Agenda Document Pack - Audit and Scrutiny Committee - 15/02/2023
Moray Council · 15 February 2023
Back to Audit and Scrutiny Committee — 15 February 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 15 February 2023 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 15 February 2023 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of the Meeting of the Audit and Scrutiny Committee of 23 November 2022 5 - 6 4. Written Questions ** 5. Internal Audit Plan - Year Ending 31 March 2024 Report by Depute Chief Executive (Education, Communities and Organisational Development) 7 - 20 6. Internal Audit Section Update Report by Depute Chief Executive (Education, Communities and Organisational Development) 21 - 36 7. Internal Audit Section - Completed Projects Report by Depute Chief Executive (Education, Communities and Organisational Development) 37 - 64 8. Local Government Benchmarking Framework 2020-21 Results Report by Depute Chief Executive (Education, Communities and Organisational Development) 65 - 82 Page 1
Page 2
9. Question Time *** Consider any oral question on matters delegated to the Committee in terms of the Council's Scheme of Administration. Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. *** Question Time - At each ordinary meeting of the Committee ten minutes will be allowed for Members questions when any Member of the Committee can put a question to the Chair on any business within the remit of that Section of the Committee. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than ten minutes after the Committee has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he/she can submit it in writing to the proper officer who will arrange for a written answer to be provided within seven working days. Page 3
Page 4
THE MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor Theresa Coull (Member) Councillor John Cowe (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Clerk Name: Lindsey Robinson Clerk Telephone: 07966 120593 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 23 November 2022 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Councillor Peter Bloomfield, Councillor Tracy Colyer, Councillor Theresa Coull, Councillor John Cowe, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Graham Leadbitter, Councillor Shona Morrison APOLOGIES Councillor Neil McLennan IN ATTENDANCE Also in attendance at the above meeting were the Chief Executive, Head of Governance, Strategy and Performance, Audit and Risk Manager, and Lindsey Robinson, Committee Services Officer as clerk to the meeting. 1. Chair Councillor Graham Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Order 20 and the Councillors’ Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member’s interests in respect of any item on the agenda. 3. Minute of Meeting of the Audit and Scrutiny Committee of 28 June 2022 The minute of the meeting of the Audit and Scrutiny Committee dated 28 June 2022 was submitted and approved. 4. Written Questions ** The Committee noted that no written questions had been submitted. 5. SPSO Recommendations Report A report by the Chief Executive asked the Committee to consider the Scottish Public Services Ombudsman (SPSO) Recommendations report. Following consideration, the Committee agreed to approve the report. 6. Internal Audit Section - Update Report Item 3. Page 5
Page 6
A report by the Depute Chief Executive provided the Committee with an update on the work of the Internal Audit Section. During consideration the Audit and Risk manager advised that, going forward, the reports would include any follow up details. Thereafter, the Committee agreed to note the contents of the report. 7. Internal Audit Section - Completed Projects Report A report by the Depute Chief Executive (Education, Communities and Organisational Development) advised the Committee on the work of the Internal Audit Section for the period from 29 June 2022 to 23 November 2022. During consideration, the Audit and Risk manager advised that the review into Adult Social Care was ongoing and the Chief Executive asked for the following to be noted from Appendix 3 to the report: With consideration to the scope of the planned external review of adult social care commissioning, no further action is required by Internal Audit. However, progress regarding this review will be closely monitored. Thereafter, the Committee agreed to note the contents of the report. 8. Internal Audit Charter A report by the Depute Chief Executive (Education, Communities and Organisational Development) sought Committee approval for a revised Internal Audit Charter that defines purpose, authority, and responsibility of the internal Audit activity within the Council. Following consideration the Committee approved the Internal Audit Charter. 9. Question Time *** The Committee noted that no questions were asked. Page 6
Page 7
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 15 FEBRUARY 2023 SUBJECT: INTERNAL AUDIT PLAN – YEAR ENDING 31 MARCH 2024 BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 This report provides the Committee with details of the planned internal audit coverage for the year ending 31 March 2024. 1.2 This report is submitted to Committee in terms of Section III I (6) of the Council’s Scheme of Administration relating to reporting on Internal Audit’s programme of work. 2. RECOMMENDATIONS 2.1 The Committee is asked to consider and: i) note the proposed Internal Audit coverage for the 2023/24 financial year; and ii) seek clarification on any matters arising from the report or from the attached appendices. 3. BACKGROUND 3.1 The Public Sector Internal Audit Standards (PSIAS) applicable to Local Government in Scotland requires the Audit and Risk Manager to report functionally to the Audit and Scrutiny Committee on various issues relative to audit planning. This requirement includes preparing a risk based internal audit plan for submission to Committee, and providing the Committee with details of internal audit resourcing or other issues that may impact on the scope of audit work. Definition of Internal Audit 3.2 Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. Item 5. Page 7
Page 8
Public Sector Internal Audit Standards (PSIAS) Requirements 3.3 PSIAS sets out the requirement for the: • Audit and Risk Manager to prepare a risk-based audit plan which considers the Council’s strategic objectives, associated risks and the views of senior management and the Committee. • Audit and Risk Manager to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities. • Audit plan to incorporate or be linked to a strategic or high-level statement of how internal audit will be delivered and developed in accordance with the Internal Audit Charter approved by this Committee at its meeting on 23 November 2022 (para. 8 of the minute refers) and how it links to the organisational objectives and priorities. Internal Audit Plan 3.4 The internal audit plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Internal audit’s approach to annual audit planning is risk-based, with all areas which may be subject to audit review contained within an ‘audit universe’. The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. 3.5 The audit universe is risk assessed each year to help determine the annual audit plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Note however, that the audit universe, whilst a key factor, is not the only consideration when determining the audit plan. Senior management have been consulted on priority areas for review, and cognisance is taken of the plans of external audit and other statutory agencies in order to avoid duplication and increase the potential for cross-reliance. 3.6 The audit universe risk assessment is based upon a number of factors including: • Materiality (based on expenditure or income). • Sensitivity (based on whether a service is a statutory duty, statutory power or non-statutory, is customer facing and whether it features as a specific challenge in the Council’s Service Plans). • Time elapsed since an area was last subject to review. • Corporate Risk Register- Assessment of any movement in the assessment of principal risks facing the Council. • Overall audit assessment of the control environment. 3.7 These various sources are designed to enable the Audit and Risk Manager to meet a requirement to provide an annual internal audit opinion on the adequacy and effectiveness of the systems of internal control, for inclusion in the annual governance statement published with the Council’s annual financial statements. Page 8
Page 9
3.8 The plan also takes in specific projects on which the External Auditor will seek to place reliance on by reviewing the audit files and re-performing certain audit tests to validate the work completed. In line with the external audit plan, this will take in: • Housing benefits payments subsidy claim (substantive testing). • National Fraud Initiative (testing of data matches). • Governance and corporate initiatives. 3.9 While internal and external audit roles are separate and distinct, Internal Audit maintains a close working relationship with the external auditor as required to secure an optimum combined benefit from the audit resource and avoid duplication. Public Sector Internal Audit Standards encourage internal audit to consider if there are other bodies whose work internal audit could place reliance on for assurance purposes. 3.10 An additional element of the planning process takes place for the Moray Integration Joint Board (MIJB), the Council’s Audit and Risk Manager, having been appointed as the Board’s Chief Internal Auditor for the period to 31 March 2024. A Moray IJB Audit, Performance and Risk Committee has been established, and a separate internal audit plan is prepared for the Board which has its own governance and accounting arrangements. 3.11 The audit role for the MIJB involves providing assurances that governance and financial arrangements have been developed and are operating in line with policy and that selected systems and processes are suitably controlled. Planned audit inputs have focused on social care services the Council delivers under direction from the MIJB. However, further testing will need to be considered in undertaking additional reviews due to the findings from the audits previously undertaken and the proposed transfer in the delivery of Social Care for Children and Families and the Criminal Justice Services to the MIJB. In recent years links have been established with Internal Audit providers and finance managers in NHS Grampian, Aberdeen City and Aberdeenshire Councils IJBs, and the practice of ensuring appropriate assurances are available continues to be refined with audit processes being developed to allow a more coordinated audit approach. 3.12 The Council’s Internal Audit Service also undertakes internal audit work for the Grampian Valuation Joint Board, which requires the provision of annual assurances on the main financial systems operated for payroll, payments and income from funding requisitions from the constituent authorities and other sources. The Joint Board’s systems align with those of the Council but requires annual review and testing in order to provide assurances for the separate annual financial statements the Board is required to prepare and publish. 3.13 While the prevention of fraud and error rests with management through the design and operation of suitable systems of control, the audit plan continues to Page 9
Page 10
