Agenda Document Pack - Audit and Scrutiny Committee - 23/11/2022
Moray Council · 23 November 2022
Back to Audit and Scrutiny Committee — 23 November 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 23 November 2022 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 23 November 2022 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of Meeting of the Audit and Scrutiny Committee of 28 June 2022 5 - 6 4. Written Questions ** 5. SPSO Recommendations Report Report by Chief Executive 7 - 18 6. Internal Audit Section - Update Report Report by Depute Chief Executive (Education, Communities and Organisational Development) 19 - 28 7. Internal Audit Section - Completed Projects Report Report by Depute Chief Executive (Education, Communities and Organisational Development) 29 - 56 8. Internal Audit Charter Report by Depute Chief Executive (Education, Communities and Organisational Development) 57 - 68 9. Question Time *** Consider any oral question on matters delegated to the Committee in terms of the Council's Scheme of Administration. Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. *** Question Time - At each ordinary meeting of the Committee ten minutes will be allowed for Members questions when any Member of the Committee can put a question to the Chair on any business within the remit of that Section of the Committee. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than ten minutes after the Committee has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he/she can submit it in writing to the proper officer who will arrange for a written answer to be provided within seven working days. Page 3
Page 4
THE MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor Theresa Coull (Member) Councillor John Cowe (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Neil McLennan (Member) Clerk Name: Lindsey Robinson Clerk Telephone: 07966 120593 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Tuesday, 28 June 2022 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Councillor Theresa Coull, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor Sandy Keith, Councillor Graham Leadbitter, Councillor Neil McLennan, Councillor Shona Morrison APOLOGIES Councillor Peter Bloomfield, Councillor Tracy Colyer, Councillor David Gordon, Councillor Christopher Price IN ATTENDANCE Also in attendance were the Chief Executive, Head of Governance, Strategy and Performance, Audit and Risk Manager, Lindsey Robinson, Committee Services Officer, as Clerk to the Committee and Maggie Bruce, Audit Scotland. 1. Chair Councillor Graham Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Order 20 and the Councillors’ Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member’s interests in respect of any item on the agenda. 3. Minutes of meeting of 30 March 2022 The minute of the meeting of the Audit and Scrutiny Committee dated 30 March 2022 was submitted and approved. 4. Written Questions ** The Committee noted that no written question shad been submitted. 5. Report on the Work of the Internal Audit Section in the Period from 1 April 2022 to 28 June 2022 A report by the Depute Chief Executive (Education, Communities and Organisational Development) advised the Committee on the work of the Internal Audit section for the period form 1 April 2022 to 28 June 2022. Item 3. Page 5
Page 6
Following consideration the Committee agreed to note the contents of the report. 6. Internal Audit Annual Report 2021-22 A report by the Depute Chief Executive (Education, Communities and Organisational Development) provided the Committee with a copy of the Internal Audit Annual report for the year ended 31 March 2022, together with the Audit and Risk Manager's opinion on the adequacy and effectiveness of the Council's system of internal control. Following consideration the Committee agreed to note the contents of the report. 7. Moray Council Annual Audit Plan 2021-22 A presentation on the Moray Council Annual Audit Plan 2021-22 was given by Maggie Bruce, Audit Scotland. She introduced the report and gave information on audit fees and the timetable for audit. Following consideration the Committee agreed to the contents of the Moray Council Annual Audit Plan 2021-22. 8. Question Time *** Councillor Dunbar sought clarification on whether it was typically required for organisations or groups who receive larger sums of money in the form of council grants or other council funding sources to provide receipts and invoices to the Council in regard to ensure that public monies are being spent as intended. In response, the Audit and Risk Manager advised that there is a requirement for following the public pound and that audit trail would be required to evidence the receipt or ensure that the monies have been received. Page 6
Page 7
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 23 NOVEMBER 2022 SUBJECT: SPSO RECOMMENDATIONS REPORT BY: CHIEF EXECUTIVE 1. REASON FOR REPORT 1.1 The Audit and Scrutiny Committee is asked to consider the SPSO Recommendations Report. 1.2 This report is submitted to Committee in terms of Section III (A (4) of the Council's Scheme of Administration relating to monitoring performance of the services in accordance with the Council’s performance management framework. 2. RECOMMENDATION 2.1 The committee is invited to consider the content of the SPSO Recommendations Report, seek clarification on any points arising and otherwise approve the report. 3. BACKGROUND 3.1 Complaints handling is part of the council’s Performance Management Framework. Members receive updates on complaints performance through routine reports to service committees. 3.2 All complaints operate through a two stage complaints process. 3.3 Once a complaint has passed through the complaints process, a complainant has the option of having their complaint considered by the SPSO. Following SPSO investigation, they can make recommendations to help councils learn from mistakes and implement service improvements. Item 5. Page 7
Page 8
3.4 The SPSO has asked authorities to confirm that SPSO complaint recommendations are reviewed at a senior level by returning an annual ‘learning and improvement statement’ confirming this. This builds on the model complaints handling procedures that set out the importance of Moray Council being able to demonstrate how they ‘systematically review complaints performance reports to improve service delivery’. Our statement includes a commitment to report on SPSO recommendations annually to Audit and Scrutiny committee. 3.5 The SPSO introduced a ‘learning and improvement unit’ (LIU) to ensure public authorities take the necessary responsibility and actions to handle complaints well and reduce the occurrence of repeat mistakes. The aim of the LIU is to enhance the impact of their work by helping authorities improve public services through learning from complaints. 3.6 One of the main areas the LIU focus on is SPSO recommendations. A key part of this work includes providing authorities with additional support and advice on how to meet their recommendations with a view to preventing repeat service failings and complaints. In addition to this extra support they are looking to adopt a tighter escalation process for the very few cases where their recommendations are not being implemented, with the potential to lead to a Special Report. 4. SPSO RECOMMENDATIONS FOR REPORTING PERIOD 2021/22 4.1 Table 1 (APPENDIX A) shows all Moray Council complaints in the reporting period 2021/22 where we received notification of referral by complainants to the SPSO. No significant recommendations were made. We were advised to carry out minor further actions as detailed at cases 5, 6, 7, 9 and 12. 4.2 Case 5, SPSO Reference 202102463 relates to a complaint that damaged guttering from a council property had led to overflow damage to a privately owned property. SPSO agreed with the council’s position to not uphold the complaint as the damage caused to the privately owned property was as a result of their own poorly fitted guttering. SPSO highlighted that, following our stage one response, the complainant should have been advised that they could report continued dissatisfaction within 2 months of receipt of their final response and have it investigated at stage 2 of our process but this was not done. This learning point was issued in a brief to housing managers. It was also forwarded to all department complaint adminstrators to share with staff who deal with complaints. Page 8
Page 9
4.3 Case 6, SPSO Reference 202103114 relates to a complaint of family concerns raised about their father’s wellbeing and finances. SPSO agreed with the council’s position that the case should be partially upheld as we had not responded to some of the family emails. They were satisfied that the council had followed Adult Support and Protection procedures. SPSO highlighted as a learning point that we should have signposted the complainant to information relating to Power of Attorney. 4.4 Case 7, SPSO reference 202103395 relates to a complaint about the poor condition of an allocated council property. SPSO agreed with the council’s position that the case should be partially upheld as we had not responded to a query from the complainant relating to faulty heating. SPSO requested that the council provide an amended final response to cover all complaint issues including some that had been raised with SPSO but not the council. The council issued a revised final response to the satisfaction of the complainant and SPSO closed their case. 4.5 Case 9, SPSO reference 202103566 relates to a complaint that the council had failed to make necessary housing adaptions to cater for disability needs. SPSO agreed with the council’s position that the case should be partially upheld as we had made some but not all of the adaptions. SPSO highlighted two issues; the council should provide timescales of works to be carried out to the customer; provide contact details for the staff member overseeing works to be carried out. These issues were shared in a brief with housing managers. 4.6 Case 12, SPSO reference 202105797 relates to a complaint that the council did not provide adequate support for a pupil to access a course. SPSO agreed with the council’s position to not uphold the complaint and that due process had been followed. SPSO requested that the council provide an amended final response to cover all complaint issues including some that had been raised with SPSO but not the council. The council issued a revised final response to the satifcation of the complainant who did not raise any further concerns with the council or SPSO. Page 9
