Agenda Document Pack - Audit and Scrutiny Committee - 19/11/2025
Moray Council · 19 November 2025
Back to Audit and Scrutiny Committee — 19 November 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 19 November 2025 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 19 November 2025 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of meeting of 10 September 2025 5 - 10 4. Written Questions ** 5. Internal Audit Section Update Report Report by Service Manager Internal Audit and Risk 11 - 86 6. Internal Audit Review - National Non-Domestic Rates Report by Service Manager Internal Audit and Risk 87 - 104 7. Internal Audit Review - Procurement and Creditor Payments Report by Service Manager Internal Audit and Risk 105 - 126 8. Internal Audit Review - Complex and Challenging Needs Service Report by Service Manager Internal Audit and Risk 127 - 152 9. Internal Audit Review - Absence Management Report by Service Manager Internal Audit and Risk 153 - 190 10. Internal Audit Follow Up Review – Moray Growth Deal Report by Service Manager Internal Audit and Risk 191 - 212 Page 1
Page 2
11. Internal Audit Charter Report by Service Manager Internal Audit and Risk 213 - 232 12. Scottish Public Services Ombudsman Recommendation Report 2024-25 Report by Executive Director Economy, Enterprise and Operations 233 - 246 13. Review of Recommendations Arising from Accounts Commission Audit of Senior Officer Exit Packages Report by Executive Director Education, Housing and Communities 247 - 274 Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Watching the Meeting You can watch the webcast live by going to: http://www.moray.gov.uk/moray_standard/page_43661.html Webcasts are available to view for 1 year following the meeting. You can also attend the meeting in person. If you wish to attend in person, please come to the High Street entrance door and a member of staff will let you into the Chamber. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 5pm three working days prior to the day of the meeting, please see Standing Order 36 for deadlines. A copy of any written answer provided by the Chair will be published on the Council’s committee management system by 12pm the day before the meeting. The Member who has put the question may, after the answer has been published, may ask one supplementary question directly related to the subject matter at the meeting, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Scott Lawrence (Chair) Councillor Theresa Coull (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor John Divers (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Paul McBain (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Councillor Sonya Warren (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 10 September 2025 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Tracy Colyer, Councillor Theresa Coull, Councillor John Divers, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Scott Lawrence, Councillor Marc Macrae, Councillor Paul McBain, Councillor Sonya Warren, Ms Margaret Wilson, Councillor Neil McLennan joined part way through Item 11. APOLOGIES Councillor John Stuart IN ATTENDANCE Chief Executive; Executive Director Economy, Enterprise and Operations; Chief Financial Officer (Depute S95 Officer); Head of Operations and Environment; Head of Housing, Property and Communities; Head of Service and Deputy Chief Officer, Moray Integration Joint Board; Service Manager Internal Audit and Risk; Service Manager Legal Services; Service Manager Education Estate; Assistant FMS and Banking Manager; Records and Heritage Manager and Caroline O'Connor, Committee Services Officer, all Moray Council; and Angela Pieri, Grant Thornton - External Auditors. 1. Chair The meeting was chaired by Councillor Scott Lawrence. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. 3. Resolution The Chair sought agreement from the Council in terms of Section 50A (4) and (5) of the Local Government (Scotland) Act 1973, as amended, the public and media representatives be excluded from the meeting for Item 11 of business on the ground that it involves the likely disclosure of exempt information of the class. Councillor Keith referred to the meeting of this Committee on 12 February 2025 when he had moved the initial Internal Audit Review on St Giles Centre Non-Domestic Item 3. Page 5
Page 6
Rates be discussed in the open session of the agenda given the level of public interest in how the Council arrived at its decision to enforce the collection of non- domestic rates liability and on the balance of harms, it was in the public interest to deal with the matter in public. In terms of consistency, Councillor Keith sought to move Item 11 on the agenda into the open session as he felt it was important to be open and transparent with the investigation's findings. This was seconded by Councillor Fernandes. The Chair referred to consistency in terms of the reasons why it was held in confidence in February and sought clarification from the Service Manager (Legal Services). In response, the Service Manager (Legal Services) advised while she had not attended the meeting in February, the advice provided by the Monitoring Officer at that meeting regarding the reasons for the report being held in confidence remained, that to do so would allow for more candid discussion and would allow for it to be discussed more fully. In acknowledging the public interest, she advised this could be addressed by the Chair agreeing to issue a press release on the information contained in the report, noting there would still be sensitivity around some of the details to be publicly shared. As an amendment Councillor Gordon moved the Resolution as the public did not have access to the report so would be listening to a debate slightly out of context without all the information. This was seconded by the Chair who confirmed he was in favour of the report being heard in the confidential section to allow more robust discussion as had been the case at the meeting on 12 February, following the advice of the Service Manager (Legal Services) and was in agreement with providing a public statement following the meeting sharing as much information within the constraints highlighted. On a division there voted:- For the Motion (4) Councillors Keith, Fernandes, Divers, Macrae For the Amendment (8) Councillors Gordon, Lawrence, Bloomfield, Colyer, Coull, Gatt, McBain, Warren Abstentions (0) Accordingly the Amendment became the finding of the meeting and the Committee agreed to consider Item 11 in the confidential section of the agenda. The meeting resolved that in terms of Section 50A (4) and (5) of the Local Government (Scotland) Act 1973, as amended, the public and media representatives be excluded from the meeting for Items 10 and 11 of business on the grounds that it involves the likely disclosure of exemption information of the class. Para number of the minute Para Number of Schedule 7a 10 Para 14 Information relating to any action taken in connection with the prevention, investigation or prosecution of crime Page 6
Page 7
11 Para 6 Information relating to the financial or business affairs of any particular person(s) In terms of Standing Order 36, Councillors Marcrae, Keith and Fernandes requested that their dissent at the decision be recorded. 4. Minute of meeting of 24 June 2025 The minute of the meeting of 24 June 2025 was submitted and approved. 5. Written Questions ** The Committee noted that no written questions had been submitted. 6. Internal Audit Section Update Report The meeting had before it a report by the Service Manager (Internal Audit and Risk) providing an update on the work of the Internal Audit Section. Ms Wilson entered the meeting during discussion of this item. In response to question from Councillor Gordon asking why there was such lengthy extension in terms of the revised implementation date in audit recommendation 5.3 of Appendix 2, the Service Manager (Internal Audit and Risk) advised this was due to additional requirements from new legislation in terms of record keeping and submission of electronic forms along with a change in service delivery from Registrars to Environmental Services. During discussion concerns were raised by a number of Councillors regarding significantly lengthy extensions in terms of revised implementation dates for outstanding audit recommendations 5.1, 5.3 and 5.6 contained in Appendix 3 querying the reasons for the extensions given the importance of having robust emergency planning policy and procedures in place. In order to provide assurance, the Head of Operations and Environment confirmed the new Emergency Planning Officer had recently taken up position; much work had been taking place to revise practical preparedness response plans which would be referenced as General Emergency Plan with arrangements in hand to bring the Plan to Economic Development and Infrastructure Services Committee in November and she was meeting with the Interim Chief Social Work Officer to finalise the Care for People Plan. To provide further assurance the Chief Executive confirmed a briefing for Elected Members was planned in November to give an overview of the procedures and roles which would inform the Annual Report to be brought to Committee. In response to a question from Councillor Warren asking if there was confidence that Internal Audit could deliver the 2025-26 Audit Plan across the Council, MIJB, Grampian Valuation Joint Board and Growth Deal to provide a robust annual audit opinion, the Service Manager (Internal Audit and Risk) confirmed he had set a challenging audit plan in order to deliver a range of projects however was confident the plan could be delivered, with possibly the exception of one project to be carried forward to next year’s audit plan. Noting that staff resources were tight and there were areas in MIJB where greater support should be available, he confirmed Page 7
Page 8
discussions were ongoing with MIJB and the Chief Executive regarding additional resources. The Chief Executive agreed it was important to set an audit plan that could be delivered along with realistic timescales for implementation of recommendations and the Corporate Leadership Team would be working to improve performance on delivering against the audit recommendations to assist delivery of the audit plan. In noting there were a number of outstanding audit recommendations, Councillor Gordon asked whether the auditor had a ledger of incomplete actions which could be shared with members for clarity of all outstanding actions. In response the Service Manager (Internal Audit and Risk) referred to the list of follow-up reviews due to be undertaken included in Appendix 1 which provided members with assurance regarding monitoring of reviews. He advised it would be possible to include audit reports for each one listed however the agenda papers would increase in size and as an alternative suggested Members raise queries on any audit reports direct with him. The Chair agreed there was an appropriate level of oversight in terms of the Audit Plan, reports and updates provided. Following consideration the Committee unanimously agreed to note the contents of the report. 7. Internal Audit Review - Banking and Reconciliation The meeting had before it a report by the Service Manager (Internal Audit and Risk) advising Committee on an internal audit review completed for the period from 24 June 2025 to 10 September 2025. In relation to unallocated income referenced in audit recommendation 1 of Appendix 1, Councillor Warren asked for more information on the work undertaken to ensure all income received is promptly identified, allocated and reconciled. In response the Service Manager (Internal Audit and Risk) advised accurate procedures were in place however it related more to a timing issue in terms of enquiries that needed to be actioned by contacting the bank to identify the source of the money. The Assistant FMS and Banking Manager provided assurance procedures were now in place to ensure all income is identified and reconciled within one calendar month. Following consideration the Committee unanimously agreed to endorse the recommendations contained in the report. 8. Internal Audit Review - Residential Care The meeting had before it a report by the Service Manager (Internal Audit and Risk) advising Committee on an internal audit review completed for the period from 24 June 2025 to 10 September 2025. On the invitation of the Chair, due to many of the recommendations relating to digitisation of the process, the Head of Service/Deputy Chief Officer, MIJB provided an update on the status of the replacement of the CareFirst system confirming that full implementation of the replacement system will be by March 2027. With reference to Recommendation 4 of Appendix 1 regarding the delay in financial assessments of between 5 - 12 weeks, Councillor Warren asked what urgent steps Page 8
Page 9
have been taken to eliminate the delay to provide families with earlier clarity and avoid the council making unnecessary overpayments. In response, the Head of Service / Deputy Chief Officer MIJB, noting the new system would not be operational until March 2027, confirmed in the interim processes and procedures had been reviewed and implemented to improve flow of information and reduce timescales of financial assessment and completion. In response to a question from Councillor Keith in relation to Recommendation 3 of Appendix 1 asking whether homeworking was a contributing factor in the unknown location of files as a result of there being no system for documenting the location of records, the Head of Service / Deputy Chief Officer MIJB provided assurance there was now a system in place meaning there was no longer an issue with file locations as all new files are being scanned into the system and backlog files are being processed through the mailroom. Following consideration the Committee unanimously agreed to endorse the recommendations contained in the report. 9. Public Sector Internal Audit Standards - External Quality Assessment of the Internal Audit Section - Follow Up Review The meeting had before it a report by the Service Manager (Internal Audit and Risk) providing Committee with an update on the implementation of the recommendations detailed within the external quality assessment undertaken on the Council's Internal Audit Section. Councillor Gordon, while noting the Committee had previously been assured the internal audit section operate without obstruction and impartiality, asked why the external auditors had given a score of 1 for "Generally Conforms" as set out in paragraph 2.1 of Appendix 1. In response, the Service Manager (Internal Audit and Risk) advised while he reports to the Chief Governance Officer, Executive Director and Chief Executive, according to the standards he functionally reports to this Committee and the external auditors considered there needed to be reinforcement of that independence within the authority. He further advised that reinforcement had been done in the Scheme of Delegation, the Financial Regulations and in terms of the new management structure with a direct reporting line to the Chief Executive, Chair of this Committee and Council Leader. In accordance with CIPFA Guidelines, a meeting between the Service Manager and members in private without management was also scheduled which provided further assurance of internal audit reporting without interference from management. Following consideration the Committee unanimously agreed to note the contents of the report. 10. Internal Audit Review - Secondary School Buildings and Grounds Security [Para 14] The meeting had before it a report by the Service Manager (Internal Audit and Risk) advising Committee on an internal audit review completed for the period from June 2025 to 10 September 2025. Page 9
Page 10
Following consideration the Committee unanimously agreed to endorse the recommendations contained in the report. 11. Internal Audit Follow Up Review - St Giles Shopping Centre - Non- Domestic Rates [Para 6] The meeting had before it a report by the Service Manager (Internal Audit and Risk) asking Committee to consider a follow up review undertaken by the Internal Audit Section to evidence implementation of audit recommendations. Councillor McLennan joined the meeting during discussion of this item. During discussions regarding Recommendation 3 of Appendix 1, Councillor McLennan raised concerns and moved two additional recommendations namely:- (ii) that the Information Governance Service liaise with the Scottish Information Commissioner on the reviewed Guidance to ensure accountability and provide assurance; and (iii) the "Guidance" be upgraded to "Policy" The Chair sought a seconder for Councillor McLennan's motion. On failing to secure a seconder, the motion fell and the Committee therefore agreed to note the contents of the report. In terms of Standing Order 36, Councillor McLennan requested that his dissent at the decision be recorded. Page 10
Page 11
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Section Update Report 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to consider an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 Global Internal Audit Standards require the Service Manager Internal Audit and Risk to prepare and present reports to the Committee on the internal audit’s activity, performance relative to its Audit Plan and any other relevant matters. 2.2 This report provides an update on audit activity and projects progressed since the last meeting 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers and notes the contents of this report and seek clarification on any points. Dafydd Lewis Service Manager Internal Audit and Risk Item 5. Page 11
Page 12
4. BACKGROUND AND CONTEXT Internal Audit Plan Update 4.1 The Audit Plan is a means of determining the priorities of the internal audit activity and how these align with the broader goals of the Council. Enclosed in Appendix 1 is an update on the progress made by the Internal Audit Section in completing audit review projects detailed within the Annual Audit Plan. Grampian Valuation Joint Board - Internal Audit Annual Report 2024/25 4.2 The provision of an internal audit service to the Grampian Valuation Joint Board is provided by the Internal Audit Section of the Moray Council. The Joint Board’s financial systems align with those of the Council, but an annual internal audit review and testing of transactions specific to the Assessor’s Service is required to provide assurances for the separate annual financial statements the Board must prepare and publish. It is pleasing to report that based on the audit work completed, reasonable assurance can be placed on the adequacy and effectiveness of the system of internal financial control established within the Assessor’s Service for 2024/25. Internal Audit Plan 2026/27 4.3 Preparation for the Audit Plan for 2026/27 has started. Internal Audit’s approach to annual audit planning is risk-based, with all areas subject to audit review contained within an ‘audit universe.’ The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems. 4.4 In accordance with the Global Internal Audit Standards, the Service Manager Internal Audit and Risk is responsible for preparing the Annual Audit Plan. However, consultation on projects for review will be undertaken with Senior Officers and Members of this Committee. In addition, this will also provide the opportunity to remind officers of established timescales for responding to requests for information during an audit review and to the recommendations within the audit report. However, I do appreciate the significant workload demands on officers and will always try to accommodate any requests for timescale changes in reporting requirements. Chartered Institute of Public Finance and Accountancy (CIPFA) Publication – Audit Committees - Practical Guidance for Local Authorities and Police 2022 Edition 4.5 The CIPFA publication Audit Committees – Practical Guidance for Local Authorities and Police (2022 Edition) provide guidance on the functions and operations of audit committees and sets out CIPFA’s view of best practice for local authorities across the United Kingdom. A report was submitted to this Committee on 24 June 2025 (paragraph 11 of the minute refers), outlining the outcomes of a self-assessment and evaluation workshop undertaken with Members against the standards of good practice detailed in the CIPFA Guidance. A further requirement of the CIPFA Guidance is for the Service Manager Internal Audit and Risk, to meet privately with Members of the Audit and Scrutiny Committee at least once a year. This meeting enables Members to seek assurance that the Service Manager Internal Audit and Risk is free to determine the scope of internal audit work without interference and to discuss any governance issues within the Council that may be of concern. In addition, the meeting can also provide the “opportunity to test out a question on the auditor, perhaps when the audit committee member is not sure if it is an appropriate question to ask”. Page 12
Page 13
4.6 Further to the meeting held with Members on 23 September 2025, I am pleased to confirm that there has been no interference by management in the work undertaken or in the reporting of the Internal Audit Section. The meeting also provided an opportunity to discuss governance issues for further consideration, including the role of this Committee in accordance with the Global Internal Audit Standards to support the overall effectiveness of the internal audit function. Follow-Up Reviews 4.7 Internal Audit reports are regularly presented to members, detailing not only findings but also the responses by management to the recommendations, with agreed dates of implementation. Internal Audit will also undertake follow-up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow-up reviews: Following the Public Pound 4.8 This follow-up review assessed the implementation of recommendations from an audit of a “Following the Public Pound” review. The scope of the audit reviewed the Council’s governance and funding arrangements regarding Moray Leisure Limited for the management of a leisure centre in Elgin and the Moray Citizens Advice Bureau for providing support and advice on a number of different topics, including benefits entitlement, housing, consumer issues, debt and money management. Whilst Moray Citizens Advice Bureau is not specifically categorised as an Arms Length External Organisation (ALEO), the Council has a significant funding contribution and has therefore been included in this review. The follow-up review has found progress in the implementation of the recommendations, but a number remain outstanding, resulting in a need to agree on revised implementation dates. The Follow-Up Report, which evaluates the implementation of the agreed recommendations, is provided in Appendix 2. Moray Integrated Community Equipment Store 4.9 An audit was previously undertaken of the Occupational Therapy Store, now known as the Moray Integrated Community Equipment Store. Occupational therapy stock comprises aids and equipment issued to help individuals with various daily tasks, including cooking, dressing, and bathing. Stock items can vary in value, ranging from a few pounds to upwards of £1,000 for certain types of hoists and specialised seating. A particular feature of this Store is that it also handles the return of equipment that is no longer required. Where possible, this equipment is decontaminated and made available for reuse. The follow-up review found progress in implementing the recommendations; however, some remain outstanding and require agreement on revised implementation dates. The Follow- Up Report, which evaluates the implementation of the agreed recommendations, is provided in Appendix 3. Keith Sports and Community Centre 4.10 This follow-up review assessed the implementation of recommendations from an audit of the Keith Sports and Community Centre. The audit evaluated the effectiveness of internal controls related to income and expenditure. It also included a review of the income collection and monitoring arrangements for the FitLife? membership scheme. Additionally, the audit examined whether the processing of debit and credit card transactions complies with the Payment Card Industry Data Security Standard. The follow-up review noted the implementation of the recommendations contained within the audit report, with the Service undertaking ongoing recovery of outstanding FitLife? membership fees due to the Page 13
Page 14
Council. The Follow-Up Report reviewing the implementation of the agreed recommendations is provided in Appendix 4. Commercial Refuse 4.11 This follow-up review concerns a previous audit undertaken of the controls in the management of the Commercial Refuse Collection Service. The audit examined the accounting arrangements for commercial trade waste income and expenditure. This included a check that mandatory trade waste agreements are in place for all commercial waste customers. Findings included a need to review charges for collecting and disposing of commercial waste to reflect current operational arrangements. It is pleasing to note that significant progress has been made in implementing the recommendations; however, some remain outstanding. The Follow-Up Report reviewing the implementation of the agreed recommendations is provided in Appendix 5. Banking and Reconciliation 4.12 A follow-up review was undertaken to evidence implementation of recommendations included within an audit report reviewing the Council’s banking and reconciliation arrangements. The Council receives significant funds through its bank accounts and operates three main bank accounts to manage incoming funds, all of which were reviewed as part of this audit. The review checked that systematic processes are in place to manage incoming funds for the timely and accurate reconciliation of these accounts. The audit report detailed a need for some administrative improvements, and it is pleasing to note from the follow-up review undertaken that all recommendations have been implemented. The Follow-Up Report is provided in Appendix 6. 5. PROPOSALS 5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the period from 10 September 2025 to 19 November 2025. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × Page 14
Page 15
6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. Page 15
Page 16
6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 16
Page 17
APPENDIX 1 Internal Audit Annual Work Programme- 2025/26 Update Report CORE SYSTEM REVIEWS Auditable Area Type of coverage Status/ Comments Payroll Continuous auditing to confirm the adequacy of the systems and procedures for paying salaries. The intention is to make further use of an auditing software application in the analysis of data and the sample selected for testing. Audit programmed to start in the next quarter(s) Procurement and Creditor Payments Continuous auditing of samples of non-payroll expenditure to test compliance with procurement and payment processing regulations. The intention is to make further use of an auditing software application in the analysis of data and the sample selected for testing. Completed Final Report issued Democracy and Governance Review administrative arrangements established to support effective democracy, governance and committee reporting arrangements. The audit will include reviewing policies and checking a sample of meetings/papers/action logs to ensure adequate and timely information is provided as required and requested to aid informed decision making. Fieldwork Completed Draft Report Prepared Banking and Reconciliation To obtain assurance that adequate procedures are in place, ensuring accurate, timely reconciliations of income received and any differences are addressed promptly. A review of the banking arrangements will also be undertaken. Completed Final Report issued Absence Management An audit will consider the effectiveness of sickness absence monitoring and reporting. This will include the arrangements from within the Council and the Moray Integration Joint Board. Completed Final Report issued Page 17
Page 18
SERVICE REVIEWS Auditable Area Type of coverage Status/ Comments National Non-Domestic Rates To ensure that Business Rates billing and collection arrangements are robust and that reliefs awarded are adequately supported. Completed Final Report issued Moray Growth Deal Follow Up A follow up review to evidence implementation of the recommendations agreed within the audit undertaken in 2024/25 Audit Plan of the governance and administrative arrangements within the management of the Moray Growth Deal. Completed Final Report issued Levelling Up Fund An overview of the governance and administrative arrangements within the Council for the management of the Levelling Up Fund. Fieldwork in progress Capital Plan Audit testing of contract management arrangements for selected project(s) within the capital plan. Audit programmed to start in this quarter Education – Secondary School Establishment visits as part of cyclical review. Further to the consultation with the service, additional testing will be undertaken in the use of purchasing cards. Audit programmed to start in the next quarter(s) Commercial Harbours A review of commercial harbours regarding the accounting arrangements of income and expenditure. The audit will review operating activity against Council Policies and Procedures. Audit programmed to start in the next quarter(s) Management of School Funds Review the processes in the management and control of School Funds. Audit programmed to start in this quarter. Common Good Funds An audit of the accounting arrangements and procedures in the management of Common Good Funds. Fieldwork in progress Adult Care Commissioning- Follow up review KPMG review Follow up review to evidence implementation of the recommendations detailed within the KPMG Adult Social Care Commissioning audit. Fieldwork in progress Transportation- Education Review operating arrangements to ensure compliance with the conditions of contracts and compliance with Council Financial Regulations and Procurement Guidelines in managing school transport contracts. Fieldwork in progress Page 18
Page 19
MORAY INTEGRATION JOINT BOARD Auditable Area Type of coverage Status/ Comments Complex and Challenging Behaviour Services Review of systems and procedures within Complex and Challenging Behaviour Services in the management of Woodview and Barlink Social Work Establishments. Completed Final Report issued Non-payroll expenditure A review of non-payroll expenditure to test compliance with Financial Regulations, procurement and payment processing regulations. An auditing software application will be used in the analysis of data and the sample selected for testing. (Further to discussions with the Chief Officer, it has been agreed to change the planned audit regarding support for carers to a review of non-payroll expenditure. This is due to the Service's ongoing implementation of a recent update to the Unpaid Carers Strategy. A review of support for carers will be considered for inclusion within a future Audit Plan). Fieldwork Completed Draft Report Prepared Social Care Financial Assessments/ Contributing to your Care An audit to check the processes and accounting arrangements in the charging of care to service users. Audit programmed to start in the next quarter(s) GRAMPIAN VALUATION JOINT BOARD Auditable Area Type of coverage Status/ Comments Grampian Valuation Joint Board In accordance with the Public Sector Internal Audit Standards applicable to local government and joint boards, an annual review is required of Grampian Valuation Joint Board activities. Completed VERIFICATION ACTIVITY Auditable Area Type of coverage Status/ Comments Year End Stock Valuations Verification of Year End Stock Verification for Building Services/ Environmental Services/ Community Services Stores. Completed Year end stock valuations agreed Network Support Grant Ongoing certification requirements for the Network Support Grant to Transport Scotland. Ongoing Half yearly audit certification requirement. Last Network Support Grant certified to 30/06/2025. Page 19
Page 20
COUNTER FRAUD ACTIVITY Auditable Area Type of coverage Status/ Comments Counter Fraud Review Annual review of the Council's counter fraud framework to minimise the risk and impacts of fraud from internal and external threats. The scope of the audit and testing undertaken will be informed by frauds reported within other organisations. Fieldwork Completed Draft Report Prepared National Fraud Initiative The National Fraud Initiative (NFI) is a data-matching project conducted by the Cabinet Office on behalf of Audit Scotland every two years. It involves a data- matching exercise using information from various Council systems, as well as data provided by other councils and organisations. Ongoing The 2024/25 NFI exercise is ongoing. The agreed approach is for services to review and document the reasons for data matches, while the Internal Audit Section investigates potential fraud, monitors progress, and reports on the outcome. FOLLOW-UP REVIEWS DUE TO EVIDENCE IMPLEMENTATION OF OUTSTANDING RECOMMENDATIONS FROM PREVIOUSLY ISSUED AUDIT PROJECTS – 2025/26* * Additional follow-up reviews may be added depending on the implementation dates for recommendations detailed by services Audit Undertaken Scope of Audit Review Self Directed Support (SDS) – Option 2/3 The scope of the audit was to review systems and procedures in the delivery and management of adult social care provided under Options 2 and 3 of the SDS scheme. This included examination of the processes to support individuals in determining their preferred care delivery option, contractual relationships with care providers, financial management and monitoring of individual care packages. Emergency Planning The objective of this audit was to provide assurance over the adequacy and effectiveness of current controls over emergency planning. The audit scope included a check to ensure adequate training, planning and testing has been developed in the event of an emergency. Pool Cars Scheme The scope of this audit was to review systems and procedures in the management and use of pool cars. Policies and procedures were checked to ensure they provide appropriate operating guidance to officers in the booking and use of pool cars. The audit included a review of arrangements for internal recharging to services and also exploration if further use of pool cars could provide additional value for money opportunities to the Council. Moray Integrated Community Stores The audit reviewed the management of the Moray Integrated Community Stores. This included reviewing the procedures for ordering and issuing occupational therapy equipment to service users. Page 20
Page 21
