Agenda Document Pack - Audit and Scrutiny Committee - 27/06/2023
Moray Council · 27 June 2023
Back to Audit and Scrutiny Committee — 27 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Tuesday, 27 June 2023 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Tuesday, 27 June 2023 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of the meeting held 10 May 2023 5 - 8 4. Written Questions ** 5. Annual Governance Statement Report by Chief Executive 9 - 24 6. Internal Audit Annual Report- 2022-23 Report by Audit and Risk Manager 25 - 36 7. Internal Audit Section Completed Projects Report Report by Audit and Risk Manager 37 - 68 8. Question Time *** Consider any oral question on matters delegated to the Committee in terms of the Council's Scheme of Administration. Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. *** Question Time - At each ordinary meeting of the Committee ten minutes will be allowed for Members questions when any Member of the Committee can put a question to the Chair on any business within the remit of that Section of the Committee. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than ten minutes after the Committee has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he/she can submit it in writing to the proper officer who will arrange for a written answer to be provided within seven working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Theresa Coull (Member) Councillor John Cowe (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Lindsey Robinson Clerk Telephone: 07966 120593 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 10 May 2023 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Councillor Peter Bloomfield, Councillor Theresa Coull, Councillor John Cowe, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Graham Leadbitter, Councillor Marc Macrae, Councillor Neil McLennan, Councillor Shona Morrison, Councillor John Stuart, Ms Margaret Wilson APPOLOGIES An apology was intimated on behalf of Mr Ivan Augustus. IN ATTENDANCE Also in attendance at the above meeting were the Chief Executive, Depute Chief Executive (Education, Communities and Organisational Development), Head of Governance, Strategy and Performance, Chief Financial Officer, Chief Officer (Health and Social Care Moray) Head of Environmental and Commercial Services, Head of Housing and Property Services, Audit and Risk Manager, Angela Pieri, Public Sector Audit Director (Scotland) and Lindsey Robinson, Committee Services Officer as clerk to the meeting. Councillors, Mustard, Robertson and Ross were in attendance for item 6 "Internal Audit Section Completed Projects". Councillor Colyer was in attendance for the entire meeting. 1. Chair Councillor Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Welcome The Committee joined the Chair in welcoming Margaret Wilson to her first meeting since joining the Committee as an external member. The second external member is Ivan Augustus, who had given his apologies. 3. Declaration of Group Decisions and Members Interests * In terms of Standing Order 21 and the Councillors’ Code of Conduct, the Committee noted the following declarations: - On behalf of the Administration, Councillor Gatt declared that there had been group discussions on all of the Agenda items but there was no whip. Item 3. Page 5
Page 6
Councillors Morrison, Divers, Gatt and Bloomfield all declared that they were either members or substitute members of the Moray Integration Joint Board. Councillor Stuart declared that he works for the Care Inspectorate but does not inspect Moray. There were no further declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member’s interests in respect of any item on the agenda. 4. Minute of the Meeting of the Audit and Scrutiny Committee of 15 February 2023 The minute of the meeting of the Audit and Scrutiny Committee dated 15 February 2023 was submitted and approved. 5. Written Questions ** The Committee noted that no written questions had been submitted. 6. Internal Audit Section Completed Projects A report by the Audit and Risk Manager advised the Committee of the work of the Internal Audit Section for the period 16 February 2023 to 10 May 2023. Councillor Cowe joined the meeting during the discussion of this item. During consideration of the report, Councillor Ross provided a statement to the Committee in respect of Appendix 4 – “Aberlour Early Years Learning and Childcare Scheme” of this report, to highlight his concerns and those of his constituents. Councillor Fernandes sought clarification on the future use of the temporary classrooms and questioned whether the decision should be made by Officers or by the Education, Children’s and Leisure Services (ECLS) Committee. In response the Depute Chief Executive (Education, Communities and Organisational Development) advised that there were a number of options under consideration for the temporary classrooms and confirmed that she would be happy to bring a report to the ECLS Committee but due to the content the report it may need to be considered in the confidential session. Councillor Gatt suggested that Appendix 4 be considered by Moray Council going forward to ensure accountability for public money. Councillor Robertson was also of the opinion that it be heard at Moray Council to allow all 26 members the opportunity to consider the findings of the report. In response the Chair advised that it was not the remit of the Audit and Scrutiny Committee and by considering the report at a meeting of the Council it would undermine the role of the Audit and Scrutiny Committee. He was also of the opinion that there were other mechanisms available to Elected Members to raise any issues with the Corporate Management Team (CMT). Councillor Gatt asked that the report be moved to a confidential session to allow free discussion. Page 6
Page 7
In response the Monitoring Officer sought clarification as to the reasons for confidentiality from Councillor Gatt, as the report was already in the public domain. Councillor Gatt expressed concern that a large sum of money had been spent without the Chief Financial Officer's knowledge and the Councillors Code of Conduct does not allow for a critical discussion about Officers to be in the open session. The Chair reminded the Committee that this Committee’s remit was to scrutinise the process and to seek assurances that the risks be minimised going forward and that any issues Elected Members have with Officers should be raised with the Chief Executive. The Chief Executive confirmed that he had not be approached by any Elected Member with regards to any issues concerning staff. He further added that the report provided the Committee with the information which had been sought. He further advised that senior management welcomed the audit and that the deadline for the high priority issues to be addressed was June 2023. The Audit and Risk Manager confirmed that following the June 2023 deadline the audit team would revisit the service to ensure compliance against the recommendations and would then present an update report to a future meeting of this Committee. Following further consideration, Councillor Gatt moved an amendment that Appendix 4 should be heard at the meeting of Moray Council on 28 June 2023 as a matter of urgency as he felt that a decision was needed on the use of the temporary cabins. Following a short adjournment and legal advice from the Monitoring Officer, the Chair declared that the amendment moved by Councillor Gatt was not competent due to it being out with the purpose of the report and would undermine the Audit and Scrutiny Committee. He was further of the opinion that discussion was needed between the Administration Group and CMT with regards to agenda setting for a special or ordinary meeting of Moray Council and that, ideally, this should be after the deadline for the actions to be completed has passed. Thereafter the Committee agreed to note the contents of the report. 7. Internal Audit Section Update A report by the Audit and Risk Manager provided the Committee with an update in the work of the Internal Audit Section. Following consideration the Committee agreed to note the contents of the report. 8. Annual External Audit Plan Year Ending 2022-23 A report by the Depute Chief Executive (Economy, Environment and Finance) informed the Committee of the Auditor's Annual Audit Plan for 2022/23. The Chair invited the External Auditor to set out the plan to the Committee. Page 7
Page 8
Following consideration the Committee agreed to note the contents of the External Auditor's Annual Plan for 2022/23. 9. Adult Social Care Commissioning Service A report by the Audit and Risk Manager advised the Committee on an audit of Adult Social Care Commissioning Service within Health and Social Care Moray (HSCM) completed by KPMG Governance, Risk and Compliance Services. During consideration the Chief Officer HSCM advised that regular reporting would be undertaken to the Audit and Scrutiny Committee on the progress of implementing the recommendations detailed within the KPMG report. Councillor McLennan left during discussion of this item. Following consideration the Committee agreed to note the contents of the report. 10. Question Time *** The Committee noted that no questions were asked. Page 8
Page 9
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 27 JUNE 2023 SUBJECT: ANNUAL GOVERNANCE STATEMENT BY: CHIEF EXECUTIVE 1. REASON FOR REPORT 1.1 The report provides Committee with a copy of the Council’s Annual Governance Statement for 2022/23 for information and review. 1.2 This report is submitted to Committee in terms of Section III (I) (5) of the Council’s Scheme of Administration relating to supporting the council’s governance arrangements through review of the Annual Governance Statement. 2. RECOMMENDATION 2.1 That Committee considers this report and notes the contents of the Annual Governance Statement provided as Appendix 1. 3. BACKGROUND 3.1 The function of good governance in the public sector ensures that entities act in the public interest at all times. Governance comprises the arrangements put in place to ensure intended outcomes are defined and achieved. 3.2 The Chartered Institute of Public Finance and Accountancy (CIPFA) and the Society of Local Authority Chief Executives (SOLACE), building on work undertaken by the International Federation of Accountants, have published a guidance framework on ‘Delivering Good Governance in Local Government’. 3.3 The Local Authority Accounts (Scotland) Regulations 2014 requires the Council to publish an Annual Governance Statement with its annual accounts. The Statement is based on the guidance and summarises practice across the seven principles identified within the framework, considers the roles of those who oversee the development and operation of such practice, and provides an overall assessment of the effectiveness of governance arrangements. The statement includes an annual opinion provided by the Audit and Risk Manager in line with Public Sector Internal Audit Standards. 3.4 Good governance practice involves both elected members and officers and this is reflected in the requirement for the statement to be certified by both the Leader of the Council and the Chief Executive as Head of Paid Service. Item 5. Page 9
Page 10