Page 10
5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Effective handling of complaints is used to ensure the efficient and sustainable delivery of services to meet the Council’s priorities in ‘Moray 2026: A Plan for the Future.’ Within the Moray Council Corporate Plan, it has been identified that “we will talk to our customers and see how they would like services improved” that is a core part of the process of learning from complaints. SPSO recommendations often necessitate further communication with customers. (b) Policy and Legal The SPSO requested a ‘Learning and Improvement statement’ in support of our statutory requirement to report to the SPSO annually on their performance indicators. (c) Financial implications It is not anticipated that there will be any financial implications as the two complaint recommendations referred to in this report are not linked in any way to financial claims. (d) Risk Implications Failure to report may result in SPSO making a declaration of non- compliance against the Council. Non-compliance with the statutory duty relating to national standards being adopted would present risk in terms of reputational damage and a loss of public confidence in our ability to deliver quality improvements based on complaints analysis, and ultimately to maintaining and improving service standards. (e) Staffing Implications There are no staffing implications related to this report. (f) Property There are no property implications related to this report. (g) Equalities/Socio Economic Impact The Equal Opportunities Officer has recommended that where services are experiencing high volumes of complaints, the management of respective services should arrange to identify common complaint issues and any learning arising. This will help to ensure that complaints are not arising from situations where customer diversity needs have not been considered or addressed, e.g. disability or cultural issues. He further recommends that where there is evidence or a suspicion that a complaint is related to characteristics protected under the Equality Act 2010 (race, disability, sex, religion/belief, sexual Page 10
Page 11
orientation, age, gender reassignment, pregnancy/maternity), services make contact the council’s Equal Opportunity Officer. (h) Climate Change and Biodiversity Impacts There are no climate change and biodiversity impacts related to this report. (i) Consultations The Corporate Management Team has been consulted on the contents of SPSO Recommendations report. 5. CONCLUSION 5.1 The SPSO Recommendations Report presents council action taken to address SPSO recommendations. Author of Report: John Black, Complaints Officer Background Papers: SPSO PIs Ref: SPMAN-2045703626-196 Page 11
Page 12
Case Ref/No LOG Ombudsman Referrals 01-04-2021 to 31-03-2022 Submission Req’d/Sub Details Decision/Date Action Plan Y/N Comp Ref No Department 1. SPSO 202008748 01/07/2021 101002640726 Integrated Children Services Complained that: Staff refused to believe parents or check out their accounts. There was poor communication between staff, foster carers and parents. Staff did not keep a parent informed of information concerning his children. These complaints were upheld by the council. 01/07/2021 – SPSO issued a decision letter. They were satisfied with council action taken and made the decision not to investigate the complaint further. N 2. SPSO 202008864 01/04/2021 101002675190 – Dealt with as an MSP enquiry and not as a complaint. Housing and Property Complained that the council unfairly refused homelessness application including appeal. This was not upheld by the Council. 21/07/2021 – SPSO issued a decision letter. They were satisfied with council action taken and made the decision not to investigate the complaint further. N Page 12
Page 13
3. SPSO 202100039 23/04/2021 No complaint raised as there was a separate appeal process Planning Complained that the council did not uphold a planning appeal. 23/04/2021 – SPSO issued a decision letter. They were satisfied that the council followed due process. They advised the complainant to raise additional unrelated complaint issues with the council however complainant chose not to do so. N 4. SPSO 202101698 06/07/2021 101002852152 Housing and Property Complained that the council had refused him employment arising from him complaining against staff in the past. 14/07/2021 – SPSO issued a decision letter. The council dealt with reported matters as staff misconduct rather than through our complaint handling procedure (CHP). SPSO determined that it could have been considered within our CHP and informed the complainant to raise it again. Complainant chose not to do so. N 5. SPSO 202102463 15/07/2021 101002800856 Housing and Property Complained of damaged guttering from a council property that led to overflow damage to an adjacent private property. 29/09/2021 – SPSO issued a decision letter. They were satisfied with council action taken regarding Y Page 13
Page 14
This complaint aspect was not upheld by the council as it was determined that the complainant’s private contractor had poorly installed guttering at the private property. The council did not follow the timelines of the CHP. the guttering and this was not upheld. They noted that the council met frontline and investigation timelines of 5 and 20 working days. They upheld that the complainant wasn’t advised that he could escalate his complaint to investigation within 2 months of receipt of the frontline response. They asked the council to remind staff to do this. The complaint administrator circulated an email to all housing managers reminding them to do this. This was also shared with other complaint administrators. 6. SPSO 202103114 27/04/2021 101002881028 Community Care Complained that Partnership did not take reasonable action between October 2020 and April 2021 following contact from complainant and his family regarding concerns about their father’s wellbeing and finances. 05/07/2022 - SPSO issued a decision letter. They were satisfied with the investigation carried out and concluded that Adult Support and Protection (ASP) procedures were adhered to. Y Page 14
Page 15
Partnership partially upheld the complaint accepting that they failed to respond to some emails. They provided a feedback learning point that the Partnership should have signposted the complainant to information relating to Power of Attorney. 7. SPSO 202103395 21/09/2021 101002774303 And 101003086276 Housing and Property Complained about the poor condition of an allocated property. Further complained following receipt of the council’s response. 101002774303 - The council partially upheld this complaint as they failed to respond to a request for an update regarding replacement heating. 101003086276 – The council did not uphold this complaint. 25/08/21 SPSO issued a decision letter. They requested that a revised final response be sent to the complainant. 21/09/2021 - A revised final response was issued to the complainant and copied to SPSO. SPSO advised that complainant had made no further contact and that their complaint file would be closed. Y 8. SPSO 202103533 27/04/2021 101002751506 Lifelong Learning, Culture and Sport Complained that the council would not fund an out of area placement for her child. 10/11/2021 - SPSO issued a decision letter. They advised that they agreed with the decision of the council and would be taking no further action. N Page 15
Page 16
This was not upheld as the council followed policy. 9. SPSO 202103566 20/08/2021 101002831214 Housing and Property Complained that necessary adaptions had not been made to the property to cater for disability needs. This was partially upheld as the council accepted that some adaptions should have been made. 03/12/2021 - SPSO issued a decision letter They advised that they were satisfied with the council handling of this complaint. They raised two feedback issues: When committing to taking actions to carry out works, timescales should be provided to the customer. Explain to the customer how they can contact the staff member who will be overseeing all works to be carried out. Y 10. SPSO 202103885 14/01/2022 101002810246 Direct Services Complained that inappropriate and erroneous use of his personal information with an outside agency whilst processing a pothole car damage insurance claim. 22/02/2022 - SPSO issued a decision letter. They advised that they were happy with the council handling of this complaint and that they would be taking no further action. N Page 16
Page 17
