Agenda Document Pack - Audit and Scrutiny Committee - 10/05/2023
Moray Council · 10 May 2023
Back to Audit and Scrutiny Committee — 10 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 10 May 2023 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 10 May 2023 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of the Meeting of the Audit and Scrutiny Committee of 15 February 2023 5 - 6 4. Written Questions ** 5. Internal Audit Section Completed Projects Report by Audit and Risk Manager 7 - 48 6. Internal Audit Section Update Report by Audit and Risk Manager 49 - 74 7. Annual External Audit Plan Year Ending 2022-23 Report by Depute Chief Executive (Economy, Environment and Finance) 75 - 154 8. Question Time *** Consider any oral question on matters delegated to the Committee in terms of the Council's Scheme of Administration. Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. *** Question Time - At each ordinary meeting of the Committee ten minutes will be allowed for Members questions when any Member of the Committee can put a question to the Chair on any business within the remit of that Section of the Committee. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than ten minutes after the Committee has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he/she can submit it in writing to the proper officer who will arrange for a written answer to be provided within seven working days. Page 3
Page 4
THE MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Theresa Coull (Member) Councillor John Cowe (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Lindsey Robinson Clerk Telephone: 07966 120593 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 15 February 2023 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Councillor Peter Bloomfield, Councillor Tracy Colyer, Councillor Theresa Coull, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Graham Leadbitter, Councillor Neil McLennan, Councillor Shona Morrison, Councillor John Stuart APOLOGIES Councillor John Cowe IN ATTENDANCE Also in attendance at the above meeting were the Chief Executive, Head of Governance, Strategy and Performance, Audit and Risk Manager, and Lindsey Robinson, Committee Services Officer as clerk to the meeting. 1. Chair Councillor Graham Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Order 21 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. 3. Minute of the Meeting of the Audit and Scrutiny Committee of 23 November 2022 The minute of the meeting of the Audit and Scrutiny Committee dated 23 November 2022 was submitted and approved. 4. Written Questions ** The Committee noted that no written questions had been submitted. 5. Internal Audit Plan - Year Ending 31 March 2024 A report by the Audit and Risk Manager provided the Committee with the details of the planned internal audit coverage for the year ending 31 March 2024. Item 3. Page 5
Page 6
Following consideration, the Committee agreed to note the proposed Internal Audit coverage for the 2023/24 financial year. 6. Internal Audit Section Update A report by the Audit and Risk Manager provided the Committee with an update on the work of the Internal Audit Section. During consideration the Audit and Risk Manager advised the Committee that the audit of ICT Hardware Asset Management would be carried forward due to the inclusion of the Aberlour Nursery Project. Thereafter, the Committee agreed to note the contents of the report. 7. Internal Audit Section - Completed Projects A report by the Audit and Risk Manager advised the Committee on the work of the Internal Audit Section for the period from 24 November 2022 to 15 February 2023. Following consideration, the Committee agreed to note the contents of the report. 8. Local Government Benchmarking Framework 2020-21 Results A report by the Depute Chief Executive (Education, Communities and Organisational Development) presented the Committee with a corporate overview of benchmarking performance data for the period 2020-21. Councillor McLennan entered the meeting during the discussion of this item. Following consideration, the Committee agreed to note the Council's performance in terms of a corporate overview of benchmarking results. 9. Question Time *** The Committee noted that no questions were asked. Page 6
Page 7
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 10 MAY 2023 SUBJECT: INTERNAL AUDIT SECTION – COMPLETED PROJECTS REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 16 February 2023 to 10 May 2023. 1.2 This report is submitted to Committee in terms of Section III (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the following internal audit work concluded during the period 16 February 2023 to 10 May 2023: Domestic Refuse Disposal 3.2 An audit review of the arrangements for collecting refuse materials from domestic properties was undertaken. Moray Council collects refuse at approximately 46,000 domestic properties at the cost of £3.1 million annually. Systems were reviewed to ensure the most effective and efficient use is made of resources in collecting domestic waste. The audit also checked the procedures for disposing of recyclable waste. The executive summary detailing the findings and recommendations for this project are given in Appendix 1. Item 5. Page 7
Page 8
Building Services - Planned Maintenance Projects 3.3 An audit of systems and procedures in managing Planned Maintenance Projects within Building Services was undertaken. The total budget for 2022/23 amounted to approximately £5 million and included the works undertaken for the replacement of bathrooms, kitchens, central heating systems and disability adaptations. 3.4 The audit scope involved an overview of how the annual planned maintenance programme is determined and the contract management arrangements of projects undertaken by Building Services. The audit selected a random selection of projects to verify costs to supporting documentation and compliance with contract conditions and regulations. In addition, due to a special investigation previously reported concerning overtime claimed by officers, further testing was also undertaken into the management of overtime payments. The executive summary detailing the findings and recommendations for this project are given in Appendix 2. European Social Fund 3.5 An audit was undertaken of the monies received from European Social Funding. The European Social Fund is administered by the Scottish Government with the objective of improving employment, education and supporting the most vulnerable people at risk of poverty. The Council secured approximately £1.1 million over 4 years in Phase 2 European Social Funding to deliver a Poverty & Social Inclusion programme that provides free confidential help and advice to people with money, debt or benefit problems. The audit reviewed the governance and administrative arrangements established to support the delivery of the Poverty & Social Inclusion programme and complies with the conditions of the funding agreement. Overall effective management arrangements were found. The executive summary for this project is given in Appendix 3. Aberlour Early Years Learning & Childcare Scheme 3.6 An audit has been undertaken into the contract management arrangements for refurbishing Aberlour's early years and childcare nurseries. In Aberlour, the early years and childcare service is delivered by private and council nurseries operating from the same premises. The review was requested after concerns were raised by elected members regarding the management of this scheme. The agreed scope for the audit was to review the reporting arrangements and compliance with Financial Regulations, Procurement Guidelines and the Conditions of the Contract for the refurbishment of the Aberlour early years learning and childcare premises. As this review was undertaken due to specific concerns raised, it is considered that the full report detailing all the findings from the audit undertaken should be provided. The audit report is given in Appendix 4. Page 8
Page 9
4 SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. At its meeting on 27 April 2023, the Corporate Management Team (CMT) considered the Internal Audit report on the Aberlour Early Years’ Learning and Childcare along with the wider End of Project Report which reported on the overall £55m Early Years Expansion Programme in Moray, of which the Aberlour project was the final part. CMT noted the comprehensive end of project report (see background documents as listed) and the overall success of the programme to expand funded early learning and childcare hours from 600 to 1140 for vulnerable 2s and 3-4 year olds by August 2021. CMT acknowledged that the expansion project was completed during the period of the pandemic which created a more challenging operating environment for the delivery of the new statutory requirement. As part of this, the Aberlour expansion to 1140 hours was due to be delivered in August 2021, which was the focus for the project team at that time. There are a number of learning points within the report and CMT were pleased to note that these are being taken forward to inform future work. Page 9
Page 10
CMT also considered the Internal Audit report and sought clarification from the Internal Auditor on various points regarding the contract management arrangements for the Aberlour project. CMT noted that there are a number of recommendations within the report and were supportive of the action identified to address these. In addition, CMT noted that since the original proposal for temporary units, a range of options had been assessed and considered in developing alternative approaches for the delivery of the decant for the project but that the project had not yet moved to the delivery phase as costings remain outstanding, which may require further consideration of options in a context of rising costs. CMT would wish to ensure that the contractual arrangements are robust ahead of project construction commencing to reflect the points set out in the Audit report and will ensure this is taken forward by relevant officers. CMT also agreed with the Audit recommendation for an urgent resolution to the future use of the temporary units and noted that this is currently part of wider considerations related to the ELC service due to be brought to the council before the summer recess and which will enable a decision on alternative use or sale at that point. 5 CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files 15-0019 Early Learning Childcare - End of Project Report Appendix 1 - Delivery_Plan_Sep_2017 Appendix 2 – Grant Award Thank You from Torridon Education Group Appendix 3 - Care Inspectorate Grading Data Compared August 2017 and June 2022 Appendix 4 - Worked Example Hourly Rate Appendix 5 - RADIC Log Appendix 6 - Moray Council ELC Internal Audit Report Ref: SPMAN-1042990102 -145 Page 10
Page 11
Appendix 1 AUDIT REPORT 23’016 DOMESTIC REFUSE COLLECTION Executive Summary The annual audit plan for 2022/23 provides for an audit review to be undertaken of the arrangements for the collection of refuse materials from domestic properties. Local Authorities have a statutory duty to provide this service in accordance with the Environmental Protection Act 1990. Moray Council collects refuse at approximately 46,000 domestic properties at the cost of £3.1 million per annum. The scope of this audit was to review systems and procedures to ensure the most effective and efficient use of resources is made for collecting domestic waste. The audit also reviewed the arrangements for disposing of recyclable waste with analysis of the Financial Management System noting this was provided at a cost in excess of £880,000 per annum. This included disposal of plastic, glass and biodegradable waste, in addition to paper / card, aluminium and steel cans for which the Council receives regular payments from recycling contractors. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The areas identified for management attention include the following :- • Incorrect accounting was noted in the treatment of Value Added Tax (VAT). The audit found that no VAT had been declared to HM Revenue and Customs (HMRC) for income received from the recycling of paper since September 2020. This amounted to £85,284 of VAT, which requires a disclosure notice and an expected interest penalty charge payable to HMRC. The service has been advised of the documentation that should be provided to the Payments Section to ensure the future proper accounting for VAT. • The Council has an agreement with a contractor for the recycling of plastic. The audit noted there was an expectation this would generate income for the Council from regular payments made by the contractor for the plastic provided for recycling. Unfortunately, the Council has received no payment due to quality issues in plastics submitted. A review should be undertaken of current systems for the recycling of plastic to determine whether improvements can be made to existing operations. • The Council receives payments from the aluminium and steel cans provided to a recycling contractor. However, it was found there is no contractual agreement between the Council and this recycling contractor for cans disposal. The service should formalise these arrangements. Item 5. Page 11
Page 12
Appendix 1 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Service operations are planned to achieve best value principles. 5.01 Consideration should be given to exploring software applications that could assist the process and provide value for money opportunities in the determination of operational routes and the resources required. Low Yes As a service we have made initial enquiries with suppliers of route optimisation software and have received one demonstration with another booked for January. Following this we will review to confirm the best value for money option. We will liaise with Head of Service to determine feasibility against budget constraints. Waste Manager 31/05/2023 Key Control: Staffing requirements are carefully assessed based on operational needs and payments made to staff are appropriately controlled. 5.02 Documented business continuity plans should be agreed to ensure continuous delivery of services in the Medium Yes The service has been liaising with the Business Continuity & Risk Management Waste Manager 31/01/2023 Page 12
Page 13
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation event of any disruption in meeting operational requirements. Officer and has drafted an initial business continuity plan. This was returned after review on 23/11/22 for further considerations. 5.03 Officers should be reminded to ensure timesheets are carefully checked prior to authorisation, and supporting documentation is completed accurately before being passed to the payroll service for payment. Medium Yes Team Leaders have advised all staff of the need to fully complete timesheets with all relevant information. Process has been reviewed and timesheets are being checked by Waste Operations Officer before forward to Admin where there is a double check of the timesheet summary for Payroll. Accountancy now have sight of Payroll data submissions to check assigned cost centres. Waste Manager Implemented Page 13
