’s services in terms of service standards
and performance information.
Standards - To ensure that the highest standards of probity and public
accountability are demonstrated.     
Page 2

Page 3

Watching the Meeting
You can watch the webcast live by going to: 
http://www.moray.gov.uk/moray_standard/page_43661.html    
Webcasts are available to view for 1 year following the meeting.  
You can also attend the meeting in person.  If you wish to attend
in person, please come to the High Street entrance door and a
member of staff will let you into the Chamber. 
Page 3

Page 4

GUIDANCE NOTES 
* Declaration of Group Decisions and Members Interests - The Chair of the
meeting shall seek declarations from any individual or political group at the
beginning of a meeting whether any prior decision has been reached on how the
individual or members of the group will vote on any item(s) of business on the
Agenda, and if so on which item(s).  A prior decision shall be one that the
individual or the group deems to be mandatory on the individual or the group
members such that the individual or the group members will be subject to
sanctions should they not vote in accordance with the prior decision.  Any such
prior decisions will be recorded in the Minute of the meeting. 
** Written Questions - Any Member can put one written question about any relevant
and competent business within the specified remits not already on the agenda, to
the Chair provided it is received by the Proper Officer or Committee Services by
5pm three working days prior to the day of the meeting, please see Standing Order
36 for deadlines.  A copy of any written answer provided by the Chair will be
published on the Council’s committee management system by 12pm the day
before the meeting.  The Member who has put the question may, after the answer
has been published, may ask one supplementary question directly related to the
subject matter at the meeting, but no discussion will be allowed. 
No supplementary question can be put or answered more than 10 minutes after
the Council has started on the relevant item of business, except with the consent
of the Chair. If a Member does not have the opportunity to put a supplementary
question because no time remains, then he or she can submit it in writing to the
Proper Officer who will arrange for a written answer to be provided within 7
working days. 
Page 4

Page 5

MORAY COUNCIL 
Audit and Scrutiny Committee 
SEDERUNT 
Councillor Scott Lawrence  (Chair)
Councillor Theresa Coull  (Depute Chair)  
Councillor Peter Bloomfield  (Member)
Councillor Tracy Colyer  (Member)
Councillor John Divers  (Member)
Councillor Jérémie Fernandes  (Member)
Councillor Donald Gatt  (Member)
Councillor David Gordon  (Member)
Councillor Sandy Keith  (Member)
Councillor Marc Macrae  (Member)
Councillor Paul McBain  (Member)
Councillor Neil McLennan  (Member)
Councillor John Stuart  (Member)
Councillor Sonya Warren  (Member)  
Mr Ivan Augustus  (Non-Voting Member)
Ms Margaret Wilson  (Non-Voting Member)
Clerk Name: Caroline O'Connor
Clerk Telephone: 07779 999296
Clerk Email: committee.services@moray.gov.uk 
Page 5

Page 6

Page 6

Page 7

MORAY COUNCIL 
Minute of Meeting of the Audit and Scrutiny Committee 
Tuesday, 24 June 2025 
Council Chambers, Council Office, High Street, Elgin, IV30 1BX 
PRESENT 
Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Tracy Colyer, Councillor
Theresa Coull, Councillor John Divers, Councillor Jérémie Fernandes, Councillor
Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Scott
Lawrence, Councillor Marc Macrae, Councillor Paul McBain, Councillor John Stuart,
Councillor Sonya Warren, Ms Margaret Wilson 
APOLOGIES 
Councillor Neil McLennan 
IN ATTENDANCE 
Chief Executive; Depute Chief Executive (Education, Communities and
Organisational Development); Depute Chief Executive (Economy, Environment and
Finance); Chief Officer, Health and Social Care Moray; Audit and Risk Manager; Head
of Housing and Property Services; DLO Manager; Head of Education; Head of Human
Resources, ICT and Organisational Development; ICT Team Leader (Cyber Resilience
and Information Security); Business Continuity and Risk Management Officer and
Caroline O'Connor, Committee Services Officer, all Moray Council; and Angela Pieri
and Andrew Wallace, Grant Thornton - External Auditors.  
ALSO IN ATTENDANCE
Councillor Amber Dunbar 
1.         Chair 
The meeting was chaired by Councillor Scott Lawrence.  
2.         Declaration of Group Decisions and Members Interests * 
In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there
were no declarations from Group Leaders or Spokespersons in regard to any prior
decisions taken on how Members will vote on any item on the agenda or any
declarations of Member's interests in respect of any item on the agenda.  
With regard to Item 6 "Internal Audit Annual Report 2024-25", Councillor Gatt stated,
for transparency, that he is Convener of the Grampian Valuation Joint Board and
would be taking part in the debate.  
Item 4.
Page 7

Page 8

With regard to Item 6 "Internal Audit Annual Report 2024-25", Councillor Warren and
Councillor Macrae stated, for transparency that they were members of the Grampian
Valuation Joint Board and would be taking part in the debate.  
With regard to Item 6 "Internal Audit Annual Report 2024-25" and Item 7 "Internal
Audit Section Update Report", Mr Augustus stated, for transparency, that he was
carer representative on the Moray Integration Joint Board and would be taking part in
the debate.  
3.         Resolution 
The meeting resolved that in terms of Section 50A (4) and (5) of the Local Government
(Scotland) Act 1973, as amended, the public and media representatives be excluded
from the meeting for Item 13 of business on the grounds that it involves the likely
disclosure of exempt information of the class described in the relevant Paragraphs of
Part 1 of Schedule 7A of the Act.  
Para Number of
the Minute Para Number of Schedule 7a
13
Para 14
Information relating to any action taken in connection with the
prevention, investigation or prosecution of crime 
4.         Minute of meeting of 7 May 2025 
The minute of the meeting of 7 May 2025 was submitted and approved.  
5.         Written Questions ** 
The Committee noted that no written questions had been submitted.  
6.         Internal Audit Annual Report 2024-25 
The meeting had before it a report by the Audit and Risk Manager providing
Committee with a copy of the Internal Audit Annual Report for the year ended 31
March 2025, together with the Audit and Risk Manager's opinion on the adequacy and
effectiveness of the Council's systems of governance, risk management and internal
control arrangements.  
Mr Augustus expressed concern at the growing burdens being placed on Internal
Audit associated with work for the Moray Integration Joint Board (MIJB) and the
difficulties experienced in recruiting an Assistant Auditor referenced at paragraph
3.18 of Appendix 1 and asked how the service would cope with the apparent growth
items in the annual plan.  In response, the Audit and Risk Manager confirmed that
current resources were a concern in terms of the expanding portfolio of the service, in
addition to the continued need to undertake additional follow-up reviews to evidence
the implementation of the recommendations. There have also been more specific
concerns related to the annual opinion regarding systems and practices that were
reported to the  MIJB Audit, Performance and Risk Committee the previous week. 
Page 8

Page 9

The Chief Executive further advised that while recruitment was part of the approach,
it was also important to work with the management team to ensure audit
recommendations are implemented to reduce workload on the service in terms of
reduced follow-up audits, and work would be undertaken to ensure agreed
recommendations were deliverable in terms of the agreed response and timescale.  
In response to a question from Councillor Keith asking when it was anticipated the
improvements described by the Chief Executive would be evidenced by providing
increased capacity within the Internal Audit service, the Chief Executive confirmed
work would be undertaken with the management team over the coming months to
consider existing recommendations along with how to improve responses to future
audits.  
During discussion and in terms of the resource issues highlighted in the report by the
Audit and Risk Manager, Councillor Stuart asked if there was any steps the
Committee could take to seek more resources within the service to support the
improvement of the Council.  In response, the Chief Executive confirmed work would
be undertaken with the Head of Governance, Strategy and Performance and Audit
and Risk Manager as part of phase 2 of the restructure to consider the resources and
whether there was scope for increased capacity, noting it would require to be taken in
context of the Council's financial position.  The Audit and Risk Manager stated that, in
accordance with the Public Sector Internal Audit Standards, the head of internal audit
is responsible for ensuring that internal audit resources are appropriate and
sufficient. If the head of internal audit has concerns that resources will adversely
impact the provision of the annual internal audit opinion, it must be brought to the
attention of this Committee. The  Audit and Risk Manager expressed his concerns
again regarding the staffing resources of the internal audit service, which have also
been raised by the External Auditor and the Chief Internal Auditor of another local
authority during the external quality assessment of the Council’s internal audit
service.   
Following consideration the Committee unanimously agreed to note the contents of
the annual report given as Appendix 1.  
7.         Internal Audit Section Update Report 
The meeting had before it a report by the Audit and Risk Manager providing an update
on the work of the Internal Audit Section.  
With reference to Recommendation 5.6 of Appendix 3, Councillor Bloomfield noted
the initial implementation date for the agreed contractual agreement detailing service
delivery had been extended resulting in an 18 month delay and asked for confirmation
that the service had been operating during that time without a contract.  In response,
the Audit and Risk Manager confirmed the three daycare providers were moving
forward in terms of a memorandum of understanding however agreed there was a
need to move forward in terms of an agreed contractual relationship. 
In respect of the recommendations in the Self-Directed Support follow-up review
referenced in Appendix 3 and noting some revised implementation dates, Mr
Augustus stressed the importance of service users' views not only being taken in
account but evidenced by recording along with clear information provided to service
users on the contributions policy.  In response, the Chief Officer, Health and Social
Page 9

Page 10

Care Moray welcomed the support from Internal Audit in terms of improvement within
the partnership and, in order to provide assurance, confirmed significant work was
being undertaken around all Self-Directed Support options to deliver the
improvements detailed in the recommendations to close off the action.  
Following consideration the Committee unanimously agreed to note the contents of
the report.  
8.         Internal Audit Review - Building Services - Reactive Repairs 
The meeting had before it a report by the Audit and Risk Manager advising Committee
on an internal audit review completed for the period from 7 May 2025 to 24 June 2025.  
In introducing the report, the Audit and Risk Manager apologised for an error in
Recommendation 6 of Appendix 1 where the Audit Finding referenced monthly
charges for October and November 2025 however this should have read October and
November 2024.  
In relation to Recommendation 3 of Appendix 1, Councillor Warren asked whether the
Council was legally compliant given 119 properties are without the required Gas
Safety Certificate.  In response, the Audit and Risk Manager confirmed the safety
checks had been undertaken and the risk rating related to the administration process
where the required documentation had not been passed from Building Services to
Property Services in order to close off some conflicts where works were
requested.  He further advised whilst certificates are legislative requirements, there
was a means of evidencing the work undertaken.  In order to provide further
assurance, the DLO Manager confirmed the service had now moved from a paper
based system to an electronic system ensuring that PDF certificates are
automatically added to files.  
Following consideration the Committee unanimously agreed to endorse the
recommendations contained within the report.  
9.         Internal Audit Review - Keith Grammar School 
The meeting had before it a report by the Audit and Risk Manager advising Committee
on an internal audit review completed for the period from 7 May 2025 to 24 June 2025.  
In relation to Recommendation 5 of Appendix 1 relating to the use of the iPayimpact
system for collection and banking of income, Councillor Colyer asked why increased
use of the system had been delayed.  In response, the Audit and Risk Manager agreed
there was a need to progress and that the benefits of the system would become
evident to users moving forward.  The Head of Education further advised the school
had faced significant staffing challenges over the last year however provided
assurance that learning from the individual audits was being shared with other
schools and the service was ensuring the Business Support Team and Learning
Technologist would support schools who wished to make better use of the system. 
With reference to Recommendation 2 of Appendix 1 regarding the purchase of
supermarket vouchers from the Pupil Equity Fund (PEF), Councillor Warren
expressed concern that as the vouchers had not been issued, the PEF money was not
supporting those it was intended to support and asked what monitoring systems are
Page 10

Page 11

in place within the Council to track and follow up on PEF spend in schools.  In
response, the Head of Education advised it is the responsibility of the Quality
Improvement Manager (QIM) to oversee the Scottish Attainment Challenge funding
which includes PEF.  The QIM works closely with the Attainment Advisor, who in turn
works with individual schools on their Pupil Equity Funding Plans which detail how
the money will be spent along with the intended outcomes in terms of improving
attainment and, while schools provide regular updates, progress of the Plans are also
followed up by the QIM and the Attainment Advisor.  
Following consideration the Committee unanimously agreed to endorse the
recommendations contained within the report.  
10.         Internal Audit Review - Information Communications Technology
Hardware Assets 
The meeting had before it a report by the Audit and Risk Manager advising Committee
on an internal audit review completed for the period from 7 May 2025 to 24 June 2025.  
With reference to the Key Issues section of Appendix 1 where it was stated that the
Corporate Information Security Policy was last reviewed and updated in January
2009, Councillor Bloomfield asked for clarification why it had not been reviewed
since then and in relation to Recommendation 5 of the Appendix expressed concern
regarding there being not agreement with the 13 NHS Grampian employees within the
Moray Integration Joint Board to confirm their requirement to comply with council
policies.  In response to the question relating to review of the policy, the Head of
Human Resources, ICT and Organisational Development acknowledged the length of
time since last reviewed however advised the practice was in line with current
industry standards and confirmed the policy review was being progressed.  In
response to the question relating to compliance of the NHS Grampian employees,
the ICT Team Leader (Cyber Resilience and Information Security) confirmed all MIJB
staff are required to agree to the Computer Use Policy as part of the sign-in process
being a prompt displayed on a regular basis which has to be accepted in order to
continue using the device. 
During discussion and in order to provide further assurance, the Depute Chief
Executive (Education, Communities and Organisational Development) confirmed
cyber security training has been rolled out to all users to ensure staff are aware of the
points relating to information security and noted in terms of actions within the audit,
priority has been given to live operational issues to ensure they are addressed with
the policy issues below in terms of resource allocation.  
Councillor Gatt acknowledged the assurance from officers that industry policies and
standard are being adhered to however stressed the importance of being able to
evidence adherence to policies.  The Chief Executive confirmed work has
commenced with managers to consider a programme to review all Council policies,
how reviews should be prioritised and ensuring document control to evidence when
the policies have been reviewed and amended.   
With reference to the Council using 100 servers as referenced in the Introduction and
Audit Scope section of Appendix 1, Councillor Macrae was alarmed at the number of
servers, suggesting the number was far too great for the size of the Council and, in
terms of business recovery plans, questioned how it was possible to back these up
Page 11

