Supplementary Agenda Document Pack - Audit and Scrutiny Committee - 10/05/2023
Moray Council · 10 May 2023
Back to Audit and Scrutiny Committee — 10 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 10 May 2023 SUPPLEMENTARY AGENDA The undernoted reports have been added to the Agenda for the meeting of the Audit and Scrutiny Committee to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 10 May 2023 at 09:30. BUSINESS 7a. Adult Social Care Commissioning Service Report by the Audit and Risk Manager 3 - 38 Page 1
Page 2
Page 2
Page 3
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 10 MAY 2023 SUBJECT: ADULT SOCIAL CARE COMMISSIONING SERVICE BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on an audit of adult social care Commissioning Service within Health & Social Care Moray (HSCM) completed by KPMG Governance, Risk & Compliance Services. 1.2 This report is submitted to Committee in terms of Section III (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 The Chief Social Work Officer reported an audit review of adult social care Commissioning Service undertaken by KPMG Governance, Risk & Compliance Services to the Audit, Performance and Risk Committee (item 11) of the Moray Integration Joint Board (MIJB) on 30 March 2023. The audit report is given in Appendix 1. 3.2 This audit was requested by the Audit, Performance and Risk Committee of the MIJB on 31 March 2022. The need for the review was highlighted due to concerns raised by senior management of HSCM and senior officers in the Council including the Depute Chief Executive (Economy, Environment & Finance); the Chief Financial Officer and the Payments Manager regarding administrative arrangements within the Commissioning Service, and the findings from a peer review report in January 2022. 3.3 The peer review was an audit of systems and procedures within the Commissioning Service by the Strategic Procurement Manager Aberdeen City and Aberdeenshire Councils Shared Services (Commissioning), with the purpose of providing evidence and assurance that the Commissioning Service was robust, appropriate, equitable, efficient and provided value for money for the population of Moray. Unfortunately, most of the findings from this peer Item 7a. Page 3
Page 4
review report were not accepted by the Commissioning Service or the previous Head of Service/Chief Social Work Officer (CSWO) due to concerns relating to the sample of contracts selected for review and the assumptions made from the testing undertaken. Subsequently, the MIJB’s Audit, Performance and Risk Committee on 31 March 2022 agreed to procure an external review of the Commissioning Service. 3.4 A detailed scope for this external review was prepared that included the following “broad purpose of the audit”: • To enable a reasonable level of assurance to be provided to the Integration Joint Board on the effectiveness of the Commissioning Service • From the audit findings, the opportunity to highlight to the Commissioning Service any required improvements to ensure an adequate and efficient service can be delivered in meeting the needs of the Moray population. A procurement exercise was thereafter undertaken and KPMG Governance, Risk & Compliance Services was appointed as the Auditor for the review. 3.5 The report in Appendix 1 has detailed 11 key findings relating to governance, roles and responsibilities, strategy/processes and contract management. It is pleasing to note that all recommendations have been accepted. However, the Head of Service/CSWO has detailed within the report to the Audit, Performance and Risk Committee of the MIJB on 30 March 2023 (Item 11), risks to achieving the set timescales for implementation of the recommendations due to staffing implications and related restructuring that has taken place following the external review. The Head of Service/CSWO confirmed that a review would be undertaken regarding capacity issues and how that risk can be mitigated using interim support. In addition, the Head of Service/CWSO has also made a commitment that progress on implementation of the actions will be reported back to the Audit, Performance and Risk Committee of the MIJB on a quarterly basis. 3.6 As the Audit and Risk Manager of the Council and the Chief Internal Auditor of the MIJB, I note the findings detailed within the audit report. I will be closely monitoring progress and undertaking a follow up review once the implementation dates for the recommendations have passed. The findings of this follow up review will be reported to a future Audit and Scrutiny Committee. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates Page 4
Page 5
the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations CMT has been consulted on the external report and has commented as follows in terms of the need for clarity and for agreed timescales to bring adult care commissioning and procurement up to date:- Clarity • Although the first sentence of the report refers to HSCM, most of the report refers simply to Moray Council. There is an ambiguity created by this, as most if not all of the actions are for HSCM and MIJB and not for Moray Council governance or for departments of the Council which are not part of HSCM. • There is a lack of clarity when referring to the Finance team as to whether this is Moray Council Financial Services or the Finance Team which reports to the HSCM Commissioning Manager. • There is a lack of clarity in some sections as to whether the contracts database referred to is the Moray Council wide contracts database (mandated by statute) maintained by the Moray Council Procurement team or the list of social care contracts / agreements kept by the HSCM Commissioning team. • Progress of the “Partners in Care Strategy” would be a matter for the HSCM and the MIJB. • A number of actions are assigned to “Service Manager” without identifying what service and where there is / appears to be responsibilities for the tasks (eg paying invoices) across more than one service. Timescales That while noting the action at 2.8 to improve contract management processes, the meeting note that pending completion of that work, a separate short term priority plan has been put in place to ensure that the activity required to bring adult care contracts up to date and aligned to current requirements is achieved with a sharp focus on the highest risk areas. As the priority plan progresses regular reviews by the Council’s Audit and Risk Manager will be needed to ensure that progress is being made with the additional safeguard of a follow-up report to a future Audit and Scrutiny Committee Page 5
Page 6
Moving forward, it would be a requirement to develop a detailed Action Plan that clearly specifies the requirements from all the recommendations with an assigned officer(s) responsible for implementation and providing indicators of progress/milestones en route to meeting final targets to avoid any possible ambiguity and effectively track progress. 5. CONCLUSION 5.1 This report provides Committee with a copy of an external audit report regarding a review of adult social Care Commissioning within HSCM, and the planned reporting arrangements of progress in the implementation of the recommendations. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: DL/ASC/100523 (SPMAN-1042990102-155) Page 6
Page 7
Social Care Commissioning The Moray Council: The Moray Health and Social Care Partnership KPMG Governance, Risk & Compliance Services February 2023 APPENDIX 1 Item 7a. Page 7
Page 8
2 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Content Distribution list For action: Simon Bokor-Ingram, Chief Officer of Health and Social Care Moray Tracy Stephen, Chief Social Work Officer and Head of Service For information: Audit & Scrutiny Committee Report status Closing meeting: 27 October 2022 Draft report issued: 10 November 2022 Updated draft report issued: 14 February 2023 Final report issued: 23 February 2023 01 Executive summary 3 02 Findings and management actions 6 03 Appendices 19 Sample testing Analysis of commissioning database Scope extract Acknowledgments Rating definitions Page 8
Page 9
