Agenda Document Pack - Audit and Scrutiny Committee - 25/03/2026
Moray Council · 25 March 2026
Back to Audit and Scrutiny Committee — 25 March 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 25 March 2026 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 25 March 2026 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of meeting of 19 November 2025 5 - 12 4. Written Questions ** 5. Internal Audit Section Update Report Report by Service Manager Internal Audit and Risk 13 - 72 6. Internal Audit Review - Levelling Up Fund Report by Service Manager Internal Audit and Risk 73 - 86 7. Internal Audit Review – Democracy and Governance Report by Service Manager Internal Audit and Risk 87 - 118 8. Internal Audit Review – Procurement and Creditor Payments Report by Service Manager Internal Audit and Risk 119 - 138 9. Internal Audit Review – Counter Fraud Review Report by Service Manager Internal Audit and Risk 139 - 160 10. Internal Audit Plan 2026-27 Report by Service Manager Internal Audit and Risk 161 - 198 Page 1
Page 2
11. Annual Audit Plan for the Year Ending 31 March 2026 Report by Executive Director Finance, Strategy and Transformation 199 - 252 12. Accounts Commission Report - Comhairle nan Eilean Siar - Cyber-attack affecting operations and services Report by Service Manager Internal Audit and Risk 253 - 258 Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Watching the Meeting You can watch the webcast live by going to: http://www.moray.gov.uk/moray_standard/page_43661.html Webcasts are available to view for 1 year following the meeting. You can also attend the meeting in person. If you wish to attend in person, please come to the High Street entrance door and a member of staff will let you into the Chamber. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 5pm three working days prior to the day of the meeting, please see Standing Order 36 for deadlines. A copy of any written answer provided by the Chair will be published on the Council’s committee management system by 12pm the day before the meeting. The Member who has put the question may, after the answer has been published, may ask one supplementary question directly related to the subject matter at the meeting, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Scott Lawrence (Chair) Councillor Theresa Coull (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor John Divers (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Paul McBain (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Councillor Sonya Warren (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 19 November 2025 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Tracy Colyer, Councillor Theresa Coull, Councillor John Divers, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Scott Lawrence, Councillor Marc Macrae, Councillor Paul McBain, Councillor Sonya Warren, Ms Margaret Wilson APOLOGIES Councillor Neil McLennan, Councillor John Stuart IN ATTENDANCE Chief Executive; Executive Director Education, Housing and Communities; Executive Director Economy, Enterprise and Operations; Chief Financial Officer (Depute S95 Officer); Service Manager Internal Audit and Risk; Locality Manager - Elgin; Chief Governance Officer (Monitoring Officer); Service Manager Environmental Services; Service Manager Provider Services; Service Manager Taxation; Service Manager Growth Deal and Caroline O'Connor, Committee Services Officer, all Moray Council; and Andrew Wallace, Grant Thornton - External Auditors. 1. Chair The meeting was chaired by Councillor Scott Lawrence. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. With regard to Item 5 "Internal Audit Section Update Report", Councillor Gordon stated, for transparency, that he is a Director of Moray Leisure Limited and would be taking part in the debate. With regard to Item 5 "Internal Audit Section Update Report", Councillor Gatt stated, for transparency, that he is Convener of the Grampian Valuation Joint Board and would be taking part in the debate. Item 3. Page 5
Page 6
With regard to Item 5 "Internal Audit Section Update Report", Councillors Warren and Macrae stated, for transparency, that they were members of the Grampian Valuation Joint Board and would be taking part in the debate. 3. Minute of meeting of 10 September 2025 The minute of the meeting of the Audit and Scrutiny Committee dated 10 September was submitted for approval. The Committee Services Officer advised of two incorrect references in the minute at paragraphs 3 and 11 where dissent was recorded as Standing Order 36 however the correct reference was Standing Order 65 and confirmed the wording would be amended with the correct reference. Subject to the amendment above, the Committee agreed the minute of the meeting. 4. Written Questions ** The Committee noted that no written questions had been submitted. 5. Internal Audit Section Update Report The meeting had before it a report by the Service Manager (Internal Audit and Risk) providing an update on the work of the Internal Audit Section. Councillor Warren expressed concern about financial risks in the programmes referenced in the report and sought assurance that the recommendations would be implemented within the timescales and how slippage would be escalated, monitored and enforced. In response the Service Manager Internal Audit and Risk advised follow up reviews evidence implementation and the current status of recommendations and, while there may be a requirement to revise dates, recommendations are not closed off until fully implemented. He further advised if a number of audit recommendations were not implemented, he would take a view in relation to the development of the audit plan whether there was a need to undertake a new audit for that service. He will raise particular concerns regarding implementation with management when necessary and referenced that within the Moray Integration Joint Board, he now attendings senior leadership team meetings on a monthly basis to address and escalate any issues of concern. The Service Manager Internal Audit and Risk was hopeful the governance arrangements referred to and implementation of recommendations would reduce the risk to the Council. In order to provide further assurance, the Chief Executive confirmed the management team are working with auditors on recommendations and encouraging managers to be mindful of resource implications and competing demands on staff when agreeing timescales for implementation and to ensure they are deliverable in terms of budget whilst addressing findings of audits. The Chief Governance Officer (Monitoring Officer) advised the Strategy and Performance team will be using Pentana software to monitor outstanding audit recommendations, not to take away from the role of the auditor who will finalise his opinion on whether actions have been implemented satisfactorily, but to assist officers in terms of managing the flow and ensuring any delays are picked up in a timely manner. Page 6
Page 7
In response to a question from Councillor Gordon relating to audit recommendation 7 of Appendix 5 asking for clarity on whether the commercial waste charges for 2023/24 and 2024/25 were increased without a full cost analysis, the Service Manager Environmental Services advised the increase last year following the 2020 price freeze was not done based on cost recovery however the cost recovery exercise had now been undertaken and it was intended to align in the fees and charges for the incoming year or for 2026/27. With reference to audit recommendation 1 of Appendix 2, Councillor Macrae sought assurance negotiations relating to new service level agreements would take into account any reductions or increases in services from those included in previous service level agreements. In response the Executive Director Education, Housing and Communities confirmed new service level agreements would focus on services to be provided however, to ensure there was cross-reference, leases would be reviewed in terms of buildings managed. Following lengthy consideration the Committee unanimously agreed to note the contents of the report. 6. Internal Audit Review - National Non-Domestic Rates The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 10 September to 19 November 2025. With reference to the key issues and audit recommendation 3 detailed in Appendix 1, Councillor Warren asked whether the Service Manager Internal Audit and Risk could provide Committee with clear assurance that there are no current fraud and misuse issues relating to historic non-domestic rates. In response, the Service Manager Internal Audit and Risk advised that he was unable to provide assurance that there were no fraud or irregularities, as the audit had been undertaken using sample testing. The audit review used the Chartered Institute of Public Finance and Accountancy (CIPFA) as the basis for the audit programme. Findings from the audit noted that reasonable assurance was found in the systems in place, but additional controls have been introduced regarding the need for review and authorisation of refunds. Following up the response provided by the Service Manager, Internal Audit and Risk and with reference to paragraph 4.2 of the report where the Service Manager Internal Audit and Risk stated that within the scope of the review he was content that appropriate controls were in place, Councillor Keith expressed confusion whether controls were in place given the issues highlighted in the St Giles Shopping Centre non-domestic rates report discussed previously at this Committee, noting it had generated much public interest. In response, the Service Manager Internal Audit and Risk advised the St Giles Shopping Centre had been a special investigation due to the issue relating to a unique set of circumstances however recommendations on improvement of systems control had been accepted by the service which it was hoped would prevent or escalate any issues far quicker than previously. Following consideration the Committee unanimously agreed to endorse the recommendations contained within the report. Page 7
Page 8
7. Internal Audit Review - Procurement and Creditor Payments The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 10 September to 19 November 2025. With reference to the breaches of financial regulations, procurement guidelines and organisation policy detailed in Appendix 1, Councillor Warren asked if the Service Manager Internal Audit and Risk was confident they were isolated issues and what evidence would be provided to demonstrate improvements in compliance. In response the Service Manager Internal Audit and Risk advised he was not confident as he was preparing another report for the next meeting of the Committee detailing a similar exercise undertaken which had raised similar issues relating to governance issues. He further advised he was concerned about non-compliance which has been raised with the Chief Financial Officer and officers were to be reminded of the requirement for procurement and financial regulations by a notice promoting use and compliance on the front page of the council's internal internet and he would monitor whether the position was improving. In response to a question from Councillor Gatt noting there was a recurring theme in terms of non-compliance and asking at what point alternative measures would be used to enforce regulations, the Chief Executive explained it was most important to ensure staff receive the correct training and understand the importance of complying with financial regulations as part of induction and ongoing training to equip them to comply and management would be focussing on that to ensure that message is cascaded down through the organisation. Following consideration the Committee unanimously agreed to endorse the recommendations contained within the report. 8. Internal Audit Review - Complex and Challenging Needs Service The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 10 September to 19 November 2025. In relation to the details contained in audit recommendation 1, Councillor Warren expressed concern regarding the long hours staff were routinely working combined with the overtime costs and asked what was being done to bring overtime costs to a sustainable level while safeguarding care quality and staff wellbeing. In response, the Service Manager Provider Services advised there is recognition regarding staff vacancies nationally within this particular sector with fluctuations in staffing levels being an issue, the service have a statutory duty to ensure appropriate staffing is in place to provide appropriate care and support regardless of vacancy levels and referenced the recent inspection from the Care Inspectorate which found that the quality of care provided is exceptional. Recognising the current service delivery is not sustainable, he confirmed the short life working group are working with staff and unions on alternative options regarding effectiveness and efficiency, digital and recruitment marketing. Following consideration the Committee unanimously agreed to endorse the recommendations contained within the report. Page 8
Page 9
9. Internal Audit Review - Absence Management The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 10 September to 19 November 2025. In response to a question from Councillor Warren asking what urgent action will be taken to reduce absence and to ensure compliance with the health and work policy given that the full review of the policy is due for completion until 2026/27 and how progress would be reported to evidence measurable improvement, the Executive Director Education, Housing and Communities provided assurance the policy is based on current employment legislation and while there was a need to update the policy and review dates, it was not envisaged there would any significant changes that would influence a change in the Council's absence rates. She confirmed effective application of the policy and how it is effectively managed was more important. A related report was being prepared for Moray Council on 3 December 2025 proposing a spend to save detailing a pilot of work within education which it was hoped would provide financial and service benefit and, if approved and proved successful, could be rolled out further. During discussion Councillor Macrae expressed concern that the audit had round that 40% of managers had undertaken training on managing sickness absence and considered the course should be mandatory service managers. In response, the Executive Director Education, Housing and Communities acknowledged whilst the course its routinely publicised, the take up is relatively low and more work was required to encourage service managers to undertake the training, particularly in service areas where there are higher absence figures. In response to a question from Councillor Keith seeking clarification as to why employee wellbeing policies were not having an impact on absence figures which it was noted were increasing at double the rate of the national average, the Chief Executive advised the current policies were not leading to improvement which is why the report proposing a different approach was coming to Moray Council which would cover supporting attendance, wellbeing of staff and support to managers to manage absence. In response to concerns raised by a number of Councillors who felt promoting the training was not sufficient and that it should be mandatory for managers to complete, the Executive Director Education, Housing and Communities offered to revise the report to be considered by Moray Council on 3 December to reference the discussion relating to improved numbers of managers attending training and whether mandatory training has been raised and if the Council agrees to support mandatory training for all managers, that it be included within the improvement project and is prioritised in services where absences are higher. The Committee were in agreement the amendments proposed be included in the report. Following lengthy consideration the Committee unanimously agreed to endorse the recommendations contained within the report. 10. Internal Audit Follow Up Review – Moray Growth Deal Page 9
Page 10
The meeting had before it a report by the Service Manager Internal Audit and Risk advising Committee on an internal audit review completed for the period from 10 September to 19 November 2025. In response to a question from Councillor Warren asking what the process was for Committee being notified of any problems regarding evidence of compliance or spend within the individual projects, the Service Manager Internal Audit and Risk advised he requires to undertake an audit every two years as the accountable body, seeking assurance from partner organisations internal audit providers regarding individual projects and that follow-up reviews are detailed in separate review reports to Committee rather than included in an internal audit update report. To provide assurance the Executive Director Economy, Enterprise and Operations confirmed where any financial changes are required, a change request process is required through the Moray Growth Deal Programme Board and any issues requiring Council are reported in an individual report to Moray Council. In addition to quarterly newsletters circulated, updated programme levels on budget, timescales etc are also routinely reported to the Transformation Board with the Council's extended leadership team scrutinising and challenging progress on individual projects. During discussion Councillor Gordon asked whether partner organisations audit plans and audits should be produced as part of the papers for Committee to provide assurance. The Service Manager Internal Audit and Risk provided assurance internal audit reports are included in reports to the Programme Board however approval would be required from the partner organisations to share with Committee. Following consideration the Committee unanimously agreed to endorse the recommendations contained within the report. 11. Internal Audit Charter The meeting had before it a report by the Service Manager Internal Audit and Risk providing Committee with an updated Internal Audit Charter to meet the requirements of the new Global Internal Audit Standards. In response to a question from Councillor Warren seeking assurance that the Charter aligns the Council with the Global Internal Audit Standards (GIAS), clarification on any areas that did not meet the standards and what actions would be taken to address these, the Service Manager Internal Audit and Risk, advised that the new Charter has been prepared to ensure compliance with the GIAS. He confirmed that the Council has previously achieved full compliance with the public sector internal audit standards, as evidenced by an external assessment review. In next year’s audit cycle, a gap analysis will be undertaken and, if required, an action plan will be prepared for any changes to current systems. Following consideration the Committee unanimously agreed to approve the revised Internal Audit Charter. 12. Scottish Public Services Ombudsman Recommendation Report 2024-25 The meeting had before it a report by the Executive Director Economy Enterprise and Operations seeking Committee approval to publish the Scottish Public Services Page 10
Page 11
Ombudsman (SPSO) Recommendations Report to comply with the SPSO statutory requirement to demonstrate learning and improvement. Following consideration the Committee unanimously agreed to:- i) note the content of the SPSO Recommendations Report; ii) welcome performance as indicated in the report; and iii) approve the report for submission to the Scottish Public Services Ombudsman. 13. Review of Recommendations Arising from Accounts Commission Audit of Senior Officer Exit Packages The meeting had before it a report by the Executive Director Education, Housing and Communities asking the Committee to note the review of Moray Councils current practice for senior officer exit packages against the recommendations arising from the recent Accounts Commission audit of Glasgow City Council. Following consideration the Committee unanimously agreed to:- i) note the review of current practice for senior and other officer early departure arrangements demonstrates best practice is already adopted; and ii) note that there are no substantive changes required subject to normal reviews of approach when considering large scale workforce contraction and re- shaping. Page 11
Page 12
Page 12
Page 13
Report to: Audit and Scrutiny Committee Meeting Date: 25 March 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Section Update Report 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to consider an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 Global Internal Audit Standards requires the Service Manager Internal Audit and Risk to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 2.2 This report provides an update on audit activity and projects progressed since the last meeting. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers and notes the contents of this report, seek clarification on any points. Dafydd Lewis Service Manager Internal Audit and Risk Item 5. Page 13
Page 14
4. BACKGROUND AND CONTEXT Internal Audit Plan Update 4.1 The Audit Plan is a means of determining the priorities of the internal audit activity and demonstrating how these align with the broader goals of the Council. An update on the progress made by the Internal Audit Section in completing audit review projects, in accordance with the Annual Audit Plan, is provided in Appendix 1. I am pleased to report that the majority of projects included in the Audit Plan have been completed or are nearing completion, with fieldwork finished or draft reports issued and awaiting management responses to the recommendations. Follow Up Reviews 4.2 Internal Audit reports are regularly presented to members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Roads Maintenance Planned Repairs 4.3 An audit was previously undertaken on Roads Maintenance Planned Repairs, covering resurfacing, surface dressing, footway, and drainage works. The audit scope included an overview of the preparation of the capital plan, as well as a review of contract management arrangements and how individual schemes are costed, agreed, and monitored. The report highlighted the need for certain administrative improvements and for conducting a detailed costing analysis of the rates and overhead recovery percentages used for accounting and cost recovery. The Service Manager Roads and Fleet accepted all recommendations. 4.4 A follow-up review has been undertaken to confirm the implementation of the recommendations. Previous follow-up reviews were reported to this Committee on 8 May 2024 (para 5 of the minute refers) and on 24 June 2025 (para 7 of the minute refers). Progress has been made; however, the recommendation to adopt a “zero-based” approach to reviewing and if necessary, updating the costs and percentage recovery rates used within the Schedule of Rates for planned works remains outstanding. 4.5 The audit acknowledges the commitment of the Service Manager Roads and Fleet to implementing this recommendation, as it also impacts the ability to undertake effective benchmarking with other local authorities and the private sector. The audit notes that there has been a lack of staffing resources, which was outside the control of the Service, and that the intention to outsource the review of costs and overhead rates proved unsuccessful. Discussions with the Service Manager Roads and Fleet indicate an intention to appoint a Principal Technician, with the expectation that this post will undertake a review of job and overhead rates. I do not intend to undertake another follow- up review of this audit, but have included in the 2026/27 Audit Plan a review of Roads Maintenance Reactive Repairs, the scope of which will also include an assessment of progress on this outstanding issue. Special Investigation - St Giles Shopping Centre – Non-Domestic Rates 4.6 This was a special investigation audit requested by the Interim Chief Executive and reported to this Committee on 12 February 2025 (para 11 of the minute refers). The agreed Page 14
Page 15
scope was to review the debt recovery arrangements for non-domestic rates regarding the St Giles Shopping Centre over a two-year period and “to identify what could have been done better and more timely.” Recommendations were made regarding administrative procedures within the Taxation Service, proposed changes to the Scheme of Delegation and the need to update the “Guidance on Managing Emails.” A previous follow-up review confirmed the implementation of recommendations, as reported to this Committee on 10 September 2025 (para 11 of the minute refers). However, a revised implementation date was required for updating the “Guidance on Managing Emails.” A further follow-up review has now been undertaken and I am pleased to confirm that this Guidance has been updated. Emergency Planning 4.7 This follow-up review assessed the implementation of recommendations from the audit of the Council's emergency planning arrangements. The Civil Contingencies Act 2004 places a legal obligation on emergency services and local authorities to assess risks, plan for and conduct exercises related to emergencies such as floods, severe weather, pandemics, or other incidents that could significantly impact the community. Effective emergency planning is a vital component of the Council’s overall governance framework, ensuring the resilience of all key services in the event of a major incident. The follow-up review identified only one outstanding recommendation yet to be fully implemented. This relates to the provision of an Annual Report to elected members, detailing the work undertaken and planned within emergency planning. The Service has provided a revised timescale of 31 May 2026 for reporting this to committee. The Follow-Up Report reviewing the implementation of the agreed recommendations is provided in Appendix 2. Children's Services Social Care Commissioning 4.8 A follow-up review was undertaken to assess the implementation of recommendations arising from a previous audit of the arrangements for commissioning children’s social care services. The original audit evaluated the key controls in place within Children’s Services relating to the external commissioning of social care provision. This included contracts for preventative support, restorative services, residential care and out-of-area residential placements necessitated by the limited availability of specialised provision within the Moray locality. The audit testing undertaken included a review of commissioning strategies and procedures, evaluation of financial monitoring arrangements and an assessment of the effectiveness of contract management and monitoring processes. The follow-up review found that the majority of recommendations had been implemented. However, the recommendation to develop a Commissioning Strategy had not been completed and the Service has provided a revised completion date. A Commissioning Strategy is a crucial policy document for providing a structured approach to planning, agreeing and monitoring social care services to meet the future needs of communities. The Follow-Up Report is provided in Appendix 3. Food Standards Scotland Guidelines 4.9 This follow-up review assessed the implementation of recommendations from an audit of the systems and procedures used by the Council's Environmental Health Service to demonstrate compliance with the Food Law Code of Practice (Scotland), developed by Food Standards Scotland. Local authorities are required to monitor compliance with food hygiene and standards on behalf of Food Standards Scotland. In 2019, the Food Law Code of Practice (Scotland) introduced a new Food Law Rating System, under which local authorities classify all food business operators within their area into defined category Page 15
Page 16
ratings. These ratings determine the requirements and frequency of inspections to assess compliance with food safety standards. The audit tested key controls and operational practices within the Environmental Health Service to confirm the Council's compliance with the Code’s requirements. It is appreciated that there have been staffing changes within the Environmental Health Service; however, I am pleased to report that the majority of recommendations have been implemented with only the need to agree on a revised date for reviewing and if required, updating policies and procedures. The Follow-Up Report is provided in Appendix 4. Special Investigation - Building Services - Windows Replacement Programme 4.10 4.11 This audit concerned a review of a contract for a window replacement programme for properties at Carnie Place, Buckie. The Head of Housing, Property and Communities requested the review after an Elected Member raised concerns that windows purchased for the properties could not be installed. The audit found that Building Services awarded a contract in 2021 for the manufacture of replacement windows for 101 properties, which included one house and 16 flats at Carnie Place, Buckie, at a value of £40,412. A total of 96 replacement windows were manufactured and delivered to Building Services in 2022. However, during installation, it was discovered that the replacement windows could not be fitted because the dimensions of the manufactured windows were greater than the rough openings at the properties. The audit review identified a need for improved contractual governance and stock control arrangements. The follow-up review found that the majority of recommendations have been implemented, although a revised implementation date is required for the proposed sale of the surplus windows. The Follow-Up Report is provided in Appendix 5. 4.12 Keith Grammar School A follow-up review was undertaken to evidence the implementation of recommendations from an audit of the administrative arrangements at Keith Grammar School. The scope of the audit covered the Devolved School Management Scheme, focusing on the allocation and management of funding at the School. The review included an assessment of how the School develops, monitors, and controls its £3.3 million budget, including the management of staffing costs associated with delivering the curriculum. The audit also examined whether non-payroll expenditure complied with Financial Regulations and Procurement Guidelines. In addition, testing was carried out to ensure that appropriate accounting arrangements were followed in the management of School Fund monies. I am pleased to report that the majority of recommendations have been implemented. While the significant administrative requirements are acknowledged, a revised timescale has been necessary to complete the opening of the new School Fund bank account. The Follow-Up Report reviewing the implementation of the agreed recommendations is provided in Appendix 6. 5. PROPOSALS 5.1 It is recommended that Committee agree to note the progress made by Internal Audit in the period from 19 November 2025 to 25 March 2026. Page 16
Page 17
6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. Page 17
Page 18
6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 18
Page 19
APPENDIX 1 Internal Audit Annual Work Programme- 2025/26 Update Report CORE SYSTEM REVIEWS Auditable Area Type of coverage Status/ Comments Payroll Continuous auditing to confirm the adequacy of the systems and procedures for paying salaries. The intention is to make further use of an auditing software application in the analysis of data and the sample selected for testing. Draft report prepared Procurement and Creditor Payments Continuous auditing of samples of non-payroll expenditure to test compliance with procurement and payment processing regulations. The intention is to make further use of an auditing software application in the analysis of data and the sample selected for testing. Completed Final Report issued Democracy and Governance Review administrative arrangements established to support effective democracy, governance and committee reporting arrangements. The audit will include reviewing policies and checking a sample of meetings/papers/action logs to ensure adequate and timely information is provided as required and requested to aid informed decision making. Completed Final Report issued Banking and Reconciliation To obtain assurance that adequate procedures are in place, ensuring accurate, timely reconciliations of income received and any differences are addressed promptly. A review of the banking arrangements will also be undertaken. Completed Final Report issued Page 19
Page 20
Absence Management An audit will consider the effectiveness of sickness absence monitoring and reporting. This will include the arrangements from within the Council and the Moray Integration Joint Board. Completed Final Report issued SERVICE REVIEWS Auditable Area Type of coverage Status/ Comments National Non-Domestic Rates To ensure that Business Rates billing and collection arrangements are robust and that reliefs awarded are adequately supported. Completed Final Report issued Moray Growth Deal Follow Up A follow up review to evidence implementation of the recommendations agreed within the audit undertaken in 2024/25 Audit Plan of the governance and administrative arrangements within the management of the Moray Growth Deal. Completed Final Report issued Levelling Up Fund An overview of the governance and administrative arrangements within the Council for the management of the Levelling Up Fund. Completed Final Report issued Capital Plan Audit testing of contract management arrangements for selected project(s) within the capital plan. Draft report issued Education – Secondary School Establishment visits as part of cyclical review. Further to the consultation with the service, additional testing will be undertaken in the use of purchasing cards. Fieldwork Work Completed Commercial Harbours A review of commercial harbours regarding the accounting arrangements of income and expenditure. The audit will review operating activity against Council Policies and Procedures. Fieldwork Work Completed Management of School Funds Review the processes in the management and control of School Funds. Fieldwork Work Completed Common Good Funds An audit of the accounting arrangements and procedures in the management of Common Good Funds. Completed Final Report issued Page 20
Page 21
Adult Care Commissioning- Follow up review KPMG review Follow up review to evidence implementation of the recommendations detailed within the KPMG Adult Social Care Commissioning audit. Draft report prepared Transportation- Education Review operating arrangements to ensure compliance with the conditions of contracts and compliance with Council Financial Regulations and Procurement Guidelines in managing school transport contracts. Draft report prepared MORAY INTEGRATION JOINT BOARD Auditable Area Type of coverage Status/ Comments Complex and Challenging Behaviour Services Review of systems and procedures within Complex and Challenging Behaviour Services in the management of Woodview and Barlink Social Work Establishments. Completed Final Report issued Non-payroll expenditure A review of non-payroll expenditure to test compliance with Financial Regulations, procurement and payment processing regulations. An auditing software application will be used in the analysis of data and the sample selected for testing. (Further to discussions with the Chief Officer, it has been agreed to change the planned audit regarding support for carers to a review of non-payroll expenditure. This is due to the Service's ongoing implementation of a recent update to the Unpaid Carers Strategy. A review of support for carers will be considered for inclusion within a future Audit Plan). Completed Final Report issued Social Care Financial Assessments/ Contributing to your Care An audit to evaluate the processes and accounting arrangements associated with charging users for social care services. The scope of the audit will also include a review of the arrangements for respite care. . Draft report prepared Page 21
Page 22
GRAMPIAN VALUATION JOINT BOARD Auditable Area Type of coverage Status/ Comments Grampian Valuation Joint Board In accordance with the Public Sector Internal Audit Standards applicable to local government and joint boards, an annual review is required of Grampian Valuation Joint Board activities. Completed VERIFICATION ACTIVITY Auditable Area Type of coverage Status/ Comments Year End Stock Valuations Verification of Year End Stock Verification for Building Services/ Environmental Services/ Community Services Stores. Completed Year end stock valuations agreed Network Support Grant Ongoing certification requirements for the Network Support Grant to Transport Scotland. Ongoing Half yearly audit certification requirement. Last Network Support Grant certified to 31/10/2025. COUNTER FRAUD ACTIVITY Auditable Area Type of coverage Status/ Comments Counter Fraud Review Annual review of the Council's counter fraud framework to minimise the risk and impacts of fraud from internal and external threats. The scope of the audit and testing undertaken will be informed by frauds reported within other organisations. Completed Final Report issued National Fraud Initiative The National Fraud Initiative (NFI) is a data-matching project conducted by the Cabinet Office on behalf of Audit Scotland every two years. It involves a data- matching exercise using information from various Council systems, as well as data provided by other councils and organisations. Ongoing The 2024/25 NFI exercise has been completed. The agreed approach is for services to review and document the reasons for data matches, while the Internal Audit Section investigates potential fraud, monitors progress and reports on the outcomes. A draft report of the findings has been prepared. Page 22
Page 23
FOLLOW-UP REVIEWS DUE TO EVIDENCE IMPLEMENTATION OF OUTSTANDING RECOMMENDATIONS FROM PREVIOUSLY ISSUED AUDIT PROJECTS – 2025/26* * Additional follow-up reviews may be added depending on the implementation dates for recommendations detailed by services Audit Undertaken Scope of Audit Review Self Directed Support (SDS) – Option 2/3 The scope of the audit was to review systems and procedures in the delivery and management of adult social care provided under Options 2 and 3 of the SDS scheme. This included examination of the processes to support individuals in determining their preferred care delivery option, contractual relationships with care providers, financial management and monitoring of individual care packages. Pool Cars Scheme The scope of this audit was to review systems and procedures in the management and use of pool cars. Policies and procedures were checked to ensure they provide appropriate operating guidance to officers in the booking and use of pool cars. The audit included a review of arrangements for internal recharging to services and also exploration if further use of pool cars could provide additional value for money opportunities to the Council. Moray Integrated Community Stores The audit reviewed the management of the Moray Integrated Community Stores. This included reviewing the procedures for ordering and issuing occupational therapy equipment to service users. In addition, a check was made to compare stock records to the actual equipment held within the Stores. Following the Public Pound The Internal Audit Plan provided for a “Following the Public Pound” review to ensure proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Councils fund Arms Length External Organisations (ALEOs) to provide important services to the public. These funding arrangements are often more complex than purchase contracts for goods or services but can bring both financial and operational benefits to councils. Procurement and Creditor Payments A review of payments made to suppliers of goods and services was undertaken. The purpose of the audit was to confirm compliance with Financial, Authorisation, Procurement and Creditor Payment Processing Regulations from the sample checked. The review formed part of the annual continuous auditing activity of non-salary expenditure and is used to support the Service Manager Internal Audit and Risk’s annual opinion of the Council’s internal control system. Housing Rent Collection & Arrears Management The audit scope was to review the key operational controls regarding rent collection and arrears management of current and former tenant rents. The aim of the audit was to look at the controls and processes existing over the administration of rent accounts, accounting fully and promptly for monies collected. Page 23