provide time for Internal Audit to coordinate the Council’s participation in the National Fraud Initiative, a data matching exercise involving a range of public sector bodies. This activity is viewed as complementary to other audit activities, and participation assists Internal Audit in assessing the potential for the occurrence of fraud and related fraud risk. Testing will primarily be undertaken by the Services, with Internal Audit undertaking an overview of the process. However, any irregularity or potential fraud will be referred to Internal Audit for investigation. 3.14 The impact of the pandemic has resulted in changes in the working practices of Services with officers working from home. The Internal Audit Section has adapted, and greater use has been made of electronic methods of communication. However, sometimes this has proved challenging and has slowed the pace of audits. Committee should therefore be aware of potential delays in progressing and completing audit reviews remain. 3.15 There is often a need to accommodate additional audit work that may be required to address any emerging issues or specific matters of concern, and the plan provides a number of audit days for this purpose. These days can also be used when the completion of a planned project takes longer than anticipated, either due to the complexity of the project or the identification of a need for additional testing. Where at one time five year audit plans were commonplace, the PSIAS standards now advocate annual planning, noting that ‘the plan should be sufficiently flexible and kept up to date with the organisation and it’s changing risks and priorities’. 3.16 Sufficiently flexible is not defined; however, it suggests that ‘contingency days’ should be held to deal with emerging issues. Thus a proportion of the available audit days are being retained as contingency days which if not used, can accommodate additional audit projects that may be brought into the audit plan later in the year. These projects may be identified by the Audit and Risk Manager as an emerging issue or come from a recommendation by Committee. Details of the available audit days are provided in Appendix 1. Internal Audit Resourcing 3.17 The staff complement of the team is currently 3.8 FTE, including the Audit and Risk Manager who has a range of responsibilities, including the management and supervision of the team, planning work, development of the service, servicing Committees, overseeing the development of business continuity and risk management arrangements and supervising the duties of the Corporate Investigations Officer. On the basis that all posts are filled and allowing for overheads for holidays, training, administration and the like, some 790 working days are available to be allocated for the 2023/24 year. This time is spread over a number of headings, principally audit projects but also work related to governance, business continuity and risk management. In addition, the Audit and Risk Manager has been appointed as the Chief Internal Auditor for the Moray Growth Deal. This requires an overview of the internal audit activity undertaken by partner organisations, in addition to a commitment to reviewing systems and practices on a regular basis. 3.18 Priority areas have been determined by internal audit and are listed in Appendices 2 and 3. Page 10
Page 11
3.19 The Public Sector Internal Audit Standards require the Audit and Risk Manager to consider whether or not the audit staffing resources are sufficient to meet the audit needs of the organisation and where it is believed that the level of resources may adversely impact the provision of the annual internal audit opinion, to draw that to the attention of the Committee. Demands on the Internal Audit Service have increased over the years, and it is expected this will continue. After a review of the staffing establishment, the Council agreed that the Internal Audit Service required additional staff resources in the form of an Assistant Auditor. Unfortunately, due to the current financial climate, the decision to progress with this appointment has been deferred for a year. As the Audit and Risk Manager, I am therefore concerned that available resources will be sufficient to meet the needs of the Council, Moray IJB and the Grampian Valuation Joint Board. . 3.20 In considering the sufficiency of the audit coverage, Committee is reminded that the responsibility for developing and maintaining a sound control environment rests with management and not with Internal Audit. 4 SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) No direct implications. (b) Policy and Legal The activities of Internal Audit assist the organisation to demonstrate the control environment and risk management arrangements are consistent with good practice. (c) Financial Implications No direct implications. (d) Risk Implications The work of internal audit mitigates the risk of dilution of controls established within systems to ensure best value is secured in the use of public resources. (e) Staffing Implications No direct implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations Planned audit work is informed throughout the year from various Page 11
Page 12
sources including service managers and the external auditor. 5 CONCLUSION 5.1 This report invites the Committee to consider and note the planned Internal Audit coverage for the 2023/24. Authors of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-129 Page 12
Page 13
Appendix 1 MORAY COUNCIL INTERNAL AUDIT ANNUAL AUDIT PLAN – 2023/24 Staff Resources Available Days 3.8 FTE staff x 52 weeks x 5 days 988 Less: Overheads: Annual Leave (including public holidays) 152 Training 20 Sick Leave (Estimate) 18 Administration 8 198 Available Days 790 Allocation of Days Core Financial Systems (Appendices 2 & 3) 125 Departmental Audit Projects (Appendices 2 & 3) 285 Moray Integration Joint Board 80 Management, Supervision and Service Development 50 Risk Management & Business Continuity 30 Governance Statement / Corporate Initiatives 40 PSIAS- External Review 40 National Fraud Initiative (oversight and reporting) 20 Grampian Valuation Joint Board 10 Follow-up Work 30 Contingency 80 790 Item 5. Page 13
Page 14
Page 14
Page 15
Appendix 2 MORAY COUNCIL – INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2023/24 LIST OF PROPOSED PROJECTS CORE FINANCIAL SYSTEMS Audit Area Total Days Housing Benefits Subsidy Claim and 30 Testing Procurement and Creditor Payments 30 Payroll 30 Debtors 25 Year-end Stock Taking 10 125 OTHER SYSTEMS Departmental Projects per Appendix 3 285 Risk Management & Business Continuity 30 Governance and Corporate Initiatives 40 PSIAS- External Review and Self-Assessment 40 Management and Supervision 50 Moray Integration Joint Board 80 Grampian Valuation Joint Board 10 National Fraud Initiative 20 Follow up work 30 Contingency/ Consultancy 80 Total – Other Systems 665 GRAND TOTAL 790 Item 5. Page 15
Page 16
Page 16
Page 17
Appendix 3 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2023/24 CORE FINANCIAL SYSTEMS Area Type of coverage Corporate Risk Register (Control Assurance) Housing Benefits - Rent Rebates and Rent Allowances Substantive testing of selected benefit claims to confirm the accuracy of the Council’s benefit subsidy claim Regulatory Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries Financial Procurement and Creditor Payments Continuous auditing of samples of non-pay expenditure to test compliance with procurement and payment processing regulations Financial Debtors A review of the system for income collection through invoicing and debt recovery arrangements Financial Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances Regulatory OTHER SYSTEMS Area Type of coverage Transformation Programme Review of the Transformation Programme to assess progress and planned outcomes are on course to be achieved Operational Housing and Property- Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing) Operational Environmental Services – Grant Claims Certification of grant claims as required: strategic timber; bus operators, regeneration schemes as appropriate Regulatory Pool Cars Review of operating arrangements for the administration and use of Pool Cars Environmental E-Mail Security A review of procedures and system controls used to administer the email system. IT Item 5. Page 17
Page 18
Appendix 3 Moray Growth Deal A follow up review to evidence implementation of the recommendations agreed within a recent audit undertaken of the governance and administrative arrangements within the management of the Moray Growth Deal Economic Education – Secondary School Establishment visits as part of cyclical review Operational Purchasing Cards Review the systems and procedures for the management, use and control of Purchasing Cards Financial ICT Disaster Recovery Review to evaluate the effectiveness of the processes and controls surrounding Information Technology Disaster Recovery Management IT Food Standards Scotland Guidelines A review of systems and practices used to evidence compliance with the new Food Standards Scotland Guidelines Environment Leisure Services – Sports and Community Centre A review of the arrangements for the accounting of income and expenditure at Keith Sports and Community Centre. The audit will also check procedures comply with the Payment Card Industry Data Security Standard Operational Burial Services Review of the arrangements for the management of the burial service including a check of the income collection procedures for the collection of interment fees and sale of lairs Regulatory Refugee Integration Scheme Review of systems and procedures to account for grants received and costs relating to Refugee Integration Operational Education- Early Learning and Childcare Premises Security Review the controls in place to mitigate the risk of unauthorised access or egress to Early Learning and Childcare Establishments Operational Moray Integration Joint Board Commissioning Services Review of the arrangements for the commissioning of services for children to ensure these are designed and delivered to meet the specified needs and demonstrate best value Regulatory Page 18
Page 19
Appendix 3 Disabled Parking System Review of the system for administering the disabled parking permits are also known as Blue Badges Operational Occupational Therapy Services – Stores A review of the Occupational Therapy Stores Systems to ensure appropriate accounting systems are followed Operational Page 19
Page 20
Page 20
Page 21
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 15 FEBRUARY 2023 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III I (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on Internal Audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2022/23 AUDIT PLAN Audit Plan Update 4.1 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed as Appendix 1 is an update on the progress undertaken by the Internal Audit Service regarding the completion of audit review projects against the Annual Audit Plan. Item 6. Page 21
Page 22
4.2 I am pleased to report that the majority of the Audit Plan should be completed within 2022/23. However, I intend to carry forward a planned review of a project within the capital programme to a future Audit Plan. Additional testing has been required during the year due to special investigations concerning the payroll system and overtime payments made to officers within Building Services. In addition, the duties of an Auditor had to be reassigned to complete data- matching investigations concerning the Council’s participation in the National Fraud Initiative. This was due to the Corporate Investigations Officer being on long term sick leave. Public Sector Internal Audit Standards 4.3 Internal performance monitoring against PSIAS has been ongoing over the last few years. However, a more structured internal assessment has recently been completed in preparation for the next External Quality Assessment, scheduled for later in 2023. Enclosed in Appendix 2 is an Action Plan detailing recommendations for compliance with PSIAS. 4.4 All Scottish Local Authorities are required to have an External Quality Assessment (EQA) every 5 years. As part of the Council’s membership of the Scottish Local Authorities Chief Internal Auditors’ Group, it was agreed that this EQA requirement would be met by each local authority internal audit service undertaking a review of another council and will thereafter receive a review in return. An assessment of the Highlands Council’s Internal Audit Service compliance with the Public Sector Internal Audit Standards is currently ongoing. Follow Up Reviews 4.5 Internal Audit reports are regularly presented to elected members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up review: Planning Fees 4.6 An audit was undertaken into the accounting arrangements for collecting and accounting of planning fees income. Planning application fees are set for all Scottish Local Authorities by the Scottish Government (Town and Country Planning (Scotland) Regulations). Approximately £833,000 of planning fees income was received by the Council in 2021/22. The audit also reviewed other related services, including pre-application advice, development enquiries, recovery of neighbour notification advertisements and non-material variation orders. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 3. Page 22
Page 23
5 SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report.. . (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis, Audit and Risk Manager Internal Audit files Ref: SPMAN-1042990102-133 Page 23
Page 24
Page 24
Page 25