Page 12

on a daily basis.  In response, the ICT Team Leader (Cyber Resilience and Information
Security) confirmed there are 100 physical servers with automated backups being
performed daily which are verified and replicated off site providing a separate copy
for recovery purposes.  
Councillor Stuart left the meeting during discussion of this item.  
Following consideration the Committee unanimously agreed to endorse the
recommendations contained within the report.  
11.         Audit and Scrutiny Committee - Self-Assessment and Evaluation
Exercises 
The meeting had before it a report by the Audit and Risk Manager advising Committee
on the outcome of a self-assessment of Compliance with the Good Practice
Principles Checklist and Evaluation of the Effectiveness Toolkit undertaken from the
Chartered Institute of Public Finance and Accountancy (CIPFA) Publication "Audit
Committees: Practical Guidance for Local Authorities and Police 2022 Edition".  
With reference to Item 6 of Appendix 1 regarding concerns discussed about the lack
of the scrutiny function of the Committee, Councillor Macrae asked when Councillors
will be entitled to scrutiny.  In response, the Chair confirmed some preliminary
discussions had taken place with officers to discuss themes of scrutiny papers to be
prepared for Committee, specifically for cross-cutting areas rather than areas within
the remit of a service Committee and it was planned to bring two scrutiny papers to
Committee within the next year.  The Head of Governance, Strategy and Performance
confirmed following on from the three scrutiny training sessions for Committee held
over the last two years and results from the feedback survey on the training, an
outcome was that members wanted regular training on scrutiny topics.  He advised
this would require a change to the Scheme of the Administration which would be
done by October with a view to changing the Standing Orders by the end of the
year.       
Following consideration the Committee unanimously agreed to endorse the
recommendations contained within the report.  
12.         Annual Governance Statement 
The meeting had before it a report providing Committee with a copy of the Council's
Annual Governance Statement for 2024/25 for review and approval.  
Following consideration the Committee unanimously agreed to note the draft Annual
Governance Statement provided as Appendix 1. 
13.         Internal Audit Follow Up Review - Cyber Security and E-Mail Security [Para
14] 
The meeting had before it a report by the Audit and Risk Manager providing an update
on a follow up review undertaken by the Internal Audit Section to evidence
implementation of audit recommendations.  
Councillor Stuart entered the meeting during discussion of this item.
Page 12

Page 13

Following consideration the Committee unanimously agreed to note the contents of
the report. 
Page 13

Page 14

Page 14

Page 15

Report to: Audit and Scrutiny
Committee 
Meeting Date: 10 September 2025     
Report by: Service Manager Internal
Audit and Risk 
Report No: GSP044/25/DL  
Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk 
Subject: Internal Audit Section Update Report 
1. PURPOSE 
☒ For Decision      ☐  For Information 
1.1 The purpose of this report is to provide an update on the work of the Internal    Audit Section . 
1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s
Scheme of Administration relating to consideration of reports from the Council’s Internal
Auditor and monitoring delivery of the audit service through receipt of quarterly reports on
work carried out by Internal Audit. 
2. SUMMARY  
2.1 Public Sector Internal Audit Standards requires the Service Manager Internal Audit and Risk
to prepare and present reports to Committee on internal audit’s activity, performance relative
to its Audit Plan and any other relevant matters.  
2.2 This report provides an update on audit activity and projects progressed since the last
meeting. 
3. RECOMMENDATIONS  
3.1 It is recommended that Committee:   
i) Considers and notes the contents of this report, seek clarification on any
points.   
Dafydd Lewis
Service Manager Internal Audit and Risk 
Item 6.
Page 15

Page 16

4. BACKGROUND AND CONTEXT
Internal Audit Plan Update
4.1 The Audit Plan is a means of determining the priorities of the internal audit activity and how
these align with the broader goals of the Council. Enclosed in Appendix 1 is an update on the
progress made by the Internal Audit Section in completing audit review projects in
accordance with the Annual Audit Plan.
4.2 The Public Sector Internal Audit Standards (PSIAS) requires the Service Manager for Internal
Audit and Risk to update this Committee on any concerns regarding the level of audit
staffing resources within the Internal Audit Section. In my Annual Report to this Committee
on 24 June 2025 (paragraph 6 of the minute refers), I highlighted concerns about whether
the current staffing levels within the Internal Audit Section are adequate to meet the future
auditing needs of the Council and its partner organisations. I am pleased to report the
successful appointment of a part-time temporary Auditor. This appointment should assist
in meeting the increasing demands on the Service; however, a period of training will be
required. The temporary post has been primarily funded from the remaining budget
following the Council’s decision to reduce the vacant Corporate Investigation Officer
position by 0.5 Full-Time Equivalent. The counter fraud responsibilities of that post will be
integrated into the duties of other officers within the Internal Audit Section. Despite an
overall reduction in staffing resources, this new appointment is expected to support a more
effective delivery of the Annual Audit Plan.
Follow Up Reviews
4.4 Internal Audit reports are regularly presented to members detailing not only findings but
also the responses by management to the recommendations with agreed dates of
implementation. Internal Audit will also undertake follow up reviews to evidence the
effective implementation of these recommendations. Please see detailed the following
completed follow up reviews:
Data Protection
4.5 A follow up review was undertaken to evidence the implementation of recommendations
from an audit that assessed the Council’s compliance with the Data Protection Act 2018.
The audit was originally reported to this Committee on 15 February 2023 (para 7 of minute
refers). It included several recommendations for reviewing and updating policies and
guidance, as well as introducing further scrutiny and controls over information
management arrangements.
4.6 A previous follow up review reported to this Committee on 8 May 2024 (para 5 of minute
refers), found that the majority of recommendations had not been implemented within the
agreed timescales. The Service advised that a multi-year timescale was required for
implementing some of these recommendations due to the lack of staff resources to meet
the ongoing volume of work and other information management compliance requirements,
which were significantly greater than initially envisaged. However, for two of these
recommendations concerning the need to update the Council’s Data Protection Policy and
Guidance and to review the guidance documents and forms within the Information
Management Section of the Interchange, the Service agreed to a revised completion date of
31 March 2025. Unfortunately, it was found at the time of this follow-up review that these
Page 16

Page 17

two recommendations are still to be completed, with the Service providing a revised
implementation date of 31 December 2025.
4.7 It is important that the Council maintains effective information governance and data
protection arrangements, as failures may result in breaches of individuals' personal data. I
do not propose undertaking another follow up review, but I will again include an audit of the
Council’s compliance with the Data Protection Act 2018 in a future Internal Audit Annual
Plan. However, it is recommended that the Service ensures progress continues in the
implementation of the outstanding recommendations detailed within the audit report.
Burials
4.8 A follow-up review has been undertaken to provide evidence of the implementation of
recommendations from an audit report on the Burial Service. The scope of this audit was to
review the systems and procedures involved in the administration of the Burial Service. This
included examining operational processes to ensure compliance with the Burial Grounds
Standards of Service. In addition, a check was made to verify the costs of delivering the
service, along with a review of the systems and procedures for income collection.
4.9 The follow-up review found that the majority of recommendations have been implemented;
however, there is a need to agree on a revised implementation date to review arrangements
for recording lair purchases and interments, with the aim of developing a singular recording
system. This has been due to the transfer of responsibility for administering burials from the
Registration Service to the Environmental Protection Service, as well as the requirement to
assess the implications of recent changes to Burial Regulations. The Follow-Up Report
reviewing the implementation of the agreed recommendations is provided in Appendix 2.
Emergency Planning
4.10 This follow-up review assessed the implementation of recommendations from an audit of
the Council's Emergency Planning arrangements. The Civil Contingencies Act 2004 places a
legal obligation on emergency services and local authorities to assess risks, plan for, and
conduct exercises related to emergencies such as floods, adverse weather, pandemics, or
other incidents that could significantly impact the community. Effective emergency
planning is an essential component of the Council’s overall governance arrangements,
ensuring the resilience of all key services in the event of a major incident. The follow-up
review found that the majority of recommendations have been implemented, although
some remain outstanding. The Follow-Up Report reviewing the implementation of the
agreed recommendations is provided in Appendix 3.
5. PROPOSALS
5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the
period from 24 June 2025 to 10 September 2025.
6. SUMMARY OF IMPLICATIONS
6.1 The table below shows whether risks and implications apply if the recommendations are
agreed:
Page 17

Page 18

SUBJECT YES NO
Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) ×
Policy and Legal ×
Financial ×
Risk ×
Staffing ×
Best Value and Transformation ×
Property ×
Information Communications Technology/Digital ×
Equalities. Social Inclusion and Economic Impact ×
Climate Change, Biodiversity and Sustainability ×
6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP))
Improved Collaborative Leadership, as part of continuous improvement through Best
Value, will better enable the Council to fulfil the ambitions set out in its strategic plans.
a) Links to Council Corporate Plan – The proposals in this report support and contribute to
improved outcomes for communities as outlined in the following Council Plan strategic
priorities:
☐ Tackle Poverty and Inequality.
☐ Build Stronger Greener Vibrant Economy.
☐ Build Thriving, resilient, empowered Communities.
b) Links to Local Outcomes Improvement Plan – The proposals in this report support and
contribute to improved outcomes for communities as outlined in the following local
Outcomes Improvement Plan priorities:
☐ Developing a diverse, inclusive, and sustainable economy
☐ Building a better future for our children and young people in Moray.
☐ Empowering and connecting communities.
☐ Improving wellbeing of our population
6.3 Policy and Legal
No implications directly arising from this report.
6.4 Financial
No implications directly arising from this report.
One off Costs:
Service
Area
Budget Budget
Years
Proposed
Spend this
Year
Virement
From
Other
Comments
Annually Recurring Costs:
Page 18

Page 19

Service
Area
Budget With
Effect
From
Annual
Net
Impact
Virement
From (if
applicable)
Other
Comments       
6.5 Risk 
The independent review of selected systems and procedures mitigates the risk associated
with inadequate or ineffective control procedures.  
6.6 Staffing 
No implications directly arising from this report.  
6.7 Best Value and Transformation 
Internal audit work supports good governance and the delivery of efficient services.  
6.8 Property 
No implications directly arising from this report.  
6.9 Information Communications/Technology/Digital 
No implications directly arising from this report.  
6.10 Equalities, Social Inclusion and Economic Impact 
No implications directly arising from this report.  
6.11 Climate Change and Biodiversity Impacts 
No implications directly arising from this report. 
7. CONSULTATION  
7.1 There have been no direct consultations during the preparation of this report. 
8. BACKGROUND PAPERS  
8.1 None   
Page 19

Page 20

APPENDIX 1 
Internal Audit Annual Work Programme- 2025/26 
Update Report 
CORE SYSTEM REVIEWS
Auditable Area Type of coverage Status/ Comments
Payroll Continuous auditing to confirm the adequacy of the
systems and procedures for paying salaries. The
intention is to make further use of an auditing
software application in the analysis of data and the
sample selected for testing.
Audit programmed to start in the
next quarter(s) 
Procurement and Creditor
Payments
Continuous auditing of samples of non-payroll
expenditure to test compliance with procurement
and payment processing regulations. The intention
is to make further use of an auditing software
application in the analysis of data and the sample
selected for testing. 
Fieldwork in progress
Democracy and Governance Review administrative arrangements established to
support effective democracy, governance and
committee reporting arrangements. The audit will
include reviewing policies and checking a sample of
meetings/papers/action logs to ensure adequate
and timely information is provided as required and
requested to aid informed decision making.
Fieldwork in progress 
Banking and Reconciliation To obtain assurance that adequate procedures are
in place, ensuring accurate, timely reconciliations
of income received and any differences are
addressed promptly. A review of the banking
arrangements will also be undertaken.
Completed
Final Report issued
Absence Management An audit will consider the effectiveness of sickness
absence monitoring and reporting. This will include
the arrangements from within the Council and the
Moray Integration Joint Board.    
Audit review and draft report
completed
SERVICE REVIEWS
Auditable Area Type of coverage Status/ Comments
National Non-Domestic Rates  To ensure that Business Rates billing and collection
arrangements are robust and that reliefs awarded
are adequately supported.
Audit review and draft report
completed
Moray Growth Deal Follow Up A follow up review to evidence implementation of
the recommendations agreed within the audit
undertaken in 2024/25 Audit Plan of the governance
and administrative arrangements within the
management of the Moray Growth Deal.
Audit programmed to start in the
next quarter(s) 
Levelling Up Fund  An overview of the governance and administrative
arrangements within the Council for the
management of the Levelling Up Fund. 
Fieldwork in progress
Capital Plan  Audit testing of contract management
arrangements for selected project(s) within the
capital plan.
Audit programmed to start in the
next quarter(s) 
Education – Secondary School Establishment visits as part of cyclical review.
Further to the consultation with the service,
additional testing will be undertaken in the use of
purchasing cards. 
Audit programmed to start in the
next quarter(s) 
Commercial Harbours A review of commercial harbours regarding the
accounting arrangements of income and
expenditure. The audit will review operating activity
against Council Policies and Procedures. 
Audit programmed to start in the
next quarter(s)
Management of School Funds Review the processes in the management and
control of School Funds. 
Audit programmed to start in the
next quarter(s)
Common Good Funds An audit of the accounting arrangements and
procedures in the management of Common Good
Funds.
Audit programmed to start in this
quarter
Adult Care Commissioning- Follow
up review KPMG review
Follow up review to evidence implementation of the
recommendations detailed within the KPMG Adult
Social Care Commissioning audit.
Audit programmed to start in the
next quarter(s)
Page 20