This was not upheld by the council. 11. SPSO 202105733 01/04/2021 101002760685 Schools and Curriculum Development Complained that their child should have been awarded higher exam grades. This complaint was partially upheld by the council. 28/10/2021 - SPSO issued a decision letter. They advised that they were happy with the council handling of this complaint and that they would be taking no further action. N 12. SPSO 202105797 06/09/2021 101002879060 Lifelong Learning, Culture and Sport Complained that there had been a lack of support to assist his child accessing a course. The complaint was not upheld by the council. On 24/01/2022, SPSO issued a decision letter. They requested the council to provide a revised final investigation response as they identified that we had not agreed the correct heads of complaint/outcomes. They recommended that a revised final response be sent. This was sent in July 2022 and the complainant did not report any further dissatisfaction to the council or SPSO. Y 13. SPSO 202107184 25/11/2021 101002881671 Schools and Curriculum Development Complained about the actions of a staff member towards a pupil during a school outing. 17/03/2021 - SPSO issued a decision letter. They advised that they were happy with the council handling of this complaint and N Page 17
Page 18
This complaint was not upheld by the council. that they would be taking no further action. 14. SPSO 202108029 22/12/2021 No complaint raised Direct Services Complained that food waste collections should continue during holiday periods. The council dealt with and responded to this matter as a request for service rather than a complaint. 22/12/2021 - SPSO issued a decision letter. They advised that they were happy with the council handling of this matter and that they would be taking no further action. N 15. SPSO 202108958 31/03/2022 101003038338 Legal and Democratic Services Complained that the council had refused his application for a taxi grant. The council did not uphold this complaint. 16/06/2022 - SPSO issued a decision letter. They advised that they were happy with the council handling of this matter and that they would be taking no further action. N Page 18
Page 19
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 23 NOVEMBER 2022 SUBJECT: INTERNAL AUDIT SECTION – UPDATE REPORT BY: DEPUTE CHIEF EXECUTIVE (EDUCATION, COMMUNITIES AND ORGANISATIONAL DEVELOPMENT) 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III I (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on Internal Audit’s activity and performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2022/23 AUDIT PLAN Audit Plan Update 4.1 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed in Appendix 1 is an update on the progress undertaken by the Internal Audit Service regarding the completion of audit review projects against the Annual Audit Plan. Item 6. Page 19
Page 20
4.2 In addition to the requirement for completing projects detailed within the Annual Audit Plan, a review has also been undertaken of the Grampian Valuation Joint Board. Internal Audit is required to provide annual assurances on the main financial systems operated for payroll, payments and income from funding requisitions from the constituent authorities and other sources. The Joint Board’s systems align with those of the Council but require annual review and testing in order to provide assurances for the separate annual financial statements the Board is required to prepare and publish. It is pleasing to report that based on the audit work completed, that reasonable assurance can be placed on the adequacy and effectiveness of the system of internal financial control established within the Assessor’s Service. Unplanned Audit 4.3 The Building Services Manager contacted the Internal Audit Section to request a review of the overtime claims made by two officers within Building Services. The investigation concerned the overtime paid to these officers and whether the individuals had actually undertaken the work claimed. 4.4 The audit reviewed a sample period of the overtime time claimed and a check made to supporting documentation, including the vehicle tracking system. Significant variances were found between the overtime claimed and the actual hours worked. The findings of this investigation have been reported to the Building Services Manager. An overview of the systems and practices to authorise overtime payments within Building Services will be undertaken as part of a planned maintenance review already agreed within the Audit Plan for 2022/23. Follow Up Reviews 4.5 Internal Audit reports are regularly presented to elected members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit undertakes follow-up reviews to evidence the effective implementation of these recommendations. It is now intended to report these follow-up reports to the Audit and Scrutiny Committee. The Status / Explanation column within the report records the Auditor’s review in verifying implementation of the recommendations. Please see detailed the following completed follow-up review: Petty Cash 4.6 An audit of the systems and procedures for administering petty cash funds was undertaken. Petty cash is an amount of money held by establishments or services in cash to usually meet minor items of expenditure. Examples include postage, stationery, sundry items, etc. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 2. Page 20
Page 21
5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report.. . (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: DL/ASC/231122 SPMAN-1042990102-123 / SPMAN-1042990102-124 / SPMAN-1042990102-125 Page 21
Page 22
Page 22
Page 23
Appendix 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2022/23 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Housing Benefits - Rent Rebates and Rent Allowances Substantive testing of selected benefit claims to confirm the accuracy of the Council’s benefit subsidy claim Final report issued Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations Final report issued Payroll Regularity testing to confirm the adequacy of the systems and procedures for the payment of salaries to selected staff groups Fieldwork in progress Capital Plan Audit testing of contract management arrangements for selected projects within the capital plan Fieldwork in progress Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances Work Completed Cyber security Identification and assessment of the potential threats to the council’s ICT systems and how these are being managed Final report issued Item 6. Page 23
Page 24
Appendix 1 OTHER SYSTEMS Area Type of coverage Collection and accounting of planning fees Review the accounting arrangements for the collection, recording etc of planning fees Final report issued Housing and Property- Planned Maintenance Works Audit of works allocation, completion and inspection across planned programme repairs (Council Housing) Fieldwork in progress Environmental Services – Grant Claims Certification of grant claims as required: strategic timber; bus operators, regeneration schemes as appropriate Awaiting request from Services General Data Protection Regulation A review of the Council systems to ensure compliance with General Data Protection Regulation Final report issued Environmental Services – Stores A review of the Environmental Services Stores Systems to ensure appropriate accounting systems are followed Audit programmed to start in the next quarter(s) Refuse Collection (Domestic) A review of the current arrangement for the collection of refuse materials for domestic properties. The audit will also cover arrangements for collection, disposal of recyclable materials Fieldwork completed and draft report prepared Moray Growth Deal An overview of the governance and administrative arrangements within the Council for the management of the Moray Growth Deal Final report issued Education – Secondary School Establishment visits as part of cyclical review Audit programmed to start in the next quarter(s) Emergency Planning A review of the Council’s Emergency Planning arrangements Fieldwork in progress Page 24
Page 25
Appendix 1 European Social Fund Review of the European Social funding arrangements in subsidising the cost for delivery of the Moray Council Money Advice Service Audit programmed to start in the next quarter(s) Corporate Services - ICT Hardware Asset Management Review of systems and practices to record / monitor the location and use of ICT hardware Audit programmed to start in the next quarter(s) Moray Integration Joint Board Care First System An exercise to assess system management, security and resilience of the Care First System used for the recording and management of service users data Final report issued Self Directed Support Review of Self Directed Support financial monitoring arrangements regarding Option 2/3 where care support packages to service users are managed by the Moray Council or an Individual Service Fund (ISF) Provider Audit programmed to start in the next quarter(s) Information Management Ensure appropriate systems exist in the management and security of data including the transfer of data between Local Authorities and the NHS Draft report issued Page 25
Page 26
Page 26
Page 27
Moray Council Appendix 2 Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Petty Cash REPORT REF: 22'010 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective controls exist in the administration and monitoring of petty cash funds 5.01 All officers administering petty cash funds should be reminded to follow recommended operating guidelines for the administration of the funds. Medium Yes 10 May 2022 A reminder has been issued to all fund holders to follow established guidelines in petty cash administration. In addition, a comprehensive review of petty cash usage has been commenced by Financial Services. Item 6. Page 27