Page 24
APPENDIX 2 Moray Council Internal Audit Section 1 DEPARTMENT: Economy, Enterprise & Operations SUBJECT: Emergency Planning REPORT REF: 23'021 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.1 The Emergency Planning Policy and Procedures should be updated to reflect current operating arrangements and staffing structures. Medium Yes 31/05/2023 (Revised Implementation Date 30/11/2025) Implemented– An updated Emergency Planning Procedures document has been agreed and is now referenced as the General Emergency Plan. A separate Emergency Planning Policy Statement has also been updated and approved by the Corporate Leadership Team. The Service has advised that the Emergency Planning Policy Statement Page 24
Page 25
Appendix 2 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation will be reported to committee for approval by 31/05/2026. 5.2 Regular meetings should be held between the Emergency Planning Officer and the Business Continuity and Risk Management Officer to ensure ongoing alignment of emergency and business continuity plans. Medium Yes Implemented Implemented– The follow up review has confirmed that regular meetings are held between the Emergency Planning Officer and the Business Continuity and Risk Management Officer. 5.3 Emergency plans should be updated to reflect current risks, working practices and staffing structures of the Council and partner organisations. After updating the emergency plans, testing should be undertaken to Medium Medium Yes Yes 31/12/2024 (Revised Implementation Date 30/09/2025) Implemented Implemented- The follow-up review has confirmed that emergency plans for services have been reviewed and where required, updated. Implemented- It was noted that the Emergency Planning Officer is undertaking Page 25
Page 26
Appendix 2 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation evidence their effectiveness and highlight any areas for further improvement. ongoing testing to evaluate the effectiveness of the emergency plans and identify areas where further improvements are required. 5.4 Further training and documented guidance should be provided to Moray Emergency Response Co- Ordinators (MERC) to support officers in best practices to follow in the event of an emergency incident. Medium Yes 31/12/2023 Implemented– It was noted that further training has been provided to Moray Emergency Response Co-Ordinators (MERC) by the Emergency Planning Officer. In addition, guidance has been developed for officers to assist in the event of an emergency and is available to officers through the MERC Portal within SharePoint. 5.5 Emergency contact details of the Moray Emergency Response Co- Ordinators (MERC) saved within Sharepoint should be restricted to only officers that require access to this information. Medium Yes 31/07/2023 Implemented- Access privileges to the emergency contact details of Moray Emergency Response Co-Ordinators (MERC) held within SharePoint are now restricted to only authorised officers. Page 26
Page 27
Appendix 2 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.6 An Annual Report should be provided to elected members detailing the work undertaken and planned within emergency planning. Medium Yes 31/03/2024 (Revised Implementation Date 30/11/2025 Further Revised Implementation Date 31/05/2026) Part Implemented– An annual emergency planning report, detailing the work undertaken and planned, has been reviewed by the Corporate Leadership Team. The Service has advised that the report will be presented to committee and is currently in the process of being submitted. A further revised implementation date of 31/05/2026 has been agreed with the Service. 5.7 A review of the hyperlinks contained within emergency planning webpages should be undertaken to ensure they connect to the intended document or website. Medium Yes 31/08/2023 Implemented– The Emergency Planning webpage has been updated and now includes the correct web links to partner agency websites and key documents. Page 27
Page 28
APPENDIX 3 Moray Council Internal Audit Section 1 DEPARTMENT: Health and Social Care Moray SUBJECT: Children's Services Social Care Commissioning REPORT REF: 24'012 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: A clear Strategy and Procedures have been developed for Children's Services Commissioning and are regularly reviewed. 5.1 The development and agreement of a Commissioning Strategy should be progressed and agreed in accordance with the timescale detailed within the Health & Social Medium Yes 31/12/2025 (Revised Implementation Date 30/06/2026) Outstanding. The Strategic Delivery Plan for 2025-2028, approved in May 2025, commits to the development of a Strategic Commissioning Strategy under the responsibility of the Senior Management Team. The Head of Service has advised Page 28
Page 29
Appendix 3 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Care Moray Strategic Delivery Plan. resources have been allocated to complete a Commissioning Strategy by the end of June 2026. Key Control: Commissioned services are identifiable, subject to appropriate contractual arrangements and managed and monitored to ensure service delivery meets the intended outcomes. 5.2 All contractual arrangements should be aligned with the new Commissioning Procedures at the earliest opportunity to ensure consistency in the management and monitoring of performance information. Medium Yes 31/10/2024 Implemented. All contractual arrangements now reflect the current commissioning procedures and require service providers to submit tailored, but consistent, performance information on a regular basis. The follow-up audit has seen appropriate contract management and monitoring arrangements to be in place giving assurance that the required information is being tracked, pursued, received and utilised. Page 29
Page 30
Appendix 3 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.3 In accordance with established contractual arrangements, payments should not be made in advance of service delivery. Medium Yes 31/12/2023 Implemented. Sample testing as part of this follow-up audit has identified no instances of advance payment for the service area. Processes have improved in terms of communication with service providers and internal checks in line with best practice being undertaken prior to invoices being processed. Reminders on financial regulations requirements are also being issued annually to budget holders and staff who process invoices. Page 30
Page 31
APPENDIX 4 Moray Council Internal Audit Section 1 DEPARTMENT: Economy, Enterprise & Operations SUBJECT: Food Standards Scotland Guidelines REPORT REF: 24'016 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Current service plan defines service delivery and aligns to the requirements set by Food Standards Scotland. Service delivery is assisted by current and comprehensive policies and procedures. 5.1 All policies and procedures should be reviewed and updated on a regular schedule to ensure content remains current and valid. Medium Yes 31/03/2025 (Revised Implementation Date 30/06/2026) Outstanding. The Service has advised it has not been possible to progress the update of all policies and procedures in 2025 due to lack of resource and staffing Page 31
Page 32
Appendix 4 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation changes. However, a meeting to plan the review has been scheduled for February 2026 and the review is to be prioritised in the Team Plan and Service Plan. A revised implementation date for updating all policies and procedures by 30/06/2026 has been set. 5.2 The Environmental Health content on the Council website should be reviewed and where required updated. Medium Yes 31/03/2025 Implemented. A review of the food safety webpages has been undertaken and it has been confirmed that information presented now meets current specifications and all outdated content has been removed. Page 32
Page 33
Appendix 4 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.3 The Food Law Enforcement Service Delivery Plan should be reported for approval to the appropriate Council Committee. Low Yes Implemented Implemented. The Service Delivery Plan has been approved by the Planning and Regulatory Services Committee on 19th December 2023. Key Control: Food Business Operator ratings have been assigned and monitoring is being undertaken, as required by the stipulations of the Food Law Rating System. 5.4 The Food Programmed Inspections Procedures should be updated to reflect the current officers within Services who receive reports on inspections undertaken. Low Yes 31/03/2025 Implemented. The Food Programmed Inspections Procedures have been seen as updated within 2025. The update has removed the outdated named contact information for issuing reports. Page 33
Page 34
Appendix 4 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.5 Consideration should be given to the amendment of the Aide Memoire Form to include the details of the Officer completing the inspection document. Low Yes 01/12/2023 Implemented. The Aide Memoire template has been amended to include an “Inspecting Officer” field detailing the responsible officer, in full compliance with the audit recommendation. 5.6 Consideration should be given to the Service implementing a periodic housekeeping check on the register of food business operators content to ensure all valid entries have a food law rating assigned to inform the inspection programme. Low Yes 31/01/2024 Implemented. A monthly report of registered premises with no food law rating assigned is now being produced by Systems Support and issued to service management for attention. The report enhances housekeeping of service data and its accuracy by continuing to ensure all valid entries have an assigned food law rating. Page 34
Page 35
Appendix 4 Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.7 Enquiries should be undertaken with the software application supplier used to inform future intervention for food businesses classified as 3A, 3B and 3C rating groups, with a view to having these aligned to the Food Law Code of Practice frequencies. Low Yes 01/12/2023 Implemented. The required software amendment has been undertaken and intervention frequencies within the Uniform system, for all rating groups, are now correctly aligned to the Food Law Code of Practice frequencies. Page 35
Page 36
Appendix 4 Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.8 In accordance with established procedures, any reductions in Food Law Rating for a food business should be countersigned by the Principal Environmental Health Officer to evidence management agreement to the change in future inspection schedule. Low Yes 03/01/2024 Implemented. Programmed Inspection Procedures have been seen as modified and prompt management notification of rating reductions. Email trails are uploaded to the Uniform system to evidence communications. Key Control: Effective performance measures are in place to assess achievement of key service activities. 5.9 Performance management information should be evidenced by suitable documentation which supports the calculation of the reported figures. Medium Yes 03/01/2024 Implemented. System reports have been devised within the Uniform system to directly provide and report the required performance indicator results. A review Page 36
Page 37
Appendix 4 Moray Council Internal Audit Section 7 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation of all Service performance indicators has been undertaken within 2025 and a new suite of measures have been agreed. Page 37
Page 38
APPENDIX 5 1 Final Internal Audit Report (Follow-up Review) Special Investigation- Building Services- Windows Replacement Programme February 2026 Distribution: Head of Housing, Property and Communities Service Manager Building Services The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Priority 1 1 Limited Priority 2 2 Priority 3 0 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 38
Page 39
Appendix 5 2 Contents Page Special Investigation- Building Services- Windows Replacement Programme (Follow Up Review) 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-14 4. Management Response 10-15 5. Follow Up 10-15 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 39
Page 40
Appendix 5 3 1. Introduction and Audit Scope The Head of Housing and Property Services, after consulting with the Corporate/ Senior Management Team, requested a review of a contract for a window replacement programme for properties at Carnie Place, Buckie. This was due to concern raised by an Elected Member in October 2024 that “large quantities of ill-fitting windows” had been purchased for a housing estate that could not be installed. A contract for the manufacture of windows of 765 windows for 101 properties in Dufftown, Rothes, Cullen, Raffan and Buckie was awarded by Building Services in 2021. The contract was for a total tender value of £297,174.00 and included the manufacture of 96 windows for 1 house and 16 flats at Carnie Place, Buckie, for £ 40,412. The contract was for the manufacture of windows, while the installation was awarded to another contractor. As part of the contract tender documents, Property Services undertook external sizing measurements for the windows, but a condition of the contract required the window manufacturer to carry out onsite dimensional surveys to ensure the new windows fitted the external wall openings. Property Services provided sizing measurements for the windows to allow cost comparisons between manufacturers as part of the tender evaluation. The contract conditions also allowed for an intrusive survey to be done if required at the properties to determine the actual sizing for manufacturing the windows. The audit scope was to check the contract for manufacturing replacement windows for properties at Carnie Place. This involved discussions with officers, review of documentation, emails, and minutes of meetings in the administration of this contract. The audit also undertook a physical inspection with the support of an officer in Property Services to confirm the stock of windows stored by Building Services. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). 2. Key Issues • The audit noted that most of the 765 replacement windows manufactured for the 101 properties in Dufftown, Rothes, Cullen, Raffan and Buckie have been successfully installed. However, the 96 windows manufactured as part of the contract for Carnie Place, Buckie cannot be fitted to the properties. This is because the size dimensions of the windows manufactured are greater than the rough openings to allow installation without structural changes to the properties at a significant cost. Enquiries with officers from Property and Building Services found that the rough openings for the windows Page 40
Page 41
Appendix 5 4 at the properties are greater when measured externally than the internal sizing. This feature of the properties at Carnie Place was not known in preparation of the tender contract documents by either Property or Building Services. However, a requirement of the contract was for the supplier (manufacturer) to undertake a dimensional survey by qualified officers of the windows at the properties. A site visit was undertaken in January 2022 at Carnie Place by the Manufacturer awarded the contract; also in attendance was the Clerk of Works Design from Property Services. An external survey was undertaken, but the Clerk of Works Design only noted the house was entered to check the internal dimensions of the window openings. After the site visit, the Manufacturer emailed the Contract Manager (Building Services) to highlight that the window openings for the properties were “tighter than outside reveals”. The Contracts Manager noted the proposed action that internal plaster boards could be “chipped away” to allow installation of the windows. The windows were then manufactured within a 5mm tolerance, except for 11 windows to the original specification of the tender contract documentation and delivered to Building Services premises in April 2022. Concern was initially raised by a contractor attempting to install the replacement windows of a sizing issue in April 2022. Further investigation by Building Services found that the replacement window frames manufactured had a greater dimensional sizing of between 20 mm to 100mm to fit the rough openings for the windows at the properties. Due to this variance, and as the internal wall was solid block and plaster, it could not be “chipped away”. Installation of the replacement windows would need structural changes to the properties, which would not be a cost-effective option and would result in significant disruption to the tenants. • The issue concerning purchasing “ill-fitting” windows was raised with the Head of Property and Housing by an Elected Member in October 2024. However, concern regarding the sizing of the windows manufactured for Carnie Place was known in April 2022. The replacement windows have been stored at a Building Services premises but have not been recorded within the Building Services Stores System as they were ordered for a specific contract. Improved accounting arrangements should be introduced for all contract items and materials to ensure any unused or surplus materials are reviewed by senior management. A decision should be undertaken about the future use of the replacement windows purchased for Carnie Place, Buckie, in accordance with Financial Regulations. Page 41
Page 42
Appendix 5 5 Special Investigation- Building Services- Windows Replacement Programme- 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 High A review was undertaken regarding the purchase of replacement windows for 17 properties at Carnie Place, Buckie. The following points were noted: 1.1 The purchase of windows for Carnie Place, Buckie was part of a more extensive windows replacement programme in 2019 for 101 properties in Dufftown, Rothes, Cullen, Rathan and Buckie. The contract documents between the Housing Service and Building Services included measurements of the windows' external dimensions (width x height). Enquiries noted this was from an external survey by Property Services for tender costing purposes and undertaken before the lifting of Covid restrictions. The contract documentation detailed in Clause 3, General that Building Services should: “Prior to ordering of the respective timber windows, the Contractor is to determine, by site dimensional survey of each window, that the new window will occupy the full external opening and that the openings are suitable or fully modified to suit the window installation proposed” The audit considers that a more detailed survey of the properties at Carnie Place, Buckie would have highlighted a need to amend the initial external dimensions measurements for the windows provided by Property Services. A review of procedures should be undertaken regarding the checks required to confirm compliance with conditions and accuracy of specifications, including measurements for future contracts. Page 42
Page 43
Appendix 5 6 1.2 In addition, the contract also allowed for “an intrusive survey to establish, e.g., the cover at jambs and soffits, or if existing openings require to be modified in any way.” It was found this was not undertaken, and the tender contract documents provided to the manufacturers to price were the external dimension measurements for the windows undertaken by Property Services. 1.3 Building Services separated the tendering process for the supply and installation of the windows replacement programme. The tenderers for manufacturing the windows were informed of “approximate dimensions” within the contract documentation. Building Services awarded the contract for the supply of windows for 101 properties in July 2021 for £297,174.00. This included the 17 properties (1 house & 16 flats) at Carnie Place, Buckie for 96 windows valued at £40,412. The contract awarded detailed the following specification requirements: “Prior to manufacture of the respective timber windows, the Supplier is to determine, by site dimensional survey of each window, that the new window will fit into the external wall opening rebate and that the openings are suitable or fully modified to suit the window installation proposed. Page 43
Page 44
Appendix 5 7 If the minimum 12mm at the head & 12.5mm at the jamb cover is not achievable at the external window opening rebate then agreement on how to proceed should be made prior to the manufacture of the windows.” 1.4 In addition to the previous contract specifications, there was a condition for the Manufacturer to undertake a site survey, a requirement also included “staff involved in the site survey should be suitably qualified and experienced (i.e. time-served or former tradesmen technically proficient in measurement for replacement windows) taking care to establish the height and width of openings and the rebate depth at head and jambs…”. 1.5 A site visit was undertaken at Carnie Place, Buckie in January 2022 by the Manufacturer. In addition, the Clerk of Works Design (Property Services) was also present. An email on 17 May 22 from the Manufacturer to the Contracts Manager within Building Services detailed that “inside reveals at Cairnie Place are tighter than outside reveals”. The window manufacturer also stated that as “agreed on site” with the Clerk of Works Design “that inside plaster board would be chipped away”. The response from Page 44
Page 45
Appendix 5 8 the Contracts Manager was “noted”. 1.6 The Contracts Manager within Building Services is no longer employed by the Council. However, a discussion has been held with the Clerk of Works Design. The officer stated that he had verbally raised his concerns regarding the sizing of the windows for Carnie Place, Buckie with the Contracts Manager and suggested that a window installer should undertake a survey before ordering the windows. The site visit with the Manufacturer in January 2022 involved an external check of the properties, but the Clerk of Works Design only noted the Manufacturer entering the house within Carnie Place to undertake an internal survey. 1.7 The windows were then manufactured within a 5mm tolerance, except for 11 windows, according to the original specification from Property Services within the tender contract documentation and delivered to Building Services premises in April 2022. The Contractor installing the windows at Carnie Place informed Building Services of an issue with sizing in April 2022. Further investigation by Building Services found that the manufactured window frames for the flats had a greater dimensional sizing of between 20 mm to 75 mm to the rough openings. Page 45
Page 46
Appendix 5 9 However, 3 windows for the flats and 8 windows for the house at Carnie Place were manufactured to a different size to the original specification detailed within the tender contract documentation. A recent survey undertaken by Building Services of the house noted variances between the manufactured window frames to the rough openings of between 20mm to 100mm. 1.8 It was also found that the internal rough openings for the windows at the properties were less than the external dimensions. The audit has been advised this is unusual, and as the internal wall was solid block and plaster, it could not be “chipped away”. Installation of the replacement windows would need structural changes to the properties, which would not be a cost effective option. 1.9 The 96 replacement windows for Carnie Place, Buckie have until recently been stored at a Building Services premises in Keith since 2022. The minutes of the Housing Maintenance Partnership Contract Meetings involving officers from Property and Building Services noted the issue concerning the replacement windows programme for Carnie Place, Buckie was discussed from August 2023. Page 46
Page 47
Appendix 5 10 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head of Housing, Property & Communities/ Service Manager Building Services Yes 30/09/2025 A review of Property and Building Services operating arrangements will be undertaken to identify any improvements needed to current practices in preparing tender specifications and checks to ensure compliance with contract conditions. Updated procedures have now been introduced that require additional sample checking to be undertaken by Building Services officers prior to approval being given for a supplier to manufacture windows. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Property and Building Services have undertaken a review of operating arrangements. It has been decided that all future window and external door replacements will be procured on a supply-and-fit basis. It was also noted that a Works Framework is being developed, with support from Procurement, for use in future projects. A Works Framework is a pre-procured contractual arrangement that allows the Council to commission works quickly and compliantly, without the need to run a full tender exercise each time. Page 47
Page 48
Appendix 5 11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium It was noted that the replacement windows for Carnie Place, Buckie had been stored until recently at a Building Services premises in Keith since 2022. As the windows had been ordered for a contract, they were not recorded as stock within the Stores System. Materials/items purchased for a contract can sometimes be stored within a Building Services premises, but this should only be for a short period to allow the practical completion of the works. Audit testing as part of this review undertook a physical check to confirm the replacement windows purchased for Carnie Place, Buckie were the same as those stored at the Building Services premises. This was confirmed. However, it was found that in addition to the purchased windows, 51 windows intended for another 6 properties were also present. Enquiries found these windows related to properties with planned installation dates before 2023. Discussions with Building Services officers noted that these windows were not installed because tenants refused access to the properties. However, further investigation and discussions are now being undertaken to allow the fitting of these windows at the properties. A full inventory check of the contract materials held within Building Services premises should be undertaken, including the dates ordered and intended contracts. This information should then be provided to the Head of Housing and Property Services for review and to authorise in accordance with Financial Regulation if alternative use, sale or disposal is required. Consideration should also be given to investigating whether the Stores Management System could be further used to account for materials/items purchased for contract purposes. Alternatively, a 6 monthly stock take should be undertaken of the materials/items held for contracts with the dates purchased and the intended works programme. This should then be reviewed by the Building Services Manager. Page 48
Page 49
Appendix 5 12 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Building Services Yes Yes 30/04/2025 31/10/2025 A full inventory check of contract materials held within all Building Services premises will be undertaken and provided to the Head of Housing and Property Services. The Building Services Stores Management System will be used to purchase and record all future contract materials. Regular 6 monthly stock takes will be undertaken for contract materials. This will be periodically reviewed by the Building Services Manager. Storage arrangements for contact materials are also being reviewed, with the intention of making greater use of direct orders from suppliers. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Part Implemented 30/06/2026 The follow-up audit review has verified that a full inventory check of contract materials has been carried out by the Service and provided to the Head of Housing, Property & Communities. It was noted that alternative uses for the windows purchased for Carnie Place, Buckie, have been explored; however, no suitable alternative has been identified by the Service. At the time of the follow-up review, the Service intends to sell the windows and will seek the approval of the Chief Financial Officer in accordance with Financial Regulations. A revised implementation date of 30 June 2026 has been agreed for the disposal of the windows. Page 49
Page 50
Appendix 5 13 Implemented N/A All materials and items purchased for contract purposes are now procured by Stores Officers using the Stores Management System. It was also noted that revised operating arrangements have been introduced for undertaking a six-monthly stock check of contract materials and items held, including the dates of purchase and the intended works programme. This is then reviewed by the Service Manager Building Services. Page 50
Page 51
Appendix 5 14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium As detailed in the previous finding, the audit undertook a physical check to confirm the stock of 96 replacement windows held for Carnie Place, Buckie until recently at the Building Services premises in Keith since 2022. The following points were also noted: • The audit confirmed the 96 replacement windows held in storage by Building Services. However, from the survey undertaken by the Manufacturer in January 2022 for the house within the replacement windows programme at Carnie Place, 8 windows had been manufactured to different dimension measurements from the information provided by Property Services as part of the tender contract documentation. The Manufacturer had not detailed these size changes to Building Services. • A variance was found between the actual sizing of the windows manufactured and the dimension measurements detailed within the tender contract documentation of 3 windows for the flats at Carnie Place. Improved checking arrangements should be undertaken by officers to verify materials or items purchased are in accordance with the agreed specification. Officers should be reminded to check deliveries on receipt against the purchase order to verify accuracy and allow for any issues to be raised with the supplier/manufacturer in accordance with the terms and conditions of the contract. Page 51
Page 52
Appendix 5 15 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Building Services Yes Implemented Improved procedures are now in place to ensure the accurate checking of deliveries on receipt against the purchase order and to verify the accuracy and condition of goods received. Any issues will be raised with the supplier/manufacturer and payment of invoices will be held until they are resolved. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Revised procedures have been introduced whereby all deliveries of contract materials are now received and verified by Stores Officers against delivery notes and purchase orders. Any issues are raised with the supplier or manufacturer before payment of invoices. Page 52
Page 53
Appendix 5 16 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of noncompliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 53
Page 54
Appendix 5 17 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report is confidential and must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 54
Page 55
APPENDIX 6 1 Final Internal Audit Report (Follow Up) Keith Grammar School February 2026 Distribution: Head of Education (Chief Education Officer) Head Teacher School Support Co-ordinator The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 0 Priority 2 4 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 55
Page 56
Appendix 6 2 Contents Page Keith Grammar School 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-14 4. Management Response 5-14 5. Follow Up Review 6-15 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 56
Page 57
Appendix 6 3 1. Introduction and Audit Scope The annual Internal Audit plan for 2024/25 provides for a review of a secondary school within Education Services. This audit details the findings from the review undertaken of Keith Grammar School as part of a rolling programme of audit visits planned for secondary schools. The scope of this audit was to review the operation of the Devolved School Management Scheme in terms of funding allocation and management at the school level. Consideration was given to how budgets are affected by National, Council and School priorities. In addition to undertaking an overview of how the School develops, monitors and controls its £3.3 million annual devolved budget, the audit involved a study of the management of the staffing costs involved in delivering the curriculum. The audit checked that non payroll expenditure complied with Financial Regulations and Procurement Guidelines. A review was also undertaken to ensure appropriate accounting arrangements are followed when managing School Fund monies in accordance with the School Fund Regulations. This report sets out the work undertaken in relation to the 2024/25 financial year. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • A review of the School's Inventory Record noted that movable assets valued at £250 or above have been recorded. This exceeds the requirements of the Council's Financial Regulations, which specify the need for a comprehensive record of all movable items with an individual replacement cost exceeding £500. In addition, despite recording movable assets valued at more than £250, the majority of items listed had no recorded value detailed within the Inventory Record. The School should review and update its Inventory Record, ensuring that the replacement costs of all items exceeding £500 are accurately documented. • Further improvements are recommended to strengthen controls in the administration and accounting arrangements for the School Fund. The review noted that one of the signatories had pre-signed blank cheques for the School Fund bank account. Enquiries found that the School Fund bank account only had two signatories, and the pre-signing of cheques was due to a staffing issue and a need to facilitate the ongoing Page 57
Page 58
Appendix 6 4 processing of payments. To enhance financial oversight, additional cheque signatories should be established for the School Fund bank account, ensuring that one signatory authorises a payment while another verifies the transaction. Additionally, the annual School Fund Income and Expenditure Statement could be further detailed to provide readers with a clearer understanding of financial activities. • The iPayimpact online payment system is not being utilised collecting income related to school activities such as trips, clubs and events. As a result, the School has had to rely on more labour intensive manual income collection processes. Consideration should be given to increasing the use of the iPayimpact online payment system. Page 58
Page 59
5 Findings/Recommendations - Keith Grammar School 2024/25 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium Financial Regulations require an Inventory List to be maintained of all movable assets valued at £500 or above to be maintained. However, it was found that the School maintained an Inventory List of items valued at more than £250, a figure specified in a previous version of the Financial Regulations. Additionally, at the time of the audit, only 35% of the listed items had a recorded value. It was explained that this was due to officers updating the list without readily available invoice price information. Procedures should be amended for maintaining the School's Inventory List to reflect the requirements of the current iteration of the Council's Financial Regulations and to ensure that cost or estimated replacement value is recorded against each item. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head Teacher Yes 01/09/2025 The current inventory is to be updated and amended as per the Council's Regulations. Page 59
Page 60
6 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The School’s Inventory List has been revised and updated and now complies with the Council’s Financial Regulations, showing the cost or estimated replacement value of all items held which exceed £500. Page 60
Page 61
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low The audit visit noted that Supermarket vouchers totalling £1,000 were held in a secure location at the School. Enquiries revealed that these vouchers had been purchased by the School from the Pupil Equity Fund in 2023, with the intention of providing them to families of pupils in financial need. However, this had been done during a period of absence by the Head Teacher, and to date, none of the vouchers have been issued since the purchase, nor have any criteria for issuing them been developed. Options for the future use of the vouchers were discussed with the Head Teacher, but it was noted that no decision had been reached at the time of the audit. Consideration should be given to the best use of the vouchers held, in accordance with the Pupil Equity Fund National Operational Guidance. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head Teacher Yes 01/10/2025 The vouchers will be used to support sessions at a charitable youth project which supports families in the local area. Cooking sessions are attended by pupils disengaging from school, offering life skills and building on engagement. Additionally, a Summer Supper Club is run which provides a meal for families who may be struggling during the holiday period, fitting the aims of Pupil Equity Funding. Page 61
Page 62
8 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A All vouchers have been handed over as planned to the charitable youth project for the undertaking of family support activities. The distribution of the vouchers has been evidenced as received by the project. Page 62
Page 63
9 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Low It was noted that the current petty cash imprest level for the School is £300. On analysis of expenditure and discussion with officers at the School, it was noted that this limit is no longer required and that a lower level of petty cash would be appropriate for the School's day-to-day needs. The ongoing use of petty cash was queried with the School but is still required for the purchase of minor reimbursements and ad hoc purchases. Consideration should be given to reducing the level of petty cash held by the School. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head Teacher Yes 01/04/2025 The Petty Cash Fund has been reduced to £50. Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Following the audit recommendation the petty cash imprest was reduced to £50 in March 2025. However, due to a change in available banking facilities, the remaining petty cash has been repaid to the Council in July 2025 and no balance is now held by the School. Page 63
Page 64
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Medium An Annual Income and Expenditure Statement must be prepared and audited in accordance with the School Fund Regulations. Upon reviewing the School's Income and Expenditure Statement, it was found to contain only three income and expenditure categories: School Fund, School Prizes and Holding. While the School does hold supporting evidence detailing the breakdown of the activities and clubs that contribute to these categories, the lack of detail in the Annual Statement prevents readers from understanding the activities undertaken using the School Fund. The School Fund Annual Income and Expenditure statement should be expanded to give improved transparency of the significant activities during the previous year. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head Teacher Yes 01/09/2025 A more comprehensive report will be produced at the end of the School Fund financial year to reflect School Fund activities. Page 64
Page 65
11 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A The School Fund Annual Income and Expenditure statement has been revised for the year ending 31st July 2025 and has been expanded to detail financial performance on the main school fund activities. Going forward the statement will continue to be tailored to give a representation of the School Fund activities supported within the relevant period. Page 65
Page 66