In addition, a check was made to compare stock records to the actual equipment held within the Stores. Special Investigation – St. Giles Shopping Centre – Non-Domestic Rates The Interim Chief Executive requested an internal audit to review the collection arrangements of non-domestic rates for the St Giles Shopping Centre, Elgin, over the last 2 years. This also required an overview of the Council’s systems and procedures in the management of the billing and collection arrangements for non-domestic rates. Special Investigation – Windows Replacement Programme The audit scope was to check the contract for manufacturing replacement windows for properties at Carnie Place. This involved discussions with officers, review of documentation, emails, and minutes of meetings in the administration of this contract. The audit also undertook a physical inspection with the support of an officer in Property Services to confirm the stock of windows stored by Building Services. Children's Services Care Commissioning The audit scope was to review and assess the commissioning of social care services for children. Services delivered included contracts for preventative, support and restorative services, residential care, and out of area residential placements required due to the limited provision of specialised care and capacity within Moray. Food Standards Scotland Guidelines The audit reviewed systems and procedures used by the Council's Environmental Health Service to evidence compliance with the Food Law Code of Practice (Scotland) developed by Food Standards Scotland. Following the Public Pound The Internal Audit Plan provided for a “Following the Public Pound” review to ensure proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Councils fund Arms Length External Organisations (ALEOs) to provide important services to the public. These funding arrangements are often more complex than purchase contracts for goods or services but can bring both financial and operational benefits to councils. Procurement and Creditor Payments A review of payments made to suppliers of goods and services was undertaken. The purpose of the audit was to confirm compliance with Financial, Authorisation, Procurement and Creditor Payment Processing Regulations from the sample checked. The review formed part of the annual continuous auditing activity of non-salary expenditure and is used to support the Service Manager Internal Audit and Risk’s annual opinion of the Council’s internal control system. Housing Rent Collection & Arrears Management The audit scope was to review the key operational controls regarding rent collection and arrears management of current and former tenant rents. The aim of the audit was to look at the controls and processes existing over the administration of rent accounts, accounting fully and promptly for monies collected. Keith Grammar School The scope of this audit was to review the operation of the Devolved School Management Scheme in terms of funding allocation and management at the school level. Consideration was given to how budgets are affected by National, Council and School priorities. Page 21
Page 22
Appendix 2 1 Final Internal Audit Report (Follow-up Review) Following the Public Pound September 2025 Distribution: Chief Governance Officer Service Manager Leisure & Culture Service Manager Benefits & Money Advice The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 3 Priority 2 2 Priority 3 - Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 22
Page 23
Appendix 2 2 Contents Page Following the Public Pound 1. Introduction & Scope 3 2. Key Issues 4 Detailed Report 3. Findings/Recommendations 5-14 4. Management Response 6-15 5. Follow Up Review 7-15 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 23
Page 24
Appendix 2 3 1. Introduction and Audit Scope The Internal Audit Plan for 2024/25 provided for a “Following the Public Pound” review to ensure proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Councils fund Arm’s Length External Organisations (ALEOs) to provide important services to the public. These funding arrangements are often more complex than purchase contracts for goods or services but can bring both financial and operational benefits to councils. Audit Scotland describes an ALEO as an organisation that is ‘formally separate to the council but is subject to its control or influence.’ Ownership, provision of funding, and significant shareholdings in a company indicate significant control or influence and therefore constitute an arm’s length relationship with an external organisation. A council is responsible for ensuring that Audit Scotland’s ‘Following the Public Pound’ principles are consistently applied by any ALEOs that it provides funding to and must ensure that ALEOs can demonstrate value for money. A ‘Code of Guidance on Funding External Public Bodies and Following the Public Pound’ was published by the Convention of Scottish Local Authorities (COSLA) and the Accounts Commission in 1996, detailing principles and requirements that should be considered when determining funding for ALEOs. This Code along with more recent publications from Audit Scotland including "Arm's length external organisations (ALEOs): are you getting it right?" (2011) and "Following the Public Pound" (2004 and 2005) was also considered in the development of the audit programme for this review. The audit scope did not include checking the procedures for small charitable donations or external bodies where the Council has entered into a contractual relationship. The audit has instead reviewed the arrangements in place with regard to Moray Leisure Limited for the operational management of a leisure centre in Elgin, and the Moray Citizens Advice Bureau for providing support and advice on a number of different topics, including benefits entitlement, housing, consumer issues, debt and money management. Whilst Moray Citizens Advice Bureau is not specifically categorised as an ALEO, the Council has a significant funding contribution and has been included in this review. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Page 24
Page 25
Appendix 2 4 2. Key Issues • Moray Leisure Centre operated by Moray Leisure Limited, was established as an ALEO in 1993, and in addition to Council operated sports and community centres contribute to meeting the leisure and sporting needs of Moray. The audit noted that reviews have been undertaken over the last 10 years regarding the future delivery direction for leisure services. A Moray Sport and Leisure Asset Review report by the Depute Chief Executive (Education, Communities and Organisational Development) to the Moray Council Committee on 26 June 2024 (item 12) agreed to procure a company called Alliance Leisure to conduct a comprehensive leisure assets review for Moray. The purpose of this review is to establish an evidence base to guide future strategic planning, investment decisions and management practices concerning leisure assets, including Moray Leisure Centre. The audit notes and concurs with the recommendations for a report to “be presented back to Council within 6 months detailing the findings of the asset review”. • In accordance with recommended guidance and the Council’s Financial Regulations, there should be a written agreement between the Council and an externally funded body. It was noted that written agreements in the form of Service Level Agreements (SLAs) had previously existed between the Moray Council and Moray Leisure Ltd and Moray Citizens Advice Bureau (CAB) but had expired in 2018 and 2019, respectively. An SLA will provide a contractual relationship detailing expectations in service delivery, funding requirements and performance monitoring reporting to evidence how these Organisations contribute to meeting the Council's strategic plans. • A requirement of the Moray Leisure Limited’ Articles of Association is to appoint 3 elected members as directors on the Board. Moray Citizens Advice Bureau requests that 2 elected members attend Board meetings in an advisory capacity. As part of this audit review, discussions were held with the elected members on both Boards to ensure there was a clear understanding of the roles and possible limitations of their duties. Feedback from elected members noted a need for further guidance to clarify expectations and possible parameters in responsibilities as elected members representing the Council within the Boards of these Organisations. Page 25
Page 26
5 Findings/Recommendations - Following the Public Pound 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 High As detailed within the Financial Regulations, the Council has adopted the principles of the COSLA / Accounts Commission's ‘Code of Guidance on Funding External Bodies and Following the Public Pound’. The Code sets out a framework for the Council’s relationships with external bodies through which they seek to carry out some of their functions other than on a straight-forward contractual basis. In accordance with the “Code”, and as detailed within the Financial Regulations, there is a requirement for a written agreement between the Council and the external bodies. It was noted that written agreements in the form of Service Level Agreements (SLAs) had been established between the Moray Council and Moray Leisure Ltd and the Moray Citizens Advice Bureau. However, the SLAs expired in 2018 and 2019 respectively. An SLA provides a formal agreement that describes the scope and quality of services to be delivered by the external bodies. In addition, the SLAs should also detail the performance information to be provided by both Organisations that will allow effective monitoring arrangements to ensure Council objectives are met and Best Value achieved Service Level Agreements should be agreed between the Council and the Moray Leisure Ltd and Moray Citizens Advice Bureau detailing the core activities that each Organisation is expected to deliver along with key performance indicators against which they will be measured. Page 26
Page 27
6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Sport and Culture Service Manager Benefits and Money Advice Manager Yes Yes 31/12/2024 31/12/2024 A new draft Service Level Agreement was collectively drafted between management staff across Moray Council and Moray Leisure Centre in mid-2021 – this agreement was not formally signed/sanctioned at the time due to the future expansion plans, which was highlighted in the Committee reports on the MLC expansion plans. This draft agreement will be reviewed and updated by the Management teams of both organisations with input from legal advisers prior to sign-off. A review of the Service Level Agreement with Moray Citizens Advice Bureau is currently underway and a draft will be reported to the relevant committee prior to completion. Page 27
Page 28
7 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Not Implemented Not Implemented 28/02/2026 30/11/2025 Further to a meeting of the Moray Council on 24 September 2025, the Executive Director Education, Housing and Communities provided a progress update report on the sport and leisure transformation including future service proposals and the asset management approach for the leisure estate. A revised date to sign off the Service Level Agreement has been agreed for 28 February 2026. A draft Service Level Agreement has been prepared; however, this has yet to be agreed and signed by both the Council and the Citizens Advice Bureau Moray. A revised date has been agreed with the Service for 30 November 2025. Page 28
Page 29
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 High The Moray Council entered into a 25-year lease in 1993 with Moray Leisure Ltd to operate a leisure centre from a Council owned building. The lease was extended by two, one-year extensions until July 2020. A report by the Depute Chief Executive (Education, Communities and Organisational Development) to a special meeting of Moray Council on 17 December 2019, approved a 10-year extension to the existing lease agreement. An extended lease agreement would provide Moray Leisure Ltd with additional security and greater value for money opportunities for leasing equipment and supporting better negotiation opportunities for improved energy deals. A new draft agreement has been prepared in draft format but has yet to be finalised. Currently, Moray Leisure Ltd operates on a monthly contractual agreement with the Council. It is appreciated that necessary delays have been required due to consideration and amendments needed regarding the proposed expansion scheme of the leisure centre. The audit is also aware of uncertainties regarding this proposed expansion scheme, in addition to the recent commissioning of a company called Alliance Leisure to undertake a comprehensive leisure assets review for Moray. However, there is a need to formalise current arrangements with an agreed lease agreement between the Council and Moray Leisure Ltd. Current uncertainties regarding expansion and the delivery of future leisure services are appreciated, however a lease agreement between the Council and Moray Leisure Ltd should be agreed as a matter of priority. Page 29
Page 30
9 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Governance, Strategy & Performance Yes 31/12/2024 The Council’s legal advisers will co-ordinate with the agents of Moray Leisure Limited to support the completion of a lease agreement within the specified timescale. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Not Implemented 28/02/2026 A revised lease agreement has not yet been agreed with Moray Leisure Limited. It is understood that an interim arrangement exists, with a lease on a year-to-year basis. Further to the report by the Executive Director Education, Housing and Communities to the meeting of the Moray Council on 24 September 2025 referred to in Finding 1, a revised implementation date for this recommendation has been agreed for 28 February 2026. Page 30
Page 31
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 High During the course of this audit, a Moray Sport and Leisure Asset Review report by the Depute Chief Executive (Education, Communities & Organisational Development) to the Moray Council Committee on 26 June 2024 (item 12) agreed to procure a company called Alliance Leisure to undertake a comprehensive leisure assets review for Moray. The purpose is to establish an evidence base to guide future strategic planning, investment decisions and management practices concerning leisure assets, including Moray Leisure Centre. It was noted that over the last 10 years, other reviews have been undertaken to explore future delivery options for leisure services. The internal audit undertaken agrees with the committee report recommendation to detail the findings of the asset review to the Council within the next 6 months. Internal Audit concurs with the recommendation detailed within the Moray Sport & Leisure Asset Review Report to Moray Council Committee on 26 June 2024 (item 12) that on conclusion of the external review, findings should be used “to provide further evidence base that will contribute to the design of our future leisure estate”. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Sport and Culture Service Manager Yes 31/12/2024 As stated in the Committee report in June, a report will be taken back to Committee before end of Dec 24 detailing the findings of the Alliance Leisure Review alongside other future service design evidence. Page 31
Page 32
11 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Further to a report by the Depute Chief Executive (Education, Communities and Organisational Development) to a Special meeting of Moray Council on 21 January 2025 that provided an update on the findings of the externally commissioned ‘Moray Sports Facilities Review’. The report also considered financial sustainability alongside the prevention agenda in relation to health and wellbeing. It was agreed that a workshop would be held for elected members to discuss rationalisation, governance and service direction. This has subsequently taken place. A further report is intended to be presented to the Council, which will consider long-term financial sustainability. Page 32
Page 33
12 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium In accordance with Financial Regulations, the Council has a requirement for funding external organisations to establish “reporting and monitoring arrangements to ensure Council objectives are met and Best Value achieved”. It is pleasing to note that performance related information is shared with the Council by both Moray Leisure Limited and Moray Citizens Advice Bureau on a regular basis. However, no structured monitoring systems have been established to measure the performance information provided against agreed objectives. Governance arrangements also do not include a requirement of how the performance of each Organisation contributes to Council objectives, which a relevant committee could then scrutinise. Consideration should be given to establishing clear objectives supported by tailored performance indicators that are agreed with Moray Leisure Limited and Moray Citizens Advice Bureau each year. The Council should then monitor performance information provided by each Organisation against these agreed objectives and if necessary, report it to the appropriate committee for scrutiny. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Sport and Culture Service Manager Yes 30/04/2025 Footfall statistics for Moray Leisure Centre are reported as part of the Council’s Service Performance reporting however appreciate these do not align to clear objectives. Intention is to report annually on performance as per performance targets set in the new Service Level Agreement. A report will be presented to Education, Children’s and Leisure Services Committee Page 33
Page 34
13 Benefits and Money Advice Manager Yes 30/04/2025 between April-June annually which will focus on performance measures/achievement based on the previous financial year. Relevant performance objectives and performance reviews will be included in the updated SLA for the Moray Citizens Advice Bureau and will be monitored and reported as appropriate. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Part Implemented Not Implemented 28/02/2026 30/11/2025 For Moray Leisure Centre, performance indicators are currently reported to the Council on a quarterly basis. However, the intention is to further develop performance monitoring through the updated Service Level Agreement. A revised date for implementation has been agreed for 28 February 2026. Requirements relating to performance objectives for Moray Citizens Advice Bureau have been included in the draft Service Level Agreement. This is awaiting agreement. A revised date for implementation has been agreed for 30 November 2025. Page 34
Page 35
14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium It was noted that a requirement of Moray Leisure Limited’ Articles of Association is for the appointment of 3 elected members as directors on the Board. Moray Citizens Advice Bureau requests that 2 elected members attend Board meetings in an advisory capacity. Elected members sitting as board members can provide important links between the Council and the funded bodies and help ensure that the organisations are being properly run and funds used effectively. However, there are disadvantages, with Audit Scotland highlighting the risk of potential conflicts of interest for elected members. As part of this audit review discussions were held with elected members representing the Council on the Boards of Moray Leisure Limited and the Moray Citizens Advice Bureau. Feedback from the elected members noted a need for improved guidance to further clarify their roles, responsibilities and parameters in their duties as elected members representing the Council on the Board of each Organisation. Further to discussions with the Head of Governance Strategy & Performance, the Council should consider and confirm whether to accept the reputational risks associated with perceived conflicts of interest where elected members sit on the boards of funded external bodies. If it is considered to continue with the current arrangement, additional guidance should be provided to elected members to further clarify the roles, duties and parameters of their responsibilities as elected members representing the Council on the board of funded external bodies. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Page 35
Page 36
15 Head of Governance, Strategy & Performance Yes 31/10/2024 Consideration will be given to the perceived risks associated with appointments to outside bodies. Guidance will be refreshed and agreed by the council as appropriate following this consideration. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Guidance on the role of elected members in representing the Council in partnership arrangements and on outside organisations has been updated. In addition, in December 2024, training was provided to Councillors by the Council's internal and external legal advisers, which included the code of conduct in respect of appointments on outside bodies. Page 36
Page 37
16 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 37
Page 38
17 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 38
Page 39
APPENDIX 3 Moray Council Internal Audit Section DEPARTMENT: Health & Social Care Moray SUBJECT: Moray Integrated Community Equipment Stores REPORT REF: 24'013 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective systems and procedures operating to ensure accurate records are maintained to account for all Occupational Therapy equipment held within Stores and issued to Service Users 5.1 A full stock check should be undertaken to ensure records correspond to the actual number of items held within Stores. High Yes 31/03/2024 Implemented – The review confirmed that Stores officers completed a full stock check after implementing new stock management arrangements. The stock take was verified by an officer from the Internal Audit Section with only minor variances noted between system recorded figures and the actual stock held. Variances were investigated and explanations obtained. Page 39
Page 40
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Items of equipment should be kept wherever possible in Asset Number order within the Stores Building. Asset Numbers should be clearly recorded where possible on shelving. Medium Yes 31/03/2024 Implemented - Asset numbers are now clearly recorded on shelving used for storing equipment. Shelf locations across the store have also been added to the Stores Software Application (ELMS). 5.2 The software application used for purchasing equipment should be regularly updated with the stock issued to ensure an accurate unit price is maintained. Further exploration should be undertaken of ELMS with the purpose of enabling the direct purchase of equipment. Medium Medium Yes Yes 31/03/2024 (Revised Implementation Date 30/06/2025) 31/10/2024 (Revised Implementation Date 30/11/2025) Implemented – The follow-up review found that the separate stores management software application used for purchasing occupational therapy equipment is now being updated when items are issued, to ensure accurate stock valuation. Part Implemented – The follow-up review found that while the purchasing of occupational therapy equipment is still undertaken through a separate stores management software application, the Service is working with the ELMS software provider to develop an accurate Page 40
Page 41
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation stock valuation function. This is nearing completion. A revised implementation date of 30/11/2025 has been agreed with the Service. 5.3 A review should be undertaken of the current policy of revaluing re-used items of equipment at 50% of the original unit price. Medium Yes 31/01/2024 (Revised Implementation Date 30/06/2025) Implemented – It has been agreed by senior management within the service to revalue re- used equipment at 50% of the original purchase price has been reviewed and it has been decided to continue with the policy of 50% revaluation. 5.4 Users of the Service should be advised that any equipment received should be included within their personal property content insurance. Medium No 31/01/2024 (Revised Implementation Date 30/06/2025) Not Implemented – The Service has now decided that individuals will not be required to include occupational therapy equipment under their personal property contents insurance. However, individuals will be advised to inform their insurer if the equipment has a structural impact on their property. 5.5 Maximum and minimum stock levels should be implemented in ELMS to assist officers in ensuring the effective Medium Yes 31/03/2024 Implemented - The review has confirmed that maximum and minimum stock level functions are now used within ELMS. The Service also Page 41
Page 42
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation management of stock levels. intends to review these stock level parameters regularly. 5.6 A record should be maintained of the stock checks undertaken, and any adjustments to stock figures for equipment recorded within ELMS should require the authorisation of the supervisor. Medium Yes 31/01/2024 Implemented – Records of weekly stock checks are now maintained. It was also confirmed that adjustments to stock levels within ELMS can now only be authorised by Supervisory Officers. 5.7 In regard to the stock of returned specialised chairs noted during the audit review, a decision should be undertaken regarding their future use. Medium Yes 31/03/2024 Implemented - The Service has decided to retain the chairs. A meeting between officers from the Equipment Stores of Aberdeen City, Aberdeenshire and Moray agreed to explore options regarding the use of these chairs and other equipment within the Grampian area. In addition, the Service has advised that the chairs could be adapted to meet the specific needs of individuals, potentially providing an alternative to procuring new items. Page 42
Page 43
Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.8 Further development should be undertaken of ELMS to enable greater use of the software application in the management of stock items. Medium Yes 31/03/2024 Implemented – It was found that the Service is making greater use of the reporting functions within ELMS. In addition, data from ELMS is exported to another software application to allow for greater analysis of information. 5.9 Officers should be instructed to utilise the facility within ELMS to mark stock as out for delivery. Low Yes 30/06/2024 Implemented - Procedures are now in place requiring drivers delivering equipment from Stores to mark equipment as out for delivery within ELMS. 5.10 A review of off contract expenditure should be carried out and where necessary contracts developed. Low Yes 31/03/2024 (Revised Implementation Date 30/06/2025 Revised Implementation Date 31/10/2025) Part Implemented – A review by the Service of expenditure to identify off-contract purchases has been completed. This review highlighted the procurement of specialised chairs, for which a formal contract arrangement is required. A revised implementation date of 31/10/2025 has been agreed with the Service. 5.12 Current operating practices should be recorded within a Service Operating Medium Yes 31/03/2024 Implemented - Operating Procedures are now in place to provide officers with a point of Page 43
Page 44
Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Manual. reference guidance in the administration of the Moray Integrated Community Equipment Store. 5.13 A review of service procedures should be undertaken to ensure the store is informed of a change in circumstance in a service user’s condition where an item of equipment may no longer be required. Arrangements should then be undertaken for collection at the earliest opportunity. If no agreement can be made for an item of equipment to be returned to the store, consideration should be given to invoicing the service user. Medium Medium Yes Yes 29/02/2024 31/01/2024 (Revised Implementation Date 30/11/2025 Revised Implementation Implemented - The Moray Integrated Community Equipment Service is informed of equipment issued to an individual but is no longer required. Testing has confirmed that when informed, arrangements are made for the collection of this equipment. Part Implemented – The Service agreed that where no agreement can be reached for the return of equipment, consideration will be given to invoicing the cost of the item. However, this follow-up review found that the Service has not finalised the arrangements for undertaking this Page 44
Page 45
Moray Council Internal Audit Section 7 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Date 30/11/2025) process. A revised implementation date of 30/11/2025 has been agreed with the Service. 5.14 Improvements identified to the Service during the audit review regarding the physical security of the Occupational Therapy Stores building should be implemented as a matter of urgency. High Yes 31/03/2024 Implemented - A new alarm system has been fitted at the Moray Integrated Community Equipment Store and is now in operation. Page 45
Page 46
APPENDIX 4 Moray Council Internal Audit Section DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Keith Sports and Community Centre REPORT REF: 24'024 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.1 In accordance with Financial Regulations and Petty Cash Guidance, reimbursement of parking fees must be made through an officer’s expenses claim and not from the petty cash account. Low Yes Implemented Implemented – The Keith Sports and Community Centre (Centre) no longer has a petty cash fund; officers will be reimbursed for parking fees by submitting a Mileage & Other Expenses Claim Form to the Payroll Service. Page 46
Page 47
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.2 Details of the numbered receipt provided by a security company for cash collections should be recorded within the income records at the Centre. Medium Yes 30/06/2024 Implemented - Details of the numbered receipt provided by the security company for cash collections are now attached to the income records held at the Centre. 5.3 Officers must use their individual login credentials when using the Gladstone system. Medium Yes 30/06/2024 Implemented – It was noted that officers at the Centre have been reminded to use their individual log-in credentials when logging in and using the Gladstone system. 5.4 A reconciliation between the Gladstone system and FMS should be undertaken to identify service users with no agreed payment plans. New payment plans should then be agreed for the service users identified, or membership should be cancelled. Medium Yes 31/07/2024 Implemented - A reconciliation exercise has been undertaken between the Gladstone system and the Council’s Financial Management System (FMS). It was found that 84 accounts had active membership but with no established direct debit payment arrangement. The total outstanding amount due to the Council has been calculated as £32,652. The Page 47
Page 48
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Service is undertaking action to recover this outstanding income due to the Council. 5.5 Failure in direct debit payments should result in the immediate suspension of a service users FitLife? membership. Medium Yes 30/09/2024 Implemented - The payment of direct debits for FitLife? Membership is now managed through the Gladstone system. Any payment failures are automatically flagged and continued use of membership by a service user is only permitted on payment of the outstanding balance. 5.6 Regular reviews should be undertaken of FitLife? Service users to ensure they remain within the correct category of membership. Medium Yes 30/06/2024 Implemented – The follow-up review has noted that an exercise has been undertaken to identify historical instances of family memberships where a child has turned 18, and a membership status change is required. Monthly procedures are now in place to identify any family membership users where a child will soon be 18 years of age, with contact then made with the account holder detailing a need to amend their membership category. Page 48
Page 49
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.7 A review should be undertaken to assess the need to maintain a Repairs and Works Log. If required, processing of minor work orders should be in accordance with agreed Centre procedures. Low Yes 30/06/2024 Implemented - A review of repair work logs maintained at the centre was carried out and all works were found to be recorded in accordance with local procedures. 5.8 Sporting equipment and clothing bought for re-sale should be purchased in accordance with Procurement Guidelines. In addition, appropriate stock control records should be maintained of sporting clothing and equipment held for resale. Medium Yes 31/08/2024 (Revised Implementation Date 30/06/2025) Implemented – The follow-up review has confirmed that the purchase of sporting equipment and clothing for resale is now in accordance with the Procurement Guidelines. Appropriate stock control records were also found in the management of items held for resale. Page 49
Page 50
Appendix 5 1 Final Internal Audit Report (Follow Up) Commercial Refuse Collection October 2025 Distribution: Head of Operations & Environment Service Manager Environmental Services Waste Manager Administration Officer The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 0 Priority 2 6 Priority 3 4 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 50
Page 51
Appendix 5 2 Contents Page Commercial Refuse Collection 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-23 4. Management Response 5-23 5. Follow Up Review 6-24 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 51
Page 52
Appendix 5 3 1. Introduction and Audit Scope The annual Internal Audit Plan for the 2024/25 year provides for a review to be undertaken of the controls in the management of the Commercial Refuse Collection Service. The audit checked to ensure robust accounting arrangements are followed, and appropriate agreements are in place with customers. The Waste (Scotland) Regulations 2012 require all business producing waste to appoint a registered carrier for disposing of their waste. The Moray Council, as a Professional Collector & Transporter of Waste, collects commercial residual and recycling waste for approximately 1,200 businesses. Analysis of the Financial Management System for 2023/24 detailed the operational cost for delivering a commercial refuse collection service amounted to £725,000, with staffing and vehicle costs as the most significant expenditure items. The annual income collected from commercial waste collection was noted as £922,000. The scope of the audit reviewed the accounting arrangements for commercial (trade) waste income and expenditure and the associated administrative processes. This involved a review of the operational planning and budget monitoring practices and checking the main cost elements of staffing and vehicle expenditure for delivering the service. The income charging and collection arrangements were also reviewed as part of the audit. In addition, a check was made that mandatory trade waste agreements required are in place for all commercial waste customers of the service. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • The audit found no full service costing analysis has been undertaken in the last 5 years. A review should be undertaken to ensure the charges for collecting and disposing of trade waste continue to reflect current operational arrangements. In addition, the review will also provide increased effectiveness in budget monitoring and forecasting processes. • A discrepancy was noted in the current trade waste charges whereby the Council approved a 10% administration fee to be added to charges for collecting trade waste from businesses under sub-contracting arrangements to national waste contractors with customers but no physical presence in Moray. The administration fee was introduced for 2024/25; however the audit found the fee has not been applied to the Page 52
Page 53
Appendix 5 4 charges made to businesses. • • The Waste (Scotland) Regulations 2012 requires a duty of care on all business waste producers to have a formal Trade Waste Agreement. Trade Waste Agreements are sent to customers by post, on initial customer engagement and thereafter, on an annual basis, for each business to agree on and confirm the continuation of the service. This is a time-consuming paper based system; consideration should therefore be given to the development of an electronic method to issue Trade Waste Agreements to businesses and receive return submissions. • Page 53
Page 54
5 Findings/Recommendations - Commercial Refuse Collection 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Low Scottish local authorities have a statutory requisite to provide domestic waste collection services, but there is no requirement to deliver a waste collection service to the commercial sector. The Council's duty concerning trade waste is to provide information and advice to businesses. It was noted that a Commercial Waste Information Guide has been prepared and is available to businesses on the Council website. However, it was compiled in 2014 and some of the information recorded is out of date. Council website content relating to the Commercial Waste Service should be reviewed on a regular basis to confirm continued validity, with updates undertaken of any relevant areas of change. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/10/2024 Review of all online content to be undertaken and any required updates actioned. Page 54
Page 55
6 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Online content of the Council website relating to Commercial Waste Services has been reviewed and updated since the initial audit. The website will continue to be kept up to date with any new content developed by the Service. Page 55