3 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 3 Acknowledgements We would like to thank the following individuals for their contribution during this internal audit: — Key individuals involved in our work are acknowledged at Appendix D. 01 Executive summary Conclusion We have performed a review of social care commissioning within Health and Social Care Moray (‘HSCM’). Our review assessed the design of controls in place, as well as their operating effectiveness in order to determine the suitability of internal procedures, the application of these procedures and whether the approach taken to commissioning aligns with best practice. In order to make this determination our work included, but was not limited to, sample testing of contracts with providers, invoices and governance meeting minutes. The delivery of social care is led by the commissioning team, but is supported by other functions across the Council including finance and procurement. Our review included meetings with staff from across these areas. We have raised 11 key findings relating to governance, roles and responsibilities, strategy/processes and contract management. We have rated six of these findings as high-level (red), four as mid-level (orange) and one as low-level (green). Governance There is not a clear structure for the escalation and oversight of commissioning issues. We specifically note that Commissioning Manager meetings have not been held since February 2022. Such meetings should act as a forum to monitor commissioning activity and provide oversight on the efficient resolution of issues. Our review of the governance arrangements in place can be found in Finding 2.1 and Appendix A . Roles and responsibilities The overarching role of the Council’s Commissioning provision should be to provide services that meet the needs of users. This means that commissioning activity must evolve to meet needs and new contracts may need to be procured. Therefore, commissioning encapsulates a number of Council areas (e.g. Commissioning Team, Procurement, etc), so it is important that staff understand the gaps for which they are responsible to ensure functional working relationships (Finding 2.2) . As per Finding 2.3 , we identified a need for staff training which would assist in communicating job Priority rating: Control design Operating effectiveness 2 4 3 1 1 0 High Medium Low Summary Page 9
Page 10
4 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Contract management We applied data analytics to the contracts database and found it to be only 78.71% complete due to a number of fields being left blank. We found out of date contracts within the database dating back as far as 2004. We have included details of this analysis in Finding 2.8 and Appendix B. Failure to keep the central contracts database up to date creates a risk to monitoring activities as contracts may be omitted from monitoring plans and/or incorrectly included. The Council has a Senior Performance Officer responsible for rolling out performance management frameworks across the Council. However, Commissioning is yet to benefit from such a framework and we were not able to obtain information relating to timelines for implementation. Delays pose a risk that there is inadequate oversight of performance at a team level. When rolled out, the framework should include suitable KPIs to measure performance (Finding 2.9) . The contract review process (Finding 2.10) is not capable of sufficiently monitoring contract compliance as it is currently only conducted periodically. Providers should be subject to more frequent, in -depth reviews that evaluate compliance with legal and regulatory standards as well as other contractual terms. This will ensure that the Council has working relationships only with compliant organisations, upholding the Council’s overall credibility and reputation. Block contracts are currently being used, however we understand that a transition away from such arrangements is in progress. The operation of block contracts require detailed tracking and monitoring in order to be managed well, however we have not found this to be the case. The Council should endeavour to complete the transition as soon as possible (Finding 2.11) . Executive summary descriptions to staff and signposting sources of guidance and escalation should the need arise. Training would also reinforce the Council’s standard operating procedures and improve adherence to such procedures Strategy & processes There is no documentation setting out the commissioning and decommissioning process, including the lack of a policy document relating to how services should be procured and managed under the Self-Directed Support (‘SDS’) framework (Finding 2.4). Our testing of a sample of 13 contracts with providers and 25 invoices demonstrated further shortcomings in contract documentation. For example, we were unable to obtain four of the sampled contracts and 15 of the sampled invoices due to insufficient audit trails which will have further implications in terms of future planning. Without complete documentation, there is a risk that staff are not following formal Council policies and procedures. The findings from our sample testing are further detailed in Finding 2.5 and Appendix A . The ‘Moray Partners in Care’ strategy, formulated by Moray Council, is a strategic plan covering the next 10 years. Although we identified a clear direction within the strategy, there are no clear targets, KPIs or milestones against which the Council can hold itself accountable. A delivery plan for the strategy is currently being developed and should be implemented as a priority to ensure the strategy is being followed (Finding 2.6) . Robust controls in invoicing ensure that expenditure is incurred appropriately, however we observed that controls are not applied consistently as they are not formally documented. For example, the 15 minute variance for billed care time and expected care time set by the Finance team has not been formalised. Furthermore, if the invoices cannot be agreed to the underlying contract, queries are raised without retaining any evidence, leading to undocumented decision making (Finding 2.7) . Page 10
Page 11
5 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Executive summary Summary of key findings Governance structure 2.1 The Council should prioritise having senior oversight to close the gap between the organisation and those charged with governance, as there is currently an insufficient grip on governance. Team structure and roles 2.2 There is a lack of clarity around roles and responsibilities, and poor cross-organisational relationships. Strategy 2.6 The Council does not have a clear strategy for the Health and Social Care Commissioning Division, supported by KPIs and milestones. Process documentation 2.4 The Council has not documented the processes around commissioning and de-commissioning. Invoicing 2.7 Financial controls around the invoicing processes are inconsistently applied. Contracts register 2.8 The Council should develop a centralised contracts register to ensure there is adequate oversight over contracts held, including their value and date. Performance management system 2.9 The Council should prioritise the development of a performance management system in commissioning. Sample testing 2.5 Our sample testing identified a number of issues relating to missing documentation and inadequate audit trails. Contract review 2.10 Contracts are currently subject to an annual review but there should be more regular review. Block contracts 2.11 The Council should ensure there is adequate monitoring of block contracts to ensure greater accuracy of billing. Training 2.3 A lack of training for staff has contributed to confusion as to what is expected of different teams. Contract management: Roles and responsibilities: Strategy & processes: Governance: Page 11
Page 12