12 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium IPayimpact is an online payment system used by schools to accept online payments from parents and carers for school related expenses such as school clubs, trips, and the purchase of tickets for school events. IPayimpact reduces the inherent control risks associated with cash handling within an establishment. Although a trial use of iPayimpact has been undertaken for one activity at Keith Grammar School, no further use has been made of the system. The current cash handling and banking arrangements at the School are manually intensive. Further use of the iPayimpact system would allow for more efficient use of staff time within the School. Consideration should be given to the further use of the iPayimpact system at the School for the collection and banking of income. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head Teacher Yes 01/12/2025 Ongoing training for office staff to be scheduled over the next few months to enable a robust transition from cash to iPayimpact. Page 66
Page 67
13 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Implemented N/A Staff training on the use of the iPayimpact (iPay) system has taken place in September 2025. Limited activities have taken place which have been suitable for iPay administration since the completion of training, however, school uniform orders are now being administered through iPay and further uses are planned after the February mid-term break. Therefore, processes are now in place for enhanced use of the iPay system. Page 67
Page 68
14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Medium The School Fund bank account has only two authorised signatories, both of whom are required to sign a cheque for payments made from the account. During the audit visit, it was discovered that one of the signatories had pre-signed blank School Fund cheques. Enquiries revealed that a signatory, who was on extended leave, had pre-signed cheques to ensure the ongoing administration of the School Fund. Unfortunately, it was also found that the School has been unable to add additional signatories to the account, as this requires both existing signatories to engage with the bank to approve the action. The School Fund Regulations state that blank cheques must not be signed in advance. The individual circumstances surrounding the need for cheques to be pre-signed for the School Fund in this instance are appreciated. However, in accordance with the School Fund Regulations, cheques must not be pre-signed. Discussions with the School have noted an intention to change the current banking facility. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Head Teacher Yes 01/09/2025 New accounts with additional signatories will be opened as soon as possible. Page 68
Page 69
15 Follow Up Review Implementation Status Revised Implementation Date Internal Audit Review Outcome Outstanding 02/07/2026 Whilst it has been seen that the School has made significant efforts towards opening a new School Fund account, staffing changes and absences within the Senior Leadership Team, combined with the lengthy banking requirements for evidence of identification and certification, have delayed the process. Additional time is therefore required for the School to implement the audit recommendation and a revised date of 2 July 2026 has been agreed to allow the full transfer of banking arrangements to a new facility, with appropriate authorised signatory provisions in place, by the end of the academic session. Page 69
Page 70
16 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 70
Page 71
17 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 71
Page 72
Page 72
Page 73
Report to: Audit and Scrutiny Committee Meeting Date: 25 March 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Levelling Up Fund 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 19 November 2025 to 25 March 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of the Levelling Up Fund; this project has been agreed for review within the Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 The Levelling Up Fund is a United Kingdom (UK) Government investment programme designed to tackle regional disparities by funding local infrastructure and regeneration projects. Moray Council was awarded £18.29 million from the UK Government’s Levelling Up Fund in November 2023. This investment is intended to support the regeneration of the Item 6. Page 73
Page 74
town centre, upgrade local transport and enhance cultural and heritage assets. The Levelling Up Fund projects are governed through a collaborative structure comprising a Project Board, Delivery Groups and Moray Council. However, the Council acts as the Accountable Body for the Fund, managing financial compliance, procurement, and reporting obligations to the UK Government. 4.2 As part of the funding requirements, the Council’s Internal Audit Section is required to undertake annual reviews of the management of the Levelling Up Fund. The scope of this audit covered the processes established for governance and administrative arrangements related to finance, risk, engagement, and performance management. Based on the review, it is considered that appropriate arrangements have been developed to ensure effective governance and administration for delivering the funding objectives of the Levelling Up Fund. A further audit will be included within a future Audit Plan to verify that project delivery is in accordance with the Levelling Up Fund award. The detailed findings and recommendations from this review are detailed within the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. Page 74
Page 75
b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 75
Page 76
APPENDIX 1 1 Final Internal Audit Report Levelling Up Fund January 2026 Distribution: Head of Growth, Planning & Climate Service Manager Strategic Planning & Development Programme Manager (Levelling Up Fund) The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Full Priority 1 0 Priority 2 0 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 76
Page 77
Appendix 1 2 Contents Page Levelling Up Fund 1. Introduction & Scope 3-4 2. Key Issues 4 Detailed Report 3. Findings/Recommendations 5-7 4. Management Response 6-8 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 77
Page 78
Appendix 1 3 1. Introduction and Audit Scope The Annual Audit Plan for 2025/26 includes a review of the adequacy of governance and administrative arrangements in place for managing the Levelling Up Fund awarded to Moray by the United Kingdom (UK) Government. Moray Council successfully secured funding for the Elgin City Centre Masterplan as part of the third-round award of the Fund. This investment is intended to support the regeneration of the town centre, upgrade local transport and enhance cultural and heritage assets. The UK Government announced in November 2023 a Levelling Up Funding award of £18,291,000 to the Moray Council. In December 2024, the Memorandum of Understanding was signed between Moray Council and the UK Government, agreeing on the terms, principles and practices for the administration and delivery of Moray's Levelling Up proposals. Moray's Levelling Up Fund proposals centre on three key projects; revitalising Elgin town centre by bringing disuses buildings back into use and enhancing pedestrian access and the evening economy; transforming a former mart site to enable commercial development, create a multifunctional green space and improve links to the city centre; and reimagining Cooper Park by restoring this valued community space with upgraded recreational and leisure facilities for residents and visitors. Full delivery of the programme is required by 31st March 2028. The Levelling Up Fund projects are governed through a collaborative structure comprising a Project Board, Delivery Groups, and Moray Council. The Project Board provides strategic leadership and oversight, ensuring that all funded initiatives align with the objectives of the Levelling Up Fund. Community representatives also sit on the Project Board, contributing local knowledge and ensuring decisions reflect community priorities. Delivery Groups operate under the guidance of the Project Board to implement individual projects. These groups coordinate day-to-day activities, engage with contractors and partners, and ensure projects progress on time and within budget. Moray Council acts as the Accountable Body for the Fund, managing financial compliance, procurement, and reporting obligations to the UK Government. The Council's Internal Audit Section will include days within the Annual Audit Plan for work relating to the Levelling Up Fund, for the project duration. However, given the proposed timescales, 2025 has primarily been a preparation year, involving planning, design, legal agreements and consenting, while 2026 is scheduled for the delivery of the projects. As the programme is at an early stage, the scope of this audit has been limited to reviewing the processes established for governance and administrative arrangements related to finance, risk, engagement and performance management. Page 78
Page 79
Appendix 1 4 At the time of the audit review at the end of September 2025, £8.1 million of Levelling Up funding had been received from the UK Government. Expenditure of £1.7 million had been incurred for project management, design fees, legal fees and enabling works. The claims submitted to the UK Government to date have been reviewed and checked to ensure alignment with the Financial Management System (FMS). Audit testing has confirmed that the expenditure claimed to date is eligible under the terms of the Levelling Up Funding Scheme, with submissions made to the UK Government in a timely manner. The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Key Issues • The audit found that, within the scope of the review, appropriate arrangements have been developed for the governance and administration required to deliver the funding objectives of the Levelling Up Fund. The Project Board and focused Delivery Groups are meeting in accordance with an agreed schedule, with effective engagement from multidisciplinary officers and external stakeholders. Robust processes for risk identification and management have been established, and delivery plans have been developed in line with best-practice project management standards. Systems for financial performance monitoring are also in place, supported by established processes for reporting and forecasting. • The audit noted the need for some administrative improvements regarding the frequency of financial monitoring information and the review of content related to the Levelling Up Fund published on the Moray Council website. However, these issues are not considered significant and are regarded as lower-level control requirements. Page 79
Page 80
5 Findings/Recommendations - Levelling Up Fund 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Low It was noted that 2025 has been predominantly a preparation period for the Levelling Up Fund, with significant work undertaken in planning, design, stakeholder engagement, legal agreements and consenting, with delivery of the projects planned for 2026. The My Moray website is the official engagement platform for the Moray Economic Partnership and is used to provide updates on progress regarding programme activities. However, information about the Levelling Up Fund is also recorded on a dedicated page of the Moray Council website. The audit review noted that the information on the Council's website contained outdated content. The Moray Council website content relating to Levelling Up Fund activities should be reviewed and updated to ensure it reflects the current status of the programme. Page 80
Page 81
6 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Strategic Planning & Development Yes 27/02/2026 The relevant pages on the Council website are in the process of being updated. Going forward into the main construction periods of 2026 and 2027 detailed plans are being discussed for continuous communications with key stakeholders and for joined up communications for the full regeneration project portfolio, dependent on corporate Communications resourcing. Page 81
Page 82
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low Levelling Up Fund (LUF) programme financial spend and forecasting is compiled on request for monitoring returns from the UK Government and on quarterly capital plan reporting to the Committee. The UK Government monitoring returns were intended to be quarterly reports, but have experienced slippage, with the last two covering 6-month periods. Whilst financial transactions are recorded when incurred within the Council's Financial Management System, there is no monthly compilation of a monitoring statement, as is the standard budget monitoring process for Council services. Full validation of recorded transactions and agreement of allocations therefore takes place covering a longer time period, as it is currently undertaken when formal reporting is required to the UK Government. A monthly financial statement review of expenditure would enhance the control and monitoring process. A monthly financial statement should be compiled and agreed between LUF programme management and the Accountancy Service to facilitate improved financial monitoring arrangements. An up to date summary of spend should be continually available for management, given the sizeable programme of work. Page 82
Page 83
8 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Strategic Planning & Development Implemented 12/11/2025 The provision of monthly financial statements by the Accountancy Service has commenced since the completion of the audit project. This ensures more frequent monitoring, progressive code alignment and consistency between the financial ledger and Service records. Page 83
Page 84
9 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with the Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 84
Page 85
10 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 85
Page 86
Page 86
Page 87
Report to: Audit and Scrutiny Committee Meeting Date: 25 March 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Democracy and Governance 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 19 November 2025 to 25 March 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of democracy and governance; this project has been agreed for review within the Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 An audit was undertaken to provide assurance that the Council’s democratic and governance arrangements are operating effectively, transparently and in compliance with statutory requirements. The audit reviewed whether key constitutional policies and regulations are up to date, clearly documented and readily accessible to both members Item 7. Page 87
Page 88
and officers. The audit also examined the arrangements for Council meetings and decision-making processes, focusing on whether agendas, minutes and supporting documentation are prepared, published and managed to ensure transparency and accountability. In addition, at the request of the Chief Executive, the scope of the audit was expanded to review a particular issue concerning the omission from a Committee report of an Integrated Impact Assessment and feedback from a public consultation exercise, both of which were required by Members to make an informed decision on a proposed budget saving affecting future service delivery arrangements. 4.2 Overall, within the scope of the audit, the review found that the Council has effective governance and democratic policies and procedures in place. However, recommendations have been made to improve the accessibility of policies and regulations, which should strengthen compliance and operational effectiveness. The audit also identified a need for enhanced accountability, monitoring, and communication between services when reporting budget-saving proposals arising from changes to service delivery to Committee. Detailed findings and recommendations from this review are provided in the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. Page 88
Page 89
☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 89
Page 90
APPENDIX 1 1 Final Internal Audit Report Democracy and Governance January 2026 Distribution: Chief Executive Chief Governance Officer Chief Financial Officer Head of Customer Experience, ICT & Digital Service Service Manager Democratic Services The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 4 Priority 2 6 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 90
Page 91
Appendix 1 2 Contents Page Democracy and Governance 1. Introduction & Scope 3-4 2. Key Issues 4-5 Detailed Report 3. Findings/Recommendations 6-27 4. Management Response 7-27 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 91
Page 92
Appendix 1 3 1. Introduction and Audit Scope The Internal Audit Section has completed a review of the Council’s governance and democratic arrangements. The objective of this review was to provide assurance that the structures and processes supporting local democracy are operating effectively, transparently and in compliance with statutory requirements. The audit was undertaken as part of the approved 2025/26 Annual Audit Plan, reflecting the critical importance of robust governance and democratic accountability in maintaining public confidence and ensuring that decision- making remains aligned with the needs and priorities of the community. Governance and democracy are fundamental to the way the Council operates and delivers services to its communities. Effective governance provides a structured framework that defines roles, responsibilities and reporting lines, enabling elected members and officers to work collaboratively to ensure that decision-making processes are transparent, accountable and compliant with statutory obligations. The scope of the audit was to assess the effectiveness of the governance structures in supporting the decision-making process. This included a review to ensure that key constitutional policies and guidelines are up to date, clearly documented and readily accessible to both members and officers. Such policies provide a consistent framework to ensure compliance with legislation and support the efficient delivery of services. In addition, the audit sought to identify risks that may weaken democratic accountability and to recommend improvements that would strengthen processes across the Council. The methodology adopted for this review combined several approaches to ensure a comprehensive assessment. This included a review of governance arrangements to provide assurance that the systems and structures supporting decision-making are effective, transparent and compliant with statutory requirements. In addition, discussions were held with members and the Corporate Leadership Team to obtain views on the strengths and potential areas for improvement within the existing governance and democratic framework. The committee reporting process plays a crucial role in maintaining democratic integrity and supporting the Council’s governance structure. Accordingly, the audit reviewed committee papers to ensure that adequate and timely information is provided to support informed decision-making. The audit programme was developed using the Delivering Good Governance in Local Government: Framework (produced by the Chartered Institute of Public Finance and Accountancy and the Society of Local Authority Chief Executives and Senior Managers). This framework serves as a practical guide for local authorities to ensure strong governance and accountability. Page 92
Page 93
Appendix 1 4 The scope of this review was extended following a request from the Chief Executive to examine the reasons for the omission of an updated Integrated Impact Assessment and to provide feedback on a public consultation exercise in a committee report on proposed budget savings within the Early Years and Childcare Service. This additional work was deemed necessary, as it is a fundamental governance requirement that elected members are provided with all relevant and material information to support informed and transparent decision- making at committee meetings. . The audit was carried out in accordance with Global Internal Audit Standards (GIAS). 2. Key Issues • It is noted that a central database of Council policies is currently being developed to provide a comprehensive record of approved policies, designated responsible officers and scheduled review dates. Although the database is still under development, once implemented it is expected to serve as an effective control mechanism for the Corporate Leadership Team, supporting oversight of key policies essential to delivering corporate objectives. In addition, the audit identified that the accessibility of policies and regulations on the Council’s intranet could be improved. At present, there is no clear or consistent indexing system within service- specific areas and search functionality is limited. Enhancing the accessibility and organisation of policies and regulations should strengthen operational effectiveness and promote greater compliance across the Council. • Previous audit reviews reported to this Committee have highlighted a recurring issue of non-compliance with Financial Regulations across Council services. This matter has been discussed and noted as a concern during monthly meetings between the Service Manager Internal Audit and Risk and the Chief Financial Officer. Financial Regulations is a first-tier governance document, required under Section 95 of the Local Government (Scotland) Act 1973, and provides the framework for lawful and transparent financial management, including budgeting, procurement and asset control. To reinforce the need for compliance, a direct link to the Financial Regulations should be placed on the Council’s intranet homepage as a reminder to all officers. In addition, the Internal Audit Section will include testing of non-payroll expenditure within future Audit Plans to assess ongoing compliance with Financial Regulations and associated guidelines. Page 93
Page 94
Appendix 1 5 • Further to a request by the Chief Executive, a review has been undertaken of the process that resulted in the omission of supporting documentation from a committee report on proposed budget savings within the Early Years and Childcare Service. A report was provided to Council on 4 December 2024 detailing the proposals for service changes and intended savings within the Early Years and Childcare Service, but with a need for consultation in accordance with the Council’s agreed Change Management Policy and Procedures. Following consideration, members approved the report. A subsequent report to Council on 26 February 2025 referred to the earlier approval but did not include the required public consultation feedback and an updated Integrated Impact Assessment for members to review. Members noted the savings but based on incomplete information. A corrective report was presented to Council on 21 May 2025, which included an updated Assessment and the consultation outcomes; members then approved the proposals. From an audit perspective, the omission of the required supporting documentation in the February report was an error that may have been due to a lack of understanding among officers regarding reporting requirements. However, it is considered from the review undertaken that there is a need for improved accountability, monitoring and communication between services. The audit review acknowledges that officers are operating under considerable pressure in the current challenging financial climate, coupled with the urgency to identify savings and implement service changes. Page 94
Page 95
6 Findings/Recommendations – Democracy and Governance 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium It is pleasing to note that an exercise has been underway within the Executive Support Service since the start of 2025 to develop a database of Council policies approved at committee. This initiative, led by the Corporate Leadership Team, aims to maintain a comprehensive record of policies, responsible officers and review dates. The Internal Audit Section has previously reported to the Audit and Scrutiny Committee instances where policies identified during service reviews had not been updated for several years. From an audit perspective, the current exercise represents good practice and should enhance governance by providing senior management with oversight to ensure that Council policies remain legally compliant, mitigate potential risks and support the efficient delivery of services. It is acknowledged that the compilation and development of the Council Policies Database is still ongoing. However, once completed, it will become a vital monitoring and control tool for The Council Policies Database should be updated to ensure an accurate and effective record of key policies is maintained, supporting informed decision- making and operational control within the Council. Page 95
Page 96
7 the Corporate Leadership Team, promoting effective resource management while ensuring accountability, legal compliance, consistency and continuity in governance and decision- making to achieve the Council’s objectives. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Executive Director, Finance, Strategy & Transformation, Chief Executive (in the interim) Yes 28/02/2026 The Council’s database will be updated and monitored to ensure an accurate record of key policies. The Extended Corporate Leadership Team will review on a six monthly basis. Page 96
Page 97
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium The audit reviewed and discussed with officers the ease of use and accessibility of locating policies and regulations within the Council’s intranet site. It was found that there is no clear and consistent indexing system within service‑specific areas, coupled with limited user‑friendly search functionality. For example, variances were noted between services that provided an A–Z listing of policies and regulations and others that displayed a vertical list of documents. As a result, difficulties are found in locating relevant documents when required for operational or compliance purposes. The absence of a clear and accessible system for locating Council policies and regulations can lead to inefficiencies, compliance risks, weak monitoring controls and reduced accountability. Improved accessibility to policies and regulations enables officers to quickly locate the required documents, supporting informed decision-making, ensuring compliance with statutory requirements, and strengthening Consideration should be given to developing and implementing a more standardised, user-friendly framework within the Council’s intranet to improve accessibility and retrieval of policies and regulations. Enhanced ease of access will support operational efficiency, strengthen compliance, and provide assurance that officers are referencing current and approved policy documents. Page 97
Page 98
9 confidence in the Council’s overall governance and control environment. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Executive Director, Finance, Strategy & Transformation, Chief Executive (in the interim) / Head of Customer Experience, ICT & Digital Services Yes 28/02/2026 It is recognised that, although there is a clear and accessible intranet landing page for Policies, Procedures and Guidelines, inconsistencies remain across the linked service areas. To address this, all appropriate policy and regulation documents will be accessible from a single page on Interchange. This page will present documents in an A–Z format and include functionality to filter by responsible service and search by title and description. Services will be briefed on the process for publishing new and updated policy and regulation documents to ensure the improved experience is maintained. Page 98
Page 99
10 These changes will be implemented on Interchange by 28 February 2026. Aligned with the approach taken by other local authorities, relevant policy and regulation documents will be published on the public-facing website, incorporating the same enhanced user experience that will be introduced on Interchange. The full website rebuild is scheduled for completion by April 2026; however, the initial improvements to Interchange will address the key concerns highlighted in this audit action. Page 99
Page 100
11 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 High This audit finding concerns a request by the Chief Executive for the Internal Audit Section to investigate an issue concerning an omission from a committee report of an updated Integrated Impact Assessment and feedback from a public consultation exercise, both of which were required by members to make an informed decision on a proposed budget saving affecting future service delivery arrangements within the Early Years and Childcare Service. From a review undertaken, the following findings were noted of the actions undertaken and the timeline of events: 1. A report to Council on 4 December 2024 (para 22 of the minute refers), titled “Short to Medium Term Financial Plan”, from the Depute Chief Executive (Economy, Environment and Finance), included a proposal for significant savings by changing the operating hours of four Council Early Learning and Childcare facilities. The report stated that consultation with service users had been undertaken; however, a full Page 100
Page 101
12 Integrated Impact Assessment and wider public consultation were also required for the proposed change in service delivery. Following consideration, members approved the report. 2. A report was presented to a special meeting of the Council on 26 February 2025 (para. 3 of the minute refers), titled “2025/26 Budget and 2025 to 2028 Financial Plan”, by the Depute Chief Executive (Economy, Environment and Finance). The report referred to the previous approval, at the meeting on 4 December 2024, of a range of budget savings proposals, including service delivery changes within Early Learning and Childcare facilities. It stated that formal consultation with officers and workforce representatives had been undertaken. However, it did not include the required public consultation feedback or an updated Integrated Impact Assessment containing this information for members to review. The report also noted that “some of these savings were subject to consultation and the results of the consultation are included in a separate report on this agenda”; however, no such separate report was provided to the The Integrated Impact Assessment Form should be amended to include designated fields for a named Lead Officer and Authorising Officer. This will strengthen accountability for the information provided and improve oversight by confirming that the Form has been completed accurately and appropriately. Page 101
Page 102
13 committee. Members agreed to note the projected savings outlined in the report. . 3. Discussions with the Chief Governance Officer (Monitoring Officer) confirmed that, following the Council meeting on 26 February 2025, it was identified that a fully completed Integrated Impact Assessment and the findings from the public consultation exercise had not been provided to members prior to their approval of the budget savings arising from the proposed changes to service delivery at the Early Learning and Childcare Facilities. 4. The audit review noted that the Strategy and Performance Service undertook a public consultation on the Early Learning and Childcare Service change proposals from 29 January to 12 February 2025. However, the results were not analysed until 7 April 2025, when a summary was shared with the Early Learning and Childcare Service. The Strategy and Performance Service were unaware of the proposal’s progress or the committee reporting timelines, resulting in the consultation work not being aligned with the committee schedule. Consideration should be given to developing a master record that provides a clear framework outlining the key stages required to complete any proposed changes to service delivery that may involve amendments to the budget-setting process. This record could also serve as an effective monitoring tool for the Corporate Leadership Team, ensuring that all required processes are followed and that appropriate supporting evidence is obtained to support any proposed budget savings affecting future service delivery arrangements. Consideration should be given to providing additional training for officers to enhance their understanding of completing an Integrated Impact Assessment and meeting committee reporting requirements. Page 102
Page 103
14 5. The Chief Governance Officer (Monitoring Officer) prepared a report for a Council meeting on 21 May 2025 (refer to paragraph 17 of the minutes), which included the necessary supporting documentation. The report recommended that members consider the outcomes of the public consultation exercise, the updated Integrated Impact Assessment and approve the Early Learning and Childcare budget proposals, noting the anticipated savings to the revenue budget. Members agreed to these recommendations. From an audit perspective, officers should have identified the omission of public consultation feedback and the absence of an updated Integrated Impact Assessment in the committee report detailing budget savings proposals arising from service delivery changes within the Early Learning and Childcare Service. However, there appears to be a lack of understanding of processes and limited awareness across services regarding the required committee reporting timescales. This highlights the need for further training, improved communication, strengthening monitoring While the complexity of reviewing service change proposals is acknowledged, members may benefit from additional training to support their role in scrutinising and approving budget proposals from an equality perspective. Page 103
Page 104
15 arrangements and clearer accountability. It is acknowledged that officers face significant time pressures in the current challenging financial climate, alongside the need to identify budget savings and progress service delivery changes. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Governance Officer Yes 31/12/2025 30/04/2026 30/04/2026 The Integrated Impact Assessment (IIA) form has been revised to incorporate a lead officer and authorising officer. The master record will be reviewed and presented to the Corporate Leadership Team weekly on the run up to the budget setting. Written guidance on completing an IIA using the existing format is complete. Face to face training for officers on completing an IIA is underway and will be a rolling programme. Elected members training on equalities considerations will be undertaken by April 26 Page 104
Page 105
16 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Low As part of this review, discussions were held with members to identify areas where service improvements could better support them in fulfilling their roles and responsibilities. Members reported occasional challenges in locating specific documents, such as meeting agendas, minutes, and reports, within the Committee Management Information System (CMIS). It was noted that the system’s search functionality is limited, which impacts the ability to efficiently access the information required for decision making and preparation needed for meetings. Timely and efficient access to information reduces the administrative time spent locating documents, enabling members to respond more effectively to queries and policy matters. Further training should be provided to members to support more effective use of the Committee Management Information System (CMIS). In addition, consideration should be given to incorporating CMIS training into the induction programme for newly elected members to ensure they are familiar with the system from the outset. Page 105
Page 106
17 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Democratic Services Yes 30/06/2026 Agreed training will be provided to support of Members use of CMIS. Will be incorporated as part of Elected Members induction programme (2027) Page 106
Page 107
18 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium Committee Services have developed clear guidance for officers, available on the intranet, regarding reporting arrangements to Council committees. Reports are classified as either “open” or “confidential.” Open reports are accessible to the public, while confidential reports are restricted to members and authorised officers. Confidential reporting is required when content includes sensitive or legally protected information, in accordance with the Local Government (Access to Information) Act 1985, to protect privacy and safeguard the Council’s interests. However, examples were noted where some committee reports have additional restrictions beyond the standard confidential reporting arrangements. This was discussed with the Chief Governance Officer (Monitoring Officer), who confirmed that certain reports may be classified as “super confidential,” with greater access restrictions due to data protection or commercial sensitivity. While the reasons for these additional restrictions are understood, to ensure transparency in committee reporting The Committee Reporting Guidance should be updated to include an additional category for reports requiring enhanced confidentiality and access restrictions beyond the current confidential reporting arrangements. Page 107
Page 108
19 protocols, this reporting category should be formally included within the Committee Reporting Guidance. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Governance Officer / Service Manager Democratic Services Yes 30/06/2026 Revised CMIS permissions will be put in place for confidential reports - including after the meetings have taken place. Guidance to be updated / implemented. Printed copies - different colour of paper and guidance note added. Page 108
Page 109
20 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Low The Best Value Action Plan 2024–27 highlighted the need for the Council to strengthen collaborative leadership between officers and elected members to support more effective decision-making. As committee reports form the core foundation for these decisions, it was considered that the previous reporting format and processes were too onerous and challenging. Consequently, on 21 January 2025, the Council agreed to adopt a revised committee reporting template and introduce a requirement for more timely submission of reports at the pre-agenda stage for formal committees and Council meetings. Following discussions with senior officers, including the Chief Executive, an opportunity should now be taken to review these revised processes to determine whether they have achieved their intended objectives or if further amendments to current committee reporting arrangements are required. . A review should be undertaken of the revised committee reporting format and timescales, with consideration given to whether further changes would improve current arrangements. Page 109
Page 110
21 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Executive Yes 30/06/2026 In progress. Suggestions of amendments being collated, with a consultation of the ECLT and with Elected Members to take place prior to decision made (June) Guidance will be provided for the summary completion, including using the Local Outcome Improvement Plan and Corporate Plan sections correctly; removing the financial tables if not required. Page 110
Page 111
22 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 7 Medium It was noted during this review that, while the Audit and Scrutiny Committee include scrutiny functions, limited reporting has been undertaken in recent years. This issue was also highlighted during a workshop facilitated by the Service Manager Internal Audit and Risk with Members, as part of an assessment exercise against the good practice guidelines from the Chartered Institute of Public Finance and Accountancy's publication, “Audit Committees: Practical Guidance for Local Authorities and Police (2022 Edition).” The Chief Governance Officer (Monitoring Officer) has acknowledged this issue, and a review is currently underway to explore opportunities for further developing the Council’s scrutiny functions. An effective scrutiny function is essential for ensuring transparency and accountability and for supporting the efficient and effective delivery of Council services. Consideration should be undertaken in the further development of the scrutiny reporting functions within the Scheme of Administration of the Audit and Scrutiny Committee. It is hoped this will facilitate further reporting to the Audit and Scrutiny Committee in providing improved oversight and constructive challenge to decisions, policies and performance. Page 111