Page 56
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium The audit review found a significant variance between the actual income collected and the budget for several financial years. This has been due to a number of reasons, such as declining trade since the Covid period and a greater awareness of recycling resulting in a reduction in waste to be collected, in conjunction with budget provisions not being wholly realigned to current market factors. However, it was noted that the information available on trade waste contracts with customers is not being used to inform the income budget figure. Consideration should be given to the use of the trade waste sales contract data held to inform income projections and align future budget provisions for improved management information purposes. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/03/2025 Implementation of this recommendation is interlinked with the service costing and charging review referred to at Recommendation 7 below. Budget provisions will be reassessed with Accountancy support following the Council Page 56
Page 57
8 charges review for 2025/26. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Part Implemented 01/04/2026 A substantial Trade Waste charging and income review has been undertaken by the Service and the Accountancy section within 2024/25. However, further revisions are required on the impact of Dallachy landfill site closure and there remains a need to further align income budgets to charging and cost recovery data. This work is ongoing, intended for completion by quarter 3 of the current year, and charging decisions and resulting full year budget amendments will be applied for 2026/27. Therefore a revised implementation date of 01/04/2026 has been agreed. Page 57
Page 58
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Low Analysis of the staffing costs charged to Waste Management Service was found to be correct. However, it was noted that some employee costs for the Commercial Refuse Collection Service should have been charged to the Domestic Refuse Service. In order to allow a more precise analysis of actual expenditure, costs should be accurately recorded against the different operational waste sectors. Employees identified as misallocated to the Commercial Refuse Collection Service should be reassigned to the correct cost centre. Going forward, staffing cost breakdowns and establishment listings received by the service should be scrutinised to ensure staffing allocations within the service remain accurate. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/10/2024 Whilst the overall numbers of staff being charged were correct it is agreed there were some budget charging discrepancies with regard to who was allocated under Trade Waste. Going forward, staffing adjustments will be correctly coded. Page 58
Page 59
10 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Employees whose costs are currently allocated to the Commercial Refuse Collection Service have been correctly confirmed to Service detail. Staffing allocations within the service are therefore accurate. Page 59
Page 60
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Low The Commercial Refuse Collection service is internally recharged by Fleet Services to hire vehicles used in service delivery. Audit testing to confirm the accuracy of the vehicle costs charged to the Commercial Refuse Collection Service found that other waste services are using some vehicles, and correspondingly costs for some vehicles used by the Commercial Refuse Collection Service are being charged to the Recycling and Domestic Waste Collection cost centres. A review should be undertaken of vehicle costs recharged to the Waste Management Service to ensure vehicle recharges are allocated to the correct cost centres. Any budget realignment required as a result of vehicle reassignment should also be undertaken. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/10/2024 Similar to recommendation 3 above, the correct number of vehicles are being charged under Trade Waste but there are discrepancies over vehicle usage between Waste sectors which require adjustment. Page 60
Page 61
12 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A A review of vehicle costs recharged to the Waste Management Service has been undertaken and reallocations required have been notified to Fleet Services in ensuring vehicle recharges are allocated to the correct cost centres. A process has been adopted to ensure monthly vehicle recharges are checked and any operational changes reflected to maintain accurate costing of the trade waste service. Page 61
Page 62
13 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium The Waste (Scotland) Regulations 2012 requires a duty of care on all business waste producers to have a formal trade waste agreement to transfer their waste in the required manner. Businesses requesting the Council to collect their trade waste must sign a Trade Waste Agreement. Thereafter, a business is also required to sign an annual Trade Waste Agreement to confirm the continuation of the service. All Trade Waste Agreements are sent to customers by post. Documents are returned to the Council using email and post, depending on customer choice. Audit testing found that a significant proportion of existing customers do not return their annual Agreements despite being issued a reminder. Consideration should be given to the development of E-forms for Trade Waste Agreements to enable a more automated approach to businesses and also provide value for money savings to the Council. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 01/04/2025 It is agreed there should be an assessment of options undertaken to work smarter in Page 62
Page 63
14 this area. Consideration will be given as to the impacts of mandatory Digital Waste Tracking to be introduced from April 2025. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Outstanding 01/10/2026 A national scheme of Digital Waste Tracking is being implemented by Scottish Government and will result in the digitising of Trade Waste Agreements. Further progress on the digitising of Trade Waste Agreements cannot be undertaken in the interim until the full detail of the government scheme is known, to ensure the Council’s system will be in full compliance with Digital Waste Tracking requirements. The scheme was intended to be implemented nationally by 1st April 2025 but there has been slippage by Government and a new date of 1st October 2026 has been set. Page 63
Page 64
15 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Medium The Council's Trade Waste Agreement allows for a 28-day notification period for a business or the Council to cancel a commercial waste collection service. As businesses are billed in advance, refunds are frequently required on cessation of the service. The Conditions of Service permit a nominal charge to cover the administrative costs of cancelling the service when processing a refund. However, the audit found there has been no charge to businesses cancelling their Trade Waste Agreement. Consideration should be given to the application of the Trade Waste Agreement cancellation charge on processing a refund, as stated in the Conditions of Service. If the service decides to retain this charge, the decided fee should be included within the annual approval of the Council's fees and charges. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 30/11/2024 The administration charge for contract cancellation should be applied. A view will need to be taken on an appropriate fee and included in the review of annual fees for Council approval in November 2024 ahead of implementation from April 2025. Page 64
Page 65
16 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A A Trade Waste Agreement Cancellation Fee has been calculated and approved as a new charge in the Council’s fees and charges for application from the 2025/26 financial year onwards. Page 65
Page 66
17 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 7 Medium Commercial waste charges were subject to a price freeze for the financial years 2019/20 to 2022/23, but a price increase has been applied to 2023/24 and 2024/25. Before the commencement of the price freeze in 2019/20 a comprehensive costing exercise was undertaken, however this has not been repeated to evidence that current charges for commercial waste services are based on the current operational model. A full-service costing analysis should be undertaken to determine the appropriate charges required for current operations. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 30/11/2024 Charges need to be reviewed, particularly to account for the recent change in disposal to Energy from Waste (EfW) as opposed to landfill. This action has previously been noted by the service and discussed with Accountancy. Page 66
Page 67
18 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Part Implemented 01/04/2026 A full-service costing analysis has been undertaken within 2024/25 to determine the appropriate charges required for current operations. The charging review, as referred to in Recommendation 2, is under further revision and is currently being considered with work intended for completion by quarter 3 of the current year. Any charging decisions will form part of the 2026/27 budget setting process. Therefore a revised implementation date of 01/04/2026 has been agreed. Page 67
Page 68
19 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 8 Low The Council provides a free waste collection service to registered charities with a set size and number of bins to be collected on a 3- weekly basis. Where the charity requests larger / additional bins or more frequent collections, an additional charge should be levied. Audit testing has confirmed that where additional or larger sized bins have been requested, the charity has been correctly charged. However where more frequent collections of the free issue bins are required, the charity has not been charged for this additional service. A review of charitable trade waste customers should be undertaken to ensure all services provided in excess of the free allowable provision are appropriately charged in accordance with service conditions. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/10/2024 A review of charitable trade waste customers had previously begun but initial issues identified and staffing shortages have delayed progress. The exercise will be resumed when staffing resources return to full complement. Page 68
Page 69
20 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A A review of charitable customers has been undertaken to improve operations by standardising collection arrangements. Audit testing has confirmed charges are being levied for additional services requested beyond the standard free offer extended to charities. Page 69
Page 70
21 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 9 Medium It was noted that for 24/25, the Council approved the addition of a 10% administration fee for sub-contracting services to collect commercial waste from businesses that are part of a national waste contract where the contractor does not have presence in Moray. The audit review noted that from analysis of the sales ledger of invoices issued from April 2024, the 10% administration fee was not applied. For 2024/25, administration fees should be charged to businesses where the Council collects trade waste as a sub- contractor to a national waste contract. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes Implemented This has been addressed on audit notification. Necessary changes have been made to incorporate the 10% administration fee to charges to customers under sub-contracted agreements. Page 70
Page 71
22 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Implementation completed as detailed above in the final audit presented to the Council’s Audit & Scrutiny Committee on 11/09/2024 (para 9 of minute refers. Page 71
Page 72
23 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 10 Medium A review of commercial waste invoices issued to businesses found low levels of unpaid debt. However, audit testing has identified examples that despite following agreed Sundry Debt Management Procedures, debt has accumulated over a prolonged period of over 6 months, and in some cases over multiple years, before the action to cease service provision has been taken. Consideration should be given to establishing set debt management parameters of financial limits and / or time periods for the cessation of a commercial waste collection service when charges remain unpaid by a business. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Waste Manager Yes 31/10/2024 This process has been discussed following an earlier review at service level. The approach to debtors to date has been to manage through payment plans whilst retaining customers. However, a strengthening of approach as required and the process to be followed, and its accompanying documentation, is being developed. Page 72
Page 73
24 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A A process has been developed for scrutiny of monthly debt management reports and template reminder letters to be sent for all unpaid invoices where there has been no engagement regarding payment. Where there is no appropriate communication following the reminder and payment has not been made within 28 days of the invoice being raised, a template letter advising service cancellation is issued. There is a more proactive approach to debt management now being taken by the Service. Page 73
Page 74
25 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 74
Page 75
26 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 75
Page 76
Appendix 6 1 Final Internal Audit Report (Follow Up) Banking and Reconciliation September 2025 Distribution: Chief Financial Officer Assistant Manager – FMS & Banking The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Full Priority 1 0 Priority 2 0 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 76
Page 77
Appendix 6 2 Contents Page Banking and Reconciliation 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-8 4. Management Response 6-9 5. Follow Up Review 7-9 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 77
Page 78
Appendix 6 3 1. Introduction and Audit Scope The 2025/2026 annual audit plan provides for a review to be undertaken of the Council's banking and reconciliation arrangements. Bank reconciliation is the process of matching the balances in an organisation's accounting records to the corresponding information on a bank statement. The aim of a bank reconciliation process is to ascertain the differences between the two and make appropriate adjustments to the accounting records to ensure accurate reflection of transactions and balances. The audit scope was to obtain assurance that an effective and systematic methodology is in place to ensure accurate and timely reconciliations are undertaken of the Council's main bank accounts for the receipt of income. This involved a review of the operating procedures, verification and testing of the reconciliations undertaken and the administration of suspense transactions where income has not been immediately identifiable on receipt. The audit has also involved undertaking a review of the Council's banking arrangements. The Council operates three main bank accounts for administering income received and these have been reviewed during the course of the audit. Focus has also been given to the processes for Funds In Transit collections to ensure that all monies received are identified and remain accounted for at all stages between collection and lodgement into the Council's bank accounts. The Council collects a significant and diverse range of income categories, such as Council Tax and Non-Domestic Rates, Housing Rents, Planning Fees, charges for Waste Services, and also encompasses funding of the Council through grant receipts and revenue support. The audit has involved interrogation of the Council's Financial Management System used for accounting and bank reconciliation purposes and the Capita Income Management System used to provide logs and breakdowns of income received by services. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • The audit confirmed that monthly bank reconciliation exercises are undertaken for all Council bank accounts. However, it was noted that the certification by management of these monthly reconciliations is not retained beyond 28 days within the SharePoint Workflow System. The certification by management of the monthly bank reconciliation exercises should be retained to ensure evidence of an audit trail is Page 78
Page 79
Appendix 6 4 maintained of the scrutiny for a core financial control. • Overall, the audit found that within the scope of the review, effective banking and reconciliation arrangements were in place for all income received. It should be noted that significant funds are collected annually through the Council's bank accounts, e.g., in 2024/25, approximately £225 million in Government funding, £196 million in services fees and charges and £51 million in Council Tax. However, at the time of the audit, 18 entries, totalling £40,900 of income, were found to have remained unallocated to accounting codes within the Financial Management System for over one month, the oldest transaction being 2 months old. To ensure accounting records are accurate and reflect current transactions, income received should be allocated to the appropriate financial code at the earliest opportunity. Page 79
Page 80
5 Findings/Recommendations - Banking and Reconciliation 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Low When income is received, a unique reference is required to identify the source and post it to the correct customer account, and/or accounting code within the Financial Management System's general ledger. However, instances occur where income received into the Council's bank accounts either does not have any source reference, the reference quoted is invalid, or the income represents a miscellaneous receipt, such as a payment received that is not associated with a particular invoice. In these circumstances, an unreconciled item is created within the bank reconciliation process, as the amount will be reflected in the Council's bank account as received but cannot be correspondingly recorded within the Council's financial accounts until a manual identification is made, which allows posting to the correct customer account and / or accounting code. Additionally, identifying breakdowns should be provided by services for Funds In Transit which are accounted for at point of collection, before lodgement into the Council's bank account. The Unallocated income must be identified in a timely manner to allow accurate financial recording within the Council's general ledger. Services should be reminded of the need to provide income detail on a prompt basis. Any receipts not able to be identified within a reasonable timescale should be returned to the bank to progress to a conclusion. Page 80
Page 81
6 non-provision of this information also creates an unreconciled item which cannot be recorded within the Council's financial accounts. Overall, from the audit testing undertaken of the bank account reconciliation processes, effective management arrangements were found, where significant funds are identified and reviewed promptly to ensure that monies received are accounted for and allocated correctly to the appropriate accounting code within FMS. However, at the time of the audit, 18 entries, totalling £40,900 of income, were found to have remained unallocated within the FMS for over one month, the oldest transaction being 2 months old. For accurate and timely recording of income in the Council's accounting records, it is important that the source of the monies received is identified at the earliest opportunity. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Manager – FMS & Banking Yes 31/08/2025 All income will be allocated within 1 month of receipt which will allow ample time for identification. Any income remaining Page 81
Page 82
7 unidentified after 1 month will be returned to the originating source by the Council's Bank. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A All unreconciled income noted at the time of the audit has now been allocated appropriately. Streamlined processes are in place to escalate coding queries with services and obtain identification and reallocation within the timescale of one month from receipt of income. Page 82
Page 83
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low The Council operates three main bank accounts for the administration of income received and these have been reviewed as part of this audit. On a daily basis, reconciling tasks are being undertaken by the Banking Team within the bank reconciliation module of FMS to ensure funds received are appropriately allocated and accounted for. Every month, a full formal reconciliation of each bank account is undertaken and is checked and approved by the Assistant Manager - FMS & Banking, within the SharePoint Workflow system. Audit testing noted that the evidence of authorisation within the SharePoint Workflow system is deleted after 28 days. An improvement to the process is required to ensure that evidence of all bank reconciliation checking and approval by service management is retained for reference purposes. Monthly bank account reconciliations should be signed and dated to retain evidence of the checks and approval undertaken by management of a core financial control. Page 83
Page 84
9 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Manager – FMS & Banking Yes 31/08/2025 All bank reconciliations will continue to go through the SharePoint Workflow system. In addition, the approving manager will add their signature and date to the file to preserve the evidence of authorisation when the file moves to the SharePoint records site. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A From July 2025 onwards, a process has been implemented of the approving manager signing and dating all monthly bank reconciliations on validation, therefore retaining evidence of authorisation. Page 84
Page 85
10 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 85
Page 86
11 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 86
Page 87
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – National Non-Domestic Rates 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 10 September 2025 to 19 November 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of non-domestic rates; this project has been agreed for review within the Internal Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted, and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 The audit scope involved reviewing the controls and processes involved in administering non-domestic rates accounts, specifically in relation to the billing of accurate and timely demand notices to all relevant ratepayers. This included accounting fully and promptly for Item 6. Page 87
Page 88
monies collected by various means from a large number of ratepayers and escalating appropriate recovery practices when debt remained unpaid. 4.2 Overall, within the scope of the review, testing confirmed that appropriate controls are in place and operating effectively in relation to the collection and accounting of non- domestic rates (NDR). It is appreciated that policies and procedures for NDR are primarily established by legislation and administered through a software application, supported by detailed guidance. However, it is considered that locally documented procedures should be further developed to strengthen governance arrangements and provide a point of reference for officers. The audit also noted that some NDR accounts may be suppressed from billing and recovery for valid administrative or legal reasons. Testing confirmed appropriate justification for such cases; however, suppressed accounts are not routinely reviewed to ensure their ongoing validity. The findings and recommendations are detailed in the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. Page 88
Page 89
b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. Page 89
Page 90
7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 90
Page 91
Appendix 1 1 Final Internal Audit Report National Non-Domestic Rates September 2025 Distribution: Chief Financial Officer Taxation Manager The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Full Priority 1 0 Priority 2 2 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 91
Page 92
Appendix 1 2 Contents Page National Non-Domestic Rates 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-11 4. Management Response 5-12 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 92
Page 93
Appendix 1 3 1. Introduction and Audit Scope The annual audit plan for 2025/26 includes a review of the arrangements for collecting and accounting for non-domestic rates income. This review forms part of the regular audit coverage of the Council’s core financial systems. Non-domestic rates are a property based tax which is collected by the Council on behalf of the Scottish Government. The amount charged to the taxpayer is calculated by multiplying the rateable value placed on a property by the Assessor by the rate per pound set by the Scottish Government. As a levying authority, the Council is obliged to pursue rates recovery in an effective and efficient manner, considering all surrounding facts and circumstances. All monies raised through non-domestic rates are controlled by the Scottish Government and are taken into account in the annual local government finance settlement. In 2024/25, the net amount of non-domestic rates billed billing in Moray amounted to £69.2 million, with £68.7 million collected during the year, representing a collection rate of 97.4%. The scope of this audit was to review the key controls operating within the non-domestic rates system, with a particular focus on billing, collection and recovery processes. The review assessed the adequacy of controls and procedures in place for: • issuing accurate and timely demand notices to all relevant ratepayers, • ensuring full and prompt accounting for monies collected through various payment methods, and • applying appropriate recovery practices when debts remain unpaid. The audit work was carried out using the Chartered Institute of Public Finance and Accountancy Control Matrices for non-domestic rates as the basis for the audit programme and testing undertaken. The audit covered accounting periods 2024/25 and 2025/26. While the systems and processes are complex, audit testing confirmed that appropriate controls are in place and operating effectively in relation to the collection and accounting of non-domestic rates. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • It is recognised that policies and procedures for non-domestic rates (NDR) are primarily determined by legislation, with regular annual updates issued by the Scottish Government. The software application used to administer the NDR system is supported by detailed operating Page 93
Page 94
Appendix 1 4 guidance and the Taxation Service is managed by experienced and professionally qualified officers. However, these arrangements should also be supported by documented procedures that set out locally developed operating practices. Such documentation would assist compliance with existing policies and guidance, while also providing a clear point of reference to ensure continuity in the event of future staffing changes. • It was noted that individual NDR accounts may be suppressed and temporarily excluded from standard processing (e.g., billing and recovery) for specific administrative or legal reasons. At the time of the audit, 191 NDR accounts, with an annual billing liability of approximately £319,000, were classified as suppressed. Testing of a random sample of suppressed accounts confirmed that appropriate reasons existed to support the suspension of recovery action. However, it was also observed that suppressed accounts are not reviewed at regular intervals to identify any changes that might affect their classification. • This audit review also considered the findings and recommendations from an Audit Commission report into a £1.1 million council tax refund fraud perpetrated by an employee at another Council. The fraud involved an employee diverting funds from council tax accounts with historic credit balances to their personal bank account. Although this fraud concerned council tax, the recommended controls suggested by the Accounts Commission have also been considered, where appropriate, in relation to the non-domestic rates system. This has resulted in further recommendations to strengthen controls concerning the review and refunding of credit balances. Page 94
Page 95
5 Findings/Recommendations - National Non-Domestic Rates 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Low The Taxation Service is staffed by experienced and professional officers, and non-domestic rates (NDR) policies and procedures are primarily determined by legislation and annual updates issued by the Scottish Government. In addition, the software application used to administer the NDR system is supported by detailed operating guidance. However, locally developed documented procedures should also be established to outline the practices undertaken for billing, collection and reconciliation. This would provide a consistent point of reference for management and staff, helping to ensure continuity and compliance irrespective of future staffing changes. Guidance setting out locally developed procedures should be documented to complement existing policies and system operating manuals for the management and administration of the non-domestic rates system. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager- Taxation Yes 31/03/2026 Due to the day-to-day demands on the limited staffing resources within the Page 95
Page 96
6 Taxation Service, it makes it difficult to undertake non-core work. The need to establish detailed procedures is accepted by the Service Manager – Taxation, and steps will be taken by 31 March 2026 to demonstrate progress to completion of this task. Page 96
Page 97
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low At the time of the audit review, it was noted that 191 of NDR accounts with an annual billing liability of £319,000 had been classified as “suppressed”. A “suppressed account” usually refers to an account where the Council has placed a temporary hold or restriction on issuing bills, reminders or recovery notices. This suppression may be required for reasons, including: • Disputed liability – where it’s unclear who should be responsible for the rates. • Pending appeal – if a ratepayer has appealed the rateable value or liability. • Internal review – checks undertaken regarding exemptions, reliefs or transitional arrangements. Audit testing of a random sample of suppressed accounts and confirmed appropriate justification for the suppressed accounts; however, these accounts are not reviewed at regular intervals to ensure ongoing correct account classification. Management should ensure regular reviews of all suppressed non-domestic rate accounts to evidence ongoing correct classification. Page 97
Page 98
8 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager- Taxation Yes 31/12/2025 A procedure will be put in place to ensure regular and verified review of suppressed accounts. Page 98
Page 99
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium The audit considered recommendations from an Accounts Commission report on a £1.1m council tax refund fraud at another council. Although the case related to council tax, the suggested controls were assessed for relevance to the NDR system regarding “dormant accounts”. A dormant non-domestic rates account is an inactive account with no current billing or recovery activity, usually because liability has ended or transferred. The Accounts Commission report recommends that access to the taxation software application be restricted, allowing only the Service Manager- Taxation to authorise refunds on dormant accounts. While current arrangements require the Service Manager- Taxation to approve refunds, system access is not currently restricted, meaning other users can access functions within the taxation system to enable a refund to a taxpayer. Further to consultation with the Service Manager Taxation, it is recommended that the Service Manager- Taxation should determine a classification for all ‘dormant’ credits to prevent a refund without management authorisation. Page 99
Page 100
10 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager- Taxation Yes 31/03/2026 Service Manager – Taxation will bring forward a procedure for approval to write on and securely control all dormant accounts. Page 100
Page 101
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium A review of non-domestic rates (NDR) accounts with credit balances was undertaken. Effective procedures were found to be in place for agreeing actions to be undertaken with ratepayers regarding any credit balances. However, analysis identified 84 dormant NDR accounts with a cumulative credit value of approximately £149,000, where a refund has not been claimed or the overpayment transferred to another account. Some of these accounts have been inactive for several years, as the payee for the overpayment could not be confirmed. It was confirmed that the Taxation Service initially contacts the ratepayer regarding the credit balance, but no further follow-up action or regular review of NDR accounts with credit balances is undertaken. It is appreciated that the demands on staff resources within the Taxation Service; however, management should consider undertaking periodic reviews of dormant accounts, and where feasible, contact should be made with ratepayers to resolve the disposal of unclaimed credit balances. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager- Taxation Yes 31/03/2026 A procedure will be put in place for the periodic review of credit balances, where Page 101
Page 102
12 staffing resources and operational demands permit it to be undertaken. Page 102
Page 103
13 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 103
Page 104
14 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 104
Page 105
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review - Procurement and Creditor Payments 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 10 September 2025 to 19 November 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of procurement and creditor payments; this project has been agreed for review within the Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 Included within the Audit Plan 2025/26 is a project to review the payments made to suppliers of goods and services processed through the Council’s Financial Management System (FMS). The purpose of the audit was to provide assurance over a key function of Item 7. Page 105
Page 106
FMS in the accurate payment and recording of expenditure. In addition, a check was also undertaken through analysis and the sample testing of invoices to confirm compliance with Financial, Authorisation, Procurement and Creditor Payment Processing Regulations. 4.2 The audit reviewed a six-month period from October 2024 to March 2025. During this time, total expenditure to suppliers of goods, works and services processed through FMS amounted to approximately £53 million. The review confirmed that payments were accurately recorded and processed in FMS. However, testing identified instances of non- compliance with Financial Regulations and Procurement Guidelines, particularly in relation to the procurement of goods and services and the authorisation of payments. The detailed findings and recommendations from this review are detailed within the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: Page 106
Page 107
☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. Page 107
Page 108
8. BACKGROUND PAPERS 8.1 None Page 108
Page 109