Appendix 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2022/23 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Housing Benefits - Rent Rebates and Rent Allowances Substantive testing of selected benefit claims to confirm the accuracy of the Council’s benefit subsidy claim Final report issued Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations Final report issued Payroll Regularity testing to confirm the adequacy of the systems and procedures for the payment of salaries to selected staff groups Final report issued Capital Plan Audit testing of contract management arrangements for selected projects within the capital plan Deferred to a future Audit Plan Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances Work Completed Cyber security Identification and assessment of the potential threats to the council’s ICT systems and how these are being managed Final report issued Item 6. Page 25
Page 26
Appendix 1 OTHER SYSTEMS Area Type of coverage Collection and accounting of planning fees Review the accounting arrangements for the collection, recording etc of planning fees Final report issued Housing and Property- Planned Maintenance Works Audit of works allocation, completion and inspection across planned programme repairs (Council Housing) Draft Report issued Environmental Services – Grant Claims Certification of grant claims as required: strategic timber; bus operators, regeneration schemes as appropriate Fieldwork completed and claim certified as correct General Data Protection Regulation A review of the Council systems to ensure compliance with General Data Protection Regulation Final report issued Environmental Services – Stores A review of the Environmental Services Stores Systems to ensure appropriate accounting systems are followed Fieldwork in progress Refuse Collection (Domestic) A review of the current arrangement for the collection of refuse materials for domestic properties. The audit will also cover arrangements for collection, disposal of recyclable materials Final report issued Moray Growth Deal An overview of the governance and administrative arrangements within the Council for the management of the Moray Growth Deal Final report issued Education – Secondary School Establishment visits as part of cyclical review Fieldwork in progress Emergency Planning A review of the Council’s Emergency Planning arrangements Draft Report issued Page 26
Page 27
Appendix 1 European Social Fund Review of the European Social funding arrangements in subsidising the cost for delivery of the Moray Council Money Advice Service Fieldwork in progress Corporate Services - ICT Hardware Asset Management Review of systems and practices to record / monitor the location and use of ICT hardware Fieldwork in progress Moray Integration Joint Board Care First System An exercise to assess system management, security and resilience of the Care First System used for the recording and management of service users data Final report issued Self Directed Support Review of Self Directed Support financial monitoring arrangements regarding Option 2/3 where care support packages to service users are managed by the Moray Council or an Individual Service Fund (ISF) Provider Fieldwork in progress Information Management Ensure appropriate systems exist in the management and security of data including the transfer of data between Local Authorities and the NHS Final report issued Page 27
Page 28
Page 28
Page 29
Appendix 2 Moray Council Internal Audit Section 1 Recommendations - Internal Audit Section – Public Sector Internal Audit Standards Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Internal Audit governance and operating arrangements comply with the Public Sector Internal Audit Standards. 5.01 A copy of the Internal Audit Charter should be issued to all officers within the Internal Audit Section. (PSIAS Ref: 1100.8) Low Yes Further to the approval of the Internal Audit Charter at the Audit & Scrutiny Committee on 23 November 2022, a copy will be provided to all officers of the Internal Audit Section. Audit and Risk Manager 23/11/2022 Item 6. Page 29
Page 30
Appendix 2 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.02 In accordance with the Public Sector Internal Auditing Standards, Committee Reports from the Internal Audit Service to elected members should be from the Audit and Risk Manager. (PSIAS Ref: 1100.1/2600.1) High Yes Depute Chief Exec. Education, Communities & Organisational Development Immediate 5.03 The Council’s Annual Governance Statement (AGS) is prepared by the Audit and Risk Manager, in addition to providing an annual opinion report on the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control. Medium Yes The Annual Governance Statement will be prepared in future by the Head of Governance, Strategy & Performance with the support of the Business Head of Governance, Strategy & Performance Immediate Page 30
Page 31
Appendix 2 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Preparation of the Annual Governance Statement should be undertaken by an officer out with the Internal Audit Section. (PSIAS Ref: 1100.9/2400.12/2600.1) Continuity and Risk Management Officer. 5.04 Consideration should be given to the development of Assurance Mapping to aid the preparation of the Annual Internal Audit Plan. (PSIAS Ref: 2000.2/2000.10) Low Yes This issue has been raised within the Scottish Local Authority Chief Internal Auditors Group with the intention of developing a consistent methodology. Audit and Risk Manager Ongoing Page 31
Page 32
Appendix 2 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.05 Findings from follow-up reviews should be reported to Audit & Scrutiny Committee on a regular basis. (PSIAS Ref: 2500.2) Medium Yes Findings from follow-up reviews will be reported within an Update Report to Audit & Scrutiny Committee on a regular basis. Audit and Risk Manager 23/11/22 Page 32
Page 33
Appendix 3 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Planning Fees REPORT REF: 23'010 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Processes are in place to separately and correctly identify different income sources for monitoring purposes. 5.01 Consideration should be given to regularly reviewing the Financial Management System to ensure the coding of income reflects the category of planning fees being collected. Any miscodings should be moved to the correct financial code. Low Yes 31/07/2022 Implemented. The follow up review found that codings are checked within the Financial Management System on a weekly basis to keep information current and correct. Weekly checks were noted to have commenced on 28/6/22. Item 6. Page 33
Page 34
Appendix 3 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Fees are only refunded in specific stated circumstances where no services have been provided and are appropriately authorised. 5.02 All refunds should be authorised by the budget manager or other approved authoriser in line with the Council's Authorisation Policy. Medium Implemented 15/6/2022 Implemented. A random sample of recent refunds was selected and found to be authorised by the budget manager in line with the Council's Authorisation Policy. Key Control: Fees are fully and accurately recorded and are in line with budgetary expectations. 5.03 Consideration should be given to undertaking regular reconciliations between the Uniform planning software application and the Council's Financial Management System to verify the accuracy of both databases. This exercise will also complement recommendation 5.01 to ensure the correct coding of planning fees income. Low Yes 31/07/2022 Implemented. As with recommendation 5.01, the Service had decided to undertake weekly reconciliation checks to ensure systems are continually updated and accurate. The follow- up review has confirmed that all fees collected are correctly recorded within the Planning Uniform System and the Financial Management System. Page 34
Page 35
Appendix 3 Moray Council Internal Audit Section Page 35
Page 36
Page 36
Page 37
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 15 FEBRUARY 2023 SUBJECT: INTERNAL AUDIT SECTION – COMPLETED PROJECTS REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 24 November 2022 to 15 February 2023. 1.2 This report is submitted to Committee in terms of Section III I (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the Internal Audit work concluded during the period 24 November 2022 to 15 February 2023. Core Financial Systems- Housing Benefits - Rent Rebates and Rent Allowances 3.2 An annual input on the grounds of materiality alone is a review of the Housing Benefits Subsidy. The council pays approximately £13 million annually, the bulk of which is funded by the Department of Work and Pensions. Certification is required to confirm the accuracy of the amount claimed, and this requires detailed testing of a sample of claims. The external auditor undertakes the certification but primarily relies on Internal Audit to complete this work. The executive summary for this project is given in Appendix 1. Item 7. Page 37
Page 38
Core Financial Systems- Payroll System 3.3 A review has been undertaken of the payroll system. The payroll system is one of the core financial systems of the Council in administering approximately £80 million of annual expenditure. The audit reviewed the key controls in the management of the payroll service. This involved an assessment of the operational effectiveness of these controls. Audit testing included the random selection of a sample of salary payments and deductions to ensure the correct calculation of remuneration and statutory/ voluntary deductions are processed timeously and accurately. The Chartered Institute of Public Finance and Accountancy Control Matrices were used to develop an audit programme. Further to an incident regarding the unauthorised access to an officer’s Employee Self-Service account, additional testing was also undertaken regarding access controls to the Employee Self Service System, where officers can amend their personal information, including bank details. 3.4 A payroll software application called iTrent is used to administer the payroll service. It was noted that approximately 5000 officer payslips are processed every month. The iTrent system has a dual function of meeting the requirements of two main service areas, i.e., payroll and human resources. The executive summary and recommendations for this project are given in Appendix 2. Departmental Systems – Moray Growth Deal 3.5 This audit reviewed the processes established for the Moray Growth Deal's governance, administration, finance, risk, engagement, and performance management. The Moray Growth Deal is a transformational investment of over £100million in the next 10 years for eight strategic projects intended to maximise regional economic competitiveness and boost economic growth across the Moray area. The Moray Growth Deal brings together the Scottish and UK Governments, Moray Council, partners from across the public and third sector and businesses to work collaboratively in delivering the Deal’s vision for the area. Moray Council is the accountable body for the Growth Deal and has the responsibility to hold to account partner organisations in the delivery of the overall programme. Each partner organisation will be separately responsible for allocating its own internal audit resources. The Deal is still at an early stage of implementation. The executive summary and recommendations for this project are given in Appendix 3. Departmental Systems – General Data Protection Regulation 3.6 A review has been undertaken of Council systems to ensure compliance with the United Kingdom's General Data Protection Regulation (GDPR). The General Data Protection Regulation is a 2016 European Union Regulation that was incorporated into the United Kingdom Data Protection Act 2018. The audit reviewed systems and controls to ensure the Council is fulfilling the requirements of GDPR. The review sought to confirm the required policies, procedures and guidance are in place; there is awareness throughout the Council with comprehensive training programmes and effective oversight and governance arrangements to monitor ongoing compliance with GDPR. The executive summary and recommendations for this project are given in Appendix 4. Page 38
Page 39
Departmental Systems – Information Management 3.7 An audit has been undertaken to review that an appropriate system exists in the management, security and transfer of data between the Council and care providers, including NHS Grampian. In recent years, discussions have been held with the internal audit providers of NHS Grampian, Aberdeen City and Aberdeenshire Councils, where it was agreed to better coordinate the audit process with the intention of providing a more comprehensive opinion on the control environment of systems within Health and Social Care. As a result, all of the internal audit service providers agreed to undertake an audit of Information Management as the first step in this process. 3.8 Unfortunately, after the agreed start for the review, I was informed by the NHS Internal Audit Provider they could no longer undertake the audit as a review by the Information Commissioner has taken precedence. As the audit within the Council was already well progressed, the audit was completed in accordance with the Audit Plan. The executive summary and recommendations for this project are given in Appendix 5. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. Page 39