6 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 6 02 Findings and management actions Governance 2.1 Governance structure The Council should prioritise having senior oversight to close the gap between the organisation and those charged with governance, as there is currently an insufficient grip on governance. The provision, management and oversight of health and social care delivered in Moray is governed by the Integration Joint Board (‘IJB’). This forms part of the wider governance structure, which is presented in more detail in Appendix A. Our review identified that currently, there is no clear structure for the escalation and oversight of issues relating to Social Care Commissioning. As part of our review, we also reviewed minutes for a number of meetings: Systems Leadership Group Meetings (leadership) – Commissioning was not discussed at leadership level as it was not on the agenda, nor was there commissioning representation. Senior Management Team Meetings (management) – There was a standing agenda item in each of these meetings labelled ‘Gaps in Social Care Provision’ where those with oversight of commissioning provided an update. – However, we noted three meetings where social care was insufficiently addressed, as discussion lacked depth and detail. On a further three occasions, the standing item was not discussed. This means that the opportunity to extract constructive actions from these meetings relating to commissioning is not utilised. Commissioning Group Meetings (operational) – Commissioning Manager Meetings are held on a roughly quarterly basis. It was agreed that action plans for each Commissioning Manager Meeting would be created, however this has not yet been done. Continued… High Page 12
Page 13
7 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.1 Governance (contd.) Risk: There is inadequate central oversight of billing and budgeting in relation to contracts. Expenditure related to contracts is not appropriately authorised, in line with Standing Financial Instructions. The Council has insufficient governance in place to successfully plan, commission and manage contracts with the highest complexity, cost and risk. Agreed management action: 1. As per guidance issued by the Sottish Government, the IJB Terms of Reference should be revised to include clear roles and responsibilities in relation to the management and oversight of all social care commissioning activities. 2. The Council should clarify the expectation around attendance at meetings and attendance should be reported at least part-publicly. Deputies attending should have the delegation to make decisions on behalf of their superior. 3. The Council should prioritise the production of action plans for each Managers Commissioning meeting. These should clearly set out the action, responsible individual and due date for completion. Progress against the action log should be monitored at each meeting. Evidence to confirm implementation: Reviewed Terms of Reference. Communications to senior management regarding manager meeting intentions. Proposed template action logs. Responsible person/title: Service Manager Target date: 1. 31st August 2023 2. 29th February 2024 3. 31st May 2023 Findings and management actions High Page 13
Page 14
8 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Roles and Responsibilities 2.2 Team structure and roles There is a lack of clarity around roles and responsibilities, and poor cross-organisational relationships. The overarching role of the Commissioning function is to provide services that meet the needs of end users. To achieve this, services must evolve according to the changing needs of service users, which is not currently possible due to blurred lines of responsibility acting as a barrier to collaborative working. Adapting alongside changing user demands may include the procurement of new contracts. This therefore incorporates a number of teams into the overall commissioning process, such as Procurement and Finance. Through our discussions with staff from across the different areas of the Council, we found that there was a lack of clarity around which teams are responsible for which parts of the commissioning process. The absence of guidance around the commissioning and de-commissioning process also exacerbates the confusion around roles and responsibilities (see Finding 2.4 ), as staff are not assigned specific responsibilities. This lack of clarity, combined with a lack of communication has exposed the Council to risks where core tasks relating to the commissioning process have not been completed as expected, because the responsible staff member did not complete the task in time. We found that teams do not work together, and fractured relationships pose a direct challenge to the effective and efficient completion of tasks. Determining roles and responsibilities requires the council to first review its commissioning structure, including the aims of the commissioning division and how these will be met, and how other teams across the council engage with the commissioning process (if required). Once an effective framework has been established, the council can then use this to re-communicate the roles and responsibilities of the different teams and individuals which sit within and alongside the commissioning function. This process will ensure that the goals are clear and are aligned on both an individual and a higher level. Risk: Roles and responsibilities are not clearly set out and allocated, resulting in inadequate completion of tasks. Continued… Findings and management actions High Page 14
Page 15
9 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.2 Team structure and roles (contd.) Agreed management action: 1. The Council will develop clear job descriptions for each role, which set out the responsibilities of the individual. These job descriptions will be shared with staff on commencement of a role, and will be made available for future reference. 2. The opportunity and scope for collaboration across the various Council teams will be explored so that the Council can benefit from shared learning and increased efficiency. 3. As part of the wider performance management process, staff will be held accountable for their roles. If tasks are not completed as expected, the reasoning behind this should be explored and appropriate action taken to avoid the chance of a recurrence. Evidence to confirm implementation: Clearly defined job descriptions. Revised approach to collaborative working. Clearly defined controls to link performance management and accountability for job roles. Responsible person/title: Service Manager Target date: 1. 31st May 2023 2. 31st August 2023 3. In place Findings and management actions High Page 15
Page 16
10 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.3 Training A lack of training for staff has contributed to confusion as to what is expected of different teams. Finding 2.2 notes that there is a lack of clarity around the roles and responsibilities of different teams, meaning expectations of each of the teams involved in the wider delivery of social care are not sufficiently understood. As part of the move towards a new single service under ‘The National Care Service’, the training that HSCM provides should include an ‘awareness raising’ arm. This will set out exactly what the service is aiming to achieve, what is required of different teams and job roles, as well as how this should be performed in accordance with the Council’s policies and standard operating procedures. Training would also provide an opportunity to signpost sources of guidance and escalation where staff feel it necessary. Ideally, training would be followed up by a series of guidance documents to be referred to should instances of uncertainty later arise. Risks: Council staff involved in commissioning are not consistently complying with the Council’s policies and procedures. Roles and responsibilities are not clearly set out and allocated, resulting in inadequate completion of tasks. Agreed management action: 1. Implement a clearly defined staff training plan, supported by a series of readily- available guidance documents. Evidence to confirm implementation: Staff training plan. Responsible person/title: Team Manager Target date: 31st August 2023 Findings and management actions Medium Page 16
Page 17