Appendix 1 1 Final Internal Audit Report Procurement and Creditor Payments September 2025 Distribution: Chief Financial Officer Head of Operations and Environment Head of Education (Chief Education Officer) Head of Housing, Property & Communities Service Manager Environmental Services Service Manager Roads & Fleet Head Teacher Inclusion, Wellbeing and Adapted Curriculum Service Manager Building Services Fleet Services Manager Assistant Manager – FMS & Banking The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 1 Priority 2 3 Priority 3 1 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 109
Page 110
Appendix 1 2 Contents Page Procurement and Creditor Payments 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-14 4. Management Response 6-15 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 110
Page 111
Appendix 1 3 1. Introduction and Audit Scope The annual audit plan for 2025/26 includes coverage of the Council’s core systems. A review has been undertaken of payments made to suppliers of goods and services processed through the Council’s Financial Management System (FMS). The objectives of the audit review were not only to provide assurance over a key function of FMS in the accurate processing and recording of expenditure, but also to test a sample of payments to confirm compliance with Financial, Authorisation, Procurement, and Creditor Payment Processing Policies and Regulations. The findings from this review will also be used to support the Service Manager Internal Audit and Risk’s annual opinion on the Council’s internal control systems. The testing undertaken was developed from the Chartered Institute of Public Finance and Accountancy’s Control Matrices, in addition to consultation with the External Auditor. The audit reviewed a six-month period from October 2024 to March 2025. Total expenditure to suppliers of goods, works, and services processed through FMS was approximately £53 million. Computer audit software was used to randomly select individual payments within stratified financial value parameters for testing. The audit also analysed all payments processed through the FMS during the sample period to identify any potential duplicate payments for further investigation. The scope of this audit excludes payments made on behalf of the Moray Integrated Joint Board, which will be covered in a separate audit report. The audit was carried out in accordance with Global Internal Audit Standards (GIAS). 2. Key Issues • Findings from the audit review found that payments had been accurately recorded and processed through FMS. However, compliance with Council policies and guidelines is an essential control requirement in the procurement and authorisation of expenditure. Computer-assisted audit software was used to analyse invoices paid through FMS, enabling both the random selection of invoices for testing and the identification of potential duplicate payments for further investigation. Testing identified instances of non-compliance with the Financial Regulations and Procurement Guidelines, relating to both the procurement of goods and services and the authorisation of payments. Given the materiality of the expenditure and the need to ensure an effective control environment for this core Council system, this type of review will remain a continuous auditing requirement within future annual audit plans. Page 111
Page 112
Appendix 1 4 • Audit testing included checks for potential duplicate payments, where separate payments had been made to the same supplier or contractor for the same amount. The majority of payments reviewed were confirmed as accurate and related to recurring or contractual agreements. However, one overpayment of £18,551 was identified, where two additional invoices had been incorrectly processed for the same purchase of stock items. Enquiries with the Service established that the overpayment occurred due to an administrative error. The Service has confirmed that action has now been taken to recover the overpayment and that further clarification has been provided to officers regarding the correct procurement procedures and processes. Page 112
Page 113
5 Findings/Recommendations – Procurement and Creditor Payments Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 High Audit testing included the use of a computer audit software application to analyse all expenditure within the sample period to highlight any potential duplicate payments. The majority of invoices highlighted for further review with the same payee and amount were found to be correct as they related to contracting and recurring payments. However, testing identified that Environmental Services had made three separate payments to the same company for the same stock items, resulting in an overpayment of £18,551. The Service has been advised, and action has now been undertaken to recover the overpayment from the company. Enquiries with the Service found that the overpayment arose from an administrative error caused by the use of a different purchasing system in the procurement of the items and in the processing of invoices for payment. Officers with responsibility for the procurement and processing of payments within Environmental Services should be reminded and if required, further training should be provided on the agreed purchasing arrangements for stock related items. Page 113
Page 114
6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Environmental Services Yes Implemented Staff in Waste have been informed that all future stock purchases must go through Stores and the Tranman system. Page 114
Page 115
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium A random sample of payments to suppliers was checked to ensure that expenditure had been authorised in accordance with the Council’s Financial Regulations and Authorisation Policy. The Authorisation Policy outlines the different levels of responsibility for budget management and the authority to commit expenditure. It also provides for a named officer to act as an ‘In Absence Authoriser’ to ensure that a service can continue to function effectively during the absence of the Budget Manager. From the audit sample and further analysis, it was found that the ‘In Absence Authoriser’ within Fleet Services had authorised invoices totalling approximately £230,000 over several months. Enquiries with the Service indicated that, due to operational demands, the In Absence Authoriser is authorising expenditure even when the Fleet Manager is at work. In accordance with the Financial Regulations and the Authorisation Policy, the Fleet Services Manager should be the primary authorising officer of all expenditure from their budget. The use of an “In Absence Authoriser” should only be used when the Budget Manager is absent from work. Page 115
Page 116
8 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Fleet Services Manager Yes 31/10/2025 Fleet Services staff with budget authority to be briefed on the audit finding and reminded that the use of 'In Absence' authorisation for Fleet Services expenditure is strictly limited to situations where the Fleet Services Manager is unavailable. Page 116
Page 117
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium A random stratified sample of payments, based on financial value, was selected from the total expenditure for the audit review and checked for compliance with Financial Regulations and Procurement Guidelines. A payment of £30,000 was made by Education Services to an outdoor activities company for “tokens” to be used for the future delivery of activities. While the specialised nature of this expenditure and the need to use a single supplier is acknowledged, Procurement Procedures require that, in such circumstances, the service must request an assessment from the Procurement Team and obtain approval from the Chief Financial Officer. Unfortunately, this had not been undertaken. In addition, according to Financial Regulations, as the purchase was for the future delivery of services, authorisation should also have been obtained from the Chief Financial Officer. It is appreciated the specialised nature of the procurement requirements detailed within the audit finding, but the purchase for goods or services must be undertaken in accordance with Financial Regulations and Procurement Guidelines. Page 117
Page 118
10 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Education (Chief Education Officer) Head of Education (Chief Education Officer) Yes Yes 31/10/2025 30/06/2026 Staff will be reminded of the need to comply with Financial Regulations and Procurement Guidelines for the purchase of goods and services. Where additional needs are identified, staff will complete training on Financial Regulations and Procurement Guidelines. Page 118
Page 119
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium As detailed previously, computer audit software was used to analyse expenditure from the Council’s Financial Management System to identify any potential duplicate payments. The following payments were noted to the same contractor for the same amount: Invoice Date Amount 26/02/2025 £9960 03/03/2025 £9960 08/03/2025 £9960 Further enquiries confirmed that these were not duplicate payments but valid invoices for works carried out by the same contractor at Council properties. It was noted that the works had been awarded to a single contractor but issued as separate orders by Building Services. Procurement Guidelines specify the following requirements: “When estimating the value of a procurement, consideration should be given to the total cost (over the period of need) including VAT and the potential for aggregation across the The Building Services Manager should remind officers responsible for procuring works of the requirement to comply with Procurement Guidelines. Additional training should be provided if necessary. Page 119
Page 120
12 organisation. Separating out a need to reduce the cost and therefore the process to be used is not an option”. In addition to the Procurement Procedures, the works undertaken should also have complied with the terms and conditions of the Council’s Building, Repair and Maintenance Framework Agreement, which requires that where the anticipated spend is £10,000 or above, all contractors within the relevant trade must be invited to quote. Had the correct procurement procedures and framework requirements been followed, and the works aggregated, this may have resulted in cost savings. The operating demands on services and the urgent nature of some work requirements are acknowledged. However, audit testing for this review focused on ensuring compliance with Financial Regulations and Procurement Guidelines. Page 120
Page 121
13 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Building Services Yes 31/10/2025 The service acknowledge that procurement procedures were not correctly followed, as the aggregated value of works should have been considered, and a mini competition carried out. The urgent nature of the works and lack of internal labour resource meant that the works had to be outsourced. The appointed framework contractor that carried out the works, did so at previously tendered and agreed rates, which benchmark favourably with the current market rate. A mini competition was recently undertaken to appoint an approved contractor. Page 121
Page 122
14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Low Audit testing was undertaken on a sample of randomly selected invoices to check compliance with Financial Regulations and Procurement Guidelines. This sample included an invoice for an item ordered through a software application used within the Libraries Service. The payment of the invoice was processed through an interface with the Council’s Financial Management System (FMS). No issues were identified regarding the procurement or authorisation of this invoice. However, it was noted that within the FMS, the actual invoice date is not recorded; instead, FMS details the date the invoice was approved for payment in the software application used in the Libraries Service. Further analysis revealed that this issue was also present in other invoices for purchases made through the same software application. The matter has been raised with the Assistant Manager – FMS & Banking. The actual invoice date should be recorded in the Financial Management System for purchases made through the software application used in the Libraries Service. . Page 122
Page 123
15 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant FMS & Banking Manager Yes Implemented This has been implemented. A process is in place for Payments staff to review and amend the invoice date on all library interface batches before being released for payment. Page 123
Page 124
16 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 124
Page 125
17 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 125
Page 126
Page 126
Page 127
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Complex and Challenging Needs Service 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 10 September 2025 to 19 November 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of Complex and Challenging Needs Service; this project has been agreed for review within the Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted, and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 An audit was undertaken to review the Complex and Challenging Needs Service. The Service provides support to individuals with complex care needs at purpose built facilities located in Elgin and Lhanbryde, as well as within their own homes across Moray. The Item 8. Page 127
Page 128
scope of the audit included a review of systems and procedures for the administration of the Service. It also examined the operational and accounting arrangements in place to assist individuals with managing their personal funds. 4.2 The demands on the Service to support individuals with complex care needs are acknowledged and overall, the administrative processes are considered appropriate. The audit identified a significant and ongoing reliance on overtime payments to officers supporting the care needs of individuals. As with other care providers, the Service is experiencing difficulties in recruiting staff; however, the reliance on overtime should be balanced against the well-being of officers. The audit has also made recommendations regarding the financial administration of the Service, including consideration of more formalised banking arrangements for managing the personal funds of supported individuals. The findings and recommendations are detailed in the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. Page 128
Page 129
b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. Page 129
Page 130
7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 130
Page 131
Appendix 1 1 Final Internal Audit Report Complex and Challenging Needs Service September 2025 Distribution: Service Manager Provider Services Team Manager/Consultant Practitioner Complex and Challenging Needs The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 1 Priority 2 6 Priority 3 5 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 131
Page 132
Appendix 1 2 Contents Page Complex and Challenging Needs Service 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-18 4. Management Response 6-19 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 132
Page 133
Appendix 1 3 1. Introduction and Audit Scope The annual Internal Audit plan for 2025/26 includes a review of the Complex and Challenging Needs Service. This Service supports individuals with complex care needs at purpose built facilities in Elgin and Lhanbryde, as well as within their own homes across Moray. At the time of the audit, the care facility in Elgin provided support to four adults. The accommodation consists of a large bungalow with shared living rooms, a communal kitchen and a garden. The facility in Lhanbryde serves as the administrative base for the Service and supports eight individuals in separate, purpose built accommodation, with access to a communal area used for social activities. The overall budget for delivering the Complex and Challenging Needs Service in 2024/25 was approximately £7.7 million. The scope of the audit was to review the systems and procedures for delivering and managing the Complex and Challenging Needs Service, specifically at the care facilities in Elgin and Lhanbryde. This was an audit of the administrative arrangements, rather than an assessment of the quality of care provided. The Care Inspectorate in Scotland, as the national regulatory body for care services, is responsible for ensuring that care services meet the required standards. The audit focused on reviewing policies, procedures, and operating practices in the administration of the Complex and Challenging Needs Service, particularly in relation to budget management and the arrangements for assisting people in managing their personal funds. However, the audit did include a check to ensure that Support Plans for individuals supported by the service were reviewed in accordance with agreed timescales. The audit was carried out in accordance with Global Internal Audit Standards (GIAS). 2. Key Issues • The Complex and Challenging Needs Service provides 24-hour support to individuals with specific care requirements. The audit found that the Service has a number of staff vacancies and as with other care sectors, is experiencing difficulties in recruiting officers. Analysis of payroll expenditure indicated that the majority of officers are working additional overtime hours each week. Random testing of overtime claims noted that some officers who are supporting individuals are often working more than 60 hours per week. The audit notes the demands on the Service and the commitment of officers to support the care needs of individuals; however, it does question the sustainability of current working arrangements. Page 133
Page 134
Appendix 1 4 • The Service also supports people at both care facilities in managing their personal funds. Officers assist individuals with payments for groceries, utilities and other living expenses. Separate records are maintained for each individual and any cash held on their behalf is stored securely. Documented guidelines outline the procedures for officers in administering these funds; however, these guidelines have not been reviewed or updated for several years. Consideration should be given to transitioning from a cash-based system to individual bank accounts, which would allow for the introduction of additional controls. • This audit focused on the financial administration of the Complex and Challenging Needs Service. However, it also included a check to confirm that the Support Plans of individuals at both care facilities had been reviewed in accordance with agreed timescales. The audit found that the majority of care packages sampled had not been reviewed for over a year. In accordance with Health & Social Care Moray Eligibility Criteria Policy, there is a requirement for a Social Worker/Community Care officer to undertake annual reviews where support is provided to meet eligible needs, or more frequently as a response to a significant change in circumstances. Page 134
Page 135
5 Findings/Recommendations - Complex and Challenging Needs Service 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 High Officers of the Service support individuals with complex care needs at the care facilities in Elgin and Lhanbryde, as well as within their own homes. A review of the staffing complement at the time of the audit identified significant vacancies. As with other social care providers, the Service is experiencing difficulties in recruiting officers. An analysis of payroll costs found that the majority of officers employed within the Service are working more than their contracted hours each week. Approximately £750,000 was paid in overtime during 2024/25. Audit testing of individual overtime claims, undertaken to verify accuracy and compliance with Financial Regulations, revealed that some Support Workers are regularly working in excess of 60 hours per week. While the audit acknowledges the commitment of officers to meeting the needs of individuals supported by the Service, it also raises concerns about the sustainability of the current working arrangements. The ongoing recruitment campaign for officers within the Complex and Challenging Needs Service should be maintained. Consideration should also be given to exploring alternative approaches to reduce the significant levels of overtime currently worked by some officers. Page 135
Page 136
6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager (Provider Services) Yes Ongoing A short-life working group will be established to seek solutions and support the ongoing staffing challenges facing the Service. Since the audit, there has been a reduction in vacancies at Woodview from 19.1 FTE to 10.6 FTE (as of 1st October), and at Barlink from 4.49 FTE to 0.45 FTE for Support Workers and 1 FTE for a Keyworker (as of 1st October). While the appointment of new staff will not have an immediate impact on reducing overtime, due to the requirement for training and shadow shifts, it is expected that, over time, this will lead to a decrease in overtime usage. In addition, a review of staffing arrangements is ongoing to identify improvements in service delivery. The combination of recent staff recruitment and a review of current service delivery methods is expected to support a significant reduction in overtime in the future. This will be closely monitored by senior management. Page 136
Page 137
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium The audit reviewed a random sample of officers overtime and travel/expenses claims to verify their accuracy and ensure correct authorisation in accordance with Financial Regulations. Testing identified one case where an officer had submitted an overtime claim for 13.75 hours and a travel/expenses claim for 27 miles in advance of the date the work was to be undertaken. Further investigation found that the officer had neither worked the planned additional hours nor incurred the mileage claimed, due to sickness absence. This is not in compliance with Financial Regulations. The officer has since reimbursed the overpaid amount and the mileage claimed. The audit also found that approximately one-third of all travel claims submitted by the Service were not dated at the time of signing, either by the submitting officer or the authorising officer. In accordance with Financial Regulations, officers within the Complex and Challenging Needs Service should be reminded that claims for overtime and travel/expenses must only be submitted after the hours have been worked or the mileage incurred. Additionally, all travel/expenses claims must be dated at the time they are signed by both the submitting and authorising officers. Page 137
Page 138
8 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers (Woodview) Service Manager (Provider Services) Yes Yes 30/09/2025 31/03/2026 All staff are to be informed, in accordance with the Financial Regulations, of the correct procedure for completing and submitting travel and expense claims. In addition, these requirements will be reminded during Supervision and Team Meetings Digital solutions will be explored with the Payroll Service for submitting expenses claims. Page 138
Page 139
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium A review was undertaken of non-staffing expenditure made by the Complex and Challenging Needs Service. This involved testing a random sample of payments to suppliers of goods and services and checking to ensure compliance with Financial Regulations and Procurement Guidelines. The review found that mostly correct procurement and authorisation processes had been undertaken. However, an example was noted where Guidelines had not been followed in the procurement for the purchase and installation of a bicycle shed to the value of £25,000. Officers involved in the purchasing of goods and services should be reminded of the need to comply with Financial Regulations and Procurement Guidelines. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Team Manager/Consultant Practitioner Residential Complex and Challenging Needs Yes Implemented A grant was secured for the bike shed, and all work was completed within the £25,000 grant allocation. Staff have been reminded of the requirement to comply with the Council’s Procurement Guidelines. Page 139
Page 140
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Low Analysis of the Financial Management System indicated that the overall budget for delivering the Complex and Challenging Needs Service in 2024/25 was £7.7 million, with the majority of expenditure related to staffing costs. It was found that the staffing budget is regularly reviewed to ensure accuracy and alignment with the needs of individuals supported by the Service. However, a number of other non staffing budget headings that is not material in value e.g. non domestic rates, utilities and ad- hoc repairs had a budget allocation which did not correspond to actual expenditure incurred. A financial “housekeeping” exercise should be undertaken to review and adjust the budget allocations for non-staffing costs to better reflect current expenditure. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Team Manager/Consultant Practitioner Residential Complex and Challenging Needs / Accountant Yes 31/03/2026 The Service, in consultation with the Accountancy Section, will review the non- staffing budget to ensure it is more closely aligned with actual expenditure. Page 140
Page 141
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium The audit visit to the care facility in Lhanbryde found that funds are held in both cash and within a bank account of monies collected through fundraising activities and donations. These funds are intended for the benefit of the people supported by the Service. The administrations of these funds are similar to the requirements of a Private Fund within a School. The audit checked the income and expenditure activity of these funds and undertook a reconciliation to confirm the accuracy of the monies held to supporting documentation. It is pleasing to report that no discrepancies were noted. However, there are no operating guidelines to support officers in the administrative requirements in the management of these funds. Guidelines should be developed detailing the administrative requirements in the management and accounting arrangements of monies held from fundraising activities and donations. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers (Woodview) Yes 31/03/2026 A financial procedure will be developed for the management and administration of Page 141
Page 142
12 Service Manager (Provider Services) Yes 28/02/26 funds collected from events, donations, and fundraising, as well as the expenditures used to benefit individuals using the service. This will include the opening of a new bank account (where an admin fee is not charged). A management panel will be established to oversee and agree the allocation of funds. Page 142
Page 143
13 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Medium The audit review noted that officers at the care facilities support individuals in the management of their personal monies. Cash sums are stored securely for individuals at the care facilities and are used for purchases such as groceries, day trips, utility bills and other living expenses. Operating arrangements for administering these funds are detailed within the Financial Guidelines developed by the Service. The audit reviewed these arrangements, including a reconciliation of supporting documents to the cash held for a sample of individuals. The following points were noted: • Resident funds are administered in cash. Records are maintained to evidence and reconcile individual balances against the monies held. However, it is considered that the amounts of cash stored at the care facilities for some individuals exceed routine weekly expenditure requirements. Consideration should be given to implementing alternative methods for managing the personal funds of individuals, such as individual banking arrangements. Page 143
Page 144
14 • The Financial Guidelines document detailing the administration arrangements for individuals’ funds has not been reviewed or updated since 2022. The Financial Guidelines document for administering individuals’ funds should be reviewed and updated as required. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers (Woodview) Service Manager (Provider Services)/ Service Manager (Learning Disability) / Chief Financial Officer (MIJB) Yes Yes 30/09/2025 31/03/2026 The Financial Guidelines document for administering individuals’ funds will be reviewed and updated. A request will also be submitted to Community Finance for weekly cash uplifts, thereby reducing the amount of funds held within the service A review will be undertaken to explore alternative methods for managing the personal funds of individuals, including consultation with guardians, social work, and Finance. Page 144
Page 145
15 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 7 Low The audit visit to the care facility at Lhanbryde noted the provision of two petty cash accounts: an Adult Services account with an imprest amount of £250 and a Children’s and Young Persons account with an imprest amount of £120. The review found that the Adult Services account was well managed and operated in accordance with Financial Guidelines. However, further to discussions with officers indicated that greater use is now being made of the purchasing card. The Children’s and Young Persons petty cash account had not been used since 2022. This account was initially established to support a young person before they turned 18 and transitioned into Adult Services. Consideration should be given to closing both the Adult Services and Children and Young Persons petty cash accounts. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Mangers (Woodview) Yes Implemented Petty cash has now been closed for both services, and evidence of this closure has been submitted to Internal Audit. Page 145
Page 146
16 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 8 Medium The audit included a review to ensure that Support Plans for individuals at both care facilities had been updated to confirm that care and support continue to meet their needs and agreed outcomes. It was found that the majority of care packages sampled had not been reviewed for over a year. This finding has also been noted in other social care reviews to highlight the requirement for regular reviews of Support Plans for individuals receiving services. It is acknowledged that management at Health and Social Care Moray are aware of this issue and are progressing the necessary actions in accordance with the Eligibility Criteria Policy, which requires a Social Worker or Community Care Officer to undertake annual reviews where support is provided to meet eligible needs. Support Plans for users of the Complex and Challenging Needs Service should be reviewed at least annually in accordance with the agreed policy. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager (Learning Disability) Yes 31/12/2025 All out-of-date support plans to be updated. Page 146
Page 147
17 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 9 Low The care facility at Lhanbryde has one dedicated pool car that officers use to support individuals within the community. It was noted that the annual mileage used for this vehicle was approximately 7,000 miles in 2024/25. A previous audit of pool cars noted that best value is obtained when comparing the cost of purchasing and use of a pool car is achieved when mileage in excess of 12,000 a year is undertaken. Analysis of mileage claimed by officers of the Service when using their personal vehicles noted a cumulative total of approximately 17,000 in 2024/25. Increasing the use of the pool car may provide a financial saving to the Service. Consideration should be given to increasing the use of the available dedicated pool car by officers of the Service. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers (Woodview) Yes 31/01/2026 A review of the current pool car arrangements will be carried out, and a more proactive approach will be implemented for its use during care and support visits outside of Woodview, which currently incur a mileage charge. Page 147
Page 148
18 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 10 Low The care home facility at Lhanbryde operates a closed-circuit television (CCTV) system as an additional security measure for the property. The use of CCTV requires compliance with Data Protection Legislation, including the completion of a Data Protection Impact Assessment (DPIA). A DPIA is a structured process that systematically analyses the data protection risks associated with CCTV systems. It was found that no DPIA had been completed. Additionally, officers operating the CCTV at the facility had not undertaken the necessary training provided by the Council. It was also noted that the location of the CCTV monitor within the property is in an accessible area, which is not in accordance with Data Protection Legislation . A Data Protection Impact Assessment (DPIA) should be completed for the care home facility at Lhanbryde. All officers operating CCTV must complete the Council’s CCTV training module. The location of the CCTV monitor within the property in Lhanbryde should also be relocated to ensure that footage can only be viewed by trained officers who require access as part of their duties. Page 148
Page 149
19 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant Managers (Woodview) Assistant Managers (Woodview) Yes Yes Implemented Implemented DPIA for the CCTV system at Woodview has been completed and approved. Training has been completed for all staff with access to the CCTV system at Woodview. In addition, access to the CCTV monitor at Woodview is now restricted. Page 149
Page 150
20 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 150
Page 151
21 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 151
Page 152
Page 152
Page 153
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Absence Management 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 10 September 2025 to 19 November 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of absence management; this project has been agreed for review within the Internal Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted, and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 An audit was undertaken to review the Council’s sickness absence management arrangements, including those officers working under the direction of the Moray Integration Joint Board (MIJB). The scope of the audit examined whether the Council has Item 9. Page 153
Page 154
adequate and appropriate policies, procedures and controls in place for managing sickness absence. The review involved testing a random sample of employees on sick leave to assess compliance with the requirements set out in Council policies and guidance. 4.2 The audit identified several areas where the Council promotes employee well-being and has established policies and guidance for effectively managing sickness absence. The Health and Work Policy, supported by the Guidance on Managing Sickness Absence and the Sickness Absence Notification and Certification Guide, provides detailed instructions for managing employee absence effectively and minimising disruption to services. However, analysis shows that the average number of days lost through sickness absence per employee within the Council has increased over recent years. In addition, audit testing of a random sample of employees on sick leave found that management interventions and/or the timing of those interventions were not always in accordance with the Health and Work Policy. The detailed findings and recommendations from this review are detailed within the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. Page 154
Page 155
b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. Page 155
Page 156
7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 156
Page 157
Appendix 1 1 Final Internal Audit Report Absence Management October 2025 Distribution: Executive Director Education, Housing & Communities Head of Human Resources, ICT and Organisational Development The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Limited Priority 1 2 Priority 2 8 Priority 3 1 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 157
Page 158