Page 21

Transportation- Education Review operating arrangements to ensure
compliance with the conditions of contracts and
compliance with Council Financial Regulations and
Procurement Guidelines in managing school
transport contracts. 
Audit programmed to start in the
next quarter(s)
MORAY INTEGRATION JOINT BOARD
Auditable Area Type of coverage Status/ Comments
Complex and Challenging Needs
Service 
Review of systems and procedures within Complex
and Challenging Needs Service in the management
of Woodview and Barlink Social Work
Establishments.
Completed
Final Report issued
Non-payroll expenditure A review of non-payroll expenditure to test
compliance with Financial Regulations,
procurement and payment processing regulations.
An auditing software application will be used in the
analysis of data and the sample selected for testing.   
(Further to discussions with the Chief Officer, it has
been agreed to change the planned audit regarding
support for carers to a review of non-payroll
expenditure. This is due to the Service's ongoing
implementation of a recent update to the Unpaid
Carers Strategy. A review of support for carers will
be considered for inclusion within a future Audit
Plan).
Audit programmed to start in the
next quarter(s)
Social Care Financial
Assessments/ Contributing to your
Care 
An audit to check the processes and accounting
arrangements in the charging of care to service
users. 
Audit programmed to start in the
next quarter(s)
GRAMPIAN VALUATION JOINT BOARD
Auditable Area Type of coverage Status/ Comments
Grampian Valuation Joint Board In accordance with the Public Sector Internal Audit
Standards applicable to local government and joint
boards, an annual review is required of Grampian
Valuation Joint Board activities. 
Completed
VERIFICATION ACTIVITY
Auditable Area Type of coverage Status/ Comments
Year End Stock Valuations Verification of Year End Stock Verification for
Building Services/ Environmental Services/
Community Services Stores.
Completed
Year end stock valuations agreed
Network Support Grant Ongoing certification requirements for the Network
Support Grant to Transport Scotland.
Ongoing
Half yearly audit certification
requirement. Last Network Support
Grant certified to 31/03/2025.
COUNTER FRAUD ACTIVITY
Auditable Area Type of coverage Status/ Comments
Counter Fraud Review  Annual review of the Council's counter fraud
framework to minimise the risk and impacts of fraud
from internal and external threats. The scope of the
audit and testing undertaken will be informed by
frauds reported within other organisations. 
Fieldwork in progress  
National Fraud Initiative The National Fraud Initiative (NFI) is a data-
matching project conducted by the Cabinet Office
on behalf of Audit Scotland every two years. It
involves a data-matching exercise using information
from various Council systems, as well as data
provided by other councils and organisations. 
Ongoing
The 2024/25 NFI exercise has begun,
and the agreed approach is for
services to review and document the
reasons for data matches, while the
Internal Audit Section investigates
potential fraud, monitors progress,
and reports on the outcome. 
Page 21

Page 22

FOLLOW-UP REVIEWS DUE TO EVIDENCE IMPLEMENTATION OF OUTSTANDING RECOMMENDATIONS FROM
PREVIOUSLY ISSUED AUDIT PROJECTS – 2025/26*
* Additional follow-up reviews may be added depending on the implementation dates for recommendations detailed by services
Audit Undertaken Scope of Audit Review
Self Directed Support (SDS) –
Option 2/3
The scope of the audit was to review systems and procedures in the delivery and management of
adult social care provided under Options 2 and 3 of the SDS scheme. This included examination of
the processes to support individuals in determining their preferred care delivery option, contractual
relationships with care providers, financial management and monitoring of individual care
packages.
Emergency Planning The objective of this audit was to provide assurance over the adequacy and effectiveness of
current controls over emergency planning. The audit scope included a check to ensure
adequate training, planning and testing has been developed in the event of an emergency.
Pool Cars Scheme The scope of this audit was to review systems and procedures in the management and use
of pool cars. Policies and procedures were checked to ensure they provide appropriate
operating guidance to officers in the booking and use of pool cars. The audit included a
review of arrangements for internal recharging to services and also exploration if further use
of pool cars could provide additional value for money opportunities to the Council.
Moray Integrated Community
Stores
The audit reviewed the management of the Moray Integrated Community Stores. This
included reviewing the procedures for ordering and issuing occupational therapy equipment
to service users. In addition, a check was made to compare stock records to the actual
equipment held within the Stores.
Keith Sports & Community Centre The audit scope reviewed the processes and procedures in place at the Keith Sports and Community
Centre and evaluate the effectiveness of internal controls relating to income and expenditure. This
involved the sample testing of individual transactions to ensure compliance with Regulations and
Guidelines. In addition, an appraisal of working practices was also undertaken to assess if the
Service was maximising the income due to the Council.
Special Investigation – St. Giles
Shopping Centre – Non-Domestic
Rates
The Interim Chief Executive requested an internal audit to review the collection arrangements of
non-domestic rates for the St Giles Shopping Centre, Elgin, over the last 2 years. This also required
an overview of the Council’s systems and procedures in the management of the billing and collection
arrangements for non-domestic rates.
Special Investigation – Windows
Replacement Programme
The audit scope was to check the contract for manufacturing replacement windows for properties
at Carnie Place. This involved discussions with officers, review of documentation, emails, and
minutes of meetings in the administration of this contract. The audit also undertook a physical
inspection with the support of an officer in Property Services to confirm the stock of windows stored
by Building Services.
Children's Services Care
Commissioning
The audit scope was to review and assess the commissioning of social care services for children.
Services delivered included contracts for preventative, support and restorative services, residential
care, and out of area residential placements required due to the limited provision of specialised care
and capacity within Moray.
Food Standards Scotland
Guidelines
The audit reviewed systems and procedures used by the Council's Environmental Health Service to
evidence compliance with the Food Law Code of Practice (Scotland) developed by Food Standards
Scotland.
Following the Public Pound The Internal Audit Plan provided for a “Following the Public Pound” review to ensure proper
accountability for public funds used in delivering services, irrespective of the means of service
delivery. Councils fund Arms Length External Organisations (ALEOs) to provide important services
to the public. These funding arrangements are often more complex than purchase contracts for
goods or services but can bring both financial and operational benefits to councils.
Procurement and Creditor
Payments
A review of payments made to suppliers of goods and services was undertaken. The purpose of the
audit was to confirm compliance with Financial, Authorisation, Procurement and Creditor Payment
Processing Regulations from the sample checked. The review formed part of the annual continuous
auditing activity of non-salary expenditure and is used to support the Service Manager Internal Audit
and Risk’s annual opinion of the Council’s internal control systems.
Commercial Refuse Collection The Internal Audit Plan provided for a review to be undertaken of the controls in the management of
the Commercial Refuse Collection Service. The audit checked to ensure robust accounting
arrangements are followed, and appropriate agreements are in place with customers.
Housing Rent Collection & Arrears
Management
The audit scope was to review the key operational controls regarding rent collection and arrears
management of current and former tenant rents. The aim of the audit was to look at the controls and
processes existing over the administration of rent accounts, accounting fully and promptly for
monies collected.
Keith Grammar School The scope of this audit was to review the operation of the Devolved School Management Scheme in
terms of funding allocation and management at the school level. Consideration was given to how
budgets are affected by National, Council and School priorities.
Banking and Reconciliation A review was undertaken to obtain assurance that an effective and systematic methodology is in
place to ensure accurate and timely reconciliations are undertaken of the Council's main bank
accounts for the receipt of income. This involved a review of the operating procedures, verification
and testing of the reconciliations undertaken and the administration of suspense transactions
where income has not been immediately identifiable on receipt.
Page 22

Page 23

APPENDIX 2
Moray Council
Internal Audit Section
DEPARTMENT: Economy, Environmental & Finance
SUBJECT: Burial Services
REPORT REF: 24'007
Follow Up Audit Review
Risk Ratings for Recommendations
High Key controls absent, not being
operated as designed or could be
improved. Urgent attention required.
Medium Less critically important controls
absent, not being operated as
designed or could be improved.
Low Lower level controls absent, not
being operated as designed or
could be improved.
No. Audit Recommendation Priority Accepted
(Yes/ No)
Date of
Completion
Status / Explanation
Key Control: Key costs of service provision are appropriately controlled and accounted for.
5.1 The Schedule of Rates should be
reviewed to ensure full and current
costs of service provision are reflected
and recharged to the Burials Service.
Medium Yes 31/03/2024 Implemented. A new full cost recovery model
has been introduced for the Burials Service,
effective from 2024/25. A new budget construct
within the Financial Management System has
been established to enable the full costs of
delivering the Burials Service to be directly
allocated to a single cost centre.
5.2 Consideration should be given to the
development of recharge rates for
interments within the Schedule of
Rates which reflect the varying costs
of service provision incurred by
weekday and weekend interments.
Low Yes 31/12/2023 Implemented. The new full cost recovery
model, referred to in section 5.1, means that all
operating costs are allocated directly to a single
cost centre for the Burials Service. This allows
for improved budget monitoring and cost
identification and facilitates accurate
accounting of labour costs for work undertaken
over the weekend.
5.3 Checks should be undertaken to
ensure all jobs carried out in the
month are identified for recharge in the
Confirm system and the Confirm
content is reflected accurately in the
recharge processed in the Financial
Management System.
Low Yes 30/09/2023 Implemented. The new costing model has
eliminated the need for monthly recharges of
interment and headstone work from Grounds
Maintenance Operations to the Burials Service,
as the cost of these activities is now charged
directly to the single cost centre for the Burials
Service.
Key Control: Processes are in place to control all income due to the service with fees formally approved and regularly reviewed and income amounts fully
and appropriately accounted for.
5.4 A review of current arrangements for
the recording of lair purchases and
interments should be undertaken with
the aim of developing a singular
recording system.
Medium Yes 31/03/2025
(Revised
Implementation
Date
31/12/2026)
Outstanding. The follow-up review found that
this recommendation had not been
implemented. However, the audit
acknowledges the need for a revised
implementation date, as significant service
delivery and legislative changes have occurred.
It was found that, as of 1 April 2025, the
administration function for burials has moved
from the Registration Service to the
Environmental Protection Service. This will
require a review of systems and practices that
were significantly paper based, with a view to
introducing improved administrative
arrangements. In addition, the implications of
the recent Burial Regulations, published by the
Scottish Government in February 2025, will
need to be considered to ensure that any
proposed singular recording system software
application meets future reporting and
management requirements. It was noted that an
update regarding these Regulations was
reported to the ED&I Committee on 29 April
2025 (item 12 of minute refers). The Service is
actively reviewing the changes needed to the
burials' administrative arrangements, with
Page 23

Page 24

Risk Ratings for Recommendations
High Key controls absent, not being
operated as designed or could be
improved. Urgent attention required.
Medium Less critically important controls
absent, not being operated as
designed or could be improved.
Low Lower level controls absent, not
being operated as designed or
could be improved.
No. Audit Recommendation Priority Accepted
(Yes/ No)
Date of
Completion
Status / Explanation
progress monitored through the Environmental
& Commercial Services Service Plan. Due to the
substantial changes in service delivery and new
legislative requirements, a revised
implementation date of 31 December 2026 has
been agreed. 
Page 24

Page 25

APPENDIX 3 
Moray Council
Internal Audit Section 
DEPARTMENT: Economy, Environmental & Finance  
SUBJECT: Emergency Planning  
REPORT REF: 23’021 
Follow Up Audit Review 
Risk Ratings for Recommendations
High Key controls absent, not being
operated as designed or could be
improved. Urgent attention required.
Medium Less critically important controls
absent, not being operated as
designed or could be improved.
Low Lower level controls absent, not
being operated as designed or
could be improved.
No. Audit Recommendation Priority Accepted
(Yes/ No)
Date of
Completion
Status / Explanation
5.1 The Emergency Planning Policy and
Procedures should be updated to
reflect current operating
arrangements and staffing structures.
Medium Yes 31/05/2023
(Revised
Implementation
Date
30/11/2025)
Part Implemented –    An updated Emergency
Planning Policy & Procedures has been
prepared in draft, which is now referenced as a
General Emergency Plan. The Plan needs to be
reviewed by the Corporate Leadership Team
before seeking approval from Committee. A
revised implementation date of 30/11/2025 has
been agreed. 
5.2 Regular meetings should be held
between the Emergency Planning
Officer and the Business Continuity
and Risk Management Officer to
ensure ongoing alignment of
emergency and business continuity
plans.
Medium   Yes Implemented Implemented– The follow up review has
confirmed that regular meetings are held
between the Emergency Planning Officer and
the Business Continuity and Risk Management
Officer. 
5.3 Emergency plans should be updated
to reflect current risks, working
practices and staffing structures of the
Council and partner organisations. 
After updating the emergency plans,
testing should be undertaken to
evidence their effectiveness and
highlight any areas for further
improvement. 
Medium 
Medium
Yes 
Yes
31/12/2024
(Revised
Implementation
Date
30/09/2025) 
Implemented 
Part Implemented –  A review of emergency
plans for services noted that all have been
updated, except the Health and Social Care
Moray - Care for People Plan. This plan still
requires further review by senior management
before it is finalised.  The Service has provided a
revised implementation date of 30/09/2025. 
It was noted that the Emergency Planning
Officer is undertaking ongoing testing to
evaluate the effectiveness of the emergency
plans and identify areas where further
improvements are required. 
5.4 Further training and documented
guidance should be provided to 
Moray Emergency Response Co-
Ordinators (MERC) to support officers
in best practices to follow in the event
of an emergency incident. 
Medium Yes 31/12/2023 Implemented–  It was noted that further training
has been provided to Moray Emergency
Response Co-Ordinators (MERC) by the
Emergency Planning Officer. In addition,
guidance has been developed for officers to
assist in the event of an emergency and is
available to officers through the MERC Portal
within SharePoint. 
5.5 Emergency contact details of the
Moray Emergency Response Co-
Ordinators (MERC) saved within
Sharepoint should be restricted to
only officers that require access to this
information. 
Medium Yes 31/07/2023 Implemented- Access privileges to the
emergency contact details of Moray Emergency
Response Co-Ordinators  (MERC) held within
SharePoint are now restricted to only authorised
officers. 
5.6 An Annual Report should be provided
to elected members detailing the work
undertaken and planned within
emergency planning. 
Medium Yes 31/03/2024
(Revised
Implementation
Date
30/11/2025) 
Outstanding –  Discussions with officers noted
that an annual report detailing the work
undertaken and planned within the Emergency
Planning Service is intended and will thereafter
be reported to committee. The Service has
provided a revised implementation date of
30/11/2025. 
Page 25

Page 26

Risk Ratings for Recommendations
High Key controls absent, not being
operated as designed or could be
improved. Urgent attention required.
Medium Less critically important controls
absent, not being operated as
designed or could be improved.
Low Lower level controls absent, not
being operated as designed or
could be improved.
No. Audit Recommendation Priority Accepted
(Yes/ No)
Date of
Completion
Status / Explanation
5.7 A review of the hyperlinks contained
within emergency planning webpages
should be undertaken to ensure they
connect to the intended document or
website. 
Medium Yes 31/08/2023  Implemented – The Emergency Planning
Service webpage within the Moray Council
website has been updated and also includes the
correct web links to partner agency websites
and key documents. 
Page 26