11 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Strategy / Processes 2.4 Process documentation The Council has not documented the processes around commissioning and de-commissioning. Our review identified that there is no documented process in place which clearly sets out the commissioning and de-commissioning process. Self-Directed Support (‘SDS’) A number of contracts are procured under the SDS framework, which has its own set of rules and regulations. The Council does not have a policy / document in place which sets out how services should be procured and managed under the SDS framework. Currently, invoices received under SDS option 2 are sent to the commissioning manager for approval. This is in the process of changing as the invoices should be signed off by the budget holder to be in line with the Council's financial regs. The Council should prioritise this alignment to financial regulations. Risk: Staff are unaware of what is required of them. Steps in the commissioning and decommissioning process may be omitted, exposing the Council to risk around incomplete contract terms. Agreed management action: 1. The Council will develop and document a clear end-to-end process, which sets out each of the steps of both the commissioning and decommissioning process. 2. All staff involved in commissioning will be provided with training around this process, and details of the process will be made available to staff for future reference. 3. Prioritise alignment with SDS financial regulations. Evidence to confirm implementation: End-to-end process document for commissioning and decommissioning. Training programme. Progress report as to the alignment with SDS financial regulations. Responsible person/title: Service Manager Target date: 31st August 2023 Findings and management actions High Page 17
Page 18
12 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Findings and management actions (cont.) High 2.5 Sample testing Our sample testing identified a number of issues relating to missing documentation and inadequate audit trails. We have presented the detailed results of our sample testing in Appendix A. Contracts We took a sample of 13 contracts under social care commissioning arrangements and reviewed whether each contract was in date, sufficiently approved and agrees to the contracts database. We identified the following issues: – We were unable to obtain documentation for four contracts in our sample, suggesting an insufficient audit trail has been maintained, and we confirmed that there was no contract in place for a further one. – There were five instances where contracts signed by the contracting party were not retained on file, these were only signed by the Council. – We were unable to confirm that five contracts were still in date, due to either no end date information or conflicting contract clauses. – We were unable to reconcile any of the contract values to the value as per the contract database as different costing information was used (e.g. per resident per week, total value, etc). – It was only possible to reconcile end dates to the database for one contract as variations to contract end dates were not accounted for in the database. – There were four contracts where the respective contract numbers were not reflected in the contracts database. Invoices We selected a sample of 25 invoices from a listing of all transactions which had been incurred by the Council. For each item in our sample, we attempted to verify the invoice and underlying approvals of the transaction. We identified the following issues: – For 15/25 items in our sample we were unable to view the invoice. This was because management was unable to tie back the transactions in our listing to individual invoices. – We were unable to confirm that any invoices in our sample had been sufficiently approved prior to payment. This was due to the Council not retaining any evidence relating to this approval. Continued… Page 18
Page 19
13 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.5 Sample testing (contd.) From the results of our sample testing, we identified three key areas for improvement: – Audit trails: as per our findings, we were unable to obtain documentation relating to both contracting and invoicing. This indicates that thorough audit trails are not maintained. Documentation should always be obtainable so that expenditure can be easily identified and monitored. – Contracts database: the database is not subject to ongoing updates to reflect contract expirations or extensions. It is also not possible to reconcile contract values with the database due to an inconsistent approach. We have expanded on this in Finding 2.8 and Appendix B . – Approvals:the Council should have a robust approvals process in place, which can be documented and applied consistently. However, for the samples we tested we were unable to confirm that approvals were sufficient and were not capable of being construed as approvals, often not even containing the word 'approved'. To be in line with best practice, the approvals process should ensure there is segregation of duties. For example, we noted that one invoice was received and 'approved' by the same member of staff. Risk: Inefficiencies in commissioning may lead to delays in the overall procurement process, thereby increasing costs to the Council and delaying commencement of the services. Insufficient internal checks are performed at the Council, which fail to identify deficiencies or gaps within the processes around commissioning. Council staff involved in commissioning are not consistently complying with the Council’s policies and procedures. Agreed management action: 1. All contracts will be signed, and copies of these signed contracts stored for future reference. 2. The Council will explore the possibility of adjusting the reporting system such that expenditure listings can easily be tied back to the underlying invoice. 3. Invoices will not be processed without adequate approval. 4. The Council will consider introducing spot-checks and/or audits of documentation, to ensure that processes are consistently being followed across the organisation. Evidence to confirm implementation: Updated and approved process documentation that clearly sets out the requirements. Signed, dated and approved contracts. Consideration of changes to system. Spot checking process. Responsible person/title: Service Manager Target date: 28th February 2025 Findings and management actions (cont.) High Page 19
Page 20
14 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.6 Strategy The Council does not have a clear strategy specifically for the Health and Social Care Commissioning Division, supported by KPIs and milestones. Moray Council has a ‘Moray Partners in Care’ strategy, which was approved and issued in 2019. This strategy sets out the strategic plan for Health and Care for the next 10 years, across Moray. The strategy covers three broad themes: 1. Building Resilience 2. Home First 3. Partners in Care While the strategy provides a good over-arching understanding of the Council direction, the strategy does not provide sufficient detail on how the Health and Social Care Commissioning department can achieve the transformation required. This means that the strategic intent has been articulated, but this has not been operationalised. For example, the outcomes noted are not supported by clear targets, supporting KPIs and milestones for the division to hold themselves against, and this strategy is not underpinned by a delivery plan. We note that the Council is currently in the process of developing a delivery plan for this strategy, which should clearly set out guidelines for how staff at the Council can deliver on the requirements of the strategy. Risk: The Council’s Health and Social Care Commissioning Division lacks direction, and is unable to support the wider Council in achieving its aims. Agreed management action: 1. The Council will develop an implementation plan which supports the wider strategy. This implementation plan will clearly set out the goals for the Council, how these will be achieved and the method for monitoring the success of this strategy. Evidence to confirm implementation: Implementation plan incorporating the considerations in our recommendation. Responsible person/title: Head of Service Target date: 29th February 2024 Findings and management actions (cont.) Medium Page 20
Page 21