Appendix 1 2 Contents Page Absence Management 1. Introduction & Scope 3-4 2. Key Issues 4-5 Detailed Report 3. Findings/Recommendations 6-30 4. Management Response 7-31 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 158
Page 159
Appendix 1 3 1. Introduction and Audit Scope The Annual Internal Audit Plan for 2025/26 provides for a review of the sickness absence management arrangements of the Council, including those working under the direction of the Moray Integration Joint Board (MIJB). The most significant expenditure category within the Council is staffing, with annual spending of approximately £200 million in 2024/25. Effective staff absence management is crucial for maintaining service delivery, controlling costs and ensuring employee well-being. It impacts productivity, financial resources and the overall health of the organisation. There are legislative requirements for how the Council manages staff absence and in particular, sickness absence. In accordance with the Employment Rights Act 1996, the employer is liable to pay sick pay benefit or statutory sick pay to an employee who is incapable of work due to sickness or injury. The Health and Safety Executive expects employers to have policies and procedures in place for managing sick leave and return to work..The Moray Council has a Health and Work Policy. This Policy is intended to provide robust sickness absence procedures ensuring that, as far as possible, employees are supported and attendance at work is maximised. The Human Resources Service is responsible for authoring and updating the Health and Work Policy, where compliance by managers and officers is an important control to mitigate against several organisational risks, including: • Employment law breaches (unfair dismissal claims, disability discrimination claims). • Financial and operational risk (increased costs, inefficiencies, loss of public trust). • Reduced employee wellbeing and morale (negative workplace culture, exacerbation of health issues). • Inconsistent application of policies (employees lose confidence in fairness and reliability of management). • Missed opportunities for reasonable workplace adjustments A payroll and human resources software application called iTrent is used for recording and providing information on employee sickness absence. Approximately 3,725 full time equivalent (fte) are employed by the Council, which includes 804 fte working under the direction of the MIJB. At the time of this audit, there were 280 employees absent due to sickness (of which 67 were teaching staff). The Council, like other local authorities in Scotland, records the days lost through sickness absence per employee, which is then provided to the Local Government Benchmarking Framework (LGBF). The Improvement Service in Scotland administers the LGBF and is a tool for public performance reporting and can be used to drive improvement and accountability Page 159
Page 160
Appendix 1 4 within local government. Detailed below are the sickness days lost through sickness absence per employee within the Moray Council, against the Scottish average for all local authorities: Year Moray Council (Non- teaching) days lost through sickness absence per employee, per annum Scotland- wide average (Non teaching) days lost through sickness absence per employee, per annum Moray Council (teaching) days lost through sickness absence per employee, per annum Scotland- wide average (teaching) days lost through sickness absence per employee, per annum 2023/24 14.0 13.9 9.6 7.6 2022/23 12.8 13.3 7.9 6.8 2021/22 11.1 12.2 6.0 5.8 The scope of this audit assessed the adequacy of design and operating effectiveness of the key controls established to ensure cross-directorate adherence to the Health & Work Policy. The review involved the testing of procedures followed for a random sample of employees on sick leave to assess levels of compliance with this Policy. A similar absence management review of NHS contracted officers is subject to a separate review in 2025/ 26 to be undertaken by the NHS Grampian Internal Audit Provider. This review will be reported separately to the Audit, Performance and Risk Committee of the MIJB. The audit was carried out in accordance with Global Internal Audit Standards (GIAS). 2. Key Issues • The audit found that the Council has a range of employee wellbeing initiatives that can support effective strategies to manage staff absence, such as: ➢ Health and Work Policy and Guidances ➢ Structured return-to-work programmes including phased return, reasonable adjustments, etc ➢ Occupational Health provision promoting health and wellbeing ➢ Employee Assistance Programme promoting health and wellbeing. ➢ Employee wellbeing guidance including Mental Health and Wellbeing, Menopause Policy and Working Together for a Positive Workplace ➢ Staff Feedback e.g. employee surveys Page 160
Page 161
Appendix 1 5 ➢ Training on health and wellbeing including mental health ➢ Recognition programme (STAR awards) All of these represent good practice, yet the days recorded as lost through sickness absence per employee within the Council and reported to the LGBF detailed a ranking of 17th out of 32 Scottish local authorities for non-teaching staff and 29th out of 32 for teaching staff. In addition, audit testing of a random sample of employees on sick leave found that management interventions and/or the timings of these management interventions were not, in the majority of cases tested, in accordance with the Health and Work Policy or Guidances. • The Health and Work Policy, supported by Guidance to managing Sickness Absence and the Sickness Absence Notification and Certification Guide, provides detailed instructions for managing employee absence effectively and minimising disruption to services. In addition, the Policy and Guidances promote a healthy workplace and ensure consistent and fair treatment of all employees. However, the Health and Work Policy was last reviewed for update in 2018. It is appreciated that the Policy may still be appropriate; comparisons with similar policies in other organisations should be considered, to see if Councils with better performance have alternative or additional strategies in place for managing staff absence. • In addition to the documented Health and Work Policy and Guidances, the Human Resources Service provides regular training for managers to support their knowledge of managing sickness absence for employees within their service. Audit testing found that around 40% of managers had undertaken this training. Efforts to improve take-up of this course are required to provide managers with a greater understanding of how to proactively manage employee sickness absence and comply with legal obligations. Page 161
Page 162
6 Findings/Recommendations - Absence Management 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium In March 2018, the Council's Policy & Resources Committee approved the Health and Work Policy as part of the Policy Framework Review. The Policy records a review date of 2021; however at the time of the audit, no review had taken place. The Health and Work Policy provides detailed instructions for managing sickness effectively. However, from an overview of similar policies within other local authorities, consideration could be given to including further clarification or additional information, such as: . • Guidance in the event of a line manager vacancy, including delegation. • Data protection considerations • Clarifying the importance of applying for management discretion where appropriate. • Useful contacts and flow-charting illustrations. The Council's Health & Work Policy should be reviewed and updated, where required, to reflect current best practice and to ensure effective management and support for improvements in sickness absence. Thereafter, regular reviews should be scheduled. Page 162
Page 163
7 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) Yes 31/03/2027 The Health and Work Policy is part of the Council’s employment policy review framework. While a full review in 2021 was not undertaken, an initial assessment was completed that indicated there were other more urgent policy reviews required with no substantial change to legislation or best practice related to the Health and Work Policy at that time. In early 2020 the impact of Covid-19 was a significant factor in the management of attendance at work and absence was subject to interim arrangements and ongoing review. The policy has nonetheless been reviewed more recently as part of a review of operational management practice (2024) and research for other potential interventions (2025). The document version history will be updated to show the review work undertaken since 2018 and work will progress on the scheduled formal review during 2026/27, which is the soonest available opportunity. Page 163
Page 164
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 High The most significant area of expenditure within the Council and the Moray Integration Joint Board (MIJB) is staffing. In 2024/25, the Council’s annual staffing expenditure was approximately £160 million, while for the MIJB it was £40 million relating to Council employed officers. Although outside the scope of this review, it was noted that annual staffing costs within the MIJB relating to NHS Grampian employed officers were approximately 56 million for the same period. Effective management of staff absence is therefore crucial to maintaining service delivery, controlling costs, and supporting employee well-being. The Council has 3,725 full time equivalent (fte) contracted employees, including 804 fte who are working under the direction of the MIJB. Sickness absence arrangements for Moray Council are managed through the Health and Work Policy, which is supported by specific guidance covering areas such as sickness notification, handling short and long-term absences and conducting return-to-work discussions. Additionally, the Council has a contract with an external service provider for the delivery of an Employee Assistance Programme. This programme is designed to support staff well-being through services such as counselling, access to information and resources and general support/ guidance. The audit also found that the Human Resources Service offers effective support and advice to management regarding procedures to follow when an employee is absent due to sickness. Detailed on the next page are the sickness days recorded as lost through sickness absence per employee within the Moray Council, compared against the Scottish average for all local authorities, as provided to the Local Government Benchmarking Framework (LGBF). Page 164
Page 165
9 Year Moray Council (Non- teaching) days lost through sickness absence per employee, per annum Scotland- wide average (Non teaching) days lost through sickness absence per employee, per annum Moray Council (teaching) days lost through sickness absence per employee, per annum Scotland-wide average (teaching) days lost through sickness absence per employee, per annum 2023/24 14.0 13.9 9.6 7.6 2022/23 12.8 13.3 7.9 6.8 2021/22 11.1 12.2 6.0 5.8 The Local Government Benchmarking Framework (LGBF), developed and coordinated by the Improvement Service in Scotland, enables councils to compare their performance across various topics to facilitate service improvements and greater transparency. Employee sickness absence is one of the key performance indicators. The audit review notes that employee sickness absence within the Council has increased over the past few years, with currently a ranking of 17th out of 32 local authorities for sickness absence days among non- teaching staff, and 29th out of 32 for teaching staff. Enquiries noted that, in 2024/25, the Council recorded sickness absence rates of 15.7 days lost (per employee) for non-teaching staff and 10.8 days lost (per employee) for teaching staff. This reflects a further annual increase in employee sickness absence across both groups. An iTrent System report obtained at the time of the audit identified Page 165
Page 166
10 depression/stress/anxiety as the leading causes of sickness absence, accounting for approximately 30% of non-teaching staff and 45% of teaching staff. Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 High The audit identified several areas where the Council promotes employee well-being and has established policies and guidance for effectively managing sickness absence, including: • Health and Work Policy, Guidance to managing Sickness Absence and Sickness Absence Notification and Certification Guide • Structured return-to-work programmes including phased return, reasonable work adjustments, etc. • Occupational Health provision promoting health and wellbeing • Employee Assistance Programme promoting health and wellbeing. • Employee wellbeing guidance including Mental Health and Wellbeing, Menopause Policy and Working Together for a Positive Workplace • Staff Feedback e.g. employee surveys The Council's Health and Work Policy, in conjunction with other employee wellbeing initiatives, provides direction that supports effective strategies for managing both short-term and long-term absences. However, from the audit testing undertaken, managers should be reminded of the need to comply with the requirements of the Health and Work Policy with specific reference to actions and timescales detailed within the Formal Absence Review Meetings framework. The audit review noted that the days lost through sickness absence per employee within the Council have been increasing over recent years. It is appreciated that there will be a cost implication, but consideration should be given to the further development of the iTrent system, which could streamline HR processes, improve workforce management and Page 166
Page 167
11 • Training on health and wellbeing including mental health • Recognition programme (STAR awards) and the wider employee engagement programme The Health and Work Policy outline actions and timescales within a framework of “Formal Absence Review Meetings” for managing both short-term and long-term employee absence. It also specifies the communication requirements and the potential outcomes that managers may implement when supporting and managing employees on sick leave. The audit reviewed a sample of employees on sick leave to assess compliance with the Health and Work Policy. The sample was randomly selected across Council and MIJB services, and the following points were noted: • From the sample of employees reviewed who were on sick leave, it was found that more than three quarters of all cases reviewed had communication timelines and actions that were not in accordance with those set out in the Health and Work Policy. This relates to when and how provide enhanced management reporting to monitor policy compliance and the effectiveness of initiatives to reduce sickness absence. Page 167
Page 168
12 managers should contact staff to discuss proposed actions regarding their ongoing or previous sickness absence. Audit testing was undertaken on a random sample of staff across all services, and instances of non-compliance with the timescales and actions detailed within the Formal Absence Review Meetings framework of the Health and Work Policy were identified, particularly in relation to the form of communication and adherence to timescales, which ranged from a few weeks to several years, The findings are based on a random sample of employees on sick leave. The scope of the audit focused on compliance with the Health and Work Policy. However, the review found a lack of the reasons for delays in communication and the actions taken in managing staff sickness. It is acknowledged that the operational demands on managers’ time may affect their ability to meet the requirements of the Health and Work Policy. Page 168
Page 169
13 • Included within the sample were officers working under the direction of the MIJB. Testing identified similar issues regarding adherence to the timescale and communication requirements detailed within the Health and Work Policy; however, the variances were not considered as significant when compared with officers under the direction of the Council. A balanced audit view was applied to any variances identified during testing of actions taken by managers in the sample of employees reviewed on sick leave, against the timescales detailed in the Health and Work Policy. While it is recognised that the demands on Trade Unions are significant, audit testing also noted delays in the availability of a Trade Union representative to accompany employees on sick leave to Formal Absence Review Meetings. The assistance of officers within the Human Resources Service in responding to queries and confirming the findings was greatly appreciated. Staff absence is recorded through a software application called iTrent. However, from an overview undertaken of absence management Page 169
Page 170
14 policies within other Councils, it appears that greater use is made of software applications in the recording, reporting and management of staff absence. It is understood that consideration is being given to an additional module within iTrent to allow improved digitisation of current processes; it is anticipated this would have a positive impact but would require time and resources to implement the necessary changes. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) Yes 31/12/2025 Reminders are sent to managers through trigger reports to support management action in accordance with the policy requirements and timescales. Training courses are routinely advertised and a Leadership Forum on 9 September 2024 focussed on the responsibilities and requirements of the policy. Further reminders will be added into the HR Bulletin on a quarterly basis. Page 170
Page 171
15 Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) Yes 31/12/2027 The need for improvement in absence management is acknowledged and has been under consideration by senior officers. As a result, it had been identified that action is required to fully understand the complexities and issues of absence management and to secure improvement. Therefore, work is underway to establish a transformation project aimed initially at improving absence within Education, where there is a large workforce and scope for improvement based on LGBF benchmarking. This will test out solutions that can be expanded to other services if successful. It is planned to report the proposal for approval to Council in December. Action is also underway to secure greater efficiency from the use of current technology. iTrent development is in the early stages of a transformation project, however, this is within the scope of the functionality currently within the Council contract which does include the system module recommended for development. Page 171
Page 172
16 To extend the use of the iTrent system to include greater absence analysis and case management would require the resourcing of an additional module for the system. This functionality would be a welcome development, however, a business case would be necessary to explore the extent to which it would provide a spend to save opportunity. Current resources are targeted to the council priorities in this area through the transformation programme: • improvement and enhancement of the current iTrent system functionality • improvements in the management of absence in accordance with the policy Following on from progress to deliver the benefits from the above two projects, consideration will be given to the benefits of a spend to save project to invest in an additional module for absence management. Page 172
Page 173
17 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium As detailed previously, the audit reviewed a sample of employees on sick leave from across all services to ensure that the management of the absence was administered in accordance with the Health & Work Policy. While this policy is intended to be applicable to all staff, there are specific requirements for dealing with the absence of teaching staff set out in the Scottish Negotiating Committee for Teachers (SNCT) Handbook, which covers pay and conditions of service applicable across all Scottish councils. The SNCT is a tripartite body comprising representatives from teaching organisations, local authorities and the Scottish Government. The negotiated national framework for teachers’ pay and conditions of service includes provisions on sickness allowance. A review comparing the Council’s Health & Work Policy with the Scottish Negotiating Committee for Teachers (SNCT) Handbook identified differences in the actions required by the Council to support individuals on sick leave and in the authority of a Head of Education Clarification should be obtained, including from Legal Services, on whether the Council’s Health & Work Policy should be amended to reflect the differing conditions for absence management set out in the Scottish Negotiating Committee for Teachers (SNCT) Handbook. Page 173
Page 174
18 (Chief Education Officer) to extend the payment of sickness allowance. Discussions with Human Resources officers confirmed that these issues have been identified and that contact has been made with Legal Services to seek further clarification. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) Yes Implemented Further discussions have now taken place with Legal Services regarding this issue. Following careful consideration, it has been agreed that no amendments should be made to the Health and Work Policy at this time. The Council’s approach to managing absence must allow for the individual circumstances of each case to be considered. Applying a blanket approach to a specific element, particularly one involving the interpretation of a national condition that would require a definitive ruling by a court or tribunal, does not allow for such consideration. No case has arisen to trigger this requirement to date, although it would be possible for there to be such a case in the future this Page 174
Page 175
19 is considered a low risk and could be dealt with if required. Page 175
Page 176
20 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Low There is a Sickness Absence Notification and Certification Guide in place to support the Council's Health & Work Policy. The Guidance outlines the procedures and responsibilities for employees to notify their designated manager of a sickness absence. Within the Education Service, an additional section requires earlier notification to ensure sufficient notice for cover arrangements. However, no comparable requirement has been identified to ensure staff coverage in the delivery of other essential services, e.g., Health and Social Care. It is acknowledged that individual services have developed their own procedures for the notification of absence by officers. Consideration should be given to updating the Sickness Absence Notification and Certification Guide to include reference to service specific absence notification requirements, developed to address situations where staff are unavailable for work due to sickness. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim Yes 31/03/2027 Consideration of amending the Health and Work Policy as recommended will be taken forward as part of the scheduled policy review due to commence from April 2026. Page 176
Page 177
21 arrangement until the appointment of the responsible officer) Page 177
Page 178
22 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium The Council has a contract with a company to provide an Occupational Health and Wellbeing Service (OH). The Health and Work Policy details when a referral regarding an employee’s sickness absence should be made to OH. On receipt of this referral, OH may be required to seek a “Specialist Report” concerning the employee’s condition from a General Practitioner or other specialist. A review of the contract between the Council and the OH company states that they “will endeavour to send Specialist Reports within 6 weeks of the date of request. It is acknowledged that Specialist Reports can take between 6 weeks and 3 months from the date of request.” Discussions with officers and audit testing found significant delays of up to 10½ months in the provision of these Specialist Reports. These delays may impact the ability to resolve issues concerning the employee's ongoing absence and may hinder an earlier return to work. In accordance with the contract between the Council and the OH company, there is a requirement for quarterly progress meetings. The delays in providing “Specialist Reports” within agreed timescales should be raised at these meetings and actions agreed with the OH provider to enable a timelier provision of these Reports in accordance with the conditions of the contract. Page 178
Page 179
23 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) Yes 31/12/2025 Following up on outstanding 3rd party reports will be added as a standing item on the regular contract management meetings. Where there are delays in securing 3rd party reports, in addition to pursuing through the OH provider, the employee concerned is asked to follow up through their medical team. If this is not successful, where necessary and possible, absence cases are progressed with the information that is available and this will continue to be emphasised to managers and HR advisers to avoid time delays wherever possible. Page 179
Page 180
24 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Medium The Human Resources Service has developed a monthly reporting system called “Trigger Reports,” which are emailed to managers and detail officers within their service who are absent from work due to sickness. This is considered good practice, and testing confirmed consistent reporting by the Human Resources Service to managers of employees on sick leave within their service. However, a review of individual trigger reports noted that these reports only record an employee's details for the initial month of absence. If the employee remains absent in the following month, the manager will not be notified unless another employee within their service is absent, which then generates a further trigger report. While the demanding workloads of managers are appreciated, ongoing notification of an employee’s absence may assist in promoting a proactive approach to attendance management in accordance with the Health and Work Policy. Consideration should be given to ensuring that managers receive monthly Trigger Reports for all employees on sickness leave within their service for the duration of their absence. Page 180
Page 181
25 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) Yes 31/01/2027 Consideration of the viability and impact of this recommendation will be assessed following a period of 6 months initially (review scale of demand from administrative perspective) and 12 months for review of impact. Page 181
Page 182
26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 7 Medium The Human Resources (HR) Service provides training courses (around 4 times a year) aimed at supervisors/managers who are responsible for managing employee absence. This is a half day course offering guidance on the principles and application of the Health and Work Policy. Testing was undertaken on a random sample of supervisors/managers responsible for the management of staff to ascertain whether training had been completed. The results of the testing undertaken revealed that around 40% of the supervisors/managers had undergone the training recently. For effective and consistent application of the Policy, all managers with line responsibilities for staff should be encouraged to participate in the training delivered by the HR Service. A reminder should be issued to all supervisors/managers responsible for staff management to attend training on the Council's Health and Work Policy. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Yes 31/01/2026 Health at Work training courses are regularly advertised to managers, however Page 182
Page 183
27 Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) other options to promote the training will be considered e.g. adding a link to the manager induction course. Additional numbers can be accommodated within the scheduled courses with improved attendance. Page 183
Page 184
28 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 8 Medium It is pleasing to note that senior officers from the Human Resources Service scrutinise a monthly listing of the 10 employees with the highest sickness absence within the Council to ensure appropriate management actions are being taken in compliance with the Health and Work Policy. This process also helps identify where additional support may be required for a service and/or where further employee wellbeing measures are needed. This is considered good practice and supports effective absence management across the Council. A review of these monthly reports noted that the same employees can appear over consecutive months. The need to review the absences of employees with the highest number of sick days is acknowledged. However, consideration could be given to expanding the current selection criteria to include analysis of absence patterns, which may help identify potential workplace or individual issues. Consideration should be given to expanding the selection criteria for the monthly overview undertaken by senior officers in the Human Resources Service, regarding absence management actions taken for employees with the highest number of sickness absence days. Page 184
Page 185
29 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) Yes 31/03/2026 Consideration will be given to expanding the selection criteria for monthly overview and the usefulness of this combined with the additional demands on a small central team required to produce the data. Page 185
Page 186
30 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 9 Medium As detailed previously, the Council has a contract with a company to provide an Occupational Health and Wellbeing Service (OH). The audit checked that procurement and processing of payments to this company is in compliance with Financial Regulations and Procurement Guidelines. The following points were noted: • Invoices payable to the OH company are issued at the beginning of the month, resulting in payments being made in advance of the service delivery. Financial Regulations state that advance payments for goods or services are only permissible with the prior written consent of the Chief Financial Officer. This had not been obtained. • A check was made to ensure that the payments made to the OH company were in accordance with the contract. It was found that a price increase had been incorrectly applied to monthly invoices from July 2024, resulting in an overpayment of £2,464. In accordance with Financial Regulations, invoices should be paid to the OH company only after the service has been delivered, or written consent obtained in writing from the Chief Financial Officer to authorise the advance payment. Payments to the OH company should be made in accordance with the contract. The overpayment identified during the audit should be recovered at the earliest opportunity. Page 186
Page 187
31 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of People, Change & Community Strategy / Executive Director Education, Housing & Communities (interim arrangement until the appointment of the responsible officer) Yes 31/10/2025 Invoices are currently being processed at the end of the month they pertain to. Discussion with the provider will take place to ensure invoicing is in line with the conditions of the contract. Arrangements have been made for recovery of the overpayment. Page 187
Page 188
32 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 188
Page 189
33 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk (CAE). Page 189
Page 190
Page 190
Page 191
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Follow-Up Review – Moray Growth Deal 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 10 September 2025 to 19 November 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of a follow-up review of a Moray Growth Deal audit undertaken in 2024/25; this project has been agreed for review within the Internal Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Considers the contents of this report, seeks clarification on any points noted, and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 The Moray Growth Deal represents a transformational investment of over £100 million across eight strategic projects designed to maximise regional competitiveness and drive Item 10. Page 191
Page 192
economic growth in Moray. It brings together the United Kingdom and Scottish Governments, Moray Council and partners from the public, third and business sectors to work collaboratively in delivering the Growth Deal’s vision for the region. In addition to reviews undertaken by the Council’s Internal Audit Section, each partner organisation is individually responsible for allocating internal audit resources to its own projects. 4.2 Due to the importance of the Moray Growth Deal, the Audit Plan for 2025/26 included a follow-up review of an audit undertaken in 2024/25, to be reported as a separate project. The previous audit examined the governance, financial and administrative arrangements that support the delivery of the Moray Growth Deal. I am pleased to report that the follow- up review confirmed all recommendations have been implemented. Further auditing of Moray Growth Deal activities is planned for inclusion in next year’s Audit Plan, with findings to be reported to this Committee. The follow-up report detailing the implementation of the agreed recommendations is provided in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. Page 192
Page 193
b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. Page 193
Page 194
7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 194
Page 195
Appendix 1 1 Final Internal Audit Report (Follow-up Review) Moray Growth Deal November 2025 Distribution: Head of Growth, Planning & Climate (Chief Planning Officer) Service Manager Growth Deal Chief Financial Officer Senior Communications Officer The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 2 Priority 2 3 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 195
Page 196
Appendix 1 2 Contents Page Following the Public Pound 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-13 4. Management Response 5-14 5. Follow Up Review 6-15 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 196
Page 197
Appendix 1 3 1. Introduction and Audit Scope The annual audit plan for 2024/25 provides for a review of the governance and administrative procedures for the management of the Moray Growth Deal (the Deal). The Moray Council’s Internal Audit Service will overview the Deal programme and project activities, but each partner organisation is separately responsible for allocating internal audit resources for its specific project. The Moray Growth Deal is a transformational programme, designed to drive economic growth across Moray over a ten year period and is supported by £100 million of investment with £65 million being invested by the UK and Scottish Governments. The Deal brings together the UK and Scottish Governments and Moray Council, together with Partners from across the public, third sector, and businesses, to work collaboratively in delivering the Deal's vision for the region. This year, the Deal entered its fourth year of the ten year programme with four of the eight approved projects now in the delivery phase and three of the four having already made grant claim submissions to draw down funding. At the time of the audit review, the funding claimed for the Moray Growth Deal amounted to £5.2 million. The scope of the audit included a review of the governance and administrative arrangements surrounding the Moray Growth Deal. It also considered how partnership working is operating, the financial management of the Deal and how success is being measured. It is pleasing to report that from the testing undertaken and within the scope of this review, effective arrangements are in place for the governance and administration of the Moray Growth Deal. However, the following areas were identified for management attention: The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • The audit included testing on a sample of grant claims for projects currently in delivery and the expenditure claimed. The review found that in relation to one project, not all expenditure claimed had supporting documentation to evidence the payment. This concerned certain categories of expenditure relating to salary costs, overheads, travel/ subsistence and software related recharges. • In accordance with the Moray Growth Deal Financial Plan, each Partner Organisation is separately responsible for allocating internal audit Page 197