Page 27

Report to: Audit and Scrutiny
Committee
Meeting Date: 10 September 2025     
Report by: Service Manager
Internal Audit and Risk 
Report No: GSP045/25/DL  
Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk 
Subject:  Internal Audit Review –  Banking and Reconciliation 
1. PURPOSE 
☒ For Decision      ☐  For Information 
1.1 The report advises Committee on an internal audit review completed for the               period from
24 June 2025 to 10 September 2025. 
1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the  Council’s
Scheme of Administration relating to consideration of reports from the Council’s Internal
Auditor and monitoring delivery of the audit service through receipt of quarterly reports on
work carried out by Internal Audit. 
2. SUMMARY  
2.1 This report provides details of the internal audit review of Banking and Reconciliation; this
project has been agreed for review within the Internal Audit Plan for 2025/26. 
3. RECOMMENDATIONS  
3.1 It is recommended that Committee considers the contents of this report, seeks
clarification on any points noted, and endorses the recommendations contained
within the report.   
Dafydd Lewis
Service Manager Internal Audit and Risk 
4. BACKGROUND AND CONTEXT  
4.1 An audit has been undertaken into the Council’s banking and reconciliation arrangements.
Each year, the Council receives significant funds through its bank accounts. The Council
operates three main bank accounts to manage incoming funds, all of which were reviewed
as part of this audit. The audit objective was to ensure that effective and systematic
processes are in place for the timely and accurate reconciliation of these accounts. This
Item 7.
Page 27

Page 28

involved a review of operating procedures, verification and testing of completed
reconciliations and an assessment of how suspense transactions are administered when
income cannot be immediately identified. Overall, the audit found that the Council has
effective banking and reconciliation arrangements in place. However, some administrative
improvements were identified. The findings and recommendations are detailed in the
audit report in Appendix 1.
5. PROPOSALS
5.1 This report provides Committee with a summary of findings arising from an audit project
completed during the review period.
6. SUMMARY OF IMPLICATIONS
6.1 The table below shows whether risks and implications apply if the recommendations are
agreed:
SUBJECT YES NO
Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) ×
Policy and Legal ×
Financial ×
Risk ×
Staffing ×
Best Value and Transformation ×
Property ×
Information Communications Technology/Digital ×
Equalities. Social Inclusion and Economic Impact ×
Climate Change, Biodiversity and Sustainability ×
6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP))
Improved Collaborative Leadership, as part of continuous improvement through Best
Value, will better enable the Council to fulfil the ambitions set out in its strategic plans.
a) Links to Council Corporate Plan – The proposals in this report support and contribute
to improved outcomes for communities as outlined in the following Council Plan
strategic priorities:
☐ Tackle Poverty and Inequality.
☐ Build Stronger Greener Vibrant Economy.
☐ Build Thriving, resilient, empowered Communities.
b) Links to Local Outcomes Improvement Plan – The proposals in this report support
and contribute to improved outcomes for communities as outlined in the following
local Outcomes Improvement Plan priorities:
☐ Developing a diverse, inclusive, and sustainable economy
☐ Building a better future for our children and young people in Moray.
☐ Empowering and connecting communities.
☐ Improving wellbeing of our population
6.3 Policy and Legal
No implications directly arising from this report.
Page 28

Page 29

6.4 Financial 
No implications directly arising from this report.
One off Costs:
Service
Area
Budget Budget
Years
Proposed
Spend this
Year
Virement
From
Other
Comments
Annually Recurring Costs:
Service
Area
Budget With
Effect
From
Annual
Net
Impact
Virement
From (if
applicable)
Other
Comments
6.5 Risk
The independent review of selected systems and procedures mitigates  the risks
associated with inadequate or ineffective control procedures.
6.6 Staffing
No implications directly arising from this report.
6.7 Best Value and Transformation
Internal audit work supports good governance and the delivery of efficient services.
6.8 Property
No implications directly arising from this report.
6.9 Information Communications/Technology/Digital
No implications directly arising from this report.
6.10 Equalities, Social Inclusion and Economic Impact
No implications directly arising from this report.
6.11 Climate Change and Biodiversity Impacts
No implications directly arising from this report.
7. CONSULTATION
7.1 There have been no direct consultations during the preparation of this  report.
8. BACKGROUND PAPERS
8.1 None
Page 29

Page 30

APPENDIX 1
1
Final Internal Audit Report
Banking and Reconciliation 
July 2025 
Distribution: Head of Financial Services
Finance Manager
Assistant Manager – FMS & Banking
The Internal Audit Section provides Management with an opinion on the internal control environment
and also categories risk ratings for recommendations as high, medium or low (detailed explanation
provided in Appendix1). The audit recommendations for this review have been classified as follows
Assurance Level Risk Ratings for
Recommendations
Full
Priority 1 0
Priority 2 0
Priority 3 2
Confidentiality and Disclosure Clause
This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only
those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information
provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings
on the information and documentation provided and consequently, no complete guarantee can be given that this Report is
necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required.
This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian
Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party
who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation,
amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract,
reinterpretation, amendment and/or modification by any third party is entirely at their own risk.
Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities,
limitations and confidentiality.
Page 30

Page 31

2
Contents
Page
Banking and Reconciliation 
1. Introduction & Scope 3
2. Key Issues 3-4
Detailed Report
3. Findings/Recommendations 5-8
4. Management Response 6-9
Appendices
1. Audit Terms of Reference and Definitions
2. Statement of Responsibility
Page 31

Page 32

3
1. Introduction and Audit Scope
The 2025/2026 annual audit plan provides for a review to be undertaken of the
Council's banking and reconciliation arrangements. Bank reconciliation is the
process of matching the balances in an organisation's accounting records to the
corresponding information on a bank statement. The aim of a bank reconciliation
process is to ascertain the differences between the two and make appropriate
adjustments to the accounting records to ensure accurate reflection of
transactions and balances.
The audit scope was to obtain assurance that an effective and systematic
methodology is in place to ensure accurate and timely reconciliations are
undertaken of the Council's main bank accounts for the receipt of income. This
involved a review of the operating procedures, verification and testing of the
reconciliations undertaken and the administration of suspense transactions where
income has not been immediately identifiable on receipt. The audit has also
involved undertaking a review of the Council's banking arrangements.
The Council operates three main bank accounts for administering income
received and these have been reviewed during the course of the audit. Focus has
also been given to the processes for Funds In Transit collections to ensure that
all monies received are identified and remain accounted for at all stages between
collection and lodgement into the Council's bank accounts. The Council collects
a significant and diverse range of income categories, such as Council Tax and
Non-Domestic Rates, Housing Rents, Planning Fees, charges for Waste
Services, and also encompasses funding of the Council through grant receipts
and revenue support.  
The audit has involved interrogation of the Council's Financial Management
System used for accounting and bank reconciliation purposes and the Capita
Income Management System used to provide logs and breakdowns of income
received by services. 
The audit was carried out in accordance with Public Sector Internal Audit
Standards (PSIAS).
2. Key Issues
• The audit confirmed that monthly bank reconciliation exercises are
undertaken for all Council bank accounts. However, it was noted that the
certification by management of these monthly reconciliations is not
retained beyond 28 days within the SharePoint Workflow System. The
certification by management of the monthly bank reconciliation
exercises should be retained to ensure evidence of an audit trail is
Page 32

Page 33

4
maintained of the scrutiny for a core financial control.
• Overall, the audit found that within the scope of the review, effective
banking and reconciliation arrangements were in place for all income
received. It should be noted that significant funds are collected annually
through the Council's bank accounts, e.g., in 2024/25, approximately
£225 million in Government funding, £196 million in services fees and
charges and £51 million in Council Tax. However, at the time of the audit,
18 entries, totalling £40,900 of income, were found to have remained
unallocated to accounting codes within the Financial Management
System for over one month, the oldest transaction being 2 months old.
To ensure accounting records are accurate and reflect current
transactions, income received should be allocated to the appropriate
financial code at the earliest opportunity.
Page 33

Page 34

5
Findings/Recommendations - Banking and Reconciliation 2025/26
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
1 Low When income is received, a unique reference is
required to identify the source and post it to the
correct customer account, and/or accounting
code within the Financial Management
System's general ledger. However, instances
occur where income received into the Council's
bank accounts either does not have any source
reference, the reference quoted is invalid, or the
income represents a miscellaneous receipt,
such as a payment received that is not
associated with a particular invoice. In these
circumstances, an unreconciled item is created
within the bank reconciliation process, as the
amount will be reflected in the Council's bank
account as received but cannot be
correspondingly recorded within the Council's
financial accounts until a manual identification
is made, which allows posting to the correct
customer account and / or accounting code.
Additionally, identifying breakdowns should be
provided by services for Funds In Transit which
are accounted for at point of collection, before
lodgement into the Council's bank account. The
Unallocated income must be identified in a
timely manner to allow accurate financial
recording within the Council's general
ledger. Services should be reminded of
the need to provide income detail on a
prompt basis. Any receipts not able to be
identified within a reasonable timescale
should be returned to the bank to progress
to a conclusion. 
Page 34

Page 35

6
non-provision of this information also  creates
an unreconciled item which cannot be recorded
within the Council's financial accounts.  
Overall, from the audit testing undertaken of the
bank account reconciliation processes, effective
management arrangements were found, where
significant funds are identified and reviewed
promptly to ensure that monies received are
accounted for and allocated correctly to the
appropriate accounting code within FMS.
However, at the time of the audit, 18 entries,
totalling £40,900 of income, were found to have
remained unallocated within the FMS for over
one month, the oldest transaction being 2
months old. For accurate and timely recording
of income in the Council's accounting records, it
is important that the source of the monies
received is identified at the earliest opportunity.
Management Response
Responsible Officer Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Assistant Manager – FMS
& Banking
Yes 31/08/2025 All income will be allocated within 1 month
of receipt which will allow ample time for
identification. Any income remaining
Page 35

Page 36

7
unidentified after 1 month will be returned
to the originating source by the Council's
Bank.  
Page 36

Page 37

8 
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
2 Low The Council operates three main bank accounts
for the administration of income received and
these have been reviewed as part of this audit.
On a daily basis, reconciling tasks are being
undertaken by the Banking Team within the
bank reconciliation module of FMS to ensure
funds received are appropriately allocated and
accounted for. Every month, a full formal
reconciliation of each bank account is
undertaken and is checked and approved by the
Assistant Manager - FMS & Banking, within the
SharePoint Workflow system. Audit testing
noted that the evidence of authorisation within
the SharePoint Workflow system is deleted after
28 days. An improvement to the process is
required to ensure that evidence of all bank
reconciliation checking and approval by service
management is retained for reference
purposes. 
Monthly bank account reconciliations
should be signed and dated to retain
evidence of the checks and approval
undertaken by management of a core
financial control.   
Page 37

Page 38

9 
Management Response
Responsible Officer Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Assistant Manager – FMS
& Banking
Yes 31/08/2025 All bank reconciliations will continue to go
through the SharePoint Workflow system.
In addition, the approving manager will add
their signature and date to the file to
preserve the evidence of authorisation
when the file moves to the SharePoint
records site. 
Page 38

Page 39

10 
Appendix 1 
AUDIT TERMS OF REFERENCE AND DEFINITIONS 
1. Audit Objectives 
1.1 The overall audit objective is to provide an objective independent opinion on
the adequacy and effectiveness of controls / processes.  
1.2 The audit will for each controls / process being considered: 
• Walkthrough the processes to consider the key controls; 
• Conduct sample testing of the identified key controls, and 
• Report on these accordingly 
1.3 All audit reviews are carried out in accordance with Public Sector Internal
Audit Standards (PSIAS). 
2. Definitions for Auditing Opinions and Findings 
2.1 In order to assist management in using our reports: 
The Internal Auditor will categorise audit assurance opinion according to
their overall assessment of the risk management system, effectiveness of the
controls in place and the level of compliance with these controls and the action
being taken to remedy significant findings or weaknesses. 
Assurance
Level
System and Testing Conclusion
Full The controls tested are being consistently applied
Substantial There is evidence that the level of non compliance with some of the
controls may put some of the system objectives at risk.
Limited The level of non compliance puts the system objectives at risk.
None Significant non-compliance with basic controls leaves the system
open to error or abuse. 
2.2 Risk ratings for each recommendation is based on the following criteria: 
High Fundamental control weaknesses that require immediate attention by
management to action and mitigate significant exposure to risk
Medium Less critically important controls absent, not being operated as
designed or could be improved
Low Lower level controls absent, not being operated as designed or could
be improved.
Page 39

Page 40

11 
Appendix 2 
STATEMENT OF RESPONSIBILITY   
The responsibility for designing and maintaining a sound system of internal control to
prevent and detect fraud and other irregularities rests with management, with internal
audit providing a service to management to support them to achieve this objective.
The Internal Audit Section will assess the adequacy and effectiveness of the system
of internal control arrangements implemented by management and perform sample
testing on those controls in the period under review with a view to providing an opinion
on the extent to which risks in this area are managed. 
The Internal Audit Section will undertake testing with the objective of detecting
significant control weaknesses. However, the audit approach alone should not be
relied upon to identify all strengths and weaknesses in internal controls nor to find any
fraud or irregularity. Even sound systems of internal control can only provide
reasonable and not absolute assurance and may not be proof against collusive fraud. 
The matters raised in this report are only those that came to our attention during the
course of the audit review and are not necessarily a comprehensive statement of all
the weaknesses that exist or all improvements that might be made. Recommendations
for improvements should be assessed by management for their full impact before they
are implemented. The performance of the audit review undertaken should not be taken
as a substitute for management’s responsibilities for the application of sound
management practices. 
This report must not be disclosed to any third party or reproduced in whole or in part
without the written consent of the Moray Council’s Audit and Risk Manager. 
Page 40

Page 41

Report to: Audit and Scrutiny
Committee
Meeting Date: 10 September 2025     
Report by: Service Manager
Internal Audit and Risk 
Report No: GSP046/25/DL  
Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk 
Subject:  Internal Audit Review – Residential Care 
1. PURPOSE 
☒ For Decision      ☐  For Information 
1.1 The report advises Committee on an internal audit review completed for the               period from
24 June 2025 to 10 September 2025. 
1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the  Council’s
Scheme of Administration relating to consideration of reports from the Council’s Internal
Auditor and monitoring delivery of the audit service through receipt of quarterly reports on
work carried out by Internal Audit. 
2. SUMMARY  
2.1 This report provides details of the internal audit review of Residential Care; this project
has been agreed for review within the Internal Audit Plan for 2024/ 25. 
3. RECOMMENDATIONS  
3.1 It is recommended that Committee considers the contents of this report, seeks
clarification on any points noted, and endorses the recommendations contained
within the report.   
Dafydd Lewis
Service Manager Internal Audit and Risk 
4. BACKGROUND AND CONTEXT  
4.1 An audit review of residential care was undertaken. The scope of the audit was to examine
the processes for making accurate payments at agreed contract rates to third-party
providers for the delivery of permanent residential care for older persons. Testing included
Item 8.
Page 41