15 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.7 Invoicing Financial controls around the invoicing processes are inconsistently applied. Robust financial controls in the invoicing process are vital to ensuring that expenditure is incurred appropriately, in line with the Council’s Standing Financial Instructions (‘SFIs’). The responsibility for complying with financial controls lies with the finance team as opposed to the commissioning team. Financial control processes are not documented, and therefore controls are not applied consistently. Our review identified the following issues: Variances There is no set limit at which any variances on invoices received are subject to further investigation. Although the finance team has informally set an acceptable limit of 15 minutes for billed care time and expected care time, there is no formal documentation to support this as a limit. Queries When the invoicing team are unable to agree invoices received to underlying contracts, queries are raised with the social commissioning team if it relates to a contract or with the social worker who raised the invoice if it relates to a one-off payment. Although an explanation is sought for the variance, the team does not retain any evidence. Risk: The Council could be incurring additional cost by paying invoices for inappropriately raised bills. Without an adequate audit trail, invoices could be processed which do no meet the Council’s needs. Agreed management action: 1. The Council will formalise and document its approach to variances. 2. Staff will ensure that all evidence is retained throughout the invoicing process, to ensure that there is an adequate audit trail for all decisions made. Evidence to confirm implementation: Revised approach to variance analysis. Document retention guidance. Responsible person/title: Head of Service Target date: 29th February 2024 Findings and management actions (cont.) Medium Page 21
Page 22
16 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Findings and management actions (cont.) High Contract Management 2.8 Contracts register The Council should develop a centralised contracts register to ensure there is adequate oversight over contracts held, including their value and date. The Council holds contracts with different providers who are responsible for the delivery of social care to the residents of Moray. We requested copies of a contracts register in order to complete our testing, however the majority of staff we interviewed were unfamiliar with the contracts register and did not believe one was in place. For the purpose of sample selection, we therefore relied on a listing of all 175 suppliers with whom transactions had been raised by the Council, provided by the Procurement department, and a listing of 59 contracts provided by Commissioning. Through further investigations, we found that the Council holds a Commissioning Database, which acts as the Contracts Register. This database includes key details related to each contract, including dates, values and responsible individual for each contract. We performed data and analytics routines (see Appendix B ) over this database and identified a number of issues. Procurement maintain its own contracts register, encompassing all Council contracts and not just commissioning. However, the extent to which commissioning information is accurately presented in this register depends on the effectiveness of communication between teams. This is something we have touched on in Finding 2.2. Incomplete Fields Overall, we identified 575 blank entries out of a possible 2,701, suggesting that the database is, at most, 78.71% complete. 49.49% of budget details and 12.33% of contracting party details were incomplete. The database contained 73 contracts in total, while the listing of contracts provided by Commissioning which we used to select our sample contained 59 contracts. Through our discussions with management, we were informed that commissioning officers are not always aware of all the details relating to their contracts, as these have not been formally recorded. This results in reputational risk if commissioning officers reach out to contracting parties to ask them to confirm the details, as well as exposing the Council to the risk that they will be held to terms which they have not agreed, and are not in line with regulations. Continued… Page 22
Page 23
17 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.8 Contracts register (cont.) Out of date contracts Our data and analytics routines identified that 21.92% of contracts on the database had start dates prior to August 2012, so related to contracts more than 10 years old. 43 contracts included on the database had expired, with 38 of these having expired prior to August 2020. Through discussions with management, we were informed that contracts often reach their expiry date, and the Council is forced to roll contracts over, or continue their operation. Data Quality Our review of the contracts database found that information entered was of varying quality. For example, information was not consistently formatted and additional comments were included for some categories. Risk: There is no central oversight of contracts held. Contracts are omitted from the register and therefore not subject to the appropriate level of monitoring and review. Without a central contracts register, there is the risk that contracts expire without the Council being aware, or irregular monitoring results in the Council failing to re-tender for contracts in time, increasing use of single tender waivers and contract extensions. Budgeting or monitoring spend cannot be achieved effectively, if there is insufficient grasp of current contracts. Agreed management action: 1. Health and Social Care Moray should prioritise the development of an expenditure contracts database, which clearly sets out their expenditure and details of the agreements they hold. 2. Once established, this database should be monitored, reviewed and routinely updated to ensure that all data is accurate and of a high quality. There will be clear ownership of the contracts register, and as part of the review process these registers should be scrutinised by senior management. 3. The Contracts database will be shared and made available to all staff involved in the commissioning process, such as the procurement team. Evidence to confirm implementation: Updated contracts database reflecting the true state of commissioning within the Council. Responsible person/title: Service Manager Target date: 31st August 2024 Findings and management actions (cont.) High Page 23
Page 24
18 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.9 Performance management system The Council should prioritise the development of a performance management system in commissioning. Contracts should be subject to regular performance review to ensure the quality of work needed is delivered to end service-users. Without a sufficient performance management system, there is a risk that the quality of services is compromised. Currently, performance management is done solely on a contract basis by the senior commissioning officers. The Council has a Senior Performance Officer, in post since November 2021 whose role includes rolling out a performance management framework and system across the Council. This has not yet been done for Commissioning, and there is no timeline in place for when this will be implemented. Risk: Without a performance management system, there is inadequate oversight of performance at a team level. Agreed management action: 1. The Council will prioritise rolling out a performance management system. This framework, when rolled out, will look at performance management on a team-wide level, including looking at what performance management KPIs should be. Evidence to confirm implementation: Performance management system incorporating the considerations in our recommendation. Responsible person/title: Service Manager Target date: 29th February 2024 2.10 Contract review Contracts are currently subject to an annual review but there should be more regular review. Although contracts are reviewed periodically, this should be conducted more often. The review should be aligned with strategic objectives, and ensure providers are held to legal and regulatory standards to ensure relationships with only compliant organisations. This should be subject to pro-active review as opposed to just informal feedback. The Council should determine the standards to be reviewed against (i.e. Council or Integration Joint Board-level objectives) that providers are expected to meet. Risk: Contracts are awarded to substandard and/or unapproved suppliers that do not meet the needs of the Council including timeliness, quality and competence. This will impact on the quality of services and best value for the Council. Agreed management action: 1. The Council will implement a regular contract review procedure that assesses the suitability of providers. Evidence to confirm implementation: Contract review procedure. Responsible person/title: Service Manager Target date: 31st August 2023 Findings and management actions (cont.) High Medium Page 24