Page 14
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Vehicle costs borne by the service are accurately calculated and allocated based on service requirements and resource planning. 5.04 Consideration should be given to the apportionment of vehicle and transport costs to the green waste collection cost centre to enable further budgetary control of all elements of the domestic refuse collection service. Low Yes Historically the same vehicles were used for residual waste and biowaste on a weekly rotation. Since implementation of alternative collection frequencies vehicles are assigned to collection of biowaste therefore specific vehicle costings will be allocated to green waste budget lines. Waste Manager 31/01/2023 Key Control: Disposal of recyclable materials collected from kerbside is controlled by formalised contractual arrangements with approved external contractors and all payments made in line with contractual terms. 5.05 Management should review current arrangements for plastic recycling to determine whether improvements can be made to decrease haulage costs and achieve higher quality submissions that could Medium Yes Quality considerations / standards have changed within the industry since tender and complexities also exist in the operation of the Materials Recovery Facility by a third sector organisation. Waste Manager 31/01/2024 Page 14
Page 15
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation generate additional income for the Council. The national Deposit & Return Scheme (DRS) will be live from 16/8/23 and is expected to capture up to 90% of the materials currently processed. The early impact of DRS will be evaluated and a review of plastic recycling arrangements then undertaken. 5.06 A contract should be agreed between the Council and a third sector organisation for providing a rediverting and recycling of waste service. The agreement should include the rates payable and service specification. Low Yes Agree there is a general lack of formal documentation between the Council and third sector organisation to determine appropriate diversion rates. This will need to be taken forward with support from Procurement colleagues, with either a contract or service level agreement to be implemented. Waste Manager 30/04/2023 Page 15
Page 16
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.07 Supporting documentation should be provided of VAT applicable income received by the Service to the Payments Section to ensure proper accounting arrangements can be followed in compliance with HMRC regulations. High Yes This has now been resolved with self- billing invoices being sent to Payments on receipt to ensure VAT is accounted for. Payments have now received all outstanding self-billing invoices and have processed the required VAT adjustments. Waste Manager Implemented 5.08 Documented agreement should be undertaken to formalise arrangements for recycling aluminium and steel cans. Medium Yes Discussion has taken place between Council and the current reprocessor with a view to formalise arrangements through an extension of the terms of the Dry Mixed Recyclates contract. Options will be reviewed with Procurement colleagues whilst being mindful of the imminent implications of the introduction of the Waste Manager 30/04/2023 Page 16
Page 17
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Deposit & Return Scheme. Page 17
Page 18
Page 18
Page 19
Appendix 2 AUDIT REPORT 23’017 BUILDING SERVICES - PLANNED MAINTENANCE PROJECTS Executive Summary The annual audit plan for 2022/23 provided for a review of Planned Maintenance Projects undertaken by Building Services. The total budget for 2022/23 amounted to approximately £5 million and included the works undertaken for the replacement of bathrooms, kitchens, central heating systems and disabled adaptations. A planned maintenance programme of projects to be undertaken is agreed annually between Property and Building Services. It was noted that service delivery, including performance management is administered through a Partnership Agreement. The audit scope involved an overview of how the annual planned maintenance programme is determined and the contract management arrangements of projects undertaken by Building Services. The audit involved a random selection of projects to verify costs to supporting documentation and compliance with contract conditions and regulations. Additional testing was also undertaken of the systems regarding the management and control of overtime paid to officers. This was due to a special investigation undertaken of the overtime claims made by two officers within Building Services. The audit concerned the overtime paid to these officers and whether the individuals had actually undertaken the work claimed. The findings of this investigation have been reported separately to the Building Services Manager. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The audit review has highlighted the following areas for improvement:- • It is pleasing to note that Building Services monitor planned maintenance performance through internally agreed targets and participation in Association for Public Service Excellence (APSE) benchmarking exercises with other Local Authorities. However, consideration should also be given to developing performance targets for the completion of works from comparisons or benchmarking with the private sector. • It was found that budgetary and actual costs of planned works are calculated from established costing arrangements. The audit noted the basis for determining the annual percentage increases in estimated costs for the planned maintenance programme is based on a costing exercise undertaken in 2019. In addition, the actual costs for works completed use percentage uplift rates for the recovery of overtime, overheads and use of sub-contractors. Costing rates should be reviewed to ensure increases provide greater transparency and supports more accurate performance data of the actual costs of the works undertaken. Item 5. Page 19
Page 20
Appendix 2 • A review of the system for authorising and recording overtime paid to officers highlighted further improvements to current administrative arrangements. Audit testing found overtime claims had not been correctly approved or a clear audit trail maintained detailing the specific job number or reason for authoring the additional hours. Page 20
Page 21
Appendix 2 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Planned maintenance works are managed in accordance with contract, procurement and financial regulations. 5.01 A review should be undertaken of the revised working time arrangements for craft and manual officers agreed at a meeting of the Communities Committee on 22 October 2013 (para. 21 of the minute refers). If the benefits of these changes to core hours and shift patterns remain, an agreement should be sought to continue with current arrangements. Medium Yes Survey of staff to be carried out and report of findings to be consulted with staff and Trade Unions, to determine if current shifts should remain. Building Services Manager 30/09/2023 5.02 Consideration should also be given in developing performance targets for the time taken to complete works from comparisons or benchmarking with the private sector. Medium Yes Benchmarking to be carried out by Property QS team to compare DLO performance in relation to external contractors. Principal Quantity Surveyor 31/03/2024 Page 21
Page 22
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.03 A review should be undertaken of the rates used and accounting arrangements for determining budgets and recovery of costs of planned maintenance works. Medium Yes Planned Maintenance recharge rates to be reviewed, as well as overhead allocation. Building Services Manager 31/03/2024 5.04 Procedures should be developed to allow the recording and monitoring of the metal collected for recycling. Low Yes Written procedure to be developed for all waste handling, including disposal of scrap. Building Services Manager 31/05/2023 5.05 Officers should be reminded of the Council’s Retention Schedule to ensure all have a clear understanding of the time periods regarding the retention of records. Low Yes Retention schedules to be reviewed for all paper stores issue tickets.as part of developing paperless Building Services Manager 30/06/2023 Page 22
Page 23
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation stock issues on new Datastox system. 5.06 Officer timesheets should be amended to allow any overtime undertaken to be recorded against a specific job number. In accordance with agreed operating arrangements, officers’ timesheets must be authorised by a supervisor and a co-ordinator. Medium Medium Yes Yes Timesheets now reviewed and agreed with Internal Audit and Payroll to capture this information. (ICT working on developing automatic timesheet recording via hand held devices). Building Services Manager 31/03/2023 5.07 The use Ctrack system should be investigated as an aid to allow the monitoring of officers timesheets of the working time charged to jobs. Medium Yes C-Track reports now being generated and issued to relevant officers weekly. A monthly Building Services Manager 31/03/2023 Page 23
Page 24
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation timesheet audit also now carried out of high overtime claims against C-Track records. (A Council wide Safe Driving and Vehicle Location Policy is being developed). 5.08 All Clerk of Works Instructions should be recorded detailing the requirement for any additional work needed within planned works. Medium Yes DLO Procedures in place to record variations should be used by all relevant staff. Refresher Training on this to take place with relevant officers. Building Services Manager 30/06/2023 5.09 Contracts should be agreed with companies used regularly for the supply of goods and materials Medium Yes Annual spend will be Building Services Manager 31/03/2024 Page 24
Page 25
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation where annual expenditure exceeds the Quick Quote threshold of £5000. reviewed after financial year end 31 March 2023 and all off contract spend highlighted as part of Departmental Procurement Plan (DPAP) 2023/24. Page 25
Page 26
Page 26
Page 27
Appendix 3 AUDIT REPORT 23’022 EUROPEAN SOCIAL FUND Executive Summary The Annual Audit Plan for 2022/23 provides for a review of monies received from European Social Funding. The European Social Fund is administered by the Scottish Government with the objective of improving employment, education and supporting the most vulnerable people at risk of poverty. The Council successfully secured approximately £1.1 million over 4 years in Phase 2 European Social Funding to deliver a Poverty & Social Inclusion programme that provides free confidential help and advice to people with money, debt or benefit problems. The scope of this audit was to provide assurance that effective governance and administrative arrangements had been established to support the delivery of the Poverty & Social Inclusion programme and complies with the conditions of the funding agreement. The programme provided funding for Council Money Advice and Income Maximisation Projects and a Challenge Fund accessed by two External Partners to deliver the programme to a broader community. It was noted that 20% match funding was required to be provided by the Council and External Partners to deliver the overall programme. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The audit noted the following points in the administration of the Scheme:- • Supporting records were verified to prove the costs claimed within previous grant claims submitted to the Scottish Government. This expenditure was related to the staffing costs of officers dedicated to programme delivery. At the time of the audit £349,000 of funding has been received and £438,000 is awaiting verification by the Scottish Government. There is no indication of any issues with the outstanding claim; however the final outturn and claim figures will not be known until project cessation on 31st March 2023. Current estimates indicate a small underspend on the overall grant allocation of approximately £45,000 due to staffing vacancies and ineligible employee sickness costs over the 4 years of the programme. • Conditions of the funding agreement required the Council and External Partners to deliver support in excess of 1,800 poverty affected households with the objective of improving financial skills, removing debt barriers to social inclusion and encouraging employment, training and education. It was found these target levels of participation have not been achieved, with the Council led programme at the time of audit reporting participant registration at 65% of the target level, and Challenge Fund partners, who received their funding awards at a later date, reporting a combined average of 61% participation compared to the target. The Item 5. Page 27
Page 28
Appendix 3 terms of the funding agreement detail financial penalties based on a percentage charge of the funding award depending on achieved participation levels. However, no penalty is applied if 65% of targets set are achieved. The Council has recently submitted a change request to the Scottish Government seeking a reduction of 15% in the target level for the Challenge Fund and at the time of the audit review, a response was awaited. Clients continue to be worked with to maximise participation levels by project end in March 2023. Page 28
Page 29
Appendix 4 Moray Council Internal Audit Section 1 Aberlour Early Years Learning & Childcare Scheme Final Report Item 5. Page 29
Page 30
Appendix 4 Moray Council Internal Audit Section 2 DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Aberlour Early Years Learning & Childcare Scheme REPORT REF: 23’014 Table of Contents Section No Section Title 1 Executive Summary 2 Introduction 3 Audit Scope 4 Summary Assessment 5 Findings 6 Recommendations Page 30
Page 31