Page 198
Appendix 1 4 resources for Moray Growth Deal Activities. It was agreed within a previous audit report that each Partner Organisation should provide their Annual Audit Plans to the Moray Council for planned internal audit activity regarding the Moray Growth Deal. However, this requirement could be further supported with an annual meeting between the Internal Audit Services of the Council and Partner Organisation to review previous audits undertaken and to discuss and agree on the scope of future auditing activities. Page 198
Page 199
5 Findings/Recommendations – Moray Growth Deal 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium The Communications Protocol was developed by the Moray Council Communications Team before the signing of the Deal. This document sets out an agreed framework for communication and engagement protocols for both proactive and reactive activities in relation to the Moray Growth Deal. The Protocol details that effective use should be made of My Moray web and social media sites to ensure members of the public are kept up to date on Moray Growth Deal news and developments. The audit appreciates the limited staff resources, but it was noted that during the audit period, news releases had not been posted to the My Moray website and social media postings can be infrequent. Further use should be made to post information on My Moray website and social media sites to ensure effective communication of any developments concerning the Moray Growth Deal. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Senior Communications Officer/ Moray Growth Deal Programme Manager Yes 31/12/2024 A lack of dedicated comms and engagement resource was flagged as a risk before the deal was signed and has continued to be an issue Page 199
Page 200
6 with ensuring continuous comms activity. However, information is shared in-line with project comms plans. Social media posts are shared when there is a relevant update and appropriate content – best practice is to only share updates when there is newsworthy content, otherwise engagement rates will be negatively impacted. A publishing error on the website has now been rectified to ensure all releases are shared timeously. As more projects enter delivery and there is more content available to share publicly this will be done. Quarterly full deal public updates will also be introduced. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Postings to the My Moray website and social media sites have been observed. There appears to be a balance of activity against the stage of the programme and individual projects. Page 200
Page 201
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium A Stakeholder Engagement Plan was developed in 2021 to detail the framework for engagement across all Moray Growth Deal projects with a key objective of promoting positive benefits for Moray and creating opportunities for stakeholders to influence the projects as they develop. The Plan details the need for regular review, however it was found there is no evidence of a formal review of this document. The audit also noted that the Stakeholder Engagement Plan requires engagement with targeted audiences to evidence the success of implementing Moray Growth Deal Projects. As more projects enter the delivery phase, it will become more important to obtain this data to evidence a success objective in supporting the realisation of benefits. The Stakeholder Engagement Plan should be reviewed and, if required, updated. Engagement should be undertaken with the targeted audiences for a project to evidence an established objective of the Moray Growth Deal. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Moray Growth Deal Programme Manager / Yes 31/03/2025 While engagement has been taking place at the appropriate stages of project development, Page 201
Page 202
8 Senior Communications Officer the plan needs to be updated and have partner sign-off. Analytics, insights and evaluation are included in the comms tracker and will link to the updated engagement plan. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The Stakeholder Engagement Plan (Plan) has been reviewed and updated and was approved by the Programme Board at its meeting of 27 March 2025. In relation to engagement with targeted audiences to support the measurement of success, this is captured in the Plan with relevant interdependencies noted. The revised Plan outlines the intention for dialogue between the Councils’ communications team and project managers to identify and document quantitative and qualitative information in support of providing an evidence base regarding performance Page 202
Page 203
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Low It was noted that a Communications Planner spreadsheet is used to organise and plan a communication strategy for all projects. The audit noted examples where fields within this spreadsheet regarding dates and explanatory information had not been completed. Better use could be made of the Communications Planner spreadsheet to support the management of the communication needs of the Moray Growth Deal more effectively. It was also found that not all communications related information is saved on the Moray Growth Deal Sharepoint site. In order to ensure consistency, all information concerning Deal activities should be saved on the Moray Growth Deal Sharepoint site. All fields within the Communications Planner spreadsheet should be completed to aid the communication management needs of the Moray Growth Deal. All communications related activities, where documented, e.g., press releases, should be saved on the Moray Growth Deal Sharepoint site. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Senior Communications Officer Yes Implemented The tracker has been refined to ensure all fields are relevant and information has been backdated where necessary to create a comprehensive record of comms actions undertaken. Page 203
Page 204
10 Senior Communications Officer Yes Implemented Now that the comms team has full access to the Sharepoint site, documentation can be kept updated through version controls. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A At the time of the follow-up review the communications planner had been updated, ensuring information has been captured within the relevant fields. In addition, press releases were found to be stored within the appropriate Sharepoint site. The staff resources within the Communications team continues to be challenging. Internal Audit coverage of the MGD for the 2026/27 financial year will include further testing in this area of the programme to ensure continued implementation. Page 204
Page 205
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 High The audit reviewed a sample of grant claims for projects currently being delivered where expenditure has been claimed from Moray Growth Deal funding. It was noted that not all spending included in the claims from a partner organisation could be verified with supporting evidence. Invoices/receipts had been provided for some creditor payments, however, certain expenditure categories i.e. salary costs, overheads, travel/ subsistence and software application costs were not supported by claim forms or system back-up documentation. The audit also checked the type of payments included within the funding claimed by a partner organisation, as eligibility for reimbursement can depend on whether the expenditure is capital or revenue cost. It was noted that included within the claims are payments for subsistence, travelling and overheads, which are generally not considered as capital expenditure. However, it is appreciated the accounting rules detailing if expenditure can be capitalised are complex. All partner organisations should be informed that supporting evidence must be provided for all expenditure claimed from Moray Growth Deal funding. Further to the findings noted within the audit and discussions with the Chief Financial Officer, a review of the types of payments claimed by the partner organisation should be undertaken to ensure the correct classification of expenditure. Page 205
Page 206
12 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Financial Officer Chief Financial Officer Yes Yes Immediate 31/12/2024 Partners are reminded of the requirement for audit evidence when claims are submitted and additional scrutiny given to the project in question A review of payment types will be undertaken to ensure compliance with the European System of Accounts 10 and in accordance with grant conditions. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented Implemented N/A N/A Procedures have been amended to now require supporting evidence proportionate to the expenditure by partner led projects to be provided for claims made from Moray Growth Deal funding. The Accountancy Service reviews spend types to ensure compliance with the European System of Accounts 10 regulations, ensuring that the conditions of the grant are being met. Page 206
Page 207
13 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium Further to an internal audit report issued in 2022, a recommendation detailed that 'Each Partner Organisation should provide their Annual Audit Plan to the Moray Council of planned internal audit activity regarding Moray Growth Deal activities. These plans should then be forwarded to the Audit and Risk Manager for Review'. At the time of this review, two partner organisations internal audit services have either delivered or are undertaking reviews regarding the delivery of Moray Growth Deal projects. Copies of each partner organisations annual audit plans had not been provided to the Moray Council Internal Audit Service. However, it is pleasing to note that one of the partner organisations internal audit services did forward details of the scope of a review to the Council’s Audit and Risk Manager, which does provide some assurance of the audit coverage undertaken of Moray Growth Deal project delivery. Partner organisations' internal audit services should be reminded to forward copies of their annual audit plans to the Moray Council regarding planned internal audit activity of Moray Growth Deal activities. This will allow the Moray Council, as the Accountable Body, to be consulted and contribute to the scope of the review. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Page 207
Page 208
14 Service Manager Growth Deal / Senior Auditor Yes 31/03/2025 At the time of the audit 2 of the 4 Growth Deal projects led by partners were in delivery, with one having completed an internal audit at the end of 2023 (the details of which had been passed to the audit team) and the other project had only entered delivery in 2024. Given different approaches to audit in the partner organisations, the PMO will work collaboratively with the Council’s Internal Audit Team to organise an annual meeting that seeks to: - Identify audit activity planned for the year ahead, securing audit plans ahead of the meeting when Moray Growth Deal activity is scheduled. - Review audit activity undertaken in the previous 12 months - Share learning and identify cross cutting issues that all partners should take account of when planning future activity It is expected that the first of these meetings will take place during Q4 24/25 FY and partners were briefed at the MGD Board on 26/09/24 of the need to support this. Page 208
Page 209
15 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A A meeting between the Service Manager Growth Deal, partners and the Council’s Senior Auditor took place in February 2025. This provided an opportunity to gain a greater understanding of the auditing practices within partner organisations and to develop a more collaborative approach. The Service Manager Growth Deal and Senior Auditor have also met individually with all partners to discuss their existing and planned future audit activities, taking into account the varying stages of individual projects. In addition, the first iteration of an annual strategic review of risk at a Deal level, designed to support the scope of future audit activity is currently in draft and will be submitted by the Service Manager Growth Deal to the Board during 2025/26. Page 209
Page 210
16 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 210
Page 211
17 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Audit and Risk Manager. Page 211
Page 212
Page 212
Page 213
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Charter 1. PURPOSE ☒ For Decision ☐ For Information 1.1 This report provides an updated Internal Audit Charter to meet the requirements of the new Global Internal Audit Standards. 1.2 This report is submitted to the Committee in terms of Section III I (2) and (6) of the Council’s Scheme of Administration relating to the consideration of reports from the Council’s Internal Auditor and overseeing the independence, objectivity, performance and conformance to professional standards of Internal Audit. 2. SUMMARY 2.1 The Committee is asked to consider and approve a revised Internal Audit Charter to ensure compliance with the new Global Internal Audit Standards. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Consider and approve the revised Internal Audit Charter. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 The Local Authority Accounts (Scotland) Regulations 2014 introduced a statutory requirement for all Scottish Local Authorities to have an internal audit service and to conform with recognised standards and practices in relation to internal auditing. The agreed standards for local authorities internal audit providers in Scotland are the Global Item 11. Page 213
Page 214
Internal Audit Standards. The Global Internal Audit Standards are organised into five domains and include 15 guiding principles and a total of 54 standards which contain requirements and essential conditions for implementation across internal audit services. The Global Internal Audit Standards (GIAS) came into effect on 1 April 2025 replacing the Public Sector Internal Audit Standards. GIAS requires all internal audit providers to implement and maintain an ‘Internal Audit Charter’. 4.2 The internal audit charter is defined as a formal document that includes the internal audit function’s mandate, organisational position, reporting relationships, scope of work, types of service and other specifications. Where previously the Public Sector Internal Audit Standards provided a framework, the GIAS details more prescriptive expectations for the delivery of the internal audit function and those responsible for governance. These include: • Detailing a greater explanation of the role of the Service Manager Internal Audit and Risk (Chief Auditor Executive) (CAE) in the delivery of an internal audit function, including the nature of the CAE’s functional reporting relationship with the Audit and Scrutiny Committee. • Topical Requirements - Need for the CAE to consider a minimum baseline for coverage in specific risk areas within the annual audit plan. • Providing further clarity of the role of the Audit and Scrutiny Committee in their oversight responsibility of the Internal Audit Service. • Detailed requirements for avoiding conflicts of interest if the Internal Audit Service undertakes non-audit activities. The new standards require that the Charter be reviewed annually and approved by the Audit and Scrutiny Committee. The revised Internal Audit Charter is provided in Appendix 1. 5. PROPOSALS 5.1 The Committee is asked to consider and approve the revised Charter document for internal audit to ensure ongoing compliance with recognised auditing standards. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Page 214
Page 215
Equalities. Social Inclusion and Economic Impact × Climate Change, Biodiversity and Sustainability × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Page 215
Page 216
Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 A copy of the revised Internal Audit Charter has been provided to the Chief Executive; Executive Director Education, Housing & Communities; Executive Director Economy, Enterprise & Operations; Chief Governance Officer; Chief Financial Officer; Chief Officer, Moray Integration Joint Board and Grampian Assessor and Electoral Registration Officer. 8. BACKGROUND PAPERS 8.1 None Page 216
Page 217
Appendix 1 Moray Council Internal Audit Section INTERNAL AUDIT CHARTER September 2025 Date for review: Annual Page 217
Page 218
2 Appendix 1 INDEX TOPIC PAGE INTRODUCTION 3-4 PURPOSE STATEMENT OF INTERNAL AUDITING – DOMAIN I • Commitment to Adhering to the Global Internal Audit Standards 5 • Internal Audit Mandate 5 • Independence, Organisational Position, and Reporting Relationships 6 • Changes to the Mandate and Charter 7 ETHICS & PROFESSIONALISM – DOMAIN II • Demonstrate Integrity 7 • Maintain Objectivity 7-8 • Demonstrate Competency 8 • Exercise Due Professional Care 8-9 • Maintain Confidentiality 9 GOVERNING THE INTERNAL AUDIT FUNCTION – DOMAIN III • Authority 9 • Independence 9-10 • Audit and Scrutiny Committee (Board) 10-11 MANAGING THE INTERNAL AUDIT FUNCTION – DOMAIN IV • Plan Strategically 11-12 • Manage Resources 12 • Communicate effectively 12 • Enhance quality 13 PERFORMING INTERNAL AUDIT SERVICES - DOMAIN V • Plan Engagement Effectively 13 • Conduct Engagement Work 13-14 • Communicate Engagement Conclusions and Monitor Action Plans 14 FRAUD AND CORRUPTION 14-15 Glossary Board - refers to the Council’s Audit and Scrutiny Committee which has delegated responsibility for overseeing the work of the Internal Audit Service Chief Audit Executive (CAE) - refers to the Service Manager Internal Audit and Risk Page 218
Page 219
3 Appendix 1 INTERNAL AUDIT CHARTER FOR THE MORAY COUNCIL Introduction 1.1 The Local Authority Accounts (Scotland) Regulations 2014 introduced a statutory requirement for all Scottish local authorities to have in place and to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the United Kingdom for all public sector internal audit providers, in-house, shared or outsourced, are the Global Internal Audit Standards (GIAS). The GIAS, in their applicability to the public sector, must be considered along with the Application Note: Global Internal Audit Standards in the UK Public Sector, which has been produced to assist with the interpretation of the GIAS. 1.2 The GIAS contain requirements to support 15 guiding principles associated with and expected to be operating within the Internal Audit function across 5 key domains: Purpose, Ethics and Professionalism, Governing, Managing and Performing, these domains and the 15 guiding principles are outlined in the images below. Page 219
Page 220
4 Appendix 1 1.3 In accordance with the Global Internal Audit Standards (GIAS), all local authorities in Scotland must produce an Internal Audit Charter (Charter). The Charter is required to detail the purpose, mission, authority, independent reporting relationships and scope of responsibilities of the internal audit function. The GIAS refers to the head of an internal audit service as the Chief Audit Executive and within the Moray Council, this is the Service Manager Internal Audit and Risk. The Internal Audit Section of the Moray Council also provides internal audit services to the Moray Integration Joint Board (MIJB) and the Grampian Valuation Joint Board (GVJB). The same professional standards defined in this Internal Audit Charter will apply to all work undertaken for the MIJB and GVJB. Purpose Statement of Internal Auditing– Domain I 2.1 As defined by the GIAS, the purpose of the Internal Auditing (IA) function is to strengthen the Council’s ability to create, protect and sustain value. This is achieved by providing the Audit and Scrutiny Committee and senior management with independent, risk- based and objective assurance, advice, insight and foresight. 2.2 The IA function enhances the Council’s: • Successful achievement of its objectives Page 220
Page 221
5 Appendix 1 • Governance, risk management and control processes • Decision-making and oversight • Reputation and credibility with its stakeholders • Ability to serve the public interest 2.3 The Council’s IA function is most effective when: • Internal auditing is performed by competent professionals in conformance with the GIAS, which are set in the public interest • The IA function is independently positioned with direct accountability to the Audit and Scrutiny Committee • Internal auditors are free from undue influence and committed to making objective assessments 2.4 IA assurance is provided by delivering an annual programme of audit work that independently and objectively assesses the design and effectiveness of the controls established to manage the Council’s most significant risks. Commitment to Adhering to the Global Internal Audit Standards 2.5 The Council’s Internal Audit (IA) function will adhere to the Institute of Internal Auditors' International Professional Practices Framework, consisting of the GIAS and Topical Requirements as well as the Application Note: Global Internal Audit Standards in the UK Public Sector. When expressing conformance with standards, the Council’s IA function will be clear that it is conforming to the Global Internal Audit Standards in the UK Public Sector. The Service Manager Internal Audit and Risk (CAE) will report annually to the Audit and Scrutiny Committee and senior management on the IA function’s conformance with the GIAS, which will be assessed through a quality assurance and improvement programme. Internal Audit Mandate 2.6 In accordance with the GIAS, the Council’s Internal Audit (IA) function receives its mandate from the Council’s first-tier constitutional documents with particular reference to the Scheme of Delegation and Financial Regulations. These documents set out the authority, roles and responsibilities enabling the IA function to provide the Audit and Scrutiny Committee and senior management with independent, risk-based and objective assurances on the robustness of the Council’s internal control systems. 2.7 The IA function’s authority is also supported by its direct reporting relationship to the Audit and Scrutiny Committee and senior management. Such authority allows for unrestricted access to the Chief Executive, Chair of the Audit and Scrutiny Committee and the Council Leader. Page 221
Page 222
6 Appendix 1 Independence, Organisational Position, and Reporting Relationships 2.8 The GIAS state that the Service Manager Internal Audit and Risk (CAE) should be positioned at a level in the Council that enables the Internal Audit (IA) Service to be performed without interference from management, thereby ensuring the independence of the IA function. 2.9 The CAE reports functionally to the Audit and Scrutiny Committee and administratively to the Chief Governance Officer (Monitoring Officer). This provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit and Scrutiny Committee, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity. 2.10 The CAE is required to confirm to the Audit and Scrutiny Committee, at least annually, the organisational independence of the IA function. If the governance structure does not support organisational independence, the CAE must document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. The CAE must disclose to the Audit and Scrutiny Committee any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the IA function’s effectiveness and ability to fulfil its mandate. 2.11 To ensure that IA independence and objectivity are maintained for assurance services, IA will remain free from interference from anyone within the Council in relation to audit selection, scope, procedures, frequency, timing and report content. 2.12 Where IA also has responsibility for non-audit activities, the GIAS requires that appropriate arrangements be established to avoid conflicts of interest. Additionally, IA will not be permitted to audit any activities for which they have previously been responsible within a period of one year and will not engage in any other activity that may impair their judgment or independence. For advisory services, the IA role will be specifically restricted to providing guidance, views, and opinions. To comply with independence requirements, IA will not be involved in any aspects of operational decisions subsequently taken by management. 2.13 The Service Manager Internal Audit and Risk (CAE) is responsible for supporting the Council’s risk management and business continuity arrangements. These responsibilities are carried out within the Internal Audit Section by the Business Continuity and Risk Management Officer, who is also involved in preparing the Council’s Annual Governance Statement. The operational management of these duties is overseen by senior management, including the Chief Governance Officer, rather than by the Service Manager for Internal Audit and Risk (CAE). This approach helps to avoid impairments to the independence and objectivity of the IA function. Page 222
Page 223
7 Appendix 1 Changes to the Mandate and Charter 2.14 The Audit Charter will be reviewed annually to ensure that it remains up to date. Any amendments will be approved by the Audit and Scrutiny Committee. Requirements to update the Internal Audit Charter may include: • A significant change in the Global Internal Audit Standards in the UK Public Sector. • A significant reorganisation within the Council • Significant changes to the Audit and Scrutiny Committee, and/or senior management Ethics & Professionalism– Domain II Demonstrate Integrity 3.1 The CAE will ensure that internal auditors: • Conform with the GIAS including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, confidentiality and the Seven Principles of Public Life • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the Council and can recognise conduct that is contrary to those expectations • Encourage and promote an ethics-based culture in the Council • Report organisational behaviour that is inconsistent with the Council’s ethical expectations, as described in applicable policies and procedures Maintain Objectivity 3.2 The Service Manager Internal Audit and Risk (CAE) will ensure that the internal audit function remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the CAE determines that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties. 3.3 Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively, such that they believe in their work product, do not compromise quality and do not subordinate their judgment on audit matters to others, either in fact or appearance. 3.4 Internal auditors will have no direct operational responsibility or authority over any of the activities they review. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: Page 223
Page 224
8 Appendix 1 • Assessing specific operations for which they had responsibility within the previous year • Performing operational duties for the Council or its partner organisations • Initiating or approving transactions external to the IA function • Directing the activities of any employee that is not employed by the IA function, except to the extent that such employees have been appropriately assigned to IA teams or to assist internal auditors 3.5 Internal auditors will: • Immediately disclose impairments of independence or objectivity, in fact or appearance, to the Service Manager Internal Audit and Risk (CAE) • Exhibit professional objectivity in gathering, evaluating, and communicating information • Make balanced assessments of all available and relevant facts and circumstances • Take necessary precautions to avoid conflicts of interest, bias, and undue influence. Demonstrate Competency 3.6 The Service Manager Internal Audit and Risk (CAE) will hold an appropriate professional qualification in addition to relevant experience. Therefore, in considering whether a CAE is suitably qualified, an organisation must be looking for: • CMIIA, or a CCAB qualification, or an equivalent professional qualification which includes training on the practice of internal audit, and • Suitable internal audit experience 3.7 In addition, all staff who are on professional training programs must comply with their terms and conditions of practice and maintain the standards expected of the professional institute they belong to and other relevant requirements as outlined in this Charter. 3.8 All staff must maintain their continued professional development in accordance with their professional body on an annual basis and make the appropriate declaration where required. Exercise Due Professional Care 3.9 In completing planning activities and subsequent audit work internal auditors shall consider the: • Extent of work needed to achieve the engagement’s objectives • Relative complexity, materiality or significance of matters to which assurance procedures are applied • Adequacy and effectiveness of governance, risk management and control processes • Probability of significant errors, fraud, or non-compliance Page 224
Page 225
9 Appendix 1 • Cost of assurance in relation to potential benefits Maintain Confidentiality 3.10 The GIAS set out the duty of internal auditors to be faithful custodians of the information they gather, sharing only in limited, defined, and controlled ways. GIAS describes the need for awareness of responsibilities in protecting information and demonstrating respect for the confidentiality, privacy and ownership of information. 3.11 While the duties under the GIAS mainly relate to restricting the sharing of information, auditors must also be aware of the circumstances under which sharing or publication of information will be required. They must be aware of the Council’s policies and procedures for the routine publication of certain information and where there are statutory obligations to share or publish information. Governing the Internal Audit Function – Domain III Authorisation by the Audit and Scrutiny Committee (Board) 4.1 Appropriate governance arrangements are essential to enable the Internal Audit (IA) function to be effective. This domain outlines the requirements for the Service Manager Internal Audit and Risk (CAE) to work closely with the Audit and Scrutiny Committee to establish the IA function, position it independently and oversee its performance. 4.2 In the United Kingdom, such arrangements are highly developed, particularly within local government, and are further supplemented by the CIPFA in the ‘Practical Guidance for Audit Committees for Local Authorities and Police 2022 edition’. In Moray, the Council’s Scheme of Delegation details the role of the Service Manager Internal Audit and Risk to act as the Chief Audit Executive for the delivery of internal audit services in accordance with GIAS. Positioned Independently – The Audit and Scrutiny Committee (Board) establishes and protects the internal audit function’s independence and qualifications 4.3 The Audit and Scrutiny Committee (Board) is responsible for enabling the independence of the Internal Audit (IA) function. Independence is defined as the freedom from conditions that impair the internal audit function’s ability to carry out its responsibilities in an unbiased manner. Page 225
Page 226
10 Appendix 1 4.4 The Service Manager Internal Audit and Risk (CAE), who reports functionally to the Council’s Audit and Scrutiny Committee, is appropriately qualified and has the necessary experience. The Service Manager, Internal Audit and Risk (CAE), administratively reports to the Chief Governance Officer (Monitoring Officer) but has access to the Chief Executive, Chair of the Audit and Scrutiny Committee and the Council Leader. This both maintains independence and positions the Service Manager Internal Audit and Risk (CAE) within the Council to discharge the function of internal audit and its responsibilities without interference. Overseen by the Audit and Scrutiny Committee (Board) – The Board oversees the internal audit function to ensure the functions effectiveness. 4.5 The Audit and Scrutiny Committee (Board) oversight is essential to enable the overall effectiveness of the Internal Audit (IA) function. Achieving this principle requires collaboration and interactive communication between the Board and the Service Manager Internal Audit and Risk (CAE), as well as the Board’s support in ensuring the IA function obtains sufficient resources to fulfil the internal audit mandate. 4.6 To establish, maintain, and ensure that Moray Council’s IA function has sufficient authority to fulfil its duties, the Audit and Scrutiny Committee will, if required: • Discuss with the CAE and senior management the appropriate authority, role, responsibilities, scope, and services (assurance and/or advisory) of the IA function • Ensure the CAE has unrestricted access to and communicates and interacts directly with the Audit and Scrutiny Committee, including in private meetings with or without senior management present, where that is required • Discuss with the CAE other topics that should be included in the internal audit charter, where appropriate • Approve the IA function’s charter, which includes the internal audit mandate and the scope and types of internal audit services • Review the internal audit charter periodically with the CAE to consider changes affecting the Council such as the employment of a new CAE or changes in the type, severity and interdependencies of risks to the organisation; and approve the internal audit charter on an annual basis.(A copy of the internal audit charter will be included for approval with the audit plan) • Approve the risk-based audit plan and any strategy on which it is based and monitor completion of the plan, in accordance with any performance indicators set annually • Through discussion with the CAE be satisfied that the IA function’s human Page 226
Page 227
11 Appendix 1 resources, administration and budgets are sufficient to complete the audit plan and provide an annual opinion • Through discussion with the CAE determine if they are satisfied that the service has appropriate levels of skills to fulfil its ability to complete the audit plan • Ensure that the CAE has adequate competencies and qualifications in conformance with the GIAS • Receive communications from the CAE about the IA function including its performance relative to its plan. These will be in accordance with the Committee’s scheduled timetabling of meetings as outlined in the Council’s meetings calendar • Ensure a quality assurance and improvement programme has been established and review the results annually and every five years for the external review to ensure that any deficiencies identified and opportunities for improvement contain an action plan and timeline for addressing these issues, together with monitoring progress • Make appropriate enquiries with the CAE to determine whether scope or resource limitations are inappropriate Managing the Internal Audit Function – Domain IV 5.1 The Service Manager Internal Audit and Risk (CAE) is responsible for managing the Internal Audit (IA) function in compliance with the internal audit charter and GIAS. This responsibility includes strategic planning, obtaining and deploying resources, building relationships, communicating with stakeholders, and ensuring and enhancing the performance of the function. 5.2 The CAE is expected to conform with the GIAS, whilst the CAE may delegate appropriate responsibilities to other qualified professionals in the delivery of the IA function. Plan Strategically 5.3 Planning strategically requires the Service Manager Internal Audit and Risk (CAE) to understand the internal audit mandate and organisational governance, risk management and control processes. A properly resourced and positioned IA function helps develop and implement a strategy to support the organisation’s success. 5.4 The CAE will develop and produce an internal audit strategy to support the requirements of the GIAS and the annual audit plan. The strategy and resulting audit plan will be subject to ongoing monitoring and updated where deemed appropriate. 5.5 The Council’s IA Service will have appropriate supporting methodologies (processes and procedures) in place via the Internal Audit Manual to provide clear directions to staff on expected practices which must be followed to achieve the Page 227