Page 25
19 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.11 Block contracts The Council should ensure there is adequate monitoring of block contracts to ensure greater accuracy of billing. We understand that the Council is already undergoing the process of moving away from block contract arrangements. This transition should be prioritised as the operation of block contracts required detailed tracking and monitoring in order to be managed well, however we have not found this to be the case. Block contracting is not monitored sufficiently enough to effectively track activity, meaning the billing which arises from this type of contracting does not align with the Council’s current position. This concerns the operation of block contracts as opposed to the use of block contracts themselves. Risk: There is insufficient tracking and monitoring of financial incentives available to the Council, resulting in the Council not obtaining optimum value for money. Agreed management action: 1. Ensure that any block contracts are appropriately monitored to ensure that best value is obtained. Evidence to confirm implementation: Active, high-quality monitoring of block contracts. Responsible person/title: Service Manager Target date: 31st August 2023 Findings and management actions (cont.) Low Page 25
Page 26
20 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –contracts We took a sample of 13 contracts under social care commissioning arrangements, using two different listings – ten from one, and three from the other. We reviewed whether each contract was in date, sufficiently approved and agrees to the contracts database. A summary of the results from our testing is as follows: Appendix A # Contract in place Contract signed Contract in date Agrees to database (value) Agrees to database (date) Agrees to database (contract no.) 1 (Note 4) (Note 5) (Note 6) 2 (Note 3) 3 (Note 1) 4 5 6 (Note 7) 7 8 9 (Note 2) 10 11 12 13 Page 26
Page 27
21 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –contracts (cont.) Appendix A Note 1 – we were unable to obtain documentation relating to four contracts (highlighted grey), suggesting that the Council should focus on maintaining audit trails (Finding 2.5) . We have excluded these contracts from our charts to more accurately display our results, and the following notes are all in addition to these four contracts. Note 2 – there was one arrangement for which we confirmed with the Council that there was no contract in place, leaving no formal document to govern this working relationship. This is in addition to the four contracts identified in Note 1. (Finding 2.5) Note 3 – there were five contracts where signatures were incomplete. Three of these were signed by the Council but not the contracting party, one was signed by neither party, and the final one related to the arrangement in Note 2 above. (Finding 2.5) Note 4 – there were five contracts that had expired, two of which had extensions that expired March 2022 and March 2020, one of which contained no end dates meaning we were unable to confirm whether it was in date, and a further one relating to the arrangement in Note 2 above. The final one contained a clause stating the duration as four years with a further conflicting clause stating it ends when no longer required. (Finding 2.5) Note 5 – we were unable to reconcile contract amounts to the contracts database for all of the contracts because contracts and the database used different pricing calculations (e.g. total / per resident per week). (Finding 2.8) Note 6 – we were unable to reconcile end dates with the contracts database for eight contracts. (Finding 2.8) Note 7 – we were unable to reconcile contracts numbers with the contracts database for four contracts. (Finding 2.8) Contract in place Contract signed Contract in date Agrees to database (value) Agrees to database (date) Agrees to database (contract no.) Yes No Fig 1. Summary of Sample Testing We have presented a summary of our contract sample testing findings in graphical form, in Figure 1. Additional comments In addition to these findings from our sample testing, we were unable to locate any document that stipulates who has sufficient power to sign and approve contracts. We would expect to see this is a scheme of delegation, or similar. Therefore, it cannot be confirmed whether the member of staff signing on behalf of the Council had the power to do so. (Finding 2.5) Page 27
Page 28
22 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –invoices We obtained a list of AP transactions for HSCM in 2022 and selected a sample of 25 invoices from this listing. We then reviewed whether the amount as per the invoice agreed with the listing, whether the supplier details as per the invoice agreed with the listing, and whether the invoice had been sufficiently approved. A summary of the results from our testing is as follows: Appendix A # Amount agrees to invoice Supplier details agree to invoice Approval 1 (Note 1) 2 3 (Note 2) 4 5 6 7 8 9 10 11 12 13 # Amount agrees to invoice Supplier details agree to invoice Approval 14 15 16 (Note 3) 17 18 19 20 21 22 23 24 25 Page 28
Page 29
23 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –invoices (cont.) Appendix A Note 1 – we received confirmation from the Council that it was not possible for 15 invoices in our to match expenditure with individual invoices due to the volume of payments. As a result we were unable to test these samples. The Council should ensure that sufficient documentation is retained which acts as an audit trail for expenditure in order to reduce the risk of duplicate or missing payments. (Finding 2.5) Note 2 – for the ten invoices we were able to obtain documentation for, we were not able to confirm that approvals were satisfactory. Although we were able to acknowledge that some type of confirmation had been received for the payment of invoices, we noted a number of issues with this. For example, for one invoice the person who received it was also the person who approved it, meaning there was no segregation of duties. Other invoices had been approved in batches, meaning individual invoices may not have been sufficiently checked. Furthermore, as we have not been able to locate a document setting out a scheme of delegation (i.e. who has the authority to approve payments), it was also not possible to confirm that those confirming approval had the power to do so. (Finding 2.5) Note 3 – for all but one of the invoices in our sample we obtained documentation for, we were able to reconcile the supplier details and value as per the invoice with the list of AP transactions. For the exception, the invoice value could be reconciled but the supplier name did not match that contained within the list of AP transactions. This poses a risk that payments are sent to the incorrect person or entity. (Finding 2.5) Page 29
Page 30
24 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –governance Appendix A We examined meeting minutes from three governance forums on an operational level, management level and leadership level and noted our findings in the boxes below. (Finding 2.1) Commissioning Group Meetings (operational level) We could only obtain documentation for one operational meeting. Staff feel this meeting is always effective, but it is not held consistently enough. The meeting we reviewed was well attended and contained a number of useful actions. The risk register, however we found to be empty, unlike the ‘operational issues’ register which appeared comprehensive. Senior Management Team Meetings (management level) We sampled ten of these meetings, for which documentation was readily available. Each meeting had space for a standing agenda item termed ‘Gaps in Social Care Provision’ where those with oversight of commissioning are to give an update of Moray’s current position. However, on three occasions this standing item referred to other parts of the meeting where social care was discussed briefly, and lacked depth and detail. On a further three occasions, this item was not discussed at all. Systems Leadership Group Meetings (leadership level) We sampled three of these meetings, all being generally well attended. But, we did note that commissioning was not discussed in any of the three meetings sampled and there was no commissioning representative in one of them. As a result, no constructive actions were drawn from the meetings we reviewed. Page 30