Page 40
5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-137 Page 40
Page 41
Appendix 1 AUDIT REPORT 23’005 HOUSING BENEFITS SUBSIDY REVIEW EXECUTIVE SUMMARY A review has been undertaken of the Council’s Housing Benefits Subsidy Claim in accordance with the 2022/23 Internal Audit Plan. The administration of the Housing Benefits system is a major activity for the Council. The Housing Benefits Team processes claims received from individuals requesting assistance for paying their rent and council tax. Claims are assessed and administered in accordance with the regulations detailed by the Department for Works and Pensions (DWP). Housing Benefits expenditure is reclaimed by the Council from the DWP by completing a Subsidy Claim Form. The total subsidy claimed for 2021/22 amounted to approximately £12.7 million. Approximately £6.9 million is related to the private rental sector, and the balance for claimants within Council owned properties. Housing Benefits expenditure has been declining since the introduction of Universal Credit, with new benefit claims for working age claimants becoming the responsibility of the DWP. It was noted there has been a £1 million reduction in the subsidy claimed compared to 2020/21. The External Auditor is required to verify the claim by testing a sample of individual benefit claims to confirm the accuracy of each award. The Council uses a computer software system to administer all benefit awards, subsidy calculations, etc. As part of a joined up audit approach, it was agreed that Internal Audit would undertake the majority of the testing and the External Auditor would thereafter review to ensure completeness and accuracy prior to their certification. The testing required all details for processing each claim to be recorded within a database provided by the DWP. This involved cross referencing all processing entries to the original supporting evidence logged on document imaging software. The testing also confirmed the calculated benefit award to the actual benefit paid out to the claimant. The regulations detailing the various elements of a benefit award can be complex and detailed. The audit found that in all cases sampled, agreement was found between the benefit paid when compared to the re-calculation of the award using the testing database. This is a positive outcome from the sample testing undertaken, given the volumes and complexities of cases involved. This annual review is time consuming and technically demanding due to the complexity of the Regulations and the need for referencing entries within the database to the original source documents. The assistance provided by officers of the Benefits and Money Advice Service was much appreciated during this review. Item 7. Page 41
Page 42
Page 42
Page 43
Appendix 2 AUDIT REPORT 23’018 PAYROLL SYSTEM Executive Summary A payroll software application called iTrent is used to administer the payroll service. It was noted that approximately 5000 officer payslips are processed every month. The iTrent system has a dual function of meeting the requirements of two main service areas, i.e., payroll and human resources. This allows segregation of duties control to ensure a separation between the management process concerning officer appointments, terminations, grading and the processing of salary payments. The scope of the audit involved a review of the key controls in the management of the payroll service. As verification of the operational effectiveness of these controls, the audit reviewed systems and procedures and tested a random sample of salary payments and deductions. The Chartered Institute of Public Finance and Accountancy Control Matrices were used in the development of an audit programme. Further testing was also undertaken regarding access controls to the Employee Self Service System, where officers can amend their personal information, including bank details. The audit was carried out in accordance with the Public Sector Internal Audit Standards (PSIAS). The areas identified for management attention include the following:- • It is pleasing to note that an establishment listing exercise was undertaken in March 2022. This involved an email from the Human Resources Section to every budget manager to request confirmation or changes required to the names, grades, locations and salary details of officers recorded within their services. This exercise is an important control to confirm the accuracy of the payroll system. However, it was found where the budget manager had not replied, no further action was undertaken, or the issue escalated to a Head of Service. • It was noted that the Human Resources Section provides an occupancy end date report to budget managers of employees due to terminate their contract of employment the following month. This report reminds budget managers of the need to complete a “Termination of Employment” Form or update the employee's employment status. Analysis undertaken of the iTrent system found 252 individuals still recorded as officers of the Council, but where records indicate a termination in their employment status. Audit testing found the issue to be an administrative requirement to update officers’ employment status rather than a salary overpayment. The occupancy end date report provided to budget managers should be expanded to include employees recorded as officers of the Council but where records indicate a termination in their employment contracts. Item 7. Page 43
Page 44
Appendix 2 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Review internal controls as detailed within the CIPFA Control Matrices to ensure effective delivery of a payroll service. 5.01 Email requests to the Payroll Section to reset an officer’s access to their Employee Self Service Account should only be accepted from a Moray Council email address or a prior registered personal email account. High Yes In place Assistant Payroll Officer Completed 5.02 Officers should be reminded to record memorable information within their Employee Self- Service accounts. This will allow an additional level of system security to confirm identity before an officer can reset their password. Medium Yes Reminders to go into staff comms. via interchange and Connect Assistant Payroll Officer / Acting Senior Comms. Officer 28/02/2023 5.03 The Human Resources Section should undertake an annual exercise with budget managers to confirm the names, grades, locations and salary details of officers within their Service. High Yes Procedure has been updated re previous schedule (3 times per year) for issue, HR & Business Resources Team Leader Completed Page 44
Page 45
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation process for non- responders and timeframe to action changes. 5.04 All budget managers should be reminded of the importance of confirming or advising Human Resources of any changes required to the establishment list reports of officers recorded within their services. If the budget manager does not respond, the issue should be referred to the appropriate Head of Service. Consideration should be given by Human Resources to allocate resource to ensure that any amendments highlighted by Budget Managers can be actioned as quickly as possibly following notification from the service. High Yes Covering email content updated to emphasise importance of completion, procedure updated to include indicative timescales to allow for planned allocation of resources to action any non- responses, escalation procedure for non-responses amended and escalation to Head of Service level if required. HR & Business Resources Team Leader 31/03/23 Page 45
Page 46
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.05 Occupancy end date reports issued to budget managers of employees due to end their employment with the Council the following month should be expanded to include all officers whose records indicate their employment contract has ended. The budget manager should advise the Human Resources Section of any changes required to the employment status of officers within their services. High Yes Report amended as recommended and procedures updated to escalate non responses to head of service. HR & Business Resources Team Leader Changes to report made. Updated procedures live from February 2023 Page 46
Page 47
Appendix 3 AUDIT REPORT 23’013 MORAY GROWTH DEAL Executive Summary The annual audit plan for 2022/23 provides for a review of the governance and administrative arrangements that the Council has established to support the delivery of the Moray Growth Deal. The Moray Growth Deal (the Deal) is a transformational investment of over £100 million in the next 10 years for eight strategic projects intended to maximise regional economic competitiveness and boost economic growth across the Moray area. The Deal provides an opportunity to build on the existing strengths of Moray’s culture, tourism, and manufacturing sectors whilst also addressing transport and housing challenges to facilitate economic growth that is sustainable, fair and inclusive. The Deal will also support major new developments in key sectors of health and aerospace, as well as early years education, all of which will expand Moray’s Science, Technology, Engineering and Mathematics (STEM) skills base to enable local people to develop the skills needed to access high quality jobs and tackle gender imbalances in key sectors of our economy. The Deal brings together the Scottish and UK Governments, Moray Council, partners from across the public and third sector and businesses to work collaboratively in delivering the Deal’s vision for the area. Moray Council is the accountable body for the Deal and has the responsibility to hold to account any partner organisation in the delivery of the overall programme. The Moray Council and each partner organisation will be separately responsible for allocating internal audit resources for the Deal’s activities. However, Moray Council’s Internal Audit Section will reserve the right to review programme and project activities and request information from all partners regarding these activities. It is appreciated the Deal is still at an early stage of implementation. The scope of this audit has therefore been limited to a review of the processes established for governance, administration, finance, risk, engagement and performance management. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The audit noted the following areas for management consideration:- • Each of the eight projects are intended to achieve economic benefits. A requirement of the Deal Agreement is to monitor the progress in the implementation of these projects and evidence the delivery of these economic benefits. A monitoring framework should be established and implemented to measure and record the benefits achieved for each project against their respective business plans. Item 7. Page 47
Page 48
Appendix 3 • During the audit difficulties were experienced in locating requested information. Documents are saved within the Council’s document management system called SharePoint. However, inconsistencies were found in the naming and location of where information had been saved. The recently appointed Programme Manager has recognised this and is working towards resolving the situation. Clear guidelines should be developed to ensure consistent practices are followed in the saving of documents. • A requirement of the Financial Plan of the Deal is for each Partner Organisation to be separately responsible for allocating internal audit resources. However, the Audit and Risk Manager of the Council is responsible for reviewing the audit activities for each Partner Organisation. The Annual Audit Plan for each Partner Organisation detailing the internal audit work planned regarding the Moray Growth Deal should be forwarded to the Moray Council as the Accountable Body every year. This will then provide the opportunity for the Audit and Risk Manager to review planned activity and to request any additional information. Page 48
Page 49