Page 112
23 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Governance Officer Yes 30/04/2026 Already planned and monitored via the Best Value Action Plan. Consultation is complete and will be reported as part of Scheme of Administration review to Council. Page 112
Page 113
24 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 8 Medium The Financial Regulations are a “first-tier governance document” that provides a comprehensive framework for managing the Council’s financial affairs. These regulations are legally required under Section 95 of the Local Government (Scotland) Act 1973 and must reflect each local authority’s financial governance structures and operational needs. They define financial responsibilities, set procedures for budgeting, accounting, income, expenditure, procurement, asset management and ensure that financial decisions are lawful, transparent and properly authorised. Previous audit reviews across services have highlighted recurring findings of non- compliance with the Financial Regulations. Monthly meetings are held between the Chief Financial Officer and the Service Manager Internal Audit and Risk and this has been highlighted as an issue of concern. Following consultation with the Chief Financial Officer, a reminder should be displayed on the Council’s intranet homepage to reinforce the requirement for officers to comply with the Financial Regulations. In addition, audit testing of non-payroll expenditure to verify compliance with the Financial Regulations will be included as a project in the Annual Audit Plan. Page 113
Page 114
25 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Financial Officer Yes 30/04/2026 Heads of Service are liaising with Service / Budget Managers to ensure all staff are aware and understand the financial regulations and training is undertaken where required. Additionally, a reminder with links to Financial Regulations and the Procurement Procedures will also be added to the monthly email which informs budget managers that their budget monitoring reports are available. A banner message was added to the intranet homepage reminding all officers to comply with Financial Regulations, including Procurement Procedures – this will be repeated periodically. Page 114
Page 115
26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 9 Medium The Annual Governance Statement is a statutory requirement under the Local Authority Accounts (Scotland) Regulations 2014. It must be included in the Council’s Annual Accounts and signed by both the Chief Executive and the Leader of the Council. The Statement explains how the Council ensures good governance, manages risk, maintains effective internal controls and provides transparency and accountability in the delivery of public services. Local authorities are expected to use the Delivering Good Governance Framework, developed by the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Society of Local Authority Chief Executives (SOLACE), as a benchmark for assessing and improving governance arrangements. It was noted that an addendum to the Delivering Good Governance Framework was issued in May 2025 by CIPFA and SOLACE. The addendum details that from 2025/26 onwards, local authorities should consider developing and maintaining a Local Code of Governance. Consideration should be given to developing a Local Code of Governance to further reinforce the Council’s commitment to transparency, accountability and effective decision-making by clearly setting out how the principles of good governance are applied in practice. Page 115
Page 116
27 A Local Code of Governance is a document that provides a customised framework for councils to apply good governance principles effectively, enhancing accountability, transparency and decision-making in accordance with national standards. The Council does not have a Local Code of Governance; however, although there is no statutory requirement, consideration should be given to developing such a document. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Chief Governance Officer Yes 31/12/2026 Plans are underway to develop a Local Code of Corporate Governance for the Council. This will require some time to put in place. The aim is for this being ready for reference in the 2027 accounts. Page 116
Page 117
28 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 117
Page 118
29 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 118
Page 119
Report to: Audit and Scrutiny Committee Meeting Date: 25 March 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Procurement and Creditor Payments 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 19 November 2025 to 25 March 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report provides details of the internal audit review of procurement and creditor payments made under the direction of the Moray Integration Joint Board (MIJB); this project has been agreed for review within the Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 Included in the Audit Plan for 2025/26 is a project to review payments made to suppliers of goods and services processed through the Council’s Financial Management System (FMS). The purpose of the audit is to provide assurance over a key function of FMS in the Item 8. Page 119
Page 120
accurate payment and recording of expenditure. In addition, analysis and sample testing of invoices were undertaken to confirm compliance with Financial, Authorisation, Procurement and Creditor Payment Processing Regulations. 4.2 The audit reviewed a six-month period of payments made under the direction of the Moray Integration Joint Board (MIJB). It was noted that total expenditure to suppliers and providers of goods and services processed through FMS amounted to approximately £30 million. The review confirmed that payments were accurately recorded and processed in FMS. However, testing identified instances of non-compliance with Financial Regulations, Value Added Tax Regulations and a significant duplicate payment. The detailed findings and recommendations from this review are detailed within the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy Page 120
Page 121
☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 121
Page 122
APPENDIX 1 1 Final Internal Audit Report Procurement and Creditor Payments (Moray Integration Joint Board) January 2026 Distribution: Head of Service Health & Social Care (MIJB) Head of Service & Chief Social Work Officer Head of Education (Chief Education Officer) Team Manager Business Support Service Manager Finance Operations Social Work Service Manager Children & Families & Criminal Justice Social Work Interim Community Care Finance Manager Locality Manager West The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 2 Priority 2 1 Priority 3 2 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 122
Page 123
Appendix 1 2 Contents Page Procurement and Creditor Payments (MIJB) 1. Introduction & Scope 3 2. Key Issues 3-4 Detailed Report 3. Findings/Recommendations 5-15 4. Management Response 6-15 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 123
Page 124
Appendix 1 3 1. Introduction and Audit Scope The annual audit plan for 2025/26 includes coverage of the Council’s core systems. A review has been undertaken of payments made to suppliers of goods and services processed through the Council’s Financial Management System (FMS), but under the direction of the Moray Integration Joint Board (MIJB). The objectives of the audit review were not only to provide assurance over a key function of the FMS in the accurate processing and recording of expenditure, but also to test a sample of payments to confirm compliance with the Council’s Financial, Authorisation, Procurement, and Creditor Payment Processing Policies and Regulations. The findings from this review will be used to support the Service Manager Internal Audit and Risk in forming the annual opinion on the Moray Integration Joint Board’s internal control systems. The testing approach was developed using the Chartered Institute of Public Finance and Accountancy’s Control Matrices, in addition to consultation with the External Auditor. The audit reviewed a six-month period of non-payroll expenditure. During the sample period, total expenditure to suppliers of goods, works and services processed through the Financial Management System (FMS) was approximately £30 million. Data analytical software called IDEA was used to randomly select individual payments, stratified by financial value parameters, for testing. In addition, the audit analysed payments to identify any potential duplicate payments for further investigation. . The audit was carried out in accordance with Global Internal Audit Standards (GIAS). 2. Key Issues • The audit review confirmed that expenditure had been accurately recorded and processed through the Financial Management System (FMS). However, examples were noted where payments had been made in advance of services being delivered, without the required approval of the Council’s Chief Financial Officer. In addition, errors in the treatment of Value Added Tax (VAT) were noted, requiring recovery of the outstanding amount from His Majesty’s Revenue and Customs (HMRC). • The audit checked the sample period for potential duplicate payments. Using IDEA software, a report was generated to identify payments made to the same payee for identical amounts. It was noted that the majority of these related to recurring payments to social and educational care Page 124
Page 125
Appendix 1 4 providers. However, audit testing found a significant duplicate payment had been made to an educational care provider, for which recovery of the overpayment is now required. Further enquiries noted this had occurred due to an administrative error. Page 125
Page 126
5 Findings/Recommendations – Procurement and Creditor Payments (MIJB) Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 High Data analytical software called IDEA was used to review non-payroll expenditure made under the direction of the Moray Integration Joint Board (MIJB). This included the random selection of invoices for testing based on their financial value, as well as the identification of potential duplicate payments where the same amount was paid to the same individual, company, or organisation. Analysis of these potential duplicate payments found that the majority of identical payments made to the same payee related to recurring expenditure for the delivery of social and educational care. However, audit testing identified that a duplicate payment of £23,355 had been made in error to an educational care provider for the same service. Further investigation found this was the result of an administrative error, where a duplicate invoice had been processed incorrectly. In addition, the incorrect invoice number was recorded in the Financial Management System when processing the duplicate invoice, which resulted in the Officers responsible for administering the payment of invoices within Children and Families Services should be reminded of the correct procedures for processing and authorising payments and if required, further training should be provided. Action should be taken as soon as possible to recover the duplicate payment identified in this finding. Page 126
Page 127
6 transaction not being identified for further investigation. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Team Manager, Business Support Yes Implemented The duplicate payment has been recovered from the care provider and staff have been reminded of the importance of following the correct procedure when processing and authorising invoices for payment. Team Leader, Business Support will manage this going forward to ensure processes are adhered to for all future payments. Page 127
Page 128
7 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Medium The audit checked a random sample of payments to verify the correct accounting treatment for Value Added Tax (VAT). No discrepancies were found in the majority of invoices reviewed; however, two paid invoices that included VAT, with a cumulative value of £9,274, had not been reclaimed from His Majesty’s Revenue and Customs (HMRC). Further enquiries found that this was due to an administrative error where the expenditure had not been correctly allocated between the financial codes for the budget cost centre and VAT within the Financial Management System. The Payments Section has been advised to correct the VAT error identified in the finding. Further instruction, and training if required, should be provided to the administrative officers who processed the invoices detailed within the finding to ensure the future correct accounting treatment of VAT. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Assistant FMS & Banking Manager Yes 30/11/2025 This has been corrected and the monies reclaimed from HMRC. A reminder has been issued to the administrative officer involved to ensure that VAT is treated correctly in future. Page 128
Page 129
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Low The audit review noted cumulative payments totalling £30,000 to a charity in respect of grant match funding for a project supporting children and young people in Moray. Further investigation found this was part of a three‑year programme from 2022 to 2025. The importance of the funding objectives is recognised; however, payments had been made in advance of service delivery. While it is appreciated that there may have been operational requirements, Financial Regulations state, ‘expenditure shall not extend to making payments in advance of delivery of goods or services or completion of works or approved stages of works unless prior permission is obtained in writing from the Chief Financial Officer (CFO).’ Permission had not been obtained from the CFO. The nature of this expenditure is noted; however, in accordance with Financial Regulations, authorisation from the Council’s Chief Financial Officer is required if a payment is to be made in advance of the services being delivered. Page 129
Page 130
9 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Social Work Service Manager, Children & Families & Criminal Justice Social Work Head of Education (Chief Education Officer) Yes Implemented Prior written approval will be sought from the Chief Financial Officer for any future purchases which require payment in advance. Page 130
Page 131
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Low The review found during audit testing that some invoices from care providers and organisations contained personal and sensitive information about individuals receiving services, including names, dates of birth and home addresses. Data Protection Legislation requires organisations to ensure proportionality in the personal information they hold about individuals. Invoices should therefore include only the personal details necessary for legal, tax, or business purposes. Audit concerns regarding personal and sensitive information detailed on invoices received from some care providers and organisations have been raised with the Head of Service. It is acknowledged that invoices must clearly describe the services being procured. However, consideration should be given to contacting care providers and organisations to agree on greater use of unique reference numbers, thereby reducing the need to include personal and sensitive information about individuals on invoices. Page 131
Page 132
11 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Interim Community Care Finance Manager Yes 05/12/2025 All care providers and organisations will be notified that only CareFirst numbers are to be used on invoices as opposed to client names and personal information and that if they do not have the CareFirst number it will be provided on request. Page 132
Page 133
12 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 High A random sample of payments, based on financial value, was reviewed to ensure compliance with Financial Regulations and to confirm that expenditure had been correctly authorised and allocated to the appropriate financial code within the Financial Management System. The sample included a payment to a Care Provider in February 2025 and the audit confirmed that the expenditure had been correctly authorised and coded. The payment related to an out-of-area placement at a Care Facility and had been made gross of any financial deductions for personal care contributions. This is in accordance with agreed procedures; however, the individual had already been in the Care Facility for approximately 12 months. Further enquiries with officers noted that difficulties had been experienced in obtaining the required financial information from the individual to enable the determination of their personal financial contribution. Once the financial assessment has been completed, any personal financial contributions for an individual are recovered from future payments made to Authorisation of expenditure must be in compliance with the Council’s Financial Regulations. Recovery action should also be undertaken in the recovery of the personal financial contribution from the individual detailed within this finding. Page 133
Page 134
13 the Care Provider. The Care Provider will then recover this deduction from the individual at the Facility. In February 2025, the Community Care Finance Service completed the financial assessment for the individual and calculated a total cumulative contribution of £15,817 from the date of their entry into the Care Facility. In accordance with agreed arrangements, this amount was deducted from the total payment made to the Care Provider in February 2025. However, the Care Provider disputed this arrangement and the Interim Community Care Finance Officer/Support Manager, in consultation with the Team Manager- Community Care agreed to refund the total value of the personal contribution, in addition to the personal contributions due from the individual up to June 2025. An amount of £20,517 was repaid to the Care Provider in June 2025. The Team Manager was aware that this had been agreed and actioned through Community Care Finance and highlighted it to the Locality Manager, West. It is understood that officers have been in discussion with the individual at the Care Facility to agree arrangements for the payment Page 134
Page 135
14 of their personal financial contribution toward their care. It is appreciated that officers face significant challenges when supporting individuals with complex care needs. However, the Council’s Financial Regulations state that “where the need for expenditure for which there is no budgetary provision arises from emergency situations, the Head of Service should consult with the Chief Financial Officer”. As the payment was made to refund the Care Provider for the personal financial contribution due from an individual, consideration should have been given to seeking the Head of Service's approval to authorise the expenditure. For information, an audit review undertaken earlier this year of out-of-area placements for individuals with care requirements highlighted a need for administrative improvements. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Locality Manager, West Yes 31/03/2026 Any financial authorisation must comply with financial regulations and approval sought from the Head of Service and Chief Page 135
Page 136
15 Financial Officer ensuring governance and financial regulations are adhered to. This is monitored through resource allocation where any financial package over a set amount is deferred to the High Cost Panel. Team Managers are required to follow due process however where this deviates from normal operating standards referral should be made in the first instance to the appropriate line manager. A process is underway to recover the debt and Social Work are working through this. Health and Social Care Moray will revise the process for such authorisations which may result in utilising the High Cost Panel. This will ensure that authorisation is provided at the correct level within the organisation for all future payments. Page 136
Page 137
16 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 137
Page 138
17 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk (CAE). Page 138
Page 139
Report to: Audit and Scrutiny Committee Meeting Date: 25 March 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Review – Counter Fraud Review 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The report advises Committee on an internal audit review completed for the period from 19 November 2025 to 25 March 2026. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. SUMMARY 2.1 This report sets out the findings from the annual internal audit review of the Council’s counter-fraud framework, designed to minimise the risk and impact of fraud arising from internal and external threats; this project has been agreed for review within the Internal Audit Plan for 2025/26. 3. RECOMMENDATIONS 3.1 It is recommended that Committee considers the contents of this report, seeks clarification on any points noted and endorses the recommendations contained within the report. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 An audit was undertaken to review the Council’s counter-fraud framework. While the prevention and detection of fraud and error rests with management, the Internal Audit Item 9. Page 139
Page 140
Section plays a significant role in reviewing systems and procedures to support an effective control environment. The audit programme for this review was developed from the Chartered Institute of Public Finance and Accountancy (CIPFA) Code of Practice on Managing the Risk of Fraud and Corruption. This CIPFA Code is a recognised best-practice framework for public sector bodies. It sets out principles for strong governance, accountability and effective counter-fraud strategies. This review also includes a check of systems and procedures identified as having a higher risk of fraud, with the scope of testing informed by fraud cases reported by other public sector bodies and highlighted by regulatory authorities such as Audit Scotland in their Technical Bulletins. 4.2 Within the scope of the review, it is considered that the Council has an appropriate and proportionate approach to managing fraud risk and has key controls in place, such as policies and procedures, including the Policy to Combat Fraud, Theft, Bribery and Corruption and the Whistleblowing (Confidential Reporting) Policy. However, areas for further development and administrative improvements were noted in the Council’s counter-fraud governance arrangements. The detailed findings and recommendations from this review are provided in the audit report in Appendix 1. 5. PROPOSALS 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. Page 140
Page 141
☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 141
Page 142
APPENDIX 1 1 Final Internal Audit Report Counter Fraud Review January 2026 Distribution: Chief Financial Officer Chief Governance Officer Service Manager Organisational Development & Change Service Manager Strategic Planning & Development Service Manager Finance Operations Service Manager Internal Audit & Risk The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low (detailed explanation provided in Appendix1). The audit recommendations for this review have been classified as follows Assurance Level Risk Ratings for Recommendations Substantial Priority 1 0 Priority 2 3 Priority 3 4 Confidentiality and Disclosure Clause This report (“Report”) was prepared by the Internal Audit Section of Moray Council. The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is as accurate as possible, the Moray Council Internal Audit Section has only been able to base findings on the information and documentation provided and consequently, no complete guarantee can be given that this Report is necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. This Report was prepared solely for the use and benefit of the Moray Council, Moray Integration Joint Board or the Grampian Valuation Joint Board. Moray Council's Internal Audit Section accepts no responsibility and disclaims all liability to any third party who purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in Appendix 2 of this report for further information about responsibilities, limitations and confidentiality. Page 142
Page 143
Appendix 1 2 Contents Page Counter Fraud Review 1. Introduction & Scope 3 2. Key Issues 4-5 Detailed Report 3. Findings/Recommendations 6-17 4. Management Response 7-17 Appendices 1. Audit Terms of Reference and Definitions 2. Statement of Responsibility Page 143
Page 144
Appendix 1 3 1. Introduction and Audit Scope The annual audit plan for 2025/26 includes a review of the Council’s counter-fraud framework, with the objective of minimising the risk and impact of fraud from internal and external threats. While the prevention of fraud and error rests with management through the design and operation of suitable systems of control, this review aims to support the Council’s counter-fraud framework by identifying any further improvements to reduce the occurrence of fraud and related risks. The Chartered Institute of Public Finance and Accountancy (CIPFA) defines fraud as “the intentional distortion of financial statements or other records by persons internal or external to the organisation, carried out to conceal the misappropriation of assets or otherwise for gain.” The Council has a responsibility to embed a robust framework for countering fraud, demonstrating strong public financial management and sound governance. Minimising losses from fraud and corruption is essential to ensuring that public funds are used for their intended purpose: providing essential services. The Council has a Policy to Combat Fraud, Theft, Bribery and Corruption, alongside other associated policies and guidance, including a Whistleblowing (Confidential Reporting) Policy and a Code of Conduct. These policies are built around a counter-fraud culture supported by practices designed to deter and detect fraudulent and corrupt activities. They also take account of the Council’s statutory obligations, particularly the provisions of the Bribery Act 2010. The scope of the audit covered governance arrangements, fraud risk assessments, staff awareness and internal controls designed to reduce fraud risks. It also assessed reporting and investigation procedures, as well as collaboration with external bodies. The audit testing programme was developed in accordance with the CIPFA Code of Practice on Managing the Risk of Fraud and Corruption, which sets out five key principles for ensuring a comprehensive and effective counter-fraud approach: • Acknowledge responsibility for countering fraud and corruption • Identify fraud and corruption risks • Develop an appropriate counter fraud strategy • Provide resources to implement the strategy • Take action in response to fraud and corruption . The audit was carried out in accordance with the Global Internal Audit Standards (GIAS). Page 144
Page 145
Appendix 1 4 2. Key Issues The audit review considers that the Council has generally an appropriate and proportionate approach to managing fraud risk, with key controls in place, including anti-fraud and corruption policies, segregation of duties in financial processes, and robust internal controls supported by prompt investigation and reporting procedures for suspected fraud. This review includes a check of systems and procedures identified as having a higher risk of fraud, with the scope of testing informed by fraud cases reported by other public sector bodies and highlighted by regulatory authorities such as Audit Scotland in their Technical Bulletins. However, areas for further development and administrative improvements within the Council’s counter-fraud strategy include: : • Training- It is pleasing to note the requirement for officers to complete the online training module designed to protect the Council from cyber- attack threats, such as ransomware, phishing and data breaches. While cyber-security remains a critical area of concern, reviews of reported frauds within the public sector indicate that significant risks often originate from financial processes. These risks include unauthorised transactions, manipulation of financial records and exploitation of weaknesses in procurement and payment systems. Consideration should be given to providing additional training to support officers who are responsible for procurement and financial processing, to help them identify potential financial risks such as false invoicing, supplier fraud and attempted manipulation of routine payment processes. • National Fraud Initiative (NFI)- The Council participates in the National Fraud Initiative (NFI), a UK-wide data-matching exercise coordinated by the Cabinet Office and administered in Scotland by Audit Scotland, to help detect and prevent fraud in the public sector. The NFI uses data- matching techniques to identify anomalies and potential fraud in areas such as housing benefits, payroll, council tax, and procurement. The Council has adopted a structured, risk-based approach for the review of matches. This process has now been further enhanced through the introduction of quality checks on the outcomes of match investigations undertaken by services by the Internal Audit Section. • Fraud/ Irregularities- Investigations into suspected fraud or irregularities involving Council officers are undertaken by Internal Audit, but may also be carried out by other services, including Human Resources and Information Governance. Financial Regulations require that any suspected irregularity involving finances, property, services, policy, or Council functions must be reported promptly to Internal Audit. While Human Resources and Information Governance inform the Page 145
Page 146
Appendix 1 5 Internal Audit Section's investigations, this is not a formalised arrangement. A structured process should be established to ensure timely notification, enabling Internal Audit to review the irregularity and determine whether a systems audit is required to improve the control environment. Page 146
Page 147
6 Findings/Recommendations - Counter Fraud Review 2025/26 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 1 Medium The Council’s fraud strategy is outlined in its Policy to Combat Fraud, Theft, Bribery and Corruption. Management is responsible for preventing and detecting fraud through effective controls, with Internal Audit providing support. Internal Audit’s approach includes an annual counter-fraud review of systems and procedures to reduce fraud risks, as well as participation in external initiatives such as the National Fraud Initiative for data matching. The scope of this annual counter-fraud review is determined from various sources, including summaries of fraud cases and other irregularities reported in Audit Scotland’s Technical Bulletins, as well as information gathered through participation in the Scottish Local Authority Investigators’ Group. A review of the guidance to organisations on the offence of failure to prevent fraud under the Economic Crime and Corporate Transparency Act 2023 noted that the Council has, in accordance with good practice, adopted a Internal Audit’s approach to supporting management in implementing effective counter-fraud arrangements should also be separately identified as part of the Internal Audit Strategy within the Annual Audit Plan. Page 147
Page 148
7 strategic approach to fraud prevention and detection. However, it is also considered that this fraud strategy should be documented as part of the Council’s annual audit planning approach. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Internal Audit and Risk Yes 25/03/2026 The Annual Audit Plan will be amended to include a reference to Internal Audit’s Strategy for supporting the Council’s counter-fraud arrangements. Page 148
Page 149
8 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 2 Low The Elgin Neighbourhood Board was awarded £20 million as part of the UK Government’s Long-Term Plan for towns in October 2023 to support a range of community-led regeneration projects. Moray Council is the Accountable Body for the neighbourhood board funding, with responsibility for ensuring that public funds are distributed fairly and managed in accordance with public-sector financial regulations. Additionally, the UK Government requires a fraud risk assessment of the governance arrangements for the funding awarded. The Strategic Planning Development Manager contacted the Internal Audit Section to assist in developing a template for conducting the fraud risk assessment. This template has been completed; however, the assessment will be an ongoing annual requirement. The Elgin Neighbourhood Board is currently in the planning and engagement phase, focused on finalising and refining its regeneration strategy before moving into implementation. A review was undertaken of the Board’s governance documentation in relation to the An annual fraud risk assessment of Elgin Neighbourhood Board activities and governance should be undertaken. If required, the Internal Audit Section should be contacted for assistance with the process Consideration should be given to including additional reference within the Elgin Neighbourhood Board Terms of Reference of the need to inform the Service Manager Internal Audit and Risk Page 149
Page 150
9 prevention and detection of fraud. It is pleasing to note that Board Members are required to uphold the Nolan Principles of Public Life. However, to enhance clarity of responsibility and strengthen the assurance framework, consideration should be given to including a requirement for the Service Manager Internal Audit and Risk, to be informed of any matters involving, or suspected to involve, irregularities or fraud. of any matter involving or is thought to involve fraud or any suspected irregularity. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Senior Project Officer (Elgin Neighbourhood Board) Yes 31/03/2026 Include duty within updated Terms of Reference to inform the Elgin Neighbourhood Board Project Manager of any matter involving or is thought to involve fraud or any suspected irregularity, who will inform the Service Manager Internal Audit and Risk. This duty will also be included within grant awards signed with all project leads. Page 150
Page 151
10 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 3 Medium Investigations of suspected irregularities by Council officers can be undertaken by the Internal Audit Section as well as by other services, including Human Resources and Information Governance Services. Financial Regulations state, “Any matter which involves, or is thought to involve, irregularities concerning finances, property, services, or policy of the Council, or any suspected irregularity in the exercise of the functions of the Council, must be reported as soon as possible by any Officer having knowledge thereof to Internal Audit.” It is pleasing to note that both Human Resources and Information Governance Services do inform the Internal Audit Section of investigations; however, this is not a formalised arrangement. A structured approach should be agreed to ensure timely notification of investigations, allowing Internal Audit to undertake an overview of the irregularity and determine whether a review of systems or Human Resources and Information Governance Services should include within their operating procedures a requirement to notify the Internal Audit Section of any investigations undertaken into suspected irregularities by Council officers. Page 151
Page 152
11 procedures is required to strengthen current governance and control arrangements. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Information Governance Manager and Data Protection Officer Acting Senior HR Advisor Yes Yes 30/06/2026 Implemented The Guidance on Data Security Breach Management will be updated to require informing the Internal Audit Section of any suspected irregularities by Council officers. Human Resource procedures have been amended to ensure that advisors dealing with relevant cases notify Internal Audit of suspected irregularities and case tracking records updated to include this action. Page 152
Page 153
12 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 4 Low It is pleasing to note that the Payments Section maintains a Register of Interests within the Service. A Register of Interests is a formal record of officers’ personal, financial, or family connections that could, or appear to, influence their impartiality in processing payments or dealing with suppliers or contractors. This allows management to implement appropriate controls to protect the officer and reduce the risk of fraud. Maintaining such a register is considered good practice as it promotes transparency and integrity in payment processes. However, a review of the Register of Interests found that recent changes in officer appointments and responsibilities had not been updated. The requirement for a Register of Interests within the Payments Section is considered good practice; however, it should be kept up to date to reflect any changes in officers’ responsibilities or appointments. Page 153
Page 154
13 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Finance Operations Yes Implemented The register of interests has been updated for all staffing changes and as well as updated with any existing staff interests. Page 154
Page 155
14 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 5 Medium A review of fraud cases reported by Audit Scotland, the Chartered Institute of Public Finance and Accountancy (CIPFA) and other regulatory bodies has noted that significant fraud occurs within services responsible for procurement, processing and administration of payment systems. Good practice in fraud prevention for procurement and payment activities highlights the need for regular training to ensure officers are reminded of regulations and policies and remain alert to emerging threats such as false invoicing, supplier fraud and manipulation of payment procedures. While fraud-awareness training is undertaken within the Payments Section, it is not formalised or integrated into the Council’s structured annual training framework. Discussions have been held with Service Managers from the Payments Section and Organisational Development & Change to explore opportunities to strengthen the current training programme. Consideration should be given to introducing annual fraud-awareness training for officers responsible for procurement and invoice processing. This should include officers in the Payments Section and within services. Enhancing staff awareness and understanding will strengthen internal controls, reduce exposure to fraud, and support compliance with best-practice standards. Page 155
Page 156
15 Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Organisational Development and Change/ Service Manager Finance Operations Yes 31/10/2026 The Service Managers will work collaboratively to identify a list of job roles that require training and agree the most appropriate training intervention to be incorporated into the corporate training offering on an annual basis going forward. Page 156
Page 157
16 Ref Risk Ratings for Recommendations Audit Finding Audit Recommendation 6 Low As part of its counter-fraud strategy, Moray Council participates in the biennial National Fraud Initiative (NFI). The NFI is a UK-wide counter-fraud exercise, coordinated by the Cabinet Office and administered in Scotland by Audit Scotland. It uses computerised data- matching techniques to compare information about individuals held by different public bodies and across different financial systems, identifying matches that may indicate potential fraud or error. The 2024/25 NFI exercise is currently in progress. The agreed approach is for services to review and document the reasons for data matches, while the Internal Audit Section investigates potential fraud, monitors progress and reports on the outcomes. Previous exercises have not identified instances of fraud; however, participation in the NFI exercise has provided two main benefits: it confirms that fraud-prevention controls are operating effectively and offers an opportunity to cleanse and improve the accuracy of data held in Council systems. It is considered that further The Internal Audit Section should undertake sample testing of NFI investigations carried out by services to verify the accuracy and completeness of the work undertaken. Page 157