Page 31
25 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Analysis of commissioning database We obtained the commissioning database used to record contracts entered into with care providers, which showed a total of 73 contracts. We then performed data analysis on the database and have noted two key areas of risk – (i) completeness; and (ii) contract start/end dates. We have set out below our approach to analysing this information and our observations, as well as a number of other key findings to be considered. For all of the below comments, we used a cut off of August 2022. Area of analysis – completeness Approach: — We initially recognised a large number of blank fields within the database and grouped columns into the five categories reflected in Table 1 & Chart 1 below . We then noted how many blank fields each category had and tested for completeness across the database. Findings: The database contains budgets ranging from 2017/18 to 2023/24, however fields relating to budgets were the least complete, with 49.49% of entries being incomplete. This suggests budgets are not being monitored sufficiently. (Finding 2.8) The most complete category was information relating to contracts such as dates (however, see next page) and contract numbers, as 9.93% of fields were incomplete. (Finding 2.8) Overall, we identified 575 blank entries out of a possible 2,701, suggesting that the database is, at most, 78.71% complete. (Finding 2.8) Appendix B Category of information Total fields in category No. of blank fields Incomplete % Risk rating Contracting party details 730 90 12.33% Contract information 584 58 9.93% Budgets 584 289 49.49% Monitoring 438 63 14.38% Other (e.g. H&SC standards, contract request requirements, etc). 365 75 20.55% Table 1 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Other Contract information Contracting party details Budgets MonitoringChart 1 Page 31
Page 32
26 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Analysis of commissioning database (cont.) Area of analysis – contract start/end dates Approach: — We condensed the database using four identifiers – name of the contracting organisation, contract numbers, start date, and end date. From this, we were able to analyse start and end dates in order to reach the following conclusions. Findings: The earliest contract start year was 2004, with 16 contracts commencing more than ten years ago (before August 2012). This equates to 21.92% of contracts in the database. (Finding 2.8) A further 27 contracts commenced more than five but less than ten years ago (August 2012 – August 2017), equating to 36.99% of contracts in the database. In Chart 2 below we have summarised the position regarding contract start dates in. (Finding 2.8) The earliest contract expiry year was 2017 and we identified a total of 43 expired contracts, equating to 58.90% of contracts in the database. This suggests that expired contracts have either not been removed from the database or renewals have not been processed correctly. (Finding 2.8) Of those 43 expired contracts, 21 had expired more than two years ago (before August 2020), equating to 28.77% of contracts in the database. (Finding 2.8) Appendix B 21.92% 36.99% 27.40% 13.70% Start date more than 10 years ago Start date 5-10 years ago Start date less than 5 years ago No information Other key findings We noted two contracts that were not assigned a commissioning officer, which showed in the database as ‘unallocated’. This presents a risk that there will be insufficient monitoring activity and limits accountability should problems arise with these contracts in particular as there is no one assigned to hold accountable. We found three instances where the database stated that there was no contract in place. This suggests that either work begins before contracts are signed or the database is not updated regularly enough. Chart 2 Page 32
Page 33
27 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Scope extract Background of the internal audit Moray Council has identified the processes that support the commissioning of services provided externally as an area of focus to ensure continuous improvement within services. The Commissioning Service is managed within the Moray Health and Social Care Partnership, and is primarily concerned with social care commissioning. The Chief Officer and Head of Service, who is also the Chief Social Work Officer, have requested a review of the Commissioning Service as part of a continuous improvement programme, and for the assurance required by the Integrated Joint Board’s Audit, Performance and Risk Committee. The Chief Officer has been given a specific instruction from the Committee to seek this review. The review will look at the work undertaken by the Commissioning Service and provide a report to the Integration Joint Board on how social work contracts are awarded and managed. Our report will provide detail findings and improvement recommendations for the Council’s Management and Commissioning Service to implement through an action plan. Our review will assess the design of controls over the Council’s commissioning process against the national background, local priorities and best practice. We will also review the operating effectiveness of the commissioning process and the extent to which these reflect the current Standing Orders, Standing Financial Instructions and the Scheme of Delegation in place and the Council’s level of compliance with these. Specifically, roles and responsibilities for the commissioning process need to be clearly defined and adhered to. For any contract management to be successful the Council must ensure that contracts are known and understood by all those who will be involved in their management and there are clear lines of responsibility, roles and accountability. Contracts represent an area of risk for many Councils where relationships often rely heavily on providers to bill accurately for the services provided. Our review will also therefore assess the processes and controls in place over the monitoring of contracts, management of contractual relationships and consequences of KPI and/or contract breaches. Our approach Our work will involve the following activities: — Meetings with the key staff involved in the commissioning and management of contracts; — Walkthroughs of the processes for commissioning and monitoring contracts; — Desktop review of documentation supporting the internal controls; — Sample testing of ten contracts; and — Benchmarking of the commissioning and contract management processes and policies against good practice. Appendix C Page 33
Page 34
28 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Scope extract –risks identified Appendix C Key risks identified Objective One: Commissioning Controls 1 The Council does not have an accurate internal needs analysis process in place. This results in the potential under and/or overstatement of business needs and unrealistic budgets and timescales impacting on the subsequent procurement decisions and best value considerations. 2 Contracts are awarded to substandard and/or unapproved suppliers that do not meet the needs of the Council including timeliness, quality and competence. This will impact on the quality of services and best value for the Council. 3 Contracts are awarded outside of the formal procurement procedures, preventing a fair tender process. This may also lead to the absence of appropriate authorisation. 4 Inefficiencies in commissioning may lead to delays in the overall procurement process, thereby increasing costs to the Council and delaying commencement of the services. 5 The Council have insufficient organisational capability and capacity with regard to the commissioning skills and resources required to deliver best value. 6 The Council have insufficient governance processes in place to successfully plan, commission and manage contracts with the highest complexity, cost and risk. 7 Insufficient internal checks are performed at the Council, which fail to identify deficiencies or gaps within the processes around commissioning. 