Appendix 3 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Ensuring the governance arrangements supporting the delivery of the Growth Deal are adequate and proportionate 5.01 A formalised monitoring framework should be agreed to measure and record the benefits achieved for each project against their respective business plans. High Yes This will be a key output that is part of wider work initiated in August 22 to develop a Benefits Realisation Plan for the MGD Programme Manager 30/06/2023 5.02 In accordance with the Stakeholder Engagement Plan, ongoing communication should be undertaken to highlight the actions undertaken within the Moray Growth Deal. This should also include the updating of the Communications Plan to reflect planned activity beyond September 2022. Medium Yes A robust stakeholder plan will be created covering planned communication and engagement activity that will be led by the Project Managers Programme Manager 31/03/2023 Page 49
Page 50
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.03 Guidelines should be developed to ensure consistent practices can be followed in the saving of documents and naming conventions within the SharePoint document management system. Medium Yes The MGD Programme Team will develop a new SharePoint site to store and archive documents Programme Manager 31/03/2023 5.04 Consideration should be given to providing elected members with a briefing session regarding the Scrutiny Checklist detailed within the Audit Scotland published report on Scotland’s City Region and Growth Deals of January 2020. High Yes A briefing on the scrutiny checklist will be incorporated into a wider MGD Elected Member engagement event that will take place in early 2023 Programme Manager 31/03/2023 5.05 Each Partner Organisation should provide their Annual Audit Plan to the Moray Council of planned internal audit activity regarding Moray Growth Deal Activities. These Plans should then be forwarded to the Audit and Risk Manager for review. Medium Yes Plans for how Highlands and Islands Enterprise (HIE), the University of the Highlands and Islands (UHI) and the Programme Manager 31/12/2022 Page 50
Page 51
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation University of Strathclyde intend to audit MGD activity led by them will be obtained and provided to the Audit and Risk Manager Page 51
Page 52
Page 52
Page 53
Appendix 4 AUDIT REPORT 23’015 UK GENERAL DATA PROTECTION REGULATION Executive Summary The annual internal audit plan for 2022/23 provides for a review to be undertaken of the Council systems to ensure compliance with United Kingdom's (UK) General Data Protection Regulation. The General Data Protection Regulation (GDPR) was a 2016 European Union regulation that came into force in May 2018, at the same time as the UK's updated Data Protection Act 2018 (DPA). Since the UK's departure from the European Union, GDPR has been adopted into UK regulation and sits alongside DPA 2018; together they introduce stronger legislation on the handling of personal data. The Council processes an individual's personal data in order to plan, run and improve its services, perform its statutory duties, carry out its regulatory, licensing and enforcement roles, make payments, administer benefits and identify fraud and improve the health of the population it serves. The UK General Data Protection Regulation regulates and protects the processing of personal data about individuals by using the law to protect data and the way it is used by Local Authorities. The scope of the audit reviewed systems and controls to ensure the Council is fulfilling the requirements of UK GDPR. The review sought to confirm the required policies, procedures and guidance are in place, there is awareness throughout the Council with comprehensive training programmes and effective oversight and governance arrangements to monitor ongoing compliance with UK GDPR. Failures that result in a breach of an individual's personal data may result in the Information Commissioner's Office issuing a fine to the Council. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Difficulties were experienced during the audit in the provision of information required for this review. This resulted in a delay in the completion of the audit; consideration will therefore be required to undertake further audit testing regarding the Council's compliance with data protection regulations in a future Audit Plan. Findings from the audit undertaken noted the following areas for consideration:- • UK GDPR requires the Council to undertake regular monitoring of policy compliance to ensure data handling and security controls are operating effectively in practice. This is not being undertaken. Further monitoring arrangements should be introduced to evidence compliance with UK GDPR and the Council's Data Protection Policy. Item 7. Page 53
Page 54
Appendix 4 • It was noted that the Council does not maintain an Information Asset Register or a formal Record of Processing Activities. A requirement of UK GDPR is a need to record data flows and document a register of personal data. This should also assist in facilitating a risk assessment of information areas where further controls may be required. • It was pleasing to note that officers need to complete Council online training modules on data protection. However, no monitoring of participation has been undertaken. A review should be done to highlight officers that have not completed this training module. Any officer identified should be reminded to undertake their data protection training requirement. Page 54
Page 55
Appendix 4 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: The Council has the appropriate procedures and controls in place to protect information, fulfilling the requirements of GDPR. 5.01 The Data Protection Policy and guidance should be reviewed to ensure the detailed information remains current and appropriate. Thereafter, a timetable for continued review should be set. Medium Yes Task already identified and awaiting workload capacity. Records & Heritage Manager and Data Protection Officer 31/01/2023 5.02 In compliance with UK GDPR, a Record of Processing Activities (ROPA) should be compiled by the Authority based on a data mapping exercise. High Yes A Data Protection Review is already underway with the Information Governance Officer post now in place. Information collected from the 2018 GDPR introduction work will form the basis of this review. A finalised ROPA and Information Records & Heritage Manager and Data Protection Officer 31/12/2023 Page 55
Page 56
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Asset Register will be produced, and retentions, privacy notices and training all highlighted too. 5.03 In compliance with UK GDPR, an Information Asset Register should also be compiled and maintained on an ongoing basis. High Yes Records & Heritage Manager and Data Protection Officer 31/08/2023 5.04 A review of Privacy Notices held within Council services should be progressed and the documents made available on the Council website for public inspection. Medium Yes Privacy notices (PNs) are covered in the current DP Review, as the current PNs are updated or new PNs created they are made available on the Council's website. After the review this will be an ongoing process whenever a change in the data process Records & Heritage Manager and Data Protection Officer 31/08/2023 Page 56
Page 57
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation occurs. 5.05 Consideration should be given to undertaking reviews within Services to audit compliance with the Data Protection Policy and Guidance. This should provide assurance that the Authority is effectively handling personal data in line with regulations. High Yes Current DP Review will assist this. Due to workload pressures, reviews will only be undertaken when investigating data breaches. Records & Heritage Manager and Data Protection Officer 31/08/2023 5.06 A review of the guidance documents and forms held within the Information Management section of the Interchange should be undertaken and updated accordingly. Low Yes When workload capacity allows, these guides are reviewed, updated and promoted. Records & Heritage Manager and Data Protection Officer 30/09/2023 5.07 A review should be undertaken of the officers that have not undertaken the data protection training on the LearnPro training system. Any officer identified should be reminded to undertake their data protection training requirement. High Yes Staff are reminded to do training via interchange news items and in response to data breaches. However, policing the completion of Records & Heritage Manager and Data Protection Officer 30/04/2023 Page 57
Page 58
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation mandatory modules could be given a higher priority. 5.08 Consideration should be given to providing elected members with an update of actions undertaken to ensure the Council's compliance with data protection requirements. High Yes Agreed this should become a regular annual report. Records & Heritage Manager and Data Protection Officer 31/12/2023 Page 58
Page 59
Appendix 5 AUDIT REPORT 23'009 INFORMATION MANAGEMENT Executive Summary The annual audit plan for 2022/23 provides for an audit review of the systems and procedures in the management and security of adult social care information, including the transfer of information between the Council to NHS Grampian and other care providers. This review should also complement the recent audit undertaken regarding the Council’s compliance with the UK General Data Protection Regulation. Effective information controls within adult social care are particularly important due to the sensitive nature of information held concerning service users. In addition, the Council has duties under data protection regulations, and breaches of these regulations can result in substantial financial penalties being levied by the Information Commissioner’s Office. In recent years, discussions have been held with the internal audit providers for NHS Grampian, Aberdeen City and Aberdeenshire Councils. The intention has been to develop closer working relationships to better coordinate the audit planning process within social care. An audit of Information Management was agreed as the first step within this process. This has progressed well with a joint approach undertaken, especially within the Internal Audit Services of Aberdeen City, Aberdeenshire and Moray Councils. However, further to a recent communication, it has not proved possible for the NHS Grampian Internal Audit Provider to participate as a review by the Information Commissioner has taken precedence. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The review has highlighted the following areas for consideration:- • The Information Commissioner considers it is good practice to have a data sharing agreement when information is shared between two organisations. Data sharing agreements set out the purpose of the data sharing, cover what happens to the data at each stage, set standards, and help organisations involved in sharing to be clear about their roles and responsibilities. It was found that the data sharing arrangements for patient/ service user information between the Council and NHS Grampian are still based on a Memorandum of Understanding from 2011. Consideration should be given to agreeing on a Data Sharing Agreement between the Council and NHS Grampian to reflect the updated Data Protection Legislation. Item 7. Page 59
Page 60
Appendix 5 • A Data Protection Impact Assessment (DPIA) is an essential part of the Council's accountability obligations under the UK General Data Protection Regulation (GDPR). A DPIA is a process to help identify and minimise data protection risks. Information regarding adult social care service users are shared with approximately 80 care providers. However, it was found that only one DPIA had been completed regarding these data sharing arrangements. • The Council uses a software application to schedule visits for care workers to service users. Details held within this software include personal information concerning individuals receiving care. The software application is administered through desktop computers but with a facility to download information to a mobile device used by carers. Access controls were found to have been installed within the mobile devices; however no individual user login or password was required to access the desktop computers used for administering the software application. Page 60
Page 61