Page 158
17 improvements to the current approach should be made, with the Internal Audit Section undertaking testing of a sample of investigations carried out by services to verify the accuracy and completeness of the work undertaken. This will strengthen assurance that NFI investigations are accurate, complete, and conducted in accordance with required processes. Management Response Responsible Officer Accepted (Yes/ No) Timescale for Implementation (Date Required) Agreed Management Action/Management Comment Service Manager Internal Audit and Risk Yes Implemented An Internal Auditor has been assigned responsibility for undertaking sample testing of NFI data-matching investigations completed by services as part of additional quality assurance procedures. Page 158
Page 159
18 Appendix 1 AUDIT TERMS OF REFERENCE AND DEFINITIONS 1. Audit Objectives 1.1 The overall audit objective is to provide an objective independent opinion on the adequacy and effectiveness of controls / processes. 1.2 The audit will for each controls / process being considered: • Walkthrough the processes to consider the key controls; • Conduct sample testing of the identified key controls, and • Report on these accordingly 1.3 All audit reviews are carried out in accordance with Global Internal Audit Standards (GIAS). 2. Definitions for Auditing Opinions and Findings 2.1 In order to assist management in using our reports: The Internal Auditor will categorise audit assurance opinion according to their overall assessment of the risk management system, effectiveness of the controls in place and the level of compliance with these controls and the action being taken to remedy significant findings or weaknesses. Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Substantial There is evidence that the level of non compliance with some of the controls may put some of the system objectives at risk. Limited The level of non compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. 2.2 Risk ratings for each recommendation is based on the following criteria: High Fundamental control weaknesses that require immediate attention by management to action and mitigate significant exposure to risk Medium Less critically important controls absent, not being operated as designed or could be improved Low Lower level controls absent, not being operated as designed or could be improved. Page 159
Page 160
19 Appendix 2 STATEMENT OF RESPONSIBILITY The responsibility for designing and maintaining a sound system of internal control to prevent and detect fraud and other irregularities rests with management, with internal audit providing a service to management to support them to achieve this objective. The Internal Audit Section will assess the adequacy and effectiveness of the system of internal control arrangements implemented by management and perform sample testing on those controls in the period under review with a view to providing an opinion on the extent to which risks in this area are managed. The Internal Audit Section will undertake testing with the objective of detecting significant control weaknesses. However, the audit approach alone should not be relied upon to identify all strengths and weaknesses in internal controls nor to find any fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. The matters raised in this report are only those that came to our attention during the course of the audit review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by management for their full impact before they are implemented. The performance of the audit review undertaken should not be taken as a substitute for management’s responsibilities for the application of sound management practices. This report must not be disclosed to any third party or reproduced in whole or in part without the written consent of the Moray Council’s Service Manager Internal Audit and Risk. Page 160
Page 161
Report to: Audit and Scrutiny Committee Meeting Date: 25 March 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Internal Audit Plan 2026/27 1. PURPOSE ☒ For Decision ☐ For Information 1.1 This report provides the Committee with details of the planned internal audit coverage for the year ending 31 March 2027. 1.2 This report is submitted to Committee in terms of Section III (I) (7) of the Council’s Scheme of Administration relating to reporting on internal audit’s programme of work. 2. SUMMARY 2.1 The Global Internal Audit Standards (GIAS) applicable to local government in Scotland requires the Service Manager Internal Audit and Risk to report functionally to the Audit and Scrutiny Committee on various matters relating to audit strategy and planning. This requirement includes preparing a risk-based Internal Audit Plan for submission to the Committee and providing details of internal audit resourcing and any issues that may impact the scope of audit work. 3. RECOMMENDATIONS 3.1 It is recommended that Committee agree the proposed internal audit coverage for the 2026/27 financial year as detailed in the Internal Audit Plan for 2026/27 ( Appendix 1), seeking clarification on any matters arising from the report or proposed Audit Plan. Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation Item 10. Page 161
Page 162
accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 4.2 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Internal Audit’s approach to annual audit planning is risk-based, with all areas which may be subject to audit review contained within an ‘audit universe’. The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. 4.3 The Internal Audit Plan details what Internal Audit anticipates being able to review in the year, assuming stability in resources available to the Section. The time allocation for all audits assumes that systems to be reviewed are adequately documented, detailing the controls put in place by management and that testing identifies that these controls are being complied with; however, if this is not the case, there will be an impact on the time taken to review planned areas and on the Plan’s achievability. 4.4 The proposed Internal Audit Plan for 2026/27 is attached in Appendix 1. The Plan includes projects within the Council as well as the Internal Audit Section’s requirements for delivering internal audit services to the Moray Integration Joint Board and the Grampian Valuation Joint Board. The Plan includes reviews of core systems that will support the Service Manager Internal Audit and Risk in providing an opinion on the adequacy and effectiveness of the Council’s internal control system for the year ending 31 March 2027, as required for the Annual Governance Statement. Allocation of days has also been included for undertaking a gap analysis to identify areas for further development in achieving compliance with the Global Internal Audit Standards (GIAS). 5. PROPOSALS 5.1 This report invites the Committee to consider and note the planned internal audit coverage for 2026/27. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × Page 162
Page 163
6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital No implications directly arising from this report. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. 7. CONSULTATION 7.1 There have been no direct consultations during the preparation of this report. Page 163
Page 164
8. BACKGROUND PAPERS 8.1 None Page 164
Page 165
APPENDIX 1 MORAY COUNCIL INTERNAL AUDIT STRATEGY AND PLAN 2026/27 Page 165
Page 166
2 1.1 Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve Council operations. It helps the Council accomplish its objectives by applying a systematic, disciplined approach to evaluate and enhance the effectiveness of risk management, control, and governance processes. The purpose of this strategy is to outline the direction and focus of the Internal Audit Service, ensuring alignment with the Council’s strategy and conformance with the Global Internal Audit Standards in the UK public sector. The strategic objectives of the Internal Audit Service are: • To strengthen the Council’s ability to create, protect, and sustain value by providing independent, risk-based, and objective assurance, advice, insight, and foresight. • Fulfilment of the internal audit mandate (contained within the Internal Audit Charter). • Be recognised as a leading provider of audit and investigative services, based on achieving a high standard of professionalism and expertise in service delivery. • Deliver audit services in accordance with the Global Internal Audit Standards, subject to the interpretations and additional requirements set out in the Application Note of the Standards in the UK Public Sector. • Deliver a plan of assurance audit engagements, which are sufficient to enable the Service Manager Internal Audit and Risk (Chief Audit Executive (CAE)) to provide an annual opinion on the Council’s control environment. • Deliver value by aligning the Audit Plan to the Council’s strategies, objectives and risks, and through delivering robust audit assurance and support. • Develop and maintain a strong knowledge, skills and expertise within the Audit Team. 1.2 The Council’s fraud strategy is embedded within its Policy to Combat Fraud, Theft, Bribery, and Corruption. While the prevention and detection of fraud and error rests with management through the design and operation of effective control systems, the Internal Audit Section supports management in fulfilling this responsibility. Key elements of the internal audit strategy include undertaking an annual counter-fraud review of the Council’s systems and procedures to minimise the risk and impact of fraud from both internal and external threats, as well as supporting external initiatives such as Audit Scotland’s National Fraud Initiative for data matching. In addition, the Service Manager Internal Audit and Risk (CAE), in accordance with the Policy to Combat Fraud, Theft, Bribery, and Corruption, will support management with investigations into any allegations of fraud, depending on the circumstances of each case. An Internal Audit Strategy is a plan that outlines how the internal audit function will support an organisation's strategic objectives, guided by the principles of the Global Internal Audit Standards (GIAS) issued by the Institute of Internal Auditors. Internal Audit will support and promote improvements in governance, risk management and control, underpinned by the Internal Audit Charter, which sets out the mandate, purpose, authority and responsibilities of the Internal Audit Service. The strategy also guides Internal Audit in developing staff, integrating new technology into the audit process, and continually improving the internal audit function. . 1. Internal Audit Strategy Page 166
Page 167
3 2.1 The Global Internal Audit Standards (GIAS), along with the Application Note: Global Internal Audit Standards in the UK Public Sector, requires the Service Manager Internal Audit and Risk (CAE) to report functionally to the Audit and Scrutiny Committee on various matters relating to audit planning. This includes preparing a risk-based internal audit plan for submission to the Committee and providing details of internal audit resourcing or any other issues that may affect the scope of audit work. 2.2 Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It also helps the organisation achieve its objectives by applying a systematic, disciplined approach to evaluating and enhancing the effectiveness of risk management, control, and governance processes. 2.3 GIAS sets out the requirement for the: ▪ Service Manager Internal Audit and Risk (CAE) to prepare a risk-based audit plan which considers the Council’s strategic objectives, associated risks and the views of senior management and the Committee. ▪ Service Manager Internal Audit and Risk (CAE) to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities. ▪ Internal Audit Plan to incorporate or be linked to a strategic or high-level statement of how Internal Audit will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities. 2.4 The diagram on the next page sets out the various sources of information used to inform the audit universe of potential projects for review. The Internal Audit Plan outlines the audit coverage that the Internal Audit Section intends to deliver during the 2026–27 financial year. The delivery of an internal audit programme that provides sufficient and appropriate coverage will support a well-informed and comprehensive year-end internal audit opinion. 1. Internal Audit Strategy Page 167
Page 168
4 2.5 Internal Audit adopts a risk-based approach to annual audit planning. The areas identified for potential review are captured within an ‘audit universe,’ which serves as a comprehensive framework for audit coverage. This audit universe is continuously reviewed and updated to ensure it reflects all significant activities, systems, and processes that support the achievement of the Council’s priorities and objectives . 2.6 Each year, the audit universe undergoes a comprehensive risk assessment to inform the development of the Annual Internal Audit Plan. This process ensures that audit time and resources are allocated appropriately, with priority given to areas presenting the most significant risks to the Council’s objectives . An audit universe is the collective grouping of auditable ’components’ – sometimes also called auditable areas, units or entities – that support the development of the internal audit plan and help to identify appropriate internal audit coverage that the Audit and Risk Manager can then prioritise. 2. Internal Audit Plan: Approach The Audit Universe Consultation External Research Corporate Plan & Risk Register Professional Guidance & Publications Internal Audit Knowledge A documented, risk-based audit universe has been developed to ensure that sufficient and appropriate areas are identified for consideration and review. . 2. Internal Audit Plan: Approach Page 168
Page 169
5 2.7 The audit universe risk assessment is based upon a number of factors including: • materiality (based on expenditure or income) • sensitivity (based on whether a service is a statutory duty, statutory power or non- statutory, is customer facing and whether it features as a specific challenge in the Council’s Service Plans) • time elapsed since an area was last subject to review • Corporate Risk Register- assessment of any movement in the principal risks facing the Council • overall audit assessment of the control environment 2.8 In developing the Internal Audit Plan for 2026/27, consideration has been given to service demands to ensure proportionate audit coverage across all Council functions. While the audit universe remains a key factor in determining priorities, it is not the sole consideration. Senior management has been consulted to identify priority areas for review, and further engagement has taken place with members of the Audit and Scrutiny Committee and the Council Leader to ensure the plan reflects strategic objectives and governance expectations. 2.9 These various sources of information enable the Service Manager Internal Audit and Risk (CAE) to meet the requirement of providing an annual internal audit opinion on the adequacy and effectiveness of the Council’s systems of internal control. This opinion is included in the Annual Governance Statement, which accompanies the Council’s annual financial statements. In addition, a review of internal audit plans from other local authorities is undertaken based on their publicly available committee reports. This benchmarking exercise provides valuable insight into issues faced by other councils and helps identify potential auditable areas relevant to Moray Council. . 2.10 The Global Internal Audit Standards encourage internal audit services to consider whether assurance can be placed on the work of other bodies. This is an ongoing process led by the Service Manager Internal Audit and Risk (CAE), involving consultation with services to identify opportunities where reliance could be placed on certifications or reviews conducted by external organisations. Such an approach helps avoid duplication of review activity within services and promotes a more efficient use of internal audit resources. 2. Internal Audit Plan: Approach Page 169
Page 170
6 While the roles of internal and external audit remain separate and distinct, Internal Audit maintains a close working relationship with the External Auditor. This collaboration is designed to secure an optimum combined benefit from the overall audit resource and minimise duplication wherever possible. 2.11 An additional element of the planning process takes place for the Moray Integration Joint Board (MIJB); the Council’s Service Manager Internal Audit and Risk (CAE) is also the MIJB’s Chief Internal Auditor. A separate Internal Audit Plan is prepared for the MIJB and is reported to their Audit, Performance and Risk Committee. The established working protocol is that audit reviews of interest to the MIJB are reported to the Council’s Audit and Scrutiny Committee before the Audit, Performance and Risk Committee. However, depending on dates on future committees, the Service Manager Internal Audit and Risk (CAE) will consider some flexibility in this reporting arrangement to ensure that the requirement of meeting the functions of both Committees can be achieved. 2.12 The audit role for the MIJB includes providing assurance that governance and financial arrangements are properly developed and operating in accordance with approved policies, and that selected systems and processes are suitably controlled. Audit testing in previous years has identified significant findings, requiring follow-up reviews to confirm the implementation of agreed recommendations. These follow-up activities have represented a considerable time commitment for the Internal Audit Section, and it is anticipated that this requirement will continue into 2026/27. . 2.13 In addition, the Council’s Internal Audit Service undertakes internal audit work for the Grampian Valuation Joint Board. This includes providing annual assurance on the main financial systems used for payroll, payments and income derived from funding requisitions from constituent authorities and other sources. While the Joint Board’s systems are aligned with those of the Council, they require separate annual review and testing to provide assurance for the Board’s own financial statements, which must be prepared and published independently. 2.14 The Internal Audit Service is also the appointed lead auditor for the Moray Growth Deal, but each partner organisation is separately responsible for allocating internal audit resources for their own growth deal activities. There is a requirement by the Scottish Government for a biannual internal audit review to be undertaken of Moray Growth Deal governance and administrative arrangements. The audit of the core financial systems will appear in the audit plan every year in some form. This work aims to provide significant assurance to the Chief Financial Officer and wider senior management team of the integrity and robustness of the control framework of the systems that handle large numbers of transactions and account for all the authority’s income and expenditure. The core financial systems typically includer: • accounts payable / purchase to pay • accounts receivable / income • payroll (employee admin / organisational management) • housing rents • council tax • Non-Domestic Rates • Treasury management • Insurance The auditing of accounts payable and payroll expenditure may be undertaken annually to support the Audit and Risk Manager’s annual assessment of the robustness of the Council’s internal control system. The review of the above core financial systems will be undertaken over a 5 year audit planning. period Internal Audit Plan: Approach Internal Audit will annually assess the adequacy of the arrangements to prevent and detect irregularities, fraud and corruption. This will be done by considering projects for the Audit Plan of subject areas that are regarded as high risk. In addition, an allocation of time will be included annually within the Audit Plan to review systems and practices where fraud or irregularities have been noted within other organisations. However, the primary responsibility for preventing and detecting corruption, fraud and irregularities rests with management who should institute adequate systems of internal control, including clear objectives, segregation of duties and proper authorisation procedures. 2. Internal Audit Plan: Approach Page 170
Page 171
7 Conformance with Global Internal Audit Standards 2.15 The Local Authority Accounts (Scotland) Regulations 2014 paragraph 7 requires that ‘a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing’. 2.16 The recognised standards adopted by all Scottish Councils are the Global Internal Audit Standards (GIAS) developed by standard setters, including the Chartered Institute of Public Finance and Accountancy and the Chartered Institute of Internal Auditors. The GIAS, in their applicability to the public sector, must be considered along with the Application Note: Global Internal Audit Standards in the UK Public Sector, which has been produced to assist with interpretation. 2.17 The Global Internal Audit Standards have introduced a requirement for “topical requirements” in the preparation of the Internal Audit Plan. Topical requirements are critical risk areas for which the Standards provide guidance to ensure a minimum baseline and consistent, comprehensive criteria for assessing the design and implementation of governance, risk management and control processes. The UK Public Sector Internal Audit Standards Application Note states that, while these topical requirements form a core part of the Global Internal Audit Standards, they are considered advisory for internal audit functions in local government. This means a council is not automatically required to audit every topic, but it must consider them during the risk assessment process. Detailed below are the current topical requirement areas issued by the Institute of Internal Auditors for consideration within the Internal Audit Plan, along with proposed actions for addressing these risk areas. Topical Requirement Description Proposed Audit Coverage Cyber Security This Topical Requirement provides a consistent, comprehensive approach to assessing the design and implementation of cybersecurity governance, risk management, and control processes. Included within the 2026/27 Internal Audit Plan The delivery of the Internal Audit Service should be fully aligned with the Global Internal Audit Standards, ensuring that all audit activities are carried out in accordance with internationally recognised principles and best practices. This alignment reinforces the integrity, consistency, and quality of the audit process across all areas of operation Internal auditors must apply topical requirements (TR) in conformance with the Global Internal Audit Standards. The purpose of TRs is to provide a benchmark on what good looks like when performing internal audit engagements over common high-risk areas of an organisation. 2. Internal Audit Plan: Approach The delivery of the Internal Audit Service should comply with the requirements of the Global Internal Audit Standards. . Internal auditors must apply topical requirements (TR) in conformance with the Global Internal Audit Standards. The purpose of TRs is to provide a benchmark on what good looks like when performing internal audit engagements over common high-risk areas of an organisation. Page 171
Page 172
8 3.1 The Annual Internal Audit Plan outlines what Internal Audit Service anticipates reviewing during the year, assuming stability in the resources available to the Section. The time allocation for all audits assumes that the systems under review are adequately documented, detailing the controls put in place by management, and that testing confirms the consistent application of these controls. If this is not the case, it will affect the time required to review planned areas and may impact the plan’s overall achievability. 3.2 The Audit Plan also allocates time to support services to strengthen their internal controls and improve compliance. This reflects Internal Audit’s continued development of a more proactive, value-added approach that complements traditional compliance-focused audit work. However, this must be balanced with the need to provide sufficient audit coverage to support an evidence-based annual opinion on the adequacy and effectiveness of the Council’s internal control systems. Throughout the duration of the Plan, Internal Audit will continue to review the Council’s Corporate Risk Register and update its own risk assessments based on audit findings, ensuring that emerging risks are appropriately addressed. 3.3 Whilst undertaking planned work, Internal Audit may identify governance issues that are outside the stated scope of the review. GIAS requires that Internal Audit report such instances to those charged with governance. In this respect, Internal Audit reports may contain issues that appear to be “outwith" scope. Where at one time, five-year audit plans Topical Requirement Description Proposed Audit Coverage Third-Party The term “third party” refers to vendors, suppliers, contractors, subcontractors, outsourced service providers, other agencies and consultants. This topical requirement intends to provide a consistent, comprehensive approach to assessing the design and implementation of third-party governance, risk management and control processes Has been included in the 2026/27 Internal Audit Plan as a strategic procurement review, supporting the ongoing continuous auditing of creditor payments. Organisational Resilience Organisational resilience refers to an organisation’s capacity to withstand and adapt to change, especially during times of disruption This topical requirement is still at consultation stage and will be considered for review within the 2027/28 Internal Audit Plan. The Internal Audit Plan details a list of projects the Internal Audit Service will review to provide members and management with an independent opinion that the Council’s risk management, governance and internal control processes are operating effectively. The proposed 2026/27 plan is presented in Appendix 2. The audit of the core financial systems will appear in the annual audit plan in some form. This work aims to provide significant assurance to the Chief Financial Officer and wider senior management team of the integrity and robustness of the control framework of the systems that handle large numbers of transactions and account for all the authority’s income and expenditure. The Internal Audit Plan details a list of projects the Internal Audit Service will review to provide members and management with an independent opinion that the Council’s risk management, governance and internal control processes are operating effectively. The proposed 2026/27 plan is presented in Appendix 2. The audit of the core financial systems will appear in the Annual Audit Plan in some form. This work aims to provide significant assurance to the Chief Financial Officer and wider senior management team of the integrity and robustness of the control framework of the systems that handle large numbers of transactions and account for all the authority’s income and expenditure. 3. Internal Audit Plan 2026/27 Page 172
Page 173
9 were commonplace, the GIAS standards now advocate annual planning, noting that the need to “review and revise the internal audit plan as necessary.”. 3.4 A proportion of the available audit days is retained as contingency. If these days are not required during the year, they can be used to accommodate additional audit projects that may be added to the Internal Audit Plan. Such projects may arise from emerging issues identified by the Service Manager Audit and Risk (CAE) or from recommendations made by Committee. . 3.5 The objectives of each audit are to identify potential risks and provide assurance on the adequacy and effectiveness of the associated controls in the following areas: • Management – To ensure the consistency of operations or programs with established objectives and goals and effective performance. • Value – To ensure the effectiveness and efficiency of operations and employment of resources. • Regulatory – To ensure compliance with significant policies, plans, procedures, laws and regulations. • Information – To ensure the reliability and integrity of management and financial information processes, including the means to identify, measure, classify and report such information. • Security – To ensure safeguarding of assets 3.6 The Internal Audit Section comprises 4.6 full-time employees, including the Service Manager Internal Audit and Risk (CAE), who is responsible for managing and supervising the team, planning audit work, developing the service, servicing committees and overseeing business continuity and risk management arrangements. The staffing complement of the Section includes a temporary part-time Auditor post that has been funded from the remaining budget of the vacant Corporate Investigation Officer role and from income received for additional audit duties required to review economic development schemes. Assuming all posts are filled and allowing for overheads such as annual leave, training, and administrative tasks, 830 working days will be available for allocation in 2026/27. The core financial systems typically include: • accounts payable/ creditors • accounts receivable / income • payroll • housing rents • council tax • non-domestic rates • treasury management • insurance Audits of accounts payable and payroll expenditure may be undertaken annually to support the Service Manager Internal Audit and Risk (CAE) assessment of the robustness of the Council’s internal control framework. It is intended that all core financial systems will be reviewed over a five-year audit planning cycle, ensuring comprehensive coverage and assurance across key financial processes. . Detailed Internal Audit Resources have been determined and are listed in Appendix 3. Page 173
Page 174
10 3.7 Global Internal Audit Standards (GIAS) requires the Service Manager Internal Audit and Risk (CAE) to assess whether audit staffing resources are sufficient to meet the Council’s needs and if resources may adversely affect the annual internal audit opinion, to report this to the Audit and Scrutiny Committee. Demands on the Internal Audit Service have increased over the years and staffing resources have previously been raised as a concern with members and senior management. However, with the appointment of a temporary part-time Auditor, current staffing levels are considered sufficient to meet the auditing needs of the Council and its partner organisations. 3.8 In accordance with GIAS, the Service Manager Internal Audit and Risk (CAE) is required to disclose any responsibility for non-audit services to safeguard the independence and objectivity of the internal audit function. The Service Manager Internal Audit and Risk (CAE) also supports the Council’s risk management and business continuity arrangements. These responsibilities are delivered within the Internal Audit Section by the Business Continuity and Risk Management Officer, who also contributes to the preparation of the Council’s Annual Governance Statement. Oversight of these operational duties rests with senior management, including the Chief Governance Officer. This structure is considered sufficient to preserve the Internal Audit Service's independence and objectivity. 4.1 Completed reviews from the Annual Internal Audit Plan will be reported to the Audit and Scrutiny Committee on a regular basis. The reporting format, developed using the audit management software used by Internal Audit, will include the scope of each review, key findings, and recommendations to improve governance, risk, and control arrangements. Senior management’s responses to the recommendations will also be recorded within the internal audit report. 4.2 The Internal Audit Service also reports on follow-up reviews to demonstrate the implementation of recommendations agreed by management. The follow-up review will be undertaken after the last agreed date of a recommendation in the audit report has passed. However, due to the available resources within the Internal Audit Section and operational demands across services, some flexibility is required in the timescales for undertaking reviews and reporting follow-up findings. . The Global Internal Audit Standards require the Service Manager Internal Audit and Risk (CAE) to maintain a functional reporting line to the Audit and Scrutiny Committee. Regular reporting should be undertaken on progress against the Internal Audit Plan, the results of follow-up reviews to evidence the implementation of recommendations, and any significant activities, risks or control issues. 4. Internal Audit Reporting Page 174
Page 175
11 4.3 Requests for unplanned work will be considered by the Service Manager Internal Audit and Risk (CAE), and depending on the nature of the request, this work may be undertaken within the available contingency days. Alternatively, the scope of a planned project may be expanded, or a change may be made to the Annual Internal Audit Plan. Any significant changes to planned activities that impact the delivery of the Annual Internal Audit Plan will be communicated to the Audit and Scrutiny Committee. 4.4 The output of audits completed during the year will inform the annual internal audit opinion. This opinion will conclude on the overall adequacy and effectiveness of the Council’s governance, risk management and control framework. It will be reported through the Internal Audit Annual Report, which is a key assurance source for the Annual Governance Statement (AGS). The role of Internal Audit is to provide independent assurance that the Council's risk management, governance and internal control processes are operating effectively. Internal auditors must maintain an impartial and unbiased attitude and avoid any conflicts of interest. If independence or objectivity is impaired, the Service Manager Internal Audit and Risk (CAE) is required, in accordance with the Global Internal Audit Standards, to report these concerns to senior management and to members of the Audit and Scrutiny Committee. . . Page 175
Page 176
12 5.1 The following performance targets will be used to measure the performance of the internal audit activity: Appendix 1 Measure Description Target Final Report Percentage of Auditee(s) responding within 20 days of receiving the draft report. 100% Final Report Percentage of final audit reports issued within 10 days of agreeing the draft report 100% Audit Plan Delivery Percentage of audits completed v planned. 85% Audit Budget Percentage of audits completed within budgeted days. 80% Audit Recommendations Percentage of audit recommendations agreed. 90% Customer Feedback Percentage of respondents who rated that the audit added value and provided meaningful results. 100% Follow Up Reviews Percentage of Follow Up Reviews completed v planned 100% A range of performance indicators have been developed to monitor the performance of the Internal Audit Service. Actual performance against the detailed performance will be reported within the Internal Audit Annual Report 5. Internal Audit Performance Page 176
Page 177
13 Moray Council Internal Audit Section INTERNAL AUDIT CHARTER Date of Creation: September 2025 Owner (Service): Service Manager Internal Audit & Risk Reviewer Head of Service: Chief Governance Officer Approver Executive Director: Economy, Enterprise & Operations Date Approved: 16/10/2025- Corporate Leadership Team Approver (Committee): Audit and Scrutiny Committee Date Approved: 19/11/2025 Next Review Date: Annual Version History Version Date Author Changes Made Approved By 1.0 [Insert Date] [Insert Author – service title] Initial document [Insert Name] Page 177
Page 178
14 INTERNAL AUDIT CHARTER FOR THE MORAY COUNCIL Introduction 1.1 The Local Authority Accounts (Scotland) Regulations 2014 introduced a statutory requirement for all Scottish local authorities to have in place and to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the United Kingdom for all public sector internal audit providers, in-house, shared or outsourced, are the Global Internal Audit Standards (GIAS). The GIAS, in their applicability to the public sector, must be considered along with the Application Note: Global Internal Audit Standards in the UK Public Sector, which has been produced to assist with the interpretation of the GIAS. 1.2 The GIAS contain requirements to support 15 guiding principles associated with and expected to be operating within the Internal Audit function across 5 key domains: Purpose, Ethics and Professionalism, Governing, Managing and Performing, these domains and the 15 guiding principles are outlined in the images below. Page 178
Page 179
15 1.3 In accordance with the Global Internal Audit Standards (GIAS), all local authorities in Scotland must produce an Internal Audit Charter (Charter). The Charter is required to detail the purpose, mission, authority, independent reporting relationships and scope of responsibilities of the internal audit function. The GIAS refers to the head of an internal audit service as the Chief Audit Executive and within the Moray Council, this is the Service Manager Internal Audit and Risk. The Internal Audit Section of the Moray Council also provides internal audit services to the Moray Integration Joint Board (MIJB) and the Grampian Valuation Joint Board (GVJB). The same professional standards defined in this Internal Audit Charter will apply to all work undertaken for the MIJB and GVJB. Page 179
Page 180
16 Purpose Statement of Internal Auditing– Domain I 2.1 As defined by the GIAS, the purpose of the Internal Auditing (IA) function is to strengthen the Council’s ability to create, protect and sustain value. This is achieved by providing the Audit and Scrutiny Committee and senior management with independent, risk-based and objective assurance, advice, insight and foresight. 2.2 The IA function enhances the Council’s: • Successful achievement of its objectives • Governance, risk management and control processes • Decision-making and oversight • Reputation and credibility with its stakeholders • Ability to serve the public interest 2.3 The Council’s IA function is most effective when: • Internal auditing is performed by competent professionals in conformance with the GIAS, which are set in the public interest • The IA function is independently positioned with direct accountability to the Audit and Scrutiny Committee • Internal auditors are free from undue influence and committed to making objective assessments 2.4 IA assurance is provided by delivering an annual programme of audit work that independently and objectively assesses the design and effectiveness of the controls established to manage the Council’s most significant risks. Commitment to Adhering to the Global Internal Audit Standards 2.5 The Council’s Internal Audit (IA) function will adhere to the Institute of Internal Auditors' International Professional Practices Framework, consisting of the GIAS and Topical Requirements as well as the Application Note: Global Internal Audit Standards in the UK Public Sector. When expressing conformance with standards, the Council’s IA function will be clear that it is conforming to the Global Internal Audit Standards in the UK Public Sector. The Service Manager Internal Audit and Risk (CAE) will report annually to the Audit and Scrutiny Committee and senior management on the IA function’s conformance with the GIAS, which will be assessed through a quality assurance and improvement programme. Page 180
Page 181