Page 28
Moray Council Appendix 2 Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 Vouchers and receipts should be retained to evidence all payments made from the Throughcare and Aftercare petty cash fund, irrespective of any claim for replenishment of funds. Medium Implemented 28 July 2021 Sample transactions have been selected over a 3 month period and vouchers obtained, evidencing that the service is now retaining vouchers and receipts as standard operational practice. 5.03 A review should be undertaken of the central control database and updated with current operating details. Medium Yes 31 March 2022 Review was undertaken and completed by end of financial year with queries on fund amounts addressed and some imprest accounts closed where no further need was established. Control database is being kept up to date and will be subject to ongoing review. Page 28
Page 29
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 23 NOVEMBER 2022 SUBJECT: INTERNAL AUDIT SECTION – COMPLETED PROJECTS REPORT BY: DEPUTE CHIEF EXECUTIVE (EDUCATION, COMMUNITIES AND ORGANISATIONAL DEVELOPMENT) 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 29 June 2022 to 23 November 2022. 1.2 This report is submitted to Committee in terms of Section III (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the internal audit work concluded during the period 29 June 2022 to 23 November 2022. Core Financial Systems- Cyber Security 3.2 Cyber Security concerns the protection of computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. Cyber security controls are designed to combat threats against networked systems and applications, whether those threats originate from inside or outside an organisation. The Scottish Government in 2020 issued a Cyber Resilience Framework to all Local Authorities. The Framework includes a self-assessment tool to assist Local Authorities in improving their cyber resilience and compliance with a range of legislative, regulatory, policy and audit requirements regarding cyber security. The audit programme was developed from this Cyber Resilience Framework and other good practice guidelines. The impact of a successful cyber attack would immediately affect how the Council would be able to continue providing day to day services. The executive summary and recommendations for this project are given in Appendix 1. Item 7. Page 29
Page 30
Core Financial Systems– Creditor Payments 3.3 Part of the audit plan annually is devoted to main financial systems including creditor payments that cover non-payroll expenditure, i.e., payment for works, goods and services to suppliers or contractors. The purpose of the audit was to confirm ongoing compliance with procurement and payment processing regulations. 3.4 Testing was undertaken by using a data analysis software application to extract a random sample of transactions for review. A check for duplicate payments was also carried out by extracting listings where more than one invoice from a single supplier had been paid for the same amount. Findings from the testing found no issues of concern regarding the suppliers used, sums paid, authorisations and accounting treatment. It is also considered from the checks undertaken that appropriate controls are operating effectively and the integrity of systems has been maintained. The executive summary is given in Appendix 2. 3.5 A similar review has also been undertaken to test a sample of transactions generated under the direction of the Moray Integration Joint Board. The purpose of the audit was to confirm again that effective controls are operating to ensure all payments are appropriately authorised, accurate and paid in accordance with regulations and agreed terms and conditions. However, the review noted findings where further improvements are required in the recording and processing of invoices. The executive summary and recommendations for this project are given in Appendix 3. Departmental Systems – Planning Fees 3.6 An audit has been undertaken into the accounting arrangements for collecting and accounting of planning fees income. Planning application fees are set for all Scottish Local Authorities by the Scottish Government (Town and Country Planning (Scotland) Regulations). Approximately £833,000 of planning fees income was received by the Council in 2021/22. The audit also reviewed other related services, including pre-application advice, development enquiries, recovery of neighbour notification advertisements and non-material variation orders. The audit checked to ensure the correct fees had been charged, and testing was undertaken to confirm the accuracy, completeness and accountability for all income collected. The executive summary and recommendations for this project are given in Appendix 4. Departmental Systems – Social Care & CareFirst System Information Governance Review 3.7 An audit has been undertaken into how information relating to social care service users is recorded, accessed and kept up to date. The Council uses a system known as CareFirst to record and manage social care cases for both adult and children’s services. CareFirst is a long standing widely used application within the public sector for recording social care data. Most of the service user data is available on CareFirst, with some data retained separately either on a Council server or in paper files. Page 30
Page 31
3.8 The scope of this review considered the findings and recommendations from an audit undertaken of the CareFirst System within the 2017/18 Audit Plan. The audit also reviewed the management arrangements for reviewing case files and access controls of who can view, add, amend or delete information, recognising that restricted access has to be balanced with a need for prompt availability of information for those employees who require it for the effective delivery of services. The executive summary and recommendations for this project are given in Appendix 5. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: DL/ASC/231122 SPMAN-1042990102-117 / SPMAN-1042990102-118 / Page 31
Page 32
SPMAN-1042990102-119 / SPMAN-1042990102-120 / SPMAN-1042990102-121 / SPMAN-1042990102-122 Page 32
Page 33
Appendix 1 AUDIT REPORT 23’011 CYBER SECURITY Executive Summary The annual audit plan for 2022/23 provides for a review to be undertaken into the Council's arrangements surrounding its Cyber Security. Cyber Security concerns the protection of computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. The scope of this audit was to provide a review of systems, practices and an assessment of the controls in place to protect the Council from a cyber-attack. The audit also reviewed Information, Communication and Technology (ICT) security policies and procedures to ensure they are regularly reviewed and promote best practices. Cyber security controls are designed to combat threats against networked systems and applications, whether those threats originate from inside or outside an organisation. A successful cyber-attack would immediately impact the delivery of services within the Council. The Scottish Government in 2020 issued a Cyber Resilience Framework to all Local Authorities. The Cyber Resilience Framework was developed jointly between the Scottish Government and the National Cyber Resilience Advisory Board. The Framework includes a self-assessment tool to assist Local Authorities in improving their cyber resilience and compliance with a range of legislative, regulatory, policy and audit requirements regarding cyber security. The audit programme has been developed from this Cyber Resilience Framework and other good practice guidelines. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The review has highlighted the following areas for improvement:- The Scottish Government recommends that all Local Authorities should comply with the Scottish Government Cyber Resilience Framework. The Service has accepted the requirement to comply with the Framework by undertaking a self-assessment tool to highlight improvements needed to the Council’s cyber resilience arrangements. It is appreciated that due to the pandemic, the ICT Service has been under additional pressure to meet changes in working practices across all Services. The audit found progress had been undertaken in completing the self-assessment tool; however, further action is needed to complete this review. It was found that no formalised incident response plan has been developed in the event of a successful cyber-attack. A cyber security incident response plan is a document that gives officers clear instructions on how to respond to Item 7. Page 33
Page 34
Appendix 1 a serious security incident, such as a data breach, data leak, ransomware attack, or loss of sensitive information. Effective security controls would reduce the risk of a successful cyber-attack, however if the worse did occur, an incident response plan would ensure clear procedures are followed to limit the damage and disruption to Services. The Council has policies and guidelines detailing best practices that should be followed regarding information security and computer use. However, they have not been reviewed for several years. Policies and Guidelines should be reviewed and if required updated to include current best practices in information management, computer use and cyber security arrangements. Page 34
Page 35