3.5 The statement is subject to review by external audit, where the external auditor is required to report on anything believed to be inconsistent with any other findings disclosed from the audit work. There has been nothing to report in this regard in previous annual audits. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal The Annual Governance Statement forms part of the annual accounts the Council is required to prepare under statute. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications Good governance includes the effective management of risk, as evidenced in this ‘risk implications’ paragraph in all reports that come before the council and its committees, and in the council’s corporate risk register that is kept under review by Senior Management and reported annually to the Corporate Committee. (e) Staffing Implications No direct implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications directly arising from this report. (i) Consultations The Chief Executive, and Corporate and Senior Management Teams have been consulted and have contributed to the content of the Annual Governance Statement. In addition, the Leader of the Council, as a signatory to the Statement, has also been consulted. Page 10
Page 11
5. CONCLUSION 5.1 This report provides Committee with a copy of the draft 2022/23 Annual Governance Statement, which has been produced following completion of the annual review of the Council’s governance arrangements and system of internal control. Author of Report: Atholl Scott, Business Continuity and Risk Management Officer Background Papers: Various including Committee Reports and Senior Manager Assurance Statements Ref: AS/asc270623/ags Page 11
Page 12
Page 12
Page 13
Appendix 1 Annual Governance Statement 2022/23 Scope of Responsibility The council is responsible for ensuring that its business is conducted in accordance with the law and proper standards, and that public money is safeguarded, properly accounted for, and used economically, efficiently and effectively. The council has a statutory duty to make arrangements to secure Best Value under the Local Government in Scotland Act 2003. In discharging these responsibilities, Elected Members and the Corporate and Senior Management Teams are responsible for putting in place proper arrangements for the governance of the council’s affairs and for facilitating the effective exercise of its functions. In delivering these functions, there is a requirement to have effective partnership working with others, principally with NHS Grampian and Moray Integration Joint Board, Grampian Valuation Joint Board and the Moray Leisure Centre, as well as with other bodies involved in Community Planning. This annual governance statement explains how the council has used the CIPFA/SOLACE 2016 Framework ‘Delivering Good Governance in Local Government’ as a basis for considering the effectiveness of its own governance arrangements. The framework predates the Covid 19 pandemic, yet remains relevant as a good practice guide on how councils should be ‘managed and controlled’. Framework for Good Governance The overall aim of the ‘Delivering Good Governance in Local Government’ Framework is to ensure that: resources are directed in accordance with agreed policy and according to priorities; there is sound and inclusive decision making; and there is clear accountability for the use of those resources in order to achieve desired outcomes for service users and communities. The CIPFA/SOLACE Framework defines the seven core principles of good governance, namely: 1. Behaving with integrity, demonstrating strong commitment to ethical values, and respecting the rule of law; 2. Ensuring openness and comprehensive stakeholder engagement; 3. Defining outcomes in terms of sustainable, economic, social and environmental benefits; 4. Determining the interventions necessary to optimise the achievement of the intended outcomes; Item 5. Page 13
Page 14
5. Developing the entity’s capacity, including the capability of its leadership and the individuals within it; 6. Managing risks and performance through robust internal control and strong public financial management; and 7. Implementing good practices in transparency, reporting, and audit to deliver effective accountability. The key elements of the council’s governance arrangements are described in terms of the seven principles defined in the Framework, summarised as follows: 1. Behaving with integrity, demonstrating strong commitment to ethical values, and respecting the rule of law; The roles and responsibilities of elected members and officers and the processes to govern the conduct of the council’s business are defined in procedural standing orders, a scheme of administration, a scheme of delegation, and financial regulations. These are updated regularly as required, with a review of committee structures completed during the year. Codes of Conduct for both elected members and officers have been developed and these define the ethical values and standards of behaviour expected. The Codes draw on the ‘Standards in Public Life’ covering issues including leadership, fairness and integrity. A Monitoring Officer is responsible for ensuring that agreed procedures are followed and that all applicable statutes and regulations are complied with. Elected members have been provided with induction training post the Local Government elections in May 2022 and definitions of leadership roles and behaviours developed and agreed. 2. Ensuring openness and comprehensive stakeholder engagement; As the recovery from the pandemic continues and the council looks for improvement and modernisation opportunities, meetings of the council and its committees are now delivered using a hybrid format that enables attendance in person or via web link. Meetings are live streamed and thus available for public viewing, with matters discussed and determined in confidence relating only to those deemed confidential in terms of Part 1 of Schedule 7A of the Local Government (Scotland) Act 1973. The rationale for all decisions proposed and taken is fully set out in committee reports. Stakeholder engagement is central to the council’s work at a strategic level, e.g., with community planning partners and on policy development or planned changes to services affecting communities or individual service users. Such engagement includes activity targeting citizens who are less likely to participate so as to better inform decision making processes. During the year, the Community Planning Partnership worked with community and third sector partners to refresh the Community Engagement Strategy. This was officially re-launched at an event in UHI Moray, and the updated strategy will support the development of future community Page 14
Page 15
and corporate plans as well as guiding consultation with local communities, for example, in progressing the participatory budgeting initiative. The council seeks and obtains feedback on delivery of its services having adopted a comprehensive complaints procedure based on a model scheme developed by the Office of the Scottish Public Services Ombudsman. All complaints are responded to as appropriate, and inform improvements to service delivery. A comprehensive report on complaints handling is prepared and presented annually to a council committee. 3. Defining outcomes in terms of sustainable economic, social, and environmental benefits; The creation and implementation of a vision for the local area, including expected outcomes for the community, is encompassed in the Local Outcomes Improvement Plan (LOIP). The overarching aim and purpose of this 10-year Plan is ‘to raise aspirations by creating an enabling environment where our residents can achieve expanded choices, improved livelihoods and wellbeing”. In particular, the LOIP recognises the importance of and benefits from reducing inequalities and poverty, with outcomes focused on the need for a growing, diverse and sustainable economy, building a better future for our children and young people in Moray, empowering and connecting communities, and a broadened objective of improving the wellbeing of our population. The LOIP is a partnership plan and its strategic delivery is overseen by a Community Planning Board, which meets quarterly. The Board monitors plan performance for each quarter and during the year considered a number of key strategic documents, notably the NHS Grampian ‘Plan for the Future’ 2022-2028, that seeks to address pressures within the Health Service; and a refreshed Moray Economic Strategy 2022-2032 that has regard to change occasioned by the pandemic, the UK departure from the European Union, cost of living and doing business pressures, Climate Change and Net Zero targets, and the progress to date of the Moray Growth Deal. Aligned to the LOIP, the council has its own Corporate Plan 2019-2024 that details specific council priorities under the banner of ‘Our People, Our Place, Our Future.’ The plan sets targets for improvement consistent with maintaining a sustainable council that provides valued services to its communities, and these targets are monitored through a Performance Management Framework. A review of the plan, involving wide consultation and incorporating the priorities of the council formed post the local government elections in 2022, has been progressed during the period. This work will inform a new Corporate Plan that will run from 2024. 4. Determining the interventions necessary to optimise the achievement of the intended outcomes; The strategic Community and Corporate Plans are translated into service plans prepared within each service area. These facilitate delivery of agreed outcomes and assist in securing continuous improvement. Service plans are reported to a meeting of the council or appropriate service committee for consideration and approval, in Page 15
Page 16
reports that provide detailed information on planned activity. The reports contain a ‘Summary of Implications’ section that links report content to strategic plans, legal and policy issues; risk, staffing and property matters; equalities; social impact; and climate change and biodiversity considerations. A particular focus is given to financial implications given the current economic climate. The council is fully aware of the financial challenges it faces and through its established committee structures, elected members have been provided with an extensive volume of information on both the availability of resources and options for future service delivery. This has been reflected in reports to the council on budget setting, including projections for the next two years; a capital strategy; and regular budget monitoring reports. The council successfully delivered a balanced budget for 2023/24. Other interventions contributing to good governance during the period included reports providing high-level assessments of council priorities, service pressures and risks, and how these are inter-connected, as well as the provision of updates on numerous policy initiatives including Workforce Planning, Climate Change, Educational Attainment, and Best Value. Progress towards achieving agreed outcomes is monitored through an established Performance Management Framework that calls for quarterly reporting on key performance measures developed for each service. In addition, the council participates in the Local Government Benchmarking Framework which compares a range of established performance measures with those of other Scottish local authorities. Elected Members are provided with reports to review, scrutinise and note actions undertaken by Services to improve performance. 5. Developing the entity’s capacity, including the capability of its leadership and the individuals within it; The Corporate Management Team (CMT) consists of the Chief Executive, two Depute Chief Executives and the Chief Officer, Health & Social Care (Moray Integration Joint Board), supported by a Senior Management Team (SMT) comprising nine Heads of Service. CMT/SMT meet frequently to discuss and provide leadership on the strategic direction of the council. The roles of officers are defined in agreed job profiles. The Chief Executive is responsible and accountable to the council for all aspects of management including promoting sound governance, providing quality information/support to inform decision making and scrutiny, supporting other statutory officers, and building relationships with all elected members. Leadership capacity of senior officers is supported through the promotion of a Leadership Forum, which brings together senior managers from all services to provide a wider perspective on the consideration of issues facing the council. Forum meetings ensure consistent messaging is available from senior management to Page 16