Page 228
12 Appendix 1 wider requirements within the GIAS and UK applications. Manage Resources 5.6 The Service Manager Internal Audit and Risk (CAE) manages resources to implement the internal audit function’s strategy and achieve its audit plan and mandate. The CAE must develop a budget that enables the successful implementation of the audit plan, this will include training, technology and day-to- day activities. 5.7 The Council has an established and documented process for developing budgets and resources that will be needed to cover the work of the IA function. As part of the annual budget planning process, the internal audit function will consider its needs, which will include, but not be limited to, staffing, training, travel and other associated costs. If the CAE has concerns regarding the level of internal audit resources to meet the auditing requirements of the Council or partner organisations, this should initially be raised with senior management for resolution before it is reported to the Audit and Scrutiny Committee. 5.8 Appropriately qualified staff will be engaged to provide services within the IA function, together with appropriate training and continued professional development. Communicate effectively 5.9 The Service Manager Internal Audit and Risk (CAE) guides the IA function to communicate effectively with its stakeholders, building relationships, establishing trust and enabling stakeholders to benefit from the results of the internal audit services. 5.10 The Council’s IA function has clear and documented processes for engagement with its stakeholders, which are documented in its internal audit manual. This process includes but is not limited to accurate, objective, clear, concise, constructive, complete and timely reporting of its fundings. 5.11 The Council’s IA function, through the CAE, will update the Audit and Scrutiny Committee (Board) on the completion of the audit plan and any significant revisions. In addition, the Board will be informed when there is an inability to agree on a recommendation with management, and where the IA function believes it is critical or high risk in relation to a control weakness that could put the Council at risk. In the event that other risks are identified that do not meet the threshold of being critical or high risk, acceptance of the risk will be noted in the action plan contained within the report. Page 228
Page 229
13 Appendix 1 Enhance quality 5.12 The Service Manager Internal Audit and Risk (CAE), is responsible for ensuring the IA function’s conformance with the GIAS and for continuous performance improvement where required. Appropriate and independent internal quality assessments will be required by self-assessment annually and externally every five years. Findings of any quality assessments undertaken will be reported to senior management and the Audit and Scrutiny Committee. Performing Internal Audit Services - Domain V Plan Engagement Effectively 6.1 The Service Manager Internal Audit and Risk (CAE) will submit an annual audit plan to the Audit and Scrutiny Committee for review and approval, which is designed to support the provision of an evidence-based assessment of the robustness of the Council’s internal control systems. This annual audit plan will be developed, based on a risk-based prioritisation of the audit universe from a range of key stakeholders, including Members, Chief Executive, Corporate Leadership Team and Heads of Services. 6.2 The scope of internal audit activities also encompasses, but is not limited to, objective examinations of evidence to provide independent assurance and advisory services to the Audit and Scrutiny Committee and senior management on the adequacy and effectiveness of governance, risk management, and control processes for the Council and partner organisations. However, the nature of evolving risks makes it likely that the audit assignments included in the audit plan may be subject to change. Consequently, the audit plan will be reviewed by the Service Manager Internal Audit and Risk (CAE) on an ongoing basis and any proposed changes will require the approval of the CAE and the Audit and Scrutiny Committee. Conduct Engagement Work 6.3 The Service Manager Internal Audit and Risk (CAE) must consider the effect on the opinion work before accepting consultancy work or management requests over and above the contingency allowed for in the internal audit plan. Such consultancy work will only be undertaken where resources permit, without impacting on the annual assurance process, and where there is no direct or perceived conflict of interest or eroding of the independence and objectivity of the internal audit function. The CAE will inform the Audit and Scrutiny Committee of any significant unplanned consultancy work undertaken. Page 229
Page 230
14 Appendix 1 6.4 The nature, objectives and scope of advisory services may be agreed with the party requesting the service, provided the IA function does not assume management responsibility. Opportunities for improving the efficiency of governance, risk management, and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management. Communicate Engagement Conclusions and Monitor Action Plans 6.5 Findings from audit reviews undertaken will be communicated to the Audit and Scrutiny Committee and senior management effectively, along with the significance and prioritisation, including limitations of scope, where applicable, and conclusions in relation to governance, risk management, and internal controls. The Council’s IA function will make all such communications in line with the GIAS and will be reflected in the internal audit manual. 6.6 Appropriate follow-up and monitoring of recommendations will be undertaken by the IA function and this will be reported to the Audit and Scrutiny Committee and senior management. 6.7 The GIAS requires the Service Manager Internal Audit and Risk (CAE) to coordinate with internal and external assurance providers to consider relying on their work and minimise duplication of effort. This may be achieved via a shared risk assessment with the Council’s external auditors and other sources of external assurance, where relevant. 6.8 The GIAS recognises that there are various relevant outside assurance providers whose authority flows from separate legal or regulatory sources beyond the control or influence of the CAE, and it may not have any ability to access the work of those assurance providers or gain insight into the scope and timing of their work. Under these circumstances, the CAE must consider whether it is possible or practical to coordinate. Handling Information 6.9 The GIAS set out the duty on internal auditors to be faithful custodians of the information they gather, sharing only in limited, defined and controlled ways, and describes the need for awareness of responsibilities in protecting information and demonstrating respect for the confidentiality, privacy and ownership of information. Fraud and Corruption 7.1 In accordance with the Council’s Policy to Combat Fraud, Theft, Bribery and Corruption, management is responsible for the prevention and detection of fraud or corruption. The Internal Audit Section will assist management in fulfilling this responsibility. Page 230
Page 231
15 Appendix 1 7.2 Audit procedures alone cannot guarantee that all fraud or corruption will be detected. Internal Audit will, however, exercise an appropriate level of professional scepticism during audit work and be alert to risks and exposures that could allow the opportunity for fraud or corruption to occur. 7.3 In support of the Council's counter fraud arrangement, the Service Manager Internal Audit and Risk (CAE) will consider including a counter fraud review of the Council’s systems and procedures to minimise the risk and impacts of fraud from internal and external threats. Page 231
Page 232
Page 232
Page 233
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Executive Director Economy, Enterprise and Operations Author: John Black Contact Email: John.black@moray.gov.uk Subject: Scottish Public Services Ombudsman Recommendation Report 2024-25 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to seek Committee approval to publish the Scottish Public Services Ombudsman (SPSO) Recommendations Report to comply with the SPSO statutory requirement to demonstrate learning and improvement. 1.2 This report is submitted to Audit and Scrutiny Committee in terms of Section III (A) (4) of the Council’s Scheme of Administration relating to monitoring performance in accordance with the Council’s performance management framework. 2. SUMMARY 2.1 Appendix 1 to this report provides details of seventeen cases referred by complainants to SPSO. Nine minor feedback points were received from SPSO covering five cases. SPSO were satisfied with our handling of the other twelve cases. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Consider and note the content of the SPSO Recommendations Report; ii) Welcome performance as indicated in the report; and iii) Approve the report for submission to the Scottish Public Services Ombudsman (SPSO). John Black Complaints Officer Item 12. Page 233
Page 234
4. BACKGROUND AND CONTEXT 4.1 Under Section 16A of the Scottish Public Services Ombudsman Act 2002, SPSO published a Statement of Principles concerning complaints handling procedures (CHP) that local authorities must adhere to. One of these principles being ‘learning and improvement’. 4.2 This report complies with Part 4 of the Council’s CHP relating to complaint governance where it is required to demonstrate to SPSO, senior management awareness of complaint learning and improvement. 4.3 The report was last reported to Committee in November 2024. 5. PROPOSALS 5.1 Table 1 (Appendix 1) provides an overview of all complaints submitted to Moray Council during the 2024-25 reporting period that were referred to the Scottish Public Services Ombudsman (SPSO) by complainants. Where the SPSO issues a recommendation, the Council is required to take the specified action within the prescribed timeframe and supply evidence of compliance to the SPSO. No recommendations were made by SPSO for the cases considered.” 5.2 Of the seventeen cases considered, SPSO provided nine minor feedback points from five cases. The Council are not required to report back to SPSO on minor feedback points. 5.3 Case 101003415819, SPSO reference 202308803 relates to an Environmental and Commercial Services complaint that the Council had not responded to emails; mishandled of an FOI request; and Complaints Handling Procedure (CHP) stages had not been followed. The Council investigated and upheld all three complaint issues. SPSO provided 3 feedback points: 1. The Council did not agree the heads of complaints the complainant was looking to raise at stage 2 (investigation stage). 2. The stage 2 response did not evidence that the Council had investigated the complaint in line with our CHP. 3. The same person responded to both the stage 1 and stage 2 complaints, and this should not happen. The Moray Council Complaints Officer took ownership of this case and re-investigated it to the satisfaction of the complainant with no further SPSO involvement required. 5.4 Case 101003442705, SPSO reference 202311021 relates to an Economic Growth and Development complaint that the Council did not discharge planning conditions or take enforcement action in respect of a new build development. The Council did not uphold this complaint as correct procedures were followed. Page 234
Page 235
SPSO provided one feedback point – It is important to ensure that communication around planning is realistic, accurate and does not give a false impression of what may happen. If there is a range of possible outcomes, then this should be explained clearly to manage expectations. 5.5 Case 101003529391, SPSO reference 202403697 relates to a Housing and Property Services that the Council had contracted companies to carry out housing repairs however they did not notify customers in advance of their attendance. The Council fully upheld this complaint. SPSO provided one feedback point - Although verbal apologies had been provided, a written apology should also be provided when upholding a complaint. 5.6 Case 101003558391, SPSO reference 202408365 relates to an Education complaint that the Council had shown bias in the way site options for the proposed new Forres Academy have been presented. The Council did not uphold this complaint. SPSO provided one feedback point – SPSO advised that the Council had not fully followed its Complaint Handling Procedure where some complaint points had not been addressed. They asked that the Council issue a revised stage 2 response. This was issued to the complainant on 13 May 2025 and no further SPSO involvement was required. 5.7 Case 101003664480, SPSO reference 202409286 relates to an Economic Growth and Development complaint that the Council should not have accepted a retrospective planning application. The Council did not uphold this complaint. SPSO provided three feedback points – Point one - The complainant could have been informed directly if the planning officer did not consider further correspondence would be productive. Instead, after the complainant did not receive a response to their letters of 4 July and 9 August 2024, they had to chase the Council for a response. At the point of receiving the letter dated 4 July 2024 the Council could have indicated that no further correspondence would occur and directing the complainant to the complaints process, this did not occur until 16 September 2024. Point two - Complaints handling: The Council’s formal response to the complaint did not include the level of detail expected. While it is noted the points raised by the complainant were responded to in previous correspondence, it is good practice to ensure the formal final response to a complaint is comprehensive. It is good practice for formal complaint responses to not be responded to by someone Page 235
Page 236
involved in the subject of the complaint. Where this is not possible it is good practice to explain why that is the case. Point three - The freepost address for the SPSO at the end of the complaint response was out of date. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) X Policy and Legal X Financial X Risk X Staffing X Best Value and Transformation X Property X Information Communications Technology/Digital X Equalities. Social Inclusion and Economic Impact X Climate Change and Biodiversity Impact X 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☒ Tackle Poverty and Inequality. ☒ Build Stronger Greener Vibrant Economy. ☒ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☒ Developing a diverse, inclusive, and sustainable economy ☒ Building a better future for our children and young people in Moray. ☒ Empowering and connecting communities. ☒ Improving wellbeing of our population 6.3 Policy and Legal SPSO require local authorities to demonstrate senior management awareness of learning and improvement through the SPSO Recommendations Report. Following approval of this report, the Chief Executive is required to send a letter to SPSO confirming this. 6.4 Financial It is not anticipated that there will be any financial implications. Page 236
Page 237
6.5 Risk Failure to adhere to the statutory SPSO requirement may result in SPSO making a declaration of non-compliance against the Council. Non-compliance with the statutory duty relating to national standards being adopted would present risk in terms of reputational damage and a loss of public confidence in reporting complaints. 6.6 Staffing There are no staffing implications related to this report. 6.7 Best Value and Transformation Effective Complaint handling can identify learning and improvement opportunities for services. 6.8 Property There are no property implications related to this report. 6.9 Information Communications/Technology/Digital There are no information communications/technology/digital implications related to this report. 6.10 Equalities, Social Inclusion and Economic Impact The Equal Opportunities Officer has recommended that complaints should be monitored to identify any patterns or gaps where services may have unintentionally not met the needs of protected groups. Monitoring with help to inform service developments to ensure an accessible, proportionate and inclusive complaints process while reducing any inequality or disadvantage. 6.11 Climate Change and Biodiversity Impacts There are no climate change and biodiversity impacts implications in this report. 7. CONSULTATION 7.1 This report has been prepared in consultation with the Corporate Leadership Team, Equalities Officer, Caroline O’Connor, Committee Services Officer and any comments made have been incorporated into the report. 8. BACKGROUND PAPERS 8.1 There are no background papers. Page 237
Page 238
APPENDIX 1 Case Ref/No LOG Ombudsman Referrals 01-04-2024 to 31-03-2025 Submission Req’d/Sub Details Decision/Date Action Plan Y/N Comp Ref No Department 1. SPSO 202308803 30/01/2024 101003415819 Environmental and Commercial Services Complained that: Emails were not responded to; mishandling of an FOI request; CHP stages not followed. The Council upheld all three complaint aspects. 30/01/2024 – SPSO issued a decision letter. 3 Feedback Points: SPSO advised that, despite upholding the complaint, we had not followed due CHP process, specifically: a. We did not agreed the complaints the complainant was looking to raise at stage 2 (investigation stage); b. Our stage 2 response did not evidence that we had investigated the complaint in line with our CHP; and c. The same person responded to both the stage 1 and stage 2 complaints and this shouldn’t happen. The Complaints Officer assumed ownership Y Page 238
Page 239
of this complaint and carried out a stage 2 investigation to the satisfaction of the complainant, addressing the feedback points raised by SPSO. As a result, no further SPSO involvement was required. 2. SPSO 202310228 28/05/2024 101003432375 101003192777 Children and Families and Criminal Justice Complained that: Lack of social work staff action leading to the breakdown of an adoption process for a young person. The Council did not uphold this complaint. 12/08/2024 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N 3. SPSO 202310998 18/04/2024 101003482086 Finance Services Complained that: Received a final demand payment for council tax despite having made payment. The Council did not uphold this complaint as correct procedures were followed. 18/04/2024 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N Page 239
Page 240
4. SPSO 202311021 19/04/2024 101003442705 Economic Growth and Development Complained that: We did not discharge planning conditions or take enforcement action in respect of a new build development. The Council did not uphold this complaint as correct procedures were followed. 20/03/2025 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. One Feedback Point: It is important to ensure that communication around planning is realistic, accurate and does not give a false impression of what may happen. If there is a range of possible outcomes, then this should be explained clearly to manage expectations. Y 5. SPSO 202311581 09/04/2024 101003489807 Environmental and Commercial Services Complained that: The road works project on the A940, Forres to Grantown Road at its junction with the access road to Beachens, Dunphail, Forres was both expensive and unnecessary. The Council did not uphold this complaint. 20/06/2024 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N Page 240
Page 241
6. SPSO 202401814 01/04/2024 101003533746 101003565254 101003585670 Education Complained that: Staff didn’t follow procedures or take appropriate actions when the complainant’s child went missing for a short time whilst in the care of nursery staff. The Council fully upheld this complaint. 21/10/2024 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N 7. SPSO 202403697 04/09/2024 101003529391 Housing and Property Services Complained that: We had failed to respond on reported anti-social behaviour reports. Companies contracted to carry out housing repairs did not notify in advance of their attendance. The Council fully upheld this complaint. 18/09/2024 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. One Feedback Point: Although verbal apologies had been provided, a written apology should also be provided when upholding a complaint. Y 8. SPSO 202405140 05/11/2024 101003619759 Health and Social Care Moray Complained that: Care and social work staff had unfairly reported the complainant to Police Scotland regarding the way he had 04/12/2024 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N Page 241
Page 242
assisted care staff to lift his cared for wife. The Council partially upheld this complaint. 9. SPSO 202405271 05/02/2025 101003462851 101003379954 Finance Services Complained that: Staff did not follow due process for claiming outstanding Council tax payments. The Council did not uphold this complaint as correct procedures were followed. 14/03/2025 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N 10. SPSO 202405309 25/09/2024 101003604186 Environmental and Commercial Services Complained that: A service charge relating to harbour use was unfair. The Council did not uphold this complaint as the charge was made in line with procedure. 25/09/2024 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N 11. SPSO 202407011 02/12/2024 101003557197 Economic Growth and Development Complained that: Council has poorly handled a planning application. The Council did not uphold this 02/12/2024 – SPSO issued a decision letter. SPSO did not take any further action as the issue complained about exceed the SPSO 12-month time limit and there were no N Page 242
Page 243
complaint. exceptional circumstances. 12. SPSO 202407830 17/01/2025 101003642687 Environmental and Commercial Services Complained that: Council had failed to carry out agreed work to a driveway. The Council partially upheld this complaint. 17/01/2025 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N 13. SPSO 202408365 10/03/2025 101003558391 Education Complained that: Staff has shown bias in the way site options for the proposed new Forres Academy have been presented. The Council did not uphold this complaint. 10/03/2025 – SPSO issued a decision letter. One Feedback Point: SPSO advised that the Council had not fully followed our complaint handling procedure and asked us to issue a revised stage 2 response. This was issued on 13 May 2025. SPSO advised that they would only take further action if the complainant reported dissatisfaction of the revised stage 2 response. Y 14. SPSO 202408435 11/12/2024 101003661861 Education Resources and Communities Complained that: We did not correctly process a FitLife membership and requested back payments. 09/01/2025 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N Page 243
Page 244
The Council partially upheld this complaint. 15. SPSO 202409286 30/01/2025 101003664480 Economic Growth and Development Complained that: The Council should not have accepted a retrospective planning application. The Council did not uphold this complaint. 30/01/2025 – SPSO issued a decision letter. SPSO were satisfied in general with our handling of this complaint and advised that they would be taking no further action. Three Feedback Points: The complainant could have been informed directly if the planning officer did not consider further correspondence would be productive. Instead, after the complainant did not receive a response to their letters of 4 July and 9 August 2024 they had to chase the Council for a response. At the point of receiving the letter dated 4 July 2024 the Council could have indicated that no further correspondence would occur and directing the complainant to the complaints process, this did not occur until 16 September 2024. Complaints handling: The Council’s formal response to the complaint did not include the level of detail expected. While it is noted the points raised Y Page 244
Page 245
by the complainant were responded to in previous correspondence, it is good practice to ensure the formal final response to a complaint is comprehensive. It is good practice for formal complaint responses to not be responded to by someone involved in the subject of the complaint. Where this is not possible it is good practice to explain why that is the case. The freepost address for the SPSO at the end of the complaint response was out of date. 16. SPSO 202409519 05/06/2024 101003582116 Health and Social Care Moray Complained that: The Council had unfairly maintained unacceptable customer action restrictions over a period of years. Historical complaint matters had been ignored. A joint Council/NHS complaint had been incorrectly dealt with. The Council fully upheld this 05/03/2025 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N Page 245
Page 246
complaint. 17. SPSO 202310543 18/04/2024 101003507502 Environmental and Commercial Services Complained that: The Council had refused his request to take down trees that complainant felt posed a risk to his property from high winds. The Council did not uphold this complaint. 25/09/2024 – SPSO issued a decision letter. SPSO were satisfied with our handling of this complaint and advised that they would be taking no further action. N Page 246
Page 247
Report to: Audit and Scrutiny Committee Meeting Date: 19 November 2025 Report by: Executive Director Education, Housing and Communities Author: Denise Whitworth Contact Email: hr@moray.gov.uk Subject: Review of Recommendations Arising from Accounts Commission Audit of Senior Officer Exit Packages 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to consider and note the review of Moray Council’s current practice for senior officer exit packages against the recommendations arising from the recent Accounts Commission audit of Glasgow City Council. 1.2 This report is submitted to Committee in terms of Section 3 (I) (1) and (3) of the Council’s Scheme of Administration relating to ensuring the highest standards of probity and public accountability are demonstrated and to consider reports from Audit Scotland concerning Council functions. 2. SUMMARY 2.1 In August 2025 the Accounts Commission considered a report from the Controller of Audit on the scrutiny, governance and transparency of decision-making of exit packages of senior officers in Glasgow City Council (Appendix 1) following matters arising from the Annual Audit Report for 2023/24. A number of issues and serious concerns were highlighted on how decisions were made on the exit packages of senior officers over a defined period. 2.2 In response to the report, the Accounts Commission have published its findings (available as a background paper) and set out their expectation that the issues the report highlights will be discussed by Audit and Scrutiny Committees within each Council following review of the Scheme of Delegation and decision-making processes. This report sets out Moray Council’s compliance with that requirement. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: Item 13. Page 247
Page 248
i) Consider and note the review of current practice for senior and other officer early departure arrangements demonstrates best practice is already adopted; and ii) Note that there are no substantive changes required subject to normal reviews of approach when considering large scale workforce contraction and re-shaping. Denise Whitworth Executive Director Education, Housing and Communities 4. BACKGROUND AND CONTEXT 4.1 As part of the Annual Audit Report for Glasgow City Council for 2023/24, the auditor raised significant matters in relation to the scrutiny, governance and transparency of decision- making in respect of the exit of five senior officers over the course of a 3-year period between 2021 and 2024. The Lead Controller of Audit used their available reporting powers under s102 (1) of the Local Government (Scotland) Act 1973 to bring these matters to the Accounts Commission’s attention and the Accounts Commission have taken proactive steps to ensure that all local government bodies recognise the important lessons to be learnt and have written to all council chief executives and leaders to highlight the importance of good governance and transparency in decision-making, letter included as a background paper. 4.2 The Accounts Commission acknowledge that councils need to undertake organisational and staff restructuring from time to time as an organisation realigns its resources to respond to change or new priorities and find ways to work more efficiently. This can include redeployment or reductions of senior officers through early retirement or redundancy packages. It is important that decisions made about restructuring, including exit packages for senior staff are undertaken transparently with clear governance arrangements reflecting the principles of public life in Scotland (referenced in Appendix 1) and that they demonstrate value for money for the public purse. 4.3 The Accounts Commission also refer to the Nine Key Principles of Public Life in Scotland (the Nolan Principles) as the basis for transparency and good governance around decision making. Councils must ensure there is clear evidence of effective governance, independent scrutiny and value for money as well as robust and transparent record keeping where decisions around restructuring and exit packages are being taken. 5. PROPOSALS 5.1 There have been previous reports by the Accounts Commission into the management of early departures of senior officers amongst councils and the key messages remain relevant. Assessment of Moray Council’s practice with early departures was assessed in a report to Audit and Performance Review Committee on 3 July 2013 (paragraph 7 of the minute refers) following an Audit Scotland National Report ‘Managing early departures from the Scottish public sector’. This found that Moray Council’s approach to the use of early departure schemes complied with the principles of best practice identified in the report and there were no areas of risk to be addressed. Page 248
Page 249
5.3 Review of the lessons learnt from the Glasgow City Council audit indicate that Moray Council’s governance and transparency of decision-making arrangements on early departures mean that it would not be possible for the situation that occurred in Glasgow City Council to happen at Moray Council. 5.2 All early departure scheme applications are managed in accordance with our agreed policies and procedures and scrutinised at either Council or Committee by elected members. The Scheme of Delegation refers explicitly to both Member and Officer Codes of Conduct, both of which are based on the principles of public life. Members and Officers have a good understanding of the of the requirements for and implementation of requests for restructure, redundancy and retirement of officers through the Council’s agreed policy and procedures in this regard and scrutinise and consider detailed reports at Corporate Committee or Council on a regular basis. This also demonstrates that the prevailing culture among senior officers appropriately reflects the standards and behaviours required by the principles of public life and that Moray Council continues to adhere to best practice in the management and scrutiny of early departures for all employees. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) x Policy and Legal x Financial x Risk x Staffing x Best Value and Transformation x Property x Information Communications Technology/Digital x Equalities. Social Inclusion and Economic Impact x Climate Change and Biodiversity Impact x 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: Page 249
Page 250
☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal The Council has a comprehensive suite of agreed policies and procedures for the management of early departures for staff, including senior officers. This includes consideration and scrutiny by elected members. 6.4 Financial There are financial implications arising from early departures that are documented in each individual application considered by Council or Committee following scrutiny by Human Resources and the Chief Financial Officer. One off Costs: Service Area Budget Budget Years Proposed Spend this Year Virement From Other Comments Annually Recurring Costs: Service Area Budget With Effect From Annual Net Impact Virement From (if applicable) Other Comments 6.5 Risk There are risks in not considering National Audit Report findings, including not meeting the Council’s statutory duty to secure best value. 6.6 Staffing There are no direct staffing implications arising from this report. 6.7 Best Value and Transformation Strong governance and scrutiny arrangements provide transparency and assurance that the principles best value are being maintained. 6.8 Property There are no property implications. 6.9 Information Communications/Technology/Digital There are no information, technical or digital implications. 6.10 Equalities, Social Inclusion and Economic Impact There are no equalities, social inclusion or economic impact implications. 6.11 Climate Change and Biodiversity Impacts Page 250
Page 251
There are no climate change and biodiversity impact implications. 7. CONSULTATION 7.1 This report has been prepared in consultation with the Chief Governance Officer, the Corporate Leadership Team and Extended Corporate Leadership Team and any comments made have been incorporated into the report 8. BACKGROUND PAPERS 8.1 Accounts Commission Letter Page 251
Page 252
The 2023/24 audit of Glasgow City Council Senior officer exit packages Prepared by the Controller of Audit September 2025 APPENDIX 1 Page 252
Page 253
The 2023/24 audit of Glasgow City Council | 2 Contents Commission findings 3 Introduction 6 How decisions were made 10 The council’s response 16 Accessibility You can find out more and read this report using assistive technology on our website www.audit.scot/accessibility. Page 253
Page 254
Commission findings | 3 Commission findings The Accounts Commission accepts the Controller of Audit’s report on a matter arising from the 2023/24 audit of Glasgow City Council in relation to the scrutiny, governance and transparency of decision-making of exit packages of senior officers. The Commission welcomes that the Controller used her powers to bring this issue to its attention, and notes she was able to draw on the independent investigation of the issue undertaken by Brodies LLP (on behalf of the council), as well as the annual audit report. The Brodies LLP report was itself supported by the report of a King's Counsel (KC), whom Brodies had instructed to review and provide an opinion on its investigation. Following consideration of the Controller’s report (presented at page 6) at its meeting on 14 August, the Commission has made the findings presented below. 1 The Commission welcomes the actions of the new chief executive of Glasgow City Council in commissioning an internal review and an independent investigation of these issues following discussions with appointed auditors, and for reporting the findings of the investigation publicly. We note that the 2023/24 annual audit report shows the council has accepted many of the recommendations and look forward to seeing the auditors’ review of progress in the 2024/25 annual audit. We expect the council to have strong evidence of good governance, scrutiny, and value for money and to present clear business cases for future restructuring. 2 Given that councils are required (under the under Section 4 of the Local Government and Housing Act 1989), to have a ‘head of paid service’, and that this is ordinarily the post of chief executive, we find it hard to understand how this post was part of a senior management restructuring package, developed in February 2021 (and presented in the ‘Restructure Report’), aimed at cost savings and efficiency. Within the final Restructure Report, an Executive Director post, deleted in January 2021, was linked to the early retirement of the chief executive, and subsequently included as part of payback period calculations. As the Brodies report states, the savings Page 254
Page 255