17 Internal Audit Mandate 2.6 In accordance with the GIAS, the Council’s Internal Audit (IA) function receives its mandate from the Council’s first-tier constitutional documents with particular reference to the Scheme of Delegation and Financial Regulations. These documents set out the authority, roles and responsibilities enabling the IA function to provide the Audit and Scrutiny Committee and senior management with independent, risk-based and objective assurances on the robustness of the Council’s internal control systems. 2.7 The IA function’s authority is also supported by its direct reporting relationship to the Audit and Scrutiny Committee and senior management. Such authority allows for unrestricted access to the Chief Executive, Chair of the Audit and Scrutiny Committee and the Council Leader. Independence, Organisational Position, and Reporting Relationships 2.8 The GIAS state that the Service Manager Internal Audit and Risk (CAE) should be positioned at a level in the Council that enables the Internal Audit (IA) Service to be performed without interference from management, thereby ensuring the independence of the IA function. 2.9 The CAE reports functionally to the Audit and Scrutiny Committee and administratively to the Chief Governance Officer (Monitoring Officer). This provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit and Scrutiny Committee, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity. 2.10 The CAE is required to confirm to the Audit and Scrutiny Committee, at least annually, the organisational independence of the IA function. If the governance structure does not support organisational independence, the CAE must document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. The CAE must disclose to the Audit and Scrutiny Committee any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the IA function’s effectiveness and ability to fulfil its mandate. 2.11 To ensure that IA independence and objectivity are maintained for assurance services, IA will remain free from interference from anyone within the Council in relation to audit selection, scope, procedures, frequency, timing and report content. 2.12 Where IA also has responsibility for non-audit activities, the GIAS requires that appropriate arrangements be established to avoid conflicts of interest. Additionally, IA will not be permitted to audit any activities for which they have previously been responsible within a period of one year and will not engage in any other activity that may impair their judgment or independence. For advisory services, the IA role will be specifically restricted to providing guidance, views, and opinions. To comply with independence requirements, IA will not be involved in any aspects of operational decisions subsequently taken by management. Page 181
Page 182
18 2.13 The Service Manager for Internal Audit and Risk (CAE) is responsible for supporting the Council’s risk management and business continuity arrangements. These responsibilities are carried out within the Internal Audit Section by the Business Continuity and Risk Management Officer, who is also involved in preparing the Council’s Annual Governance Statement. The operational management of these duties is overseen by senior management, including the Chief Governance Officer, rather than by the Service Manager for Internal Audit and Risk (CAE). This approach helps to avoid impairments to the independence and objectivity of the IA function. Changes to the Mandate and Charter 2.14 The Audit Charter will be reviewed annually to ensure that it remains up to date. Any amendments will be approved by the Audit and Scrutiny Committee. Requirements to update the Internal Audit Charter may include: • A significant change in the Global Internal Audit Standards in the UK Public Sector. • A significant reorganisation within the Council • Significant changes to the Audit and Scrutiny Committee, and/or senior management Ethics & Professionalism– Domain II Demonstrate Integrity 3.1 The CAE will ensure that internal auditors: • Conform with the GIAS including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, confidentiality and the Seven Principles of Public Life • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the Council and can recognise conduct that is contrary to those expectations • Encourage and promote an ethics-based culture in the Council • Report organisational behaviour that is inconsistent with the Council’s ethical expectations, as described in applicable policies and procedures Maintain Objectivity 3.2 The Service Manager Internal Audit and Risk (CAE) will ensure that the internal audit function remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the CAE determines that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties. Page 182
Page 183
19 3.3 Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively, such that they believe in their work product, do not compromise quality and do not subordinate their judgment on audit matters to others, either in fact or appearance. 3.4 Internal auditors will have no direct operational responsibility or authority over any of the activities they review. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: • Assessing specific operations for which they had responsibility within the previous year • Performing operational duties for the Council or its partner organisations • Initiating or approving transactions external to the IA function • Directing the activities of any employee that is not employed by the IA function, except to the extent that such employees have been appropriately assigned to IA teams or to assist internal auditors 3.5 Internal auditors will: • Immediately disclose impairments of independence or objectivity, in fact or appearance, to the Service Manager Internal Audit and Risk (CAE) • Exhibit professional objectivity in gathering, evaluating, and communicating information • Make balanced assessments of all available and relevant facts and circumstances • Take necessary precautions to avoid conflicts of interest, bias, and undue influence Demonstrate Competency 3.6 The Service Manager Internal Audit and Risk (CAE) will hold an appropriate professional qualification in addition to relevant experience. Therefore, in considering whether a CAE is suitably qualified, an organisation must be looking for: • CMIIA, or a CCAB qualification, or an equivalent professional qualification which includes training on the practice of internal audit, and • Suitable internal audit experience 3.7 In addition, all staff who are on professional training programs must comply with their terms and conditions of practice and maintain the standards expected of the professional institute they belong to and other relevant requirements as outlined in this Charter. 3.8 All staff must maintain their continued professional development in accordance with their professional body on an annual basis and make the appropriate declaration where required. Exercise Due Professional Care 3.9 In completing planning activities and subsequent audit work internal auditors shall consider the: • Extent of work needed to achieve the engagement’s objectives • Relative complexity, materiality or significance of matters to which assurance procedures are applied Page 183
Page 184
20 • Adequacy and effectiveness of governance, risk management and control processes • Probability of significant errors, fraud, or non-compliance • Cost of assurance in relation to potential benefits Maintain Confidentiality 3.10 The GIAS set out the duty of internal auditors to be faithful custodians of the information they gather, sharing only in limited, defined, and controlled ways. GIAS describes the need for awareness of responsibilities in protecting information and demonstrating respect for the confidentiality, privacy and ownership of information. 3.11 While the duties under the GIAS mainly relate to restricting the sharing of information, auditors must also be aware of the circumstances under which sharing or publication of information will be required. They must be aware of the Council’s policies and procedures for the routine publication of certain information and where there are statutory obligations to share or publish information. Governing the Internal Audit Function – Domain III Authorisation by the Audit and Scrutiny Committee (Board) 4.1 Appropriate governance arrangements are essential to enable the Internal Audit (IA) function to be effective. This domain outlines the requirements for the Service Manager Internal Audit and Risk (CAE) to work closely with the Audit and Scrutiny Committee to establish the IA function, position it independently and oversee its performance. 4.2 In the United Kingdom, such arrangements are highly developed, particularly within local government, and are further supplemented by the CIPFA in the ‘Practical Guidance for Audit Committees for Local Authorities and Police 2022 edition’. In Moray, the Council’s Scheme of Delegation details the role of the Service Manager Internal Audit and Risk to act as the Chief Audit Executive for the delivery of internal audit services in accordance with GIAS. Positioned Independently – The Audit and Scrutiny Committee (Board) establishes and protects the internal audit function’s independence and qualifications 4.3 The Audit and Scrutiny Committee (Board) is responsible for enabling the independence of the Internal Audit (IA) function. Independence is defined as the freedom from conditions that impair the internal audit function’s ability to carry out its responsibilities in an unbiased manner. Page 184
Page 185
21 4.4 The Service Manager Internal Audit and Risk (CAE), who reports functionally to the Council’s Audit and Scrutiny Committee, is appropriately qualified and has the necessary experience. The Service Manager, Internal Audit and Risk (CAE), administratively reports to the Chief Governance Officer (Monitoring Officer) but has access to the Chief Executive, Chair of the Audit and Scrutiny Committee and the Council Leader. This both maintains independence and positions the Service Manager Internal Audit and Risk (CAE) within the Council to discharge the function of internal audit and its responsibilities without interference. Overseen by the Audit and Scrutiny Committee (Board) – The Board oversees the internal audit function to ensure the functions effectiveness. 4.5 The Audit and Scrutiny Committee (Board) oversight is essential to enable the overall effectiveness of the Internal Audit (IA) function. Achieving this principle requires collaboration and interactive communication between the Board and the Service Manager Internal Audit and Risk (CAE), as well as the Board’s support in ensuring the IA function obtains sufficient resources to fulfil the internal audit mandate. 4.6 To establish, maintain, and ensure that Moray Council’s IA function has sufficient authority to fulfil its duties, the Audit and Scrutiny Committee will, if required: • Discuss with the CAE and senior management the appropriate authority, role, responsibilities, scope, and services (assurance and/or advisory) of the IA function • Ensure the CAE has unrestricted access to and communicates and interacts directly with the Audit and Scrutiny Committee, including in private meetings with or without senior management present, where that is required • Discuss with the CAE other topics that should be included in the internal audit charter, where appropriate • Approve the IA function’s charter, which includes the internal audit mandate and the scope and types of internal audit services • Review the internal audit charter periodically with the CAE to consider changes affecting the Council such as the employment of a new CAE or changes in the type, severity and interdependencies of risks to the organisation; and approve the internal audit charter on an annual basis.(A copy of the internal audit charter will be included for approval with the audit plan) • Approve the risk-based audit plan and any strategy on which it is based and monitor completion of the plan, in accordance with any performance indicators set annually • Through discussion with the CAE be satisfied that the IA function’s human resources, administration and budgets are sufficient to complete the audit plan and provide an annual opinion • Through discussion with the CAE determine if they are satisfied that the service has appropriate levels of skills to fulfil its ability to complete the audit plan • Ensure that the CAE has adequate competencies and qualifications in conformance with the GIAS • Receive communications from the CAE about the IA function including its performance relative to its plan. These will be in accordance with the Committee’s scheduled timetabling of meetings as outlined in the Council’s meetings calendar Page 185
Page 186
22 • Ensure a quality assurance and improvement programme has been established and review the results annually and every five years for the external review to ensure that any deficiencies identified and opportunities for improvement contain an action plan and timeline for addressing these issues, together with monitoring progress • Make appropriate enquiries with the CAE to determine whether scope or resource limitations are inappropriate Managing the Internal Audit Function – Domain IV 5.1 The Service Manager Internal Audit and Risk (CAE) is responsible for managing the Internal Audit (IA) function in compliance with the internal audit charter and GIAS. This responsibility includes strategic planning, obtaining and deploying resources, building relationships, communicating with stakeholders, and ensuring and enhancing the performance of the function. 5.2 The CAE is expected to conform with the GIAS, whilst the CAE may delegate appropriate responsibilities to other qualified professionals in the delivery of the IA function. Plan Strategically 5.3 Planning strategically requires the Service Manager Internal Audit and Risk (CAE) to understand the internal audit mandate and organisational governance, risk management and control processes. A properly resourced and positioned IA function helps develop and implement a strategy to support the organisation’s success. 5.4 The CAE will develop and produce an internal audit strategy to support the requirements of the GIAS and the annual audit plan. The strategy and resulting audit plan will be subject to ongoing monitoring and updated where deemed appropriate. 5.5 The Council’s IA Service will have appropriate supporting methodologies (processes and procedures) in place via the Internal Audit Manual to provide clear directions to staff on expected practices which must be followed to achieve the wider requirements within the GIAS and UK applications. Manage Resources 5.6 The Service Manager Internal Audit and Risk (CAE) manages resources to implement the internal audit function’s strategy and achieve its audit plan and mandate. The CAE must develop a budget that enables the successful implementation of the audit plan, this will include training, technology and day-to- day activities. 5.7 The Council has an established and documented process for developing budgets and resources that will be needed to cover the work of the IA function. As part of the annual budget planning process, the internal audit function will consider its needs, which will include, but not be limited to, staffing, training, travel, and other associated costs. If the CAE has concerns regarding the level of internal audit resources to meet the auditing Page 186
Page 187
23 requirements of the Council or partner organisations, this should initially be raised with senior management for resolution before it is reported to the Audit and Scrutiny Committee. 5.8 Appropriately qualified staff will be engaged to provide services within the IA function, together with appropriate training and continued professional development. Communicate effectively 5.9 The Service Manager Internal Audit and Risk (CAE) guides the IA function to communicate effectively with its stakeholders, building relationships, establishing trust and enabling stakeholders to benefit from the results of the internal audit services. 5.10 The Council’s IA function has clear and documented processes for engagement with its stakeholders, which are documented in its internal audit manual. This process includes but is not limited to accurate, objective, clear, concise, constructive, complete and timely reporting of its fundings. 5.11 The Council’s IA function, through the CAE, will update the Audit and Scrutiny Committee (Board) on the completion of the audit plan and any significant revisions. In addition, the Board will be informed when there is an inability to agree on a recommendation with management, and where the IA function believes it is critical or high risk in relation to a control weakness that could put the Council at risk. In the event that other risks are identified that do not meet the threshold of being critical or high risk, acceptance of the risk will be noted in the action plan contained within the report. Enhance quality 5.12 The Service Manager Internal Audit and Risk (CAE), is responsible for ensuring the IA function’s conformance with the GIAS and for continuous performance improvement where required. Appropriate and independent internal quality assessments will be required by self-assessment annually and externally every five years. Findings of any quality assessments undertaken will be reported to senior management and the Audit and Scrutiny Committee. Performing Internal Audit Services - Domain V Plan Engagement Effectively 6.1 The Service Manager Internal Audit and Risk (CAE) will submit an annual audit plan to the Audit and Scrutiny Committee for review and approval, which is designed to support the provision of an evidence-based assessment of the robustness of the Council’s internal control systems. This annual audit plan will be developed, based on a risk-based prioritisation of the audit universe from a range of key stakeholders, including Members, Chief Executive, Corporate Leadership Team and Heads of Services. Page 187
Page 188
24 6.2 The scope of internal audit activities also encompasses, but is not limited to, objective examinations of evidence to provide independent assurance and advisory services to the Audit and Scrutiny Committee and senior management on the adequacy and effectiveness of governance, risk management, and control processes for the Council and partner organisations. However, the nature of evolving risks makes it likely that the audit assignments included in the audit plan may be subject to change. Consequently, the audit plan will be reviewed by the Service Manager Internal Audit and Risk (CAE) on an ongoing basis and any proposed changes will require the approval of the CAE and the Audit and Scrutiny Committee. Conduct Engagement Work 6.3 The Service Manager Internal Audit and Risk (CAE) must consider the effect on the opinion work before accepting consultancy work or management requests over and above the contingency allowed for in the internal audit plan. Such consultancy work will only be undertaken where resources permit, without impacting on the annual assurance process, and where there is no direct or perceived conflict of interest or eroding of the independence and objectivity of the internal audit function. The CAE will inform the Audit and Scrutiny Committee of any significant unplanned consultancy work undertaken. 6.4 The nature, objectives and scope of advisory services may be agreed with the party requesting the service, provided the IA function does not assume management responsibility. Opportunities for improving the efficiency of governance, risk management, and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management. Communicate Engagement Conclusions and Monitor Action Plans 6.5 Findings from audit reviews undertaken will be communicated to the Audit and Scrutiny Committee and senior management effectively, along with the significance and prioritisation, including limitations of scope, where applicable, and conclusions in relation to governance, risk management, and internal controls. The Council’s IA function will make all such communications in line with the GIAS and will be reflected in the internal audit manual. 6.6 Appropriate follow-up and monitoring of recommendations will be undertaken by the IA function and this will be reported to the Audit and Scrutiny Committee and senior management. 6.7 The GIAS requires the Service Manager Internal Audit and Risk (CAE) to coordinate with internal and external assurance providers to consider relying on their work and minimise duplication of effort. This may be achieved via a shared risk assessment with the Council’s external auditors and other sources of external assurance, where relevant. 6.8 The GIAS recognises that there are various relevant outside assurance providers whose authority flows from separate legal or regulatory sources beyond the control or influence of the CAE, and it may not have any ability to access the work of those assurance providers or gain insight into the scope and timing of their work. Under these circumstances, the CAE must consider whether it is possible or practical to coordinate. Page 188
Page 189
25 Handling Information 6.9 The GIAS set out the duty on internal auditors to be faithful custodians of the information they gather, sharing only in limited, defined and controlled ways, and describes the need for awareness of responsibilities in protecting information and demonstrating respect for the confidentiality, privacy and ownership of information. Fraud and Corruption 7.1 In accordance with the Council’s Policy to Combat Fraud, Theft, Bribery and Corruption, management is responsible for the prevention and detection of fraud or corruption. The Internal Audit Section will assist management in fulfilling this responsibility. 7.2 Audit procedures alone cannot guarantee that all fraud or corruption will be detected. Internal Audit will, however, exercise an appropriate level of professional scepticism during audit work and be alert to risks and exposures that could allow the opportunity for fraud or corruption to occur. 7.3 In support of the Council's counter fraud arrangement, the Service Manager Internal Audit and Risk (CAE) will consider including a counter fraud review of the Council’s systems and procedures to minimise the risk and impacts of fraud from internal and external threats. Glossary Board - refers to the Council’s Audit and Scrutiny Committee which has delegated responsibility for overseeing the work of the Internal Audit Service Chief Audit Executive (CAE) - refers to the Service Manager Internal Audit and Risk Page 189
Page 190
26 Appendix 2 Internal Audit Section Annual Work Programme- 2026/27 At the start of each audit, a discussion will be held with the service to agree on the specific terms of reference for the audit, which includes the objective and scope of the review. The scheduling of reviews is dependent on officer availability, resourcing and priorities. CORE SYSTEM REVIEWS Auditable Area Audit Scope Corporate Risk Register (Control Assurance) Allocated Days Payroll Continuous auditing will be undertaken to confirm the adequacy of the systems and procedures for paying salaries. An auditing software application will be used to analyse the data and to select the sample for testing. Financial & Regulatory 30 Third Party and Strategic Procurement (Topical Requirement) In accordance with the Global Internal Audit Standards (GIAS), an audit will be undertaken to assess the governance, risk management and control arrangements in place to ensure a consistent and comprehensive approach to managing third-party relationships. The GIAS User Guide will inform the development of the detailed audit scope and testing for this review. (An additional allocation of days has been included to undertake a contractual-type review in partnership with Aberdeenshire Council.) Financial, Regulatory & Environmental 40 Page 190
Page 191
27 Counter Fraud Review An annual review of the Council’s counter- fraud framework will be undertaken to minimise the risk and impact of fraud from internal and external threats. The scope of the audit and the testing to be carried out will be informed by frauds reported in other organisations. Regulatory 30 Cyber Security (Topical Requirement) In accordance with the Global Internal Audit Standards (GIAS), an audit of Cyber Security will be undertaken. This will include a review of the controls in place to identify and assess potential threats to the Council’s ICT systems and to evaluate how these threats are being managed. The GIAS User Guide will be used to develop the detailed audit scope and testing for this review. In addition, consideration will be given to the ‘key lessons’ and recommendations outlined in an Accounts Commission report regarding a cyber attack at Comhairle nan Eilean Siar. IT (Technological) 35 Global Internal Audit Standards- Self Assessment The Global Internal Audit Standards (GIAS) require an annual self-assessment as part of a continuous quality assurance and improvement program to ensure that the internal audit function conforms to the standards. This assessment will involve reviewing the Internal Audit Section’s procedures and processes against the GIAS to identify areas for improvement and to inform a Regulatory 30 Page 191
Page 192
28 Quality Assurance and Improvement Plan (QAIP). Insurance A review to provide assurance that the Council has effective and robust insurance procedures, ensuring that appropriate cover is in place and that processes are clearly defined and consistently followed. Financial & Operational Continuity and Performance 25 Procurement and Creditor Payments Continuous auditing of samples of non-pay expenditure will be undertaken to test compliance with Financial Regulations and Procurement Guidelines. Financial & Regulatory 50 Value Added Tax This audit will assess the adequacy and effectiveness of the Council’s arrangements for managing VAT compliance and reporting. It will review the processes for VAT treatment of income and expenditure, accuracy of VAT returns and adherence to HMRC regulations. Financial & Regulatory 25 SERVICE REVIEWS Auditable Area Audit Scope Corporate Risk Register (Control Assurance) Allocated Days Moray Growth Deal An audit will be undertaken of the governance and administrative procedures within the Council for the management of the Moray Growth Deal. The scope will include a review of partnership working arrangements, financial management, and the measurement of success criteria. Economic Sustainability 30 Page 192
Page 193
29 Environmental Services - Roads Maintenance (Response Repairs) This audit will assess the effectiveness of the Roads Maintenance Response Repairs, focusing on how reactive issues are identified, prioritised and resolved. The scope will include a review of the work order management system, costing arrangements and performance monitoring against service standards. Economic Sustainability 35 Elgin Neighbourhood Board This audit will assess the governance and accountability arrangements of the Elgin Neighbourhood Board in delivering local priorities. The review will include an assessment of reporting arrangements and compliance with relevant policies and funding requirements. Economic Sustainability 30 Education – Secondary School An establishment visit to review the financial and administrative arrangements of a secondary school will be undertaken as part of the cyclical review. Operational Continuity and Performance 30 Climate Change and Sustainability The objective of this audit is to review the effectiveness and efficiency of the Council’s arrangements for addressing climate change and sustainability. The review will assess the adequacy of governance, risk management, internal controls, data reliability and compliance with statutory climate change requirements. The audit scope will be agreed with the Principal Climate Change Officer before the review begins. Environmental 40 Page 193
Page 194
30 Housing Allocations This audit will assess the Council’s housing allocation processes, including compliance with statutory requirements and the Housing Allocation Policy. It will also assess the adequacy of record-keeping, system access controls, and the monitoring and reporting of allocation decisions to ensure consistency and accountability. Operational Continuity and Performance 30 MORAY INTEGRATION JOINT BOARD Auditable Area Audit Scope Corporate Risk Register (Control Assurance) Allocated Days Self-Directed Support Option 1 This audit will assess the effectiveness of governance, financial controls and monitoring arrangements for Self-Directed Support Option 1, where individuals receive a direct payment to arrange their own care. The review will examine eligibility assessments, support planning, payment processing, and oversight of fund usage to ensure compliance with relevant legislation and policies. Operational Continuity and Performance & Regulatory 30 Moray Integration Joint Board- Financial Sustainability The review will assess the robustness of Moray IJB’s financial planning and governance arrangements, including the adequacy of its medium and long-term financial strategies, alignment of resources with strategic priorities and the effectiveness of its risk management in addressing funding pressures. The audit will Financial & Regulatory 30 Page 194
Page 195
31 also consider the clarity and transparency of financial reporting to Moray Council and NHS Grampian. Block Contracts This audit will assess the effectiveness of governance, procurement, and contract management arrangements for block contracts within social care services. It will review how contracts are awarded, monitored, and evaluated to ensure value for money, service quality and compliance with relevant legislation and Council policies and regulations. Operational Continuity and Performance & Regulatory 20 GRAMPIAN VALUATION JOINT BOARD Auditable Area Audit Scope Corporate Risk Register (Control Assurance) Allocated Days Grampian Valuation Joint Board In accordance with the Global Internal Audit Standards applicable to local government and joint boards, an annual review of Grampian Valuation Joint Board activities will be undertaken. Regulatory 10 VERIFICATION ACTIVITY Auditable Area Audit Scope Corporate Risk Register (Control Assurance) Allocated Days Stocks and stores - year end valuations Verification of Year End Stock Verification for Building Services/ Environmental Services/ Community Services Stores. Regulatory 10 Page 195
Page 196
32 Network Support Grant Ongoing certification of the Network Support Grant for Transport Scotland. Regulatory 25 INTERNAL AUDIT SECTION ONGOING SERVICE REQUIREMENTS Category Scope Corporate Risk Register (Control Assurance) Allocated Days Consultancy- Risk Management Due to recent changes in the Council’s organisational structure, it is considered an opportune time to review current arrangements and explore best practices to identify areas for improvement in risk management. The Internal Audit Section includes a part-time Business Continuity and Risk Management Officer who supports the Council’s risk management arrangements. In accordance with the Global Internal Audit Standards (GIAS), this review will not form part of the Annual Internal Audit Plan but will be undertaken as a consultancy assignment to maintain the independence of the internal audit function. Operational Continuity and Performance & Regulatory 50 National Fraud Initiative Oversee the Council’s participation in the Cabinet Office/Audit Scotland led National Fraud Initiative (NFI) exercise, including data submission and the investigation of matches by services. Financial & Regulatory 30 Audit & Scrutiny Committee Self- Assessment Provide assistance to the Chair of the Audit and Scrutiny Committee in undertaking a self- Regulatory 15 Page 196
Page 197
33 assessment of the Audit and Scrutiny Committee against CIPFA best practice guidance. Audit Planning for 2027/28 Develop and consult on the proposed coverage for the Annual Internal Audit Plan 2027/28. Regulatory 10 Critical Friend Consultancy In its ‘critical friend’ role, provide internal challenge and quality assurance on projects involving significant change and systems implementation; provide independent challenge of the evidence to support improvement; and perform an independent and objective assessment of the evidence to support self-evaluation and improvement. Operational Continuity and Performance 30 Management, Planning and Contingency Management, planning, and assurance reporting to the Council, MIJB, and GVJB Committees. Contingency days also include an allocation for completing work in progress from the 2025/26 Internal Audit Plan. Operational Continuity and Performance 30 Follow-Up Monitor progress in implementing Internal Audit recommendations on a quarterly basis and provide an update to the Audit and Scrutiny Committee. Reporting of these follow-up reviews requires some flexibility, as implementation dates provided by management need to be balanced with Internal Audit resources and the requirement to complete the Annual Internal Audit Plan. Operational Continuity and Performance & Regulatory 80 Page 197
Page 198
34 Appendix 3 Internal Audit Section- Available Days – 2026/27 Staff Resources Available Days 3.8 FTE staff x 52 weeks x 5 days Temporary Auditor – Contracted until 30/06/2026 988 62 1050 Less: Overheads: Annual Leave (including public holidays) 158 Training 28 Sick Leave (Estimate) 21 Administration 13 Available Days 830 Allocation of Days Core Systems Reviews 265 Service Reviews 195 Moray Integration Joint Board 80 Grampian Valuation Joint Board 10 Follow Up Reviews 80 Verification Requirements 35 Internal Audit Section Ongoing Service Requirements 115 Risk Management & Business Continuity 50 Total 830 Page 198
Page 199
Report to: Audit and Scrutiny Committee Meeting Date: 25 March 2026 Report by: Executive Director Finance, Strategy and Transformation Author: Jamie Fraser Contact Email: jamie.fraser@moray.gov.uk Subject: Annual Audit Plan for the Year Ending 31 March 2026 1. PURPOSE ☒ For Decision ☐ For Information 1.1 The purpose of this report is to inform the Committee of the External Auditor’s Annual Audit Plan for the 2025/26 financial period. 1.2 This report is submitted to Committee in terms of Section III (I) (9) of the Council’s Scheme of Administration relating to considering reports produced by the Council’s External Auditor. 2. SUMMARY 2.1 The Annual Audit Plan sets out the risks which the External Auditor has identified during the audit planning process and sets out the approach which the External Auditor will take, including Wider Scope and Best Value issues. 2.2 The plan makes reference to the draft financial statements being presented without the inclusion of revalued housing stock, with work to complete valuations expected in the summer period and for inclusion an amended set of draft financial statements to be published between 30 June 2026 and 15 September 2026. 3. RECOMMENDATIONS 3.1 It is recommended that Committee consider and note the contents of the External Auditor’s Annual Plan for 2025/26. Jamie Fraser Chief Financial Officer 4. BACKGROUND AND CONTEXT Item 11. Page 199
Page 200
4.1 In September 2022, the Accounts Commission confirmed the appointment of Grant Thornton as the external auditor for the Council for financial years 2022/23 to 2026/27 inclusive. 4.2 In delivering the public audit for Moray, Grant Thornton will provide independent assurance that public money has been spent appropriately and provides value. Audit work is carried out in accordance with International Standards on Auditing, the Code of Audit Practice and any other relevant guidance. 4.3 The audit includes consideration of Best Value as part of the Wider Scope audit. 4.4 Grant Thornton’s Annual Audit Plan (AAP) for 2025/26 is attached as Appendix 1 to this report. The Plan sets out the scope of the audit work and the auditor’s approach to the audit. The AAP is risk based and details the initial risks identified at the planning stage by Grant Thornton on pages 10 to 14. These will direct the focus of audit testing and the AAP sets out the planned work to be undertaken for the audit of the financial statements for the year ending 2025/26. 4.5 Page 19 of the AAP refers to the draft financial statements. The Council operates a 5-year rolling programme of revaluations of land and property assets when preparing its annual accounts. For the annual accounts ended 31 March 2026 the housing stock is due for revaluation. Revaluations have historically been carried out internally by the Estates team, however capacity within the team, due to staff vacancies and recruitment challenges, mean this work will be carried out externally although not in time for the draft statements due to be published on 30 June 2026. A disclosure note will be included within the draft statements to inform users of the omission. Moray Council at their meeting on 30 June 2026 will be asked to delegate authority to the Executive Director Finance, Strategy and Transformation to publish a revised set of 2025/26 draft financial statements inclusive of the updated valuations between 30 June 2026 and 15 September 2026. The revised statements will be required if there is a material change in the revaluations, which are technical amendments and do not impact cash backed reserves. Grant Thornton have been informed of these intentions. 4.6 Page 41 of the AAP shows the baseline audit fee for 2025/26 as £318,810, which is an increase of 4.34% on the previous year. In the main this fee is set by Audit Scotland. In addition, a fee of £7,500 is notified in respect of the audit of those Council trusts which are charities. 4.7 The annual accounts timetable, including key deadlines, are shown on page 37 of the AAP and includes the statutory requirement for the Council to submit the Unaudited Annual Accounts along with supporting working papers to Grant Thornton by 30 June 2026, following consideration by those charged with governance at the meeting of Moray Council on 30 June 2026. Moray Council will be asked to consider the Annual Audit Report and approve the Audited Annual Accounts at its meeting on 30 September 2026. 5. PROPOSALS 5.1 The Audit Plan will direct the work of the External Auditor. Any additional work required will be reported on as part of the Annual Audit Report. Page 200
Page 201
6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) √ Policy and Legal √ Financial √ Risk √ Staffing √ Best Value and Transformation Property √ Information Communications Technology/Digital Equalities. Social Inclusion and Economic Impact √ Climate Change and Biodiversity Impact √ 6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☒ Tackle Poverty and Inequality. ☒ Build Stronger Greener Vibrant Economy. ☒ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following local Outcomes Improvement Plan priorities: ☒ Developing a diverse, inclusive, and sustainable economy ☒ Building a better future for our children and young people in Moray. ☒ Empowering and connecting communities. ☒ Improving wellbeing of our population 6.3 Policy and Legal The external audit is conducted in terms of statutory powers afforded to the appointed External Auditor and in accordance with Grant Thornton’s Code of Practice. 6.4 Financial The baseline audit fee for 2025/26 is £318,810. 6.5 Risk There are no risk implications arising from this report. 6.6 Staffing Page 201
Page 202
Preparation of the Council’s financial statements will be co-ordinated by the Chief Financial Officer and will require input from all sections of Financial Services along with other departments across the Council. 6.7 Best Value and Transformation The audit covers aspects of Best Value. 6.8 Property None arising directly from this report. 6.9 Information Communications/Technology/Digital None arising directly from this report 6.10 Equalities, Social Inclusion and Economic Impact None arising directly from this report. 6.11 Climate Change and Biodiversity Impacts None arising directly from this report. 7. CONSULTATION 7.1 This report has been prepared in consultation with the Corporate Leadership Team, the Chief Financial Officer and the Chief Audit Executive and any comments made have been incorporated into the report 8. BACKGROUND PAPERS 8.1 Held within Accountancy section. Page 202
Page 203
Moray Council External Audit Plan Financial year ending 31 March 2026 Prepared for those Charged with Governance, the Controller of Audit and the Accounts Commission 12 March 2026 APPENDIX 1 Page 203
Page 204
|© 2026 Grant Thornton UK LLP Commercial in Confidence Contents Section Page 1. Introduction and Headlines 03 2. Identified risks 08 3. Other matters 15 4. Materiality 20 5. Group audit 23 6. IT audit strategy 26 7. Wider scope and best value arrangements 28 8. Audit Scotland deliverables 32 9. Logistics 36 9. Audit Fees 39 10. Independence matters 42 11. Communication of audit matters with those charged with governance 44 12. Appendices 47 Moray Council External Audit Plan 2 Page 204
Page 205
|© 2026 Grant Thornton UK LLP Commercial in Confidence Introduction and Headlines02 Moray Council External Audit Plan 3 Page 205
Page 206