Page 42

verifying that all residents entering a residential care home following a care needs
assessment had been financially assessed in accordance with Scottish Government
Guidance. A check was also carried out to verify the accuracy of the calculation of
assessed contributions toward care costs, as well as the administrative arrangements for
processing and paying third-party care providers.
4.2 The audit found that processes and information storage systems within the Community
Care Finance Service to administer payments to residential care homes are significantly
paper-based. The Service should explore opportunities to digitise its current operating
arrangements, which could lead to improved efficiency and stronger administrative
controls. The audit also identified significant delays in both requesting the necessary
financial assessment information and processing it once received from individuals who
have entered a care home. These delays affect cash flow and accounting processes, as
payments already made need to be recovered from future payments to care homes.
The findings and recommendations are detailed in the audit report in Appendix 1.
5. PROPOSALS
5.1 This report provides Committee with a summary of findings arising from an audit project
completed during the review period.
6. SUMMARY OF IMPLICATIONS
6.1 The table below shows whether risks and implications apply if the recommendations are
agreed:
SUBJECT YES NO
Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) ×
Policy and Legal ×
Financial ×
Risk ×
Staffing ×
Best Value and Transformation ×
Property ×
Information Communications Technology/Digital ×
Equalities. Social Inclusion and Economic Impact ×
Climate Change, Biodiversity and Sustainability ×
6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP))
Improved Collaborative Leadership, as part of continuous improvement through Best
Value, will better enable the Council to fulfil the ambitions set out in its strategic plans.
a) Links to Council Corporate Plan – The proposals in this report support and contribute
to improved outcomes for communities as outlined in the following Council Plan
strategic priorities:
☐ Tackle Poverty and Inequality.
☐ Build Stronger Greener Vibrant Economy.
☐ Build Thriving, resilient, empowered Communities.
Page 42

Page 43

b) Links to Local Outcomes Improvement Plan – The proposals in this report support
and contribute to improved outcomes for communities as outlined in the following
local Outcomes Improvement Plan priorities:
☐ Developing a diverse, inclusive, and sustainable economy
☐ Building a better future for our children and young people in   Moray.
☐ Empowering and connecting communities.
☐ Improving wellbeing of our population   
6.3 Policy and Legal  
No implications directly arising from this report.  
6.4 Financial  
No implications directly arising from this report. 
One off Costs:
Service
Area
Budget Budget
Years
Proposed
Spend this
Year
Virement
From
Other
Comments       
Annually Recurring Costs:
Service
Area
Budget With
Effect
From
Annual
Net
Impact
Virement
From (if
applicable)
Other
Comments       
6.5 Risk 
The independent review of selected systems and procedures mitigates  the risks
associated with inadequate or ineffective control procedures.  
6.6 Staffing 
No implications directly arising from this report.  
6.7 Best Value and Transformation 
Internal audit work supports good governance and the delivery of efficient services.  
6.8 Property 
No implications directly arising from this report.  
6.9 Information Communications/Technology/Digital 
No implications directly arising from this report.  
6.10 Equalities, Social Inclusion and Economic Impact 
No implications directly arising from this report.  
6.11 Climate Change and Biodiversity Impacts 
No implications directly arising from this report. 
Page 43

Page 44

7. CONSULTATION  
7.1 There have been no direct consultations during the preparation of this  report. 
8. BACKGROUND PAPERS  
8.1 None   
Page 44

Page 45

APPENDIX 1
1
Final Internal Audit Report
Residential Care 
August 2025 
Distribution: Chief Financial Officer (Moray IJB & Dr Grays)
Head of Service
Interim Finance Manager
The Internal Audit Section provides Management with an opinion on the internal control environment
and also categories risk ratings for recommendations as high, medium or low (detailed explanation
provided in Appendix1). The audit recommendations for this review have been classified as follows
Assurance Level Risk Ratings for
Recommendations
Substantial
Priority 1 0
Priority 2 4
Priority 3 3
Confidentiality and Disclosure Clause
This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only
those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information
provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings
on the information and documentation provided and consequently, no complete guarantee can be given that this Report is
necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required.
This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian
Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party
who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation,
amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract,
reinterpretation, amendment and/or modification by any third party is entirely at their own risk.
Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities,
limitations and confidentiality.
Page 45

Page 46

2
Contents
Page
Residential Care 
1. Introduction & Scope 3-4
2. Key Issues 4
Detailed Report
3. Findings/Recommendations 5-18
4. Management Response 6-19
Appendices
1. Audit Terms of Reference and Definitions
2. Statement of Responsibility
Page 46

Page 47

3
1. Introduction and Audit Scope
The 2024/25 annual audit plan includes a review of the procedures and
administrative arrangements involving third-party suppliers appointed to provide
residential care home services. Last year's gross expenditure budget for
permanent residential care for older persons was £12.6 million. Monitoring actual
expenditure against this budget is undertaken and reported regularly to the Moray
Integration Joint Board. At the time of this audit review, an overspend of £1.8
million was noted for 2024/25. The Service has indicated this is due to an
increased number of individuals requiring nursing care, which is charged at a
higher rate than residential care.
A care needs assessment from Health and Social Care Services is required
before an individual enters a care home. This assessment determines the type
and level of care an individual requires, ensuring the home can provide the
necessary support. A financial assessment is then undertaken to evaluate an
individual's income, savings and capital to determine how much they can afford
to contribute towards their care. The review noted that at the time of the audit,
there were 470 supported individuals in permanent residential care. However,
these numbers can vary throughout the year. Funding arrangements are in place
with 52 individual care home, 14 of which are located within Moray and provide
care to 91% of all residents.  
The National Care Home Contract (NCHC) sets the standard rates for residential
and nursing care payable for publicly funded placements in Scotland. For
2024/2025, the standard rate for residential care is £825.94 per week. The
standard rate for nursing care is £957.57 per week, which includes the additional
costs associated with nursing services, ensuring that residents receive the
necessary medical care and support. The amount payable by an individual
entering a care home is determined through a financial assessment and a means-
tested calculation, which will result in a contribution towards the cost of their care.
However, if an individual has capital exceeding £35,000, they are considered a
self-funding resident. In such cases, the contract for their care is arranged directly
between the individual and the care home.  
The audit scope was to review the processes for making accurate payments to
third-party providers for permanent residential care delivery at agreed contract
rates. The audit also involved testing to ensure that all eligible residents are
financially assessed in accordance with the Charging for Residential
Accommodation Guidance (CRAG) issued by Scottish Government and that
assessed contributions towards care costs are appropriately applied.   
The audit focused on permanent residential care for older persons in the care
sector. An audit of social care financial assessments for other care sector groups,
non-residential services and temporary residential care has been included as a
separate audit project within the 2025/26 Internal Audit Plan.   
Page 47

Page 48

4
The audit was carried out in accordance with Public Sector Internal Audit
Standards (PSIAS).
2. Key Issues
• The audit found that the systems used by the Community Care Finance
Service to administer the residential care home service are significantly
paper-based. Concerns were noted during the review regarding the
storage arrangements of resident files, which were further exacerbated
by home working arrangements. Consideration should be given to
exploring opportunities for digitising processes to improve administrative
efficiency and data protection management.
• A care needs assessment is required before an individual enters a care
home. When a care home is considered the most appropriate care
option, a financial assessment is then required to determine how much
the individual should contribute towards the cost of their care. Audit
testing identified  significant delays both in requesting the necessary
financial assessment information from individuals and in processing the
information once received. However, no concerns were noted regarding
the accuracy of the financial assessments undertaken.
• When a new resident enters a care home, standard residential or nursing
care rates are paid for publicly funded placements. These rates apply
until the resident's income, savings and capital are assessed to
determine their financial contribution towards the cost of their care.
However, it was noted that there is no early identification of individuals
who may be "self-funders", A self-funder is someone who pays the full
cost of their care, as they declare that their income, savings or assets
typically exceed the financial threshold and a financial assessment is not
required to be undertaken by Community Care Finance. In such cases,
the amounts overpaid are recovered from the care homes. Early
identification of self-funders would eliminate this requirement  and
improve cash flow and the financial accounting processes.
Page 48

Page 49

5
Findings/Recommendations - Residential Care 2024/25
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
1 Low Contributions required from individuals towards
the cost of their residential care are based on
the Charging for Residential Accommodation
Guidance (CRAG), issued annually by the
Scottish Government. This guidance ensures a
nationally consistent approach to the charging
criteria for residents in residential care homes.
However, the audit review found that the
information regarding the financial process for
contributing to the cost of residential care, as
detailed on the Council's website, is dated 2011
and is not the most current version of
information available within the Service. It is
understood that Service is developing guidance
content which will need to be reflected on both
the Moray Council and Health and Social Care
Moray websites.   
Information made available online about
residential care and contribution
implications should be reviewed and
updated to ensure clear guidance is
available to members of the public. 
Page 49

Page 50

6 
Management Response
Responsible Officer Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Interim Finance Manager Yes 30/09/2025 Moray Council and Health and Social Care
Moray websites will be updated to reflect
CRAG content on an annual basis. 
Page 50

Page 51

7 
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
2 Medium A standardised financial assessment form is
used to record the information required under
Charging for Residential Accommodation
Guidance (CRAG) to calculate the contribution
a resident must make toward the cost of their
residential care. At the time of the audit, the
Service was in the process of revising this form.
It was noted that the current financial
assessment form, along with the supporting
information provided in communications with
the resident or their representative, is not
digitised. The process remains manually
intensive in terms of information handling. A
modernised approach to engagement is
required, offering the potential for administrative
savings and improved ease of use for
stakeholders.     
Consideration should be taken to
modernise and improve the financial
assessment process by digitising the
request and submission of assessment
information.   
Page 51

Page 52

8 
Management Response
Responsible Officer Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Interim Finance Manager Yes 31/03/2027 The current Financial Assessment Form
has been reviewed and updated to
facilitate the easier capture and processing
of information. However, the digitisation of
the process is linked to the implementation
of the replacement of the CareFirst
system. 
Page 52

Page 53

9 
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
3 Medium As noted in Finding 2, financial assessments
and their associated supporting information are
not currently available in electronic format. As
part of the audit review, access to residents'
files was required to test and verify the accuracy
of the financial assessments undertaken.
However, it was found that there is no organised
filing system for identifying the records held and
their locations. There is also no dedicated or
organised filing space specifically for
Community Care Finance. Instead, files are
stored securely in a room alongside other social
work files in boxes but not in alphabetical order.
Files actively being worked on by officers may
be located in the Community Care Finance
office or at officer's homes due to homeworking
practices. However, there is no log maintained
of files removed by staff. All files requested for
audit sampling were located, either in the
storage room, Community Care Finance office,
or at officers' homes and were made available
to Internal Audit over a period of time. The lack
of a system for documenting records
held/extracted is not conducive to easy access
A filing system should be implemented to
ensure that all financial assessments and
related records are secure, easily
identifiable, and can be located at all
times. As detailed in Recommendation 2,
further exploration into the digitisation of
the information held should be
undertaken. Additionally, due to
homeworking arrangements and the
storage of files at officers homes, a record
log detailing the location of these files
should also be maintained. All officers
should also be reminded of the importance
of good data protection arrangements in
the storage of information within their own
homes.     
Page 53

Page 54

10 
or the proper control of supported person's
records.    
Management Response
Responsible Officer Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Interim Finance Manager Yes 31/08/2025 An online filing system is to be
implemented to eliminate need for manual
storage and handling. The Mailroom
Service has agreed to scan all backlog
records and a new process is in place for
scanning new files. 
Page 54

Page 55

11 
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
4 Medium A care needs assessment is required before an
individual enters a care home. This assessment
is usually undertaken by a community care
officer or social worker to determine the level of
care and support needed. If a care home is
considered the most appropriate care option, a
financial assessment is then required to
determine how much an individual should
contribute towards the cost of their care. This
assessment considers income, savings and
capital to decide whether and how much
financial assistance can be provided. The
National Care Home Contract (NCHC) standard
or nursing rate is paid gross to the care home
for a resident until the financial contribution has
been determined. Any subsequent
overpayment, calculated from the financial
assessment, is recovered from future payments
made to the care home. 
The audit undertook a review of the financial
assessment process for individuals entering a
care home. From a random sample of 20 cases,
8 were identified where there were delays by the
Community Care Finance Service, taking
The operational demands within the
Community Care Finance Service are
appreciated. However, as already detailed
within this report, the implementation of
greater digitisation of processes and
storage of information will deliver
improved efficiencies. Consideration
should also be given to reviewing the roles
and responsibilities of officers, which may
also highlight where changes in current
working practices will deliver improved
service performance. 
In addition, the development of
comprehensive performance information
to support improved monitoring of service
delivery should be undertaken. 
Page 55

Page 56

12 
between 5 weeks and 3 months to request
information from a resident to be used in the
financial assessment to determine an
individual's financial contribution towards their
care home costs. As care home rates are paid
gross to the providers until a resident's financial
contribution is determined, this may result in the
need to recover significant sums from future
payments. 
It is appreciated that further delays can occur
due to the time taken for a resident to provide
the information required to undertake a financial
assessment. However, it was noted that
significant delays were still observed in carrying
out financial assessments after the requested
information had been received. The audit
reviewed a sample of 20 financial assessments
and found 7 cases where delays ranging from 4
weeks to 3 months occurred in completing the
evaluation. These duties are undertaken by only
one officer, and at the time of the audit, 363
referrals for financial assessments had been
undertaken in the 11 months of 2024/25. It is
also acknowledged that the complexity and
level of input required can vary significantly
when determining an individual's financial
contribution towards their care home costs. 
Page 56

Page 57

13 
Management Response
Responsible Officer Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Interim Finance Manager Yes 31/03/2027 The digitisation of the financial
assessment process will be part of the
Carefirst replacement system. In the
interim, the financial assessment process
has been divided into different
administrative roles, and written
procedures have been completed. This
should help improve the flow of information
and reduce timescales for financial
assessment completion. 
Page 57

Page 58

14 
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
5 Medium A "self-funder" is someone who pays for their
care home fees from their own resources. This
typically applies when an individual entering a
care home has capital in excess of £35,000 (for
2024/25). The self-funder pays their care fees
directly to the care home, and the Council is
only be liable to pay the free personal care rate
as stipulated by the Scottish Government.
There is no requirement for a full financial
assessment of a self-funder, only a declaration
is required as part of the application for the free
personal care payment. 
As detailed in Finding 4, delays were noted
within the Community Care Finance Service in
undertaking financial assessments to determine
the financial contribution required when an
individual enters a care home. The audit noted
that even for self-funders, payments are being
made to care homes at the gross rate. Once the
financial assessment is completed and the
individual is confirmed as a self-funder, the
overpaid expenditure is recovered from the care
home. 
Consideration should be given to refining
the assessment processes for individuals
entering a care home, to enable the early
identification of potential self-funders and
ensure that appropriate accounting
arrangements are applied from the outset.   
Page 58