Commission findings | 4 associated with the deleted post had already been achieved. Based on the information considered, it is our view that the rationale for the former chief executive’s retirement contributing to efficiencies was, at best, unclear. 3 We consider that the restructuring package was dealt with in a manner inconsistent with the Key Principles of Public Life in Scotland, in particular selflessness, integrity and objectivity. The Restructure Report appears to have been approved by some individuals who then benefitted from its proposals. This exhibits a failure to address and document potential conflicts of interest (that should have been obvious to such senior and experienced officers) and displays a lack of judgement in relation to how their actions adhered to the principles. The council should take action to ensure that all officers and members are not only familiar with the principles but that the organisational culture respects and supports them fully. The council must also ensure that independent scrutiny is applied to issues and decisions where there are potential conflicts of interest. 4 Given the seniority of the officers associated with these exit packages, our clear view is that a full report should have been presented to the relevant committee for approval. Within the Scheme of Delegation used during this period, consideration of whether to involve elected members was a ‘judgement call’ by officers based on whether an issue could be considered politically controversial. Given the significance of the post of chief executive, linking it to efficiency savings should have been subject to independent scrutiny. Had elected members been involved at key stages, their scrutiny could have mitigated some of the justified criticisms around perceived conflicts of interest. 5 As councils continue to face financial challenges, service redesign and restructuring will be a necessary part of responding, so transparency around decision-making is essential. The decisions of elected members and officers should uphold the nine Key Principles of Public Life in Scotland – selflessness, integrity, objectivity, accountability, openness, honesty, leadership, public services, respect. Where decisions around restructuring and exit packages are being taken, councils must ensure there is clear evidence of effective governance, independent scrutiny, and robust and transparent record keeping. Page 255
Page 256
Commission findings | 5 6 It is alarming to see reports which need to consider the lawfulness of actions within councils, and such circumstances do little to reassure taxpayers about how public money is being used. Given the serious issues highlighted in the Controller’s report, the Commission considered carefully the most appropriate way to use the powers available to it, including holding a hearing, making recommendations to Scottish ministers or censuring in light of the concerning issues presented. In reaching our findings, we have considered the legal advice provided to Glasgow City Council and the action already taken. On this occasion, we have decided to take proactive steps to ensure that all local government bodies recognise the important lessons presented here, including writing to all council chief executives and leaders to highlight the importance of good governance and transparency in decision-making. Page 256
Page 257
Introduction | 6 Introduction 1. The Code of Audit Practice requires auditors to produce an Annual Audit Report (AAR) summarising the significant matters arising from their audit work. For local authorities, auditors address the AAR to elected members and the Controller of Audit. 2. I have received the Annual Audit Report and the audited annual accounts for Glasgow City Council (the council) for 2023/24. The appointed local auditor (Stephen Reid of Ernst & Young LLP (EY)) has issued a qualified audit opinion in relation to the council’s financial statements for the council and its group in respect of two City Building group entries for a second year. This reflected the impact of delays from previous years’ auditing of the accounts for these arm’s-length external organisations following a series of whistleblowing allegations in 2022. 3. The auditor also identified several risks, including the need for a robust medium- to longer-term financial strategy to reflect potential financial scenarios and support financial sustainability, as well as the need to agree a revised date for implementation of the new pay and grading structure. A total of 30 recommendations remain open, including 19 Grade 1(high risk) recommendations. I will monitor the council’s progress with addressing these issues through the audit team. I intend to bring a Best Value report to the Commission in August 2026 and will keep this under review with the appointed auditor including consideration of the pace of progress in implementing improvements. 4. The auditor also raised significant matters in the AAR in relation to the scrutiny, governance and transparency of decision-making in respect of the exit of five senior officers over the course of a three-year period between 2021 and 2024. I have decided to use the reporting powers available to me under s102 (1) of the Local Government (Scotland) Act 1973 to bring these matters to the Accounts Commission’s attention. 5. My report relies on a number of publicly available documents. Auditors have not undertaken primary evidence gathering such as interviews with current or former officials of Glasgow City Council. The report draws heavily on the independent review ‘Investigation into exit packages of former senior officials at Glasgow City Council’ undertaken by Brodies LLP, particularly for the ‘Background’ and ‘How decisions were made’ sections of the report. The independent review report is publicly available from Glasgow City Council. It was produced for the purposes of the council, and I appreciate the agreement of both the council and Brodies to use the content. I note that the parties who exited the council as part of the restructure of the Chief Executive’s Department were not interviewed, and Page 257
Page 258
Introduction | 7 not all had the opportunity to give evidence to the investigation carried out by Brodies. My report also draws on the work reported by the appointed auditor in the Annual Audit Report 2023/24. Background 6. In early 2021, a proposal was drafted setting out a restructure of the council’s Chief Executive’s Department, which included setting out the financial arrangements relating to the exit of five senior officers. The officers were: • the former solicitor to the council and director of governance • the former principal advisor to the chief executive • the former head of human resources • the former head of legal and administration and latterly director of legal and administration • the former chief executive. 7. The departures took place between April 2021 and May 2024. The total cost of the exit packages was £1.035 million with £0.268 million relating to redundancy payments and £0.77 million relating to strain on pension fund costs. The estimated ongoing savings in the proposal were £0.65 million per annum. Strain on pension fund costs are the additional cost incurred by a pension fund when a member retires early or receives benefits without actuarial reductions, often due to factors like redundancy or employer- approved early retirement. These costs arise because the fund needs to pay out benefits sooner or with less reduction than initially anticipated, requiring additional funding to cover the shortfall. 8. The leader of the council and city treasurer raised concerns after publication of the unaudited financial statements, which included details of the pension costs and payments in relation to loss of office, were published. The new chief executive launched an internal review into these matters which led to the commissioning of an independent review, including legal advice. 9. In March and April 2025, the outcome of the independent review was reported to three of the council’s committees for consideration. Subsequently, proposed changes to strengthen its governance arrangements in relation to workforce and service reform, were considered and agreed at a meeting of the council on 15 May 2025. A timeline of these events is set out in Exhibit 1. It is important to note that the Brodies independent investigation states that ‘we did not find any evidence Page 258
Page 259
Introduction | 8 allowing us to conclude that any recipient of any severance/retirement package, or any other officer, acted improperly’. Exhibit 1 Timeline of key events 2021 to 2024 January/February 2021 As part of planning for the restructuring of the council’s Chief Executive’s Department, a business case was developed which set out the proposed financial arrangements for the exit of five senior officers within the department. April 2021 The former solicitor to the council and director of governance left the council. She received a sum of £95,000 voluntary separation payment. July 2021 The former principal advisor to the chief executive left, receiving early unreduced access to her pension and redundancy, totalling benefits of just under £192,000. January 2023 The former head of human resources left, receiving early unreduced access to his pension and redundancy, totalling benefits of just under £148,000. September 2023 The former head of legal and administration (latterly the director) left, receiving early unreduced access to her pension and redundancy totalling benefits of £283,000. May 2024 The former chief executive left, receiving early unreduced access to her pension at a cost of £317,000 to the council. July 2024 The council published its unaudited financial statements, including the remuneration report, disclosing costs associated with the early retirement of the former chief executive and former director of legal and administration. August 2024 The accounts and financial statements were reported to the council’s Finance and Audit Scrutiny Committee. September 2024 An internal review was commissioned by the new chief executive to be performed by the council’s monitoring officer and head of audit and inspection. October 2024 The appointed auditor was notified about the internal review and about the restructure report. December 2024 The council instructed Brodies LLP to investigate and prepare an independent report on these matters. Page 259
Page 260
Introduction | 9 Timeline of key events 2025 February 2025 Brodies LLP provided the report of its investigation. This included the report of a King’s Counsel (KC), Brodies had instructed to review and provide an opinion on its investigation. March 2025 The council’s Finance and Audit Scrutiny Committee considered in public, a report by the chief executive on the findings of the independent investigation by Brodies of senior officer exit payments. This included provision of the full Brodies report and KC opinion. April 2025 The council’s Wellbeing, Equalities, Communities, Culture and Engagement Policy Committee considered a report setting out the findings and recommendations of the independent review of the arrangements for the chief officer departures. April 2025 A special meeting of the council’s Finance and Audit Scrutiny Committee was held to consider the annual accounts and annual audit report, including the external auditor’s comments on the exit payments. May 2025 The council’s City Administration Committee considered a paper on the review of arrangements for chief officer departures and proposed changes. May 2025 The former chief executive reached an agreement with Strathclyde Pension Fund which, with the approval of the council, resulted in repayment to the council of the strain on the fund cost associated with her early retirement. May 2025 Glasgow City Council agreed proposed changes to the terms of reference of committees and the scheme of delegated functions, in response to the independent review. Source: Audit Scotland Page 260
Page 261
How decisions were made | 10 How decisions were made The approach taken to the restructuring of the senior management of the Chief Executive’s Department The role of the Chief Executive’s Department 10. The Chief Executive’s Department in a council is the strategic planning and management centre of the organisation. It provides the corporate lead, advice and support to its other departments and functions. It also provides the lead for governance and support to councillors with their policy-setting, decision-making and scrutiny role. 11. In Glasgow City Council, the main services of the Chief Executive’s Department include for example: Policy, Corporate governance and communication; Legal and administration; Human resources; Corporate procurement; Digital services; Customer care; Financial inclusion and Economic development. Restructuring requires good governance 12. Whether as part of improvement and/or savings programmes, councils need to undertake organisational and staff restructuring from time to time. It allows the organisation to realign its resources to respond to change or to new priorities and find ways to work more efficiently. This can include redeployment or reductions of senior officers through early retirement or redundancy packages. 13. It is important that decisions made about restructuring, including exit packages for senior staff, are undertaken in the most transparent manner with clear governance arrangements that reflect the principles of public life in Scotland (Exhibit 2). In addition to demonstrating high standards of governance, councils also need to demonstrate that decisions about restructuring and exit packages are value for money for the public purse. Page 261
Page 262
How decisions were made | 11 Exhibit 2 Principles of public life There are expectations on how elected members and officers of public bodies, including councils, conduct themselves and the work they undertake. In 1995, the Committee on Standards in Public Life (the Nolan Committee) identified seven principles of conduct underpinning public life. In Scotland these principles were expanded to include a further two into the Nine Principles of Public Life in Scotland 1. Selflessness Acting solely in the public interest. 2. Integrity Avoiding obligations that might influence official duties. 3. Objectivity Making decisions impartially and on merit. 4. Accountability Being answerable to the public and open to scrutiny. 5. Openness Acting transparently and justifying decisions. 6. Honesty Being truthful and declaring conflicts of interest. 7. Leadership Promoting and upholding these principles through example. 8. Public service Acting in the interests of the public body and fulfilling its core tasks. 9. Respect Treating colleagues and staff with courtesy and valuing their roles. Source: Scottish Government/Audit Scotland How decisions were made The process for approving the business case for restructuring the senior management of the Chief Executive’s Department is not formally documented 14. The independent investigation by Brodies LLP sets out that following a discussion in January 2021, the head of human resources sent the former chief executive a business case in February 2021, entitled Proposed Senior Management Restructure Report. This report set out the proposed financial arrangements relating to the exit of five senior officers within the Chief Executive’s Department. The report proposed that: Page 262
Page 263
How decisions were made | 12 • the post of solicitor to the council and director of governance (Grade 13) be made redundant, with its functions merged into other senior roles. A new role of solicitor to the council and monitoring officer (Grade 12) would be created • the post of solicitor to the council and monitoring officer be subject to a ‘bump redundancy’, and a legal manager post (Grade 10) deleted • the post of principal adviser to the chief executive (Grade 11) be made redundant, with its functions merged into a new head of performance and governance role • the post of head of human resources (Grade 11) be subject to a bump redundancy, and a strategic HR manager post (Grade 11) deleted • the chief executive (Grade 15) take early retirement in or around late 2022 on grounds of efficiency, with an estimated cost of £349,095. Bump redundancy (or transferred redundancy) generally refers to an employee at risk of redundancy being moved into another role within the organisation. The person currently in that role is then made redundant instead. 15. In February 2021, the former executive director of finance sent an email to the chief executive stating: ‘I can confirm that each individual case and the overall project are consistent with council policy and the business case is comfortably within target parameters. I am therefore fully supportive of the proposals as outlined in the paper.’ There is no explicit evidence of the chief executive, the director of governance and solicitor to the council approving the restructure report, as required at that time by the scheme of delegated functions. The independent review concludes that it is implicit in the collective correspondence about the report. There does not appear to be a clear document trail recording definitively the decision- making in relation to approval of the restructure report. Approval of the exit and the terms for four of the five officers were in line with policy 16. The independent review concluded that approval requirements were met for the exit terms of the solicitor to the council, the principal advisor to the chief executive, head of/director of legal and administration and head of human resources. 17. The exit terms offered to four of the former officers were in line with the council’s policies in terms of redundancy payments, pension strain costs and payback periods. Page 263
Page 264
How decisions were made | 13 18. The independent review concludes that ‘it is not clear whether [the solicitor to the council’s] departure can be said to fall within the scope of the council’s policies on redundancy and early retirement’ as it was not formally a redundancy. She received a severance payment of £95,000 as an agreed sum to be paid on her resignation. She did not receive redundancy or early access to her pension. Approval of the chief executive’s exit did not follow the scheme of delegated functions 19. There was no specific provision for approval of the early retirement or severance of the chief executive under the scheme of delegated functions. 20. The former chief executive highlighted in her statement to the independent review that in her view, as the role didn’t fall under ‘chief officials’ that the scheme permitted her to delegate approval to the executive director of finance and head of human resources, as for non- chief officials. Her view is the approval was given at the time the restructure report was written in 2021. 21. The independent review also draws attention to an email in March 2024 from an HR officer sent to both the new head of human resources and the executive director of finance with the request for the former chief executive’s early retirement, which was approved on the same day. The independent review notes, however, that it appears that the executive director of finance and the new head of human resources did not consider they were formally approving the application but that their function was to check the application complied with relevant council policies. Elected members were not involved in decision-making or approval processes 22. The scheme includes the general requirement on officers ‘where he/she considers that a matter may be politically controversial even although it has been specifically delegated to him/her, to consult with the appropriate city convener. If after consultation the officer determines the matter is politically controversial, it must be referred to committee as appropriate for approval’. 23. What can be considered politically controversial is a judgement, however it is reasonable to consider the early retirement of the chief executive on efficiency grounds, and the operational and financial implications of this could meet this description, and it is not clear what consideration was given to this issue. The independent review concluded that officers should have referred the restructure report to the relevant city convenor for consultation as a matter of potential political controversy. 24. Councillors do not, however, appear to have been involved in the decision-making or approval processes for the exit packages for any of the five senior officers, including the chief executive. There is no evidence of the proposals and terms being discussed with councillors and the Page 264
Page 265
How decisions were made | 14 restructure report was not shared with councillors or presented at committee for approval. Appropriate scrutiny, transparency and accountability was lacking 25. As highlighted at paragraph nine, it is important to note that the independent investigation states that ‘we did not find any evidence allowing us to conclude that any recipient of any severance/retirement package, or any other officer, acted improperly’. However, in the interests of transparency and good governance, the absence of a clear document trail, setting out the decisions and approvals required for the restructure report, including the consideration of potential conflicts of interest and the need to involve councillors, is concerning. 26. I support the auditor’s conclusions in his 2023/24 AAR that ‘the council was unable to demonstrate effective scrutiny, governance and transparency in decision-making or value for money in respect of the exit of five senior officers over the course of a three-year period between 2021 and 2024’. It is not clear whether the restructure was value for money. All councils should ensure that they can demonstrate the value for money for any service reform or restructure. In this case, the council’s restructure paper highlights two key reasons for the structural change: • the ongoing requirement to make significant savings; and • a need to address the demographics of the senior team and put in place robust succession planning arrangements. 27. The restructure report concluded that the total cost of the proposals would be £731,486, with ongoing annual savings of £652,658, resulting in a payback period of 1.12 years. However, the detail of the report sets out total redundancy and strain on the fund costs of £1.025 million for the five senior officers. The council advises that the lower cost of £731,846 is after in-year salary savings are included. 28. The appointed auditor notes in the AAR that the actual total cost of the exit of the five senior officers was £1.035 million as opposed to the cost of the proposals in the restructure report of £1.025 million. The difference reflects updated figures since the time of the business case in 2021, as well as changes to planned leaving dates. 29. It is not possible to reach a conclusion on the rationale for the exit terms given to the five senior officers, as there is a lack of consideration within the restructure report of the benefits to the council for the reform (outwith the overall annual financial savings of £0.65 million). 30. There is no reference within the restructure report to alternative mechanisms for change being considered. The auditor comments in the AAR that ‘while we note in circumstances where restructures involve senior officers, alternative options such as redeployment are often not Page 265
Page 266
How decisions were made | 15 practical or possible, we would expect consideration of all options to be evaluated. In this specific instance, it’s unclear why early retirement and redundancy was the best solution to address concerns around succession planning’. 31. It is particularly difficult to see the justification for the chief executive’s early retirement on the grounds of cost savings and succession planning, as the post of chief executive remains within the structure. In February 2024, the request to approve the terms of the chief executive’s early retirement, made to the head of human resources and the executive director of finance for approval, was made on the grounds of efficiency. 32. A final amendment made to the restructure report before its approval by officers was to include a link between the deletion of the post of executive director of development and regeneration services and the early retirement of the chief executive. The deletion of the role was approved by the council’s City Administration Committee in January 2021, but the rationale for the link to support the case for the chief executive’s retirement contributing to savings is unclear. Page 266
Page 267
The council’s response | 16 The council’s response How the council are taking action to address the issues raised The council’s response and actions taken The council commissioned an independent review and reported publicly on the findings 33. In September 2024, the council’s new chief executive commissioned the council’s monitoring officer and head of audit and inspection to undertake an internal review of the arrangements for the departure of senior officers. 34. Following consideration of the findings of the internal review and discussion of the findings with the appointed auditor, the council sought an independent legal view. Brodies LLP was instructed to undertake an independent investigation. Brodies provided their report in February 2025. This included the opinion of a KC on the questions of law asked by the council, based on the findings in the Brodies LLP report. 35. A summary of findings from the Brodies LLP report, are set out in Exhibit 3. The full report, with the opinion provided by the KC, is available from Glasgow City Council. Page 267
Page 268
The council’s response | 17 Exhibit 3 Key findings of independent legal review Severance terms offered to each of the officers were in accordance with applicable council policies. The justification for the early retirement of the former chief executive was not supported by the restructure report or accompanying correspondence and there was no clear justification for linking her retirement with the deletion of the post of executive director of development and regeneration services. The restructure report should have been the subject of elected member input, rather than being approved solely by officers, particularly as the officers who were involved in approving it also benefitted from its terms by being proposed for early retirement/severance packages. No evidence was found that elected members were asked to approve the report or individual applications for severance/retirement. There was also no evidence that elected members had any knowledge of the details of the departures prior to the publication of the remuneration report as part of the unaudited annual accounts for 2023/24. It is considered that the former chief executive’s application for early retirement was not, on the face of it, lawfully approved in terms of the council’s Scheme of Delegated Functions. However, it was considered unlikely that a judicial review would overturn the decision, given the detriment to the former chief executive and the time passed. That the pension strain costs which formed part of four of the five redundancy/early retirement packages under investigation were mandatory in terms of the council’s policy and the Local Government Pension Scheme Regulations. It is considered that there is no reasonable basis for the recovery of the sums paid by the council in respect of the five early retirement/redundancy packages. Source: Brodies LLP report: Investigation into exit packages of former senior officers at Glasgow City Council and Opinion of senior counsel in re. Investigation into exit packages of former senior officers at Glasgow City Council 36. The council presented the legally privileged report from Brodies LLP and the opinion from the KC in public to the Finance and Audit Scrutiny Committee on 11 March 2025. The council’s decision to consider the findings of the independent review in public, indicates a desire to ensure greater transparency and openness on the matter, which is welcome. Page 268
Page 269
The council’s response | 18 The council are making updates to governance structures and policy 37. An internal review of the council’s governance arrangements relating to workforce and service reform activity has been undertaken. In response to the issues highlighted by the independent review and recommendations from the appointed auditor, the council is making amendments to governance arrangements and policy in respect of early retirement and voluntary redundancy. 38. At the May 2025 council meeting, amendments to the Scheme of Delegated Functions and Committee Terms of Reference were agreed. The amendments to arrangements include: • Clarity in the scheme that the term chief officers refers to all officers grade 12 and above, including the chief executive. • Changing the title of the Senior Officer Appointment Committee to the Senior Officer Workforce Committee and changing the remit to consider not only appointments of senior officers but also the approval of proposals involving early retirement or redundancy of officers of grade 12 or above. • Adding the director of legal and administration to the senior officers required to approve changes to staffing structures, numbers and gradings. • Deleting the previous delegation, which authorised the chief executive to approve applications from chief officials for early retirement and voluntary severance. • Adding an express delegation relating to the early retirement and voluntary severance of the chief executive, giving authority to the Chair of the Corporate Workforce Planning Board to recommend proposals to the Senior Officer Workforce Committee. 39. The auditor makes the recommendation in the AAR that the council should ‘set clear guidance on minimum expectations for any future restructure papers. This should include at a minimum an outline of how the restructure achieves value for money, what alternatives to early retirement or voluntary redundancy were considered and how the restructure meets the council’s strategic priorities. The council accepted this recommendation and have committed to set clear guidance for future restructure papers and to establish a Corporate Workforce Planning Board to oversee the implementation. 40. In addition, the council have committed to make improvements to the administration of exit packages in response to areas for improvement identified by the appointed auditor in the AAR. The recommendations include: Page 269
Page 270
The council’s response | 19 • The council should engage with Strathclyde Pension Fund to ensure that strain on fund calculations are only made for relevant individuals and consider whether any amendments are required to improve the accuracy of estimated costs. • Management should review the current operational processes for recording approvals and agreements to early retirements and redundancies. This should include clear guidance on requirements for electronic approvals. 41. The auditor notes in the AAR that ‘further work will be required to ensure that such arrangements are adhered to and the Nolan principles are upheld in future’. The council report that it ‘will put in place arrangements to enhance and monitor awareness, understanding and application of the council’s governance rules across senior management and leadership teams. This will be extended to include the employees’ Code of Conduct, with appropriate training and communication carried out with employees across the council family’. No legal basis for recovery 42. The independent review concluded that there is no reasonable basis for the recovery of the sums paid by the council in respect of the five early retirement/redundancy packages. The current chief executive advised that in early May 2025, legal representation for the former chief executive arranged for an agreement to be made with Strathclyde Pension Fund and the council. This resulted in the repayment, from Strathclyde Pension Fund to the council, of the strain on the pension fund of £317,000, stemming from her early retirement. Glasgow City and other councils need to ensure good governance, value for money and clear business cases for future reform and restructuring The council needs to ensure it is better prepared for future restructuring 43. Councils should not turn to early retirement as the first and only option when faced with budget cuts. The need for early retirements could be better controlled by taking a strategic approach to planning the size and composition of the workforce, including senior roles. 44. Best Value thematic work undertaken at the council has highlighted that while detailed workforce planning occurs at a service level, there is no overall workforce plan or strategy. The council need to be able to show, how any restructure provides value for money including how any restructures support the council’s strategic plan, financial plans and workforce plans. 45. As the council looks to continue to transform and ensure it is fit for the future, it will need to demonstrate that: Page 270
Page 271
The council’s response | 20 • the planned restructure achieves value for money • the revised structure reflects the council’s strategic priorities • alternatives to early retirement or voluntary redundancy have been considered • the process for approving early retirements and redundancies is clearly documented • the decision-making process is subject to appropriate scrutiny and is in line with the principles of public life. Lessons learnt for all councils 46. Given the current challenging financial context across the public sector, other councils will also be undertaking restructuring and reform programmes. They too need to ensure that they have effective governance arrangements in place. In particular, all councils will wish to consider: • Are their schemes of delegation and codes of conduct fit for purpose and do they reflect the principles of public life? • Does the scheme of delegation include a clear process for considering proposals and approvals for restructure, redundancy and retirement and does it appropriately manage potential conflicts of interest? • Is there appropriate officer and councillor scrutiny of the decision- making processes in relation to restructure, redundancy and retirement? • Is there a good understanding and implementation of the requirements set out in the scheme of delegation relating to restructure, redundancy and retirement, through training and monitoring? • Does the prevailing culture among senior officers reflect the standards and behaviours required by the principles of public life? 47. The Accounts Commission produced a report in 1997 and follow-up review about the management of early retirement. These were: • Bye now, pay later? The management of early retirement in local government – December 1997 • Bye now, pay later? A follow-up review of the management of early retirement – June 2003 48. Messages from these reports remain relevant and councils should remain cognisant of these as they undertake restructuring and reorganisation that includes the early exit of senior members of staff, Page 271
Page 272
The council’s response | 21 senior council members and senior staff in bodies in the group accounts. Listed below are recommendations from the 2003 report of note: • Framework for decision-making: early retirement policies should be approved by councillors and be reviewed regularly. • Informing councillors: councillors should receive a report at least annually that details the number of early retiral decisions made in the year, along with the associated costs and savings attached to these decisions. • Decision-making: councils should rigorously appraise individual cases to ensure the expected savings associated with a retiral outweigh the costs. • To improve accountability and assist in monitoring, the costs of early retirement should be charged to the appropriate service budget. • Elected members should be involved in approving early retirement decisions for senior staff. Page 272
Page 273
The 2023/24 audit of Glasgow City Council Senior officer exit packages Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN Phone: 0131 625 1500 Email: info@audit.scot www.audit.scot ISBN: 978 1 915839 81 7 AS.5.0 Page 273
Page 274
Page 274