Page 17
managers. Human Resources have continued to review and refine the leadership development strategy and provide training opportunities online. The council has an agreed elected members’ development strategy that, in addition to the Induction Programme, includes an on-going training programme of learning, development and briefings. Members appointed to certain committees also receive specific training related to the responsibilities of these committees. In addition, elected members represent the council on a range of outside bodies, including on boards of other Community Planning partners, across partnership bodies such as the Moray Economic Partnership, various national bodies such as COSLA and its themed Boards, and a broad range of charitable and third sector organisations. This representation provides valuable learning and networking opportunities for those members. 6. Managing risks and performance through robust internal control and strong public financial management; The council has a risk management policy and strategy designed to support the identification, evaluation and mitigation of risks that may impact on its ability to meet its objectives. A Corporate Risk Register provides summary information on what the CMT/SMT considers are the principal risks facing the council and how these are managed and controlled. Risk implications also feature in committee reports to inform the decision-making process. The council’s system of internal control is based on a framework of financial regulations, regular management information, administrative procedures, management supervision and a scheme of delegation that defines accountabilities of senior officers. Establishing and maintaining an effective system of internal control is a management function. An Audit and Scrutiny Committee, through its consideration of reports by internal and external auditors, monitors the effectiveness of the system of internal control. Strong financial management is secured through the work of the Chief Financial Officer appointed in terms of s. 95 of the Local Government (Scotland) Act 1973. This officer advises the Council on all financial matters and ensures the timely production and reporting of budget estimates, budget monitoring reports and annual accounts. Draft and audited Annual Accounts are published on the council website. 7. Implementing good practices in transparency, reporting, and audit to deliver effective accountability; Council business is conducted through an established cycle of webcast committee meetings. Webcasts remain available for viewing for 12 months following a meeting. Meeting dates are published in advance, and agenda papers are made available at least one week before meetings take place. Minutes of meetings are prepared and important decisions are publicised on the council website and through social media. Page 17
Page 18
The council’s website provides a platform from which to disseminate a wide range of information including news items on policy decisions, guidance on council services and on service disruptions/interruptions arising from weather events or similar. The website facilitates efficient access to digital services across a range of service areas and allows for consultations to be undertaken and for interested parties to provide feedback electronically. The council responds to the findings and recommendations of Internal Audit, External Audit, Scrutiny and Inspection bodies generally by developing improvement Action Plans. The Audit and Scrutiny Committee is integral to overseeing independent and objective assurance processes that make recommendations for improvements to the system of internal control. The Committee’s Terms of Reference were reviewed and updated during the year. The council responds to requests for information and Freedom of Information legislation having processed over 1,300 such requests during the period covered by this statement. Review of Adequacy and Effectiveness of the Council’s Governance Framework In order to assess the effectiveness of the governance framework, including the system of internal control, it is necessary to consider the role of the functions and individuals who contribute to it, as follows: • Elected Members Governance arrangements at a political level emanate from the council, its committees and from other roles that elected members fulfil. These include participation in the Community Planning Board and associated groups for multi- agency issues. Elected members also have substantive roles on the Moray Integration Joint Board for Health and Social Care, the Grampian Valuation Joint Board, and the Moray Leisure Arm’s Length External Organisation (ALEO), each of which has its own governance arrangements. In addition, elected members have membership and represent Moray Council interests in partnerships that contribute to meeting council aims and objectives, notably in the development and delivery of the Moray Growth Deal. • Audit and Scrutiny Committee The council has an Audit and Scrutiny Committee where elected members consider reports on audit work completed. These provide assurances on the adequacy and effectiveness of the system of internal controls including those relative to the delivery of plans, compliance with laws and regulations, accuracy of information and safeguarding of assets. The Committee also receives reports on the performance of and trends from council services regarding service standards and performance information. During the period covered by this statement, to further strengthen oversight processes, two external members have been appointed to the committee in Page 18
Page 19
line with Chartered Institute of Public Finance and Accountancy best practice guidance for Audit Committees operating in Local Government. This committee is a key component of good governance, distinguished from other committees by the role elected members are required to fulfil, not in setting policy or considering service matters, but by providing independent oversight and challenge in support of the council’s duty to secure continuous improvement. These functions are delivered independently from the supervisory oversight roles of the Corporate and Senior Management Teams. • The Corporate Management Team The Corporate Management Team (CMT) has overarching operational responsibility for good governance arrangements. The team comprises the Chief Executive, two Depute Chief Executives with portfolio responsibilities for Education, Communities and Organisational Development; and Economy, Environment and Finance respectively, and the Chief Officer (Health and Social Care Integration). • The Corporate Management Team / Senior Management Team This is an extended management team comprising the CMT and Heads of Services. The role and remit of this group is to support the formulation and implementation of policies, strategies and plans to achieve local and national outcomes, share and promote good practice from an inter-service perspective, to act with the wider objectives of the council in mind to ensure the resources are effectively deployed, and assist CMT in keeping the governance of the council and its services under review. Individual Heads of Service, collectively the Senior Management Team (SMT), have considered the effectiveness of governance arrangements within their respective services by reference to the principal risks identified in the Council’s corporate risk register and provided assurance statements for use in the preparation of this corporate statement. This affirms the broad ownership of good governance and recognition of its importance within the senior leadership of the council. Generally the assurance statements are positive with limited commentary on governance weaknesses, albeit it has been noted in several statements that minor data breaches have occurred. While in part this may be a reflection of a move to hybrid working post pandemic and an increase in electronic communications, the importance of holding personal data securely has been recognised and priority given to refresher training on this topic. This should minimise the risk of further similar breaches occurring. • The Head of Governance, Strategy and Performance (Monitoring Officer) / Chief Financial Officer Page 19
Page 20
The Head of Governance, Strategy and Performance and the Chief Financial Officer perform their respective statutory duties as outlined elsewhere in this statement. In discharging the responsibilities of the role, the Chief Financial Officer complies with the governance requirements of the CIPFA Statement on the role of the Chief Financial Officer, and the Head of Governance, Strategy and Performance provides an information annual report on the duties of Monitoring Officer to a meeting of the council. • The Chief Social Work Officer The Head of Service for Health and Social Care Moray undertakes the statutory role of Chief Social Work Officer (CSWO). The latest available CSWO annual report for the 2021/22 year noted that governance and accountability arrangements remained unchanged throughout the year, with accountability of the CSWO being to the Moray Integrated Joint Board (MIJB) for adult services, and to Education, Communities and Organisational Development Committee and Moray Council on matters relating to children and young people and justice social work. The report noted that planning for the delegation of children’s social work to the Integrated Joint Board was continuing, and it has since been confirmed that this will proceed during 2023/24. Overall the report concluded that notwithstanding the governance arrangements in place, Social Work, like other areas of Health and Social Care, continued to experience pressures. • Internal Audit The council has a system of internal control designed to manage risk to a reasonable level. Internal controls cannot eliminate the risk of failure to achieve policies, aims and objectives and can therefore only provide reasonable and not absolute assurance of effectiveness. The Audit and Risk Manager complies with mandatory Public Sector Internal Audit Standards and with published good practice guidance e.g. on the Role of the Head of Internal Audit in Local Government. During the year, the Internal Audit Charter and the council’s Policy to Combat Fraud, Theft, Bribery and Corruption were updated. The Audit and Risk Manager is accountable on a day-to-day basis to the Head of Governance, Strategy and Performance and to the Audit and Scrutiny Committee. The internal audit plan for the year includes a range of audit projects covering main financial systems, other systems operating within services and several ad- hoc/unplanned projects. The outcomes from these projects, together with any recommendations to enhance the control environment, are reported to the Audit and Scrutiny Committee. This Committee is chaired by an elected member who is not part of the council Administration. Almost all planned reviews detailed within the Annual Internal Audit Plan for 2022/23 have been completed. The Public Sector Internal Audit Standards require an internal audit opinion to be provided annually. As planned audit work was substantially completed by the year- Page 20