|© 2026 Grant Thornton UK LLP Commercial in Confidence Introduction and headlines (1) Purpose This document provides an overview of the planned scope and timing of the external audit of Moray Council and its group for those charged with governance. The Group includes: • Subsidiaries: Connected Charitable Trust Funds, Other Trusts Funds and Common Good Fund • Associates: Moray Council, Grampian Valuation Joint Board and Moray Leisure Limited We are appointed by the Accounts Commission as the external auditors of Moray Council for the five-year period 2022/23 to 2026/27. Respective responsibilities The Code of Audit Practice (the Code) summarises where the responsibilities of auditors begin and end and what is expected from the audited body. Our respective responsibilities, and that of Moray Council are summarised in the Appendix of this Audit Plan. We draw your attention to this and the Code. Scope of our Audit The scope of our audit is set in accordance with the Code and International Standards on Auditing (ISAs) (UK). We are responsible for forming and expressing an opinion on Moray Council’s financial statements, which have been prepared by management with the oversight of those charged with governance (Full Council). Our audit of the financial statements does not relieve management or the Full Council of your responsibilities. The audit of the financial statements does not relieve management or the Audit and Scrutiny Committee of your responsibilities. It is your responsibility to ensure that proper arrangements are in place for the conduct of its business, and that public money is safeguarded and properly accounted for. As part of our wider scope work, we will consider how you are fulfilling these responsibilities. Our audit approach is based on a thorough understanding of Moray Council and is risk based. Significant risks Those risks requiring special audit consideration and procedures to address the likelihood of a material financial statement error have been identified as: • Management override of controls (ISA (UK) 240); • Valuation of land, buildings and Council dwellings; • Valuation of defined benefit pension scheme. We will communicate significant findings on this area as well as any other significant matters arising from the audit to you in our Annual Audit (ISA 260) Report. Moray Council External Audit Plan 4 Page 206
Page 207
|© 2026 Grant Thornton UK LLP Commercial in Confidence Introduction and headlines (2) Group Audit Moray Council is required to prepare group financial statements that consolidate the financial information of: • Moray Council • Moray Integration Joint Board • Grampian Valuation Joint Board • Moray Leisure Limited • Moray Council Common Good Funds & Moray Council Trust Funds Moray Council External Audit Plan 5 Materiality We have calculated our planning materiality to be £10.130 million (Group) (PY: £8.080 million) and £9.496 million (Council) (PY: £7.650million), which equates to 2.5% (Group) (PY: 2%) and 2.35% (PY: 1.9%) (Council) of your prior year gross expenditure. Performance materiality has been determined as £7.597 million (Group) (PY: £5.660 million) and £7.122 million (Council) (PY: £5.350 million) and is based on 75% (PY: 70%) of planning materiality. We are obliged to report uncorrected omissions or misstatements other than those which are ‘clearly trivial’ to those charged with governance. A lower materiality threshold will of £25,000 will be used on the Senior Officers Remuneration table within the Remuneration Report. We will revisit our materiality throughout our audit including updating to reflect the draft unaudited financial statements for 2025/26. Other Matters We summarise other audit matters for the Audit and Scrutiny Committee’s awareness. This includes: • Consideration of going concern in accordance with Practice Note 10. • Certification of grant claims and returns. The two approved claims/returns for 2025/26 relate to housing benefit (HB) subsidy and non-domestic rates (NDR). • Completing Assurance Statements on Whole of Government Accounts. • In accordance with the Code and planning guidance we also required to complete and submit a number of information returns and other deliverables to Audit Scotland during the year. Page 207
Page 208
|© 2026 Grant Thornton UK LLP Commercial in Confidence Introduction and headlines (3) Audit Fees Audit fees were shared by Audit Scotland with Moray Council in January 2026. The baseline audit fee set is £318,810. Audit fees are paid to Audit Scotland who in turn pay Grant Thornton UK LLP. The baseline audit fee has been agreed with the audited body. We reserve the right to review our fee during the audit should significant delays be encountered and/or new technical matters arise. There will be changes to the above audit fee due to anticipated increased work required on the audit as follows: • ISA (UK) 600 – Group Financial Statements and IFRS16 leases requires enhanced audit procedures introduced in 2024/25 • Follow up of audit recommendations raised in previous audits and number of areas of wider scope work The quantum of the work will be determined later in the audit process and agreed with the Chief Financial Officer. We reserve the right to review our fee during the audit should significant delays be encountered and/or new technical matters arise. Moray Council External Audit Plan 6 Adding Value Through the Audit Our overall approach to adding value through the audit is clear and upfront communication, founded on our public sector credentials. We use our LEAP audit methodology and data analytics to ensure delivery of a quality audit. We aim to add value to Moray Council through our external audit work by being constructive and forward looking, by attending meetings of both the Full Council where appropriate and the Audit and Scrutiny Committee and by recommending and encouraging good practice. In so doing, we will help Moray Council promote improved standards of governance, better management and decision making and more effective use of resources. We will ensure an element of unpredictability in our testing to highlight areas of risk and improvements that can be made through both the financial statement and wider scope and best value audit. We have invited members of your financial reporting team to our annual Local Government Chief Accountants workshop, which is led by our internal financial reporting technical team. We look to bring forward audit testing where possible by performing an interim audit which is ongoing during March 2026. This will help provide a smooth and efficient audit process to support delivery for the year end audit. Page 208
Page 209
|© 2026 Grant Thornton UK LLP Commercial in Confidence Introduction and headlines (4) Moray Council External Audit Plan 7 Wider scope and best value audit In accordance with the Code, our planning considers the wider scope and Best Value areas of audit. We have identified the following wider scope risks and will conclude on these during the audit: - Financial sustainability – There is a risk that transformation and savings plans to address financial pressures for medium to longer term are not sufficient to address future funding gaps and increasing deficits. More information relating to the response to this risk can be found on page 30 of this report. Findings and conclusions drawn from procedures undertaken on the four wider scope areas will be reported within the Annual Audit Report. As part of our integrated wider-scope work we also use a risk-based approach to assess and report on whether Moray Council has made proper arrangements for securing Best Value and is complying with its community planning duties. For 2025/26 we are required to carry out work and report on the Best Value thematic ‘Asset Management - How well are councils managing their assets to achieve their corporate objectives and respond to challenges around financial sustainability and climate change’. Page 209
Page 210
|© 2026 Grant Thornton UK LLP Commercial in Confidence Identified risks03 Moray Council External Audit Plan 8 Page 210
Page 211
|© 2026 Grant Thornton UK LLP Commercial in Confidence Significant risks identified (1) Significant risks are defined by ISAs (UK) as risks that, in the judgement of the auditor, require special audit consideration. In identifying risks, audit teams consider the nature of the risk, the potential magnitude of misstatement, and its likelihood. Significant risks are those risks that have a higher risk of material misstatement. Moray Council External Audit Plan 9 “In determining significant risks, the auditor may first identify those assessed risks of material misstatement that have been assessed higher on the spectrum of inherent risk to form the basis for considering which risks may be close to the upper end. Being close to the upper end of the spectrum of inherent risk will differ from entity to entity and will not necessarily be the same for an entity period on period. It may depend on the nature and circumstances of the entity for which the risk is being assessed. The determination of which of the assessed risks of material misstatement are close to the upper end of the spectrum of inherent risk, and are therefore significant risks, is a matter of professional judgment, unless the risk is of a type specified to be treated as a significant risk in accordance with the requirements of another ISA (UK).” (ISA (UK) 315). In making the review of unusual significant transactions “the auditor shall treat identified significant related party transactions outside the entity’s normal course of business as giving rise to significant risks.” (ISA (UK) 550). Management should expect engagement teams to challenge management in areas that are complex, significant, or highly judgmental, which may be the case for accounting estimates, related parties and similar areas. Management should also expect to provide engagement teams with sufficient evidence to support their judgments and the approach they have adopted for key accounting policies referenced to accounting standards or changes thereto. Where estimates are used in the preparation of the financial statements, management should expect teams to challenge management’s assumptions and request evidence to support those assumptions. Page 211
Page 212
|© 2026 Grant Thornton UK LLP Commercial in Confidence Significant risks identified (2) Significant risk Description Key aspects of our proposed response to the risk Management override of controls Under ISA (UK) 240 there is a non-rebuttable presumed risk that the risk of management override of controls is present in all entities. Our risk focuses on the areas of the financial statements where there is potential for management to use their judgement to influence the financial statements alongside the potential to override the entity’s internal controls, related to individual transactions. We have therefore identified management override of controls, in particular journals, management estimates and of transactions outside the course of business as a significant risk of material misstatement. In addressing this audit risk we will: • Document our understanding of and evaluate the design effectiveness of management’s key controls over journals; • Analyse your full journal listing for the year and use this to determine our criteria for selecting high risk journals; • Test the high risk journals we have identified; • Gain an understanding of the critical judgements applied by management in the preparation of the financial statements and consider their reasonableness; • Gain an understanding of the key accounting estimates made by management and carry out substantive testing on in scope estimates. • Evaluate the rationale for any changes in accounting policies, estimates or significant unusual transactions. Moray Council External Audit Plan 10 Page 212
Page 213
|© 2026 Grant Thornton UK LLP Commercial in Confidence Significant risks identified (3) Significant Risk Description Key aspects of our proposed response to the risk Fraud in Expenditure Recognition Due to the presumption that there are risks of fraud in expenditure recognition, we are required to evaluate which types of expenditure, expenditure transactions or assertions give rise to such risks. Practice Note 10: Audit of Financial Statements of Public Sector Bodies in the United Kingdom (PN10) states: "As most public bodies are net spending bodies, then the risk of material misstatement due to fraud related to expenditure may be greater than the risk of material misstatements due to fraud related to revenue recognition". (rebutted) Having considered the risk factors set out in ISA 240 and the nature of the expenditure streams at the Council, we have determined that the risk of fraud arising from expenditure recognition can be rebutted, because: • there is limited incentive for management to manipulate the outturn position as the Council maintains sufficient reserves to cover any overspend. • we consider payroll costs to be well forecast and are able to agree these costs to underlying payroll systems. • non-payroll costs are generally high volume / low value transactions which are recognised across a number of expenditure streams. This would require a significant proportion of transactions to be manipulated to result in a material error. As such, we believe there is less opportunity for a material misstatement as a result of fraud to occur in the recognition of expenditure. Therefore, we do not consider this to be a significant risk for Moray Council and the Group. Moray Council External Audit Plan 11 Page 213
Page 214
|© 2026 Grant Thornton UK LLP Commercial in Confidence Significant risks identified (4) Significant Risk Description Key aspects of our proposed response to the risk Fraud in Revenue Recognition Under ISA (UK) 240 there is a rebuttable presumed risk that revenue may be misstated due to the improper recognition of revenue. This presumption can be rebutted if the auditor concludes that there is no risk of material misstatement due to fraud relating to revenue recognition. (rebutted) Having considered the risk factors set out in ISA240 and the nature of the revenue streams at the Moray Council and the Group, we have determined that the risk of fraud arising from revenue recognition for all revenue streams can be rebutted, because: • there is little incentive to manipulate revenue recognition. • there is a low opportunity to manipulate other income since it is non complex and there are sufficient controls in place to prevent and detect fraud from other income streams, we therefore believe that the risk of material fraud is low. Therefore, we do not consider this to be a significant risk for Moray Council and the Group. Moray Council External Audit Plan 12 Page 214
Page 215
|© 2026 Grant Thornton UK LLP Commercial in Confidence Significant risks identified (5) Significant Risk Description Key aspects of our proposed response to the risk Valuation of land, buildings and council dwellings In accordance with the CIPFA/LASAAC Code of Practice, except for initial recognition, the Council is required to hold property and property, plant and equipment (PPE) on a valuation basis. The valuation basis used will depend on the nature and use of the assets. Specialised land, buildings, equipment, installations and fittings are held at depreciated replacement costs, as a proxy for fair value. Non-specialised land and buildings, such as offices, are held at fair value. Council dwellings are determined using the basis of existing use value for social housing. As at 31 March 2025, the Council held land and buildings of £403 million and council dwellings of £496 million. Given these significant values, and the level of complexity and judgement involved in their estimation process, there is an inherent risk of material misstatement in the year end valuation of some assets. However, the risk is less prevalent in other assets as these are generally held at depreciated historical cost, as a proxy of fair value. We will therefore focus our audit attention on assets that have large and unusual changes in valuations compared to last year and/or unusual approaches to their valuations. The risk will be pinpointed as part of our final accounts work, once review the population of assets revalued. A substantial change has been made to the Code of Audit Practice for 2025/26. Local authorities are now required to completed a full valuation for all properties once every five years or alternatively on a five-year rolling basis and supported by indexation in intervening years. We have confirmed that the Council employ an internal valuer to undertake a rolling programme of valuations across their asset base valuing land and buildings at least once every five years. In the intervening periods, Moray Council carries out an indexation exercise. For 2025/26, the Council will utilise an external valuer to carry out the valuations of Council Dwellings. We therefore consider this to be a significant risk to our audit and a key audit matter. We will: • Evaluate management’s processes and controls for the calculation of the valuation estimates, the instructions issued to their management experts and the scope of their work. • Evaluate the competence, capabilities and objectivity of the valuation expert. • Write to the valuer to confirm the basis on which the valuations were carried out. • Challenge the information and assumptions used by the valuer to assess completeness and consistency with our understanding. • Evaluate the valuer’s report to identify assets that have large and unusual changes and/or approaches to the valuation – these assets will be substantially tested to ensure the valuations are reasonable. • Test a sample of other asset revaluations made during the year to ensure they have been input accurately into the body’s asset register and associated entries in the financial statements. • Evaluate the assumptions made by management for any assets not revalued during the year and how management has satisfied themselves that these are not materially different to current value. • For any assets not formally revalued, evaluate the judgement made by management or others in the determination of the current value of these assets. Moray Council External Audit Plan 13 Page 215
Page 216
|© 2026 Grant Thornton UK LLP Commercial in Confidence Significant risks identified (6) Significant Risk Description Key aspects of our proposed response to the risk Valuation of defined benefit pension scheme The Council participates in the North East Scotland Pension Fund (NESPF), a local government pension scheme. There is an established Pension Fund protocol in place with Pension Fund auditors to provide external auditors with relevant assurance. The local government pension scheme is a defined benefit pension scheme and in accordance with IAS 19: Employee Benefits, Moray Council is required to recognise its share of the scheme assets and liabilities in its Statement of Financial Position. In 2024/25, the Council applied the asset ceiling test as prescribed by IFRIC 14 which limited the measurement of a defined benefit asset to the ‘present value of economic benefits available in the form of refunds from the plan or reductions in future contributions to the plan.’ The pension asset can be recognised as the lower of the net pension asset or the present value of any economic benefits available. The Council’s actuaries undertook this assessment and the asset value in the accounts was reduced as the present value of the benefits available were lower than the pension asset. The net liability arising from the unfunded defined benefit obligation remained as there is no right to offset this. The Council’s actuary will provide an annual IAS 19 actuarial valuation of Moray Council’s net liabilities in the pension scheme. There are a number of assumptions contained within the valuation, including: discount rate; future return on scheme assets; mortality rates; and future salary projections. Given the material value of the scheme’s gross assets and gross liabilities and the level of estimation in the valuation, there is an inherent risk that the defined benefit pension scheme net liability could be materially misstated within the financial statements. This risk is focussed on the appropriateness and reasonableness of the underlying assumptions adopted by the actuary and the suitability of these for the Council. We therefore consider this to be a significant risk to our audit and a key audit matter. We will: • Evaluate management's processes and controls for the calculation of the gross asset and gross liability and estimates, the instructions issued to the actuarial expert and the scope of their work. • Evaluate the assumptions made by the actuary in the calculation of the estimate, using work performed by an auditor’s expert commissioned on behalf of Audit Scotland and additional follow up procedures (where required). • Evaluate the data used by management’s experts in the calculation of the estimates. • Perform substantive analytical procedures over the gross assets, gross liabilities and in year pension fund movements, investigating any deviations from audit expectations. • Assess the accuracy and completeness of the IAS 19 estimates and related disclosures made within the Council’s financial statements. • Review management’s assessment of the application of IFRIC 14 (if applicable). • Evaluate the response received from the NESPF auditor in line with the Audit Scotland Protocol for Auditor Assurances for Local Government Pension Schemes. Moray Council External Audit Plan 14 Page 216
Page 217
|© 2026 Grant Thornton UK LLP Commercial in Confidence Other matters03 Moray Council External Audit Plan 15 Page 217
Page 218
|© 2026 Grant Thornton UK LLP Commercial in Confidence Other matters (1) Other work We have a number of audit responsibilities as set out in the Code and Planning Guidance 2025/26 issued by Audit Scotland: • We audit parts of your Remuneration Report, as required under the Code, and check whether these sections have been properly prepared (opinion). These procedures are performed to a lower materiality. • We read the sections of your Statement of Accounts which are not subject to audit and check that they are consistent with the financial statements on which we give an opinion (opinion). • We carry out work to satisfy ourselves that disclosures made in your Annual Governance Statement are in line with requirements set out in Delivering Good Governance in Local Government: Framework (2016) (opinion). • We consider our other duties under the Code and planning guidance (2025/26), as and when required, including: • Supporting Audit Scotland’s reporting to the Accounts Commission. • Contributing to Audit Scotland Performance Reports and providing regular updates to Audit Scotland to share awareness of current issues. • Contributing to the National Fraud Initiative (NFI) report. • Notifying the Controller of the Audit when circumstances indicate a statutory report may be required. • Completing mandated information requests and returns and notifying Audit Scotland of any cases of money laundering or fraud. • Review of Technical guidance prior to issue by Audit Scotland. Moray Council External Audit Plan 16 Internal control environment During our initial audit planning we will develop our understanding of your control environment (design and implementation) as it relates to the preparation of your financial statements. In particular we will: • Consider key business processes and related controls. • Assess the design of key controls over all significant risks we have identified. This will include key controls over: • Journal entries and other key entity level controls. • The completeness and accuracy of information provided to the actuary to perform the valuation of the net pension fund liability. • The review of actuarial outputs including key assumptions made by the actuary and significant movements impacting the net pension liability. • The review of valuation outputs including key assumptions made by the valuer and significant movements in revalued assets. • The completeness of accruals and liabilities recorded within the general ledger. Our focus is on design and implementation of controls only. We do not intend to assess or place any reliance on the operating effectiveness of your controls during our audit. Page 218
Page 219
|© 2026 Grant Thornton UK LLP Commercial in Confidence Other matters (2) Going concern assessment As auditors, we are required to obtain sufficient appropriate audit evidence regarding, and conclude on: • whether a material uncertainty related to going concern exists; and • the appropriateness of management’s use of the going concern basis of accounting in the preparation of the financial statements. The Public Audit Forum has been designated by the Financial Reporting Council as a “SORP-making body” for the purposes of maintaining and updating Practice Note 10: Audit of financial statements and regularity of public sector bodies in the United Kingdom (PN 10). It is intended that auditors of public sector bodies read PN 10 in conjunction with (ISAs) (UK). PN 10 was updated in 2020 to take account of revisions to ISAs (UK), including ISA (UK) 570 (Revised September 2019) on going concern. PN 10 allows auditors to apply a ‘continued provision of service approach’ when auditing going concern in the public sector, where appropriate. Audit Scotland’s also issued further guidance in a Going Concern publication in December 2020). Within our wider scope work we will conclude on Moray Council’s arrangements to ensure financial sustainability. Internal Audit We read and understand the work of Internal Audit during the year, and how this work feeds into management’s governance processes and inclusion within the Annual Governance Statement. We do not rely directly upon the work of Internal Audit, and our approach is fully substantive. Moray Council External Audit Plan 17 Financial reporting developments During our audit we will actively discuss emerging financial reporting developments with you. We invited members of your finance team to our LG technical audit workshops earlier this year. The workshop includes good practice information for those bodies preparing group accounts. Progress against prior year audit recommendation As part of our final account's procedures, we will follow up on the implementation of prior year audit recommendations and report on progress against the recommendations in full within our Annual Audit Report. Whole of government accounts (WGA) The Code of Audit Practice requires appointed external auditors to review and report on WGA returns prepared by audited bodies. External auditors of local authorities are required to provide an assurance statement on the 2025/26 WGA returns for bodies over a prescribed threshold determined by NAO. While we do not expect to be informed of the threshold before July 2026, we anticipate that we will be required to provide a partial assurance statement for the Council for 2025/26. Page 219
Page 220
|© 2026 Grant Thornton UK LLP Commercial in Confidence Other matters (3) National Fraud Initiative The National Fraud Initiative (NFI) in Scotland is a biennial counter-fraud exercise led by Audit Scotland, and overseen by the Public Sector Fraud Authority for the UK as a whole. The Council received their NFI matches in early 2025 and we will review the Council’s progress towards reviewing matches, in particular those matches assessed as very high risk, and provide an update in our Annual Audit report. Interim Testing As part of our interim procedures, we will complete testing on a number of areas when efficient to do so, which will cover the first nine months of the financial year. This will include: • Payroll - starters, leavers and changes in circumstances • NDR reliefs testing Other material balances and transactions Under International Standards on Auditing, "irrespective of the assessed risks of material misstatement, the auditor shall design and perform substantive procedures for each material class of transactions, account balance and disclosure". All other material balances and transaction streams will therefore be considered as part of our audit. However, the procedures will not be as extensive as the procedures adopted for the significant risks we have identified and highlighted in this Audit Plan. Moray Council External Audit Plan 18 Section 106 Charities Our audit appointment as the Council’s auditor includes the audit of any trust funds falling within Section 106 of the Local Government (Scotland) Act 1973 that are registered charities. For Moray Council we have therefore been appointed as auditors of the connected charitable trust funds. The audit fee for this work is outside of the main fee and is £7,500. Our audit procedures for the connected charities trust funds include: • Total transactional audit testing over all income and expenditure transactions incurred during 2025/26. • Agreeing investment balances held by the trust fund to external confirmation from investment fund managers. Grant Claims Local government auditors are required to review and report on approved grant claims prepared by local authorities. We will work with officers to ensure the timely completion and audit inspection of your Housing Benefit return and Non-Domestic Rates claim. Page 220
Page 221
|© 2026 Grant Thornton UK LLP Commercial in Confidence Other matters (4) Local Area Network Moray Council has a Local Area Network (LAN) comprising of representatives from relevant scrutiny bodies. The LAN is responsible for sharing information and intelligence between scrutiny bodies and for considering the timing of scrutiny activity to ensure that the scrutiny footprint is manageable for those engaging with the process. As the appointed auditor, we are responsible for bringing LAN members together at the start of planning and for informing the council about the LAN process. As part of our audit planning, we will engage with members of the Local Area Network (LAN) in other agencies to collect information on performance and scrutiny risks to inform risk assessment discussions. Draft financial statements 2025/26 From our discussions with the Council, we have been informed that the timeliness of a full set of draft financial statements will be impacted due to the availability of an external valuation expert for the Council’s housing stock valuation. This could impact the timeliness of the audit depending on when this is received. It will impact also the date that the Council will be able to advertise their draft statements as they need to be a complete version. We are aiming to commence the audit as planned on a set of statements without the housing stock valuation included. This will add a level of complexity to the audit process. At the date of this report the timeline for the valuation is not yet finalised, initial discussions have indicated the valuation is expected in the summer period. Moray Council External Audit Plan 19 Risk Categorization ISQM (UK) 1 (Revised March 2023) requires audit firms to establish policies and procedures for the acceptance and continuance of client relationships. These acceptance and continuance procedures are the initial way that we manage risk and determine whether we should engage with an entity or whether to continue with an existing engagement. Risk management of our audit engagements is achieved through categorisation; by dividing up our audit engagements into categories and putting in place relevant risk management processes and procedures to mitigate those risks. Categorisation also assists with ensuring that we identify the correct ethical requirements which apply to each entity and assists with monitoring and checking compliance with the Ethical Standard. The audit engagement categorisation of public sector entities has been updated with effect from 21 October 2025. An audit is now considered a category 2b public sector audit engagements where expenditure is greater than £875 million (previously this threshold was £500 million). Audit engagements of public sector entities with revenue or expenditure below this threshold will be category 4c. Therefore, based on the projected expenditure figures detailed in the budget, our 2025/26 audit of Moray Council is expected to be classified as a Category 4C audit as gross expenditure will not exceed £875 million. Page 221
Page 222
|© 2026 Grant Thornton UK LLP Commercial in Confidence Materiality04 20Moray Council External Audit Plan Page 222
Page 223
|© 2026 Grant Thornton UK LLP Commercial in Confidence Our approach to materiality (1) The concept of materiality is fundamental to the preparation of the financial statements and the audit process and not only applies to the monetary misstatements but also to disclosure requirements and adherence to acceptable accounting practice and applicable law. Moray Council External Audit Plan 21 Matter Description Planned audit procedures 1 Determination We have determined planning materiality (financial statement materiality) at the planning stage of the audit based on professional judgement in the context of our knowledge of Moray Council and its group, including consideration of factors such as public expectations, industry developments, financial stability and reporting requirements for the financial statements. We have determined financial statement materiality based on a proportion of the gross expenditure of Moray Council and the group for the financial year. We determine planning materiality to: – establish what level of misstatement could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements; – assist in establishing the scope of our audit engagement and audit tests; – determine sample sizes; and – assist in evaluating the effect of known and likely misstatements in the financial statements. 2 Other factors An item does not necessarily have to be large to be considered to have a material effect on the financial statements. An item may be considered to be material by nature when it relates to: – instances where greater precision is required (e.g.. senior management remuneration and audit fees). 3 Reassessment of materiality Our assessment of materiality is kept under review throughout the audit process. We reconsider planning materiality on receipt of the draft statement of accounts and if, during the course of our audit engagement, we become aware of facts and circumstances that would have caused us to make a different determination of planning materiality. Misstatements, including omissions, are considered to be material if they, individually or in the aggregate, could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements; Judgments about materiality are made in light of surrounding circumstances, and are affected by the size or nature of a misstatement, or a combination of both; and Judgments about matters that are material to users of the financial statements are based on a consideration of the common financial information needs of users as a group. The possible effect of misstatements on specific individual users, whose needs may vary widely, is not considered. (ISA (UK) 320) Page 223
Page 224
|© 2026 Grant Thornton UK LLP Commercial in Confidence Our approach to materiality (2) Moray Council External Audit Plan 22 Materiality area 2025/26 planning materiality Qualitative factors considered Headline materiality for the financial statements Group: £10.130 million Council: £9.496 million This is equivalent to approximately 2.5% (Group) and 2.35% (Council) of the gross expenditure for the period ended 31 March 2025 (2024/25: 2% (Group) and 1.9% (Council)). In setting this threshold, the following factors have been considered: • There were no significant findings in the 2024/25 audit report. • No significant deficiencies have been identified in the Council’s control environment. • The level of public interest in the Council by the public and the Scottish Government. Performance materiality for the financial statements Group: £7.597 million Council: £7.122 million Performance materiality has been set at 75% (Group and Council) of financial statements materiality (2024/25: 75% (Group and Council)). Performance materiality is used for the purposes of assessing the risks of material misstatement and determining the nature, timing, and extent of further audit procedures. This is the amount we set at less than materiality for the financial statements as a whole, to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole. Reporting threshold Group: £0.506 million Council: £0.474 million This balance is set at 5% of materiality (Group and Council) (2024/25: 5%). All misstatements above this threshold will be reported. Materiality for the senior management remuneration disclosure Group: £25,000 Group (PM): £18,750 Council: £25,000 Council (PM): £18,750 Due to the public interest in senior officer remuneration disclosures, we apply specific audit procedures to this work and set a lower materiality level for this area. We design our procedures to detect errors in specific accounts at a lower level of precision which we have determined to be applicable for senior officer remuneration disclosures. We evaluate errors in this disclosure for both quantitative and qualitative factors against this lower level of materiality. We will apply heightened auditor focus in the completeness and clarity of disclosures in this area and will request amendments to be made if any errors exceed the threshold we have set or would alter the bandings reported for any individual. As a lower materiality is determined, we are required to determine a performance materiality (PM) for the Remuneration Report. Lower performance materiality has been set at 75% of Remuneration Report materiality. Page 224
Page 225
|© 2026 Grant Thornton UK LLP Commercial in Confidence Group Audit05 Moray Council External Audit Plan 23 Page 225
Page 226
|© 2026 Grant Thornton UK LLP Commercial in Confidence Group audit scope and risk assessment In accordance with ISA (UK) 600 Revised, as group auditor we are required to obtain sufficient appropriate audit evidence regarding the financial information of the components and the consolidation process to express an opinion on whether the group financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework. Component Risk of material misstatement to the group Planned audit approach and level of response required under ISA (UK) 600 Revised Response performed by Risks identified Auditor Moray Council Yes Full scope audit performed by Grant Thornton UK LLP. Group auditor Valuation of land and buildings, valuation of pension scheme Grant Thornton UK Moray Integration Joint Board No Analytical procedures at group level Group Auditor N/A Grant Thornton UK Grampian Valuation Joint Board No Analytical procedures at group level Group Auditor N/A Grant Thornton UK Moray Leisure Limited No Analytical procedures at group level Group Auditor N/A Saffery LLP Moray Common Good Funds No Specific audit procedures on PPE, reserves and cash held at 31 March Group Auditor Valuation of land and buildings Grant Thornton UK Moray Trust Funds No Specific audit procedures on PPE, reserves and cash held at 31 March Group Auditor Valuation of land and buildings Grant Thornton UK Moray Council External Audit Plan 24 Page 226
Page 227
|© 2026 Grant Thornton UK LLP Commercial in Confidence Group audit scope and risk assessment (2) There were have been no key changes in the group during 2025/26. During the course of our audit engagement, we will continue to assess the appropriateness of our planned approach in relation to the group audit scope. Fraud and Litigation We have not been made aware of any actual or attempted frauds in the year during our planning procedures performed to date. Should any factors arise in relation to fraud risk or actual or attempted fraud we ask that you inform us of this at the earliest possible opportunity. Involvement in the work of component auditors We do not intend to use the work of component auditors as part of our 2025/26 audit. Moray Council External Audit Plan 25 Page 227
Page 228
|© 2026 Grant Thornton UK LLP Commercial in Confidence IT audit strategy06 Moray Council External Audit Plan 26 Page 228
Page 229