Appendix 5 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Arrangements are in place for secure handling of personal data. 5.01 Data Protection Impact Assessments (DPIAs) should be undertaken to determine whether additional safeguards need to be implemented where information concerning service users is shared with care providers. High Yes DPIAs are to be carried out on all processes, including for new contracts where data sharing is required with partners. Records and Heritage Manager, and, Data Protection Officer/ Commissioning Manager 31/12/2023 5.02 Assurances should be obtained that appropriate data protection training has been undertaken by NHS Grampian employed officers requiring access to Council administered databases. Medium Yes Arrangements to be put in place to confirm that Data Protection training has been received by NHS staff prior to being given access Information Systems Officer 31/03/2023 Page 61
Page 62
Appendix 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation to Council systems. 5.03 Access to the Staffplan Software Application used to schedule visits by Care Workers to service users should require individual user login and password controls. Medium Yes Password Protection facility to be utilised for Staffplan office based access. Provider Services Manager 31/03/2023 5.04 Regular reviews should be undertaken to confirm the access requirement to the Occupational Therapy Stores Management System by NHS Grampian employed officers. Medium Yes Develop procedure for confirming current NHS staff access requirements to Council systems. Information Systems Officer 31/03/2023 Page 62
Page 63
Appendix 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Appropriate security controls operate within Information sharing arrangements 5.05 The Council and NHS Grampian should agree on an updated Data Sharing Agreement (DSA) for operational information concerning service users that includes the requirements of the current data protection regulations. Medium Yes Overarching Information Sharing Protocol with NHS Grampian to be updated and signed. Dedicated DSAs then to be completed for individual processes. Records and Heritage Manager, and, Data Protection Officer/ Commissioning Manager 30/06/2023 5.06 Contract compliance visits to care providers should include a review that appropriate systems are being followed to manage and ensure the security of service user information. Medium Yes Contract Monitoring checklist for external providers updated to include Information Management. Commissioning Manager Implemented Page 63
Page 64
Page 64
Page 65
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 15 FEBRUARY 2023 SUBJECT: LOCAL GOVERNMENT BENCHMARKING FRAMEWORK 2020-21 RESULTS BY: DEPUTE CHIEF EXECUTIVE (EDUCATION, COMMUNITIES & ORGANISATIONAL DEVELOPMENT) 1. REASON FOR REPORT 1.1 The reason for this report is to present to the Committee with a corporate overview of benchmarking performance data for the period 2020-21. 1.2 This report is submitted to Committee in terms of Section III A (4) of the Council’s Scheme of Administration relating to monitoring performance in accordance with the Council’s performance management framework. 2. RECOMMENDATION 2.1 It is recommended that the Committee consider and note the Council’s performance in terms of a corporate overview of benchmarking results. 3. BACKGROUND 3.1 Local Government Benchmarking Framework data, fully published in July 2022 informs the National Benchmarking Overview Report 2020-21. The majority of results are gathered from national sources following annual data submissions that are subject to extensive validation processes, a contributory factor to the time-lag in publication and reporting. There are a limited number of results supplied directly by local authorities. The full suite of benchmarking data can be viewed using My Local Council tool. Results and commentary on 2020-21 results were included in 2021-22 quarter 4 performance reports submitted to service committees in line with the Council’s performance management framework. 3.2 The summary (Appendix 1) includes – i) notes to results by exception (indicators ranked in lowest quartile) ii) bullet points highlighting results that have improved / worsened by 5% (based on previous year) iii) tables detailing all indicator results presented by service themes Item 8. Page 65
Page 66
3.3 Caution on making direct comparison between years due to significant impact of Covid-19 on more recent results, however an assessment of results can be inferred to an extent. The tables show that there has been an overall improvement in performance with indicator result values improved to a greater margin (62%) than those that have worsened (38%). 3.4 There has been notable positive movement in the percentage of indicators ranked by quartiles in both national and family groupings. Page 66
Page 67
3.5 Indicators featuring in the lowest quartile (ranked 25th to 32nd) have been scrutinised in relation to improvements by the relevant Service Committees; Education, Children’s and Leisure Services on 8 June 2022, Corporate on 14 June 2022, Economic Development and Infrastructure and Housing and Community Safety on 21 June 2022 as part of 2021/22 Quarter 4 Performance Reports. This corporate overview report was also submitted to the Corporate Committee on 31 January 2023. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) The Council and its partners have agreed priorities in the LOIP, with a range of outcome targets included for each of the priorities. It will be important that service committees keep those targets in mind when reviewing the performance data in the national benchmarking results, for two reasons: 1. To recognise that to achieve success the targets might mean weaker performance in non-priority areas, and 2. To consider whether the priorities and targets should be reviewed or amended in light of the information contained with the national benchmarking results. (b) Policy and Legal The Council has a statutory obligation to publish a range of information that will demonstrate that it is securing best value and assist in comparing performance both over time and between authorities where appropriate. (c) Financial implications There are no direct financial implications arising from this report. (d) Risk Implications There are no direct risk implications arising from this report although effective performance management assists in the management of risk. (e) Staffing Implications There are no direct staffing implications arising from this report. (f) Property None. Page 67
Page 68
(g) Equalities/Socio Economic Impact An Equality Impact Assessment is not needed because the report is to inform the committee on performance issues. (h) Climate Change and Biodiversity Impacts None (i) Consultations Heads of Service and Service Managers have been consulted and reports have gone to relevant service committees. 5. CONCLUSION 5.1 In 2020-21, 52% of Local Government Benchmarking Framework indicator results featured in the top 16 of 32 Scottish councils. 5.2 When compared to national and comparator performance, improvement can be inferred due to positive movement in rankings across quartiles. Author of Report: Louise Marshall, Strategy and Performance Manager Background Papers: National Benchmarking Overview Report 2020-21 My Local Council Performance Report (Financial Services) Period to March 2022 Performance Report (Human Resources, Information Communications Technology and Organisational Development) Period to March 2022 Performance Report (Governance, Strategy and Performance) Period to March 2022 Performance Report (Economic Growth and Development Services) - Period to March 2022 Performance Report (Environmental and Commercial Services) - Period to March 2022 Q4 2021-22 Performance Report - Education - Period to March 2022 Q4 2021-22 Performance Report - Education Resources and Communities - Period to March 2022 Q4 2021-22 Performance Report - Children and Families and Criminal Justice Social Work - Period to March 2022 Ref: 221 Page 68
Page 69
1 Appendix 1 Local Government Benchmarking Framework (LGBF) Benchmarking Overview 2020-21 Item 8. Page 69
Page 70
2 Preface All 32 Scottish councils signed up to the Local Government Benchmarking Framework, that provides a common approach to benchmarking, which is grounded in reporting standard information on services councils provide to local communities across Scotland. The core purpose of local government’s efforts through this work is to support all councils to improve their services by working and learning together. By engaging in benchmarking, services will learn how to continue to improve their use of performance information; improve their understanding of variations which affect achievements and enabling the opportunity to share effective service practices across councils. This information is made publically available, so that the public in turn can hold services to account for what is achieved on their behalf. The public are encouraged to use the information to ask questions of services in order to engage with services in the improvement process. When reading the information, it is important to remember though that councils across Scotland do not have common service structures. Each council has the structure and service arrangements that it believes are the most appropriate and cost effective to support its local community. Equally, all councils report their performance locally within developed and agreed public reporting frameworks. Therefore to ensure comparability across councils, it has been necessary to develop standard service definitions, and standard classifications for spending and performance. Councils developed a process to drill into the information collated through the Local Government Benchmarking Framework to understand, in more detail, why variations occur. The process was organised around ‘family groups’ of councils so that councils similar in terms of the type of population that they service (e.g. relative deprivation and affluence) and the type of area in which they serve them (e.g. urban, semi-rural, and rural) can compare. This allows improvements to the benchmarking framework to be identified and good practice to be shared between councils. The indicators in the Framework cover how much councils spend on particular services, service performance and how satisfied people are with the major services provided. All the information that this report draws upon uses standard definitions and is therefore comparable to a high degree of accuracy. The indicators in the Local Government Benchmarking Framework are designed to focus questions on why variations in cost and performance are occurring between similar councils. They do not supply the answers, those emerge as councils engage with each other to drill down and explore why these variations are happening. The LGBF Workshop Programme has been added to the platform for learning and improvement. Our ambition in undertaking benchmarking is to continue to increase the quality of life and develop the well-being of everyone in Moray. All of the information generated by the Framework has been placed in a dedicated website mylocalcouncil showing movement on indicators across themes, times and all councils. Page 70
Page 71