Appendix 4 Moray Council Internal Audit Section 3 1. Executive Summary An audit has been undertaken into the operational management arrangements for the refurbishment of Aberlour early years learning and childcare premises. The review was requested by the Depute Chief Executive (Education, Communities & Organisational Development) after concerns were raised by elected members regarding the scheme. In Aberlour, the early years and childcare service is delivered by private and council nurseries; both operate from the same premises. The Children and Young People (Scotland) Act 2014 introduced a statutory duty for Local Authorities to provide funded places for all eligible children. In order to achieve this requirement, a contract was awarded in 2018 for the construction and refurbishment of various premises to meet this expansion programme. The refurbishment of Aberlour early years learning and childcare premises is part of this larger contract and was managed by a Senior Projects Officer and thereafter by the Early Years’ Service Manager in consultation with Property Services. In addition, progress was regularly reviewed by the Early Years Learning Expansion Programme Board, which included representation of senior officers across various services. However, since May 2022, the responsibilities of the Early Learning Expansion Programme Board have been transferred to the Transforming Education Project Board, with additional reporting to the Transform Learning Board. This is consistent with established project management arrangements detailed within the Council’s Project Management Governance Policy. The scope of the audit was to undertake an overview of the reporting arrangements and compliance with Financial Regulations, Procurement Guidelines and the Conditions of the Contract for the refurbishment of the Aberlour early years learning and childcare premises. However, it should be noted the refurbishment works are yet to start. The audit findings should be viewed with consideration of the extraordinary challenges faced by officers during the pandemic. In addition, it was also found that key officers involved in the management of the scheme have moved to other posts or are no longer employed by the Council. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The review has highlighted the following areas for consideration: Page 31
Page 32
Appendix 4 Moray Council Internal Audit Section 4 • The refurbishment of Aberlour early years learning childcare premises was initially intended to be undertaken in August 2020. However, due to issues concerning the pandemic the date for the planned refurbishment works was deferred from 2020 to 2021. In early 2021 a decision was made to purchase temporary cabins as the preferred option for providing temporary accommodation to the children and staff of both nurseries. A temporary cabin was to be located at Speyside High School and another at Aberlour Primary School. These proposals were reported to the Education, Communities and Organisational Development Committee on 11 August 2021. The cost of purchasing the temporary cabins was £234,860. However, after discussions with officers and a review of supporting documentation, the audit found that later in 2021 and early 2022, concerns were raised regarding increases in construction costs and the location of a temporary cabin. This provided an opportunity to review alternative temporary accommodation provision to ensure moving forward that consideration was given to the most cost effective option. A report to the Education, Children’s and Leisure Services Committee on 24 August 2022 noted a revised proposal to locate one temporary cabin at the Aberlour Primary School and outdoor units near the park at Aberlour. Concerns were raised regarding this option, as detailed in a report to the Education, Children's and Leisure Services Committee on 2 November 2022. A further review was then undertaken with a report to the Education, Children's and Leisure Services Committee on 14 December 2022 that agreed for the Depute Chief Executive (Education, Communities & Organisational Development) to investigate other temporary accommodation options. The audit considers that appropriate reporting has been undertaken to update elected members on progress regarding the refurbishment of the Aberlour early years learning and childcare premises. Required changes to the delivery of temporary accommodation to allow works to progress have not only been due to concerns raised by stakeholders but significantly because of increases in construction costs and the requirement for the Council to achieve best value. • Council Procurement and Financial Regulations are intended to ensure best practices are followed and assist officers to operate within delegated authority. The temporary cabins were procured by issuing an Architect Instruction to the Contractor for the purchase from a single supplier. The Architect Instruction was issued in accordance with a direction received from the Senior Project Page 32
Page 33
Appendix 4 Moray Council Internal Audit Section 5 Manager (Early Learning & Childcare). It is appreciated the programmed timescale requirements for progressing this scheme; however, an advance payment of £117,430 was made for these temporary cabins without the prior approval of the Chief Financial Officer. The temporary cabins are currently stored at the haulage company’s premises and at the time of the audit, have incurred additional storage costs of approximately £6,000. A decision should be undertaken as a matter of urgency regarding the future use of these temporary cabins. • As detailed previously, the Education, Children's and Leisure Services Committee on 14 December 2022 agreed for the Depute Chief Executive (Education, Communities & Organisational Development) to investigate other options in providing temporary accommodation. At the time of this audit the intention was noted to purchase outdoor units (yurts) to be located at the Aberlour Primary School grounds as temporary accommodation to deliver the early years learning and childcare service for both nurseries during the period required for refurbishing the premises. As construction and material costs have increased over recent years, Property Services have requested an updated contract price from the Contractor to complete the works. A review should then be undertaken to ensure the adequacy of the current budget. Page 33
Page 34
Appendix 4 Moray Council Internal Audit Section 6 2. Introduction This audit has been undertaken from a request received from the Depute Chief Executive (Education, Communities & Organisational Development) after concerns were raised by elected members regarding the management of the contract for the refurbishment of Aberlour early years learning and childcare premises. The refurbishment of Aberlour early years learning and childcare premises is part of a larger contract awarded in 2018 to expand the early years learning and childcare service. The Senior Responsible Officer for the contract is the Head of Education, but with the refurbishment scheme being operationally managed by the Senior Projects Officer and currently by the Early Years’ Service Manager in consultation with Property Services. Progress was regularly reviewed by the Early Years Learning Expansion Programme Board and later by the Transforming Education Project Board, with additional reporting to the Transform Learning Board. In Aberlour, the early years and childcare service is delivered by private and council nurseries; both operate from the same premises. The contract required the consideration of options in providing temporary accommodation to allow both nurseries to maintain service delivery during the refurbishment of the premises. 3. Audit Scope The scope of the audit was to undertake a review of the Aberlour Early Years Learning and Childcare Scheme regarding the reporting arrangements and compliance with Financial Regulations, Procurement Guidelines and the Conditions of the Contract. However, it was noted that the actual works for the refurbishment of the premises have not yet started. 4. Summary Assessment The Internal Audit Section will provide Management with an opinion on the internal control environment based on four categories of classification: Assurance Level System and Testing Conclusion Full The controls tested are being consistently applied Page 34
Page 35
Appendix 4 Moray Council Internal Audit Section 7 Substantial There is evidence that the level of non-compliance with some of the controls may put some of the system objectives at risk. Limited The level of non-compliance puts the system objectives at risk. None Significant non-compliance with basic controls leaves the system open to error or abuse. Our assessment in terms of the design of, and the compliance with the system of internal controls for Aberlour Early Years and Childcare Scheme as limited by the scope of audit is set out below: System Assessment Testing Assessment Substantial Limited 5. Findings The main issues raised for management consideration are: 5.01 This audit review was requested by the Depute Chief Executive (Education, Communities & Organisational Development) after concerns were raised by elected members regarding the operational management for the refurbishment of the Aberlour early years learning childcare premises. Last year the Education, Children’s and Leisure Services Committee of the 26th of January 2022 requested Internal Audit to report on concerns regarding the financial management in the expansion of the Early Years Learning and Childcare Service. Both audit reviews have resulted in findings and recommendations. It is considered that the implementation to manage the expansion of the early years learning and childcare service was appropriately staffed by qualified officers. In addition, an Early Years Learning and Childcare Expansion Programme Board (Programme Board) included senior officers from across the Council was formed at the start of the expansion programme to support and provide an overview of both capital and revenue expenditure. The Council has a Project Management Governance Policy to aid officers in project management governance arrangements. The Project Management Governance Policy was agreed Page 35
Page 36
Appendix 4 Moray Council Internal Audit Section 8 at Policy & Resources Committee on 7 June 2016, with additional project management assurances concerning governance and leadership noted at the Corporate Committee on 30 August 2022. It is appreciated that as detailed within report to the Corporate Committee, the Policy “still largely reflect sound project management governance and remain fit for purpose”. It was also noted the Policy is based on the Prince2 Project management methodology, aligned with the Scottish Government Construction Procurement Manual and the Office of Government Commerce (OGC) Gateway framework. However, a review of the Policy noted that minor updates are required regarding reference to previous post titles, financial regulations and the Audit and Performance Committee. 5.02 The refurbishment of Aberlour early years learning childcare premises was initially intended to be undertaken in August 2020. The contract detailed a requirement for a “major refurbishment” of the premises. However, due to the pandemic the refurbishment was delayed for a year with the intention for the works to be started by the end of 2021. In order to allow works to progress, the premises had to be vacated and the delivery of the early years learning and childcare service provided within alternative accommodation. In March 2021, Property Services in accordance with an instruction received from the Senior Project Manager (Early Learning & Childcare) issued an Architect Instruction for the design, manufacture and delivery of temporary cabins. The audit noted discussions by the Programme Board regarding this course of action. In addition this was also reported to the Education, Communities and Organisational Development Committee on 11 August 2021, which included the proposed location of a cabin at Speyside High School and another at Aberlour Primary School. The Architect Instruction issued to the Contractor detailed the requirement to purchase two temporary cabins from a named supplier at the cost of £234, 860. The procurement of the temporary cabins by the Contractor from a single supplier was due to programmed timescale requirements and budgetary needs to complete the works per Scottish Government deadlines. The urgency of timescales is appreciated; however, it is unclear why consideration was not given for the purchase of the temporary cabins directly by the Council. Compliance with Council Financial Regulations Page 36
Page 37
Appendix 4 Moray Council Internal Audit Section 9 and Procurement Guidelines not only ensures officers operate within their delegated authority but also that best practices are followed in the purchasing of goods, services or works. If a single supplier was the preferred option due to required timescales, this could have been undertaken with the approval of the Chief Financial Officer. 5.03 The procurement of temporary cabins was undertaken by the issue of an Architect Instruction to the Contractor on 31 March 2021. However, it was found that discussions held by the Programme Board in May 2021 detailed concerns raised by the Head teacher of Speyside High School and an Elected Member regarding the proposed placement of a temporary cabin at the High School. The audit noted that site visits had been made to the High School by officers of the Programme Board to discuss these concerns with the Head teacher. An indicative start date for the refurbishment works was detailed as November 2021. However, it is understood this did not proceed due to budgetary pressures, increases in the costs for the refurbishment works and the concerns raised regarding the intended placement of the temporary cabin. The Programme Board noted this requirement to delay the start date and the need for further investigation during the third quarter of 2021. The audit has experienced difficulties in sometimes evidencing an audit trail that clearly documents progress. This may be due to the exceptional circumstances surrounding the pandemic and that officers have moved to other posts or are no longer employed by the Council. It was noted that in March and April 2022, further discussions were held that included a report to the Programme Board where a revised plan was discussed for the placement of one temporary cabin at the Primary School and an outdoor facility near the park in Aberlour with the intention of both nurseries returning to existing premises after the refurbishment works. It was also noted that in May 2022 discussions were held by the Asset Management Working Group, regarding a need to increase the capital budget and the revised option for placement of one temporary cabin at the Primary School and an outdoor facility near the park in Aberlour. These revised proposals were then reported to the Education, Children's and Leisure Services Committee on 24 August 2022. A report to the Education, Children's and Leisure Services Committee on 2 November Page 37
Page 38