|© 2026 Grant Thornton UK LLP Commercial in Confidence IT audit strategy In accordance with ISA (UK) 315, we are required to obtain an understanding of the IT environment related to all key business processes, identify all risks from the use of IT related to those business process controls judged relevant to our audit and assess the relevant IT general controls (ITGCs) in place to mitigate them. Our audit will include completing an assessment of the design and implementation of ITGCs related to security management; technology acquisition, development and maintenance; and technology infrastructure. IT application Audit area Planned level IT audit assessment Advance Business Solutions e5 System Financial Reporting • ITGC assessment (design and implementation effectiveness only) iTrent Pension scheme – payroll entries • ITGC assessment (design and implementation effectiveness only) CIPFA Asset Management PPE • ITGC assessment (design and implementation effectiveness only) The following IT applications are in scope for IT controls assessment based on the planned financial statement audit approach, we will perform the indicated level of assessment: Moray Council External Audit Plan 27 Page 229
Page 230
|© 2026 Grant Thornton UK LLP Commercial in Confidence Wider scope and best value arrangements 07 Moray Council External Audit Plan 28 Page 230
Page 231
|© 2026 Grant Thornton UK LLP Commercial in Confidence Wider scope and best value arrangements (1) Our responsibilities under the Code of Audit Practice extend beyond the audit of the financial statements. The Code of Audit Practice sets out four areas that constitute the wider scope of public audit in Scotland. These are summarised below: We consider each of these areas through our audit planning process and have set out below the identified areas of risk for our wider scope work. From our initial planning work, we have identified one significant risk in relation to Financial Sustainability. We will continue to review your arrangements before we issue our Annual Audit Report. A conclusion on the effectiveness and appropriateness of arrangements Moray Council has in place for each of the wider scope areas will be reported in the Annual Audit Report. 29Moray Council External Audit Plan Financial management Has the body got sound budgetary process, financial capacity and the control environment and internal controls are operating effectively. Financial Sustainability How the body looks forward to the medium and longer term to consider whether the body is planning effectively to deliver its services or the way in which they should be delivered. Vision, Leadership and Governance How effective are the body’s scrutiny and governance arrangements, leadership and decision making, and transparent reporting of financial and performance information. Use of Resources to Improve Outcomes How the body makes best use of their resources to meet stated outcomes and improvement objectives, through effective planning and working with strategic partners and communities. Page 231
Page 232
|© 2026 Grant Thornton UK LLP Commercial in Confidence Wider scope and best value arrangements (2) 30Moray Council External Audit Plan Risk assessment of Moray Council’s wider scope arrangements The risk assessment process has identified one significant risk. The risk is reflected below, and we have confirmed the planned audit procedures to be carried out in response to the risk. Area 2025/26 risk assessment 2025/26 risk -based procedures planned Financial Sustainability Significant Risk - Financial Sustainability The Council continue to face significant financial pressures. In its 2026/27 Revenue Budget, approved by Full Council in February 2026, the Council confirmed that efficiency savings totalling £14.700 million would be required over the next three years (2026/27 – 2028/29) in order to achieve financial balance. The Council have approved £4.446 million of savings for 2026/27 and £2.069 million for financial years 2027/28 and 2028/29. A further £8.185 million of savings need to be identified. Delivery of these savings will be critical in ensuring the Council can achieve financial balance in the medium term. The Council also prepare a Medium to Longer Term Financial Strategy (2026/27– 2035/36) (MTLFS) which was approved by the Council in February 2026. The MTLFS shows the level of challenge the Council is likely to face in the coming years. The MTLFS is based on optimistic, average and pessimistic assumptions and the budget gap could range from a budget surplus of £33.5 million to a budget deficit of £95.1 million. The mid range projections show a total budget gap of £44.130 million over the 10-year period to 2034/35 and the Council will need to identify new approaches to manage this gap over the longer term. We will: • Review how the council identifies significant financial pressures and builds them into its plans. • Review how the council plans to bridge its funding gap and identify achievable savings and future transformation. • Review how the council plans its finances to support the sustainable delivery of services. • Review how the council identifies and manages risk to financial resilience. • Review how the council sets longer term financial plans and capital investment to deliver on priorities and how they determine their affordability. • Follow up the recommendations raised in the 2024/25 Annual Audit Report, including those raised in the Controller of Audit Report. Page 232
Page 233
|© 2026 Grant Thornton UK LLP Commercial in Confidence Wider scope and best value arrangements (3) 31Moray Council External Audit Plan Best Value Under the 2021 Code of Audit Practice, the audit of Best Value in councils is fully integrated within our annual audit work. Best Value at the council is assessed comprehensively over the period of the audit appointment and includes an annual evaluation of the council’s approach to demonstrating improvement in the effective use of resources and public performance reporting. Controller of Audit Report At least once every five years, the Controller of Audit reports to the Accounts Commission on each council’s performance in meeting its Best Value duties. The Controller of Audit report on the Council was presented to the Accounts Commission in April 2024. The Accounts Commission’s findings were reported to members at the June 2024 Council meeting. We reported progress with the council’s improvement actions from the Best Value 2023/24 audit in our 2024/25 Annual Audit Report. A limited number actions remained outstanding, and we will review any further progress in our 2025/26 wider scope work. Best Value Thematic The thematic work for 2025/26 is on the subject of asset management - ‘How well are councils managing their assets to achieve their corporate objectives and respond to challenges around financial sustainability and climate change’. This work will include an assessment of and conclusion on: • To what extent does the council have a clear asset management strategy and plans that align with its corporate objectives, new ways of working, the changing needs of its population and net zero commitments • To what extent do the council’s governance and accountability arrangements support effective asset management • To what extent does the council have a robust approach to working with partners and communities in managing its assets This work will be completed and reported to those charged with governance in advance of the financial statements audit work. Performance Reporting Auditors have a statutory duty to satisfy themselves that councils have made proper arrangements for preparing and publishing the statutory performance information in accordance with the Direction from the Accounts Commission. The Commission issued a new Statutory Performance Information Direction in 2024 which applies in 2025/26 for the first time. Complying with the Direction is fundamental to councils fulfilling their duty to secure Best Value. We will evaluate the Council’s arrangements for complying with the new Direction in 2025/26, with our findings reported in the Annual Audit Report. Page 233
Page 234
|© 2026 Grant Thornton UK LLP Commercial in Confidence Audit Scotland Deliverables08 Moray Council External Audit Plan 32 Page 234
Page 235
|© 2026 Grant Thornton UK LLP Commercial in Confidence Audit Scotland Deliverables (1) 33Moray Council External Audit Plan As set out in the Code of Audit Practice, as appointed auditors we have several wider reporting responsibilities beyond the audit of the financial statements. Below we summarise the key areas of work for our 2025/26 audit, including expected reporting under Audit Scotland’s Code of Audit Practice and audit planning guidance: Requirement How we will report our findings Annual Accounts Perform an audit of the annual accounts and express an audit opinion. • Independent Auditor’s Report on the financial statements • Annual Audit Report detailing findings from our audit work on the financial statements. Wider scope audit areas Conclude and report on our assessment of the wider scope audit areas. • Annual Audit Report Best Value– Follow Up Follow up of the Council’s progress in implementing the recommendations raised in previous Best Value Assurance Reports, Annual Audit Reports and the Controller of Audit report issued in March 2024. • Annual Audit Report Best Value thematic work for 2025/26 We are required to report locally on any Best Value thematic work prescribed by the Accounts Commission. For 2025/26 the prescribed thematic is ‘Asset Management’. • Annual Audit Report • Reporting in a separate management report is also required. Statutory Performance Information Consider and report on Statutory Performance Information arrangements. • Annual Audit Report National Fraud Initiative (NFI) Contribute to NFI report. • Annual Audit Report • Reporting participation to Audit Scotland including completion of NFI questionnairePage 235
Page 236
|© 2026 Grant Thornton UK LLP Commercial in Confidence Audit Scotland Deliverables (2) 34Moray Council External Audit Plan Requirement How we will report our findings Statutory Objections Consider statutory objections to the annual accounts • Response to any objections received. Whole of Government Accounts (WGA) Provide assurance over Moray Council’s WGA return. • Partial Assurance Statement on WGA return Housing Benefits Subsidy Claim Independent certification on housing benefit subsidy claim to the Department for Works and Pensions (DWP). • Auditor certificate on Housing Benefit Subsidy Claim (Deadline to be confirmed when Technical Guidance Note is released in April 2026) Non-domestic rates (NDR) Certification of NDR claim. • Auditor certificate on Non-Domestic Rate Return (Deadline to be confirmed when Technical Guidance Note is released in May 2026) Current Issues Returns Prepare and submit Current Issues Returns. • Current Issues Returns Statutory Objections Consider statutory objections to the annual accounts • Response to any objections received. Correspondence queries Carry out preliminary enquiries into any correspondence relevant to Moray Council that is referred to Audit Scotland. • Providing responses to any correspondence received based on our audit knowledge and understanding and the results of any review as agreed with Audit Scotland Page 236
Page 237
|© 2026 Grant Thornton UK LLP Commercial in Confidence Audit Scotland Deliverables (3) 35Moray Council External Audit Plan Requirement How we will report our findings Emerging issues Communication of emerging issues to Audit Scotland and highlight any issues for potential statutory reports. • Communicating throughout our audit emerging issues identified throughout the year Performance, impact and overview reports Contribute to housing benefit performance audits, the Shared Risk Assessment, sector annual reports, shared intelligence on health and social care, and sector meetings. • Providing information returns to Audit Scotland Money laundering and fraud Provide information on cases of money laundering or fraud. • Completion of fraud returns for all frauds over £5,000 or involving misappropriation or theft of assets or cash which are facilitated by weaknesses in internal control • Reporting cases to the National Crime Agency of any instances of money laundering or fraud Technical Guidance Contribute to Technical Guidance Notes • Providing responses to Audit Scotland consultations on draft Technical Guidance Notes for Auditors Local Area Network Engage with members of the Local Area Network (LAN) in other agencies to collect information on performance and scrutiny risks to inform risk assessment discussions • We will share with the Council a timetable of scrutiny activity for the year and advise the Chief Executive that if they have any specific concerns on the timetable, it should be raised with the relevant scrutiny body • We will share the timetable of scrutiny activity with the Scrutiny Coordination Group Page 237
Page 238
|© 2026 Grant Thornton UK LLP Commercial in Confidence Logistics09 Moray Council External Audit Plan 36 Page 238
Page 239
|© 2026 Grant Thornton UK LLP Commercial in Confidence Logistics Moray Council External Audit Plan 37 The audit timeline Planning: February / March 2026 Key Dates Finals / Wider Scope: July - September 2026 Completion: September 2026 Key elements • Planning meeting with management to set audit scope • Agree timetable and deliverables with management and Audit and Risk Committee • Issue the Audit Plan to management and the Audit and Scrutiny Committee • Document design effectiveness of systems and processes Key elements • Audit team to complete fieldwork and detailed testing • Review of key judgements and estimates • Feedback on draft financial statements Key elements • Draft Audit Findings issued to management • Audit Findings meeting with management • Draft Auditor’s Annual Report issued to Full Council • Audit Findings presentation to Full Council • Annual Audit Report • Finalise and sign financial statements and audit report Audit and Scrutiny Committee: 25 March 2026 Full Council 30 September 2026 Audit phases: Year End: 31 March 2026 Page 239
Page 240
|© 2026 Grant Thornton UK LLP Commercial in Confidence Our team and communications Moray Council External Audit Plan 38 Grant Thornton core team Service delivery Audit reporting Audit progress Technical support Formal communications Annual client service review The Audit Plan The Auditor’s Annual Report Audit planning meetings Audit clearance meetings Communication of issues log Technical updates Informal communications Open channel for discussion Communication of audit issues as they arise Notification of up-coming issues As part of our overall service delivery, we may utilise colleagues who are based overseas, primarily in India and the Philippines. Those colleagues work on a fully integrated basis with our team members based in the UK and receive the same training and professional development programmes as our UK based team. They work as part of the engagement team, reporting directly to the Audit Senior and Manager and will interact with you in the same was as our UK based team albeit on a remote basis. Our overseas team members use a remote working platform which is based in the UK. The remote working platform (or Virtual Desktop Interface) does not allow the user to move files from the remote platform to their local desktop meaning all audit related data is retained within the UK. Mark Stocks (Planning to 8 March) Angela Pieri (Planning from 9 March and fieldwork & completion) Engagement Leader Andrew Wallace Senior Audit Manager Matthew Cronin (Planning) Yashika Goel (fieldwork and completion) Audit Senior • Key contact for senior management and Audit and Risk Committee • Overall quality assurance • Audit planning • Resource management • Performance management reporting • On-site audit team management • Day-to-day point of contact • Audit fieldwork Page 240
Page 241
|© 2026 Grant Thornton UK LLP Commercial in Confidence Audit Fees10 Moray Council External Audit Plan 39 Page 241
Page 242
|© 2026 Grant Thornton UK LLP Commercial in Confidence Audit Fees Relevant Professional Standards Across all sectors and firms, the Financial Reporting Council (FRC) has set out its expectation of improved financial reporting from organisations and the need for auditors to demonstrate increased scepticism and challenge and to undertake additional and more robust testing. As a firm, we are absolutely committed to meeting the expectations of the FRC on audit quality and public sector financial reporting. This includes, for Audit Scotland contracts, meeting the expectations of the Audit Scotland Quality Team and the Scottish quality framework. We are required to consider all relevant professional standards, including paragraphs 4.1 and 4.2 of the FRC’s Ethical Standard (revised 2024) which stipulate that the Engagement Lead (Key Audit Parter) must set a fee sufficient to enable the resourcing of the audit with partners and staff with appropriate time and skill to deliver an audit to the required professional and Ethical standards. Audit fees were shared by Audit Scotland with the Chief Executive and Chief Financial Officer in January 2026. Audit fees are paid to Audit Scotland who in turn pay us. We reserve the right to review our fee during the audit should significant delays be encountered and/or new technical matters arise. Audit Scotland set the baseline audit fee. We can increase the fee, from the baseline, for the inclusion of additional risks, new technical matters or where specific client matters are identified, such as prior year misstatements and disclosure amendments re-occurring during the audit. Moray Council External Audit Plan 40 The baseline fee of £318,810 has been set by Audit Scotland. In accordance with Audit Scotland guidance, we are able to discuss a variation to the audit fee where additional work is required. Further detail on the audit fee is available at page 41. Our audit appointment includes the audit of any trust funds falling within section 106 of the Local Government (Scotland) Act 1973 that are registered as charities with the Office of the Scottish Charities Regulator (OSCR). Auditors, appointed under the Accounts Commission are eligible under the charities regulations to audit a charity’s statement of accounts. As part of our audit work in the current year we will provide an opinion over the Council’s registered charity. The audit fee for this work is not covered in the fee set by Audit Scotland. At this stage we anticipate that the fee will be £7,500 based upon a similar level of work and number of charities as in previous years. If additional work is required which would result in an additional audit fee, this will be advised and subject to agreement with Moray Council. There will be changes to the baseline audit fee due to anticipated increased work required on the audit as follows: • ISA (UK) 600 – enhanced audit procedures required in relation to the group Financial Statements • Follow up of significant number of outstanding external audit recommendations These are considered in further detail at page 41. Page 242
Page 243
|© 2026 Grant Thornton UK LLP Commercial in Confidence Audit Fees (2) Audit fees for 2025/26 We know at the outset at the planning stage that there will be some additional fee to external auditor remuneration due to: • enhanced audit procedures required due to ISA600 groups and IFRS16 leases that was revised in 2024/25 • follow-up of prior year audit recommendations and number of areas of work in wider scope work We will agree the additional fee later in the process when the quantum of work is fully determined. These areas formed part of the additional fee in 2024/25 also. External auditors’ remuneration would be £253,050 plus £7,500 for the Charity, and the total fee would be £326,310. The audit fee has been discussed with the Chief Financial Officer. We reserve the right to review our fee during the audit should significant delays be encountered and/or new technical matters arise. We will also require some additional fee if the council house valuation is received in a further iteration of financial statements. Fee Assumption In setting the fee for 2025/26 we have assumed that you will: • prepare a good quality set of accounts, supported by comprehensive and well-presented working papers which are ready at the start of the audit • provide appropriate analysis, support and evidence for all critical and significant judgements and estimates made in preparing the financial statements • provide early notice of proposed complex or unusual transactions which could have a material impact on the financial statements • provide ongoing access to officers and management experts throughout the audit and timely responses to audit queries. • provide all requested information on the best value thematic and wider scope work to agreed timelines • provide the housing benefit and non-domestic rates grant claims and supporting working papers within agreed timescales. Additional Fees (Non-Audit Services) Moray Council External Audit Plan 41 Service Fees (£) External Auditor Remuneration £253,050 Pooled Costs £8,730 Contribution to Performance Audit and Best Value £59,470 Sectoral cap adjustment -£2,440 Trust Fund Charity (not covered in the initial fee) £7,500 2025/26 Fee £326,310 Fees (£) At planning stage we confirm there are no planned non- audit services Nil Page 243
Page 244
|© 2026 Grant Thornton UK LLP Commercial in Confidence Independence matters11 Moray Council External Audit Plan 42 Page 244
Page 245
|© 2026 Grant Thornton UK LLP Commercial in Confidence Independence matters As part of our assessment of our independence at planning we note the following matters: We confirm that there are no significant facts or matters that impact on our independence at planning as auditors that we are required or wish to draw to your attention and consider that an objective reasonable and informed third party would take the same view. The firm and each covered person have complied with the Financial Reporting Council’s Ethical Standard and confirm that we are independent and are able to express an objective opinion on the financial statements. Following this consideration, we can confirm that we are independent at planning and are able to express an objective opinion on the financial statements. In making the above judgement, we have also been mindful of the quantum of non-audit fees compared to audit fees disclosed in the financial statements and estimated for the current year. Matter Conclusions Relationships with Grant Thornton We are not aware of any relationships between Grant Thornton and the Council that may reasonably be thought to bear on our integrity, independence and objectivity. Relationships and Investments held by individuals We have not identified any potential issues in respect of personal relationships with the Council or investments in the Council held by individuals. Employment of Grant Thornton staff We are not aware of any former Grant Thornton partners or staff being employed, or holding discussions in respect of employment, by the Council as a director or in a senior management role covering financial, accounting or control related areas. Business relationships We have not identified any business relationships between Grant Thornton and the Council. Contingent fees in relation to non-audit services No contingent fee arrangements are in place for non-audit services provided. Gifts and hospitality We have not identified any gifts or hospitality provided to, or received from, a member of the Council’s board, senior management or staff (that would exceed the threshold set in the Ethical Standard). Moray Council External Audit Plan 43 Page 245
Page 246
|© 2026 Grant Thornton UK LLP Commercial in Confidence Communication of audit matters with those charged with governance 12 Moray Council External Audit Plan 44 Page 246
Page 247
|© 2026 Grant Thornton UK LLP Commercial in Confidence Communication of audit matters with those charged with governance (1) Moray Council External Audit Plan 45 Our communication plan Audit Plan Audit Findings Respective responsibilities of auditor and management/those charged with governance Overview of the planned scope and timing of the audit, form, timing and expected general content of communications including significant risks and Key Audit Matters Planned use of internal audit Confirmation of independence and objectivity A statement that we have complied with relevant ethical requirements regarding independence. Relationships and other matters which might be thought to bear on independence. Details of non-audit work performed by Grant Thornton UK LLP and network firms, together with fees charged. Details of safeguards applied to threats to independence Significant matters in relation to going concern Matters in relation to the group audit, including: Scope of work on components, involvement of group auditors in component audits, concerns over quality of component auditors’ work, limitations of scope on the group audit, fraud or suspected fraud Views about the qualitative aspects of the Council’s accounting and financial reporting practices including accounting policies, accounting estimates and financial statement disclosures ISA (UK) 260, as well as other ISAs (UK), prescribe matters which we are required to communicate with those charged with governance, and which we set out in the table here. This document, the Audit Plan, outlines our audit strategy and plan to deliver the audit, while the Audit Findings will be issued prior to approval of the financial statements and will present key issues, findings and other matters arising from the audit, together with an explanation as to how these have been resolved. We will communicate any adverse or unexpected findings affecting the audit on a timely basis, either informally or via an audit progress memorandum. Page 247
Page 248
|© 2026 Grant Thornton UK LLP Commercial in Confidence Communication of audit matters with those charged with governance (2) Our communication plan Audit Plan Audit Findings Significant findings from the audit Significant matters and issue arising during the audit and written representations that have been sought Significant difficulties encountered during the audit Significant deficiencies in internal control identified during the audit Significant matters arising in connection with related parties Identification or suspicion of fraud involving management and/or which results in material misstatement of the financial statements Non-compliance with laws and regulations Unadjusted misstatements and material disclosure omissions Moray Council External Audit Plan 46 Respective responsibilities As auditor we are responsible for performing the audit in accordance with ISAs (UK), which is directed towards forming and expressing an opinion on the financial statements that have been prepared by management with the oversight of those charged with governance. The audit of the financial statements does not relieve management or those charged with governance of their responsibilities. Page 248
Page 249
|© 2026 Grant Thornton UK LLP Commercial in Confidence Appendices14 Moray Council External Audit Plan 47 Page 249
Page 250
|© 2026 Grant Thornton UK LLP Commercial in Confidence New or revised IFRS New or revised accounting standards that are in effect for reporting periods beginning on or after 1 January 2025. Amendment to IFRS 9 and IFRS 7 - Contracts Referencing Nature-dependent Electricity The International Accounting Standards Board (IASB) issued amendments to IFRS 9 and IFRS 7 to improve the reporting of nature-dependent electricity contracts, such as power purchase agreements (PPAs). These contracts, which secure electricity from sources like wind and solar power, can vary due to uncontrollable factors like weather. The amendments clarify the 'own-use' requirements, permit hedge accounting for these contracts, and introduce new disclosure requirements to help investors understand their impact on a company's financial performance and cash flows. The amendments are effective from 1 January 2026. Amendments to IFRS 9 and IFRS 7 – Classification and measurement of financial instruments These amendments clarify the requirements for the timing of recognition and derecognition of some financial assets and liabilities, adds guidance on the solely payment of principal and interest (SPPI) criteria, and includes updated disclosures for certain instruments (e.g. instruments with features linked to environmental social and governance (ESG) targets). The amendments are effective from 1 January 2026. IFRS 18 Presentation and Disclosure in the Financial Statements IFRS 18 will replace IAS 1 Presentation of Financial Statements. All entities reporting under IFRS Accounting Standards will be impacted. The new standard will impact the structure and presentation of the statement of profit or loss as well as introduce specific disclosure requirements. Some of the key changes are: • Introducing new defined categories for the presentation of income and expenses in the income statement • Introducing specified totals and subtotals, for example the mandatory inclusion of ‘Operating profit or loss’ subtotal. • Disclosure of management defined performance measures • Enhanced principles on aggregation and disaggregation which apply to the primary financial statements and notes. IFRS 18 will be effective in the UK from 1 January 2027. IFRS 19 Subsidiaries without Public Accountability: Disclosures IFRS 19 provides reduced disclosure requirements for eligible subsidiaries. A subsidiary is eligible if it does not have public accountability and has an ultimate or intermediate parent that produces consolidated financial statements available for public use that comply with IFRS Accounting Standards. IFRS 19 is a voluntary standard for eligible subsidiaries and is effective in the UK from 1 January 2027. 48 Page 250
Page 251
|© 2026 Grant Thornton UK LLP Commercial in Confidence B. Responsibilities • Maintaining strong corporate governance arrangements and a financial position that is soundly based • Establishing and maintaining an effective internal audit function. External Audit Our responsibilities include: • Compliance with the FRC Ethical Standard • Compliance with the Code and UK Auditing Standards (ISA’s UK) in the conduct and reporting of our financial statements audit • Compliance with the Code and guidance issued by Audit Scotland in the conduct and reporting of our wider scope work Providing assurance on specified returns and other outputs (where required), as specified in guidance issued by Audit Scotland • Liaison with and notifying Audit Scotland when circumstances indicate a statutory report may be required. • Contributing to relevant performance studies (as set out in Audit Scotland’s Planning Guidance for 2025/26). 49 The Code sets out auditor responsibilities and responsibilities of the audited body. Key responsibilities are summarised below. Please refer to the Code for further detail. Moray Council Your responsibilities include: • Maintaining adequate accounting records and working papers • Preparing accounts for audit, comprising financial statements, which give a true and fair view, and related reports • Establishing and maintaining a sound system of internal control • Establishing sound arrangements for proper conduct of affairs, including the regularity of transactions • Maintaining standards of conduct for the prevention and detection of fraud and other irregularities Page 251
Page 252
© 2026 Grant Thornton UK LLP. All rights reserved. ‘Grant Thornton’ refers to the brand under which the Grant Thornton member firms provide assurance, tax and advisory services to their clients and/or refers to one or more member firms, as the context requires. Grant Thornton UK LLP is a member firm of Grant Thornton International Ltd (GTIL). GTIL and the member firms are not a worldwide partnership. GTIL and each member firm is a separate legal entity. Services are delivered by the member firms. GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions." Moray Council External Audit Plan 50 Page 252
Page 253
Report to: Audit and Scrutiny Committee Meeting Date: 25 March 2026 Report by: Service Manager Internal Audit and Risk Author: Dafydd Lewis Contact Email: dafydd.lewis@moray.gov.uk Subject: Accounts Commission Report - Comhairle nan Eilean Siar - Cyber-attack affecting operations and services 1. PURPOSE ☒ For Decision ☐ For Information 1.1 This report summarises the key issues identified in the Accounts Commission’s review of the 2023/24 Comhairle nan Eilean Siar cyber-attack and highlights lessons for all public sector bodies to consider and apply to strengthen their cyber resilience, governance and business continuity. 1.2 The report is submitted to the Committee under Section III (I)(2) and (9) of the Council’s Scheme of Administration, which requires consideration of reports from the Council’s Internal Auditor and those produced by the Council’s External Auditor. 2. SUMMARY 2.1 This report summarises the Accounts Commission’s report, published on 27 November 2025, concerning the November 2023 ransomware attack on Comhairle nan Eilean Siar. It highlights weaknesses in Information Technology (IT) resilience and disaster recovery planning and sets out recommendations for all public-sector bodies to consider regarding cyber security, staff training and governance. 3. RECOMMENDATIONS 3.1 It is recommended that Committee: i) Consider and note the contents of this report and the Accounts Commission’s report regarding the Comhairle nan Eilean Siar cyber-attack affecting operations and services; and ii) Notes that a review of the Council’s systems and processes relative to cybersecurity forms part of the planned internal audit coverage for 2026/27. Item 12. Page 253
Page 254
Dafydd Lewis Service Manager Internal Audit and Risk 4. BACKGROUND AND CONTEXT 4.1 On 7 November 2023, Comhairle nan Eilean Siar was the target of a significant ransomware attack that encrypted its on-premise servers and disrupted essential services, including payroll and finance. Although cloud-based systems remained operational, the Council relied on manual workarounds for several weeks to maintain service delivery. 4.2 The Accounts Commission published a report on 27 November 2025 outlining its findings from the review of the incident, Comhairle nan Eilean Siar’s response, and recommendations for all public-sector bodies to consider regarding cyber resilience measures and governance arrangements. 4.3 The report notes that the Comhairle nan Eilean Siar cyber-attack exposed several critical weaknesses across systems and operations. Outdated IT infrastructure and limited monitoring allowed malware to spread before detection, while insufficient network segmentation amplified the operational impact. The attack caused significant disruption to essential services over several days, with delays in restoring key systems due to untested or incomplete disaster recovery procedures. 4.4 Governance and oversight gaps were identified because cyber risk was not fully embedded within senior management or elected member oversight, and formal reporting on cyber resilience was lacking. Deficiencies in staff awareness and training further contributed to the delayed recognition of the attack, with inconsistent adherence to security protocols, including password management and phishing precautions. The incident response was hindered by unclear coordination and delays in communication between the IT service, management and external stakeholders. The Council has reported direct costs of approximately £0.95 million, of which £0.3 million is recurring, as the Comhairle focuses on “building back better.” 4.5 The audit identified several key lessons for all public-sector bodies to consider, based on the Comhairle’s experience: • IT infrastructure should be resilient and meet recognised disaster recovery standards, as locally hosted systems are particularly vulnerable to cyber threats. • Organisations must regularly conduct cyber testing and disaster recovery exercises, ensuring that formally approved incident response and recovery plans are routinely tested and kept up to date. • Staff should receive ongoing information security training, with participation actively monitored to ensure full organisational coverage. • IT teams must have sufficient capacity and capability to effectively deliver cyber- resilience measures and maintain robust recovery plans. Page 254
Page 255
4.6 The Head of Customer Experience, ICT and Digital Services, has been consulted and acknowledges the potential for cyber disruption arising from this and other widely reported incidents across both the private and public sectors. Moray Council is implementing a combination of technical, procedural and cultural controls to further mitigate this risk. The Service will continue to develop and monitor the effectiveness of these measures in the coming period. It is important to note that the effective application of cybersecurity controls is the responsibility not only of ICT and Digital Services, but of all elected members and officers. 4.7 The Accounts Commission report recommends that the key findings and learning from this cyber-attack should be reviewed by each council. It was noted that the Corporate Leadership Team has already received a report from the Head of Customer Experience, ICT and Digital Services, in which the Council’s current arrangements were assessed against these findings. This review has provided assurance regarding existing arrangements, while also identifying areas that require further development. 4.8 The Annual Audit Plan for 2026/27 includes a review of cybersecurity, which will incorporate the “key lessons” and recommendations for public-sector organisations outlined in the Accounts Commission report, within the scope of the audit. In addition, the Global Internal Audit Standards identify cybersecurity as a topical area requiring mandatory consideration during the annual risk assessment that informs the development of the Annual Audit Plan. 5. PROPOSALS 5.1 This report provides the Committee with a summary of the key findings from the Accounts Commission’s review of the Comhairle nan Eilean Siar cyber-attack affecting operations and services. 6. SUMMARY OF IMPLICATIONS 6.1 The table below shows whether risks and implications apply if the recommendations are agreed: SUBJECT YES NO Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan) × Policy and Legal × Financial × Risk × Staffing × Best Value and Transformation × Property × Information Communications Technology/Digital × Equalities. Social Inclusion and Economic Impact × Climate Change and Biodiversity Impact × Page 255
Page 256
6.2 Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Improved Collaborative Leadership, as part of continuous improvement through Best Value, will better enable the Council to fulfil the ambitions set out in its strategic plans. a) Links to Council Corporate Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Council Plan strategic priorities: ☐ Tackle Poverty and Inequality. ☐ Build Stronger Greener Vibrant Economy. ☐ Build Thriving, resilient, empowered Communities. b) Links to Local Outcomes Improvement Plan – The proposals in this report support and contribute to improved outcomes for communities as outlined in the following Local Outcomes Improvement Plan priorities: ☐ Developing a diverse, inclusive, and sustainable economy ☐ Building a better future for our children and young people in Moray. ☐ Empowering and connecting communities. ☐ Improving wellbeing of our population 6.3 Policy and Legal No implications directly arising from this report. 6.4 Financial No implications directly arising from this report. 6.5 Risk The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. 6.6 Staffing No implications directly arising from this report. 6.7 Best Value and Transformation Internal audit work supports good governance and the delivery of efficient services. 6.8 Property No implications directly arising from this report. 6.9 Information Communications/Technology/Digital This report summarises the Accounts Commission’s report, published on 27 November 2025, concerning the November 2023 ransomware attack on Comhairle nan Eilean Siar. 6.10 Equalities, Social Inclusion and Economic Impact No implications directly arising from this report. 6.11 Climate Change and Biodiversity Impacts No implications directly arising from this report. Page 256
Page 257
7. CONSULTATION 7.1 The Head of Customer Experience, ICT and Digital Services and the Chief Governance Officer (Monitoring Officer) were consulted during the preparation of this report. 8. BACKGROUND PAPERS 8.1 None Page 257
Page 258
Page 258