Page 21
end, and based on his wider knowledge of the organisation and its control systems, it is the opinion of the Audit and Risk Manager that reasonable assurance can be placed upon the adequacy and effectiveness of the governance and control environment which operated in the council during the year. • Health & Social Care Integration The council, as a key partner within Health and Social Care Moray has an interest in the governance arrangements within the Moray Integration Joint Board (MIJB). Internal Audit arrangements for the MIJB are provided jointly by the council’s Internal Audit service and NHS Grampian’s Internal Auditors. The council’s Internal Audit Service provides assurance over social care services, and oversight of the MIJB governance arrangements. A separate internal audit opinion is provided in respect of audit projects completed for the MIJB. • External Agencies In addition to the various internal review processes and the external audit of the Annual Accounts, aspects of the council’s governance arrangements are considered in various inspection reports produced by the external auditor and other inspectorate agencies. Audit Scotland’s Best Value Assurance Report on Moray Council contained eight recommendations. An action plan was developed in response and good progress has been made. The council remains committed to responding positively to the remaining recommendations to strengthen governance arrangements, with progress closely monitored and updated status reports on each action being reported to the appropriate committee. Overall assessment of the effectiveness of governance arrangements Having regard to the information provided in the preceding paragraphs, it is considered that established systems and processes are broadly effective and not inconsistent with the seven principles identified in the ‘CIPFA/SOLACE’ Framework ‘Delivering Good Governance in Local Government.’ Significant governance issues Governance issues highlighted as significant in the Annual Governance Statement for 2021/22 went beyond describing governance processes and how effective they operated in practice, also providing commentary on the planned strategic direction of the council and its partners, and linked risk issues. That strategic direction continues to be developed and adapted in response to multiple factors both external and internal, and is covered more appropriately in a separate Management Commentary, also published with the Annual Accounts. Page 21
Page 22
Specific governance issues noted in the prior year and how they have been addressed relate to: An externally commissioned review on the management of social care contracts; - a report on this was published in February 2023, and has been submitted to the Audit, Performance and Risk Committee of the Moray integration Joint Board and to the council’s Audit and Scrutiny Committee for their respective interests. The report covers a complex area of work, with Self-directed Support legislation enabling individuals to exercise choice and control over the support or services required to meet assessed care needs. While the legislation provides welcome flexibility in terms of personalising care provision, this has created challenges for the Commissioning Service to review and update contractual agreements with multiple suppliers of care services, at a time when these services are operating under difficult market conditions with staffing and cost pressures widely documented. The report makes recommendations to strengthen governance arrangements and deliver improvements. These recommendations have been accepted by the management of Health and Social Care Moray, and will require the Commissioning Service to work more closely with the council’s procurement team going forward, and to develop an action plan for improvement that assigns responsibilities to relevant officers and sets timescales to enable progress to be effectively monitored. Addressing the key challenges to support education recovery and the need for improving attainment; - Educational Services has refreshed its standards for Professional Leadership and Learning 2022-2025. This has updated its vision to support and develop Moray teachers and practitioners to enable children and young people to be the best they can be. Attainment results have been monitored and reported to council in a detailed report which outlined achievements as well as challenges that require to be addressed as the service emerges from the pandemic. A number of other governance issues have been identified that require further development in the incoming period relating to curriculum improvements, inspections, and aspects of financial management. Managing the fine political balance with new Members through a commitment to collaboration across all Councillors; - a programme of induction has been delivered for new and returning elected members of the council. Briefing sessions have been provided as necessary on corporate and service projects as appropriate. Political Leaders have recognised the importance of collaborative working where possible and this message has been reinforced by the council’s Corporate/ Senior Management Team both informally and in committee reports covering strategic topics including on Best Value and on the Corporate Overview of Council Priorities. Additional developments in the council’s risk management and business continuity arrangements; - a part - time officer has been appointed to assist in the assessment of risks affecting the council, and support the preparation of business Page 22
Page 23
continuity plans to aid delivery of critical services in the event of a disruption. An early stage review has been completed to inform areas requiring priority attention. The focus has been on the identification of critical functions and to align business continuity planning with risk management practice, thus ensuring that there is justification for allocating resources to particular tasks. A plan is in place to progress this work within council services and to develop links with partners and emergency planning as appropriate. Increased numbers of data breaches have highlighted the need for further data protection training; - data breaches, albeit in small numbers, continue to be highlighted across a number of service areas, potentially a consequence of staff working in a more diverse way during and since the pandemic. The council has addressed this by updating its mandatory e-learning module covering General Data Protection Regulations (GDPR) and has developed a refresher training course for staff to annually measure their understanding of this important topic. Internal audits of information governance and of compliance with the GDPR requirements were completed and action plans developed and agreed with management for implementation during 2023/24. Implementation of actions arising from the latest Best Value Progress Report from the Accounts Commission; - A Best Value action plan was submitted and approved by council covering a number of themes – increasing the pace of transformational change, performance reporting, financial planning and sustainability, and improving educational attainment. The importance of committed decisive leadership was also highlighted as an issue in the Best Value report - this has been recognised as a political risk in the corporate risk register and in a number of reports to council and its committees on matters relative to strategic direction and good governance. Concluding Remarks This Annual Governance Statement summarises the extensive governance arrangements the council has in place to support delivery of its strategic plans and to secure Best Value in its use of resources. While the statement demonstrates that these arrangements are comprehensive and broadly fit for purpose, there are multiple challenges ahead that will impact on how council services are designed and delivered going forward. As these challenges are addressed in the incoming period, it is recognised that governance arrangements too will need to be adapted, and in our respective roles as Council Leader and Chief Executive (Head of Paid Service), we are committed to making this happen to ensure the council and its resources continue to be effectively managed and controlled. Page 23
Page 24
Kathleen Robertson Roderick D Burns Leader of the Council Chief Executive 28th June 2023 Page 24
Page 25
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 27 JUNE 2023 SUBJECT: INTERNAL AUDIT ANNUAL REPORT – 2022/23 BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 To provide Committee with a copy of the Internal Audit Annual Report for the year ended 31 March 2023, together with the Audit and Risk Manager’s opinion on the adequacy and effectiveness of the council’s system of internal control. 1.2 This report is submitted to Committee in terms of Section III (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee considers the contents of the annual report given as Appendix 1 to this report and seeks clarification on any matters relating thereto. 3. BACKGROUND 3.1 The purpose of this report is to present to the Audit and Scrutiny Committee the Internal Audit Annual Report for the year to 31 March 2023, which includes the Audit and Risk Manager's independent assurance opinion on the adequacy of the Council's overall control environment. 3.2 The Public Sector Internal Audit Standards (PSIAS) requires the Chief Audit Executive (CAE), the Council’s Audit and Risk Manager, to provide an annual internal audit opinion and report on the adequacy and effectiveness of the Council’s governance, risk management and internal controls to support the preparation of the Annual Governance Statement. 3.3 To meet the requirements of the PSIAS, the Internal Audit Annual Report 2022/23, at Appendix 1, includes the annual Internal Audit opinion and provides details of the Internal Audit activity and performance during the year. Item 6. Page 25
Page 26
4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 The Internal Audit annual report provides a summary overview of the nature and extent of audit work carried out during the year to inform the audit opinion on the internal control environment operating within the Council. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-158 / SPMAN-1042990102-159 Page 26
Page 27
APPENDIX 1 INTERNAL AUDIT ANNUAL REPORT and OPINION 1 APRIL 2022 to 31 MARCH 2023 Item 6. Page 27
Page 28
CONTENTS Page SECTION 1 – INTRODUCTION 3 SECTION 2 – BASIS OF OPINION 3-4 SECTION 3 – SUMMARY AND LIMITATIONS OF WORK THAT SUPPORTS OPINION 4-9 SECTION 4 – OPINION 9 Page 28