3 Summary The Local Government Benchmarking Framework (LGBF) data provides evidence of trends in how resources are allocated, performance of services and levels of customer satisfaction. This year’s results introduces data from 2020/21 and provides an evidence-based picture of the impact of the pandemic as well as the extraordinary effort and achievement during this exceptional period. Exceptions based on 32 local authorities, areas of service delivery ranked in the lowest quartile are presented below as Notes to Benchmarking Results. Care should to be taken when making comparison over time and with others due to the complexities around altered delivery and operating landscapes during the reporting period. The National Benchmarking Overview Report 2020/21 is available here. Notes to Benchmarking Results (indicators ranked in the lowest quartile) No Comment Children’s Services 1,3,4,5,6,7,8,9 Senior phase attainment levels against both breadth and depth measures are higher in 2020/21 than in previous years, however improvement is not at a pace to lift results out of the lowest quartile in a number of indicators. Assessment processes were different in 2020 and 2021 due to the cancellation of exams and external assessment of coursework in 2020, and the use of the Alternative Certification Model in 2021, therefore some results are not directly comparable with previous and future years. Data sets relating to Achievement of Curriculum for Excellence Levels (ACEL) and Insight are being used to drive improvement across attainment indicators. 2 There has been improvement in the overall proportion of children accommodated in community based placements and an overall reduction in the number of children looked after. Placement of those residentially out of area is due to no provision for specific specialist needs being available in Moray. 10 There has been a seven percentage point improvement in the percentage of funded early years provision which is graded good/better but no change in ranking. Providers continue to be supported and challenged by Continuous Improvement Officers. Individual service level agreements being established to ensure Early Learning Centre needs are met and contract monitoring commenced to provide equitable approaches to service monitoring and quality of provision. There are regular opportunities for Early Years Managers to collaborate at online and face to face forums throughout the year. Ongoing support is provided by Learning and Teaching and Early Intervention teachers with training based on needs analysis provided. Corporate Services 11 There has been an improvement in the Council’s workforce gender pay gap in contrast with an increase nationally, Moray remains within the lowest quartile. The gap in pay is the percentage difference between male employees’ average hourly rate of and female employees average hourly rate of pay, where a positive figure indicates male employees are, on average, paid more per hour than female employees. Across Scotland, results range from -5.57 to 14.08, reinforcing the likely variations in methods of calculation and the unique workforce composition of each council. 12 All invoice payments are made immediately on receipt of authorised invoices from departments (a measure taken during the pandemic to support the local economy), therefore performance reflects the pace of budget managers’ authorisation. Heads of Service are periodically informed of the performance of their service in this regard to encourage improvement. Assets 13 The Council approved the ‘Developing a Strategic Approach to the Learning Estate’ document in December 2020, followed by a 10 year Learning Estate Strategy in September 2022. Both of these documents are significant contributory factors to the operational building condition indicator result and set out the vision of providing a sustainable education service aiming for excellence. The Learning Estate Strategy sees the development of individual solutions that meet the varied needs of Associated School Groups across Moray. Full condition surveys of schools are being undertaken over a two year period and there is intention to develop lifetime maintenance plans are in development for all of our school buildings to ensure they are maintained at a minimum B for condition. Adult Social Work 14 In Care Inspections, the Commissioning Lead is invited to the verbal feedback session with the Page 71
Page 72
4 Inspector and the provider and if required an improvement action plan is set out and agreed with the provider and shared with the Council to address Recommendations. Any Requirements are time bound. Concerns raised through Council monitoring with providers is subject to an internal structure with escalation points of routine, supportive to enhanced monitoring to ensure improvement. Housing Services 15 Full compliance with Energy Efficiency Standard for Social Housing (EESSH) is anticipated by March 2023. At the end of March 2022, there had been further improvement with 60% of properties meeting the energy efficiency standard and significant programmes of work approved. Financial Sustainability 16 As an indicator of affordability, this indicator highlights the revenue implications of existing and proposed capital expenditure by identifying the proportion of the revenue budget required to meet financing costs, net of investment income. This is factored into the Council’s financial planning and will be used as a tool for assessing affordability in the review of the capital plan. 17 The need for budgets and forecasts to reflect actual spending becomes increasingly important with decreasing or lower levels of usable reserves to draw on. The reduction in actual outturn as a percentage of budgeted expenditure reflects additional funding received at the year-end which was not planned to be spent in the reporting year, increasing the use of usable reserves. Patterns of budgeted spend were impacted across all local authorities, but in different ways, although an increase in the level of reserves held was a common feature. Climate Change 18 The methodology used in what is considered ‘within the scope’ of influence of the local authority significantly impacts on the result and ranking applied and this has been raised with the Improvement Service. Moray has a relatively low population density area and large emissions from distilling and MOD bases comparative to its population. For example, heavy industry within the Emissions Trading Scheme are considered not within scope yet distilling is, motorway emissions are not within scope yet trunk roads in rural areas are. The Council Climate Change Strategy and Action Plan was adopted in March 2021 with the aim of Moray Council becoming carbon neutral by 2030. The Route Map to Net Zero compliments these document by creating a framework for delivery. Progress is being made: Moray continues to have excellent waste recycling rates, the Council is working to improve energy efficiency in existing buildings, 8% of the council’s vehicle fleet have changed to electric and a programme to implement supporting infrastructure continues, the Council is committed to developing sustainable food policies and strategies that tackle the climate and nature emergency. Work to establish Moray Community Climate Hub to show how different sectors are decarbonising their activities will be useful in more closely examining Moray’s position. Proposals from CoSLA and partners have been developed to create a Climate Intelligence Service (CIS) that will build capacity to improve decision making for area-wide emissions reduction by providing data and tools to help authorities create local indicators within a shared national context. Caution on making direct comparison over time in the charts below due to the significant impact of Covid-19 on more recent results. However, performance as presented does infer positive improvement in the percentage of indicators in the top two quartiles in the context of national and family groupings. Improvement in indicator results appears to have had an impact on rankings both nationally and within the family group. Results have improved to a greater margin than those that have worsened. Relative performance: Percentage of indicator rankings by quartiles – Page 72
Page 73
5 2020/21 vs 2019/20 Moray appears in the following Benchmarking Family Groups – Table Legend – Relative Change Short Term Trend Rank 2020/21 2019/20 to 2020/21 Result to Previous Year Local Authorities (32) Family Group (8) Result improving by 5% or more improved 1st quartile 1st quartile Result worsened by 5% or more worsened 2nd quartile 2nd quartile no change 3rd quartile 3rd quartile 4th quartile 4th quartile People Services Other Services Includes education, social work and housing. The benchmarking clubs are based on the average social context of the local authority population (using data from SIMD 2012). Includes environmental services and culture/leisure services. The benchmarking clubs are based on the dispersion of the local authority population (using data for the Grant-Aided Expenditure indicator for population dispersion). Angus Argyll & Bute East Lothian Highland Midlothian Moray Scottish Borders Stirling East Ayrshire East Lothian Fife Moray North Ayrshire Perth & Kinross Stirling South Ayrshire Results improved 53 indicators Results worsened 33 indicators Page 73
Page 74
N/A1 Data no longer collected nationally / locally N/A2 Result below 5; not published to protect confidentiality N/A3 Indicator result yet to be published 6 Results improved / worsened (past 12 months) Results that improved by 5% or > • 5% increase in secondary pupils and 2% decrease in gross expenditure contributing to overall reduction in cost per pupil • Increase in overall average total tariff score and those in SIMD quintile 5 (least deprived), 4 and 3, but all remain in the lowest quartile nationally • Improvement in percentage of funded early years provision graded good or better, results remains below national average and in bottom quartile nationally • Reduction in both costs and number of children in residential and community care settings results in decreasing cost per child per week and improved ranking • Improvement in early years provision being graded good/better • Reduction in school exclusion rates for both pupils and looked after children • Lower percentage of child-protection re-registrations and looked after children experiencing more than one placement in reporting year • Falling overall workforce in top 5% workforce against a sustained number of women in those post leading to an overall percentage increase • Cost of collecting council tax reduced by 12% against a slight increase in the number of dwellings means lower cost per dwelling • Improved sickness absence rates albeit based on less robust data during lockdown periods • Despite increase in the percentage of internal floor area of operational buildings in satisfactory condition, lowest ranking authority • Homecare costs per hour for people aged 65 or over decreased due to reduction in total homecare costs and increase in care hours • 15% reduction in net expenditure on care homes for older people against a small increase in number of long-stay residents gives a low cost per resident • Significant reduction in the number of days people (75 and over) spend in hospital when ready to be discharged per 1,000 population (75+), improvement mirrored nationally • Increased number of premises for refuse collection and 14% reduction in net expenditure resulted in reduced cost of collection per premise, lowest nationally • 40% reduction in the cost of road maintenance per kilometre led to a considerable improvement in cost per of maintenance per kilometre achieving 4th lowest ranking • Cost of trading standards and environmental health per 1,000 population improved due a reduction in gross expenditure across both services • Non-emergency repairs fell by 40% with working days to complete by 60%, therefore a considerable reduction in average days to complete repairs • Percentage of unemployed people assisted into work from council funded/operated employability programmes improved, moving closer to the national average • Percentage of immediately available employment land increased, remaining in the 3rd quartile • Total useable reserves as a percentage of council annual budgeted net revenue improved for the second consecutive year Results that worsened by 5% or > • 30% increase in pre-school gross expenditure contributing to significant increase in cost per pre-school education place, albeit remains the third lowest cost per place nationally • Drop in overall average tariff SIMD quintile 2, remaining significantly below national and family group average performance • The attainment gap in literacy and numeracy between least and most deprived has widened, performance remains in and around the top quartile nationally (2nd and 9th respectively) • Significant increase in rate of readmissions to hospital within 28 days per 1,000 discharges, albeit comparing well against national and family group • Severe drop in attendances coupled with increase in net expenditure resulting in rising cost per attendance at sports facilities • Increase in cost per library visits, indicator remains in the top quartile nationally • Increase in the cost of parks and open spaces per 1,000 population due to 6% increase in net expenditure and a slight decrease in estimated population • Properties within scope of housing quality standard increased whilst those meeting standard reduced resulting in drop in performance • Slight increase in rent arrears as a percentage of rent due not affecting lowest position nationally • Decrease in Business Gateway Start Ups and Gross Value Added per capita mirrors national position • Overall claimant count almost doubled in numbers and as a proportion of the estimated working age population • Percentage of claimants aged 16-24 as a percentage of the estimated population having nearly doubled was just above the national average • Actual outturn as a percentage of budgeted expenditure dropped and features in the lowest quartile Page 74
Page 75