Appendix 4 Moray Council Internal Audit Section 10 2022 regarding these revised proposals noted concerns raised by elected members. A further report to the Education, Children's and Leisure Services Committee on 14 December 2022 agreed for the Depute Chief Executive (Education, Communities & Organisational Development) to investigate other options in providing temporary accommodation to allow the refurbishment works to be completed. It is understood at the time of this audit, the purchase of outdoor units (yurts) for placement within the Aberlour Primary School grounds is the preferred option for temporary accommodation. The complexity of this Scheme is appreciated, especially due to the requirement for providing temporary accommodation to allow the refurbishment works to be completed. The audit noted that consultation had been undertaken with officers and parents concerning the needs of the Scheme. In addition, construction cost increases and the Council's requirement to achieve best value have also impacted the decision making process. However, temporary accommodation options were progressed incurring significant costs that were later deemed unsuitable. In addition, concerns were also raised by affected stakeholders. Consideration should be given to any improvements that may be required in the current arrangements for consultation and communication with stakeholders for future projects. 5.04 Further to a directive from the Senior Project Manager, an Architect Instruction was issued to the Contractor for purchasing two temporary cabins at £234,860, it was noted that £117,430 was paid in advance to the supplier for the design, manufacture and delivery. In addition, another Architect Instruction was also issued in December 2021 for the purchase of replacement doors to meet Scottish Building Regulations at the cost of approximately £14,000. This has also incurred additional costs of approximately £2000 to the Council for storing and delivering these doors to the Building Services Depot at Keith. Currently, the temporary cabins are stored with a haulage company that has incurred at the time of this audit a cost of approximately £6000. This review has already raised concerns regarding the procurement arrangements for purchasing the temporary cabins; however Financial Regulations detail the requirement for advance payments to be authorised by the Chief Financial Officer. No Page 38
Page 39
Appendix 4 Moray Council Internal Audit Section 11 evidence could be found that the Chief Financial Officer had been consulted to authorise the advance payment for the purchase of the temporary cabins. A decision is also required as a matter of urgency regarding the future intention of the temporary cabins stored with a haulage company. 5.05 As the works for refurbishing the Aberlour early years learning and childcare premises have yet to start, undertaking a full contract audit has not been possible to ensure compliance with the Conditions of Contract. It is acknowledged that officers dealing with Scheme within Property Services have retired or are no longer employed by the Council. The assistance provided by the Principal Quantity Surveyor in the completion of this review is much appreciated. However, during the audit, supporting contract documentation requested could not be found or possibly needed to be completed. Moving forward, it would be beneficial if the refurbishment of the Aberlour early years learning and childcare premises contract is reviewed to ensure documents are easily retrievable that will evidence compliance with the Conditions of Contract and Council Policies and Regulations. 5.06 At the time of the audit, the current expenditure for this Scheme amounted to approximately £340,000. The Moray Council Committee on 29 June 2022 agreed on a budget of £900, 000 to complete the works. As detailed within this report, it has now been decided to investigate the purchasing of outdoor units (yurts) to be located at the Aberlour Primary School grounds as temporary accommodation for the nurseries during the period for the refurbishment of the premises. As construction and material costs have increased over recent years, an updated contract price should be obtained from the Contractor for the completion of the works. Thereafter, the adequacy of the current budget should be reviewed. Page 39
Page 40
Appendix 4 Moray Council Internal Audit Section 12 6. Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective management controls operate to ensure the delivery for the refurbishment Aberlour Early Learning and Childcare Premises in accordance with Council Regulations and Conditions of Contract 5.01 Consideration should be given to updating job titles and other points of reference recorded within the Project Management Governance Policy. Low Yes Council programme governance was reviewed by cmt/smt in 2022 with a number of actions identified and reported to committee in Aug 22. Further review is not currently merited given short passage of time and that council arrangements Depute Chief Executive (Education, Communities & Organisational Development) 30/09/2023 Page 40
Page 41
Appendix 4 Moray Council Internal Audit Section 13 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation reflect recognised standards. However, the Policy will be updated to reflect current Council post titles/ regulations/ comm. Project Management training has already been delivered to cmt/smt and is available for other officers via OD. Project checklist has also been established to support project management Page 41
Page 42
Appendix 4 Moray Council Internal Audit Section 14 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.02 All officers responsible for purchasing goods, services or works should be reminded of the Council’s Financial Regulations and Procurement Guidelines. High Yes Annual reminders will be given to officers re Financial Regs and where this has not happened, training will be undertaken Head of Housing & Property/ Head of Education (Chief Education Officer) 30/06/2023 5.03 Consideration should be given to any improvements that may be required in the current arrangements for consultation and communication with Medium Yes Improvement is to assure arrangements as each project develops. To support this, the project checklist contains Depute Chief Executive (Education, Communities & Organisational Development) Implemented- Checklist is already in place Ongoing action is as projects reach key stages Page 42
Page 43
Appendix 4 Moray Council Internal Audit Section 15 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation stakeholders for future projects. specific points on planning communication and engagement and roll out is being supported by the PM Network Page 43
Page 44
Appendix 4 Moray Council Internal Audit Section 16 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 All officers involved in procuring goods, services and works should be reminded that in accordance with Financial Regulations, advance payments must be authorised by the Chief Financial Officer. As a matter of urgency, a decision is required regarding the future intention of the temporary cabins stored with the haulage company. Consideration should be given for the temporary cabins High High Yes Yes This should be written into documentation for key projects where processes aligned to Financial Regs are clear from offset Use of temporary units are being considered as a wider discussion and should be included at Head of Housing & Property/ Head of Education (Chief Education Officer) 30/06/2023 30/06/2023 Page 44
Page 45
Appendix 4 Moray Council Internal Audit Section 17 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation to be used by another establishment or be sold. DCEs recommendati on in Learning Estate portfolio. Temporary units will be sold if no use identified. 5.05 The refurbishment contract for the Aberlour early years learning and childcare premises should be reviewed to ensure documents are easily retrievable to evidence compliance with the Conditions of Contract and Medium Yes Further to recruitment to vacant posts the service now has adequate capacity to resource ongoing projects to Head of Housing & Property 30/06/2023 Page 45
Page 46
Appendix 4 Moray Council Internal Audit Section 18 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Council Policies and Regulations. requisite standards and immediate reconciliation of existing documentation will be undertaken. 5.06 The contractor should be contacted for an updated cost estimate for the completion of the works and if required the budget should be reviewed and updated. Medium Yes The process is for a tender from the contractor to be assessed by the QS. No tender was received by the deadline date and this has been reported Head of Housing & Property 30/06/2023 Page 46
Page 47
Appendix 4 Moray Council Internal Audit Section 19 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation through the normal governance process and other procurement approaches to achieve best value are being put to the client. . Page 47
Page 48
Page 48
Page 49
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 10 MAY 2023 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III I (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE AUDIT PLAN National Fraud Initiative 2022 – Council Tax Single Person Discount 4.1 The National Fraud Initiative (NFI) is a data matching project conducted by the Cabinet Office on behalf of Audit Scotland. Public bodies, including Local Authorities are mandatory participants in this process. A matching exercise was undertaken between information provided by the Taxation Service of householders claiming council tax single person discount and the electoral register, where there is more than one person in the household aged 18 or over at the property. The report provided by the NFI detailed 3129 matches. Item 6. Page 49
Page 50
4.2 While this volume of matches is significant, previous exercises have shown that the incidence of fraud is not. Accordingly, a proportionate approach has been taken to testing, which involved a high level ‘scanning’ of all matched data and more in-depth testing of a sample of matches: the following points were noted: • Majority of the matches related to timing issues where changes of circumstances have occurred but are not reflected within the information provided to the NFI. • However, testing found a need to cancel single person discounts for 13 households from the information provided in the NFI match. Most of these matches are related to changes in circumstances during the current year. An investigation is currently being undertaken by the Service in seeking a more automated approach to completing annual reviews of eligibility of claimants to council tax single person discount. Follow Up Reviews 4.3 Internal Audit reports are regularly presented to elected members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Health & Social Care Moray - Self-Directed Support (SDS) 4.4 This audit reviewed the arrangements for monitoring service users who receive an SDS direct payment to purchase their own support. The audit involved the random selection of a sample of care packages and a check made to ensure compliance with operating procedures, expenditure incurred by the service user is in accordance with the agreed budget/ support plans and surplus funds are recovered from service users where appropriate. It was noted that a total of 150 adult service users receive an SDS direct payment to purchase their own support at a cost of approximately £3 million annually. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 1. Unfortunately, it was found that the majority of the recommendations had not been implemented. The Service detailed particular issues regarding staff shortages and revised dates of implementation have been agreed. Health & Social Care Moray - Client Monies 4.5 This audit concerned a review of the processes undertaken by the Community Care Finance Team in how they administer the corporate bank account. It involved selecting a sample of individuals, and a check made on how the Health and Social Care Officer appointed as the named "Corporate Appointee" manages and supports the individuals to access their funds appropriately. The Adults with Incapacity (Scotland) Act 2000 enables a Health and Social Care Officer to be appointed by the DWP to have "Corporate Appointeeship" responsibility for managing the benefits received by an individual. At the time of the audit, it was found that 59 individuals are being managed within the "Corporate Apppointeeship" Scheme with a combined value of £483,000 held within the Council's corporate bank account. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 2. The Service detailed that it has not been possible to implement a number of the recommendations within the previously agreed timescales. There will therefore Page 50
Page 51
be a need to undertake a further follow up review of this audit and thereafter report progress to a future Audit and Scrutiny Committee. Procurement and Creditor Payments 4.6 An audit was undertaken to review payments made by the Authority to suppliers of goods and services. The purpose of the audit was to confirm that effective controls are operating to ensure all payments are appropriately authorised, accurate and paid in accordance with financial regulations and agreed terms and conditions. This audit review related to testing a sample of transactions generated under the direction of the Moray Integration Joint Board. Through the use of computer audit software, a sample of payments was randomly selected from this period with a value of £1.05 million. The testing undertaken was developed from the Chartered Institute of Public Finance and Accountancy’s Audit Programme. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 3. It is pleasing to report that all recommendations have now been implemented. Social Media Accounts 4.7 A follow up review was undertaken of the audit undertaken regarding the Council’s use of Social Media. Social media refers to websites and applications, e.g., Facebook and Twitter that are designed to allow people to share content quickly, efficiently, and in real time. Officers use social media as a form of communication across various services. It was found that the Corporate Communications Team is primarily responsible for posting Council information. However, individual services such as Health and Social Care, Schools, Sports and Community Centres, fostering and kinship manage their own social media accounts. The Follow Up Report confirming the implementation of the agreed recommendations is given in Appendix 4. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. Page 51
Page 52
(f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: SPMAN-1042990102- 149 Page 52
Page 53
Appendix 1 Moray Council Internal Audit Section 1 DEPARTMENT: Health and Social Care Moray SUBJECT: Self-Directed Support REPORT REF: 22'013 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Clear and current policy documents and operational guidelines have been developed for the financial administration of SDS packages. 5.01 The SDS Direct Payment guidance and financial monitoring procedures should be reviewed and updated on a regular basis. Low Yes 30/04/2022 Implemented. Financial Monitoring Procedures were updated in October 2021 and SDS Direct Payments Guidance was revised in April 2022. Item 6. Page 53
Page 54
Appendix 1 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Financial reviews are being carried out to monitor the usage of SDS funding in accordance with operational guidelines. 5.02 Annual financial reviews should be undertaken in line with the direct payment financial monitoring procedures. High Yes 31/01/2022 Not implemented. The review found a backlog in the Service undertaking annual financial reviews. Discussions with the Service noted there had been multiple staffing changes and vacancies for a prolonged period. It is hoped that with a stable staffing position, the resources are now available for implementing this recommendation by 31/08/2023. 5.03 Consideration should be given to the routine production of reports from the Care First System which can be used to detail financial reviews falling due and allow management to prioritise workloads accordingly. The Medium Yes 31/12/2021 Implemented. Reports are being produced by the CareFirst system to detail financial reviews due and their priority. The reports have also indicated a data cleansing need within CareFirst which is being undertaken to ensure data remains accurate. Page 54