Appendix 1 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective Cyber Security Controls to combat threats against networked systems and applications. 5.01 The ICT Service should progress with completing the Scottish Government Cyber Resilience Framework self-assessment tool. Any improvement actions required to Council systems and procedures should be agreed with an action plan detailing recommendations for implementation. High Yes In the latest response to the Scottish Government Cyber Assurance survey (Feb 22), the ICT Service reported that it currently aligns with the Progression Stage of ‘Partial Target’. The intention is to progress to ‘Target’ by the end of the current financial year. Note there are dependencies on the ICT Team Leader (Infrastructure & Information Security) 31 March 2023 Page 35
Page 36
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation implementation of 5.04 and 5.05 5.02 ICT policies and guidelines should be reviewed and if required updated to include best practices in information management, computer use and cyber security practices. Medium Yes The Corporate Information Security Policy is currently under review. A revised draft will be available by the end of September. The Computer Use Policy will be reviewed thereafter. ICT Team Leader (Infrastructure & Information Security) 31 December 2022 5.03 The ICT Business Continuity Plan should be reviewed and if required updated to reflect current cyber resilience arrangements. High Yes This was acknowledged in the response to the latest Scottish Government Cyber Assurance survey. ICT Infrastructure Manager 31 December 2022 Page 36
Page 37
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 Cyber security awareness training should be provided to officers of all levels within the Council. Medium Yes A solution to provide phishing simulations and linked eLearning content, to raise cyber awareness has been procured. The work to implement this solution is in progress and discussions have taken place with regard to the baseline phishing campaign ICT Team Leader (Infrastructure & Information Security) 31 March 2023 5.05 An Incident Response Plan should be developed and thereafter regularly tested through simulation exercises. High Yes This was acknowledged in the response to the latest Scottish Government Cyber Head of HR, ICT & OD / Infrastructure Manager 31 December 2022 Page 37
Page 38
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Assurance survey. Work is also being progressed via CMT/SMT with regard to this, in light of the SEPA lessons learned. 5.06 A review of existing insurance cover should be carried out to ensure the level of cover is appropriate and adequate in relation to the threat level from cyber-attack. Medium Yes There is cover in the existing policy for reinstatement of data as well as cyber incidents. Further information is required on the obligations and requirements for cyber insurance in future renewals. ICT Infrastructure Manager 30 September 2022 Page 38
Page 39
Appendix 2 AUDIT REPORT 23'007 CREDITOR PAYMENTS Executive Summary The annual audit plan for 2022/23 provides for a review to be undertaken of payments made by the Authority to suppliers of goods, services and works. The purpose of the audit was to confirm that effective controls are operating to ensure all payments are; authorised by a Budget Manager, accurate and paid in accordance with regulations, and agreed terms and conditions. Approximately £49.6 million was paid by the Council in the six months from October 2021 to April 2022, to suppliers of goods and services. Through the use of computer audit software a sample of 30 invoices was chosen from the period, across Council services, with a value of £2.9 million. The process reviewed a selection of randomly selected invoices, and a sample of high value invoices. The audit work also involved a separate exercise of extracting multiple invoices with the same payee and value as a check for duplicate payments. The audit had regard to the Audit Scotland publication ' Fraud and irregularity 2021/22' issued in July 2022. The publication detailed a number of good practice recommendations including Internal Audit undertaking a review to ensure proper controls are operating regarding segregation of duties, tendering arrangements, authorisation of expenditure etc. The audit has included these elements within this review. Findings from the testing undertaken found no issues of concern in terms of contracted suppliers used, sums paid, authorisations and accounting treatment. It is also considered from the checks undertaken, that appropriate controls are operating effectively and the integrity of systems has been maintained. This is a positive outcome given the continuation of remote/hybrid working and changes to processing practices required as a result of the Covid 19 pandemic. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Item 7. Page 39
Page 40
Page 40
Page 41
Appendix 3 AUDIT REPORT 23'010 CREDITOR PAYMENTS Executive Summary The annual audit plan for 2022/23 provides for a review to be undertaken of payments made by the Authority to suppliers of goods and services. The purpose of the audit was to confirm that effective controls are operating to ensure all payments are appropriately authorised, accurate and paid in accordance with financial regulations and agreed terms and conditions. This audit review related to testing a sample of transactions generated under the direction of the Moray Integration Joint Board. Approximately £21 million was paid through the Council’s creditors system by Health and Social Care Moray in the six months from October 2021 to March 2022 to suppliers of goods and services. Through the use of computer audit software, a sample of payments was randomly selected from this period with a value of £1.05 million. The testing undertaken was developed from the Chartered Institute of Public Finance and Accountancy’s Audit Programme, in addition to consultation with the External Auditor. The audit work also involved a separate exercise of extracting multiple invoices from the same supplier with the same value as a check for duplicate payments. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS) Findings from the audit undertaken noted the following areas for consideration:- Testing found that payments had been made to Care Providers before the services were delivered. The advance payment period ranged from a couple of days to approximately 6 months. Payments made by Health and Social Care Moray and processed by the Moray Council must comply with the Council’s Financial Regulations. These Regulations state that unless written authority is obtained from the Head of Financial Services, payments should not be made in advance for the delivery of goods or services. A computer audit software application was used to check for potential duplicate payments by undertaking a data matching analysis of invoices paid to the same company with an identical value. An example was found from a sample of fifteen matches investigated where a company had been paid twice for the same service. The value of this duplicate payment amounted to £9,796.93. Action is currently being undertaken to recover this duplicate payment. In addition, a recommendation has also been made within this report to further strengthen controls within the Community Care Finance Team in the processing of invoices. The audit noted issues concerning the management of social care contracts. This is related to the contractual relationships with care providers and the administration of individual contracts. With consideration to the scope of the planned external review of adult social care commissioning, no further action is planned by Internal Audit. However, progress regarding this review will be closely monitored. Item 7. Page 41
Page 42
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective controls in the processing of creditor payments to ensure compliance with Financial Regulations and Procurement Guidelines 5.01 A review should be undertaken across all social care external providers to ensure that payments are not made in advance of the service delivery. High Yes All invoices received will be more rigorously checked to ensure providers are not paid in advance unless a prior agreement has been received. Any issues will be escalated to the Commissioning Manager for resolution. Community Care Finance Officer 15 August 2022 Page 42
Page 43
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.02 Monitoring arrangements within the Community Care Finance Team should be amended to include a requirement to record all invoices processed for payment. Medium Yes Procedures are being drafted to include clear instructions and a checklist for recording all invoices received for payment. Community Care Finance Officer 31 August 2022 5.03 The Community Care Finance Team should check invoices received from Care Providers to ensure the care delivered to each service user corresponds to their individual authorised support package detailed within CareFirst. Medium Yes This is currently in place, albeit not for all services. This check will be expanded to include all service areas. Community Care Finance Officer 31 August 2022 5.04 Payments should be made to the agreed Care Provider and not a sub contracted company. High Yes Agreed. Advice will be required from the Commissioning Team for any invoices Commissioning Manager 31 August 2022 Page 43
Page 44
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation received from a sub contractor for the delivery of care. Page 44
Page 45