Page 29
SECTION 1 – INTRODUCTION Purpose of this report 1.1 This report is issued in compliance with the Public Sector Internal Audit Standards (PSIAS), which requires the Audit and Risk Manager to deliver ‘an annual internal audit opinion and report that can be used by the organisation to inform its governance statement’, and which ‘must conclude on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control’. This report constitutes the required statement. 1.2 It is management’s responsibility to maintain risk management systems, internal control and governance. Internal Audit is an element of the internal control framework established by management to examine, evaluate and report on accounting and other controls over operations. Internal Audit assists management in the effective discharge of its responsibilities and functions by examining and evaluating controls. Internal Audit cannot be held responsible for internal control failures. 1.3 Internal Audit’s role includes assessing the adequacy of the risk management, internal controls and governance arrangements put in place by management and performing testing on a sample of transactions to ensure those controls were operating for the period under review. 1.4 Public Sector Internal Audit Standards (PSIAS) require officers of the Internal Audit Section to communicate on a timely basis all facts and matters that may have a bearing on their independence. I can confirm that all staff members involved in 2022/23 internal audit reviews were independent of operational processes and their objectivity was not compromised in any way. SECTION 2- BASIS OF OPINION 2.1 This opinion is based on my knowledge of the Council’s governance, risk and control processes and from audit work completed during the period to 31st March 2023. There are limitations to the level of assurance that can be provided dependent on the scope and coverage of the audit work completed. My evaluation is based on the following: • The audit work undertaken by Internal Audit during the year to 31st March 2023. • The assurance statements signed by Heads of Services on the operation of the internal financial controls for the services they were responsible for during the year to 31st March 2023. • The governance statement of the Council for the year ended 31st March 2023. • Reports issued by the Council’s External Auditor, Audit Scotland, and other external review agencies. Page 29
Page 30
• My knowledge of the Council’s governance, risk management and performance monitoring arrangements. SECTION 3- SUMMARY AND LIMITATIONS OF WORK THAT SUPPORTS THE OPINION 3.1 Internal audit operates independently within the organisation. While there may have been limitations in the scope of the audit due to the pandemic, there have been no limitations imposed by management on the scope of audit work performed. The internal audit opinion has been informed by the audit work completed during the year. 3.2 The annual audit plan presented to the Audit and Scrutiny Committee at the start of the year describes in some detail the framework around which audit work is developed. In addition, the selection of audit topics was selected having regard to corporate planning documents, budget data and information drawn from the corporate risk register, and takes into account input from senior management regarding possible areas for audit. The work undertaken by Internal Audit in 2022/2023 is summarised below. 3.3 The internal audit work has been conducted in accordance with an established methodology that promotes quality and conformance with the Public Sector Internal Audit Standards and the agreed Internal Audit Annual Audit Plan. Planned audit coverage Status Housing Benefits - Rent Rebates and Rent Allowances Completed Procurement and Creditor Payments Completed Payroll Completed Capital Plan- Aberlour Early Years Learning & Childcare Scheme Completed Stocks and stores - year end valuations Completed Cyber security Completed Collection and accounting of planning fees Completed Housing and Property- Planned Maintenance Works Completed General Data Protection Regulation Completed Environmental & Commercial Services – Stores Completed Refuse Collection (Domestic) Completed Moray Growth Deal Completed Education – Secondary School Completed Emergency Planning Completed European Social Fund Completed Corporate Services - ICT Hardware Asset Management Deferred to a future Audit Plan Care First System Completed Self Directed Support Completed Information Management Completed Page 30
Page 31
Progress on the 2022/2023 Internal Audit Plan 3.4 Progress against planned audit work for the year to 31 March 2023 can be summarised as follows:- • Each year, an element of the plan covers work on core financial systems, which are of key significance to the Council in terms of good financial governance. These systems receive the most significant focus in terms of management control and are also reviewed on a cyclical basis by the External Auditor to obtain assurances needed for the audit of the annual accounts. • Summaries of the issues arising in relation to each system or activity covered by internal audit work in 2022/2023 have been reported separately to the Audit and Scrutiny Committee. Appropriate responses to the recommendations are also included. When actioned, the recommendations made in the internal audit reports should provide management with additional comfort that the system of control operates as intended. It is therefore imperative that the agreed actions are implemented by management. • The impact of the pandemic has resulted in changes in the working practices of services with officers working from home. This has required a change to established working practices, e.g., making greater use of audio, video, and screen-sharing software applications. These changes in working practices have brought challenges; however, using an Internal Audit Software Application has assisted in ensuring consistency in working practices. • Despite these constraints, I am pleased to report that the majority of the Audit Plan for 2022/23 has been completed. In addition to the planned audit work, an investigation was undertaken within Building Services regarding an allegation of overtime paid to two officers. This resulted in a report to the Building Services Manager detailing variances between the overtime claimed and the actual hours worked. The scope of a planned review of planned maintenance works was subsequently increased to include an overview of the systems and practices for authorising overtime payments within Building Services. • Additional testing was also required within a planned review of the payroll system due to an incident regarding the unauthorised access to an officer’s Employee Self-Service account. This included a check of a sample of officers who had requested the Payroll Section to reset their passwords for access to their Employee Self-Service accounts. It is pleasing to note that no issues were noted, but the audit has included recommendations to improve controls within the payroll system. • An audit was undertaken into the operational management arrangements for the refurbishment of Aberlour early years learning and childcare premises. The Depute Chief Executive (Education, Communities & Organisational Development) requested the review after concerns were raised by elected members regarding the scheme. The scope of the review was to undertake an overview of the reporting arrangements and compliance with Financial Regulations, Procurement Guidelines for the refurbishment of the premises. A Page 31
Page 32
number of recommendations were made to enhance future governance and administrative arrangements. All recommendations have been accepted. • The Internal Audit Section coordinates the Council’s participation in the National Fraud Initiative, a data-matching exercise involving a range of public sector bodies. This activity is viewed as complementary to other audit activities, and participation assists Internal Audit in assessing the potential for the occurrence of fraud and related fraud risk. The Corporate Investigations Officer provides support to services for matches needing investigation and also for undertaking an overview of the process. However, due to sickness, these duties had to be done by an Auditor, which has impacted the number of days available to complete the Annual Audit Plan. 3.5 The total number of recommendations made is set out in the following table: Report Risk Ratings for Recommendations System/ Testing Assessment High Medium Low 2021/22 Audit Plan H Housing Benefits - Rent Rebates and Rent Allowances 0 0 0 Full Procurement and Creditor Payments 0 0 0 Full Procurement and Creditor Payments (MIJB) 2 2 0 Limited Payroll 4 1 0 Substantial Capital Plan - Aberlour Early Years Learning & Childcare Scheme 3 3 0 Limited Cyber security 3 3 0 Substantial Collection and accounting of planning fees 0 1 2 Full Housing and Property- Planned Maintenance Works 0 7 2 Substantial General Data Protection Regulation 5 2 1 Limited Environmental & Commercial Services – Stores Substantial Refuse Collection (Domestic) 1 4 3 Substantial Moray Growth Deal 2 3 0 Substantial Education – Buckie High School 0 1 2 Full Emergency Planning 1 6 0 Substantial European Social Fund 0 0 0 Full Care First System 0 9 1 Limited Self Directed Support 7 3 0 Limited Information Management 1 5 0 Limited Page 32
Page 33
3.6 The following performance measures were in place for 2022/2023: Measure Description Target Actual Final Report Percentage of Auditee(s) responding within 20 days of receiving the draft report. 100% 69% Final Report Percentage of final audit reports issued within 10 days of agreeing the draft report 100% 100% Audit Plan Delivery Percentage of audits completed v planned. 85% 94% Audit Budget Percentage of audits completed within budgeted days. 80% 75% Audit Recommendations Percentage of audit recommendations agreed. 90% 100% Customer Feedback Percentage of respondents who rated that the audit added value and provided meaningful results. 100% 100% Follow Up Reviews Percentage of Follow Up Reviews completed v planned 100% 90% It is pleasing to report the majority of planned projects within the Audit Plan for last year was completed. In addition, all reports were issued as “final” within 10 days of agreeing the draft report, and officers agreed to all recommendations. Completion of audit projects within individual budgets was below target; however further testing was required within the reviews of Planned Maintenance Works and the Payroll System. In addition, significant findings were found in the reviews administered by the Moray Integration Joint Board. Difficulties were experienced in obtaining replies to audit recommendations within 20 days of officers receiving the draft report. Heads of Services have been informed of the need to respond promptly to audit recommendations, but the demands on officers to meet service requirements are appreciated. 3.7 Governance – in supporting the preparation of the Council’s Annual Governance Statement, sufficient information was obtained by Internal Audit to conclude that the Council generally complies with the latest good governance practice issued by CIPFA /SOLACE, and that the Corporate Management Team (comprising the Chief Executive, two Depute Chief Executives and the Chief Officer - Moray Health and Social Care ) and Senior Managers have a strong awareness of the challenges facing the Council in the incoming period. Written assurances from senior managers also considered governance practice within individual service areas. 3.8 Key governance and internal control arrangements have been maintained, albeit capacity issues called for resources to be prioritised for essential services and to take forward the Council's strategic priorities. Internal Audit noted progress made in several key priority areas while supporting the development of the annual governance statement. This has included the development of a Scrutiny Guide and further expanding the role of the Audit and Scrutiny Committee. The pandemic required committee meetings to be remotely, however the Council agreed in June 2022 to a Page 33