8 Council staff involved in commissioning are not consistently complying with the Council’s policies and procedures. Objective Two: Contract Management Governance 9 The Council does not have robust procedures in place, applied consistently across the Council for agreeing, monitoring and reporting on contracts. 10 The Council does not have example documentation and contracts in place, which provide the wording for key clauses to help ensure that Council contracts are worded in line with legal expectations and Council requirements. 11 Roles and responsibilities are not clearly set out and allocated, resulting in inadequate completion of tasks. 12 Invoices raised are incomplete, inaccurate or not raised in a timely manner. 13 There is inadequate central oversight of billing and budgeting in relation to contracts. Expenditure related to contracts is not appropriately authorised, in line with Standing Financial Instructions. 14 There is insufficient tracking and monitoring of financial incentives available to the Council, resulting in the Council not obtaining optimum value for money. 15 The Council does not have effective KPI’s in place, to support monitoring and measuring of performance against contract terms. 16 The Council does not effectively share and report on data relating to contract performance throughout the Council, limiting the Council’s ability to improve contract performance. 17 Contract obligations, including non-financial obligations, are not clear opening up the Council to the risk of regulatory or legal non-compliance. Page 34
Page 35
29 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Acknowledgements Appendix D We would like to thank the following individuals for their contribution during this internal audit: Stakeholder Title Simon Bokor-Ingram Chief Officer of Health and Social Care Moray Jane Mackie Chief Social Worker Roddy Huggan Commissioning Manager Aimee Borzoni Senior Commissioning Officer Diane Beattie Head of Procurement Carl Bennet Senior Performance Manager Fiona McPherson Public Involvement Officer Charles McKerron Integrated Services Manager Laurie Anne Davidson Development Worker Michelle Fleming SDS/Carers Officer Stakeholder Title Catherine Quinn Interim Community Care Finance Officer Carmen Gillies Interim Strategy Lead Tracie Wills Senior Commissioning Manager Pauline Knox Senior Commissioning Manager Tracey Peden Development Officer Page 35
Page 36
30 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Ratings definitions We have set out below the overall report grading criteria and priority ratings used to assess each individual finding. Appendix E Low Medium High Issues arising that would, if corrected, improve internal control in general but are not management actions which could improve the efficiency and / or effectiveness of the system or process but which are not vital to achieving your strategic aims and objectives. These are generally issues of good practice that the auditors consider would achieve better outcomes. A potentially significant or medium level weakness in the system or process which could put you at risk of not achieving its strategic aims and objectives. In particular, having the potential for adverse impact on your reputation or for raising the likelihood of your strategic risks occurring. A significant weakness in the system or process which is putting you at serious risk of not achieving its strategic aims and objectives. In particular: significant adverse impact on reputation; non-compliance with key statutory requirements; or substantially raising the likelihood that any of your strategic risks will occur. Any management action in this category would require immediate attention. Finding priority rating Definition Significant assurance Significant assurance with minor improvement opportunities Partial assurance with improvements required The system is well designed and only minor low priority management actions have been identified related to its operation. Might be indicated by priority three only, or no management actions (i.e. any weaknesses identified relate only to issues of good practice which could improve the efficiency and effectiveness of the system or process). The systems is generally well designed however minor improvements could be made and some exceptions in its operation have been identified. Might be indicated by one or more priority two management actions. (i.e. there are weaknesses requiring improvement but these are not vital to the achievement of strategic aims and objectives - however, if not addressed the weaknesses could increase the likelihood of strategic risks occurring). Both the design of the system and its effective operation need to be addressed by management. Might be indicated by one or more priority one, or a high number of priority two management actions that taken cumulatively suggest a weak control environment. (i.e. the weakness or weaknesses identified have a significant impact preventing achievement of strategic aims and/or objectives; or result in an unacceptable exposure to reputation or other strategic risks). Overall report rating Definition No assurance The system has not been designed effectively and is not operating effectively. Audit work has been limited by ineffective system design and significant attention is needed to address the controls. Might be indicated by one or more priority one management actions and fundamental design or operational weaknesses in the area under review. (i.e. the weakness or weaknesses identified have a fundamental and immediate impact preventing achievement of strategic aims and/or objectives; or result in an unacceptable exposure to reputation or other strategic risks). Page 36
Page 37
31 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential This report has been prepared solely for MHSCP in accordance with the terms and conditions set out in our engagement letter. We do not accept or assume any liability or duty of care for any other purpose or to any other party. This report should not be disclosed to any third party, quoted or referred to without our prior written consent. © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG global organisation of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved. The KPMG name and logo are registered trademarks or trademarks of KPMG International. | CREATE: CRT128147 kpmg.com/uk This report is provided pursuant to the terms of our engagement letter. Nothing in this report constitutes a valuation or leg al advice. We have not verified the reliability or accuracy of any information obtained in the course of our work, other than in the limited circumstances set out in our engagement letter. This report is for the sole benefit of The Moray Council: The Moray Health and Social Care Partnership (‘MHSCP’). In preparing this report we have not taken into account the interests, needs or circumstances of anyon e apart from MHSCP, even though we may have been aware that others might read this report. This report is not suitable to be relied on by any party wishing to acquire rights against KPMG LLP (other than MHSCP) for any purpose or in any context. Any party other than MHSCP that obtains access to this report or a copy (under the Freedom of Information Act 2000, the Freedom of Information (Scotland) Act 2002, through the MHSCP Publication Scheme or otherwise) and chooses to rely on this report (or any part of it) does so at its own risk. To the fullest extent permitted by law, KPMG LLP does not as sume any responsibility and will not accept any liability in respect of this report to any party other than MHSCP. Any disclosure of this report beyond what is permitted under our engagement letter may prejudice substantially our commercial interests. A request for our consent to any such wider disclosure may result in our agreement to these disclosure restrictions being lifted in part. If MHSCP receives a reque st for disclosure of the product of our work or this report under the Freedom of Information Act 2000 or the Freedom of Information (Scotland) Act 2002, having regard to these actionable disclosure restrict ions MHSCP should let us know and should not make a disclosure in response to any such request without first consulting KPMG LLP and taking into account any representations that KPMG LLP might make. Page 37
Page 38
Page 38