Page 55
Appendix 1 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation requirement of manual spreadsheets should be minimised wherever possible to ensure information reference points come direct from the Care First system. 5.04 A risk based approach should be initiated by management to prioritise outstanding financial reviews and work through the backlog in an order which makes best use of limited resources. High Yes 31/12/2021 Not implemented. The review noted a backlog remains in the Service undertaking financial reviews. It was found the service had developed a prioritisation plan, but due to resourcing issues, it has not been possible to implement this recommendation. A revised implementation date of 31/08/2023 has been agreed. Page 55
Page 56
Appendix 1 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.05 A reminder should be issued to service users, and approved payroll providers where applicable, to inform the Authority when funds in excess of the contingency amount are held. This may assist in the prioritisation of early financial reviews and highlight issues for further investigation. High Yes 30/04/2022 Implemented. Assurance has been obtained from the Service that this has been undertaken. Further reminders are to be issued in January 2023 and will be scheduled annually each January going forward, incorporated into an annual data check. 5.06 A review should be undertaken of all Service Users in regard to the current balances held within their SDS bank account. Action should then be taken to recover excess funds. High Yes 30/04/2022 Not implemented. Significant surpluses were reclaimed on managed accounts as a result of obtaining details of all bank balances following the audit undertaken. The Service commenced work on a review of unmanaged accounts, but this has not been completed due to staffing issues. A revised implementation date of Page 56
Page 57
Appendix 1 Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 31/08/2023 has been agreed. 5.07 In compliance with established procedures, one-off direct payments should be subject to a financial monitoring review 3 months (or in limited circumstances at another interval) after the funding has been distributed to confirm its appropriate usage. Medium Yes 30/04/2022 Not implemented. The Service has detailed staffing issues as the reason for not implementing this recommendation. A revised implementation date of 31/08/2023 has been agreed. 5.08 The Service should comply with the monitoring requirements detailed within an agreement between the Council and Service User for the purchase and Medium Yes 31/12/2021 Not implemented. The Service has detailed staffing issues within the SDS Team and Social Work as the reason for not implementing this recommendation. While some details of the purchase have been obtained, many other conditions in the legal Page 57
Page 58
Appendix 1 Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation adaptation of a mini van. agreement between the Council and the Service User have not been evidenced. SDS Team to liaise with Social Work, and a revised implementation date of 31/03/2023 has been agreed. 5.09 Closing financial reviews of SDS care packages should be undertaken in accordance with agreed procedures. Evidence should be retained of any expenditure outwith the agreed support plan and of the full discussions held and decisions made by Social Workers regarding retrospective authorisation. Medium Yes 31/12/2021 Not implemented. At the end of a direct payment package monies are returned, but closing reviews have not been carried out to confirm monies have been applied appropriately. The Service has detailed staffing issues as the reason for not implementing this recommendation. A revised implementation date of 31/08/2023 has been agreed. Page 58
Page 59
Appendix 1 Moray Council Internal Audit Section 7 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: SDS Funding is only used to support the service user's support plan outcomes and compliance is monitored to ensure public funds are spend appropriately. 5.10 Care and Support Plans should be reviewed annually to ensure the agreed care is being provided and continues to meet the service user's needs. High Yes 01/05/2022 Not implemented. The follow-up audit exercise noted that since the pandemic annual support plan reviews have not recommenced across all parts of the Service. Limitations were stated in resources with staffing vacancies and workload pressures due to an increased demand for care, including the requirement to deal with particularly complex cases and increasing difficulties in sourcing care. Priority has been given to support plans for new and changing care arrangements rather than routine annual reviews. The newly appointed Head of Service will review current procedures. The current status of this recommendation will be reviewed in the follow- up audit after 31/08/2023. Page 59
Page 60
Appendix 1 Moray Council Internal Audit Section 8 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.11 All Social Workers should be reminded of the requirement to inform the SDS Team of any amendment to a Support Plan that will have a financial change to a service user's care package. High Yes 01/12/2022 Implemented. The SDS Team sends reminders to Social Work regarding the requirement to refer support package changes where there is a financial implication. A recent reminder to officers was noted on 01/12/2022. Key Control: SDS service has effective arrangements in place to monitor support packages and report on performance. 5.12 Consideration should be given to the development of appropriate performance monitoring measures to be reported to service management on a regular basis. Given the current backlog of reviews and consequences of direct payment accounts not being Low Yes 30/09/2022 Not implemented. Performance measures for Health & Social Care as a whole are being developed using Pentana. Initial work on developing these measures is being led by the Performance Team and started in July 2022. A delay has been experienced due to workload pressures and the 30/09/2022 target has not been met. The Performance Team is to commence engagement with the SDS Team Page 60
Page 61
Appendix 1 Moray Council Internal Audit Section 9 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation scrutinised on a timely schedule, it may be beneficial for performance information to be made available for management to identify any resourcing issues arising and assess risks involved. on their specific performance measures in November 2022. The Commissioning Manager has agreed to a revised implementation date of 31/03/2023. Page 61
Page 62
Page 62
Page 63
Appendix 2 Moray Council Internal Audit Section 1 DEPARTMENT: Health & Social Care Moray SUBJECT: Client Monies REPORT REF: 22'011 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Clear and current policy documents and operational guidelines have been developed for the financial management of client monies. 5.01 The Procedures for Managing Service User's Money and Corporate Appointeeship should be reviewed and updated and a subsequent regular cycle of review maintained. Medium Yes 31/10/2022 Not implemented. Procedures have not been reviewed and updated as intended due to staffing absence. This will now be prioritised and a revised implementation date of 30/06/2023 has been agreed. Item 6. Page 63
Page 64
Appendix 2 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 Procedures for the management of client monies should be promoted to ensure there is an awareness of their requirements by all officers involved in client finance administration. Medium Yes 31/10/2022 Not implemented. As procedures have not been reviewed per 5.01, the intended promotion activity after update has not been undertaken. A revised completion date of 30/06/2023 has been agreed. Key Control: Correct formal powers to administer client monies have been obtained. 5.03 Clarification should be obtained from Legal Services regarding the length of time funds must be retained on behalf of deceased clients and potential action which can be taken should the funds not be claimed within the timeframe. Medium Yes 31/10/2022 Implemented. A process is now in place for active pursual of estate settlement and referral to National Ultimus Haeres Unit to aid fund dispersement where applicable. The balance held in relation to these funds has significantly decreased since the audit was undertaken. Page 64
Page 65
Appendix 2 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Consideration should also be given to holding these funds separate to the corporate bank account for increased visibility. A separate balance record is being maintained for increased visibility of deceased client funds and to record actions taken. Key Control: All transactions should be for benefit of the client with justifiable supplier selection, verified to source documentation and in line with the client's Financial Management Plan. Any cash held is done so securely and with full accounting arrangements. 5.04 Due to changes in operating practices a full review of current cash handling procedures should be undertaken. The review should include a risk assessment to ensure best practices are followed regarding the safety and security of both officers and client funds. Documented procedures should thereafter be updated to reflect High Yes 31/07/2022 Not implemented. The topic was initially referred to Practice Governance Group, however, the service has decided a full review of the corporate account is required and a meeting has been instigated with all relevant staff. As this will take time and resources to complete a revised implementation date of 31/07/2023 has been agreed. Page 65
Page 66
Appendix 2 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation any agreed changes. Key Control: Robust records of fund administration per client are maintained. 5.05 Confirmation of the monthly reconciliation of the Corporate bank account to manual records should be undertaken by Community Care Finance management. This should also include the verification of a sample of transactions to source cumentation. High Yes 31/05/2022 Implemented. There is now a monthly management check of the corporate bank account reconciliation and a sample of transactions are independently checked for validity. The follow-up exercise has resulted in further enhancements to the management check being advised such as types of transactions for increased focus, which will increase the strength of the scrutiny process. Page 66
Page 67
Appendix 3 Moray Council Internal Audit Section 1 DEPARTMENT: Health & Social Care Moray SUBJECT: Procurement and Creditor Payments REPORT REF: 23'008 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective controls in the processing of creditor payments to ensure compliance with Financial Regulations and Procurement Guidelines 5.01 A review should be undertaken across all social care external providers to ensure that payments are not made in advance of the service delivery High Yes 15/08/22 Implemented- A review of providers has been undertaken, and testing noted only one example where payment had been made before the service was delivered. However, further investigation found that approval had Item 6. Page 67
Page 68
Appendix 3 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation been obtained from the Chief Financial Officer in accordance with Financial Regulations. 5.02 Monitoring arrangements within the Community Care Finance Team should be amended to include a requirement to record all invoices processed for payment Medium Yes 31/08/22 Implemented - The monitoring database recording invoices passed for payment has been amended to include additional information on when care has been provided to service users. It was also noted that a revised Standard Operating Procedures (SOP) had been prepared but has not been finalised. The SOP details requirement for recording information on the monitoring database. 5.03 The Community Care Finance Team should check invoices received from Care Providers to ensure the care delivered to each Medium Yes 31/08/22 Implemented – Invoices are matched to CareFirst to ensure that the care being billed for agrees to the support package as detailed Page 68
Page 69
Appendix 3 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation service user corresponds to their individual authorised support package detailed within CareFirst in the system. Where discrepancies arise, confirmation is sought from Social Work. 5.04 Payments should be made to the agreed Care Provider and not a sub contracted company High Yes 31/08/22 Implemented. - The follow up review has confirmed that payments are no longer being made to a third party but to the Care Provider. Page 69
Page 70
Page 70
Page 71
Appendix 4 Moray Council Internal Audit Section 1 DEPARTMENT: Chief Executive SUBJECT: Social Media REPORT REF: 22'012 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: The use of social media to facilitate council activities i.e communications, has adequate controls and monitoring 5.01 A single guidance document should be developed for officers in the use of social media accounts. Medium Yes 31/04/2022 Implemented. A Social Media Guidance Document has been prepared and is currently going through an employee consultation process. Item 6. Page 71
Page 72
Appendix 4 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 The Media and Communications Section should be informed prior to a Service setting up a Social Media Account. Medium Yes 31/11/2022 Implemented. Evidence noted of the Media and Communications Section being informed of the setting up of new Social Media Accounts. 5.03 The Media and Communications Section should maintain a record of social media accounts and officers authorised to post information across all Council services. Medium Yes 31/11/2022 Implemented. Noted that a record is now maintained of Council social media accounts and officers authorised to post information. 5.04 Consideration should be given that prior to allowing officers access to a Council social media account, training should be undertaken. Medium Yes 16/12/2022 Implemented. An E-Learning module is now available to officers, and in-person sessions can also be provided when requested. Officers must complete the E-Learning module before access is allowed. Page 72
Page 73
Appendix 4 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.05 Further exploration should be undertaken to the benefits of introducing additional security controls available from social media website providers. Medium Yes Ongoing Implemented. Two step authorisation is required for all Facebook Council accounts. In addition, a review of other social media platforms has been completed with the intention of also requiring a two step authorisation procedure before access is allowed. Page 73