Page 59

15 
Management Response
Responsible Officers Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Head of Service / Interim
Finance Manager
Yes 30/09/2025 Discussions have been held with Head of
Service to ensure Social Workers resume
this activity and issue appropriate
documentation to enable self-funder
identification and processing at the earliest
opportunity. 
Page 59

Page 60

16 
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
6 Low The scope of this audit included a review to
verify the accuracy of the 4 weekly payments
made to care homes. It was noted that, as part
of the verification process, a paper record is
maintained for each resident in each care
home, detailing the 4 weekly payments to be
made. This record is updated and cross-
checked against information in the social work
and social care case management system
(CareFirst) producing the payment batches, to
confirm accuracy. In addition, the paper record
is used to calculate any payment adjustments
required due to changes in a resident's
circumstances. 
These paper payment records are held
individually by the officers responsible for
specific care homes. As these officers work
from home, the records are not digitised or
centrally stored, which limits accessibility for
other officers in the event of a query or when
further scrutiny is required.     
The payment records maintained for each
resident within a care home should be
digitised to improve accessibility and
ensure they are readily available to
management and other officers within the
service.   
Page 60

Page 61

17 
Management Response
Responsible Officer Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Interim Finance Manager Yes 31/03/2026 System for moving payment records online
is underway. A care home is being trialled
and there will then be a roll out to the rest
of the care homes. 
Page 61

Page 62

18 
Ref Risk Ratings for
Recommendations
Audit Finding Audit Recommendation
7 Low Payments are made to care home providers on
a four-weekly basis and are accompanied by a
remittance report that provides a breakdown of
the residents at each home. In addition, care
homes are contractually required to notify the
Social Care Service of any changes in
residents' circumstances that may affect
ongoing payments. 
However, it was noted that the Community Care
Finance Service also issues a separate
payment schedule fortnightly to each care
home. The schedule lists the residents and the
rates to be paid to each care home. Care homes
are expected to confirm the accuracy of this
schedule and return the completed form to the
Community Care Finance Service. The audit
found a low return rate of these forms from care
home providers, and non-submissions are not
followed up. Discussions with the Service
indicated that the requirement for this fortnightly
schedule is historical and likely dates back to a
previous payment arrangement with care
homes. 
Consideration should be given to whether
there is an ongoing need to send the
fortnightly estimated payment schedules
to all care homes. 
Page 62

Page 63

19 
Management Response
Responsible Officer Accepted (Yes/ No) Timescale for
Implementation
(Date Required)
Agreed Management
Action/Management Comment
Interim Finance Manager Yes 31/08/2025 Schedules have been confirmed as a
historic practice no longer required given
care home contractual requirements and
resident details provided to homes on
payments made. Practice to be ceased. 
Page 63

Page 64

20 
Appendix 1 
AUDIT TERMS OF REFERENCE AND DEFINITIONS 
1. Audit Objectives 
1.1 The overall audit objective is to provide an objective independent opinion on
the adequacy and effectiveness of controls / processes.  
1.2 The audit will for each controls / process being considered: 
• Walkthrough the processes to consider the key controls; 
• Conduct sample testing of the identified key controls, and 
• Report on these accordingly 
1.3 All audit reviews are carried out in accordance with Public Sector Internal
Audit Standards (PSIAS). 
2. Definitions for Auditing Opinions and Findings 
2.1 In order to assist management in using our reports: 
The Internal Auditor will categorise audit assurance opinion according to
their overall assessment of the risk management system, effectiveness of the
controls in place and the level of compliance with these controls and the action
being taken to remedy significant findings or weaknesses. 
Assurance
Level
System and Testing Conclusion
Full The controls tested are being consistently applied
Substantial There is evidence that the level of non compliance with some of the
controls may put some of the system objectives at risk.
Limited The level of non compliance puts the system objectives at risk.
None Significant non-compliance with basic controls leaves the system
open to error or abuse. 
2.2 Risk ratings for each recommendation is based on the following criteria: 
High Fundamental control weaknesses that require immediate attention by
management to action and mitigate significant exposure to risk
Medium Less critically important controls absent, not being operated as
designed or could be improved
Low Lower level controls absent, not being operated as designed or could
be improved.
Page 64

Page 65

21 
Appendix 2 
STATEMENT OF RESPONSIBILITY   
The responsibility for designing and maintaining a sound system of internal control to
prevent and detect fraud and other irregularities rests with management, with internal
audit providing a service to management to support them to achieve this objective.
The Internal Audit Section will assess the adequacy and effectiveness of the system
of internal control arrangements implemented by management and perform sample
testing on those controls in the period under review with a view to providing an opinion
on the extent to which risks in this area are managed. 
The Internal Audit Section will undertake testing with the objective of detecting
significant control weaknesses. However, the audit approach alone should not be
relied upon to identify all strengths and weaknesses in internal controls nor to find any
fraud or irregularity. Even sound systems of internal control can only provide
reasonable and not absolute assurance and may not be proof against collusive fraud. 
The matters raised in this report are only those that came to our attention during the
course of the audit review and are not necessarily a comprehensive statement of all
the weaknesses that exist or all improvements that might be made. Recommendations
for improvements should be assessed by management for their full impact before they
are implemented. The performance of the audit review undertaken should not be taken
as a substitute for management’s responsibilities for the application of sound
management practices. 
This report must not be disclosed to any third party or reproduced in whole or in part
without the written consent of the Moray Council’s Audit and Risk Manager. 
Page 65

Page 66

Page 66

Page 67

Report to: Audit and Scrutiny
Committee
Meeting Date: 10 September 2025     
Report by: Service Manager
Internal Audit and Risk 
Report No: GSP047/25/DL  
Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk 
Subject:  Public Sector Internal Audit Standards - External Quality Assessment of
the Internal Audit Section - Follow Up Review 
1. PURPOSE 
☒ For Decision      ☐  For Information 
1.1 The purpose of this report is to provide Committee with an update on the implementation
of recommendations detailed within the external quality assessment undertaken on the
Council’s Internal Audit Section. 
1.2 This report is submitted to Committee in terms of Section III (I) (6) of the Council’s Scheme
of Administration relating to the consideration of reports in overseeing the independence,
objectivity, performance and conformance to professional standards of internal audit. 
2. SUMMARY  
2.1 The Local Authority Accounts (Scotland) Regulations 2014 paragraph 7 requires that ‘a
local authority must operate a professional and objective internal auditing service in
accordance with recognised standards and practices in relation to internal auditing’.  
2.2 The recognised standards adopted by all Scottish councils are the Public Sector Internal
Audit Standards (PSIAS) developed by standard setters, including the Chartered Institute
of Public Finance and Accountancy and the Chartered Institute of Internal Auditors. The
standards include a requirement for an External Quality Assessment (EQA) of internal
audit once every five years and for the findings to be considered at a meeting of a Council
committee. An EQA of the Council’s Internal Audit Section was completed last year by the
Chief Internal Auditor of Perth and Kinross Council. The findings were reported to this
Committee on 11 September 2024 (paragraph 10 of the minutes refers). This report
Item 9.
Page 67

Page 68

provides an update on the implementation of recommendations contained within this EQA
report.
3. RECOMMENDATIONS
3.1 It is recommended that Committee considers and notes the contents of this report,
seek clarification on any points.
Dafydd Lewis
Service Manager Internal Audit and Risk
4. BACKGROUND AND CONTEXT
4.1 Through the Scottish Local Authorities Chief Internal Auditors’ Group, in which the Council
participates, it was agreed that the EQA requirement could be met through a peer review
process. This required each council’s chief internal auditor to lead a review of another
council’s internal audit service and receive a review in return. Perth and Kinross Council
was selected to undertake the assessment of the Moray Council’s Internal Audit Section.
4.2 An assessment took place in March 2024, during which the Chief Internal Auditor of Perth
and Kinross Council reviewed the operating arrangements within Moray against the PSIAS.
This involved the verification of a portfolio of evidence, interviews with the Chair of the
Audit and Scrutiny Committee, the Chief Executive, and the Head of Governance, Strategy
and Performance, as well as discussions and file reviews with officers within the Internal
Audit Section.
4.3 The overall conclusion of the external assessment is that Moray Council’s Internal Audit
Section fully conforms with the PSIAS. This represents the highest level of conformance
and should reassure members and senior management about the effectiveness of the
Internal Audit Section’s operating arrangements. However, the report included several
recommendations, highlighting the need to reinforce Internal Audit’s role as an
independent appraisal function for the Council and its partner organisations, as well as
concerns regarding the availability of staffing resources.
4.4 A follow-up review has been undertaken by the Senior Auditor to evidence the
implementation of the recommendations. The Follow-Up Report is included in Appendix
1. It is pleasing to confirm that the majority of the recommendations have been
implemented. However, in accordance with PSIAS, despite the recent appointment of a
temporary part-time auditor, concerns remain regarding the current staffing resources.
Senior management and members of this Committee will be kept informed of any impact
resulting from the staffing situation and the potential implications for the future delivery of
the internal audit service.
5. PROPOSALS
Page 68

Page 69

5.1 The Committee considers and notes the progress made in implementing the
recommendations detailed in the External Quality Assessment Report of the Internal Audit
Section.
6. SUMMARY OF IMPLICATIONS
6.1 The table below shows whether risks and implications apply if the recommendations are
agreed:
SUBJECT YES NO
Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) ×
Policy and Legal ×
Financial ×
Risk ×
Staffing ×
Best Value and Transformation ×
Property ×
Information Communications Technology/Digital ×
Equalities. Social Inclusion and Economic Impact ×
Climate Change, Biodiversity and Sustainability ×
6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP))
Improved Collaborative Leadership, as part of continuous improvement through Best
Value, will better enable the Council to fulfil the ambitions set out in its strategic plans.
a) Links to Council Corporate Plan – The proposals in this report support and contribute
to improved outcomes for communities as outlined in the following Council Plan
strategic priorities:
☐ Tackle Poverty and Inequality.
☐ Build Stronger Greener Vibrant Economy.
☐ Build Thriving, resilient, empowered Communities.
b) Links to Local Outcomes Improvement Plan – The proposals in this report support
and contribute to improved outcomes for communities as outlined in the following
local Outcomes Improvement Plan priorities:
☐ Developing a diverse, inclusive, and sustainable economy
☐ Building a better future for our children and young people in Moray.
☐ Empowering and connecting communities.
☐ Improving wellbeing of our population
6.3 Policy and Legal
No implications directly arising from this report.
6.4 Financial
No implications directly arising from this report.
Page 69

Page 70

One off Costs:
Service
Area
Budget Budget
Years
Proposed
Spend this
Year
Virement
From
Other
Comments
Annually Recurring Costs:
Service
Area
Budget With
Effect
From
Annual
Net
Impact
Virement
From (if
applicable)
Other
Comments
6.5 Risk
The independent review of selected systems and procedures mitigates the risk associated
with inadequate or ineffective control procedures.
6.6 Staffing
No implications directly arising from this report.
6.7 Best Value and Transformation
Internal audit work supports good governance and the delivery of efficient services.
6.8 Property
No implications directly arising from this report.
6.9 Information Communications/Technology/Digital
No implications directly arising from this report.
6.10 Equalities, Social Inclusion and Economic Impact
No implications directly arising from this report.
6.11 Climate Change and Biodiversity Impacts
No implications directly arising from this report.
7. CONSULTATION
7.1 There have been no direct consultations during the preparation of this report.
8. BACKGROUND PAPERS
8.1 None
Page 70

Page 71

APPENDIX 1
XXX 2020 Page 1
EXTERNAL QUALITY
ASSESSMENT 2
OF
MORAY COUNCIL’S
INTERNAL AUDIT SERVICE
Report Recipients:
J Mundell, Interim Chief Executive
D Whitworth, Depute Chief Executive (Education, Communities & Organisational    
Development)
A McEachan, Head of Governance, Strategy & Performance
D Lewis, Chief Audit Executive (Audit and Risk Manager)
Councillor G Leadbitter, Chair of Audit & Scrutiny Committee
Page 71

Page 72

EXECUTIVE SUMMARY
2
1. INTRODUCTION
1.1 The mandatory Public Sector Internal Audit Standards (PSIAS), published initially in
April 2013 and updated most recently in March 2017, apply to all internal audit service
providers in the UK public sector, whether in-house, provided via a shared service
arrangement or outsourced. To supplement the PSIAS and provide specific guidance
surrounding its application within a local government setting, the Chartered Institute of
Public Finance and Accountancy (CIPFA) compiled a Local Government Application
Note, which was last updated in 2019.
1.2 The objectives of the PSIAS are to define the nature of internal auditing within the UK
public sector; set basic principles for carrying out internal audit; establish a framework
for providing internal audit services, which add value to the organisation, leading to
improved organisational processes and operations; establish the basis for the evaluation
of internal audit performance and drive improvement planning.
1.3 The PSIAS require the Chief Audit Executive (the Audit and Risk Manager in Moray
Council) to develop and maintain a quality assurance and improvement programme
(QAIP) that covers all aspects of the internal audit activity.  The QAIP must include both
periodic internal self-assessments and five-yearly external assessments, carried out by
a qualified, independent assessor from outwith the organisation, and enable evaluation
of the internal audit activity’s (Internal Audit in Perth & Kinross Council) conformance
with the PSIAS, including the Mission of Internal Audit, Definition of Internal Auditing and
Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness
of the internal audit activity and identify opportunities for improvement. 
1.4 To assist its members to meet the five-yearly external assessment requirement, the
Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG) established a
collaborative system of formal peer reviews.  This approach not only assists with
ensuring that independent assessors, and their teams, have appropriate knowledge and
experience of the local government internal audit environment but also removes the
financial burden from councils, associated with procuring these services externally.  The
allocation of assessors / assessment teams to councils participating in the peer review
process was undertaken autonomously, ensuring that, amongst other governing
principles, local authorities with perceived / known conflicts of interest could not review
one another.  At the outset, assessors were required to formally declare any interests
so that these could be appropriately addressed during the allocation process.  Perth &
Kinross Council was selected to carry out the external assessment in Moray Council.  
1.5 To support the peer review process, SLACIAG developed a comprehensive External
Quality Assessment (EQA) framework, including an EQA Checklist for Assessing
Conformance with the PSIAS and the Local Government Application Note (EQA
Checklist) and a key Stakeholder Questionnaire proforma. The external assessment of
Moray Council’s Internal Audit Service has been carried out by Perth & Kinross Council’s
Internal Audit service utilising this framework.  
1.6 This report provides a high level summary of requirements for each standard per the
PSIAS and CIPFA Local Government Application Note and sets out the findings,
conclusions and recommendations from the external assessment, which involved
discussions with key members of staff, including the Chief Audit Executive, review of the
most recent self-assessment carried out utilising the EQA Checklist and consideration
of other relevant supporting documentation / information (Evidence Pack) including
working paper files and completed stakeholder questionnaires. A comprehensive list of
supporting documentation / information and completed stakeholder questionnaires
considered as part of the assessment can be found at appendices B and C respectively.
Page 72