N/A1 Data no longer collected nationally / locally N/A2 Result below 5; not published to protect confidentiality N/A3 Indicator result yet to be published 7 Overview of Local Government Benchmarking Framework Indicator Results Note Indicator Description Moray National Average Relative Change 2019/20 to 2020/21 Rank 2020/21 2016/17 2017/18 2018/19 2019/20 2020/21 2020/21 % change Short Term Trend Nat (32) FG (8) Children’ s Services Cost per primary school pupil (£) 4,894 5,073 5,200 5,427 5,297 5,916 -2.40 2 2 Cost per secondary school pupil (£) 7,432 7,699 7,617 7,707 7,211 7,657 -6.43 5 2 Cost per pre-school education place (£) 2,741 2,749 3,526 5,496 7,420 9,273 35.01 4 1 % of secondary pupils achieving 5 or more awards at Level 5 59 57 61 59 63 67 4.00 24 7 1 % of secondary pupils achieving 5 or more awards at Level 6 30 28 32 30 33 41 3.00 27 8 % of pupils living in the 20% most deprived areas Gaining 5+ awards at Level 5 55 N/A2 N/A2 N/A2 62 49 4 2 % of pupils living in the 20% most deprived areas Gaining 5+ awards at Level 6 N/A2 N/A2 N/A2 N/A2 31 23 4 1 Gross Cost of “Children Looked After” in Residential Based Services per child per week (£) 4,551 4,016 4,604 5,156 4,661 4,380 -9.59 21 5 Gross Cost of “Children Looked After” in a Community Setting per child per week (£) 493 453 437 455 399 382 -12.31 24 7 2 % of children being looked after in the community 82.33 78.38 79.05 81.28 82.18 90.30 0.90 29 8 % of adults satisfied with local schools (rolling 4 years) 71.67 71.67 74.63 76.97 N/A3 N/A3 3 % of pupils entering positive destinations 93.86 94.17 92.76 93.07 94.08 95.48 1.01 29 8 4 Overall average total tariff 819 795 815 802 885 972 10.39 27 8 Overall average total tariff SIMD Quintile 1 661 601 826 939 897 688 -4.47 3 1 5 Overall average total tariff SIMD Quintile 2 711 702 574 689 643 817 -6.68 31 8 6 Overall average total tariff SIMD Quintile 3 655 677 830 731 878 975 20.11 28 7 Page 75
Page 76
N/A1 Data no longer collected nationally / locally N/A2 Result below 5; not published to protect confidentiality N/A3 Indicator result yet to be published 8 Note Indicator Description Moray National Average Relative Change 2019/20 to 2020/21 Rank 2020/21 2016/17 2017/18 2018/19 2019/20 2020/21 2020/21 % change Short Term Trend Nat (32) FG (8) 7 Overall average total tariff SIMD Quintile 4 875 867 839 839 965 1,108 15.02 29 7 8 Overall average total tariff SIMD Quintile 5 1073 923 935 908 965 1,320 6.28 30 8 % P1, P4 & P7 pupils combined achieving expected CFE Level in Literacy 64.75 N/A1 63.90 66.88 -0.85 22 5 9 % P1, P4 & P7 pupils combined achieving expected CFE Level in Numeracy 69.89 N/A1 67.82 74.69 -2.07 29 7 Literacy Attainment Gap (P1,4,7 combined) – percentage point gap between the least and most deprived pupils 14.88 N/A1 19.75 24.70 33.00 2 1 Numeracy Attainment Gap (P1,4,7 combined) – percentage point gap between the least and most deprived pupils 13.77 N/A1 17.55 21.42 27.00 9 1 % of children meeting developmental milestones 89.79 92.22 93.16 95.59 95.98 85.06 0.39 3 1 10 % of funded early years provision which is graded good/better 90.57 75.44 75.44 78.30 85.19 90.93 6.89 29 8 School attendance (%) 94.00 N/A1 93.85 N/A1 93.80 92.00 -0.05 6 1 School attendance rates (LAC, %) 87.20 N/A1 87.41 N/A1 89.35 87.89 1.94 11 3 School exclusion rates per 1,000 pupils 33.10 N/A1 22.74 N/A1 14.18 11.87 -8.57 20 7 School exclusion rates per 1,000 looked after children 236.26 N/A1 180.41 N/A1 125.00 77.81 -55.41 23 6 % participation for 16-19 year olds 89.80 91.20 91.29 93.49 91.77 92.18 -1.72 22 8 % of child protection re-registrations within 18 months 9.18 5.81 3.16 7.50 2.27 7.01 -5.23 12 2 % LAC with more than 1 placement in the last year (Aug-July) 25.12 30.63 30.95 25.00 14.94 16.79 -10.06 5 2 % of children living in poverty (after housing costs) 23.08 23.16 21.90 23.39 21.35 20.86 -2.04 11 1 Page 76
Page 77
N/A1 Data no longer collected nationally / locally N/A2 Result below 5; not published to protect confidentiality N/A3 Indicator result yet to be published 9 Note Indicator Description Moray National Average Relative Change 2019/20 to 2020/21 Rank 2020/21 2016/17 2017/18 2018/19 2019/20 2020/21 2020/21 % change Short Term Trend Nat (32) FG (8) Corporate Services Support Services as a % of Total Gross Expenditure 4.56 4.58 4.29 4.18 4.14 4.03 -0.04 21 5 % of the highest paid 5% employees who are women 51.91 52,74 54.08 54.72 61.05 58.30 6.34 8 4 11 The gender pay gap (%) 7.75 6.52 7.58 6.42 6.16 3.66 -0.26 26 8 Cost of collecting Council Tax per dwelling 12.05 10.36 9.80 9.08 7.95 6.64 -12.38 21 8 Sickness Absence days per Teacher 5.87 6.40 6.48 6.76 4.54 4.16 -32.90 24 6 Sickness Absence days per Employee (non-teacher) 10.98 11.54 12.45 12.69 8.67 9.71 -31.68 10 4 % of income due from Council Tax received by the end of the year 95.89 96.67 96.94 96.96 95.83 94.77 -1.14 14 3 12 % of invoices sampled that were paid within 30 days 90.16 89.10 89.67 87.31 84.02 91.76 -3.28 27 6 Assets % of operational buildings that are suitable for their current use 94.58 94.76 98.22 98.21 98.15 82.31 -0.07 1 1 13 % of internal floor area of operational buildings in satisfactory condition 41.39 52.64 54.23 53.93 66.93 89.20 13.01 32 8 Adult Social W ork Home Care costs per hour for people aged 65 or over (£) 24.32 29.62 38.21 36.76 27.79 27.62 -24.41 15 5 Self-Directed Support spend on people aged 18 or over as a % of total Social Work spend on adults 4.95 4.36 4.12 4.11 5.04 8.13 0.93 17 6 % of people aged 65 or over with long term care needs receiving personal care at home 65.64 66.06 65.26 62.15 62.00 61.71 -0.15 17 4 % of adults supported at home who agree that their services and support had an impact in improving or maintaining their quality of life (rolling 4 years) 78.51 79.20 % of adults supported at home who agree that they are supported to live as independently as possible 82.68 82.72 % of adults supported at home who agree that they had a say in how their help, care or support was 74.84 79.68 Page 77
Page 78
N/A1 Data no longer collected nationally / locally N/A2 Result below 5; not published to protect confidentiality N/A3 Indicator result yet to be published 10 Note Indicator Description Moray National Average Relative Change 2019/20 to 2020/21 Rank 2020/21 2016/17 2017/18 2018/19 2019/20 2020/21 2020/21 % change Short Term Trend Nat (32) FG (8) provided % of carers who feel supported in their caring role 39.48 30.70 Residential costs per week per resident for people aged 65 or over (£) 334 349 366 345 288 432 -16.28 5 1 Rate of readmission to hospital within 28 days per 1,000 discharges (%) 74.91 84.37 77.08 77.81 100.90 120.03 29.67 9 2 14 Proportion of care services graded ‘good’ (4) or better in Care Inspectorate inspections (%) 70.65 84.69 81.82 75.24 79.80 82.50 4.56 29 8 Number of days people spend in hospital when they are ready to be discharged, per 1,000 population (75+) 1095.22 936.08 1063.26 767.70 492.74 484.28 -35.82 19 5 Culture & Leisure Gross cost per attendance at Sports facilities (£) 2.20 2.13 2.17 0.93 18.71 40.36 1908.00 5 2 Cost per Library visit (£) 1.58 1.62 1.43 1.62 2.94 2.88 82.00 10 3 Cost of Museums per visit (£) 2.09 2.56 2.69 2.30 N/A1 10.19 Cost of Parks & Open Spaces (£) per 1,000 population 15,423 12,487 14,568 11,166 11,880 19,112 6.39 6 2 % of adults satisfied with Libraries (rolling 4 years) 72.67 70.33 74.93 77.60 N/A3 N/A3 % of adults satisfied with Parks and Open Spaces (rolling 4 years) 87.67 83.33 85.10 82.43 N/A3 N/A3 % of adults satisfied with Museums and Galleries (rolling 4 years) 51.33 49.67 58.10 60.10 N/A3 N/A3 % of adults satisfied with Leisure Facilities (rolling 4 years) 73.00 67.67 66.40 66.73 N/A3 N/A3 Environme ntal Services Net cost per Waste collection per premises (£) 55.80 54.58 56.16 40.34 34.78 68.64 -13.78 1 1 Net cost per Waste disposal per premises (£) 111.47 111.66 115.54 102.66 102.00 107.52 -0.65 15 7 Net Cost of Street Cleaning (£) per 1,000 population 8,690 8,790 9,228 7,581 7,251 12,966 -4.35 5 1 Page 78
Page 79
N/A1 Data no longer collected nationally / locally N/A2 Result below 5; not published to protect confidentiality N/A3 Indicator result yet to be published 11 Note Indicator Description Moray National Average Relative Change 2019/20 to 2020/21 Rank 2020/21 2016/17 2017/18 2018/19 2019/20 2020/21 2020/21 % change Short Term Trend Nat (32) FG (8) Street Cleanliness Score N/A1 N/A1 N/A1 N/A1 N/A1 91.36 Cost of Maintenance per Kilometre of Roads (£) 6,995 7,380 6,537 7,193 4,301 12,269 -40.21 5 1 % of A Class roads that should be considered for maintenance treatment (rolling 2 years) 25.17 25.87 28.56 29.16 26.60 27.26 -2.56 17 2 % of B Class roads that should be considered for maintenance treatment (rolling 2 years) 22.85 23.49 25.62 25.79 22.30 30.70 -3.49 6 1 % of C Class roads that should be considered for maintenance treatment (rolling 2 years) 21.91 24.89 28.06 25.20 21.30 32.38 -2.86 5 1 % of unclassified roads that should be considered for maintenance treatment (rolling 2 years) 31.40 31.61 31.09 35.49 35.00 37.95 -0.49 14 3 Cost of trading standards and environmental health (£) per 1,000 population 22,651 22,219 21,109 20,572 18,734 20,726 -8.94 17 7 Cost trading standards, money advice & citizens advice (£) per 1,000 population 5,613 5,813 5,283 5,332 4,681 6,665 -12.22 10 4 Cost of environmental health (£) per 1,000 population 17,038 16,405 15,826 15,240 14,053 14,061 -7.79 23 8 % of total household waste arising that is recycled 59.07 57.77 57.40 58.98 54.90 42.84 -4.08 4 2 % of adults satisfied with refuse collection (rolling 4 years) 87.00 87.33 82.83 73.50 N/A3 N/A3 % of adults satisfied with street cleaning (rolling 4 years) 66.00 66.00 65.30 58.63 N/A3 N/A3 Housing Services Gross rent arrears (all tenants) as at year end as a % of rent due for the reporting year 2.49 2.44 2.37 2.58 3.20 8.53 0.62 1 1 % of rent due in the year that was lost due to voids 0.54 0.66 0.85 0.95 1.17 1.47 0.22 12 5 % of council dwellings meeting Scottish Housing Quality Standard 96.01 95.82 92.47 90.67 84.32 89.09 -6.00 21 6 Average number of days to complete non- emergency repairs 6.35 7,68 7.51 9.54 6.11 9.13 -35.99 10 2 Page 79
Page 80
N/A1 Data no longer collected nationally / locally N/A2 Result below 5; not published to protect confidentiality N/A3 Indicator result yet to be published 12 Note Indicator Description Moray National Average Relative Change 2019/20 to 2020/21 Rank 2020/21 2016/17 2017/18 2018/19 2019/20 2020/21 2020/21 % change Short Term Trend Nat (32) FG (8) 15 % of council dwellings that are energy efficient 52.65 55.35 57.38 54.63 57.38 85.00 2.76 26 8 Economic Development % Unemployed People Assisted into work from Council operated / funded Employability Programmes 4.37 8.72 3.44 0.62 5.75 6.78 5.13 16 6 Cost per Planning Application 4,210 3,991 5,054 4,314 4,482 4,986 3.90 13 3 Average time (Weeks) per Planning Application 6.95 6.52 6.68 6.43 6.69 11.08 4.10 3 2 % of procurement spent on local small / medium enterprises 21.22 25.16 23.91 21.90 23.56 26.74 1.65 17 3 No of business gateway start-ups per 10,000 population 13.74 13.36 12.56 16.18 9.51 13.43 -41.22 22 5 Investment in Economic Development & Tourism per 1,000 population (£) 45,243 54,146 24,631 33,853 34,134 88,635 0.83 3 1 Proportion of people earning less than the living wage (%) 23.70 24.70 27.40 24.00 21.50 18.59 -2.50 18 7 Proportion of properties receiving superfast broadband (%) 80.00 83.01 83.20 84.60 85.70 91.60 1.00 26 8 Town Vacancy Rates (%) 11.91 9.93 6.87 6.87 10.95 11.35 4.07 15 3 Immediately available employment land as a % of total land allocated for employment purposes in the local development plan 22.41 22.36 49.04 24.20 34.76 47.12 10.56 22 4 Gross Value Added (GVA) per capita (£) 20,495.47 22,280.23 22,298.99 21,655.19 19,809.84 21,821.87 -8.52 20 4 Claimant count as a % of working age population (%) 2.10 2.10 2.60 2.70 5.10 5.68 88.89 10 3 Claimant count as a % of 16-24 population (%) 3.22 3.43 3.89 3.83 7.32 7.23 91.13 16 3 Fi n a n ci al S u st ai n a bi lit y Total useable reserves as a % of council annual budgeted net revenue 15.25 12.35 10.45 15.04 25.05 23.60 10.01 11 3 Page 80
Page 81
N/A1 Data no longer collected nationally / locally N/A2 Result below 5; not published to protect confidentiality N/A3 Indicator result yet to be published 13 Note Indicator Description Moray National Average Relative Change 2019/20 to 2020/21 Rank 2020/21 2016/17 2017/18 2018/19 2019/20 2020/21 2020/21 % change Short Term Trend Nat (32) FG (8) Uncommitted General fund Balance as a % of council annual budgeted net revenue 10.71 8.55 6.17 7.53 7.23 3.52 -0.30 3 1 16 Ratio of Financing Costs to Net Revenue Stream 8.66 9.52 9.95 9.50 8.00 6.24 -1.50 27 7 Ratio of Financing Costs to Net Revenue Stream – Housing Revenue Account 21.10 19.72 20.33 21.46 21.63 22.91 0.17 13 5 17 Actual outturn as a % of budgeted expenditure 98.67 99.20 100.08 96.04 89.64 97.44 -6.40 30 7 Climate Change CO2 emissions area wide per capita 6.01 5.59 5.80 5.73 4.81 4.62 -0.91 21 4 18 CO2 emissions area wide: emissions within scope of LA per capita 7.89 7.50 7.68 7.31 6.39 4.09 -0.92 32 8 Page 81
Page 82
Page 82