Page 74
Page 74
Page 75
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 10 MAY 2023 SUBJECT: ANNUAL AUDIT PLAN FOR THE YEAR ENDING 31 MARCH 2023 BY: DEPUTE CHIEF EXECUTIVE (ECONOMY, ENVIRONMENT & FINANCE) 1. REASON FOR REPORT 1.1 To inform the Committee of the Auditor’s Annual Audit Plan for 2022/23. 2. RECOMMENDATION 2.1 It is recommended that the Committee consider and note the contents of the External Auditor’s Annual Plan for 2022/23. 3. BACKGROUND 3.1 In September 2022, the Accounts Commission confirmed the appointment of Grant Thornton as the external auditor for the Council for financial years 2022/23 to 2026/27 inclusive. 3.2 In delivering the public audit for Moray, Grant Thornton will provide independent assurance that public money has spent appropriately and provides value. Audit work is carried out in accordance with International Standards on Auditing, the Code of Audit Practice and any other relevant guidance. 3.3 The audit includes consideration of Best Value. 4. ANNUAL AUDIT PLAN 2022/23 4.1 Grant Thornton’s Annual Audit Plan for 2022/23 is attached as APPENDIX 1 to this report. The Plan sets out the scope of the audit work and the auditor’s approach to the audit. The Plan details the initial risks identified by Grant Thornton and planned work to be undertaken for the audit of the financial statements for the year ending 2022/23. Item 7. Page 75
Page 76
4.2 The main risks for the Council will be the focus of audit testing and are outlined on page 11 of the Plan. In order to assist with the assessment of risk, an Informing the Audit Risk Assessment was completed by senior managers and this is attached as APPENDIX 2. 4.3 Page 6 of the Annual Audit Plan shows the External Audit fee for 2022/23 as £282,860, which is an increase of 12.5% on the previous year, reflecting additional requirements placed on auditors which come into effect this year. 4.4 The annual accounts timetable, including key deadlines are shown on page 7 of the Annual Audit Plan and includes the statutory requirement for the Council to submit the Unaudited Annual Accounts along with supporting working papers to Grant Thornton by 30 June 2023, following consideration by those charged with governance at the meeting of Moray Council on 28 June 2023. The Council will be asked to consider the Annual Audit Report and approve the Audited Annual Accounts at its meeting on 27 September 2023. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) (b) Policy and Legal The external audit is conducted in terms of statutory powers afforded to the appointed External Auditor and in accordance with Grant Thornton’s Code of Practice. (c) Financial implications The annual audit fee for 2022/23 is £282,860. (d) Risk Implications The risks associated with the Audit Plan have been identified and categorised within the Audit Plan on page 11. (e) Staffing Implications Preparation of the Council’s financial statements will be co-ordinated by the Chief Financial Officer and will require input from Financial Services along with other departments across the Council. (f) Property None arising directly from this report. (g) Equalities/Socio Economic Impact None arising directly from this report. (h) Climate Change and Biodiversity Impacts None arising directly from this report. Page 76
Page 77
(i) Consultations The content of the Annual Audit Plan has been discussed with CMT, the Chief Financial Officer and the Audit and Risk Manager prior to production and their comments have been incorporated where appropriate. 6. CONCLUSION 6.1 The Annual Audit Plan informs the Council, its Committees and officers of the work to be undertaken by External Audit (Grant Thornton) in the year ahead. Author of Report: Laurie Milne, Senior Accountant Background Papers: Ref: LM/LJC/SPMAN-1293228629-859 Page 77
Page 78
Page 78
Page 79
Item 7. Page 79
Page 80
Commercial in confidence Page 80
Page 81
Commercial in confidence Page 81
Page 82
Commercial in confidence • • • • • • • • • Page 82
Page 83
Commercial in confidence • • • • • • • • Page 83
Page 84
Commercial in confidence • • • • Page 84
Page 85
Commercial in confidence Page 85
Page 86
Commercial in confidence 8 • • • • • Page 86
Page 87
Commercial in confidence Page 87
Page 88
Commercial in confidence • • • • • • Page 88
Page 89
Commercial in confidence • • • • • • Page 89
Page 90
Commercial in confidence Page 90
Page 91
Commercial in confidence Page 91
Page 92
Commercial in confidence • • • • • • • • Page 92
Page 93
Commercial in confidence • • • • • Page 93
Page 94
Commercial in confidence • • • • Page 94
Page 95
Commercial in confidence • • • • – – – – – – • • Page 95
Page 96
Commercial in confidence • • Page 96
Page 97
Commercial in confidence Page 97
Page 98
Commercial in confidence Page 98
Page 99
Commercial in confidence Page 99
Page 100
Commercial in confidence Page 100
Page 101
Commercial in confidence Page 101
Page 102
Commercial in confidence Page 102
Page 103
Commercial in confidence • • • • Page 103
Page 104
Commercial in confidence • • • Page 104
Page 105
Commercial in confidence Page 105
Page 106
Commercial in confidence • • Page 106
Page 107
Commercial in confidence • • • Page 107
Page 108
Commercial in confidence • • • • • • • • • • Page 108
Page 109
Commercial in confidence • • • • • • • • Page 109
Page 110
Commercial in confidence • • • • • • Page 110
Page 111
Commercial in confidence Page 111
Page 112
Commercial in confidence Service Fees £ Service Fees £ • • • • Page 112
Page 113
Commercial in confidence 35 Adding value through the audit • • • Inflo • • • • • •Page 113
Page 114
Page 114
Page 115
Commercial in confidence Page 115
Page 116
Commercial in confidence Page 116
Page 117
Commercial in confidence Page 117
Page 118
Commercial in confidence 40 • • • • • Page 118
Page 119
Commercial in confidence 41 • • • • • • Page 119
Page 120
Commercial in confidence • • • • • • Page 120
Page 121
Commercial in confidence Page 121
Page 122
Commercial in confidence 44 • • • • • • • • • • Page 122
Page 123
Commercial in confidence • • • • • • • • Page 123
Page 124
Page 124
Page 125
Informing the audit risk assessment for Moray Council 2022/23 Angela Pieri Director T 0161 214 6337 E Angela.L.Pieri@uk.gt.com Rebecca Lister Senior Manager T 020 7728 2529 E Rebecca.Lister@uk.gt.com Hannah McKellar Manager T 0131 659 8569 E Hannah.L.McKellar@uk.gt.com Item 7. Page 125
Page 126
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence The contents of this report relate only to the matters which have come to our attention, which we believe need to be reported to you as part of our audit process. It is not a comprehensive record of all the relevant matters, which may be subject to change, and in particular we cannot be held responsible to you for reporting all of the risks which may affect your business or any weaknesses in your internal controls. This report has been prepared solely for your benefit and should not be quoted in whole or in part without our prior written consent. We do not accept any responsibility for any loss occasioned to any third party acting, or refraining from acting on the basis of the content of this report, as this report was not prepared for, nor intended for, any other purpose. 2 Page 126
Page 127
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Table of Contents Section Page Purpose 4 General Enquiries of Management 6 Fraud 9 Fraud Risk Assessment 10 Laws and Regulations 15 Impact of Laws and Regulations 16 Related Parties 18 Going Concern 20 Accounting Estimates 22 Accounting Estimates - General Enquiries of Management 23 Appendix A – Accounting Estimates 26 3 Page 127
Page 128
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Purpose The purpose of this report is to contribute towards the effective two-way communication between Moray Council’s external auditors and Moray Council’s Audit and Scrutiny Committee, as 'those charged with governance'. The report covers some important areas of the auditor risk assessment where we are required to make inquiries of the Audit and Scrutiny Committee under auditing standards. Background Under International Standards on Auditing (UK), (ISA(UK)) auditors have specific responsibilities to communicate with the Audit, Risk and Assurance Committee. ISA(UK) emphasise the importance of two-way communication between the auditor and the Audit and Scrutiny Committee and also specify matters that should be communicated. This two-way communication assists both the auditor and the Audit and Scrutiny Committee in understanding matters relating to the audit and developing a constructive working relationship. It also enables the auditor to obtain information relevant to the audit from the Audit and Scrutiny Committee and supports Audit and Scrutiny Committee in fulfilling its responsibilities in relation to the financial reporting process. Communication As part of our risk assessment procedures we are required to obtain an understanding of management processes and the Authority’s oversight of the following areas: • General Enquiries of Management • Fraud, • Laws and Regulations, • Related Parties, • Going Concern, and • Accounting Estimates. 4 Page 128
Page 129
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Purpose This report includes a series of questions on each of these areas and the response we have received from Moray Council’s management. The Audit and Scrutiny Committee should consider whether these responses are consistent with its understanding and whether there are any further comments it wishes to make. 5 Page 129
Page 130
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence General Enquiries of Management Question Management response 1. What do you regard as the key events or issues that will have a significant impact on the financial statements for 2022/23? Impact of inflation on construction costs and by extension on DRC valuations. 2. Have you considered the appropriateness of the accounting policies adopted by Moray Council? Have there been any events or transactions that may cause you to change or adopt new accounting policies? If so, what are they? Accounting Policies are reviewed each year as the Accounts are prepared and changes incorporated where deemed necessary. No changes to Accounting Policies are anticipated for the 2022/23 Accounts. 3. Is there any use of financial instruments, including derivatives? If so, please explain No derivatives. Financial Liabilities – measured at amortised cost and include: Long Term Loans from PWLB and commercial lenders, Short Term Loans from other Local Authorities, Lease Payables, PPP Contracts, Trade Payables. Financial Assets – measured at amortised cost and include: Cash in Hand, Bank Current and Deposit Accounts, Trade Receivables for Goods and Services Provided. 4. Are you aware of any significant transactions outside the normal course of business? If so, what are they? Not aware of any significant transactions. 6 Page 130
Page 131
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence General Enquiries of Management Question Management response 5. Are you aware of any changes in circumstances that would lead to impairment of non-current assets? If so, what are they? Not aware of any specific circumstances. 6. Are you aware of any guarantee contracts? If so, please provide further details N/A 7. Are you aware of the existence of loss contingencies and/or un-asserted claims that may affect the financial statements? If so, please provide further details N/A 8. Other than in house solicitors, can you provide details of those solicitors utilised by Moray Council during the year. Please indicate where they are working on open litigation or contingencies from prior years? Separate working provided on this in response to another request. 7 Page 131
Page 132
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence General Enquiries of Management Question Management response 9. Have any of the Moray Council’s service providers reported any items of fraud, non-compliance with laws and regulations or uncorrected misstatements which would affect the financial statements? If so, please provide further details Not aware of any instances of Fraud. 10. Can you provide details of other advisors consulted during the year and the issue on which they were consulted? Mercer for Actuarial Services in relation to IAS 19 Employee Benefits. Arlingclose – Treasury Management Advisers and also engaged specifically on the changes to Service Concession Arrangements in Scotland. 11. Have you considered and identified assets for which expected credit loss provisions may be required under IFRS 9, such as debtors (including loans) and investments? If so, please provide further details Bad Debt Provision for Trade Debtors, Council Tax and Housing Rents will be processed as normal. No further allowance anticipated in 2022/23. 8 Page 132
Page 133
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Fraud Matters in relation to fraud ISA (UK) 240 covers auditors responsibilities relating to fraud in an audit of financial statements. The primary responsibility to prevent and detect fraud rests with both the Audit and Scrutiny Committee and management. Management, with the oversight of the Audit and Scrutiny Committee, needs to ensure a strong emphasis on fraud prevention and deterrence and encourage a culture of honest and ethical behaviour. As part of its oversight, the Audit and Scrutiny Committee should consider the potential for override of controls and inappropriate influence over the financial reporting process. As Moray Council’s external auditor, we are responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud or error. We are required to maintain professional scepticism throughout the audit, considering the potential for management override of controls. As part of our audit risk assessment procedures we are required to consider risks of fraud. This includes considering the arrangements management has put in place with regard to fraud risks including: • assessment that the financial statements could be materially misstated due to fraud, • process for identifying and responding to risks of fraud, including any identified specific risks, • communication with the Audit and Scrutiny Committee regarding its processes for identifying and responding to risks of fraud, and • communication to employees regarding business practices and ethical behaviour. We need to understand how the Audit and Scrutiny Committee oversees the above processes. We are also required to make inquiries of both management and the Audit and Scrutiny Committee as to their knowledge of any actual, suspected or alleged fraud. These areas have been set out in the fraud risk assessment questions below together with responses from Moray Council’s management. 9 Page 133
Page 134