Page 73

3 
2.  OVERALL CONCLUSION
2.1 The overall conclusion of the external assessment is that Moray Council’s Internal Audit
Service fully conforms with the PSIAS.  However, it should be noted that Standard ref
No. 1100.2 Independence & Objectivity have been assessed as generally conforms
and steps should be taken to address the associated areas for improvement. A full
summary of assessment, per assessment area, can be found at Appendix A.  A
summary of totals is as follows:   
Fully
Conforms     
Generally
Conforms     
Partially
Conforms     
Does Not
Conform   
TOTALS 13 1 0 0 
2.2 The main areas for improvement highlighted in the report are as follows: 
• Enhancing the organisational independence of the Chief Audit Executive by including
the role of the post within the Scheme of Delegation
• Ensuring clarity over areas where the Chief Audit Executive has functional
responsibility 
2.3 Full details of the assessment recommendations and management responses can be
found in the Action Plan at Appendix D. 
Page 73

Page 74

4
3. SECTION A – MISSION OF INTERNAL AUDIT AND CORE PRINCIPLES
The PSIAS state that the Mission of Internal Audit articulates what internal audit aspires
to accomplish within an organisation, which is ‘to enhance and protect organisational
value by providing risk-based and objective assurance, advice and insight’.
Taken as a whole, the Core Principles for the Professional Practice of Internal Auditing,
as set out in the PSIAS, articulate internal audit effectiveness. For an internal audit
function to be considered effective, all Core Principles should be present and operating
effectively. Failure to achieve any of the Core Principles would imply that an internal
audit activity was not as effective as it could be in achieving the Mission of Internal Audit.
3.1 Evidence obtained from assessing conformance with other standards in the PSIAS has
been used, along with specific consideration surrounding the achievement of the Core
Principles, to conclude that the Internal Audit Service at Moray Council fully conforms
with accomplishing the Mission of Internal Audit as detailed above.
4. SECTION B – DEFINITION OF INTERNAL AUDITING
The PSIAS state that internal auditing is an independent, objective assurance and
consulting activity designed to add value and improve an organisation’s operations. It
helps an organisation accomplish its objectives by bringing a systematic, disciplined
approach to evaluate and improve the effectiveness of risk management, control and
governance processes.
4.1 Evidence obtained from assessing conformance with other standards in the PSIAS has
been used to conclude that the Internal Audit Service at Moray Council fully conforms
with the definition of Internal Auditing as detailed above. The main reasons for this
assessment include the Internal Audit Charter and engagement with stakeholders.
5. SECTION C – CODE OF ETHICS
The PSIAS state that the purpose of the Institute of Internal Auditor’s Code of Ethics is
to promote an ethical culture in the profession of internal auditing. A code of ethics is
necessary and appropriate for the profession of internal auditing, founded as it is on the
trust placed in its objective assurance about risk management, control and governance.
Internal auditors in UK public sector organisations must conform to the Code of Ethics
as set out in the PSIAS. If individual internal auditors have membership of another
professional body then he or she must also comply with the relevant requirements of
that organisation.
5.1 Evidence obtained from assessing conformance with other standards in the PSIAS, in
particular the Attribute Standards 1000 – Purpose Authority and Responsibility, 1100 –
Independence and Objectivity, 1200 – Proficiency and Due Professional Care and
Professional Standards 2000 – Managing the Internal Audit Activity and 2300 –
Performing the Engagement, has been used to conclude that Moray Council’s Internal
Audit Service fully conforms with the requirement to comply with the Code of Ethics.
Page 74

Page 75

5
6. SECTION D – ATTRIBUTE STANDARDS
Attribute Standards apply to organisations and individual internal auditors
providing the internal audit services in a local authority.
6.1 1000 - Purpose, Authority, and Responsibility
The PSIAS state that the purpose, authority and responsibility of the internal audit
activity must be formally defined in an Internal Audit Charter, consistent with the Mission
of Internal Audit and the mandatory elements of the International Professional Practices
Framework. The chief audit executive must periodically review the internal audit charter
and present it to senior management and the board for approval. The internal audit
charter must also:
• define the terms ‘board’ and ‘senior management’ for the purposes of internal audit
activity;
• cover the arrangements for appropriate resourcing;
• define the role of internal audit in any fraud-related work; and
• describe safeguards to limit impairments of independence or objectivity if internal
audit or the chief audit executive undertakes non-audit activities.
6.1.1 Moray Council’s Internal Audit Charter is periodically reviewed with the most recent
review taking place in 2022. The Internal Audit Charter was approved by the Audit &
Scrutiny Committee on 23 November 2022.
6.1.2 Having considered the findings above, it has been concluded that the Internal Audit
Service at Moray Council fully conforms with Standard 1000 on Purpose, Authority and
Responsibility.
6.2 1100 - Independence and Objectivity
The internal audit activity must be independent and internal auditors must be objective
in performing their work. Various aspects of independence and objectivity are covered
in this standard as well as 1200, including reporting functional lines of the CAE, the
relationship between the CAE and the board and any impairment to individual internal
auditors’ objectivity or independence. Reporting and management arrangements must
be put in place that preserve the CAE’s independence and objectivity, in particular with
regard to the principle that the CAE must be independent of the audited activities.
6.2.1 The Chief Audit Executive reports functionally to the Audit & Scrutiny Committee and
administratively to the Head of Governance, Strategy & Performance, who is a member
of the Council’s Corporate Management Team. The Chief Audit Executive has direct
and unrestricted access to the Chief Executive and the Chair of the Audit & Scrutiny
Committee and this has been confirmed through Stakeholder engagement. These
reporting / access arrangements are defined within the job description of the Chief Audit
Executive but not specifically within the Internal Audit Charter. The Audit Charter does
contain reference to arrangements for safeguards to limit impairment of independence
or objectivity on behalf of the audit team.
6.2.2 In support of organisational independence, the Chief Audit Executive attends the Audit
& Scrutiny Committee meetings to present all internal audit reports (including, for
example, the Internal Audit Charter, Annual Report, Internal Audit Plan and reports /
executive summaries from the planned audits) to Elected Members. The reports are all
submitted in the Chief Audit Executive’s name.
6.2.3 The Chief Audit Executive has functional and operational responsibility for non-audit
activities, namely supporting business continuity and risk management arrangements
within services. This function is operationally kept separate from the delivery of internal
audit. but this, and the potential for impairment to the Chief Audit Executive’s
Page 75

Page 76

6
independence and objectivity, is not clearly communicated to stakeholders through the
Audit Charter.
6.2.4 All staff within the Internal Audit service are required to complete a declaration form, that
includes the requirement to raise any issues or concerns where a conflict of interest may
arise on an annual basis.
6.2.5 There is scope for improving clarity regarding reporting lines by explicitly stating
reporting lines within the Audit Charter
6.2.6 Furthermore, there is scope to consider the Chief Audit Executive’s delegated authority
within the Scheme of Delegation.
6.2.7 Where the Chief Audit Executive has roles and responsibility in addition to Internal Audit,
this should be clearly communicated to the Audit & Scrutiny Committee and Senior
Officers. The Audit Charter should be updated in this regard to ensure that there are
clear arrangements for ensuring the independence and objectivity of the Internal Audit
function.
6.2.8 Moray Council’s Internal Audit Service generally conforms with Standard 1100 on
Independence and Objectivity.
6.3 1200 - Proficiency and Due Professional Care
The CAE must be professionally qualified, suitably experienced and responsible, in
accordance with the organisation’s human resources processes, for recruiting
appropriate staff. He or she is responsible for ensuring that up-to-date job descriptions
exist, reflecting roles and responsibilities, and that person specifications define the
required qualifications, competencies, skills, experience and personal attributes.
The CAE should periodically assess individual auditors’ skills and competencies against
those set out in the relevant job descriptions and person specifications. Any training or
development needs identified should be included in an appropriate ongoing
development programme that is recorded and regularly reviewed and monitored. In
addition, all internal auditors have a personal responsibility to undertake a programme
of continuing professional development (CPD) to maintain and develop their
competence. This may be fulfilled through requirements set by professional bodies or
through the organisation’s own appraisal and development programme. Auditors should
maintain a record of such professional training and development activities.
The internal audit activity should be appropriately resourced to meet its objectives. It
should have appropriate numbers of staff in terms of grades, qualifications, personal
attributes and experience or have access to appropriate resources in order to meet its
objectives and to comply with these standards. The PSIAS states that the CAE must
obtain competent advice and assistance if the activity is unable to perform all or part of
an engagement.
6.3.1 The Chief Audit Executive holds a relevant professional qualification and is suitably
experienced, with over 30 years internal audit experience within local government. The
Chief Audit Executive is a member of SLACIAG and regularly attends and contributes
to meetings. In relation to the two SLACIAG Sub-groups, the Computer Audit Sub-
Group (CASG) and the Scottish Local Authorities Investigators Group (SLAIG), Moray
Council’s Internal Audit team is represented on both.
Page 76

Page 77

7
6.3.2 To support the Chief Audit Executive in Moray Council’s Internal Audit service there is
one Senior Auditor, who is also suitably qualified and experienced. There are a total of
3.8 FTE members of staff in the Internal Audit service, including the Chief Audit
Executive and Senior Auditor. The Internal Audit Service delivers internal audit services
to Moray Council, Moray Integration Joint Board, the Grampian Valuation Board and
Moray Growth Deal. Whilst there are no specialist computer auditors or fraud
investigators, the Chief Audit Executive is a member of the Computer Audit Sub Group
and the team contains officers who are experienced in fraud and corruption
investigations.
6.3.3 All Internal Audit team members participate in Moray Council’s corporate Employee
Review and Development process.
6.3.4 The Internal Audit Service is represented on a number of corporate groups, including
the Information Assurance Group and the Leadership Forums, and may be asked to
advise other Council groups on specific issues connected with the control environment.
6.3.5 The Chief Audit Executive, Senior Auditor and one auditor have specific CPD
requirements to adhere to, with the remaining team member currently undertaking
professional training with the Institute of Internal Auditors. Training records are held.
6.3.6 Engagement with key stakeholders, as part of the validation of the self assessment
process has confirmed that the Chief Audit Executive demonstrates sufficient knowledge
and experience and that all members of the Internal Audit Service exercise due
professional care.
6.3.7 Consideration should be given to the size of the Internal Audit team in order to ensure
that the Internal Audit Service meet its objectives for all organisations that it provides
internal audit services to (as detailed in 6.3.2).
6.3.8 Moray Council’s Internal Audit Service fully conforms with standard 1200 on
Proficiency and Due Professional Care.
6.4 1300 - Quality Assurance and Improvement Programme
The PSIAS state that the Chief Audit Executive must develop and maintain a quality
assurance and improvement programme (QAIP) that covers all aspects of the internal
audit activity.
The QAIP must include both periodic internal self-assessments and five-yearly external
assessments, carried out by a qualified, independent assessor from outside the
organisation, and enable evaluation of the internal audit activity’s conformance with the
PSIAS, including the Definition of Internal Auditing and Code of Ethics. In addition, the
QAIP should also assess the efficiency and effectiveness of the internal audit activity
and identify opportunities for improvement.
The public sector requirement in the PSIAS states that results of the QAIP and progress
against any improvement plans must be reported in the annual report.
6.4.1 Internal audit reports are reviewed by the Chief Audit Executive prior to issue and
working papers are reviewed by either the Chief Audit Executive or Senior Internal
Auditor. Where the assignment is carried out by the Senior Internal Auditor, the Chief
Audit Executive will review the working paper file.
6.4.2 Client feedback is actively pursued by the Internal Audit Service for assignments carried
out within Moray Council.
Page 77

Page 78

8
6.4.3 Performance measures are in place to monitor the performance of the Internal Audit
service. These include the audit plan delivery and the budget surrounding the plan. The
performance against these measures is reported to Audit & Scrutiny Committee as part
of the Annual Audit Report and Opinion.
6.4.4 The EQA Checklist has been used for a formal self-assessment of compliance with the
PSIAS. The Quality Assurance Improvement Plan was provided to the Audit & Scrutiny
Committee, with ongoing compliance being reported in subsequent years.
6.4.5 Moray Council’s Internal Audit Service fully conforms with Standard 1300 on Quality
Assurance and Improvement Programme.
7. SECTION E – PERFORMANCE STANDARDS
Performance Standards describe the nature of the internal audit services being
provided and provide criteria against which the performance of an internal audit
function can be measured.
7.1 2000 - Managing the Internal Audit Activity
The chief audit executive must effectively manage the internal audit activity to ensure it
adds value to the organisation. The internal audit activity is effectively managed when
it achieves the purpose and responsibility included in the internal audit charter, it
conforms with the PSIAS, its individual members conform with the Code of Ethics and
the PSIAS and it considers trends and emerging issues that could impact the
organisation. The internal audit activity adds value to the organisation and its
stakeholders when it considers strategies, objectives and risks; strives to offer ways to
enhance governance, risk management, and control processes; and objectively
provides relevant assurance.
7.1.1 An annual Internal Audit Plan is compiled by the Chief Audit Executive outlining the
planned programme of work to be undertaken. A review is undertaken of the Audit
Universe, taking account of internal audit risk assessment and historic internal audit
activity over a 5 year period. Consideration is given to the Corporate Risk Register
(compiled by Heads of Services supported by the Business Continuity and Risk
Management Officer), as well as corporate transformation and improvement plans. The
Corporate Management Team, Heads of Services, Council Leader and the Chair of the
Audit and Scrutiny Committee are also consulted and asked if there are any projects
they want to be included in the Annual Audit Plan. Contact is made with the External
Auditor to detail the projects contained within the Audit Plan.
7.1.2 The draft Internal Audit Plan is presented to the Audit & Scrutiny Committee for formal
approval.
7.1.3 Progress towards completion of the Internal Audit Plan, and the individual audits
contained within it are reported to each Audit & Scrutiny Committee, which routinely take
place five times a year.
7.1.4 Managers are asked to complete a feedback questionnaire from the reviews undertaken,
which is assessed to determine whether any improvements are needed to the audit
process.
7.1.5 Moray Council’s Internal Audit Service fully conforms with Standard 2000 on Managing
the Internal Audit Activity.
Page 78