Appendix 4 AUDIT REPORT 23'010 PLANNING FEES Executive Summary The annual audit plan for 2022/23 provides for an audit review to be undertaken of the collection and accounting of planning fees income. Planning application fees are set for all Scottish Local Authorities by the Scottish Government (Town and Country Planning (Scotland) Regulations). A review of the Council's Financial Management System (FMS) noted a total of £833,000 of planning fees income received by the Council in 2021/22. In addition, the Council charges fees for related services, including pre-application advice, development enquiries, recovery of neighbour notification advertisements and non-material variation orders. The charges for these services are set locally as part of the Council's charging policy and approximately £132,000 was received in 2021/22. The scope of this audit project was to evaluate the accounting arrangements for the collection and recording of planning income received. The audit checked that the correct fees had been charged, and testing was undertaken to confirm the accuracy, completeness and accountability for all income collected. The audit also included a check of the procedures for refunding fees to service users. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The audit review found that overall effective administrative procedures are being followed. However, the following areas for improvement have been identified:- The processing of planning fee refunds does not follow the Council's Authorisation Policy. It was noted that there is no physical authorisation of individual refunds by the budget manager or from an approved authoriser. The use of electronic signatures and standard forms were used to process refunds to service users. All refunds must be authorised in accordance with the Council's Authorisation Policy. Examples were found where planning income received had been miscoded within the Financial Management System (FMS). This does not affect the accuracy of the total income recorded but does misstate the income detailed against individual fee classifications. Regular reviews should be undertaken of FMS to ensure income has been correctly coded. Any miscodings noted should be adjusted to ensure FMS accurately records income received. Item 7. Page 45
Page 46
Appendix 4 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Processes are in place to separately and correctly identify different income sources for monitoring purposes. 5.01 Consideration should be given to regularly reviewing the Financial Management System to ensure the coding of income reflects the category of planning fees being collected. Any miscodings should be moved to the correct financial code. Low Yes Financial codings will be checked on a quarterly basis. Parties involved in taking payment for planning fees are to be reminded of the codes to use for accurate allocation. Development Management & Building Standards Manager 31 July 2022 Key Control: Fees are only refunded in specific stated circumstances where no services have been provided and are appropriately authorised. 5.02 All refunds should be authorised by the budget manager or other approved authoriser in line with the Council's Authorisation Policy. Medium Implemented Practices have now been amended as a result of the audit recommendation and all refunds are being authorised by the budget manager in line with the Council's Authorisation Policy. Development Management & Building Standards Manager Implemented Page 46
Page 47
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Fees are fully and accurately recorded and are in line with budgetary expectations. 5.03 Consideration should be given to undertaking regular reconciliations between the Uniform planning software application and the Council's Financial Management System to verify the accuracy of both databases. This exercise will also complement recommendation 5.01 to ensure the correct coding of planning fees income. Low Yes Quarterly reconciliations are considered to be practical and able to be accommodated within resources available. Quarterly reconciliations will be undertaken by the Planning Technical Assistant with any errors identified reported to the budget manager. Development Management & Building Standards Manager 31 July 2022 Page 47
Page 48
Page 48
Page 49
Appendix 5 AUDIT REPORT 23'012 SOCIAL CARE & CAREFIRST SYSTEM INFORMATION GOVERNANCE REVIEW Executive Summary The annual internal audit plan for 2022/23 provides for a review of the CareFirst system and the various databases used for recording service user information. CareFirst is the primary database that records and manages social care cases for Adult, Children and Families Services. CareFirst is a long standing widely used application within the public sector for recording social care data. Most service user data is available on CareFirst, but some information is saved separately either on a council IT server or in paper files due to the lack of a facility within CareFirst to attach documents and the continued requirement to hold some information in hard copy for legal reasons. The audit reviewed access controls around the management of case files. This included consideration of who can view, add, amend or delete information, recognising that restricted access has to be balanced with a need for prompt availability of information for those employees who require it to deliver services effectively. Controls in this area are particularly important due to the sensitive nature of much of the information. In addition, the Council has duties under data protection regulations, and breaches of these regulations can result in censure and substantial financial penalties being levied by the Information Commissioner’s Office. The audit also considered the findings from a review of the CareFirst System that was undertaken within the 2017/18 Audit Plan and a check undertaken to evidence the implementation of these recommendations. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). It is appreciated that due to the pandemic, officers have been focused on supporting service users for the last few years to ensure that essential care continues to be delivered. The review has highlighted the following areas for consideration:- Information concerning a service user care package is recorded on multiple databases, i.e., CareFirst, shared drive and paper files. Evaluation should be undertaken with improving technology, if it is feasible to strengthen case recording procedures such that all data ultimately can be recorded in a single file for each service user. Case recording procedures have been developed, however it was noted they had not been reviewed for several years. In addition, with the imminent transfer of Children and Families Services to the Moray Integration Joint Board, there is an opportunity to review working practices and develop uniform procedures for recording information and reviewing case files. Item 7. Page 49
Page 50
Appendix 5 The audit reviewed who can view, add, amend or delete information from the various databases used for recording service user information. Different access controls were found between the CareFirst system, Council IT server and paper files. Consideration should be given to reviewing access controls for these various databases to ensure consistency in operating arrangements and that officers can only access information required to undertake duties of their post. Page 50
Page 51
Appendix 5 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective Information control systems in operation to protect and secure access to social care data. . 5.01 Investigation should be undertaken to explore the possibilities of developing a single case recording system. Medium Yes This is a key requirement for the replacement of CareFirst System. The CareFirst Replacement Board was suspended at the beginning of the pandemic. Health & Social Care Moray are currently developing a prioritised delivery plan for our Strategic Plan, Commissioning Manager The delivery plan for Health & Social Care Moray’s Strategic Plan, incorporating the proposed timetable for replacement of the CareFirst, is scheduled to be put before the IJB by 30 November 2022. Page 51
Page 52
Appendix 5 Partners In Care. The prioritisation of the replacement of CareFirst will be part of this process. 5.02 Additional access controls to the CareFirst System should be introduced to include time limited access and more complex password combination requirements. Medium Yes Time limited access will be introduced. It is not possible to introduce more complex password combinations on CareFirst but this will be a requirement for the replacement of CareFirst. Information Systems Officer 31 October 2022 5.03 A review of access rights to CareFirst, Shared Drive and Paper Files should be undertaken with the purpose that officers should only be authorised to view case file information required to undertake their duties. Medium Yes Agreed. Implementation will be depended on the replacement to the CareFirst System. Commissioning Manager The delivery plan for Health & Social Care Moray’s Strategic Plan, incorporating the proposed timetable for replacement of Page 52
Page 53