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Fraud risk assessment Question Management response 1. Has Moray Council assessed the risk of material misstatement in the financial statements due to fraud? How has the process of identifying and responding to the risk of fraud been undertaken and what are the results of this process? How do Moray Council’s risk management processes link to financial reporting? The Council has established risk management, governance and operating procedures to mitigate the risk of material misstatement in the financial statements. The Corporate Risk Register detailing the Council’s principal risks is reviewed by CMT/SMT on a 6 monthly basis with an annual report provided to elected members. Services are also required to maintain risk registers detailing identifiable risks and mitigating controls. In addition, the Audit and Risk Manager prepares a risk-based audit plan which considers the Council’s strategic objectives, associated risks and the views of senior management. 2. What have you determined to be the classes of accounts, transactions and disclosures most at risk to fraud? A risk register is maintained by Accountancy recording risks, controls, etc. In addition, Internal Audit will also review and test transactions to ensure compliance with Council Regulations and Procedures. The use of IDEA, a computer assisted software system is used to analyse and select a sample for testing. 3. Are you aware of any instances of actual, suspected or alleged fraud, errors or other irregularities either within Moray Council as a whole, or within specific departments since 1 April 2022? If so, please provide details No irregularity noted below the £5000 reporting threshold. 10 Page 134
Page 135
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Fraud risk assessment Question Management response 4. As a management team, how do you communicate risk issues (including fraud) to those charged with governance? The Council’s Financial Regulations require all irregularities to be reported to the Audit and Risk Manager. Principal risks facing the Council are reviewed on a 6 monthly basis by CMT/SMT and the Corporate Risk Register is then updated accordingly. 5. Have you identified any specific fraud risks? If so, please provide details Do you have any concerns there are areas that are at risk of fraud? Are there particular locations within Moray Council where fraud is more likely to occur? Specific concerns have been raised regarding the threat of a successful cyber attack. The risk has been discussed by CMT/ SMT and a section for Information Technology is included in the Corporate Risk Register. In addition, as part of the risk-based approach to preparing the Annual Audit Plan, an internal audit review has been undertaken regarding the Council’s cyber security controls. An overtime irregularity was also noted within Building Services involving two officers where a special investigation was undertaken by the Internal Audit Section. As a result, the Internal Audit Section also undertook a review of overtime payroll processing procedures that resulted in the introduction of additional processing controls. 6. What processes do Moray Council have in place to identify and respond to risks of fraud? Financial Regulations detail that all staff irregularities should be reported to the Audit and Risk Manager. This is supported by the Policy to Combat Fraud, Theft, Bribery and Corruption and the Whistleblowing Policy. In addition, the Council participates in the National Fraud Initiative data matching exercise, and also publicises a point of contact to report fraud or irregularities involving the misuse of council resources. 11 Page 135
Page 136
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Fraud risk assessment Question Management response 7. How do you assess the overall control environment for Moray Council, including: • the existence of internal controls, including segregation of duties; and • the process for reviewing the effectiveness the system of internal control? If internal controls are not in place or not effective where are the risk areas and what mitigating actions have been taken? What other controls are in place to help prevent, deter or detect fraud? Are there any areas where there is a potential for override of controls or inappropriate influence over the financial reporting process (for example because of undue pressure to achieve financial targets)? If so, please provide details The responsibility for developing and maintaining sound control environment rests with management. However, the Audit and Risk Manager prepares a risk-based audit plan which considers the Council’s strategic objectives and associated risks. While the prevention of fraud and error rests with management through the design and operation of suitable systems of control, reviews undertaken by Internal Audit will make recommendations to improve the control environment. Internal Audit also coordinates the Council’s participation in the National Fraud Initiative, a data matching exercise involving a range of public sector bodies. This activity is viewed as complementary to other audit activities, and participation assists Internal Audit in assessing the potential for the occurrence of fraud and related fraud risk. Testing will primarily be undertaken by the Services, with Internal Audit undertaking an overview of the process. In accordance with an Audit and Scrutiny Committee Report, the Internal Audit Section reviewed the key fraud risks identified within an Audit Scotland Report – Fraud & Irregularity. Findings detailing risks, mitigating controls and responsible officer(s) were reported to the Information Assurance Group. 8. Are there any areas where there is potential for misreporting? If so, please provide details None noted. 12 Page 136
Page 137
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Fraud risk assessment Question Management response 9. How does Moray Council communicate and encourage ethical behaviours and business processes of it’s staff and contractors? How do you encourage staff to report their concerns about fraud? What concerns are staff expected to report about fraud? Have any significant issues been reported? If so, please provide details The Council has a Policy to Combat Fraud, Theft, Bribery and Corruption. This policy is built around a counter fraud culture supported by practices to deter and detect fraudulent and corrupt activities. It takes account of the Council’s statutory obligations, including, and in particular, the provisions of the Bribery Act 2010. The Council has a statutory responsibility to make arrangements for the administration of its financial affairs under the direction of a proper officer - the Chief Financial Officer. The Council has incorporated within its standing orders and procurement procedures, arrangements in respect of contracts for the supply of services, goods or materials and the execution of works. These ensure that established and consistent contracting procedures are available for use by the Council, and all procuring officers are either fully trained or are given support by Procurement Officers as part of the Supported Tender Process. The Audit and Scrutiny Committee has a remit which includes ensuring that the highest standards of probity and public accountability are demonstrated. This involves oversight of internal control processes as a contribution to good governance and generally supporting an anti-fraud, theft, corruption, and bribery culture. This Committee considers reports produced by Internal and External Audit on the Council’s systems; reports which include recommendations to strengthen internal controls and in turn reduce the risk of fraud and related behaviours going undetected. .As detailed previously, Managers have an ongoing responsibility for implementing effective systems of control which secure the legitimacy of expenditure, the safeguarding of assets and income, the reliability of management information, the accuracy of record keeping and compliance with statutory guidance. They also have a responsibility to communicate this policy to their staff and ensure established systems are followed. Financial Regulations detail that all irregularities should be reported to the Audit and Risk Manager. In addition, a Confidential ‘whistle blowing’ policy and procedure is in place, enabling employees to raise any concerns about any aspect of the Council’s work without fear of victimisation, subsequent discrimination or disadvantage, and in the knowledge that such concerns will be properly investigated. 13 Page 137
Page 138
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Fraud risk assessment Question Management response 12. What arrangements are in place to report fraud issues and risks to the Audit and Scrutiny Committee? How does the Audit and Scrutiny Committee exercise oversight over management's processes for identifying and responding to risks of fraud and breaches of internal control? What has been the outcome of these arrangements so far this year? The Public Sector Internal Audit Standards (PSIAS) applicable to Local Government in Scotland requires the Audit and Risk Manager to report functionally to the Audit and Scrutiny Committee on various issues relative to the work of the Internal Audit Service, including special investigations. The Audit and Scrutiny Committee has a remit which includes ensuring that the highest standards of probity and public accountability are demonstrated. This involves oversight of internal control processes as a contribution to good governance and generally supporting an anti-fraud, theft, corruption, and bribery culture. This Committee considers reports produced by Internal and External Audit on the Council’s systems; reports which include recommendations to strengthen internal controls and in turn reduce the risk of fraud and related behaviours going undetected. Functions and makeup of the Audit and Scrutiny Committee have also been recently reviewed and updated to reflect the requirements of the Chartered Institute of Public Finance and Accountancy (CIPFA) Position Statement: Audit Committees in Local Authorities and Police 2022 13. Are you aware of any whistle blowing potential or complaints by potential whistle blowers? If so, what has been your response? None noted 14. Have any reports been made under the Bribery Act? If so, please provide details None noted 14 Page 138
Page 139
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Law and regulations Matters in relation to laws and regulations ISA (UK) 250 requires us to consider the impact of laws and regulations in an audit of the financial statements. Management, with the oversight of the Audit and Scrutiny Committee, is responsible for ensuring that Moray Council’s operations are conducted in accordance with laws and regulations, including those that determine amounts in the financial statements. As auditor, we are responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud or error, taking into account the appropriate legal and regulatory framework. As part of our risk assessment procedures we are required to make inquiries of management and the Audit and Scrutiny Committee as to whether the body is in compliance with laws and regulations. Where we become aware of non-compliance or suspected non-compliance we need to gain an understanding of the non-compliance and the possible effect on the financial statements. Risk assessment questions have been set out below together with responses from management. 15 Page 139
Page 140
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Impact of laws and regulations Question Management response 1. How does management gain assurance that all relevant laws and regulations have been complied with? What arrangements does Moray Council have in place to prevent and detect non-compliance with laws and regulations? Are you aware of any changes to the Authority’s regulatory environment that may have a significant impact on the Authority’s financial statements? Generally speaking each service area (for example planning, procurement, social work) are familiar with the statutory regime in which they operate and will keep up to speed with developments through their professional associations such as CIPFA or SOLAR. Changes to legislation, consultations and guidance are notified to the Council by the Scottish Government and are distributed to the relevant departmental area. The legal section has teams which specialise in different areas of Council activity and will be involved (at the request of client departments) in the implementation of more complex changes (such as formation of the IJB) and in any areas where legislation is unclear. Legal compliance will often be subject to external regulation (for example data protection). The Councils Scheme of Delegation (detailing the powers given to officers to implement services under specified legislation) is reviewed annually in line with revised legislative powers, in consultation with client departments. 2. How is the Audit and Scrutiny Committee provided with assurance that all relevant laws and regulations have been complied with? The Councils Scheme of Delegation (detailing the powers given to officers to implement services under specified legislation) is reviewed annually in line with revised legislative powers, in consultation with client departments. 3. Have there been any instances of non-compliance or suspected non-compliance with laws and regulation since 1 April 2022 with an on-going impact on the 2022/23 financial statements? If so, please provide details The Council is currently being challenged on its Records Management Plan by the Keeper of the Records of Scotland. Not aware of other instances. 4. Are there any actual or potential litigation or claims that Statutory Appeal in the Court of Session in respect of an LRB decision in regard to 16 Page 140
Page 141
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Impact of laws and regulations Question Management response 5. What arrangements does Moray Council have in place to identify, evaluate and account for litigation or claims? The legal section has teams which specialise in different areas of Council activity and will be involved (at the request of client departments) in the implementation of more complex changes (such as formation of the IJB) and in any areas where legislation is unclear. Where necessary external advise will be sought. 6. Have there been any reports from other regulatory bodies, such as HM Revenues and Customs, which indicate non-compliance? If so, please provide details The Council is currently being challenged on its Records Management Plan by the Keeper of the Records of Scotland. 17 Page 141
Page 142
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Related Parties Matters in relation to Related Parties Moray Council are required to disclose transactions with bodies/individuals that would be classed as related parties. These may include: ■ bodies that directly, or indirectly through one or more intermediaries, control, or are controlled by Moray Council; ■ associates; ■ joint ventures; ■ a body that has an interest in the authority that gives it significant influence over the Authority; ■ key management personnel, and close members of the family of key management personnel, and ■ post-employment benefit plans (pension fund) for the benefit of employees of the Authority, or of any body that is a related party of the Authority. A disclosure is required if a transaction (or series of transactions) is material on either side, i.e. if a transaction is immaterial from the Authority’s perspective but material from a related party viewpoint then the Authority must disclose it. ISA (UK) 550 requires us to review your procedures for identifying related party transactions and obtain an understanding of the controls that you have established to identify such transactions. We will also carry out testing to ensure the related party transaction disclosures you make in the financial statements are complete and accurate. 18 Page 142