Page 34
hybrid system, allowing officers and members to join meetings from within and outwith the chamber. 3.9 Risk Management – procedures have been developed with a risk management policy in place and risk registers maintained at corporate and service levels. It is pleasing to report that additional resources were provided with the appointment of a Risk Management and Business Continuity Officer. The Risk Management and Business Continuity Officer has assisted in facilitating further implementation and development of risk management arrangements within Services. This should ensure more effective service-level risk management to underpin the Corporate Risk Register. 3.10 The Corporate Risk Register is regularly reviewed by the senior management and was approved by the Corporate Committee in August 2022. Political and financial risks figure highly given the acute challenges the Council has faced and continue to face going forward. Successful implementation of the Improvement and Modernisation Programme will be vital to improving the future efficiency and sustainability of Council services. Statement on Conformance with the Public Sector Internal Audit Standards 3.11 The Local Authority Accounts (Scotland) Regulations 2014 require that ‘a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing’. The recognised standards adopted by all Scottish Councils are the Public Sector Internal Audit Standards (PSIAS) developed by the Chartered Institute of Public Finance and Accountancy and the Chartered Institute of Internal Auditors. The standards include a requirement for an annual self-assessment. 3.12 Internal performance monitoring against PSIAS has been ongoing over the last few years. However, a more structured internal assessment has recently been completed in preparation for the next External Quality Assessment, scheduled for later in 2023. An Action Plan detailing recommendations required for compliance with PSIAS was reported to the February Audit and Scrutiny Committee. It is pleasing to report that all recommendations have been implemented. This included a change in the Committee reporting arrangements with reports now from the Audit and Risk Manager rather than the Depute Chief Executive (Education, Communities and Organisational Development). It was also agreed that the responsibility for preparation for the Council’s Annual Governance Report now lies outwith the Internal Audit Service. Implementation of both recommendations has enhanced the Council’s governance arrangements and the requirement for the opinion of the Audit and Risk Manager to be independent of management. 3.13 The Public Sector Internal Audit Standards require the Audit and Risk Manager to consider whether or not the audit staffing resources are sufficient to meet the audit needs of the organisation and where it is believed that the level of resources may adversely impact the provision of the annual internal audit opinion, and draw this to the attention of the Committee. Demands on the Internal Audit Service have increased over a number of years, and it is expected this will continue. After a review of the staffing establishment, the Council agreed to additional staff resources in the form of an Assistant Auditor. Unfortunately, due to the current financial pressures, Page 34
Page 35
the decision to progress with this appointment has been deferred for a year. As the Audit and Risk Manager, I am concerned about whether available resources will be sufficient to meet the auditing needs of the Council, Moray Integration Joint Board and the Grampian Valuation Joint Board. . 3.14 In considering the sufficiency of the audit coverage, Committee is reminded that the responsibility for developing and maintaining a sound control environment rests with management and not with Internal Audit. SECTION 4- OPINION 4.1 Any system of control can only ever provide reasonable and not absolute assurances that control weaknesses or irregularities do not exist or that there is no risk of error, fraud, or breaches of laws or regulations. Furthermore, it is the responsibility of management to establish an appropriate sound system of internal control and monitor its effectiveness. It is the responsibility of the Audit and Risk Manager to provide an annual assessment of the robustness of the internal control system. 4.2 It is my opinion, based on the audit work completed and other sources of assurance, that reasonable assurance can be placed on the adequacy and effectiveness of the Council’s internal control system for the year ending 31 March 2023. Dafydd Lewis Audit and Risk Manager 13 May 2023 Page 35
Page 36
Page 36
Page 37
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 27 JUNE 2023 SUBJECT: INTERNAL AUDIT SECTION – COMPLETED PROJECTS REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 11 May 2023 to 27 June 2023. 1.2 This report is submitted to Committee in terms of Section III (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the following internal audit work concluded during the period from 11 May 2023 to 27 June 2023. The reviews detailed below conclude the audit plan for 2022/23. Emergency Planning 3.2 An audit review of the Council's Emergency Planning arrangements has been undertaken. The Civil Contingencies Act 2004 places a legal obligation upon emergency services and local authorities to assess the risk of, plan, and exercise for emergencies, such as floods, adverse weather, pandemic or other emergencies that could have a significant impact on the community. Effective emergency planning is an essential component of the Council’s overall governance arrangements to ensure the resilience of all key services in the event of a major incident. The audit also reviewed if adequate training, planning and testing had been undertaken to ensure the Council is prepared in Item 7. Page 37
Page 38
the event of an emergency. The executive summary and recommendations for this project are given in Appendix 1. Self Directed Support 3.3 A review of the financial monitoring arrangements for Self-Directed Support (SDS) packages has been undertaken as part of the coverage for Health & Social Care Moray activities. The Social Care (SDS) (Scotland) Act 2013 came into force in April 2014 and introduced the Self Directed Support (SDS) term to describe how people can exercise choice and control over the support or services that allow them to live independently and meet agreed outcomes. The Act requires all Local Authorities to offer options to individuals who have been assessed as needing a care service. 3.4 The scope of this audit was to review systems and procedures for the following care delivery options: • An individual chooses their own support but is managed by Health & Social Care Moray. • The care provider is arranged by Health & Social Care Moray at the request of the service user. Annual expenditure for these types of care delivery options amounted to approximately £40 million and £17 million respectively for external and in- house (Health & Social Care Moray) care providers. The executive summary and recommendations for this project are given in Appendix 2. Buckie High School 3.5 A review of the administrative arrangements within Buckie High School has been completed. The scope of this audit was to undertake a review of the Devolved School Management Scheme in terms of the allocation of funding and the management of these funds at school level. In addition to undertaking an overview of how the School develops, monitors and controls its £4.8 million budget, the audit reviewed the management of the staffing costs involved in delivering the curriculum. The audit checked that non payroll expenditure complied with Financial Regulations and Procurement Guidelines. A review was also undertaken to ensure appropriate accounting arrangements are followed in managing school fund monies. The executive summary and recommendations for this project are given in Appendix 3. Page 38
Page 39
Environmental & Commercial Services – Stores 3.6 A review was undertaken of the Environmental & Commercial Services Stores. The audit reviewed the systems and controls in managing materials, parts and equipment (stock) stored to meet the needs of Roads, Cleaning and Fleet Services. In addition, the stores is also responsible for the purchase and issue of approved clothing for all Council Services. Individual stock items can vary in value from a few pounds to upwards of £1,000. Approximately £1.1 million of stock is issued annually from stores. The executive summary and recommendations for this project are given in Appendix 4. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Page 39
Page 40
Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-163 / SPMAN-1042990102-160 SPMAN-1042990102-166 / SPMAN-1042990102-161 SPMAN-1042990102-162 Page 40
Page 41
Appendix 1 AUDIT REPORT 23’021 EMERGENCY PLANNING Executive Summary The annual audit plan for 2022/23 provides for an audit review of the Council's Emergency Planning arrangements. The Civil Contingencies Act 2004, places a legal obligation upon emergency services and local authorities to assess the risk of, plan, and exercise for emergencies, such as floods, severe weather, industrial accident or other emergencies that could have a significant impact on the community. Effective emergency planning is an essential component of the Council’s overall governance arrangements to ensure the resilience of all key services in the event of a major incident. An Emergency Planning Officer supports Council Services' delivery of emergency planning arrangements. The objective of this audit was to provide assurance over the adequacy and effectiveness of current controls over emergency planning. The audit scope reviewed that adequate training, planning and testing systems have been developed to ensure the Council is prepared in the event of an emergency. However, emergency planning arrangements cannot exist in isolation as effective business continuity plans are required to ensure the Council can not only deal with an emergency but also continue to function and recover effectively afterwards. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The audit found significant work has been undertaken to ensure the Council maintains effective emergency planning arrangements and the ability to respond operationally to emergency events. This has been achieved despite limited staff resources. The review highlighted the following key points: • The Emergency Planning Policy and Procedures have not been updated since 2014. This document is currently being reviewed and provides guidance to officers for coordinating action in dealing with an emergency. The Emergency Planning Policy and Procedures should be updated to reflect current operating arrangements and staffing structures. • Emergency Plans have been developed detailing actions to be undertaken in the event of an incident. It is appreciated the limited staffing resources available, however it was found that some plans still need to be reviewed and updated to reflect the current staffing structures of the Council and partner organisations. After updating, testing should be undertaken to ensure effectiveness and highlight any further improvements to Emergency Plans. Item 7. Page 41