Appendix 5 the CareFirst, is scheduled to be put before the IJB by 30 November 2022. 5.04 An officer should record a clear description within the CareFirst System to explain why access is required to a Restricted Case File. Where restricted service user records are also held within the shared drive and paper records, a clear description should also be maintained detailing reasons for access. Low Low Yes Yes A review of the management reports where access is required to a restricted case file will be undertaken to ensure the reason for access is clearly recorded. A report from the review will be considered by the Practice Governance Board. Commissioning Manager/ Information Systems Officer Commissioning Manager/ Information Systems Officer 31 December 2022 31 December 2022 5.05 CareFirst Case Files should be deleted in accordance with the Council Document Retention Policy. Deletion of case files should only be actioned after the authority of a senior manager is obtained. Medium Yes Implementation arrangements will be reviewed and agreed by the Practice Governance Board. Commissioning Manager/ Information Systems Officer 31 December 2022 Page 53
Page 54
Appendix 5 5.06 The deletion of CareFirst System files should also include information held regarding a service user within the shared drive and paper files. Medium Yes Implementation arrangements will be reviewed and agreed by the Practice Governance Board. Commissioning Manager 31 December 2022 5.07 The re-introduction of regular reviews of case files should be undertaken by Managers within Adult, Children and Families Services. Medium Yes Regular reviews of case files will be undertaken by managers. Head of Community Care/ Head Children & Families & Criminal Justice 31 October 2022 5.08 Case recording procedures should be updated for Adult, Children and Families Services. Medium Yes Adult Services have reviewed the Case Recording Procedure and are developing a complementary Records Management Procedure. The revised Case Recording Procedure is currently at final draft stage. Commissioning Manager 31 December 2022 Page 54
Page 55
Appendix 5 Children and Families Services are also intending to update their Case Recording Procedure. Quality Improvement & Policy Manager 31 January 2023 5.09 A review should be undertaken of the security of paper records held within the Community Care Finance Offices to ensure service user information can only be viewed by authorised officers. Medium Yes This has recently taken place, a number of actions from the review have been completed. New office equipment is currently being purchased e.g. new lockable filing cabinets and the Community Care Finance Officer is liaising with Health & Safety Section with a view to identifying any further security measures for both the office Community Care Finance Officer Completed Page 55
Page 56
Appendix 5 and the building. Page 56
Page 57
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 23 NOVEMBER 2022 SUBJECT: INTERNAL AUDIT CHARTER BY: DEPUTE CHIEF EXECUTIVE (EDUCATION, COMMUNITIES AND ORGANISATIONAL DEVELOPMENT) 1. REASON FOR REPORT 1.1 To seek Committee approval for a revised Internal Audit Charter that defines the purpose, authority, and responsibility of the internal audit activity within the Council. 1.2 This report is submitted to Committee in terms of Section III I (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 The Committee is asked to consider and approve the revised Internal Audit Charter. 3. BACKGROUND 3.1 The Public Sector Internal Audit Standards (PSIAS) require the purpose, authority and responsibility of the internal audit activity to be formally defined in an Internal Audit Charter. The Internal Audit Charter establishes Internal Audit’s position within the Council; authorises access to records, personnel and physical properties relevant to the performance of engagements; and defines the scope of Internal Audit activities. 3.2 The PSIAS was developed by the Chartered Institute of Public Finance and Accountancy and the Chartered Institute of Internal Auditors (CIIA) and is mandatory for all providers of internal audit services in the public sector. The standards are based on the compulsory elements of the global CIIA’s International Professional Performance Framework. Item 8. Page 57
Page 58
3.3 The definition of Internal Auditing within PSIAS is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes”. 3.4 The Internal Audit Charter defines the role and purpose of internal audit and its responsibilities and status within the Council. The Audit and Risk Manager must periodically review the Internal Audit Charter and present it to senior management and the Audit and Scrutiny Committee for approval. 3.5 It is expected the Charter will also be a helpful reference point for elected members who have recently joined the Committee. The Charter is provided in Appendix 1. 4 SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal Public sector bodies are required to adopt mandatory standards for internal audit and these call for the regular review and updating of an internal audit terms of reference document. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications Not having a formally agreed charter could mean the role of internal audit within the council is not clearly defined and understood, and technically is a non-compliance with the required standards. (e) Staffing Implications No implications directly arising from this report. . (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report (h) Climate Change and Biodiversity Impacts No implications. Page 58
Page 59
(i) Consultations The Standards require the draft Charter to be discussed with senior management and such discussions have taken place with the Corporate and Senior Management Team. Separately, the Chief Financial Officer and Monitoring Officer have been consulted and any comments incorporated into this report. 5. CONCLUSION 5.1 The Committee is asked to consider and approve the revised Charter document for internal audit to ensure ongoing compliance with recognised auditing standards. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: DL/ASC/231122 SPMAN-1042990102-127 Page 59
Page 60
Page 60
Page 61
APPENDIX 1 Governance, Strategy and Performance Internal Audit Charter Author: Audit and Risk Manager Date for review: May 2027 Item 8. Page 61
Page 62
Introduction The Local Authority Accounts (Scotland) Regulations 2014 introduced a requirement for all Scottish Local Authorities to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Public Sector Internal Audit Standards (PSIAS), which came into effect in April 2013, and were updated in March 2017. These standards are largely based on the International Professional Practices Framework (IPPF). A requirement of the PSIAS is that all local authorities should have an Internal Audit Charter. Definition and Purpose of Internal Auditing The overarching “mission” of an Internal Audit Service is to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. Internal Auditing is defined in the PSIAS as ‘an independent, objective, assurance and consultancy activity designed to add value and improve an organisation’s operations. Internal Audit adds value to the organisation (and its stakeholders) by enhancing governance, risk management and internal control and objectively providing assurance. As part of the meeting Moray Council’s system of corporate governance, Internal Audit’s purpose is to support the Council in its activities designed to achieve its declared objectives and to do so: • In support of the Council’s vision, values and priority. • As a contribution to the Council’s management of risks, including assisting management to improve the risk identification and management process in particular where there is exposure to significant regulatory, financial, strategic, reputational and operational risk to the achievement of the Council’s objectives. • As an aid to ensuring that the Council and its elected members, employees and contracted third parties are operating within the law and relevant regulations and that public money is safeguarded and properly accounted for, and used economically, efficiently and effectively. • As a contribution towards establishing and maintaining a culture of honesty, integrity, openness, accountability and transparency throughout the Council in all its activities and transaction. • As a contribution towards ensuring that financial statements and other published performance information are accurate and reliable. Page 62
Page 63
Moray Council also provides an internal audit service to Moray Integration Joint Board (MIJB) and the Grampian Valuation Joint Board (GVJB). It will apply the same standards as defined in this Charter to any work undertaken for the MIJB and the GVJB, with separate Internal Audit plans and reports presented to their respective ‘senior management’ and ‘board’. POSITION OF INTERNAL AUDIT WITHIN THE ORGANISATION The Internal Audit Service is managed by the Audit and Risk Manager. The Audit and Risk Manager reports administratively to the Head of Governance, Strategy and Performance, who is a member of the Council’s extended Corporate Management Team. The PSIAS requires the Audit and Risk Manager to report functionally to the Audit and Scrutiny Committee. Functional reporting is defined as that which enables the Audit and Risk Manager to ensure that Internal Audit can fulfil its responsibilities. The Audit and Scrutiny Committee is charged with responsibility for ensuring good stewardship of the Council’s resources, enhancing the profile, status and authority of Internal Audit and affirming its independence. Specifically, in relation to audit matters, the committee: • Contributes to making the Council, its committees and services more responsive to the audit function and its purpose; • Enhances good governance arrangements by promoting internal control and risk management by supporting an anti-fraud culture, and by the review of revisions to financial procedures; • Has responsibility for focusing audit resources through agreeing to an annual programme of work; • Monitors delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit; • Considers the annual opinion provided by the Audit and Risk Manager on the adequacy and effectiveness of the control environment. ORGANISATIONAL STATUS AND INDEPENDENCE In terms of the PSIAS, the status of Internal Audit should enable it to function effectively, with recognition of the independence of Internal Audit that is fundamental to its effectiveness. Moray Council’s financial regulations detail that the Depute Chief Executive (Education, Communities and Organisational Development) is responsible for securing a continuous Internal Audit service to provide an independent and objective opinion on the control environment comprising risk management, internal control and governance. This remit is delegated to the Audit and Risk Manager. Internal Audit will systematically review, appraise, make appropriate recommendations for improvement, and report upon: • The efficacy of governance arrangements put in place to achieve the organisation’s objectives and priorities. Page 63