Page 143
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Related Parties Question Management response 1. Have there been any changes in the related parties including those disclosed in Moray Council’s 2021/22 financial statements? If so please summarise: • the nature of the relationship between these related parties and Moray Council • whether Moray Council has entered into or plans to enter into any transactions with these related parties • the type and purpose of these transactions No changes since 2021/22. 2. What controls does Moray Council have in place to identify, account for and disclose related party transactions and relationships? Senior Officers and Elected Members make annual returns and any significant factors that arise as part of this process would be factored into the Related Parties Note in the Annual Accounts. 3. What controls are in place to authorise and approve significant transactions and arrangements with related parties? Normal procedures following the Authorisation policy would apply – transactions over £25,000 are checked by the Chief Financial Officer. 4. What controls are in place to authorise and approve significant transactions outside of the normal course of business? For significant transactions that are new and outside the normal course of business Committee approval is required. 19 Page 143
Page 144
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Going Concern Matters in relation to Going Concern The audit approach for going concern is based on the requirements of ISA (UK) 570, as interpreted by Practice Note 10: Audit of financial statements and regularity of public sector bodies in the United Kingdom (Revised 2020). It also takes into account the National Audit Office's Supplementary Guidance Note (SGN) 01: Going Concern – Auditors’ responsibilities for local public bodies. Practice Note 10 confirms that in many (but not all) public sector bodies, the use of the going concern basis of accounting is not a matter of significant focus of the auditor’s time and resources because the applicable financial reporting frameworks envisage that the going concern basis for accounting will apply where the body’s services will continue to be delivered by the public sector. In such cases, a material uncertainty related to going concern is unlikely to exist. For this reason, a straightforward and standardised approach to compliance with ISA (UK) 570 will often be appropriate for public sector bodies. This will be a proportionate approach to going concern based on the body’s circumstances and the applicable financial reporting framework. In line with Practice Note 10, the auditor’s assessment of going concern should take account of the statutory nature of the body and the fact that the financial reporting framework for central government bodies presume going concern in the event of anticipated continuation of provision of the services provided by the body. Therefore, the public sector auditor applies a ‘continued provision of service approach’, unless there is clear evidence to the contrary. This would also apply even where those services are planned to transfer to another body, as in such circumstances, the underlying services will continue. For many public sector bodies, the financial sustainability of the body and the services it provides are more likely to be of significant public interest than the application of the going concern basis of accounting. Financial sustainability is a key component of wider scope and best value work and it is through such work that it will be considered. Page 144
Page 145
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Going Concern Question Management response 1. What processes and controls does management have in place to identify events and / or conditions which may indicate that the statutory services being provided by Moray Council will no longer continue? Regular reporting on the Council’s finances would highlight any conditions which may meant he Council is no longer to deliver statutory duties. Regular performance reports to Service Committees would highlight this as well. 2. Are management aware of any factors which may mean for Moray Council that either statutory services will no longer be provided or that funding for statutory services will be discontinued? If so, what are they? Not aware of any factors. 3. With regard to the statutory services currently provided by Moray Council, does Moray Council expect to continue to deliver them for the foreseeable future, or will they be delivered by related public authorities if there are any plans for Moray Council to cease to exist? It is expected that the Council will continue to deliver statutory services. 4. Are management satisfied that the financial reporting framework permits Moray Council to prepare its financial statements on a going concern basis? Are management satisfied that preparing financial statements on a going concern basis will provide a faithful representation of the items in the financial statements? The annual accounts will be prepared on a going concern basis and this will provide a faithful representation of the items included in the financial statements. Page 145
Page 146
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Accounting estimates Matters in relation to accounting estimates ISA (UK) 540 (Revised December 2018) requires auditors to understand and assess a body’s internal controls over accounting estimates, including: • The nature and extent of oversight and governance over management’s financial reporting process relevant to accounting estimates; • How management identifies the need for and applies specialised skills or knowledge related to accounting estimates; • How the body’s risk management process identifies and addresses risks relating to accounting estimates; • The body’s information system as it relates to accounting estimates; • The body’s control activities in relation to accounting estimates; and • How management reviews the outcomes of previous accounting estimates. As part of this process auditors also need to obtain an understanding of the role of those charged with governance, which is particularly important where the estimates have high estimation uncertainty, or require significant judgement. Specifically do Audit and Scrutiny Committee members: • Understand the characteristics of the methods and models used to make the accounting estimates and the risks related to them; • Oversee management’s process for making accounting estimates, including the use of models, and the monitoring activities undertaken by management; and • Evaluate how management made the accounting estimates? We would ask the Audit and Scrutiny Committee to satisfy itself that the arrangements for accounting estimates are adequate. 22 Page 146
Page 147
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 1. What are the classes of transactions, events and conditions, that are significant to the financial statements that give rise to the need for, or changes in, accounting estimate and related disclosures? Valuation of Property, Plant & Equipment Valuation of Pension Liability 2. How does the Authority’s risk management process identify and address risks relating to accounting estimates? By engaging with experts in each of the areas identified the risk of material misstatement is reduced. 3. How does management identify the methods, assumptions or source data, and the need for changes in them, in relation to key accounting estimates? The results of prior year audits are looked at and whether there was any material concerns raised or amendments made – in those instances accounting estimates would be reviewed. 4. How do management review the outcomes of previous accounting estimates? The results of prior year audits are looked at and whether there was any material concerns raised or amendments made – in those instances accounting estimates would be reviewed. 5. Were any changes made to the estimation processes in 2022/23 and, if so, what was the reason for these? No changes were made in 2022/23. Page 147
Page 148
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 6. How does management identify the need for and apply specialised skills or knowledge related to accounting estimates? Each area is looked at in isolation and the skills/knowledge/capacity of relevant Services considered. 7. How does the Authority determine what control activities are needed for significant accounting estimates, including the controls at any service providers or management experts? Ensuring that relevant information is provided on time and accurately to ensure that the information received can be relied upon. 8. How does management monitor the operation of control activities related to accounting estimates, including the key controls at any service providers or management experts? Regular updates provided by preparers of the Accounts on any issues that arise. 9. What is the nature and extent of oversight and governance over management’s financial reporting process relevant to accounting estimates, including: - Management’s process for making significant accounting estimates - The methods and models used - The resultant accounting estimates included in the financial statements. The unaudited accounts are reported to Committee and then again upon completion of the audit. External Audit reporting also helps to inform on estimates. Page 148
Page 149
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 10. Are management aware of any transactions, events, conditions (or changes in these) that may give rise to recognition or disclosure of significant accounting estimates that require significant judgement (other than those in Appendix A)? If so, what are they? Not aware of any additional areas where new estimates would be required to be disclosed. 11. Why are management satisfied that their arrangements for the accounting estimates, as detailed in Appendix A, are reasonable? No major changes required to annual accounts in previous years. 12. How is the Audit and Scrutiny Committee provided with assurance that the arrangements for accounting estimates are adequate? Annual accounts are reported to Full Council. 25 Page 149
Page 150
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Appendix A Accounting Estimates Estimate Method / model used to make the estimate Controls used to identify estimates Whether management have used an expert Underlying assumptions: - Assessment of degree of uncertainty - Consideration of alternative estimates Has there been a change in accounting method in year? Land and buildings valuations Infrastructure/Community Assets/AUC – DHC Schools – DRC Surplus Assets – Fair Value Council Dwellings - EUV Information used is industry standard information from entities such us BCIS. Internal Valuers No. Valuation of defined benefit net pension fund liabilities Based on information from Actuaries. Information provided to actuaries based on year end position reducing the need for use of estimates. Yes. Disclosure in accounts regarding the changes that could happen and the impact it would have on the figues included in the accounts No. Heritage assets valuations Insurance Valuations/Historic Cost Yes. No. Depreciation Straight Line method over the useful life of the asset. Estates provide useful life estimates. Internal Valuers No 26 Page 150
Page 151
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Appendix A Accounting Estimates Estimate Method / model used to make the estimate Controls used to identify estimates Whether management have used an expert Underlying assumptions: - Assessment of degree of uncertainty - Consideration of alternative estimates Has there been a change in accounting method in year? Investment property revaluations Fair Value Per the Code – Investment Property reviewed annually. Internal Valuers No alternative considered – prescriptive by the Code. No. Provisions Only 1 provision – amount based on actual amounts. Liaison with HR. No. Based on information from HR – confirmed each year that it is still at an appropriate level No Accruals Based on actual entries in the ledger, or on information received from departments. No but in some cases estimates are made by Quantity Surveyors. In most cases based on actual ledger entries so no estimation. Where estimates are provided we know it will be based on professional judgement and we would query if it was materially different from estimates provided. No. Credit loss and impairment allowances Bad Debt Provision – debtors, council tax, housing rents. Debtors/Housing Rents: >12 months – provided in full 6-12 months – 50% <6 months – 0% Council Tax: <12 months – 0% >12 months – 100% No. Looked at and reviewed each year to see if the percentages are still appropriate. No. 27 Page 151
Page 152
© 2023 Grant Thornton UK LLP | Moray Council 2022/23 Commercial in confidence Appendix A Accounting Estimates (Continued) Estimate Method / model used to make the estimate Controls used to identify estimates Whether management have used an expert Underlying assumptions: - Assessment of degree of uncertainty - Consideration of alternative estimates Has there been a change in accounting method in year? Accrued Income Based on actual entries in the ledger, or on information received from departments No. In most cases based on actual ledger entries so no estimation. Where estimates are provided we know it will be based on professional judgement and we would query if it was materially different from estimates provided. No. PFI Liabilities Financial models are used each year. Financial models are well established and were set up in conjunction with experts and have been audited in detail since then. Models used were set up in conjunction with experts – annual use is by Council staff. No changes considered – processes well established. No. Fair Value of Assets and Liabilities (Financial Instruments) In most cases the fair value is calculated using models provided by the Council’s Treasury Management Advisers. Use of external expert information. Yes. No. 28 Page 152
Page 153
© 2023 Grant Thornton UK LLP ‘Grant Thornton’ refers to the brand under which the Grant Thornton member firms provide assurance, tax and advisory services to their clients and/or refers to one or more member firms, as the context requires. Grant Thornton UK LLP is a member firm of Grant Thornton International Ltd (GTIL). GTIL and the member firms are not a worldwide partnership. GTIL and each member firm is a separate legal entity. Services are delivered by the member firms. GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions. grantthornton.co.uk Page 153
Page 154
Page 154