Page 42
Appendix 1 • It was noted the Council maintains a weekly rota of senior managers designated as Moray Emergency Response Co-Ordinators (MERC) in the event of an incident. However, it was found that limited training is provided or documented guidance and instructions to support officers in their duties. It was noted that work is being carried it to improve guidance available to MERC’s. In addition, it was also found a need to update the emergency contact details of officers. Page 42
Page 43
Appendix 1 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: The Council’s emergency planning arrangements are fit for purpose to respond effectively in the event of a major incident 5.01 The Emergency Planning Policy and Procedures should be updated to reflect current operating arrangements and staffing structures. Medium Yes A new Moray Council General Emergency Plan is in development / draft. Updating both the strategic and operational requirements of the Moray Councils Emergency Response arrangements and outlining the responsibilities Emergency Planning Officer 31/05/2023 Page 43
Page 44
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation of responder partners. 5.02 Regular meetings should be held between the Emergency Planning Officer and the Business Continuity and Risk Management Officer to ensure ongoing alignment of emergency and business continuity plans. High Yes A Closer working relationship will continue between the Emergency Planning Officer and the Business Continuity and Risk Management Officer, to further develop alignment of emergency planning and business continuity plans. Emergency Planning Officer / Business Continuity and Risk Management Officer Ongoing Page 44
Page 45
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.03 Emergency plans should be updated to reflect current risks, working practices and staffing structures of the Council and partner organisations. After updating the emergency plans, testing should be undertaken to evidence their effectiveness and highlight any areas for further improvement. Medium Yes Emergency Plans are being updated to reflect risks, and strategic and operational requirements. However this process requires commitment from the heads of services to ensure implementation of this recommendation Once developed, a test exercise schedule will be developed to stress test and learn lessons and update the agreed plans. Emergency Planning Officer 31/12/2024 Page 45
Page 46
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 Further training and documented guidance should be provided to Moray Emergency Response Co-Ordinators (MERC) to support officers in best practices to follow in the event of an emergency incident. Medium Yes The Emergency Planning Officer has previously sourced, on a number of occasions, free Scottish Government Crisis Management training for officers. This training is now being re-run in May 2023 and all MERC’s yet to undertake have been invited to attend. The Emergency Planning Officer has also sourced a MERC induction package from a neighbouring authority and this Emergency Planning Officer / Senior HR Adviser 31/12/2023 Page 46
Page 47
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation will be developed along with Organisational Development for future MERC training delivery. New Action Cards (step by step) guidance is in development for MERC’s to use at time of incidents. 5.05 Emergency contact details of the Moray Emergency Response Co-Ordinators (MERC) saved within Sharepoint should be restricted to only officers that require access to this information. Medium Yes ICT/Sharepoint to provide the Emergency Planning Officer with a list of access names for review. The Emergency Planning Officer to Emergency Planning Officer 31/07/2023 Page 47
Page 48
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation review and clarify those that need requirement and advise ICT accordingly. 5.06 An Annual Report should be provided to elected members detailing the work undertaken and planned within emergency planning. Medium Yes An Annual Emergency Planning Report will be submitted to members. Consultancy Manager 31/03/2024 5.07 A review of the hyperlinks contained within emergency planning webpages should be undertaken to ensure they connect to the intended document or website. Medium Yes The Emergency Planning Officer in Liaison with the Senior Communication s Officer is making arrangements to progress updating of relevant hyperlinks. Emergency Planning Officer/ Senior Comms. Officer 30/08/2023 Page 48
Page 49
Appendix 2 1 AUDIT REPORT 23’025 SELF DIRECTED SUPPORT Executive Summary The Internal Audit Plan for the 2022/23 year provides for a review of the financial monitoring arrangements for Self-Directed Support (SDS) packages of adults as part of the coverage of Health & Social Care Moray activities. The Social Care (SDS) (Scotland) Act 2013 came into force in April 2014 and introduced the SDS term to describe how individuals can exercise choice and control over the support or services that allow them to live independently and meet agreed outcomes. The Act requires all Local Authorities to offer the following 4 Options to individuals who have been assessed as needing a care service: • option 1 - a direct payment, which is a payment to a person or third party to purchase their own support • option 2 - the person directs the available support • option 3 - the local council arranges the support • option 4 - a mix of the above The scope of the audit was to review systems and procedures in the delivery and management of adult social care provided under Options 2 and 3 of the SDS Scheme. This included examination of the processes to support individuals in their preferred care delivery option, contractual relationships with care providers, financial management and monitoring of individual care packages. Annual expenditure for individuals in receipt of SDS Option 2 and & 3 care packages amounted to approximately £40 million and £17 million respectively for external and internal care providers. The audit was carried out in accordance with the Public Sector Internal Audit Standards (PSIAS). The key areas identified for management attention include the following :- • The Social Care (SDS) (Scotland) Act 2013 requires Councils to provide individuals and their families with information and support to decide on a service user's preferred SDS care delivery option. A review of the support packages of individuals using care services found limited evidence of discussions between social workers and service users/families regarding the range of SDS care delivery options. A clear audit trail should be maintained to evidence the discussions held with service users in determining their care package. • It was noted that where care is delivered through SDS Option 2, a tripartite agreement should be agreed to detail the care provided, signed by the provider, Council, and the supported person. From a random sample of individuals using care services, it was found the majority had no tripartite agreement in place to Item 7. Page 49
Page 50
Appendix 2 2 formalise their care arrangements. The audit found, through a documentation review and discussions with social workers, examples where no referral had been made to the SDS Team to finalise a tripartite agreement or where the process still needed to be completed. The current workload pressures within the Service are appreciated. • The Council does not charge individuals receiving a day care service. A review of practices within other Local Authorities notes charging policies where individuals contribute to the cost of receiving a day care service. The Council's charging policy should be reviewed regarding day care and a decision should be made as to whether a charge should be levied for the service in future. • Audit testing noted examples where supporting documentation concerning an individual's care package was either not recorded or could not be found within the CareFirst System. In addition, changes to care packages were noted regarding the care delivered or the provider where again this was not reflected within the CareFirst System. CareFirst is the primary database that records and manages social care cases within Health & Social Care Moray. The limitations of the CareFirst System are appreciated, highlighted in a separate audit review in 2022/23. The Service has committed to investigate a replacement to the current recording databases used within Health & Social Care Moray. Page 50
Page 51
Appendix 2 3 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective controls operate in the management and recording arrangements for the delivery of SDS Options 2 and 3 care packages 5.01 In accordance with SDS Regulations, evidence should be maintained to document the discussions held by social workers regarding the various care delivery options discussed with the individual using care services. High Yes Discussions will be held by Social Workers as part of the assessment and recorded as part of the Support Plan on Care First. Team Managers will be accountable to ensure implementatio n and delivery through supervision, which will be monitored and reviewed at Chief Social Work Officer / Head of Service 30/09/2023 Page 51
Page 52
Appendix 2 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Practice Governance Board monthly. 5.02 Documented procedures should be developed to support social workers and individuals using care services in the selecting of SDS care delivery options. High Yes Relevant Guidance will be developed and a process map will be distributed to all Social Workers. This will be monitored at Practice Governance Board monthly. Chief Social Work Officer / Head of Service 31/03/2024 5.03 An annual reference document detailing a breakdown of the rates paid to care providers should be provided to all relevant officers to assist in budgetary High Yes A document containing all providers and costs will be issued to all relevant Provider Services Manager 30/06/2023 Page 52
Page 53
Appendix 2 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation planning and the accurate preparation of an individual's support package. officers. A process to maintain and update the document going forward will be developed and monitored through the Practice Governance Board on a regular basis. 5.04 All officers should be reminded to update the CareFirst System to ensure the database is up-to-date and accurate for each individual using care services. High Yes Discussions will be held by Social Workers as part of the assessment and recorded in the Support Plan on Care First. Team Chief Social Work Officer / Head of Service 30/09/2023 Page 53
Page 54