Page 79

9
7.2 2100 - Nature of Work
The internal audit activity must evaluate and contribute to the improvement of the
organisation’s governance, risk management, and control processes using a systematic,
disciplined, and risk-based approach. Internal audit credibility and value are enhanced
when auditors are proactive and their evaluations offer new insights and consider future
impact.
More specifically, the internal audit activity must assess and make appropriate
recommendations to improve the organisation’s governance processes, evaluate the
effectiveness and contribute to the improvement of risk management processes and
assist the organisation in maintaining effective controls by evaluating their efficiency and
effectiveness and promoting continuous improvement.
7.2.1 The Chief Audit Executive includes an appropriate balance of work within the Plan to
evaluate and contribute to the improvement of the Council’s governance, risk
management and control processes. Findings re coverage of governance, risk
management and control processes.
7.2.3 Moray Council’s Internal Audit Service fully conforms with Standard 2100 on Nature of
Work.
7.3 2200 - Engagement Planning
Internal auditors must develop and document a plan for each engagement, including the
engagement’s objectives, scope, timing and resource allocations. The plan must
consider the organisation’s strategies, objectives and risks relevant to the engagement.
The CIPFA Local Government Application note states that for each engagement, a brief
should be prepared, discussed and agreed with relevant managers. The brief should
establish the objectives, scope and timing for the assignment and its resource and
reporting requirements. Audit work should be undertaken using a risk-based audit
approach.
7.3.1 The Audit Plan includes a brief summary of the scope for each audit, which is developed
more fully prior to the commencement of the audit. The audit programme is compiled by
the auditor and is reviewed by the Chief Audit Executive or Senior Auditor to ensure that
the programme is consistent with, and will provide sufficient evidence for arriving at an
opinion on, the agreed scope.
7.3.2 Moray Council’s Internal Audit Service fully conforms with Standard 2200 on
Engagement Planning.
7.4 2300 - Performing the Engagement
Internal auditors must identify, analyse, evaluate and document sufficient information to
achieve the engagement’s objectives.
At each stage of the audit, auditors should consider what specific work needs to be
conducted and evidence needs to be gathered to achieve the engagement objectives
and support an independent and objective audit opinion. Systems should be in place to
ensure that auditors obtain and record, within the working papers, sufficient evidence to
support their conclusions, professional judgements and recommendations. Working
papers should always be sufficiently complete and detailed to enable an experienced
internal auditor with no previous connection with the audit to ascertain what work was
performed, re-perform it if necessary and support the conclusions reached. The CAE
should also specify how long all audit documentation should be retained, whether held
on paper or electronically. All audit work should be subject to an appropriate internal
quality review process.
Internal auditors must be alert to the possibility of intentional wrongdoing, errors and
omissions, poor value for money, failure to comply with management policy and conflicts
Page 79

Page 80

10
of interest when performing their individual audits. They must also have sufficient
knowledge to identify indicators that fraud or corruption may have been committed.
7.4.1 The Internal Audit Manual details the procedures for use within Moray Council’s Audit
Service. The Manual is supported by the Pentana system, which is an audit automation
tool supporting the service’s management and control workflow.
7.4.2 All audit files are stored electronically within Pentana.
7.4.3 Evidence for file and report reviews, which are undertaken by the Chief Audit Executive
or the Senior Auditor, is retained within Pentana.
7.4.5 Records management arrangements are appropriate and consider GDPR.
7.4.6 Moray Council’s Internal Audit Service fully conforms with Standard 2300 on
Performing the Engagement.
7.5 2400 - Communicating Results
The basic aims of every internal audit report should be to:
• give an opinion on the risk and controls of the area under review, building up to the
annual opinion on the overall adequacy and effectiveness of the organisation’s
framework of governance, risk management and control;
• prompt management to implement the agreed actions for change leading to
improvement in the control environment and performance; and
• provide a formal record of points arising from the audit and, where appropriate, of
agreements reached with management, together with appropriate timescales.
Each report should include the scope and purpose of the audit to help the reader to
understand the extent, or limitations, of the assurance(s) provided by the report. During
the course of the audit, key issues should be brought to the attention of the relevant
manager to enable them to take corrective action and to avoid surprises at the closure
stage. Before issuing the final report, the internal auditor should normally discuss the
contents with the appropriate levels of management to confirm the factual accuracy, to
seek comments and to confirm the agreed management actions. A draft report is useful
for this purpose. Recommendations should be prioritised according to risk. The
recommendations and the resultant management action plans should be agreed prior to
the issue of the final report. Any areas of disagreement between the internal auditor and
management that cannot be resolved by discussion should be recorded in the action
plan and the residual risk highlighted. Those weaknesses giving rise to significant risks
that are not agreed should be brought to the attention of a more senior level of
management and the board.
As set out in the PSIAS, the CAE must deliver an annual internal audit opinion and report
that can be used by the organisation to inform its annual governance statement. This
must include the annual internal audit opinion concluding on the overall adequacy and
effectiveness of the organisation’s governance, risk and control framework, a summary
of the audit work from which the opinion is derived (including reliance placed on work by
other assurance bodies); and a statement of conformance with the PSIAS and the
results of the internal audit QAIP.
7.5.1 Draft reports are prepared for each audit assignment by the lead auditor and reviewed
by the Chief Audit Executive or Senior Auditor. This includes assessing the strength of
controls in place within the audited area.
7.5.2 Once factual accuracy has been confirmed with the service being audited, the action
plan is completed, with any issues being addressed with the relevant Head of Service
before the report is passed for presentation to the Audit & Scrutiny Committee.
Page 80

Page 81

11
7.5.3 The work of the Internal Audit service for the year is considered, summarised and forms
part of the overall opinion that is provided annually by the Chief Audit Executive.
7.5.4 Engagement with stakeholders during the validation of the EQA confirms that this
process is understood, respected and valued by the organisation.
7.5.5 Moray Council’s Internal Audit Service fully conforms with Standard 2400 on
Communicating Results.
7.6 2500 - Monitoring Progress
The PSIAS place responsibility for monitoring progress with the CAE to ensure that
management actions have been effectively implemented or, if not, that senior
management have accepted the risk of not taking action. The CAE must, therefore,
implement a follow-up process for ensuring the effective implementation of audit results
or ensuring senior management are aware of the consequences of not implementing an
action point and are prepared to accept the risk of such consequences occurring. The
results of this process should be communicated to the board. The CAE should develop
escalation procedures for cases where agreed actions have not been effectively
implemented by the date agreed. These procedures should ensure that the risks of not
taking action have been understood and accepted at a sufficiently senior management
level. The effective involvement of the board in the follow-up process is critical to
ensuring that it works. The CAE should consider revising the internal audit opinion in
light of findings from the follow-up process. The findings of follow-up reviews should
inform the planning of future audit work.
7.6.1 The audit follow-up review process is documented within the Internal Audit Manual.
Follow-up audits take place following the last date of implementation for all
recommendations. A control record is maintained to monitor when audits are due for
follow up. Follow-up audits are reviewed by the CAE or Senior Auditor, following which
they are now reported to Audit & Scrutiny Committee.
7.6.3 Moray Council’s Internal Audit Service fully conforms with Standard 2500 on
Monitoring Progress.
7.7 2600 - Communicating the Acceptance of Risks
When the chief audit executive concludes that management has accepted a level of risk
that may be unacceptable to the organisation, they must discuss the matter with senior
management. If the chief audit executive determines that the matter has not been
resolved, they must communicate the matter to the board. It is not the responsibility of
the chief audit executive to resolve the risk.
7.7.1 All audits on systems and practices are reported to the Board including Management
responses to recommendations. Where a recommendation is made which is not
accepted by management, which has been found to be rare, the Chief Audit Executive
presents a report to Audit & Scrutiny Committee where a ‘no’ response has been entered
against a recommendation, the CAE and elected members would have the opportunity
to challenge this response from Management.
7.7.2 The organisational structure allows for direct communication between the Chief Audit
Executive and the Chief Executive and the Chair of the Audit & Scrutiny Committee.
7.7.3 The full scope of internal audit responsibilities are covered in the annual report / opinion
i.e. governance, risk management and control.
7.7.4 Moray Council’s Internal Audit Service fully conforms to the Standard on
Communicating the Acceptance of Risk.
Page 81

Page 82

12 
Jackie Clark 
Chief Internal Auditor
Perth & Kinross Council
August 2024
Page 82

Page 83

13 
APPENDIX A – SUMMARY OF ASSESSMENT 
REF PAGE
No. ASSESSMENT AREA
Fully
Conforms 
Generally
Conforms 
Partially
Conforms 
Does Not
Conform 
Section A  Mission of Internal Audit and Core Principles    
Section B  Definition of Internal Auditing    
Section C  Code of Ethics    
Section D  ATTRIBUTE STANDARDS 
1000  Purpose, Authority and Responsibility    
1100  Independence and Objectivity    
1200  Proficiency and Due Professional Care    
1300  Quality Assurance and Improvement Programme    
Section E  PERFORMANCE STANDARDS 
2000  Managing the internal Audit Activity    
2100  Nature of Work    
2200  Engagement Planning    
2300  Performing the Engagement    
2400  Communicating Results    
Page 83

Page 84

14 
2500  Monitoring Progress    
2600  Communicating the Acceptance of Risks    
TOTALS 13 1 0 0
Page 84

Page 85

15 
APPENDIX B – EVIDENCE PACK
• Completed self-assessment against the Public Sector Internal Audit Standards
• Internal Audit Charter
• Internal Audit Manual
• Pentana system outputs
• Organisational charts, Job descriptions
• Links to relevant Committee reports
• Relevant communication 
Page 85

Page 86

16 
APPENDIX C – STAKEHOLDERS 
Stakeholder interviews were held with the following key members of staff and Elected
Members:
• D Lewis, Audit & Risk Manager (Chief Audit Executive)
• T Laing, Senior Internal Auditor
• J Lovie, Internal Auditor
• R Burns, Chief Executive (former)
• A McEachan, Head of Governance, Strategy & Performance
• Councillor G Leadbitter, Chair of Audit & Scrutiny Committee
Page 86

Page 87

17 
APPENDIX D – ACTION PLAN
ACTION PLAN – INTERML AUDIT FOLLOW UP REVIEW – JUNE 2025 
No.  Report
Para  Recommendation  Management Response  Responsible
Officer / Agreed
Completion Date
1 6.2.5 There is scope for improving clarity regarding reporting
lines by explicitly stating reporting lines within the Audit
Charter
The Audit Charter will be updated to provide greater
clarification regarding the rights of access for Internal
Audit Section officers to documentation and to seek
explanations from any officer regarding any issues in
completing their duties
Audit and Risk
Manager / Agreed 30
November 2024
Follow Up Review
Status Comment 
Implemented 
The Internal Audit Charter has been updated to include further reference to the administrative and functional reporting
requirements of the Audit & Risk Manager (Chief Audit Executive (CAE)). In addition, greater clarity has also been
included regarding the Audit and Risk Manager’s “rights of access” to members and senior management. The Audit and
Scrutiny Committee approved the updated Audit Charter on 20 November 2024 (paragraph 10 of the minutes refers). 
No.  Report
Para  Recommendation  Management Response  Responsible
Officer / Agreed
Completion Date
2 6.2.6 Furthermore, there is scope to consider the Chief Audit
Executive’s delegated authority within the Scheme of
Delegation
The Scheme of Delegation will be updated to include the
responsibility for the Audit and Risk Manager to act as the
Head of
Governance,
Strategy and
Page 87

Page 88

18 
Chief Audit Executive for the delivery of internal audit
services.
Performance /
Agreed 31 January
2025
Follow Up Review
Status  Comment
Implemented The Scheme of Delegation has been updated to include reference to the requirement for the Audit and Risk Manager’s
responsibility to deliver the internal audit service in accordance with the Public Sector Internal Audit Standards. The
updated Scheme of Delegation was approved by full Council on 25 June 2025.   
No.  Report
Para  Recommendation  Management Response  Responsible
Officer / Agreed
Completion Date
3 6.2.7 Where the Chief Audit Executive has roles and
responsibility in addition to Internal Audit, this should be
clearly communicated to the Audit & Scrutiny
Committee and Senior Officers. The Audit Charter
should be updated in this regard to ensure that there are
clear arrangements for ensuring the independence and
objectivity of the Int The updated Audit Charter was
approved by the Audit and Scrutiny Committee on 20
November 2024 (paragraph 10 of the minutes
refers).ernal Audit function.
As detailed in the ‘management response’ to
recommendation 1, the Audit Charter will also be updated
to detail the separate roles of the Audit and Risk Manager
within the Council.
Audit and Risk
Manager / Agreed 30
November 2024
Follow Up Review
Status  Comment
Implemented The Internal Audit Charter has been updated to include reference of the requirement that any duties of the Audit and
Risk Manager that fall outside internal auditing must not impact the requirement for independence or objectivity. 
Page 88

Page 89

19
No. Report
Para Recommendation Management Response Responsible
Officer / Agreed
Completion Date
4 6.3.7 Consideration should be given to the size of the Internal
Audit team in order to ensure that the Internal Audit
Service meet its objectives for all organisations that it
provides internal audit services to (as detailed in 6.3.2)
Concerns regarding the current staffing resources of the
Internal Audit Service to meet the auditing and also
counter fraud requirements of the Council and partner
organisations have already been highlighted to senior
management and members. However, this issue will be
raised again for consideration with senior management.
Audit and Risk
Manager / Agreed
30 September 2024
Follow Up Review
Status Comment
Part- Implemented In accordance with the Public Sector Internal Auditing Standards (PSIAS), the Audit and Risk Manager must ensure that
internal audit resources are appropriate and sufficient. Where the Audit and Risk Manager believes that the level of
resources will adversely impact the provision of the annual internal audit opinion, this must be brought to the attention
of the Audit and Scrutiny Committee. Concerns were raised by the Audit and Risk Manager within the Annual Internal
Audit Report to the Audit and Scrutiny Committee on 24 June 2025 (paragraph 6 of the minutes refers) regarding the level
of staff resources. However, the recent appointment of a part-time temporary auditor should assist in meeting the
increasing demands on the Service.
.
Critical
Significant
Routine
Page 89

Page 90

Page 90