Page 64
• The effectiveness of all internal controls and other arrangements put in place to manage risk, in particular where there is exposure to significant financial, strategic, reputational and operational risk to the achievement of the organisation’s objectives. • The completeness, reliability and integrity of information, both financial and operational performance, including working alongside services in a ‘critical friend’ role to authenticate any self-assessment evidence of service performance and improvement. • The systems formed to ensure compliance with policies, plans, procedures, laws and regulations whether established by the organisation or externally. • The effectiveness of arrangements for safeguarding the organisation’s assets and interests, including fraud prevention controls and detection processes. • The economy, efficiency and effectiveness with which resources are deployed. • The extent to which services’ operational practices are being carried out as planned and objectives and goals are met. Internal Audit’s work covers: • All activities, systems, processes, policies and protocols that currently exist or under development. • All records, personnel and properties. • All services and other activities for which the organisation is responsible or accountable, whether delivered directly or by third parties through contracts, partnerships or other arrangements. RIGHTS OF ACCESS The Audit and Risk Manager and any member of the Internal Audit service are authorised in the performance of an audit engagement and have the authority to: • Have access at any reasonable time to all computer systems and records (both paper and electronic). • Require and receive explanations concerning any matter under examination from personnel relevant to their roles, including elected members or board members • Enter at all reasonable times and without notice any properties provided that the terms of the lease are observed where such properties are leased to a third party. Page 64
Page 65
• Require personnel to produce cash, stores, or other assets under their control. Internal Audit safeguards all information obtained in the carrying out its duties, only uses it for defined purposes, and makes no disclosure of any information held, unless this is authorised or there is a legal/professional requirement to do so. AUDIT RESOURCES AND WORK PRIORITISATION The Moray Council’s Internal Audit Annual Plan, as approved by the Audit and Scrutiny Committee, is the primary determinant of the relative priority to be placed on each part of the work of Internal Audit, with Internal Audit Annual Plans specific to the MIJB and the GVJB being approved and monitored by their respective ‘senior management’ and ‘board’. The audit planning process, to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, includes consideration of the organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided. The Audit and Risk Manager determines the actual deployment of available resources covering the range and breadth of audit activity, which is integral to the assurance process across the activities of the Council, MIJB and GVJB in order to provide the statutory annual Internal Audit opinion to each organisation’s ‘senior management’ and ‘board’. This plan also requires to be sufficiently flexible to reflect the changing risks and priorities of each organisation. The Audit and Risk Manager ensures that Internal Audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. Appropriate refers to the mix of qualifications, knowledge, skills and other competencies needed to perform the plan, such as compliance with the Code of Ethics set out in the PSIAS and with the Nolan principles established in the Seven Principles of Public Life. This is of particular importance and relevance for the profession of Internal Audit, founded as it is on the trust placed in its objective assurance about risk management, internal control and governance. In the event that there is a need for additional audit work than there are resources available, the Audit and Risk Manager will identify the shortfall in the Plan and initially advise the Head of Governance, Strategy and Performance the Depute Chief Executive (Education, Communities and Organisational Development) followed by the Audit and Scrutiny Committee as required. It will be for the Audit and Scrutiny Committee to decide whether to accept the risks associated with the non-delivery of such audit work or to recommend to the Council that it requires Management to identify additional resources. Internal Audit responsibilities are not relieved in areas of the Council’s work that are subject to review by others, but reliance is placed on the work of other review agencies, principally the Council’s External Auditor, to avoid duplication, make the best use of resources and inform the overall assessment of governance arrangements. Page 65
Page 66
MANAGEMENT RESPONSIBILITIES Responsibility for internal control rests with Management, who must ensure that proper internal control arrangements are in place. Internal Audit’s role is to evaluate the effectiveness of such internal control arrangements. Management is responsible for accepting and implementing audit recommendations and bears any risk from not taking agreed action. Internal Audit is not a substitute for an effective system of internal control implemented by management. COUNTER FRAUD WORK The prevention and detection of fraud is a management function and management is responsible for implementing and maintaining suitable systems of control to mitigate the risk of fraudulent activity. Internal audit supports the Council’s commitment to fraud prevention and detection by overseeing data matching exercises carried out under the National Fraud Initiative. The Council takes the threat of fraud or related malpractice seriously and has adopted a Policy to Combat Fraud, Theft, Bribery and Corruption. In addition, a Whistle- blowing Policy has been developed in consultation with the Human Resources service to facilitate the reporting of any concerns. The Financial Regulations provide that whenever any matter arises which involves, or is thought to involve, irregularities concerning cash, stores or other property of the Council or any suspected irregularity in the exercise of the functions of the Council, any Officer having knowledge thereof, shall, as soon as possible, notify Internal Audit. OBJECTIVITY AND CONFLICTS OF INTEREST The Council’s Code of Conduct for Employees sets out the required standards for the conduct of all employees and includes provisions for the declarations of interests, gifts and hospitality. The Internal Audit service preserves its independence and objectivity by ensuring that: staff are free from any conflicts of interest when undertaking assurance audits by following the requirements of relevant professional bodies and HR policies; and by providing clarity on duties undertaken during audit consultancy engagements to ensure these do not impact on assurance audits and do not impair its independence and objectivity. The Audit and Risk Manager has managerial responsibility for the corporate functions and resources, which develop, support and advise on the frameworks in place within the Council on Risk Management, Business Continuity and on Counter Fraud to support Management. In order to prevent a perceived impairment of objectivity and to ensure that Internal Audit independence and impartiality are maintained and demonstrated, no Internal Audit resources will be used in the performance of these functions. Page 66
Page 67
OTHER PARTIES OUTWITH THE COUNCIL The Council’s Audit and Risk Manager is also the Chief Internal Auditor for the Moray Integration Joint Board and the Internal Auditor for the Grampian Valuation Joint Board. While separate and distinct governance arrangements apply to these bodies, the principles outlined in this Charter apply and are adopted in respect of all work completed by Internal Audit. REVIEW The PSIAS requires that the chief audit executive periodically reviews the Internal Audit Charter and presents it to senior management and also to the Board for approval. In this context, the chief audit executive is the Audit and Risk Manager, senior management is the Corporate Management Team, and the Board is the Audit and Scrutiny Committee. Dafydd Lewis Audit and Risk Manager November 2022 Page 67
Page 68
Page 68