Appendix 2 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Managers will be accountable to ensure implementatio n and delivery through supervision, which will be monitored and reviewed at Practice Governance Board monthly. 5.05 A tripartite agreement between the individual using the care service, Council and care provider should be agreed for all SDS Option 2 care packages. Medium Yes Social Workers will refer to the SDS Team when setting up a new package and this will be reviewed and monitored through Chief Social Work Officer / Head of Service 30/09/2024 Page 54
Page 55
Appendix 2 7 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation supervision. SDS Team to then put in place a Tripartite Agreement. This will be monitored and reviewed at the Practice Governance Board regularly. 5.06 A contractual agreement detailing service delivery and costs should be agreed with the 3 providers of day care services noted within the findings. High Yes Clarification will be given from SDS Team and Social Work as to the direction regarding contractual agreement. Provider Services Manager 31/03/2024 Page 55
Page 56
Appendix 2 8 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.07 Annual support plan reviews of individuals in receipt of SDS Option 2 and 3 care packages should be undertaken in accordance with agreed procedures. High Yes Work with Social Work to develop a strategy to ensure all reviews are completed on time. There is a significant capacity issue across Social Work. This will be monitored and reviewed regularly through the Practice Governance Board. Chief Social Work Officer / Head of Service 30/09/2024 Page 56
Page 57
Appendix 2 9 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.08 Consideration should be given for management to undertake regular reviews of the accuracy and recording of the checks completed to ensure the accuracy of payments made to care providers. Medium Yes Continuous audit to be implemented through Community Care Finance. Interim Community Care Finance Officer 30/09/2023 5.09 The Council's charging policy should be reviewed in regard to day care and a decision made as to whether a charge should be levied for the service in the future. High Yes Review the Moray Council charging policy to allow the IJB to make recommendati ons regarding future iterations. Interim Chief Finance Officer (MIJB) 30/09/2023 5.10 A review of arrangements regarding the authorisation of individual care packages should be undertaken. Medium Yes Review the current authorisation practice in line with financial Chief Social Work Officer / Head of Service 31/08/2023 Page 57
Page 58
Appendix 2 10 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Thereafter, authorisation requirements should be documented and communicated to all appropriate officers. regulations. Develop a process map highlighting authorisation levels for all Social Workers. Monitor and review through the Practice Governance Board. Page 58
Page 59
Appendix 3 AUDIT REPORT 23’024 BUCKIE HIGH SCHOOL Executive Summary The annual Internal Audit plan for 2022/23 provides for a review of a secondary school as part of a rolling programme of audit visits within Education Services. This audit details the findings from the audit review undertaken of Buckie High School as a start of this rolling programme of visits planned for all secondary schools. The scope of this audit was to undertake a review of the Devolved School Management Scheme in terms of the allocation of funding and the management of these funds at school level. Consideration was given to how budgets are affected by national, Council and School priorities. In addition to undertaking an overview of how the School develops, monitors and controls its £4.8 million budget, the audit reviewed the management of the staffing costs involved in delivering the curriculum. The audit checked that non payroll expenditure complied with Financial Regulations and Procurement Guidelines. A review was also undertaken to ensure appropriate accounting arrangements are followed in managing school fund monies. This report sets out the work undertaken in relation to the 2022/23 financial year. Testing found Buckie High School to be well managed with a good appreciation of policies, procedures and financial management processes. However, consideration should be given to the following:- • It was noted a register of electrical items is maintained, but not of other types of equipment held at the School. Council Financial Regulations require a comprehensive record of all moveable items with an individual replacement cost of over £500. • A review of school fund records noted effective management arrangements, however consideration should be given to implementing further improvements in the monthly bank reconciliation exercise. This includes the “writing back” of uncashed cheques over 6 months old. Item 7. Page 59
Page 60
Appendix 3 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Listings of equipment held by the School are kept up-to-date and secure with physical items appropriately identified. 5.01 An inventory record should be developed of all moveable items with a value over £500. Thereafter a copy of this record should be saved off site. Medium Yes Financial Regulation compliant inventory record to be developed. Copy to be held off site. Business Support Officer 30/06/2023 Key Control: School Funds are administered in compliance with the School Fund Regulations. 5.02 Monthly school fund reconciliation records should include a requirement for the “writing back” of uncashed cheques over 6 months old. In addition, correcting adjustments noted within the school fund Low Yes School Fund Procedures be amended. Business Support Officer 30/08/2023 Page 60
Page 61
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation cashbook should also be amended. 5.03 Supporting documentation to evidence income and expenditure transactions should be held with the central School Fund records. Low Yes Supporting documentation relating to School fund income and expenditure now held with central School Fund records. Business Support Officer Implemented Page 61
Page 62
Page 62
Page 63
Appendix 4 AUDIT REPORT 23’023 ENVIRONMENTAL & COMMERCIAL SERVICES STORES Executive Summary The annual Internal Audit plan for 2022/23 provided for a review to be undertaken of the Environmental & Commercial Services Stores. The stores is located at the Ashgrove Depot in Elgin and includes both internal and external storage facilities. This is the primary storage facilities for meeting the needs of Roads, Cleaning and Fleet Services. In addition, the stores is also responsible for the purchase and issue of approved clothing for all Council Services. The stores system has 1225 lines of individual stock items, which can vary in value from a few pounds to upwards of £1,000. Approximately £1.2 million of stock items were issued from stores in 2022/23. The audit used the Chartered Institute of Public Finance Accountants audit programme to review the systems and controls in managing stock held within Stores. The Service uses a software application called Tranman for administering the stores system. Testing also included a review of the security arrangements to safeguard against unauthorised access to the storage areas. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Overall the audit found the stores system to be effectively managed. However, the review has highlighted the following areas for consideration: • It was noted that Tranman has functions and reporting facilities to assist in the effective management of a stores system. However, it was found that no minimum or maximum stock figures have been set against each stock item. The maintenance of stock levels at the appropriate levels is important to ensure the cost effective and efficient delivery of the Service. • It was found that no review to highlight slow moving stock within stores had been undertaken for a number of years. It is appreciated that over the last few years the restrictions to systems and practices due to the pandemic. However, in accordance with good stock management arrangements, a review should now be undertaken of slow moving stock and consideration should be undertaken to whether these items should be sold or disposed. • As part of the audit review, testing was undertaken to verify the average price stock valuation used within Tranman. The majority of individual stock valuations tested were found to be correct. However, it was noted that a minor costing Item 7. Page 63
Page 64
Appendix 4 error occurred when stock items were received and items issued before a revised price was recorded within Tranman. Analysis found that the materiality of the error is low, but revised procedures have now been amended and the software supplier of Tranman advised to develop a solution to resolve the issue. Page 64
Page 65
Appendix 4 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective systems and procedures are operating to ensure accurate records are maintained to account for all stocks held within Environmental & Commercial Services Stores. 5.01 A review should be undertaken of the items stored within the external storage compound and consideration should be given to whether any items could be stored within the internal storage facility for improved security. This includes the copper coil identified during the audit review. Medium Yes High value items including copper coil will be moved within a secure building. Fleet Business Co-ordinator 30/06/2023 5.02 All materials and equipment recorded within Tranman should be updated with minimum and maximum stock levels. This should assist in more effective management of stock levels at the appropriate levels. Medium Yes Minimum and maximum stock levels will be set on the Tranman system. Fleet Business Co-ordinator 31/12/2023 Page 65
Page 66
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.03 Adjustments required to stock figures recorded within Tranman should require the authorisation of the Fleet Business Co- ordinator. Medium Yes Procedure to be amended to ensure that adjustments to Tranman Stock levels are authorised by management. Fleet Business Co-ordinator Implemented. 5.04 Road materials held within the vehicle storage area should be stored more securely with access restricted to authorised officers. Medium Yes A secure area has been created within the roads department storage building. Only Stores staff have access to this. Fleet Business Co-ordinator Implemented. 5.05 Current procedures should be amended to ensure that changes to framework contract prices of stock items are regularly updated within Tranman. Medium Yes Suppliers will be contacted to provide changes in prices. Tranman will Fleet Business Co-ordinator 30/06/2023 Page 66
Page 67
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation then be updated. 5.06 Regular reviews should be undertaken of stores to highlight any slow moving or obsolete stock. Consideration should then be undertaken as to whether any identified items are sold or disposed. Medium Yes An exercise has now begun to identify areas of slow moving or obsolete stock and where required sale or disposal will be arranged. Fleet Business Co-ordinator 30/09/2023 5.07 Requisition notes should only be accepted if completed in full with the individual requesting an item detailing their name, signature and service. Low Yes Reminder given to staff to ensure that requisition notes are fully completed on all occasions. This will be monitored on a regular basis. Fleet Business Co-ordinator On Going Page 67
Page 68
Page 68